ChangeLog 417 KB
Newer Older
Niels Möller's avatar
Niels Möller committed
1 2 3 4
2020-04-29  Niels Möller  <nisse@lysator.liu.se>

	* Released Nettle-3.6.

5 6
2020-04-27  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
7 8 9 10 11
	* configure.ac: Tweak gcc command line options. Delete checks for
	older gcc versions. Add -Wno-sign-compare, since warnings for
	signed/unsigned comparisons adds a lot of noise, in particular
	when building mini-gmp.

12 13 14 15
	* mini-gmp.c: Updated mini-gmp from the gmp repository, latest
	change from 2020-04-20.
	* mini-gmp.h: Likewise.

Niels Möller's avatar
Niels Möller committed
16 17
2020-04-25  Niels Möller  <nisse@lysator.liu.se>

18 19 20 21 22 23
	* gmp-glue.c (mpz_limbs_read, mpz_limbs_write, mpz_limbs_modify)
	(mpz_limbs_finish, mpz_roinit_n): Delete compatibility
	definitions. These functions available in GMP since version 6.0.0.
	* gmp-glue.h: Delete corresponding declarations, and preprocessor
	conditions.

24 25 26 27 28 29 30 31
	* configure.ac: Update required version of GMP to 6.1.0, needed
	for mpn_zero_p.
	* ecc-ecdsa-verify.c (zero_p): Deleted static function, usage
	replaced with mpn_zero_p.
	* testsuite/testutils.c (mpn_zero_p): Delete conditional
	definition.
	* testsuite/testutils.h: Delete corresponding declarations.

Niels Möller's avatar
Niels Möller committed
32 33 34
	* Makefile.in (DISTFILES): Add poly1305-internal.h.
	* testsuite/Makefile.in (DISTFILES): Delete setup-env.

35 36
2020-04-23  Niels Möller  <nisse@lysator.liu.se>

37 38 39 40 41 42 43
	* run-tests: Set WINEPATH, since it appears wine doesn't search
	for dlls in the unix PATH.
	* examples/setup-env: Delete creation of extra dll symlinks.
	* examples/teardown-env: Delete corresponding cleanup.
	* testsuite/setup-env: Deleted file (same symlink creation).
	* testsuite/teardown-env: Delete corresponding cleanup.

44 45 46 47 48
	* testsuite/ecc-add-test.c (test_main): Delete ASSERTs with
	functions pointer comparisons. They provide little value, and fail
	when linking with hogweed.dll on windows.
	* testsuite/ecc-dup-test.c (test_main): Likewise.

49 50 51 52 53 54 55
2020-04-22  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/Makefile.in: Use pattern rules for test executables,
	replacing...
	(test-rules): ...deleted rule.
	* testsuite/.test-rules.make: Deleted file.

Niels Möller's avatar
Niels Möller committed
56 57 58 59 60 61 62
2020-04-21  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* gostdsa-vko.c (gostdsa_vko): New file and function.
	* testsuite/gostdsa-vko-test.c (test_vko): New test.
	* nettle.texinfo (GOSTDSA): Document it.

63 64 65 66 67 68 69 70 71 72 73
2020-04-19  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* gosthash94.h (struct gosthash94_ctx): Rearrange struct to enable
	use of MD_UPDATE macro, in particular, replacing byte count with
	block count and index. Also move buffer last, for consistency with
	other hash functions.
	* gosthash94.c (gosthash94_update_int): Use MD_UPDATE macro.
	(gosthash94_write_digest): Update for block count rather than byte
	count.

74 75 76 77 78 79
2020-04-17  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac (LIBNETTLE_MAJOR): Increase libnettle version
	number to 8.0, for move of internal poly1305 functions.
	(LIBNETTLE_MINOR): Reset to zero.

80 81 82 83 84 85 86 87 88 89
2020-04-15  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* poly1305.h (poly1305_set_key, poly1305_digest, _poly1305_block):
	Removed declarations from this public header file.
	* poly1305-internal.h: New file, with declarations of internal
	poly1305 functions.
	(_poly1305_set_key, _poly1305_digest): Renamed, with leading
	underscore. Updated definitions and all uses.

90 91
2020-04-12  Niels Möller  <nisse@lysator.liu.se>

92 93 94
	* Makefile.in (DISTFILES): Reorder to ensure that generated des
	headers can't be older than desdata.stamp.

95 96 97
	* testsuite/ed448-test.c: Define _GNU_SOURCE, for getline with gcc
	-std=c89.

98 99
2020-04-06  Niels Möller  <nisse@lysator.liu.se>

100 101
	* configure.ac (LIBHOGWEED_MAJOR): Increase libhogweed version
	number to 6.0, at request of Gnutls team.
102 103
	(LIBHOGWEED_MINOR): Reset to zero.

104 105 106 107 108 109
2020-04-01  Niels Möller  <nisse@lysator.liu.se>

	* config.guess: Update to 2020-01-01 version, from savannah's
	config.git.
	* config.sub: Likewise.

110 111
2020-03-31  Niels Möller  <nisse@lysator.liu.se>

112 113 114
	* aclocal.m4 (LSH_TYPE_SOCKLEN_T, LSH_CHECK_KRB_LIB, LSH_LIB_ARGP)
	(LSH_MAKE_CONDITIONAL): Delete unused macros.

115 116 117 118 119 120 121 122 123 124
	* config.make.in (abs_top_builddir, TEST_SHLIB_DIR): New variables.

	* run-tests: Check TEST_SHLIB_DIR, and set up LD_LIBRARY_PATH and
	related member variables.

	* testsuite/Makefile.in (check): Pass only TEST_SHLIB_DIR
	to the run-tests script, and leave setting of LD_LIBRARY_PATH and
	related variables to that script.
	* examples/Makefile.in (check): Likewise.

125 126 127 128 129 130
2020-03-26  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: Bump package version to 3.6.
	(LIBNETTLE_MINOR): Bump minor number, now 7.1.
	(LIBHOGWEED_MINOR): Bump minor numbers, now 5.1

131 132 133 134 135 136 137 138 139 140
2020-03-14  Niels Möller  <nisse@lysator.liu.se>

	From H.J. Lu:
	* configure.ac (ASM_X86_ENDBR)
	(ASM_X86_MARK_CETASM_X86_MARK_CET_ALIGN): New substituted
	variables.
	* config.m4.in: Substituted here. Add ASM_X86_MARK_CET to
	diversion inserted at end of assembly files.
	* asm.m4 (PROLOGUE): Add ASM_X86_ENDBR at entry point.

Niels Möller's avatar
Niels Möller committed
141 142 143 144 145 146 147 148 149 150 151 152 153
2020-03-09  Niels Möller  <nisse@lysator.liu.se>

	From Daiki Ueno:
	* chacha-crypt.c (chacha_crypt32): New function.
	* chacha-set-nonce.c (chacha_set_counter, chacha_set_counter32):
	New functions.
	* chacha.h (CHACHA_COUNTER_SIZE, CHACHA_COUNTER32_SIZE): New constants.
	* chacha-poly1305.c (chacha_poly1305_encrypt)
	(chacha_poly1305_decrypt): Use chacha_crypt32.
	* testsuite/chacha-test.c: Update tests to use new functions.
	* nettle.texinfo: Document new chacha functions, and update
	out-of-date chacha-poly1305 documentation.

Niels Möller's avatar
Niels Möller committed
154 155 156 157 158 159 160 161
2020-03-08  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* cmac-des3-meta.c (nettle_cmac_des): New file, moving definition
	from...
	* testsuite/cmac-test.c: ... old location.
	* nettle-meta.h (nettle_cmac_des): Declare it.

Niels Möller's avatar
Niels Möller committed
162 163 164 165 166 167 168 169 170
2020-02-15  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* ecc-internal.h (ecc_modq_add, ecc_modq_mul, ecc_modp_sqr)
	(ecc_modp_mul, ecc_mod_submul_1, ecc_modp_mul_1, ecc_modp_add)
	(ecc_modp_sub): Deleted macros. Updated callers to use respective
	functions instead.
	(ecc_modp_addmul_1): Delete unused macro.

171 172
2020-02-09  Niels Möller  <nisse@lysator.liu.se>

173 174 175 176
	Addition of struct nettle_mac based on patches by Daiki Ueno.
	* nettle-meta-macs.c (nettle_get_macs): New file, new function.
	* testsuite/meta-mac-test.c: New test.

177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200
	* nettle-meta.h (_NETTLE_HMAC): New macro.
	(nettle_hmac_md5, nettle_hmac_ripemd160, nettle_hmac_sha1)
	(nettle_hmac_sha224, nettle_hmac_sha256, nettle_hmac_sha384)
	(nettle_hmac_sha512): Declare.
	(struct nettle_mac): New public struct,
	* testsuite/testutils.h: ...moved from this file.

	* hmac-md5-meta.c: New file.
	* hmac-ripemd160-meta.c: Likewise.
	* hmac-sha1-meta.c: Likewise.
	* hmac-sha224-meta.c: Likewise.
	* hmac-sha256-meta.c: Likewise.
	* hmac-sha384-meta.c: Likewise.
	* hmac-sha512-meta.c: Likewise.

	* Makefile.in (nettle_SOURCES): Add new files.

	* testsuite/testutils.h (_NETTLE_HMAC): Delete unused version of
	this macro.
	* testsuite/testutils.c (test_mac): Allow testing with smaller
	digest size.
	* testsuite/hmac-test.c (test_main): Use test_mac for tests using
	key size == digest size.

201 202 203 204 205
	* testsuite/cmac-test.c (nettle_cmac_aes128, nettle_cmac_aes256):
	Moved to...
	* cmac-aes128-meta.c: New file.
	* cmac-aes256-meta.c: New file.

206 207 208
	* nettle-meta.h (struct nettle_mac): New public struct,
	* testsuite/testutils.h: ...moved from this file.

Niels Möller's avatar
Niels Möller committed
209 210 211 212 213
2020-02-06  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* gost28147.h: Deleted, move declarations to gost28147-internal.h.

214 215 216 217 218 219 220 221 222
2020-02-05  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: On Solaris, link shared libraries with --shared
	rather than -G. For gcc, --shared is the proper way. For Solaris'
	proprietary cc, according to docs, it accepts --shared as an alias
	for -G since Oracle Solaris Studio 12.4, and it was made more gcc
	compatible in later versions. Since 12.4 was released in 2014,
	don't attempt to cater for older versions.

223 224
2020-01-26  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244
	* ecc-internal.h (struct ecc_curve): Delete g, the curve
	generator, since it was used only by tests. Update all curve
	instances.

	* eccdata.c (output_curve): Delete output of ecc_g.
	(output_point): Delete name argument, and update callers.

	* testsuite/testutils.c (ecc_ref): Table of reference points moved
	out of test_ecc_mul_a. Add generator to the list of points.
	(test_ecc_mul_a): Use ecc_ref table also for the n == 1 case.
	(test_ecc_ga, test_ecc_get_g, test_ecc_get_ga): New functions,
	using the tabulated generator.

	* testsuite/ecc-add-test.c: Use test_ecc_get_g, instead of
	accessing ecc->g.
	* testsuite/ecc-dup-test.c: Likewise.
	* testsuite/ecc-mul-a-test.c: Use test_ecc_get_ga and test_ecc_ga.
	Delete special case for n == 1.
	* testsuite/ecc-mul-g-test.c: Use test_ecc_ga.

Niels Möller's avatar
Niels Möller committed
245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271
	Support for GOST DSA, contributed by Dmitry Baryshkov.
	* gostdsa-verify.c (gostdsa_verify): New file and function.
	* gostdsa-sign.c (gostdsa_sign): New file and function.
	* ecc-gostdsa-verify.c (ecdsa_in_range, ecc_gostdsa_verify_itch)
	(ecc_gostdsa_verify): New file and functions.
	* ecc-gostdsa-sign.c (ecc_gostdsa_sign_itch, ecc_gostdsa_sign):
	New file and functions.
	* ecc-internal.h (ECC_GOSTDSA_SIGN_ITCH): New macro.
	* ecc-hash.c (gost_hash): New function.
	* testsuite/gostdsa-verify-test.c: New test.
	* testsuite/gostdsa-sign-test.c: New test.
	* testsuite/gostdsa-keygen-test.c: New test.
	* testsuite/Makefile.in (TS_HOGWEED_SOURCES): Add new tests.

	Support for GOST gc256b and gc512a curves, contributed by Dmitry
	Baryshkov.
	* eccdata.c (ecc_curve_init): Add parameters for gost_gc256b and
	gost_gc512a.
	* ecc-gost-gc256b.c: New file, define _nettle_gost_gc256b.
	* ecc-gost-gc512a.c: New file, define _nettle_gost_gc512a.
	* Makefile.in: Add rules to generate ecc-gost-gc256b.h and
	ecc-gost-gc512a.h.
	(hogweed_SOURCES): Add ecc-gost-gc256b.c ecc-gost-gc512a.c.
	* examples/ecc-benchmark.c (curves): Add to list.
	* testsuite/testutils.c (ecc_curves): Add to list.
	(test_ecc_mul_a): Reference points for new curves.

272 273
	* NEWS: Started on entries for Nettle-3.6.

274 275 276 277 278
2020-01-25  Niels Möller  <nisse@lysator.liu.se>

	* examples/hogweed-benchmark.c (bench_curve_init): Pass correct
	sizes to knuth_lfib_random. Patch contributed by Dmitry Baryshkov.

279 280
2020-01-15  Niels Möller  <nisse@lysator.liu.se>

281 282 283 284 285 286 287 288 289 290 291 292 293 294
	* Makefile.in: Replace suffix rules by pattern rules. Move .asm
	rule above .c rule, since now the order of rules in the Makefile
	matters, rather than the order in the .SUFFIXES list.
	(aesdata, desdata, twofishdata, shadata, gcmdata, eccparams):
	Individual rules replaced by a pattern rule.
	(eccdata): Add explicit dependencies, to complement the pattern
	rule.
	* examples/Makefile.in: Replace suffix rules by pattern rules.
	* testsuite/Makefile.in: Likewise.
	* tools/Makefile.in: Likewise.

	* config.make.in: Empty .SUFFIXES, to not accidentally use any
	suffix rules.

295 296 297 298 299 300 301 302 303 304
	* aclocal.m4 (DEP_INCLUDE): Delete substituted variable.

	* Makefile.in: Use the GNU make directive -include to include
	dependency .d files. Delete dependency files on make clean.
	* examples/Makefile.in: Likewise.
	* testsuite/Makefile.in: Likewise. Also use $(OBJEXT) properly.
	* tools/Makefile.in: Likewise.

	* configure.ac (dummy-dep-files): Delete these config commands.

305 306 307 308 309 310 311 312 313 314
2020-01-10  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Eremin-Solenikov: Consistently rename ecc files and
	internal functions to include curve name rather than just number
	of bits. E.g.,
	* ecc-256.c (nettle_ecc_256_redc): File and function renamed to...
	* ecc-secp256r1.c (_nettle_ecc_256_redc): ... new names.
	* eccdata.c (ecc_curve_init, main): Take curve name as input, not
	bit size.

315 316 317 318 319 320 321 322 323 324 325 326 327 328
2020-01-03  Niels Möller  <nisse@lysator.liu.se>

	Add benchmarking of ed25519, ed448 and curve448.
	* examples/hogweed-benchmark.c: (struct eddsa_ctx): New struct.
	(bench_eddsa_init, bench_eddsa_sign, bench_eddsa_verify)
	(bench_eddsa_clear): New functions.
	(struct curve_ctx): New struct, generalizing struct curve25519_ctx.
	(bench_curve_init, bench_curve_mul_g, bench_curve_mul)
	(bench_curve_clear): New functions.
	(struct curve25519_ctx, bench_curve25519_mul_g)
	(bench_curve25519_mul, bench_curve25519): Deleted.
	(alg_list): Add eddsa and curve entries.
	(main): Delete call to bench_curve25519.

329 330
2020-01-02  Niels Möller  <nisse@lysator.liu.se>

331 332 333 334 335 336 337 338 339 340 341 342 343
	* eddsa-internal.h (nettle_eddsa_dom_func): New typedef.
	(struct ecc_eddsa): Use function pointer to represent eddsa dom
	string. To avoid calling sha512_update with empty input for
	ed25519.
	* ed448-shake256.c (ed448_dom): New function, calling
	sha3_256_update with the magic dom prefix.
	(_nettle_ed448_shake256): Point to it.
	* ed25519-sha512.c (_nettle_ed25519_sha512): Add do-nothing dom function.

	* eddsa-sign.c (_eddsa_sign): Update to use dom function pointer.
	* eddsa-verify.c (_eddsa_verify): Likewise.

	* eddsa-internal.h (struct ecc_eddsa): Add magic dom string,
344
	needed for ed448.
345 346 347 348 349 350 351 352 353 354 355 356 357 358 359
	* ed25519-sha512.c (_nettle_ed25519_sha512): Empty dom string.
	* ed448-shake256.c (_nettle_ed448_shake256): New file and
	parameter struct.

	* eddsa-hash.c (_eddsa_hash): Add digest_size as input argument.
	Handle ed448 digests with two extra bytes. Update callers.
	* eddsa-verify.c (_eddsa_verify): Hash dom string.
	* eddsa-sign.c (_eddsa_sign_itch): Assert that
	_eddsa_compress_itch isn't too large.
	(_eddsa_sign): New argument k1, with the hash prefix. Add hashing
	of this prefix and the dom string. Update callers. Fix final
	reduction, it's different for ed25519, with q slightly larger than
	a power of two, and ed448, with q slightly smaller.
	* eddsa-pubkey.c (_eddsa_public_key_itch): Assert that
	_eddsa_compress_itch isn't too large.
360

Niels Möller's avatar
Niels Möller committed
361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377
	Implementation of ed448-shake256, based on patch by Daiki Ueno.
	* ed448-shake256-pubkey.c (ed448_shake256_public_key): New file
	and function.
	* ed448-shake256-sign.c (ed448_shake256_sign): New file and function.
	* ed448-shake256-verify.c (ed448_shake256_verify): New file and function.

	* Makefile.in (hogweed_SOURCES): Add new ed448 files.

	* testsuite/eddsa-verify-test.c (test_ed448): New function.
	(test_main): New ed448 tests.
	* testsuite/eddsa-sign-test.c (test_ed448_sign): New function.
	(test_main): New ed448 tests.
	* testsuite/ed448-test.c: New tests.
	* testsuite/Makefile.in (TS_HOGWEED_SOURCES): Add ed448-test.c.

	* nettle.texinfo (Curve 25519 and Curve 448): Document ed448.

378 379
2020-01-01  Niels Möller  <nisse@lysator.liu.se>

380 381 382 383 384 385 386
	* ecc-448.c (ecc_mod_pow_2kp1): New function.
	(ecc_mod_pow_446m224m1): Reduce scratch usage from 6*n to 5*n, at
	the cost of one copy operation. Also use ecc_mod_pow_2kp1 where
	applicable.
	(ECC_448_INV_ITCH): Reduce to 5*ECC_LIMB_SIZE.
	(ECC_448_SQRT_ITCH): Reduce to 9*ECC_LIMB_SIZE.

387 388
	* testsuite/eddsa-compress-test.c: Test also with curve448.

389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409
2019-12-30  Niels Möller  <nisse@lysator.liu.se>

	Preparation for ed448, based on patch by Daiki Ueno.
	* eddsa-internal.h (struct ecc_eddsa): New struct for eddsa
	parameters.
	* ed25519-sha512.c (_nettle_ed25519_sha512): New parameter struct.
	* eddsa-expand.c (_eddsa_expand_key): Replace input
	struct nettle_hash with struct ecc_eddsa, and generalize for
	ed448. Update all callers.
	* eddsa-sign.c (_eddsa_sign): Likewise.
	* eddsa-verify.c (_eddsa_verify): Likewise.
	* eddsa-compress.c (_eddsa_compress): Store sign bit in most
	significant bit of last byte, as specified by RFC 8032.
	* eddsa-decompress.c (_eddsa_decompress): Corresponding update.
	Also generalize to support ed448, and make validity checks
	stricter.
	* testsuite/eddsa-sign-test.c (test_ed25519_sign): New function.
	(test_main): Use it.
	* testsuite/eddsa-verify-test.c (test_ed25519): New function.
	(test_main): Use it.

410 411
2019-12-28  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
412
	* bignum.h: Drop unrelated include of nettle-meta.h.
413 414 415
	* pss.h: Include nettle-meta.h explicitly.
	* eddsa-internal.h: Likewise.

416 417
2019-12-25  Niels Möller  <nisse@lysator.liu.se>

418 419 420 421 422 423 424 425
	Support for SHAKE256, based on patch by Daiki Ueno.
	* shake256.c (sha3_256_shake): New file and function.
	* Makefile.in (nettle_SOURCES): Add shake256.c.
	* testsuite/testutils.c (test_hash): Allow arbitrary digest size,
	if hash->digest_size == 0.
	* testsuite/shake.awk: New script to extract test vectors.
	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Add shake256-test.c.
	(DISTFILES): Add shake.awk.
Niels Möller's avatar
Niels Möller committed
426
	* nettle.texinfo (Recommended hash functions): Document SHAKE-256.
427

428 429 430 431 432 433
	* sha3.c (_sha3_pad): Generalized with an argument for the magic
	suffix defining the sha3 instance.
	* sha3-internal.h (_sha3_pad_hash): New macro, for SHA3 hashes.
	Updated all callers of _sha3_pad.
	(_sha3_pad_shake): New macro, using the SHAKE magic byte 0x1f.

434 435 436 437 438 439 440 441
2019-12-19  Niels Möller  <nisse@lysator.liu.se>

	* ecc-mul-a-eh.c (ecc_mul_a_eh) [ECC_MUL_A_EH_WBITS == 0]: Use
	add_hh rather than add_hhh.
	(table_init) [[ECC_MUL_A_EH_WBITS > 0]: Likewise.
	* ecc-internal.h (ECC_MUL_A_EH_ITCH) [ECC_MUL_A_EH_WBITS == 0]:
	Reduced from 13*n to 12*n.

442 443
2019-12-18  Niels Möller  <nisse@lysator.liu.se>

444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463
	Rename add and dup functions for Edwards curves.
	* ecc-dup-th.c (ecc_dup_th): New file, move and rename ecc_dup_eh.
	* ecc-add-th.c (ecc_add_th): New file, move and rename ecc_add_eh.
	* ecc-add-thh.c (ecc_add_thh): New file, move and rename
	ecc_add_ehh.
	* ecc-dup-eh.c (ecc_dup_eh_untwisted): Rename to just ecc_dup_eh.
	* ecc-add-eh.c (ecc_add_ehh_untwisted): Rename to just ecc_add_eh.
	* ecc-add-ehh.c (ecc_add_ehh_untwisted): Rename to just ecc_add_ehh.
	* ecc-internal.h (ecc_dup_th, ecc_add_th, ecc_add_thh): Declare
	new functions, delete declarations of ecc_*_untwisted variants.
	(ECC_DUP_TH_ITCH, ECC_ADD_TH_ITCH, ECC_ADD_THH_ITCH): New macros.
	* ecc-25519.c (_nettle_curve25519): Update, use ecc_dup_th and
	friends.
	* ecc-448.c (_nettle_curve448): Update for rename, without
	_untwisted suffix.
	* Makefile.in (hogweed_SOURCES): Added ecc-dup-th.c, ecc-add-th.c,
	and ecc-add-thh.c
	* testsuite/ecc-dup-test.c (test_main): Update asserts.
	* testsuite/ecc-add-test.c (test_main): Likewise.

464 465 466
	* eddsa-verify.c (_eddsa_verify): Use function pointer rather than
	calling ecc_add_eh directly. Preparation for eddsa over curve448.

467 468 469 470 471 472 473 474 475 476 477
2019-12-17  Niels Möller  <nisse@lysator.liu.se>

	* examples/ecc-benchmark.c (bench_dup_hh): Rename, and use
	ecc->dup pointer.
	(bench_dup_jj): ... old name.
	(bench_add_hh): Rename, and use ecc->addd_hh pointer.
	(bench_add_jja): ... old name.
	(bench_dup_eh, bench_add_eh): Deleted.
	(bench_curve): Update, and delete curve25519 special case.
	(main): Update table headers accordingly.

478 479 480 481
2019-12-15  Niels Möller  <nisse@lysator.liu.se>

	* ecc-dup-eh.c (ecc_dup_eh): Eliminate one unneeded ecc_modp_add.

Niels Möller's avatar
Niels Möller committed
482 483 484 485 486 487 488 489 490 491 492 493
2019-12-14  Niels Möller  <nisse@lysator.liu.se>

	* ecc-mul-m.c (ecc_mul_m): New file and function. Implements
	multipliction for curves in Montgomery representation, as used for
	curve25519 and curve448. Extracted from curve25519_mul.
	* ecc-internal.h (ecc_mul_m): Declare.
	(ECC_MUL_M_ITCH): New macro.
	* Makefile.in (hogweed_SOURCES): Add ecc-mul-m.c.

	* curve25519-mul.c (curve25519_mul): Use ecc_mul_m.
	* curve448-mul.c (curve448_mul): Likewise.

494 495 496 497
2019-12-13  Niels Möller  <nisse@lysator.liu.se>

	* Merge curve448 implementation.

498 499
2019-12-09  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
500 501 502 503 504 505
	* ecc-internal.h: Revert itch macro changes. We now have
	h_to_a_itch <= mul_itch, mul_g_itch. Add asserts at a few places
	relying on this.
	(ECC_ECDSA_KEYGEN_ITCH, ECC_MAX): Delete macros.
	(ECC_ECDSA_SIGN_ITCH): Revert previous change.

506 507 508 509 510
	* ecc-448.c (ecc_mod_pow_446m224m1): Reduce scratch space from 9*n
	to 6*n.
	(ECC_448_INV_ITCH, ECC_448_SQRT_ITCH): Reduce accordingly.
	* curve448-mul.c (curve448_mul): Reduce allocation from 14*n to 12*n.

511 512 513 514 515 516 517 518 519
2019-12-08  Niels Möller  <nisse@lysator.liu.se>

	* x86_64/ecc-curve448-modp.asm (nettle_ecc_curve448_modp): New
	assembly function.
	* ecc-448.c (ecc_448_modp) [HAVE_NATIVE_ecc_curve448_modp]: Use
	native nettle_ecc_curve448_modp if available.
	* configure.ac (asm_hogweed_optional_list): Add ecc-curve448-modp.asm.
	(HAVE_NATIVE_ecc_curve448_modp): New config.h define.

520 521 522 523
2019-12-03  Niels Möller  <nisse@lysator.liu.se>

	* ecc-448.c (ecc_448_modp) [GMP_NUMB_BITS == 64]: New function.

Niels Möller's avatar
Niels Möller committed
524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578
2019-12-01  Niels Möller  <nisse@lysator.liu.se>

	Curve 448 support contributed by Daiki Ueno.
	* eccdata.c (enum ecc_type): Add ECC_TYPE_EDWARDS.
	(ecc_add): Support untwisted edwards curves.
	(ecc_curve_init): Add curve448 parameters.
	* ecc-internal.h (ECC_ECDSA_KEYGEN_ITCH): New macro.
	(ECC_ECDSA_SIGN_ITCH): Increased from 12*size to 13*size.
	(ECC_MAX): New macro.
	* ecc-448.c: New file.
	(ecc_mod_pow_2k, ecc_mod_pow_446m224m1, ecc_448_inv)
	(ecc_448_zero_p, ecc_448_sqrt): New functions.
	(_nettle_curve448): New curve definition.
	* curve448.h (CURVE448_SIZE): New constant.
	(curve448_mul_g, curve448_mul): Declare new public functions.
	* ecc-eh-to-a.c (ecc_eh_to_a): Update assert to allow the curve448
	Edwards curve.
	* curve448-mul.c (curve448_mul): New file and function.
	* curve448-mul-g.c (curve448_mul_g): New file and function.
	* curve448-eh-to-x.c (curve448_eh_to_x): New file and function.
	* ecc-dup-eh.c (ecc_dup_eh_untwisted): New function.
	* ecc-add-ehh.c (ecc_add_ehh_untwisted): New function.
	* ecc-add-eh.c (ecc_add_eh_untwisted): New function.
	* ecc-point.c (ecc_point_set): Add point validation for curve448.
	* ecc-point-mul.c (ecc_point_mul): Allow h_to_a_itch larger than
	mul_itch.
	* ecc-point-mul-g.c (ecc_point_mul_g): Allow h_to_a_itch
	larger than mul_g_itch. Switch from TMP_DECL/_ALLOC/_FREE to
	gmp_alloc_limbs/gmp_free_limbs.
	* ecdsa-keygen.c (ecdsa_generate_keypair): Use
	ECC_ECDSA_KEYGEN_ITCH.
	* Makefile.in (hogweed_SOURCES): Add ecc-448.c, curve448-mul-g.c,
	curve448-mul.c, and curve448-eh-to-x.c.
	(HEADERS): Add curve448.h.
	(ecc-448.h): New generated file.

	* testsuite/testutils.c (ecc_curves): Add _nettle_curve448 to list
	of tested curves.
	(test_ecc_mul_a): Add curve448.
	* testsuite/ecdsa-keygen-test.c (ecc_valid_p): Add curve448 support.
	* testsuite/ecdh-test.c (test_main): Add tests for (non-standard)
	curve448 diffie-hellman.
	* testsuite/ecc-add-test.c (test_main): Update for testing of curve448.
	* testsuite/ecc-dup-test.c (test_main): Likewise.
	* testsuite/ecc-mul-a-test.c (test_main): Likewise. Also increase
	scratch allocation for h_to_a_itch.
	* testsuite/ecc-mul-g-test.c (test_main): Likewise.
	* testsuite/curve448-dh-test.c: Test for curve448.
	* testsuite/Makefile.in (TS_HOGWEED_SOURCES): Add curve448-dh-test.c.

	* examples/ecc-benchmark.c: Add curve448 to list of benchmarked
	curves.

	* nettle.texinfo (Curve 25519 and Curve 448): Add docs.

579 580 581 582 583 584 585 586 587 588
2019-12-07  Niels Möller  <nisse@lysator.liu.se>

	* ecc-eh-to-a.c (ecc_eh_to_a): Require op == 0, delete code only
	used for non-standard ecdsa over curve25519.
	* testsuite/ecdsa-sign-test.c (test_main): Delete test of ecdsa
	over curve25519.
	* testsuite/ecdsa-verify-test.c (test_main): Likewise.
	* testsuite/ecdsa-keygen-test.c (test_main): Exclude curve25519
	from test.

589 590 591 592 593 594 595
2019-12-05  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: Use AC_TRY_LINK rather than AC_TRY_COMPILE to
	check for __builtin_bswap64. Since calling an non-existing
	function typically results in a warning only at compile time, but
	fails at link time. Patch contributed by by George Koehler.

Niels Möller's avatar
Niels Möller committed
596 597 598 599 600
2019-12-04  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/testutils.c (test_cipher_cfb8): Add cast of size_t to
	unsigned long for argument to fprintf.

601 602
2019-11-21  Niels Möller  <nisse@lysator.liu.se>

603 604 605 606 607 608 609
	* eccdata.c (ecc_curve_init_str): Delete unused t and d arguments.
	Related to the the edwards_root member of struct ecc_curve, which
	was used by ecc_a_to_eh before it was deleted, see 2014-09-17
	entry below.
	(ecc_curve_init): Delete corresponding curve25519 constants, and
	NULL arguments passed for the other curves.

610 611
	* Merge curve448 preparations, from September 2017.

612 613
2017-09-23  Niels Möller  <nisse@lysator.liu.se>

614 615 616 617 618 619
	* eccdata.c: Reorganize curve25519 precomputation to work directly
	with the twisted Edwards curve, with new point addition based on a
	patch from Daiki Ueno.
	* ecc-25519.c (_nettle_curve25519): Update for removed Montgomery
	curve constant.

620 621 622 623
	* ecc-internal.h (struct ecc_curve): Delete unused pointer
	edwards_root. Update all instances.
	* eccdata.c (output_curve): Don't output it.

624 625
	* testsuite/ecc-add-test.c (test_main): Reduce test duplication.
	Use ecc->add_hhh_itch.
626 627
	* testsuite/ecc-dup-test.c (test_main): Reduce test duplication.
	Use ecc->dup_itch.
628

629 630
2017-09-23  Daiki Ueno  <dueno@redhat.com>

631 632 633 634
	* ecc-eh-to-a.c (ecc_eh_to_a): Use ecc->q.bit_size, instead of
	hard-coded value for curve25519.
	* eddsa-sign.c (_eddsa_sign): Likewise.

635 636 637 638 639 640 641 642 643 644 645
	* ecc-internal.h (ecc_dup_func): New typedef.
	(struct ecc_curve): New constants add_hh_itch and dup_itch, new
	function pointers add_hh and dup.
	* ecc-192.c, ecc-224.c, ecc-256.c, ecc-384.c, ecc-521.c,
	ecc-25519.c: Update accordingly.
	* ecc-mul-g-eh.c (ecc_mul_g_eh): Use new function pointers.
	* ecc-mul-a-eh.c (ecc_mul_a_eh, table_init, ecc_mul_a_eh):
	Likewise.
	* testsuite/ecc-dup-test.c (test_main): Likewise.
	* testsuite/ecc-add-test.c (test_main): Likewise.

Niels Möller's avatar
Niels Möller committed
646 647
2019-10-01  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
648 649 650
	* testsuite/testutils.c (test_cipher_cfb8): Reset destination area
	between tests. Encrypt/decrypt final partial block.

Niels Möller's avatar
Niels Möller committed
651 652 653 654 655 656
	From Daiki Ueno, fixing bug reported by Stephan Mueller:
	* cfb.c (cfb8_decrypt): Don't truncate output IV if input is
	shorter than block size.
	* testsuite/testutils.c (test_cipher_cfb8): Test splitting input
	into multiple calls to cfb8_encrypt and cfb8_decrypt.

657 658 659
2019-09-30  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/siv-test.c (test_cipher_siv): Fix out-of-bounds read.
660 661 662
	Trim allocation size for de_data, drop some uses of
	SIV_DIGEST_SIZE, call FAIL for unexpected returned values.
	(test_compare_results): Delete digest argument.
663

664 665
2019-09-15  Niels Möller  <nisse@lysator.liu.se>

666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688
	From Dmitry Eremin-Solenikov:
	* gost28147.c (_gost28147_encrypt_block): New file, encrypt
	function and sbox tables moved here.
	* gosthash94.c: Update functions to take sbox array as argument.
	(gost_block_compress): Use _gost28147_encrypt_block.
	(gosthash94cp_update,gosthash94cp_digest): New functions.
	* gost28147-internal.h: New file.
	* gost28147.h: New file.
	* gosthash94-meta.c (nettle_gosthash94cp): New hash algorithm.
	* nettle-meta-hashes.c (_nettle_hashes): Add nettle_gosthash94 and
	nettle_gosthash94cp.
	* hmac-gosthash94.c (hmac_gosthash94_set_key)
	(hmac_gosthash94_update, hmac_gosthash94_digest)
	(hmac_gosthash94cp_set_key, hmac_gosthash94cp_update)
	(hmac_gosthash94cp_digest): New file and functions.
	* pbkdf2-hmac-gosthash94.c (pbkdf2_hmac_gosthash94cp): New file
	and function.
	* testsuite/pbkdf2-test.c (test_main): Add
	pbkdf2-hmac-gosthash94cp tests.
	* testsuite/hmac-test.c (test_main): Add hmac-gosthash94 tests.
	* testsuite/gosthash94-test.c (test_main): Add gosthash94cp tests.
	* nettle.texinfo (Legacy hash functions): Document gosthash94cp.

689 690
	* testsuite/dlopen-test.c (main): Use libnettle.dylib on MacOS.

691 692
2019-07-08  Niels Möller  <nisse@lysator.liu.se>

693
	* nettle-types.h (union nettle_block16): Mark w member as deprecated.
694
	* eax.c (block16_xor): Use uint64_t member of nettle_block16.
695
	* gcm.c (gcm_gf_add, gcm_gf_shift, gcm_gf_shift_8): Likewise.
696

Niels Möller's avatar
Niels Möller committed
697 698 699 700 701
2019-07-10  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Eremin-Solenikov:
	* cmac64.c (_cmac64_block_mulx, cmac64_set_key, cmac64_init)
	(cmac64_update, cmac64_digest): New file, new functions.
Niels Möller's avatar
Niels Möller committed
702 703 704 705 706
	* cmac-des3.c (cmac_des3_set_key, cmac_des3_update)
	(cmac_des3_digest): New file, new functions.
	* cmac.h: Add cmac64 and cmac_des3 declarations.
	* Makefile.in (nettle_SOURCES): Add cmac64.c and cmac-des3.c.
	* testsuite/cmac-test.c (test_main): Add tests for cmac_des3.
Niels Möller's avatar
Niels Möller committed
707

Niels Möller's avatar
Niels Möller committed
708 709 710 711 712 713 714 715
2019-07-02  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Eremin-Solenikov:
	* testsuite/testutils.c (test_mac): New function.
	* testsuite/cmac-test.c (nettle_cmac_aes128, nettle_cmac_aes256):
	New algorithm structs.
	(test_cmac_aes128, test_cmac_aes256): Use test_mac.

716 717
2019-06-06  Niels Möller  <nisse@lysator.liu.se>

718
	Update for cmac changes, enabling const for the _message functions.
719 720 721 722 723 724 725 726 727 728 729 730 731 732 733
	* siv-cmac.c (_siv_s2v): Take a const struct cmac128_key as argument,
	and use a local struct cmac128_ctx for message-specific state.
	(siv_cmac_set_key): Take a struct cmac128_key as argument. Updated
	callers.
	(siv_cmac_encrypt_message, siv_cmac_decrypt_message): Take a const
	struct cmac128_key as argument. Updated callers.

	* siv-cmac.h (SIV_CMAC_CTX): Changed to use struct cmac128_key
	rather than struct cmac128_ctx.

	* siv-cmac-aes256.c (siv_cmac_aes256_encrypt_message)
	(siv_cmac_aes256_decrypt_message): Likewise.
	* siv-cmac-aes128.c (siv_cmac_aes128_encrypt_message)
	(siv_cmac_aes128_decrypt_message): The ctx argument made const.

734 735
2019-05-15  Niels Möller  <nisse@lysator.liu.se>

736 737 738 739
	* siv-cmac.h (SIV_CMAC_AES128_KEY_SIZE, SIV_CMAC_AES256_KEY_SIZE):
	New constants.
	* testsuite/siv-test.c: Simplify tests a little.

740 741 742 743
	* siv-cmac.h (SIV_MIN_NONCE_SIZE): New constant, 1.
	* siv-cmac.c (_siv_s2v): Require non-empty nonce.
	* nettle.texinfo (SIV-CMAC): Update documentation.

744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765
2019-05-06  Niels Möller  <nisse@lysator.liu.se>

	SIV-CMAC mode, based on patch by Nikos Mavrogiannopoulos:
	* siv-cmac.h (SIV_BLOCK_SIZE, SIV_DIGEST_SIZE): New constants.
	(SIV_CMAC_CTX): New macro.
	(struct siv_cmac_aes128_ctx, struct siv_cmac_aes256_ctx): New
	context structs.
	* siv-cmac.c (_siv_s2v, siv_cmac_set_key)
	(siv_cmac_encrypt_message)
	(siv_cmac_decrypt_message): New file, new functions.
	* siv-cmac-aes128.c (siv_cmac_aes128_set_key)
	(siv_cmac_aes128_encrypt_message)
	(siv_cmac_aes128_decrypt_message): New file, new functions.
	* siv-cmac-aes256.c (siv_cmac_aes256_set_key)
	(siv_cmac_aes256_encrypt_message)
	(siv_cmac_aes256_decrypt_message): New file, new functions.
	* Makefile.in (nettle_SOURCES): Add siv-cmac source files.
	(HEADERS): Add siv-cmac.h.
	* testsuite/siv-test.c: New file.
	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Added siv-test.c
	* nettle.texinfo (SIV-CMAC): Documentation.

766 767 768 769 770 771 772 773
2019-04-30  Niels Möller  <nisse@lysator.liu.se>

	Based on a patch contributed by Nikos Mavrogiannopoulos.
	* cmac.c (_cmac128_block_mulx): Renamed function...
	(block_mulx): ... from old name.
	* cmac-internal.h (_cmac128_block_mulx): New file, declare function.
	* Makefile.in (DISTFILES): Added cmac-internal.h.

774 775
2019-06-26  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
776 777 778 779 780 781 782
	* Released nettle-3.5.1.

	* configure.ac: Update version number to 3.5.1.

	* Makefile.in (distdir): Add x86_64/sha_ni to list of distributed
	directories.

783 784
	* Released nettle-3.5.

785 786 787 788 789 790 791
2019-06-25  Niels Möller  <nisse@lysator.liu.se>

	* config.sub: Update to 2019-05-23 version, from savannah's
	config.git.
	* config.guess: Update to 2019-06-10 version, from savannah's
	config.git. Adds recognition of mips R6 and riscv.

792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808
2019-06-05  Niels Möller  <nisse@lysator.liu.se>

	Further separation of CMAC per-message state from the
	message-independent subkeys, analogous to the gcm implementation.
	* cmac.h (struct cmac128_ctx): Remove key, instead a struct
	cmac128_key should be passed separately to functions that need it.
	(CMAC128_CTX): Include both a struct cmac128_key and a struct
	cmac128_ctx.
	(CMAC128_SET_KEY, CMAC128_DIGEST): Updated accordingly.

	* cmac.c (cmac128_set_key): Change argument type from cmac128_ctx
	to cmac128_key. Use a nettle_block16 for the constant zero block.
	(cmac128_init): New function, to initialize a cmac128_ctx.
	(cmac128_digest): Add cmac128_key argument. Move padding memset
	into the block handling a partial block. Call cmac128_init to
	reset state.

Niels Möller's avatar
Niels Möller committed
809 810 811 812 813 814
2019-06-01  Niels Möller  <nisse@lysator.liu.se>

	* cmac.h (struct cmac128_key): New struct.
	* cmac.h (struct cmac128_ctx): Use struct cmac128_key.
	* cmac.c (cmac128_set_key, cmac128_digest): Update accordingly.

815 816 817 818 819 820 821 822
2019-05-12  Niels Möller  <nisse@lysator.liu.se>

	Delete old libdes/openssl compatibility interface.
	* des-compat.c: Delete file.
	* des-compat.h: Delete file.
	* testsuite/des-compat-test.c: Delete file.
	* nettle.texinfo (Compatibility functions): Delete mention in documentation.

Niels Möller's avatar
Niels Möller committed
823 824 825 826
2019-05-11  Niels Möller  <nisse@lysator.liu.se>

	* NEWS: More updates for Nettle-3.5.

827 828 829 830 831 832 833
2019-04-27  Niels Möller  <nisse@lysator.liu.se>

	From Simo Sorce:
	* x86_64/poly1305-internal.asm: Add missing EPILOGUE.
	* x86_64/serpent-decrypt.asm: Likewise.
	* x86_64/serpent-encrypt.asm: Likewise.

834 835 836 837
2019-04-14  Niels Möller  <nisse@lysator.liu.se>

	* tools/nettle-pbkdf2.c (main): Check strdup return value.

838 839 840 841 842 843 844 845 846
2019-03-29  Niels Möller  <nisse@lysator.liu.se>

	* aes.h (struct aes_ctx): Redefine using a union of key-size
	specific contexts.
	* aes-decrypt.c (aes_decrypt): Use switch on key_size.
	* aes-encrypt.c (aes_encrypt): Likewise.
	* aes-set-decrypt-key.c (aes_invert_key): Likewise.
	* aes-set-encrypt-key.c (aes_set_encrypt_key): Likewise.

847 848 849 850 851 852 853
2019-03-27  Niels Möller  <nisse@lysator.liu.se>

	* xts.c (xts_shift): Arrange with a single write to u64[1].
	* cmac.c (block_mulx): Rewrite to work in the same way as
	xts_shift, with 64-bit operations. XTS and CMAC use opposite
	endianness, but otherwise, these two functions are identical.

854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873
2019-03-24  Niels Möller  <nisse@lysator.liu.se>

	From Simo Sorce:
	* xts.h: New file.
	* xts.c: New file.
	(BE_SHIFT): New macro.
	(xts_shift, check_length, xts_encrypt_message)
	(xts_decrypt_message): New functions.
	* xts-aes128.c (xts_aes128_set_encrypt_key)
	(xts_aes128_set_decrypt_key, xts_aes128_encrypt_message)
	(xts_aes128_decrypt_message): New file, new functions.
	* xts-aes256.c (xts_aes256_set_encrypt_key)
	(xts_aes256_set_decrypt_key, xts_aes256_encrypt_message)
	(xts_aes256_decrypt_message): New file, new functions.
	* nettle.texinfo (XTS): Document XTS mode.
	* Makefile.in (nettle_SOURCES): Add xts sourcce files.
	(HEADERS): New installed header xts.h.
	* testsuite/xts-test.c: New file.
	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Add xts-test.c.

874 875 876 877 878 879 880 881 882 883 884
2019-02-06  Niels Möller  <nisse@lysator.liu.se>

	* gosthash94.h (struct gosthash94_ctx): Move block buffer last in
	struct.
	* md2.h (struct md2_ctx): Likewise.
	* md4.h (struct md4_ctx): Likewise.
	* md5.h (struct md5_ctx): Likewise.
	* ripemd160.h (struct ripemd160_ctx): Likewise.
	* sha1.h (struct sha1_ctx): Likewise.
	* sha2.h (struct sha256_ctx, struct sha512_ctx): Likewise.

885 886
2019-01-19  Niels Möller  <nisse@lysator.liu.se>

887 888 889
	* examples/Makefile.in (TARGETS): Delete eratosthenes, left over
	from earlier change.

890 891
	* fat-arm.c: Fix declarations of chacha_core functions.

892 893 894 895 896 897 898 899 900
	From Yuriy M. Kaminskiy:
	* fat-setup.h (chacha_core_func): New typedef.
	* fat-arm.c (fat_init): Enable choice between
	_nettle_chacha_core_c and _nettle_chacha_core_neon.
	* configure.ac (asm_nettle_optional_list): Add
	chacha-core-internal-2.asm.
	* chacha-core-internal.c: Enable fat build with C and asm version.
	* arm/fat/chacha-core-internal-2.asm: New file.

Niels Möller's avatar
Niels Möller committed
901 902 903 904 905
2019-01-12  Niels Möller  <nisse@lysator.liu.se>

	* examples/eratosthenes.c: Deleted program.
	* examples/Makefile.in: Delete rule to build and distribute it.

906 907 908 909 910
2019-01-10  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/rsa-compute-root-test.c (test_one): Use %u and
	corresponding cast, when printing bit sizes.

911 912 913 914 915
2019-01-09  Niels Möller  <nisse@lysator.liu.se>

	* examples/nettle-benchmark.c (GET_CYCLE_COUNTER): Add volatile to
	inline asm.

916 917 918 919
2019-01-08  Niels Möller  <nisse@lysator.liu.se>

	* sha512-compress.c: Add missing include of sha2-internal.h.

920 921 922 923 924
2019-01-06  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/rsa-compute-root-test.c (generate_keypair): Fix assert
	call with side-effects.

Niels Möller's avatar
Niels Möller committed
925 926 927 928 929 930 931 932 933 934
2019-01-06  Niels Möller  <nisse@lysator.liu.se>

	* nettle-types.h: Don't use nettle-stdint.h, include <stdint.h>
	directly.
	* nettle-write.h: Likewise.
	* configure.ac: Delete use of AX_CREATE_STDINT_H.
	* aclocal.m4 (AX_CREATE_STDINT_H): Delete.
	* Makefile.in (INSTALL_HEADERS, distclean-here): Delete mention of
	nettle-stdint.h.

935 936
2018-12-26  Niels Möller  <nisse@lysator.liu.se>

937 938 939 940 941
	* examples/hogweed-benchmark.c (make_openssl_rsa_ctx): New helper
	function. Call openssl's RSA_generate_key_ex rather then the
	deprecated RSA_generate_key.
	(bench_openssl_rsa_init, bench_openssl_rsa_tr_init): Use it.

942 943 944 945
	* eccdata.c (ecc_pippenger_precompute): Check that table size is
	at least 2. Intended to silence warning from the clang static
	analyzer.

946 947 948 949 950
	* configure.ac: Bump package version to 3.5.
	(LIBNETTLE_MAJOR): Bump major number, now 7.
	(LIBHOGWEED_MAJOR): Bump major number, now 5.
	(LIBNETTLE_MINOR, LIBHOGWEED_MINOR): Reset to zero.

951 952 953 954 955 956 957 958 959 960
	* pkcs1-internal.h: New header file, moved declarations of
	_pkcs1_sec_decrypt and _pkcs1_sec_decrypt_variable here.
	* rsa-internal.h: ... old location.
	* Makefile.in (DISTFILES): Added pkcs1-internal.h.
	* pkcs1-decrypt.c: Include new file.
	* pkcs1-sec-decrypt.c: Likewise.
	* rsa-decrypt-tr.c: Likewise.
	* rsa-sec-decrypt.c: Likewise.
	* testsuite/pkcs1-sec-decrypt-test.c: Likewise.

961 962 963 964 965
	* tools/nettle-pbkdf2.c: Add #define _GNU_SOURCE, needed for
	strdup with gcc -std=c89.
	* testsuite/ed25519-test.c: Add #define _GNU_SOURCE, needed for
	getline with gcc -std=c89.

966 967 968 969
	* rsa-sign-tr.c (sec_equal): Fix accidental use of C99 for loop.
	Reported by Andreas Gustafsson.
	* testsuite/rsa-sec-decrypt-test.c (test_main): Likewise.

Niels Möller's avatar
Niels Möller committed
970 971 972 973
2018-12-04  Niels Möller  <nisse@lysator.liu.se>

	* Released nettle-3.4.1.

974 975
2018-11-28  Niels Möller  <nisse@lysator.liu.se>

976 977 978
	* configure.ac: Update GMP check. Check for the function
	mpn_sec_div_r, available since GMP-6.0.0.

979 980 981 982 983 984 985 986
	* testsuite/rsa-encrypt-test.c (test_main): Fix allocation of
	decrypted storage. Update test of rsa_decrypt, to allow clobbering
	of all of the passed in message area.

	* pkcs1-decrypt.c (pkcs1_decrypt): Rewrite as a wrapper around
	_pkcs1_sec_decrypt_variable. Improves side-channel silence of the
	only caller, rsa_decrypt.

987 988 989
	* Makefile.in (DISTFILES): Add rsa-internal.h, needed for make
	dist. Patch from Simo Sorce.

990 991
	* rsa-internal.h: Add include of rsa.h.

992 993 994 995 996 997 998
2018-11-27  Niels Möller  <nisse@lysator.liu.se>

	* rsa-sec-compute-root.c (sec_mul, sec_mod_mul, sec_powm): New
	local helper functions, with their own itch functions.
	(_rsa_sec_compute_root_itch, _rsa_sec_compute_root): Rewrote to
	use helpers, for clarity.

999 1000 1001 1002 1003 1004 1005
2018-11-26  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/rsa-compute-root-test.c (generate_keypair): Simplify
	selection of psize and qsize, and fix so that qsize is used.
	(test_main): Add outer loop, to test with more than one key.
	Deallocate storage before exiting.

1006 1007
2018-11-25  Niels Möller  <nisse@lysator.liu.se>

1008 1009 1010
	* testsuite/rsa-compute-root-test.c: Renamed, from ...
	* testsuite/rsa-sec-compute-root-test.c: ... old name.

1011 1012
	* rsa.h (rsa_sec_compute_root_tr): Deleted declaration, moved to ...
	* rsa-internal.h (_rsa_sec_compute_root_tr): ... new location.
1013 1014 1015
	* rsa-sign-tr.c (_rsa_sec_compute_root_tr): Renamed, from...
	(rsa_sec_compute_root_tr): ... old name. Updated callers.
	(cnd_mpn_zero): Use a volatile-declared mask variable.
1016

1017 1018 1019
	* testsuite/testutils.c (mpz_urandomb) [NETTLE_USE_MINI_GMP]: Fix
	masking of most significant bits.

1020 1021 1022
	* rsa-decrypt-tr.c (rsa_decrypt_tr): Use
	NETTLE_OCTET_SIZE_TO_LIMB_SIZE.

1023 1024 1025 1026
	* testsuite/rsa-sec-decrypt-test.c (rsa_decrypt_for_test): Tweak
	valgrind marking, and document potential leakage of lowest and
	highest bits of p and q.

1027 1028 1029 1030
	* rsa-sec-compute-root.c (_rsa_sec_compute_root): Avoid calls to
	mpz_sizeinbase, since that potentially leaks most significant bits
	of private key parameters a and b.

1031 1032 1033
	* testsuite/pkcs1-sec-decrypt-test.c (pkcs1_decrypt_for_test): Fix
	valgrind marking of return value.

1034 1035 1036
	Merged below changes from Simo Sorce, to make RSA private key
	operations side-channel silent.

1037 1038 1039 1040
2018-11-08  Simo Sorce  <simo@redhat.com>

	* rsa-sign.c (rsa_compute_root) [!NETTLE_USE_MINI_GMP]: Use
	_rsa_sec_compute_root.
Niels Möller's avatar
Niels Möller committed
1041

Niels Möller's avatar
Niels Möller committed
1042 1043 1044
	* testsuite/rsa-sec-compute-root-test.c: Add more tests for new
	side-channel silent functions.

Niels Möller's avatar
Niels Möller committed
1045 1046 1047 1048
	* rsa-sign.c (rsa_private_key_prepare): Check that qn + cn >= pn,
	since that is required for one of the GMP calls in
	_rsa_sec_compute_root.

Niels Möller's avatar
Niels Möller committed
1049 1050
	* rsa-decrypt-tr.c: Switch to use side-channel silent functions.

1051 1052 1053
	* pkcs1-sec-decrypt.c (_pkcs1_sec_decrypt_variable): New private
	function. Variable size version for backwards compatibility.

Niels Möller's avatar
Niels Möller committed
1054 1055
	* testsuite/rsa-sec-decrypt-test.c: Adds more tests.

Niels Möller's avatar
Niels Möller committed
1056 1057 1058 1059
	* rsa-sec-decrypt.c (rsa_sec_decrypt): New function.
	Fixed length side-channel silent version of rsa-decrypt.
	* testsuite/rsa-encrypt-test.c: add tests for the new fucntion.

Niels Möller's avatar
Niels Möller committed
1060 1061 1062
	* testsuite/pkcs1-sec-decrypt-test.c: Adds tests for
	_pkcs1_sec_decrypt.

Niels Möller's avatar
Niels Möller committed
1063 1064
	* gmp-glue.c (mpn_get_base256): New function.

Niels Möller's avatar
Niels Möller committed
1065 1066 1067
	* pkcs1-sec-decrypt.c (_pkcs1_sec_decrypt): New private function.
	Fixed length side-channel silent version of pkcs1-decrypt.

Niels Möller's avatar
Niels Möller committed
1068 1069 1070 1071
	* cnd-memcpy.c (cnd_memcpy): New function.
	* memops.h: Declare it.
	* testsuite/cnd-memcpy-test.c: New test case.

1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082
	* rsa-sign-tr.c (rsa_sec_compute_root_tr): New function that uses
	_rsa_sec_compute_root, as well as side-channel silent RSA
	blinding.
	(rsa_compute_root_tr) Rewritten as a wrapper around
	rsa_sec_compute_root_tr.
	(rsa_sec_blind, rsa_sec_unblind, sec_equal, rsa_sec_check_root)
	(cnd_mpn_zero): New helper functions.
	(rsa_sec_compute_root_tr) [NETTLE_USE_MINI_GMP]: Defined as a not
	side-channel silent wrapper around rsa_compute_root_tr, and the
	latter function left unchanged.

1083 1084 1085 1086 1087
	* rsa-sec-compute-root.c (_rsa_sec_compute_root_itch)
	(_rsa_sec_compute_root): New file, new private functions.
	Side-channel silent version of rsa_compute_root.
	* rsa-internal.h: New header file with declarations.

Niels Möller's avatar
Niels Möller committed
1088 1089
	* gmp-glue.h (NETTLE_OCTET_SIZE_TO_LIMB_SIZE): New macro.

1090 1091 1092 1093 1094 1095
2018-11-24  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: Bump package version to 3.4.1.
	(LIBNETTLE_MINOR): Bump library version to 6.5.
	(LIBHOGWEED_MINOR): Bump library version to 4.5.

1096 1097 1098 1099 1100 1101 1102 1103 1104
2018-11-17  Niels Möller  <nisse@lysator.liu.se>

	* examples/hogweed-benchmark.c (bench_rsa_verify)
	(bench_openssl_rsa_tr_init): New functions.
	(alg_list): Benchmark timing-resistant RSA functions, i.e.,
	including RSA blinding.
	(main): Increase width of first column, here and in other
	printouts.

1105 1106 1107 1108 1109 1110
2018-10-10  Dmitry Eremin-Solenikov  <dbaryshkov@gmail.com>

	* ctr16.c (_ctr_crypt16): Bugfix for the src == dst case, when
	processing more than on full block of size CTR_BUFFER_LIMIT, src
	and dst arguments to memxor3 were not properly updated.

1111 1112 1113 1114 1115
2018-10-10  Niels Möller  <nisse@lysator.liu.se>

	* aes-set-encrypt-key.c: Add missing include of stdlib.h.
	* des-compat.c: Likewise.

1116 1117 1118 1119 1120
2018-09-13  Niels Möller  <nisse@lysator.liu.se>

	* rsa-keygen.c (rsa_generate_keypair): Delete unlikely and
	redundant check for p == q.

1121 1122
2018-08-09  Niels Möller  <nisse@lysator.liu.se>

1123 1124 1125
	* rsa-internal.h (_rsa_blind, _rsa_unblind): Mark with
	_NETTLE_ATTRIBUTE_DEPRECATED.

Niels Möller's avatar
Niels Möller committed
1126 1127 1128
	* nettle-types.h (_NETTLE_ATTRIBUTE_PURE)
	(_NETTLE_ATTRIBUTE_DEPRECATED): New macros, for gcc and
	lookalikes.
1129 1130 1131 1132 1133
	* ecc-curve.h: Include nettle-types.h, and use
	_NETTLE_ATTRIBUTE_PURE instead of local definition.
	* nettle-meta.h: Use _NETTLE_ATTRIBUTE_PURE, instead of explicit
	#ifdefs.

Niels Möller's avatar
Niels Möller committed
1134 1135 1136 1137 1138
	* aes.h: Mark functions using struct aes_ctx interface as
	deprecated. Add #undef _NETTLE_ATTRIBUTE_DEPRECATED in files where
	the functions are implemented or tested.
	* gcm.h: Similarly mark functions using gcm_aes_ctx as deprecated.

1139 1140 1141 1142 1143
	* nettle-internal.c (des_set_key_wrapper, des3_set_key_wrapper)
	(blowfish128_set_key_wrapper): Wrapper functions, to avoid cast
	between incompatible function types (which gcc-8 warns about).
	Wrappers are expected to compile to a single jmp instruction.

1144 1145 1146
	* des-compat.c (des_compat_des3_encrypt)
	(des_compat_des3_decrypt): Change length argument type to size_t.

1147 1148 1149 1150 1151
2018-08-08  Niels Möller  <nisse@lysator.liu.se>

	* nettle.texinfo (Compatibility): New section on ABI and API
	compatibility.

1152 1153 1154 1155
2018-07-25  Dmitry Eremin-Solenikov  <dbaryshkov@gmail.com>

	* examples/nettle-benchmark.c: Add benchmarking for HMAC functions.

1156 1157 1158 1159 1160
2018-07-13  Niels Möller  <nisse@lysator.liu.se>

	* examples/eratosthenes.c (vector_alloc): Add assert related to
	overflow in the size calculation. Fixes a corner case identified
	by static analysis.
1161
	(vector_init): Analogous assert.
1162

Niels Möller's avatar
Niels Möller committed
1163 1164
2018-07-12  Niels Möller  <nisse@lysator.liu.se>

1165 1166
	* examples/eratosthenes.c (main): Don't allocate bitmap storage
	for limit == 2 (early exit), closing memory leak at exit.
1167
	(main): Fix handling of short -q option.
1168

Niels Möller's avatar
Niels Möller committed
1169 1170
	* eccdata.c (output_curve): Replace mpz_init_set_ui by mpz_set_ui,
	to fix memory leak.
1171 1172
	(ecc_curve_clear): New function.
	(main): Call it, to deallocate storage before exit.
Niels Möller's avatar
Niels Möller committed
1173

1174 1175 1176 1177 1178 1179
2018-07-08  Niels Möller  <nisse@lysator.liu.se>

	* fat-x86_64.c (fat_init): Fix setup for nettle_sha1_compress.
	* x86_64/fat/sha1-compress.asm: Add leading underscore to symbol name.
	* x86_64/fat/sha1-compress-2.asm: Likewise.

Niels Möller's avatar
Niels Möller committed
1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203
2018-07-07  Niels Möller  <nisse@lysator.liu.se>

	From Nikos Mavrogiannopoulos.
	* sha1-compress.c (nettle_sha1_compress): Renamed, and promoted to
	public function, since there's known appliation usage (filezilla).
	* sha1.h (_nettle_sha1_compress): Old name, now a preprocessor
	alias for the new name.
	* md5-compress.c (nettle_md5_compress): Similarly renamed (used by
	sogo).
	* md5.h (_nettle_md5_compress): Old name,, now a preprocessor
	alias for the new name.

	* chacha-internal.h, dsa-internal.h, eddsa-internal.h:
	* hogweed-internal.h, ripemd160-internal.h, rsa-internal.h:
	* salsa20-internal.h, sha2-internal.h, sha3-internal.h:
	* umac-internal.h: Internal declarations moved to new header
	files, which are not installed..
	* Makefile.in (DISTFILES): Added above files.

	* libnettle.map.in: Use a different symbol version for _nettle_*
	symbols, depending on the minor release. This marks these symbols
	explicitly not part of the public Nettle ABI.
	* libhogweed.map.in: Analogous change.

1204 1205
2018-06-17  Niels Möller  <nisse@lysator.liu.se>

1206 1207 1208
	* aclocal.m4 (NETTLE_CHECK_IFUNC): Fix quoting. Patch contributed
	by Dmitry Eremin-Solenikov.

1209 1210 1211 1212
	* testsuite/symbols-test: Exclude ____chkstk_darwin symbols,
	produced by Apple's Xcode 10 compiler. Patch contributed by
	Dominyk Tiller.

1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227
2018-03-25  Niels Möller  <nisse@lysator.liu.se>

	From Michael Weiser.
	* configure.ac (ASM_WORDS_BIGENDIAN): New substution, set from AC_C_BIGENDIAN.
	* config.m4.in: Use it to set WORDS_BIGENDIAN.
	* asm.m4 (IF_BE, IF_LE): New macros.
	* arm/memxor.asm: Support big-endian ARM.
	* arm/memxor3.asm: Likewise.
	* arm/neon/chacha-core-internal.asm: Likewise.
	* arm/neon/salsa20-core-internal.asm: Likewise.
	* arm/neon/umac-nh.asm: Likewise.
	* arm/v6/sha1-compress.asm: Likewise.
	* arm/v6/sha256-compress.asm: Likewise.
	* arm/README: Document big-endian considerations.

1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242
2018-03-17  Niels Möller  <nisse@lysator.liu.se>

	Discourage direct access to data symbols with non-public size.
	Direct references to these symbols may result in copy-relocations
	like R_X86_64_COPY, which make the symbol size leak into the ABI.
	* ecc-curve.h (_nettle_secp_192r1, _nettle_secp_224r1)
	(_nettle_secp_256r1, _nettle_secp_384r1, _nettle_secp_521r1): Add
	leading underscore on these data symbols.

	* nettle-meta.h (_nettle_ciphers, _nettle_hashes, _nettle_aeads)
	(_nettle_armors): Add leading underscore on these data symbols.
	Update all internal use. Macros without leading underscore remain,
	and expand to access via accessor functions nettle_get_ciphers and
	similar.

Niels Möller's avatar
Niels Möller committed
1243 1244
2018-03-10  Niels Möller  <nisse@lysator.liu.se>

1245 1246 1247
	* eccdata.c (ecc_table_size): New helper function.
	(ecc_pippenger_precompute): Display warning for poor parameters.

Niels Möller's avatar
Niels Möller committed
1248 1249 1250
	* eccparams.c (main): New program, to list parameter alternatives
	for Pippenger's algorithm.

1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267
	* Makefile.in: Tweak parameters for ecc tables.
	(ecc-192.h): Change parameters from k = 7, c = 6 to k = 8, c = 6.
	Reduces table size from 15 KB to 12 KB. Modest speedup, appr. 3%
	for ecdsa signatures.
	(ecc-224.h): Change parameters from k = 12, c = 6 to k = 16, c =
	7. Table size unchanged (14 KB in 32-bit platforms, 18 KB on
	64-bit platforms. Minor speedup, appr. 1% for ecdsa signatures.
	(ecc-256.h): Change parameters from k = 14, c = 6 to k = 11, c =
	6. Table size unchanged, 16 KB. 14% speedup for ecdsa signatures.
	(ecc-384.h): Changed parameters from k = 41, c = 6 to k = 32, c =
	6. Table size unchanged. 12% speedup for ecdsa signatures.
	(ecc-521.h): Changed parameters from k = 56, c = 6 to k 44, c = 6.
	Table size unchanged (17 KB on 32-bit platforms, 18 KB on 64-bit
	platforms). 15% speedup for ecdsa signatures.
	(ecc-255.h): Change parameters from k = 14, c = 6 to k = 11, c =
	6. Table size unchanged, 16 KB. 24% speedup for eddsa signatures.

1268 1269 1270 1271 1272
2018-03-14  Niels Möller  <nisse@lysator.liu.se>

	Merge sha256 code using the x86_64 sha_ni instructions, starting
	2018-02-21.

1273 1274 1275 1276 1277 1278 1279
2018-03-11  Niels Möller  <nisse@lysator.liu.se>

	* x86_64/fat/sha256-compress.asm: New file.
	* x86_64/fat/sha256-compress-2.asm: New file.
	* fat-x86_64.c (fat_init): Select plain x86_64 assembly version or
	sha_ni version for sha256_compress.

1280 1281 1282 1283 1284
2018-02-21  Niels Möller  <nisse@lysator.liu.se>

	* x86_64/sha_ni/sha256-compress.asm: New implementation using sha_ni
	instructions.

1285 1286 1287 1288
2018-02-20  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/cmac-test.c (test_cmac_hash): Deallocate ctx properly.

1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301
2018-02-19  Niels Möller  <nisse@lysator.liu.se>

	Mostly aesthetic changes. Besides indentation:
	* cmac.h (struct cmac128): Rename, to cmac128_ctx.
	(CMAC128_CTX): Rename first member from data to ctx.

	* cmac.c: Use const void * as the type for cipher arguments.
	(block_mulx): Un-inline.
	(cmac128_set_key): Make a constant function local.

	* testsuite/cmac-test.c: Delete local typedefs.

2018-02-19  Nikos Mavrogiannopoulos  <nmav@redhat.com>
1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322

	Add support for CMAC.
	* cmac.h: New file.
	(struct cmac128): New struct.
	* cmac.c (block_mulx, cmac128_set_key, cmac128_update)
	(cmac128_digest): New file, new functions.
	* cmac-aes128.c (cmac_aes128_set_key, cmac_aes128_update)
	(cmac_aes128_digest): New file, new functions.
	* cmac-aes256.c (cmac_aes256_set_key, cmac_aes256_update)
	(cmac_aes256_digest): New file, new functions.
	* Makefile.in (nettle_SOURCES): Added cmac.c cmac-aes128.c cmac-aes256.c.
	(HEADERS): Added cmac.h.

	* testsuite/cmac-test.c: New tests.
	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Add cmac-test.c.

	* examples/nettle-benchmark.c (time_cmac): New function.
	(main): Use it.

	* nettle.texinfo: Document CMAC.

1323 1324
2018-02-20  Niels Möller  <nisse@lysator.liu.se>

1325
	* testsuite/cbc-test.c (test_cbc_bulk): Use struct
1326
	aes256_ctx, instead of the deprecated struct aes_ctx.
1327 1328
	* testsuite/cfb-test.c (test_cfb_bulk): Likewise.
	* examples/rsa-session.h (struct rsa_session): Likewise.
1329 1330 1331 1332 1333
	* examples/rsa-encrypt.c (rsa_session_set_encrypt_key)
	(process_file): Use aes256_* functions.
	* examples/rsa-decrypt.c (rsa_session_set_decrypt_key)
	(process_file): Likewise.

1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345
2018-02-19  Niels Möller  <nisse@lysator.liu.se>

	* nettle-internal.h: Include sha3.h, needed for the definition of
	NETTLE_MAX_HASH_CONTEXT_SIZE.
	(TMP_DECL_ALIGN, TMP_ALLOC_ALIGN): New macros, to support
	allocation of context structs with alignment requirements.
	[!HAVE_ALLOCA]: Also use assert, rather than calling abort
	directly.

	* pss.c (pss_encode_mgf1, pss_verify_mgf1): Use new macros.
	* pss-mgf1.c (pss_mgf1): Likewise.

1346 1347 1348 1349 1350 1351
2018-02-18  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Moved pss-mgf1-test.c...
	(TS_HOGWEED_SOURCES): ...to here. Fixes link failure in builds
	without public-key support.

Niels Möller's avatar
Niels Möller committed
1352 1353 1354 1355 1356
2018-02-18  Dmitry Eremin-Solenikov  <dbaryshkov@gmail.com>

	* examples/nettle-openssl.c): Move expressions with side effects
	out of asserts.

1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367
2018-02-17  Dmitry Eremin-Solenikov  <dbaryshkov@gmail.com>

	(openssl_evp_set_encrypt_key, openssl_evp_set_decrypt_key): Use
	EVP_CipherInit_ex.
	* examples/nettle-openssl.c (nettle_openssl_gcm_aes128)
	(nettle_openssl_gcm_aes192, nettle_openssl_gcm_aes256): New aead
	algorithms, for benchmarking purposes, and supporting wrapper functions.
	* nettle-internal.h: Corresponding declarations.
	* examples/nettle-benchmark.c (main): Include openssl's gcm aes in
	benchmark.

1368 1369
2018-02-16  Niels Möller  <nisse@lysator.liu.se>

1370 1371 1372
	* nettle.texinfo: Improved index entries.
	(Cipher functions): Update CAST128/CAST5 docs. Inconsistencies
	spotted by Henrik Rindlöw.
1373

1374 1375 1376 1377
2018-02-10  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: New configure option --enable-x86-sha-ni.

1378 1379 1380 1381 1382 1383 1384
2018-02-07  Niels Möller  <nisse@lysator.liu.se>

	* x86_64/fat/sha1-compress.asm: New file.
	* x86_64/fat/sha1-compress-2.asm: New file.
	* fat-x86_64.c (fat_init): Select plain x86_64 assembly version or
	sha_ni version for sha1_compress.

1385 1386
2018-02-05  Niels Möller  <nisse@lysator.liu.se>

1387 1388 1389
	* x86_64/sha_ni/sha1-compress.asm: New implementation using sha_ni
	instructions.

1390 1391 1392 1393
	* fat-x86_64.c (get_x86_features): Check for sha_ni extension.

	* x86_64/fat/cpuid.asm: Clear %ecx input to cpuid instruction.

1394 1395 1396 1397 1398 1399
2018-02-01  Nikos Mavrogiannopoulos  <nmav@redhat.com>

	* gcm.c (gcm_fill): New function, for use with _ctr_crypt16.
	(gcm_encrypt, gcm_decrypt): Use _ctr_crypt16. 50% speedup of
	gcm_aes128, benchmarked on x86_64 with aesni instructions.

1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417
2018-02-01  Niels Möller  <nisse@lysator.liu.se>

	Based on a patch contributed by Nikos Mavrogiannopoulos.
	* ctr16.c (_ctr_crypt16): New file, renamed and generalized
	function. New function pointer argument, used to fill a block with
	counter values. Use nettle_block16 * as the type for the buffer to
	be filled. Always process any final and partial block, and return
	no value.
	* ctr.c (ctr_crypt): ... previous, replaced, function.
	(ctr_fill16): Updated to new argument type.
	(ctr_crypt): Return immediately after using _ctr_crypt16.

	* ctr-internal.h: New file, declaring _ctr_crypt16.
	(nettle_fill16_func): New function typedef.

	* Makefile.in (nettle_SOURCES): Added ctr16.c.
	(DISTFILES): Added ctr-internal.h.

1418 1419 1420 1421
2018-01-30  Niels Möller  <nisse@lysator.liu.se>

	* Makefile.in (clean-here): Don't delete desdata.stamp.

1422 1423 1424 1425 1426 1427 1428 1429 1430
2018-01-24  Jay Foad  <jay.foad@gmail.com>

	* Makefile.in (TARGETS): Delete dependencies on aesdata, desdata,
	twofishdata, shadata and gcmdata. They are not needed for a normal
	build.
	(clean-here): Explicitly delete of above files.
	(desdata.stamp): New stamp target, to avoid building desdata twice
	in a parallell build.

Niels Möller's avatar
Niels Möller committed
1431 1432 1433 1434 1435
2018-01-23  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac (asm_path): Recognize "x86", in addition to "i?86",
	for 32-bit x86 processors. Reportedly needed for x86 android builds.

Niels Möller's avatar
Niels Möller committed
1436 1437 1438 1439 1440 1441 1442 1443 1444
2018-01-20  Niels Möller  <nisse@lysator.liu.se>

	CFB8 support, contributed by Dmitry Eremin-Solenikov.
	* cfb.c (cfb8_encrypt, cfb8_decrypt): New functions.
	* cfb.h: Declare them.
	(CFB8_ENCRYPT, CFB8_DECRYPT): New macros.
	* testsuite/cfb-test.c: New tests for CFB8.
	* nettle.texinfo (CFB and CFB8): Documentation.

1445 1446 1447 1448
2018-01-16  Niels Möller  <nisse@lysator.liu.se>

	* tools/pkcs1-conv.c (convert_file): Add missing break statements.

Niels Möller's avatar
Niels Möller committed
1449 1450 1451 1452 1453 1454 1455 1456 1457
2018-01-09  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/testutils.c (test_cipher_ctr): Test operations with
	shorter sizes.

	* testsuite/ctr-test.c: Additional unofficial test vectors, to
	exercise carry propagation in the counter, and block size
	different from 16.

1458 1459
2018-01-08  Niels Möller  <nisse@lysator.liu.se>

1460 1461 1462 1463 1464 1465 1466
	* ctr.c (ctr_crypt16): New function, with optimizations specific
	to 16-byte block size.
	(ctr_fill16): New helper function, definition depending on
	WORDS_BIGENDIAN, and little endian version requiring
	HAVE_BUILTIN_BSWAP64.
	(ctr_crypt): Use ctr_crypt16, when appropriate.

1467 1468
	* nettle-types.h (union nettle_block16): Add uint64_t field.

1469 1470 1471
	* configure.ac: Check for __builtin_bswap64, define
	HAVE_BUILTIN_BSWAP64 if available.

Niels Möller's avatar
Niels Möller committed
1472 1473
	* ctr.c (ctr_fill): New function. Use in ctr_crypt.

1474 1475 1476 1477
	* ctr.c (ctr_crypt): For in-place operation, increase max buffer
	size from 4 blocks to 512 bytes, similarly to CBC and CFB.
	Improves in-place aes128 CTR performance by 25% on x86_64.

1478 1479 1480
	* examples/nettle-benchmark.c (time_cipher): Benchmark in-place
	operation separately, for cbc_decrypt and ctr_crypt.

1481 1482 1483 1484 1485
	* cbc.c (cbc_decrypt): For in-place operation (src == dst case),
	eliminate use of src variable.
	* cfb.c (cfb_decrypt): Likewise.
	* gcm.c (gcm_crypt): Likewise, and replace one memxor3 by memxor.

Niels Möller's avatar
Niels Möller committed
1486 1487 1488 1489 1490 1491 1492
2018-01-03  Niels Möller  <nisse@lysator.liu.se>

	* x86_64/aesni/aes-encrypt-internal.asm: Read subkeys into xmm
	registers before the block loop, and completely unroll the round
	loop.
	* x86_64/aesni/aes-decrypt-internal.asm: Likewise.

Niels Möller's avatar
Niels Möller committed
1493 1494
2017-11-19  Niels Möller  <nisse@lysator.liu.se>

1495
	* Released nettle-3.4.
Niels Möller's avatar
Niels Möller committed
1496

1497 1498 1499 1500 1501 1502
2017-11-12  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: Update check of GMP_NUMB_BITS declaration in
	assembly files. Was broken by rename of configure variable
	GMP_NUMB_BITS --> NUMB_BITS.

Niels Möller's avatar
Niels Möller committed
1503 1504 1505 1506 1507 1508 1509 1510
2017-11-11  Niels Möller  <nisse@lysator.liu.se>

	* nettle.texinfo: Document nettle_get_hashes, nettle_get_ciphers
	and nettle_get_aeads, and replace nettle_secp_256r1 by
	nettle_get_secp_256r1. Update version numbers. Delete ancient
	setting of ispell-skip-region-alist as an emacs file-local
	variable.

1511 1512 1513 1514 1515 1516 1517 1518 1519 1520
2017-11-08  Niels Möller  <nisse@lysator.liu.se>

	* ecc-curve.h (nettle_secp_192r1, nettle_secp_224r1)
	(nettle_secp_256r1, nettle_secp_384r1, nettle_secp_521r1): Delete
	macro wrappers, partially reverting below 2017-04-09 change. They
	didn't work at all for applications that only see a forward
	declaration of struct ecc_curve. Instead, we will have to make an
	ABI and API break and delete these symbols, when the size of
	struct ecc_curve is increased.

Niels Möller's avatar
Niels Möller committed
1521 1522 1523 1524 1525 1526
2017-11-05  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac Bump package version to 3.4.
	(LIBNETTLE_MINOR): Bump library version to 6.4.
	(LIBHOGWEED_MINOR): Bump library version to 4.4.

Niels Möller's avatar
Niels Möller committed
1527 1528 1529 1530 1531 1532
2017-10-23  Niels Möller  <nisse@lysator.liu.se>

	* examples/Makefile.in (check): Also set DYLD_LIBRARY_PATH in the
	environment, to support Mac OSX shared libraries.
	* testsuite/Makefile.in (LD_LIBRARY_PATH): Likewise.

1533 1534
2017-10-23  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
1535
	Merge API fixes, starting at 2017-01-12.
1536

1537 1538
2017-04-09  Niels Möller  <nisse@lysator.liu.se>

1539 1540 1541 1542 1543 1544 1545 1546
	* ecc-curve.h (nettle_get_secp_192r1, nettle_get_secp_224r1)
	(nettle_get_secp_256r1, nettle_get_secp_384r1)
	(nettle_get_secp_521r1): New functions, returning a pointer to
	corresponding structure.
	(nettle_secp_192r1, nettle_secp_224r1, nettle_secp_256r1)
	(nettle_secp_384r1, nettle_secp_521r1): Redefined as macros,
	calling the corresponding function.