Commit 07f5ea16 authored by Niels Möller's avatar Niels Möller

Update NEWS file for 3.4.1.

Mention dependency on GMP-6, and RSA performance regression.
parent 1fe332ad
...@@ -2,45 +2,47 @@ NEWS for the Nettle 3.4.1 release ...@@ -2,45 +2,47 @@ NEWS for the Nettle 3.4.1 release
This release fixes a few bugs, and makes the RSA private key This release fixes a few bugs, and makes the RSA private key
operations side channel silent. The RSA improvements are operations side channel silent. The RSA improvements are
contributed by Simo Sorce and Red Hat, and includes one new contributed by Simo Sorce and Red Hat, and include one new
public function. public function, rsa_sec_decrypt, see below.
All functions handling RSA private keys are now side-channel All functions using RSA private keys are now side-channel
silent, meaning that they try hard to avoid any branches or silent, meaning that they try hard to avoid any branches or
memory accesses depending on secret data. This applies both to memory accesses depending on secret data. This applies both to
the bignum calculations, which now use GMP's mpn_sec_* family the bignum calculations, which now use GMP's mpn_sec_* family
of functions, and the processing of pkcs#1 padding. of functions, and the processing of PKCS#1 padding needed for
RSA decryption.
Nettle's ECC functions were already side-channel silent, while Nettle's ECC functions were already side-channel silent, while
the DSA functions still aren't. There's also one caveat the DSA functions still aren't. There's also one caveat
regarding the improved RSA functions: due to small table regarding the improved RSA functions: due to small table
lookups in relevant mpn_sec_* functions in GMP-6.1.2, the lookups in relevant mpn_sec_* functions in GMP-6.1.2, the
lowest and highest few bits of the secret factors p and q may lowest and highest few bits of the secret factors p and q may
leak. I'm not aware of any attacks on RSA where knowing a few still leak. I'm not aware of any attacks on RSA where knowing
bits of the factors makes a significant difference. This leak a few bits of the factors makes a significant difference. This
will likely be plugged in later GMP versions). leak will likely be plugged in later GMP versions.
Changes in behavior: Changes in behavior:
* The old rsa_decrypt_tr may now clobber all of the provided * The functions rsa_decrypt and rsa_decrypt_tr may now clobber
message buffer, independent of the actual message length. It all of the provided message buffer, independent of the
is side-channel silent, in that branches and memory accesses actual message length. They are side-channel silent, in that
don't depend on the validity or length of the message. branches and memory accesses don't depend on the validity or
Side-channel leakage from the caller's use of length and length of the message. Side-channel leakage from the
return value may still provide an oracle useable for a caller's use of length and return value may still provide an
Bleichenbacher-style chosen ciphertext attack. Which is why oracle useable for a Bleichenbacher-style chosen ciphertext
the new function rsa_sec_decrypt, see below, is recommended. attack. Which is why the new function rsa_sec_decrypt is
recommended.
New features: New features:
* New function rsa_sec_decrypt. It differs from rsa_decrypt_tr * A new function rsa_sec_decrypt. It differs from
in that the length of the decrypted message is given a rsa_decrypt_tr in that the length of the decrypted message
priori, and pkcs#1 padding indicating a different length is is given a priori, and PKCS#1 padding indicating a different
treated as an error. For applications that may be subject to length is treated as an error. For applications that may be
chosen ciphertext attacks, it is recommended to initialize subject to chosen ciphertext attacks, it is recommended to
the message area with random data, call this function, and initialize the message area with random data, call this
ignore the return value. This applies in particular to function, and ignore the return value. This applies in
RSA-based key exchange in the TLS protocol. particular to RSA-based key exchange in the TLS protocol.
Bug fixes: Bug fixes:
...@@ -50,6 +52,22 @@ NEWS for the Nettle 3.4.1 release ...@@ -50,6 +52,22 @@ NEWS for the Nettle 3.4.1 release
* Fix link error on the pss-mgf1-test test, affecting builds * Fix link error on the pss-mgf1-test test, affecting builds
without public key support. without public key support.
Performance regression:
* All RSA private key operations employing RSA blinding, i.e.,
rsa_decrypt_tr, rsa_*_sign_tr, the new rsa_sec_decrypt, and
rsa_compute_root_tr, are significantly slower. This is
because (i) RSA blinding now use side-channel silent
operations, (ii) blinding includes a modular inversion, and
(iii) side-channel silent modular inversion, implemented as
mpn_sec_invert, is very expensive. A 60% slowdown for
2048-bit RSA keys have been measured.
Miscellaneous:
* Building the public key support of nettle now requires GMP
version 6.0 or later (unless --enable-mini-gmp is used).
The shared library names are libnettle.so.6.5 and The shared library names are libnettle.so.6.5 and
libhogweed.so.4.5, with sonames still libnettle.so.6 and libhogweed.so.4.5, with sonames still libnettle.so.6 and
libhogweed.so.4. It is intended to be fully binary compatible libhogweed.so.4. It is intended to be fully binary compatible
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment