diff options
Diffstat (limited to 'comm/third_party/libgcrypt/ChangeLog')
| -rw-r--r-- | comm/third_party/libgcrypt/ChangeLog | 13947 |
1 files changed, 13947 insertions, 0 deletions
diff --git a/comm/third_party/libgcrypt/ChangeLog b/comm/third_party/libgcrypt/ChangeLog new file mode 100644 index 0000000000..72ea034caf --- /dev/null +++ b/comm/third_party/libgcrypt/ChangeLog @@ -0,0 +1,13947 @@ +2021-02-17 Werner Koch <wk@gnupg.org> + + Release 1.9.2. + + commit 24bd7e8215f7982b0c8db46fd87b47b370a52ec6 + + +2021-02-12 NIIBE Yutaka <gniibe@fsij.org> + + random: Fix build for macOS. + + commit d78cdf42854b17e2216890e7b78f9e7e05c0b1f8 + * random/rndlinux.c [__APPLE__] (HAVE_GETENTROPY): Valid only when the + macro __MAC_10_11 is available. + +2021-02-08 Werner Koch <wk@gnupg.org> + + tests: Fix minor glitches. + + commit 82395f11b444651f544f5e51c62fc6b65c04f9ef + * tests/basic.c (ALWAYS_INLINE): Make sure it is defined. + * tests/version.c (main): Print the config info to stdout. + + New test Makefile target xtestsuite. + + commit ebc4d5670a1ada54ad907a4836eb8f6f573c2c38 + * tests/Makefile.am (xtestsuite, xcheck): New targets. + + New test driver to allow for standalone regression tests. + + commit b142da4c88deef4798ef96061dac399df3ddd73d + * tests/testdrv.c: New. + +2021-02-03 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + sha256-avx2: fix reading beyond end of input buffer. + + commit 24af2a55d862d45fe3aef6b5626a52d9bb0fb17e + * cipher/sha256-avx2-bmi2-amd64.S + (_gcry_sha256_transform_amd64_avx2): Use 'last block' code path if + input length is only one block. + * tests/basic.c (check_one_md_final): Use dynamic allocated buffer + so that in future similar access errors get detected by + tests/basic + valgrind. + + ecc-ecdh: fix memory leak. + + commit 289543544e41cd5fe90352c5c7548ac09da533cc + * cipher/ecc-ecdh.c (_gcry_ecc_mul_point): Free 'ec' at function exit. + + tests: allow running 'make check' with ASAN. + + commit f46a6bd9b3d7ef7d1a72c5b6da5cf34ace2ff156 + * tests/t-secmem.c (main): Skip test if environment variable + GCRYPT_IN_ASAN_TEST is defined. + * tests/t-sexp.c (main): Do not initialize secmem if environment + variable GCRYPT_IN_ASAN_TEST is defined. + + global: make sure that bulk config string is null-terminated. + + commit 8716e4b2ada21456802aee67c2bc8edfec78f820 + * src/global.c (_gcry_get_config): Append null-terminator to output + in the 'what == NULL' case. + + Add handling for -Og with O-flag munging. + + commit a71b7de32b0c7c41359335a488cfe4dd70c65121 + * cipher/Makefile.am (o_flag_munging): Add handling for '-Og'. + * random/Makefile.am (o_flag_munging): Add handling for '-Og'. + + jent: silence ubsan warning about signed overflow. + + commit 6fc11291282a668839040c72a1d558a6ebbd4972 + * random/jitterentropy-base.c (jent_stuck): Cast 'delta2' values to + 'uint64_t' for calculation. + + Fix ubsan warnings for i386 build. + + commit 364e9e9d10503b36f98fbb1b489e00026f22c9d7 + * mpi/mpicoder.c (_gcry_mpi_set_buffer) [BYTES_PER_MPI_LIMB == 4]: Cast + "*p--" values to mpi_limb_t before left shifting. + * tests/t-lock.c (main): Cast 'time(NULL)' to unsigned type. + + Fix building with --disable-asm on x86. + + commit af23ab5c5482d625ff52e60606cf044e2b0106c8 + * cipher/keccak.c (USE_64BIT_BMI2, USE_64BIT_SHLD) + (USE_32BIT_BMI2): Depend also on HAVE_CPU_ARCH_X86. + * random/rndjent.c [__i386__ || __x86_64__] (USE_JENT): Depend + also on HAVE_CPU_ARCH_X86. + + md: clear bctx.count at final function. + + commit cb95fc53003e9f34ff80fc33627ceda605de223c + * cipher/md4.c (md4_final): Set bctx.count zero after + finalizing. + * cipher/md5.c (md5_final): Ditto. + * cipher/rmd160.c (rmd160_final): Ditto. + * cipher/sha1.c (sha1_final): Ditto. + * cipher/sha256.c (sha256_final): Ditto. + * cipher/sha512.c (sha512_final): Ditto. + * cipher/sm3.c (sm3_final): Ditto. + * cipher/stribog.c (stribog_final): Ditto. + * cipher/tiger.c (tiger_final): Ditto. + +2021-02-02 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Add checking key for ECDSA. + + commit 598d0f3e0294a487e01b88cc714a8cd0a47329bb + * cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_verify): Validate public key. + * cipher/ecc-gost.c (_gcry_ecc_gost_verify): Likewise. + * cipher/ecc-sm2.c (_gcry_ecc_sm2_verify): Likewise. + +2021-01-29 Werner Koch <wk@gnupg.org> + + Release 1.9.1. + + commit 466299b1ceb82ec7c4dd0ca376de50399a896adf + * configure.ac: Bump LT version to C23/A3/R1. + +2021-01-29 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + hash-common: fix heap overflow when writing more data after final. + + commit 512c0c75276949f13b6373b5c04f7065af750b08 + * tests/basic.c (check_one_md): Test writing to digest after read. + * cipher/hash-common.c (_gcry_md_block_write): Reset 'hd->count' if + greater than blocksize. + +2021-01-28 Werner Koch <wk@gnupg.org> + + Add a compliance keyword to gcry_get_config. + + commit aa3f595341eb263980210776c7fe377b2ed24c5e + * src/global.c (print_config): New config line. + +2021-01-27 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + asm-common-aarch64: add MacOS support for GET_DATA_POINTER. + + commit 014fed5153647641376b9131ea1d87dc5e88cf42 + * cipher/asm-common-aarch64.h [__APPLE__] (GET_DATA_POINTER): Add MacOS + variant of macro. + +2021-01-27 NIIBE Yutaka <gniibe@fsij.org> + + random: Use getentropy on macOS when available. + + commit 6cb0faf6ceec5b2e799e6fb5f04b85d135a7da9b + * random/rndlinux.c [__APPLE__ && __MACH__] (getentropy): Declare. + (_gcry_rndlinux_gather_random): Check the symbol and use getentropy. + + mpi: Fix _gcry_mpih_mod implementation. + + commit f06ff4e31c8e162f4a59986241c7ab43d5085927 + * mpi/mpih-const-time.c (_gcry_mpih_mod): Handle the overflow. + + build: Check spawn.h for MacOS X Tiger. + + commit fc901e978a0c18a3524cad5d1ef3451ed11b9347 + * configure.ac: Add check for spawn.h. + * tests/random.c: Only use posix_spawn if available. + +2021-01-26 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + global: fix compile error at pragma GCC diagnostic. + + commit 3d095206c30d772d5fc68bf69bfc384e43f766e9 + * src/global.c (_gcry_vcontrol): Move "pragma GCC diagnostics" outside + function. + + cipher-proto: remove forward typedef of cipher_bulk_ops_t. + + commit 17aad639d29c7c835a7effb89181c7c99b16cb6a + * cipher/cipher-proto (cipher_bulk_ops_t): Remove typedef, leave + forward declaration of 'struct cipher_bulk_ops'. + (gcry_cipher_setkey_t): Change 'bulk_ops' to + 'struct cipher_bulk_ops *'. + * cipher/arcfour.c: Include 'cipher-internal.h'. + * cipher/gost28147.c: Ditto. + * cipher/idea.c: Ditto. + * cipher/rfc2268.c: Ditto. + * cipher/salsa20.c: Ditto. + * cipher/seed.c: Ditto. + * cipher/mac-internal.h (CTX_MAGIC_NORMAL): Rename to... + (CTX_MAC_MAGIC_NORMAL): ... this. + (CTX_MAGIC_SECURE): Rename to... + (CTX_MAC_MAGIC_SECURE): ... this. + * cipher/mac-cmac.c (cmac_open): Use CTX_MAC_MAGIC_SECURE. + * cipher/mac-gmac.c (gmac_open): Ditto. + * cipher/mac-hmac.c (hmac_open): Ditto. + * cipher/mac-poly1305.c (poly1305mac_open): Ditto. + * cipher/mac.c (mac_open): Use CTX_MAC_MAGIC_SECURE and + CTX_MAC_MAGIC_NORMAL. + +2021-01-26 David Michael <fedora.dm0@gmail.com> + + cipher/sha512: Fix non-NEON ARM assembly implementation. + + commit 1e72c50f864ae1c77ba80c191224b9ef1d22a2e2 + * cipher/sha512.c (do_transform_generic) + [USE_ARM_ASM]: Switch to the non-NEON assembly implementation. + +2021-01-26 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + blake2: fix RIP register access for AVX/AVX2 implementations. + + commit b2f78ae034b8d4aa3d4cc7bf85262317832f6e0a + * cipher/blake2b-amd64-avx2.S: Use rRIP instead of (RIP). + * cipher/blake2s-amd64-avx.S: Use rRIP instead of (RIP). + + sha512/sha256: remove assembler macros from AMD64 implementations. + + commit 9f49e806f9506533236fd44b17f17b85961b20f1 + * configure.ac (gcry_cv_gcc_platform_as_ok_for_intel_syntax): Remove + assembler macro check from Intel syntax assembly support check. + * cipher/sha256-avx-amd64.S: Replace assembler macros with C + preprocessor counterparts. + * cipher/sha256-avx2-bmi2-amd64.S: Ditto. + * cipher/sha256-ssse3-amd64.S: Ditto. + * cipher/sha512-avx-amd64.S: Ditto. + * cipher/sha512-avx2-bmi2-amd64.S: Ditto. + * cipher/sha512-ssse3-amd64.S: Ditto. + + configure.ac: run assembler checks through linker for better LTO support + + commit 393bd6c3d1aa2b2a1b05be0e2d7fb2514e6c5ad0 + * configure.ac (gcry_cv_gcc_arm_platform_as_ok) + (gcry_cv_gcc_aarch64_platform_as_ok) + (gcry_cv_gcc_inline_asm_ssse3, gcry_cv_gcc_inline_asm_pclmul) + (gcry_cv_gcc_inline_asm_shaext, gcry_cv_gcc_inline_asm_sse41) + (gcry_cv_gcc_inline_asm_avx, gcry_cv_gcc_inline_asm_avx2) + (gcry_cv_gcc_inline_asm_bmi2, gcry_cv_gcc_as_const_division_ok) + (gcry_cv_gcc_as_const_division_with_wadivide_ok) + (gcry_cv_gcc_amd64_platform_as_ok, gcry_cv_gcc_win64_platform_as_ok) + (gcry_cv_gcc_platform_as_ok_for_intel_syntax) + (gcry_cv_gcc_inline_asm_neon, gcry_cv_gcc_inline_asm_aarch32_crypto) + (gcry_cv_gcc_inline_asm_aarch64_neon) + (gcry_cv_gcc_inline_asm_aarch64_crypto) + (gcry_cv_gcc_inline_asm_ppc_altivec) + (gcry_cv_gcc_inline_asm_ppc_arch_3_00) + (gcry_cv_gcc_inline_asm_s390x, gcry_cv_gcc_inline_asm_s390x): Use + AC_LINK_IFELSE check instead of AC_COMPILE_IFELSE. + + rijndael: remove unused use_xxx flags. + + commit a14447f8169aff30a49f5c2ab06bd5bbd1cc3531 + * cipher/rijndael-internal.h (RIJNDAEL_context_s): Remove unused + 'use_padlock', 'use_aesni', 'use_ssse3', 'use_arm_ce', 'use_ppc_crypto' + and 'use_ppc9le_crypto'. + * cipher/rijndael.c (do_setkey): Do not setup 'use_padlock', + 'use_aesni', 'use_ssse3', 'use_arm_ce', 'use_ppc_crypto' and + 'use_ppc9le_crypto'. + + Define HW-feature flags per architecture. + + commit 8d404a629167d67ed56e45de3e65d1e0b7cdeb24 + * random/rand-internal.h (_gcry_rndhw_poll_slow): Add requested length + parameter. + * random/rndhw.c (_gcry_rndhw_poll_slow): Limit accounted bytes to 50% + (or 25% for RDRAND) - this code is moved from caller side. + * random/rndlinux.c (_gcry_rndlinux_gather_random): Move + HWF_INTEL_RDRAND check to _gcry_rndhw_poll_slow. + * src/g10lib.h (HWF_PADLOCK_*, HWF_INTEL_*): Define only if + HAVE_CPU_ARCH_X86. + (HWF_ARM_*): Define only if HAVE_CPU_ARCH_ARM. + (HWF_PPC_*): Define only if HAVE_CPU_ARCH_PPC. + (HWF_S390X_*): Define only if HAVE_CPU_ARCH_S390X. + + Add configure option to force enable 'soft' HW feature bits. + + commit 3b34bd6e178614d6021ee7d1140646f7c8ed7519 + * configure.ac (force_soft_hwfeatures) + (ENABLE_FORCE_SOFT_HWFEATURES): New. + * src/hwf-x86.c (detect_x86_gnuc): Enable HWF_INTEL_FAST_SHLD + and HWF_INTEL_FAST_VPGATHER if ENABLE_FORCE_SOFT_HWFEATURES enabled. + +2021-01-26 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix Ed25519 private key handling for preceding ZEROs. + + commit 1b74f633bd3e358fb07a856a70597019980651d2 + * cipher/ecc-curves.c (mpi_ec_setup_elliptic_curve): Fill-up or remove + preceding ZEROs correctly, fixing the third argument of mpi_set_opaque. + + ecc: Fix initialization of CTX for sign and verify. + + commit 652b102697cbfe2d7bc642fc7374cb21a9cf03e6 + * cipher/ecc.c (ecc_sign, ecc_verify): Call + _gcry_pk_util_init_encoding_ctx at first. + +2021-01-21 NIIBE Yutaka <gniibe@fsij.org> + + build: Fix build of tests with non-default installation. + + commit fa3420b011c105ca21894489e62c7e882a3ac4dd + * tests/Makefile.am: Add forgotten @LDADD_FOR_TESTS_KLUDGE@. + +2021-01-20 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Split inline assembly blocks with many memory operands. + + commit 00df9f27181d77166ceb55f319329400bf2e6a48 + * cipher/rijndael-aesni.c (aesni_ocb_checksum, aesni_ocb_enc) + (aesni_ocb_dec, _gcry_aes_aesni_ocb_auth): Split assembly blocks + with more than 4 memory operands to smaller blocks. + * cipher/sha512-ssse3-i386.c (W2): Split big assembly block to + three smaller blocks. + + tests/basic: fix build on ARM32 when NEON disabled. + + commit 81354e911bfa3e135d3e07f6a8d9e98033cd921a + * tests/basic.c (CLUTTER_VECTOR_REGISTER_NEON) + (CLUTTER_VECTOR_REGISTER_AARCH64): Remove check for __ARM_FEATURE_SIMD32. + + kdf: make self-test test-vector array read-only. + + commit 097148bc89ec8c18b9e4795733e0f0b1ae0ecd1d + * cipher/kdf.c (selftest_pbkdf2): Make 'tv[]' constant. + + kdf: add missing null-terminator for self-test test-vector array. + + commit c6425a5537294dfe2beaafc9105f7af4ceac677f + * cipher/kdf.c (selftest_pbkdf2): Add null-terminator to TV array. + + cipher/bithelp: use __builtin_ctzl when available. + + commit 807827cda3bacf5f475167ee6d34657713111838 + * cipher/bithelp.h (_gcry_ctz64): Use __builtin_ctzl if available. + + mpi/longlong: make use of compiler provided __builtin_ctz/__builtin_clz. + + commit 477355047e5c75ad2b2238a8716e4646b861184c + * configure.ac (gcry_cv_have_builtin_ctzl, gcry_cv_have_builtin_clz) + (gcry_cv_have_builtin_clzl): New checks. + * mpi/longlong.h (count_leading_zeros, count_trailing_zeros): Use + __buildin_clz[l]/__builtin_ctz[l] if available and bit counting + macros not yet provided by inline assembly. + +2021-01-19 Werner Koch <wk@gnupg.org> + + Release 1.9.0. + + commit 0dc49af9b5371c5e2f766b70c3bede2b10db9f7e + + +2021-01-19 NIIBE Yutaka <gniibe@fsij.org> + + Fix DSA for FIPS 186-3. + + commit 30ed9593f632c728d918598037358deaeccd1968 + * cipher/dsa.c (generate_fips186): Supply INITIAL_SEED to + _gcry_generate_fips186_3_prime. + * tests/fips186-dsa.c (check_dsa_gen_186_2): Add where tv comes from. + (check_dsa_gen_186_3): Implement tests. + * tests/pubkey.c (get_dsa_key_fips186_with_seed_new): Use the qbits + and seed of tests/fips186-dsa.c. + +2021-01-19 NIIBE Yutaka <gniibe@fsij.org> + Tomáš Mráz <tm@t8m.info> + + Check if FIPS is operational and error return if not. + + commit ebeae53222648c637907f4b358888fc0e7123dc9 + * src/visibility.c (gcry_kdf_derive): Add the check. + (gcry_prime_generate, gcry_prime_group_generator): Likewise. + (gcry_mpi_randomize): Likewise, but no return. + +2021-01-18 Werner Koch <wk@gnupg.org> + + ecc: Change an error code of gcry_ecc_mul_point. + + commit ca5a90bf70598247589078478d237287ca524453 + * cipher/ecc-ecdh.c (_gcry_ecc_mul_point): Return + GPG_ERR_UNKNOWN_CURVE. + +2021-01-15 NIIBE Yutaka <gniibe@fsij.org> + Tomáš Mráz <tm@t8m.info> + + kdf: Add selftest. + + commit 7a0da24925361a3109474d0e433511467a9e35d1 + * src/cipher-proto.h (_gcry_kdf_selftest): New. + * cipher/kdf.c (check_one, selftest_pbkdf2): New. + (_gcry_kdf_selftest): New. + * src/fips.c (run_kdf_selftests): New. + (_gcry_fips_run_selftests): Call run_kdf_selftests. + +2021-01-13 NIIBE Yutaka <gniibe@fsij.org> + Tomáš Mráz <tm@t8m.info> + + cmac: Add selftest. + + commit 385a89e35b0b95f15b4c6e4d5482b1fc6906f7c5 + * cipher/mac-cmac.c (check_one, selftests_cmac_3des): New. + (selftests_cmac_aes, cmac_selftest): New. + (cmac_ops): Add cmac_selftest. + * src/fips.c (run_mac_selftests): Add CMAC selftests. + +2021-01-13 NIIBE Yutaka <gniibe@fsij.org> + + sexp: Raise an error when an integer is negative with USG. + + commit 00d7c1c632019066a4884930d413ccc044d81af5 + * src/sexp.c (do_vsexp_sscan): Return GPG_ERR_INV_ARG if negative. + +2021-01-08 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Add backward compatibility support for Ed25519 key in SEXP. + + commit 4768baf74be03d8973d004725f796aef329c45bf + * cipher/ecc-curves.c (_gcry_ecc_get_curve): Support Ed25519 keys with + parameter {p,a,b,g,n}. + + ecc: Minor implementation change for _gcry_ecc_get_curve. + + commit 3fe7036d05f283df9441d42242f0047b6ea11a32 + * cipher/ecc-curves.c (_gcry_ecc_get_curve): Flatten. + +2020-12-30 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add s390x/zSeries implementation of Poly1305. + + commit 1f75681cbba895ea2f7ea0637900721f4522e729 + * cipher/Makefile.am: Add 'poly1305-s390x.S' and + 'asm-poly1305-s390x.h'. + * cipher/asm-poly1305-s390x.h: New + * cipher/chacha20-s390x.S (_gcry_chacha20_poly1305_s390x_vx_blocks8) + (_gcry_chacha20_poly1305_s390x_vx_blocks4_2_1): New, stitched + chacha20-poly1305 implementation. + * cipher/chacha20.c (USE_S390X_VX_POLY1305): New. + (_gcry_chacha20_poly1305_s390x_vx_blocks8) + (_gcry_chacha20_poly1305_s390x_vx_blocks4_2_1): New prototypes. + (_gcry_chacha20_poly1305_encrypt, _gcry_chacha20_poly1305_decrypt): Add + s390x/VX stitched chacha20-poly1305 code-path. + * cipher/poly1305-s390x.S: New. + * cipher/poly1305.c (USE_S390X_ASM, HAVE_ASM_POLY1305_BLOCKS): New. + [USE_S390X_ASM] (_gcry_poly1305_s390x_blocks1, poly1305_blocks): New. + * configure.ac (gcry_cv_gcc_inline_asm_s390x): Check for 'risbgn' and + 'algrk' instructions. + * tests/basic.c (_check_poly1305_cipher): Add large chacha20-poly1305 + test vector. + + Add s390x/zSeries implementation of ChaCha20. + + commit 6a0bb9ab7f886087d7edb0725c90485086a1c0b4 + * cipher/Makefile.am: Add 'asm-common-s390x.h' and 'chacha20-s390x.S'. + * cipher/asm-common-s390x.h: New. + * cipher/chacha20-s390x.S: New. + * cipher/chacha20.c (USE_S390X_VX): New. + (CHACHA20_context_t): Change 'use_*' bit-field to unsigned type; Add + 'use_s390x'. + (_gcry_chacha20_s390x_vx_blocks8) + (_gcry_chacha20_s390x_vx_blocks4_2_1): New. + (chacha20_do_setkey): Add HW feature detect for s390x/VX. + (chacha20_blocks, do_chacha20_encrypt_stream_tail): Add s390x/VX + code-path. + * configure.ac: Add 'chacha20-s390x.lo'. + + hwf-s390x: add VX vector instruction set detection. + + commit 1d13794780e3d052cd5ed6f900bf5900cf44b377 + * configure.ac (gcry_cv_gcc_inline_asm_s390x_vx): New check. + * src/g10lib.h (HWF_S390X_VX): New. + * src/hwf-s390x.c (HWCAP_S390_VXRS): New. + (s390x_features) [HAVE_GCC_INLINE_ASM_S390X_VX]: Add VX feature check. + * src/hwfeatures.c (hwlist): Add "s390x-vx". + + mpi/longlong: add s390x/zSeries macros. + + commit 0252cc9b62dfe20c77211f093b4fda54786177d3 + * mpi/longlong.h [__s390x__] (add_ssaaaa, sub_ddmmss, UTItype) + (umul_ppmm, udiv_qrnnd): New. + +2020-12-22 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + hwf-arm: fix incorrect HWCAP2 for SHA1 and SHA2 on AArch32. + + commit 6b6bfd57d0a6b2b4577c084db35078cd9fadafa5 + * src/hwf-arm.c (HWCAP2_SHA1, HWCAP2_SHA2): Change from bit indexes to + flags. + + Add missing prototype for _gcry_mac_selftest. + + commit e47f04b4a28947c90db70ccaf93e149cfd5213c9 + * src/cipher-proto.h (_gcry_hmac_selftest): Rename to... + (_gcry_mac_selftest): ... this. + +2020-12-21 NIIBE Yutaka <gniibe@fsij.org> + + Merge hmac-tests.c into mac-hmac.c. + + commit 2ab14b23afc092fd25395954c2a94db932ca4d95 + * cipher/Makefile.am (EXTRA_DIST): Remove hmac-tests.c. + * cipher/hmac-tests.c: Remove, merge into... + * cipher/mac-hmac.c: ... here. + +2020-12-18 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add s390x/zSeries acceleration for SHA3. + + commit 7532e27cacb74c92fd561524a0897163b0fcd7f4 + * cipher/asm-inline-s390x.h (KLMD_PADDING_STATE): New. + (kimd_execute): Change 'reg0' from read-only to read/write. + (klmd_shake_execute): New. + * cipher/keccak.c (USE_S390X_CRYPTO): New. + (KECCAK_CONTEXT) [USE_S390X_CRYPTO]: New members. + [USE_S390X_CRYPTO] (keccak_bwrite_s390x, keccak_final_s390x) + (keccak_bextract_s390x, keccak_write_s390x, keccak_extract_s390x): New. + (keccak_write) [USE_S390X_CRYPTO]: Use accelerated function if enabled. + (keccak_final) [USE_S390X_CRYPTO]: Likewise. + (keccak_extract) [USE_S390X_CRYPTO]: Likewise. + (keccak_init) [USE_S390X_CRYPTO]: Detect and setup zSeries + acceleration. + + Add s390x/zSeries acceleration for SHA512. + + commit 45f0ec0c4e3b08627cbf7e65f5f110c321710d01 + * cipher/sha512.c (USE_S390X_CRYPTO): New. + (SHA512_CONTEXT) [USE_S390X_CRYPTO]: New members. + (do_sha512_transform_s390x, do_sha512_final_s390x): New. + (sha512_init_common) [USE_S390X_CRYPTO]: Detect and setup s390x/zSeries + acceleration. + (sha512_final) [USE_S390X_CRYPTO]: Use accelerated final function. + + Add s390x/zSeries acceleration for SHA256. + + commit 0b555c3cc7c2b80ec2628685946a6139a1996911 + * cipher/sha256.c (USE_S390X_CRYPTO): New. + (SHA256_CONTEXT) [USE_S390X_CRYPTO]: New members. + (do_sha256_transform_s390x, do_sha256_final_s390x): New. + (sha256_common_init) [USE_S390X_CRYPTO]: Detect and setup s390x/zSeries + acceleration. + (sha256_final) [USE_S390X_CRYPTO]: Use accelerated final function. + + Add s390x/zSeries acceleration for SHA1. + + commit 88570515b4ca92a44c4e40c31f877c11cc00ab68 + * cipher/asm-inline-s390x.h (ALWAYS_INLINE): New. + (klmd_query): New. + (km_function_to_mask, kimd_execute, klmd_execute): Mark as always + inline. + * cipher/rijndael-s390x.c (ALWAYS_INLINE): Remove. + * cipher/sha1.c (do_sha1_transform_s390x, do_sha1_final_s390x): New. + (sha1_init) [SHA1_USE_S390X_CRYPTO]: Detect and setup s390x/zSeries + acceleration. + (sha1_final) [SHA1_USE_S390X_CRYPTO]: Use accelerated final function. + * cipher/sha1.h (SHA1_USE_S390X_CRYPTO): New. + (SHA1_CONTEXT) [SHA1_USE_S390X_CRYPTO]: New. + + Add bulk AES-GCM acceleration for s390x/zSeries. + + commit 5aeb091f911398217b2e9facb9bdeb05c63d7844 + * cipher/Makefile.am: Add 'asm-inline-s390x.h'. + * cipher/asm-inline-s390x.h: New. + * cipher/cipher-gcm.c [GCM_USE_S390X_CRYPTO] (ghash_s390x_kimd): New. + (setupM) [GCM_USE_S390X_CRYPTO]: Add setup for s390x GHASH function. + * cipher/cipher-internal.h (GCM_USE_S390X_CRYPTO): New. + * cipher/rijndael-s390x.c (u128_t, km_functions_e): Move to + 'asm-inline-s390x.h'. + (aes_s390x_gcm_crypt): New. + (_gcry_aes_s390x_setup_acceleration): Use 'km_function_to_mask'; Add + setup for GCM bulk function. + + Add bulk function interface for GCM mode. + + commit f4e63e92dc0b79633f48b11d292dd7bdf2752ede + * cipher/cipher-gcm.c (do_ghash_buf): Proper handling for the case + where 'unused' gets filled to full blocksize. + (gcm_crypt_inner): New. + (_gcry_cipher_gcm_encrypt, _gcry_cipher_gcm_decrypt): Use + 'gcm_crypt_inner'. + * cipher/cipher-internal.h (cipher_bulk_ops_t): Add 'gcm_crypt'. + + Add s390x/zSeries acceleration for AES. + + commit 9219d9d1b60c01a4c7dbde05ee6b5b52e0d7d072 + * configure.ac: Add 'rijndael-s390x.lo'. + * cipher/Makefile.am: Add 'rijndael-s390x.c'. + * cipher/rijndael-internal.c (USE_S390X_CRYPTO): New. + (RIJNDAEL_context_s) [USE_S390X_CRYPTO]: New 'km*_func' members. + * cipher/rijndael-s390x.c: New. + * cipher/rijndael.c (_gcry_aes_s390x_setup_acceleration) + (_gcry_aes_s390x_setup_setkey) + (_gcry_aes_s390x_setup_prepare_decryption, _gcry_aes_s390x_encrypt) + (_gcry_aes_s390x_decrypt): New. + (do_setkey) [USE_S390X_CRYPTO]: Add s390x acceleration setup. + + Add bulk function interface for OFB mode. + + commit f12b6788f2297391265af93a7794bfbc503de6d7 + * cipher/cipher-internal.h (cipher_bulk_ops): Add 'ofb_enc'. + * cipher/cipher-ofb.c (_gcry_cipher_ofb_encrypt): Use bulk encryption + function if defined. + * cipher/basic.c (check_bulk_cipher_modes): Add OFB-AES test vectors. + + hwf: add detection of s390x/zSeries hardware features. + + commit 128054767d5f864798a39d432997f7d38c4bf729 + * configure.ac (gcry_cv_gcc_inline_asm_s390x) + (HAVE_CPU_ARCH_S390X): Add s390x detection support. + * mpi/config.links: Add setup for s390x links. + * src/Makefile.am: Add 'hwf-s390x.c'. + * src/g10lib.h (HWF_S390X_MSA, HWF_S390X_MSA_4, HWF_S390X_8): New. + * src/hwf_common.h (_gcry_hwf_detect_s390x): New. + * src/hwf-s390x.c: New. + * src/hwfeatures.c: Add "s390x-msa", "s390x-msa-4" and "s390x-msa-8". + + tests/bench-slope: use same benchmarking for XTS as for other modes. + + commit 0e37bb32e215feb4716341f7053c4f54806645cb + * tests/bench-slope.c (bench_xts_encrypt_init): Use same buffer + sizes as other tests. + (bench_xts_encrypt_do_bench, bench_xts_decrypt_do_bench): Remove. + (xts_encrypt_ops): Use 'bench_encrypt_do_bench'. + (xts_decrypt_ops): Use 'bench_decrypt_do_bench'. + + aarch64: mpi/longlong.h: fix operand size mismatch. + + commit c59b5b03a063ebc73935dbb10bc4f568faddbedf + * mpi/longlong.h [__aarch64__] (count_leading_zeros): Use correctly + sized temporary variable for asm output. + + aarch64: use configure check for assembly ELF directives support. + + commit 8352b0ece5237e3f86f1525b072e8f690ad0fa94 + * configure.ac (gcry_cv_gcc_asm_elf_directives): New check. + (HAVE_GCC_ASM_ELF_DIRECTIVES): New 'config.h' macro. + * cipher/asm-common-aarch64.h (ELF): Change feature macro check from + __ELF__ to HAVE_GCC_ASM_ELF_DIRECTIVES. + +2020-12-18 NIIBE Yutaka <gniibe@fsij.org> + + Reorganize self-tests for HMAC. + + commit c90fb0d8fb7a84bbcc8d6832de6a554405591850 + * cipher/Makefile.am: Prepare merge of hmac-test.c into mac-hmac.c. + * cipher/hmac-tests.c: Ifdef-out run_selftests and _gcry_hmac_selftest. + * cipher/mac-internal.h: Include cipher-proto.h for selftest. + (gcry_mac_spec_ops): Add selftest field. + * cipher/mac-hmac.c: Include hmac-tests.c for migration. + (hmac_selftest) New. + (hmac_ops): Add hmac_selftest. + * cipher/gost28147.c, cipher/mac-cmac.c: Add new field for selftest. + * cipher/mac-gmac.c, cipher/mac-poly1305.c: Likewise.. + * cipher/mac.c (_gcry_mac_selftest): New. + * src/fips.c (run_mac_selftests): Rename from run_hmac_selftests. + Use GCRY_MAC_HMAC_*, and call _gcry_mac_selftest. + (_gcry_fips_run_selftests): Use run_mac_selftests. + +2020-12-03 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Prevent link-time optimization from inlining __gcry_burn_stack. + + commit 1a83df98b198902ee6d71549231a3af37088d452 + * src/g10lib.h (NOINLINE_FUNC): New attribute macro. + * src/misc.c (__gcry_burn_stack): Add NOINLINE_FUNC attribute. + + tests/basic: check 32-bit and 64-bit overflow for CTR and ChaCha20. + + commit 2065720b5b0642cc1a0e08086a434244ebb1abf2 + * tests/basic.c (check_one_cipher_ctr_reset) + (check_one_cipher_ctr_overflow): New. + (check_one_cipher): Add counter overflow tests for ChaCha20 and CTR + mode. + + chacha20-ppc: fix 32-bit counter overflow handling. + + commit ed45eac3b721c1313902b977379fbd4886ccca7b + * cipher/chacha20-ppc.c (vec_add_ctr_u64, ADD_U64): New. + (_gcry_chacha20_ppc8_blocks1, _gcry_chacha20_ppc8_blocks4) + (_gcry_chacha20_poly1305_ppc8_blocks4): Use ADD_U64 when incrementing + counter. + +2020-12-03 NIIBE Yutaka <gniibe@fsij.org> + + tests: Put a work around to tests/random for macOS. + + commit 9769b40b54cf010a0c41c4ab05a7a88e17d70613 + * configure.ac [*-apple-darwin*] (USE_POSIX_SPAWN_FOR_TESTS): New. + * tests/random.c [USE_POSIX_SPAWN_FOR_TESTS] (run_all_rng_tests): New. + +2020-11-18 NIIBE Yutaka <gniibe@fsij.org> + + build: Update to newer autoconf constructs. + + commit 9485ca7b5bf11194cff59edbfa6a0fba3bf6162a + * acinclude.m4 (GNUPG_SYS_SYMBOL_UNDERSCORE): Use AS_MESSAGE_LOG_FD + instead of AC_FD_CC. + (GNUPG_CHECK_MLOCK): Use AC_LINK_IFELSE instead of AC_TRY_LINK. + Use AC_RUN_IFELSE instead of AC_TRY_RUN. + * configure.ac (AC_ISC_POSIX): Replace by AC_SEARCH_LIBS. + Use AC_USE_SYSTEM_EXTENSIONS instead of AC_GNU_SOURCE. + Use AS_HELP_STRING instead of AC_HELP_STRING. + (AC_TYPE_SIGNAL): Remove. + (AC_DECL_SYS_SIGLIST): Remove. + * m4/Makefile.am (EXTRA_DIST): Update. + * m4/onceonly.m4: Remove. + * m4/socklen.m4: Update from gnulib. + * m4/libtool.m4: Update from libgpg-error. + * m4/gpg-error.m4: Update from libgpg-error. + * m4/noexecstack.m4: Use AS_HELP_STRING instead of AC_HELP_STRING. + + build: Use modern Autoconf check for type. + + commit 425bf499185d78aa8fcad6a30b8771e7865d449d + * configure.ac (byte, ushort, us6, u32, u64): Use AC_CHECK_TYPES. + * cipher/poly1305.c: Use HAVE_TYPE_U64. + * src/hmac256.c: HAVE_TYPE_U32. + * src/types.h: Use HAVE_TYPE_BYTE, HAVE_TYPE_USHORT, HAVE_TYPE_U16, + HAVE_TYPE_U32, and HAVE_TYPE_U64. + + m4: Update with newer autoconf constructs. + + commit 908e347fb68b28e180ac816b5050406358e81a0f + * src/libgcrypt.m4: Replace AC_HELP_STRING to AS_HELP_STRING. + +2020-10-30 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Handle removed zeros at the beginning for Ed25519. + + commit 361a0588489cf4a539da8debd1771024a1faa218 + * cipher/ecc-curves.c (mpi_ec_setup_elliptic_curve): Accept private + key with removed zeros. + +2020-10-23 Werner Koch <wk@gnupg.org> + + random: Allow for a Unicode random seed file on Windows. + + commit 24341f58f0d38bd62c45d285bcf8472f82b56135 + * random/random-csprng.c (utf8_to_wchar) [W32]: New. + (any8bitchar) [W32]: New. + (my_open): New. Replace all calls to open with this. + +2020-10-01 Tianjia Zhang <tianjia.zhang@linux.alibaba.com> + + tests: Fix typo in comment. + + commit 4a50c6b88d6d8d843e50add851a8a5e691349097 + * tests/basic.c: Fix typo in comment. + +2020-09-27 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael: clean-up prepare_decryption function. + + commit 2051d5bd6f732a36e5a536cba734531a9e2e915f + * cipher/rijndael-internal.h (rijndael_prepare_decfn_t): New. + (RIJNDAEL_context_s): New member 'prepare_decryption'. + * cipher/rijndael-padlock.c (_gcry_aes_padlock_prepare_decryption): New. + * cipher/rijndael.c (_gcry_aes_padlock_prepare_decryption): New. + (do_setkey): Setup 'ctx->prepare_decryption' for each acceleration type. + (prepare_decryption): Remove calls to other prepare decryption functions. + (check_decryption_preparation): Call 'ctx->prepare_decryption' instead + of 'prepare_decryption'. + + rijndael: clean-up generic bulk functions. + + commit 7679c918ade9d334bc80cb8c10916bbc847ff382 + * cipher/rijndael.c (_gcry_aes_cfb_enc, _gcry_aes_cbc_enc) + (_gcry_aes_ctr_enc, _gcry_aes_cfb_dec, _gcry_aes_cbc_dec) + (_gcry_aes_ocb_crypt, _gcry_aes_ocb_auth, _gcry_aes_xts_crypt): Remove + calls to hardware accelerated AES bulk functions. + + cipher: setup bulk functions at each algorithms key setup. + + commit 51271eb86bcb0eb89e55a2add9607c503f182c89 + * cipher/cipher-internal.h (cipher_mode_ops_t, cipher_bulk_ops_t): New. + (gcry_cipher_handle): Define members 'mode_ops' and 'bulk' using new + types. + * cipher/cipher.c (_gcry_cipher_open_internal): Remove bulk function + setup. + (cipher_setkey): Pass context bulk function pointer to algorithm setkey + function. + * cipher/cipher-selftest.c (_gcry_selftest_helper_cbc) + (_gcry_selftest_helper_cfb, _gcry_selftest_helper_ctr): Remove bulk + function parameter; Use bulk function returned by setkey function. + * cipher/cipher-selftest.h (_gcry_selftest_helper_cbc) + (_gcry_selftest_helper_cfb, _gcry_selftest_helper_ctr): Remove bulk + function parameter. + * cipher/arcfour.c (arcfour_setkey): Change 'hd' parameter to + 'bulk_ops'. + * cipher/blowfish.c (bf_setkey): Change 'hd' parameter to + 'bulk_ops'; Setup 'bulk_ops' with bulk acceleration functions. + (_gcry_blowfish_ctr_enc, _gcry_blowfish_cbc_dec) + (_gcry_blowfish_cfb_dec): Make static. + (selftest_ctr, selftest_cbc, selftest_cfb): Do not pass bulk function + to selftest helper. + (selftest): Pass 'bulk_ops' to setkey function. + * cipher/camellia.c (camellia_setkey): Change 'hd' parameter to + 'bulk_ops'; Setup 'bulk_ops' with bulk acceleration functions. + (_gcry_camellia_ctr_enc, _gcry_camellia_cbc_dec) + (_gcry_camellia_cfb_dec, _gcry_camellia_ocb_crypt) + (_gcry_camellia_ocb_auth): Make static. + (selftest_ctr, selftest_cbc, selftest_cfb): Do not pass bulk function + to selftest helper. + (selftest): Pass 'bulk_ops' to setkey function. + * cipher/cast5.c (cast_setkey): Change 'hd' parameter to + 'bulk_ops'; Setup 'bulk_ops' with bulk acceleration functions. + (_gcry_cast5_ctr_enc, _gcry_cast5_cbc_dec, _gcry_cast5_cfb_dec): Make + static. + (selftest_ctr, selftest_cbc, selftest_cfb): Do not pass bulk function + to selftest helper. + (selftest): Pass 'bulk_ops' to setkey function. + * cipher/chacha20.c (chacha20_setkey): Change 'hd' parameter to + 'bulk_ops'. + * cipher/cast5.c (do_tripledes_setkey): Change 'hd' parameter to + 'bulk_ops'; Setup 'bulk_ops' with bulk acceleration functions. + (_gcry_3des_ctr_enc, _gcry_3des_cbc_dec, _gcry_3des_cfb_dec): Make + static. + (bulk_selftest_setkey): Change 'hd' parameter to 'bulk_ops'. + (selftest_ctr, selftest_cbc, selftest_cfb): Do not pass bulk function + to selftest helper. + (do_des_setkey): Change 'hd' parameter to 'bulk_ops'. + * cipher/gost28147.c (gost_setkey): Change 'hd' parameter to + 'bulk_ops'. + * cipher/idea.c (idea_setkey): Change 'hd' parameter to 'bulk_ops'. + * cipher/rfc2268.c (do_setkey): Change 'hd' parameter to 'bulk_ops'. + * cipher/rijndael.c (do_setkey): Change 'hd' parameter to + 'bulk_ops'; Setup 'bulk_ops' with bulk acceleration functions. + (rijndael_setkey): Change 'hd' parameter to 'bulk_ops'. + (_gcry_aes_cfb_enc, _gcry_aes_cfb_dec, _gcry_aes_cbc_enc) + (_gcry_aes_cbc_dec, _gcry_aes_ctr_enc, _gcry_aes_ocb_crypt) + (_gcry_aes_ocb_auth, _gcry_aes_xts_crypt): Make static. + (selftest_basic_128, selftest_basic_192, selftest_basic_256): Pass + 'bulk_ops' to setkey function. + (selftest_ctr, selftest_cbc, selftest_cfb): Do not pass bulk function + to selftest helper. + * cipher/salsa20.c (salsa20_setkey): Change 'hd' parameter to + 'bulk_ops'. + * cipher/seed.c (seed_setkey): Change 'hd' parameter to 'bulk_ops'. + * cipher/serpent.c (serpent_setkey): Change 'hd' parameter to + 'bulk_ops'; Setup 'bulk_ops' with bulk acceleration functions. + (_gcry_serpent_ctr_enc, _gcry_serpent_cbc_dec, _gcry_serpent_cfb_dec) + (_gcry_serpent_ocb_crypt, _gcry_serpent_ocb_auth): Make static. + (selftest_ctr_128, selftest_cbc_128, selftest_cfb_128): Do not pass + bulk function to selftest helper. + * cipher/sm4.c (sm4_setkey): Change 'hd' parameter to 'bulk_ops'; Setup + 'bulk_ops' with bulk acceleration functions. + (_gcry_sm4_ctr_enc, _gcry_sm4_cbc_dec, _gcry_sm4_cfb_dec) + (_gcry_sm4_ocb_crypt, _gcry_sm4_ocb_auth): Make static. + (selftest_ctr_128, selftest_cbc_128, selftest_cfb_128): Do not pass + bulk function to selftest helper. + * cipher/twofish.c (twofish_setkey): Change 'hd' parameter to + 'bulk_ops'; Setup 'bulk_ops' with bulk acceleration functions. + (_gcry_twofish_ctr_enc, _gcry_twofish_cbc_dec) + (_gcry_twofish_cfb_dec, _gcry_twofish_ocb_crypt) + (_gcry_twofish_ocb_auth): Make static. + (selftest_ctr, selftest_cbc, selftest_cfb): Do not pass bulk function + to selftest helper. + (selftest, main): Pass 'bulk_ops' to setkey function. + * src/cipher-proto.h: Forward declare 'cipher_bulk_ops_t'. + (gcry_cipher_setkey_t): Replace 'hd' with 'bulk_ops'. + * src/cipher.h: Remove bulk acceleration function prototypes for + 'aes', 'blowfish', 'cast5', 'camellia', '3des', 'serpent', 'sm4' and + 'twofish'. + +2020-09-21 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael: tidy do_setkey little bit. + + commit e0829ae648d9d9da67cd8a8fae7aa05774a0d0f7 + * cipher/rijndael.c (do_setkey): Reduce number of ifdefs by using + function pointer for accelerated key-setup. + +2020-09-18 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael-aesni: tweak x86_64 AES-NI for better performance on AMD Zen2. + + commit f96989f0e9085fa58b475131d29b37f68ba564ec + * cipher/rijndael-aesni.c (do_aesni_enc_vec8, do_aesni_dec_vec8): Move + first round key xoring and last round out to caller. + (do_aesni_ctr_4): Change low 8-bit counter overflow check to 8-bit + addition to low-bits and detect overflow from carry flag; Adjust + slow path to restore counter. + (do_aesni_ctr_8): Same as above; Interleave first round key xoring and + first round with CTR generation on fast path; Interleave last round + with output xoring. + (_gcry_aes_aesni_cfb_dec, _gcry_aes_aesni_cbc_dec): Add first round + key xoring; Change order of last round xoring and output xoring + (shorten the dependency path). + (_gcry_aes_aesni_ocb_auth): Add first round key xoring and last round + handling. + +2020-08-26 Werner Koch <wk@gnupg.org> + + build: Allow customization of the signing key. + + commit 9cd92ebae21900e54cc3d8b607c8ed1afbf2eb9b + * Makefile.am (sign-release): Read variabales from user configuration. + +2020-08-21 NIIBE Yutaka <gniibe@fsij.org> + + tests: Fix basic.c. + + commit fd51bc523d095168ee9367fe3f18d18f7a88ad90 + * tests/basic.c (check_one_hmac): Fix error paths. + (check_pubkey_crypt): Fix wrong call of gcry_sexp_new. + + ecc: Fix an error path. + + commit 65a2cd139e21250e6581a4f610015937e7b91451 + * cipher/ecc-ecdh.c (_gcry_ecc_mul_point): Avoid null dereference on + error. + +2020-07-23 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + chacha20-aarch64: improve performance through higher SIMD interleaving. + + commit 8d7b1d0a52bde173646e5b42b31d23593eabecf2 + * cipher/chacha20-aarch64.S (ROTATE2, ROTATE2_8, ROTATE2_16) + (QUARTERROUND2): Replace with... + (ROTATE4, ROTATE4_8, ROTATE4_16, QUARTERROUND4): ...these. + (_gcry_chacha20_aarch64_blocks4) + (_gcry_chacha20_poly1305_aarch64_blocks4): Adjust to use QUARTERROUND4. + + tests/bench-slope: improve CPU frequency auto-detection. + + commit f1c3db3bf40e07cfd1a6a92209865ee7a98129ca + * configure.ac (gcry_cv_have_asm_volatile_memory): Check also if + assembly memory barrier with input/output register is supported. + * tests/bench-slope.c (auto_ghz_bench): Change to use base operation + that takes two CPU cycles and unroll loop by 1024 operations. + + Enable jitter entropy also on non-x86 architectures. + + commit 886120f33bd3f10e6e6a09920eca1f9ed81044e7 + * configure.ac: Do not force jentsupport to "n/a" on non-x86 + architectures. + + random/jitterentropy: fix USE_JENT == JENT_USES_GETTIME code path. + + commit 4ed9b949485448816a70d86260d572f08ae34621 + * random/jitterentropy-base-user.h (jent_get_nstime): Use 'tv' variable + instead of non-existing 'time'. + + Camellia AES-NI/AVX/AVX2 size optimization. + + commit 4c0e244fc53e0f7b927bfe4cf54695b5d282fd27 + * cipher/camellia-aesni-avx-amd64.S: Use loop for handling repeating + '(enc|dec)_rounds16/fls16' portions of encryption/decryption. + * cipher/camellia-aesni-avx2-amd64.S: Use loop for handling repeating + '(enc|dec)_rounds32/fls32' portions of encryption/decryption. + +2020-07-14 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Support reading EC point in compressed format for good curves. + + commit e0dabf74bf276500257f15b85ded9cf24ccc8334 + * cipher/ecc-curves.c (gcry_ecc_get_curve): Handle G, differently. + * cipher/ecc-misc.c (_gcry_ecc_sec_decodepoint): Support compressed + representation of EC point. Rename from _gcry_ecc_os2ec. + * cipher/ecc-sm2.c (_gcry_ecc_sm2_decrypt) Follow the change. + * cipher/ecc.c (ecc_decrypt_raw): Likewise. + * mpi/ec.c (_gcry_mpi_ec_set_point): Likewise. + * src/ec-context.h: API change _gcry_ecc_sec_decodepoint from + _gcry_ecc_os2ec. + * tests/basic.c (check_pubkey): Use compressed representation + for two public keys of NIST P192 and NIST P256. + +2020-07-06 Werner Koch <wk@gnupg.org> + + mpi: Consider +0 and -0 the same in mpi_cmp. + + commit 1f3a92e103d4a8e019d8d022647a2b9fb2681327 + * mpi/mpi-cmp.c (do_mpi_cmp): Check size of U an V. + +2020-06-23 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix length computation. + + commit 1db1dc7945b111b6e20a8420ad38a358316681ab + * cipher/ecc-curves.c (mpi_ec_setup_elliptic_curve): Add one only for + Edwards case. + +2020-06-20 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add SM4 x86-64/AES-NI/AVX2 implementation. + + commit 35a78eb248d6bacd2a58477a122a0020d796ce63 + * cipher/Makefile.am: Add 'sm4-aesni-avx2-amd64.S'. + * cipher/sm4-aesni-avx2-amd64.S: New. + * cipher/sm4.c (USE_AESNI_AVX2): New. + (SM4_context) [USE_AESNI_AVX2]: Add 'use_aesni_avx2'. + [USE_AESNI_AVX2] (_gcry_sm4_aesni_avx2_ctr_enc) + (_gcry_sm4_aesni_avx2_cbc_dec, _gcry_sm4_aesni_avx2_cfb_dec) + (_gcry_sm4_aesni_avx2_ocb_enc, _gcry_sm4_aesni_avx2_ocb_dec) + (_gcry_sm4_aesni_avx_ocb_auth): New. + (sm4_setkey): Enable AES-NI/AVX2 if supported by HW. + (_gcry_sm4_ctr_enc, _gcry_sm4_cbc_dec, _gcry_sm4_cfb_dec) + (_gcry_sm4_ocb_crypt, _gcry_sm4_ocb_auth) [USE_AESNI_AVX2]: Add + AES-NI/AVX2 bulk functions. + * configure.ac: Add ''sm4-aesni-avx2-amd64.lo'. + + Add SM4 x86-64/AES-NI/AVX implementation. + + commit c9a3f1bb91e63033e3bf3e06bdd6075622626d0d + * cipher/Makefile.am: Add 'sm4-aesni-avx-amd64.S'. + * cipher/sm4-aesni-avx-amd64.S: New. + * cipher/sm4.c (USE_AESNI_AVX, ASM_FUNC_ABI): New. + (SM4_context) [USE_AESNI_AVX]: Add 'use_aesni_avx'. + [USE_AESNI_AVX] (_gcry_sm4_aesni_avx_expand_key) + (_gcry_sm4_aesni_avx_crypt_blk1_8, _gcry_sm4_aesni_avx_ctr_enc) + (_gcry_sm4_aesni_avx_cbc_dec, _gcry_sm4_aesni_avx_cfb_dec) + (_gcry_sm4_aesni_avx_ocb_enc, _gcry_sm4_aesni_avx_ocb_dec) + (_gcry_sm4_aesni_avx_ocb_auth, sm4_aesni_avx_crypt_blk1_8): New. + (sm4_expand_key) [USE_AESNI_AVX]: Use AES-NI/AVX key setup. + (sm4_setkey): Enable AES-NI/AVX if supported by HW. + (_gcry_sm4_ctr_enc, _gcry_sm4_cbc_dec, _gcry_sm4_cfb_dec) + (_gcry_sm4_ocb_crypt, _gcry_sm4_ocb_auth) [USE_AESNI_AVX]: Add + AES-NI/AVX bulk functions. + * configure.ac: Add ''sm4-aesni-avx-amd64.lo'. + + Optimizations for SM4 cipher. + + commit 81fee26bbbae820a311a3ce3ac55e304655c2acd + * cipher/cipher.c (_gcry_cipher_open_internal): Add SM4 bulk + functions. + * cipher/sm4.c (ATTR_ALIGNED_64): New. + (sbox): Convert to ... + (sbox_table): ... this structure for sbox hardening as is done + for AES and GCM. + (prefetch_sbox_table): New. + (sm4_t_non_lin_sub): Make inline; Optimize sbox access pattern. + (sm4_key_lin_sub): Make inline; Tune slightly. + (sm4_key_sub, sm4_enc_sub): Make inline. + (sm4_round): Make inline; Take 'x' as separate parameters instead + of array. + (sm4_expand_key): Return void; Drop keylen; Unroll loops by 4; + Wipe sensitive variables at end; Move key-length check to + 'sm4_setkey'. + (sm4_setkey): Add initial self-test step; Add key-length check; + Remove burn stack (as variables wiped in 'sm4_expand_key'). + (sm4_do_crypt): Return burn stack depth; Unroll loops by 4. + (sm4_encrypt, sm4_decrypt): Prefetch sbox table; Return burn + stack from 'sm4_do_crypt', as allows tail-call optimization + by compiler. + (sm4_do_crypt_blks2): New two parallel block function for greater + instruction level parallelism. + (sm4_crypt_blocks, _gcry_sm4_ctr_enc, _gcry_sm4_cbc_dec) + (_gcry_sm4_cfb_dec, _gcry_sm4_ocb_crypt, _gcry_sm4_ocb_auth): New + bulk processing functions. + (selftest_ctr_128, selftest_cbc_128, selftest_cfb_128): New + bulk processing self-tests. + (sm4_selftest): Clear SM4 context before use; Use 'sm4_expand_key' + instead of 'sm4_setkey'; Call bulk processing self-tests. + * src/cipher.h (_gcry_sm4_ctr_enc, _gcry_sm4_ctr_dec) + (_gcry_sm4_cfb_dec, _gcry_sm4_ocb_crypt, _gcry_sm4_ocb_auth): New. + * tests/basic.c (check_ocb_cipher): Add SM4-OCB test vector. + +2020-06-18 NIIBE Yutaka <gniibe@fsij.org> + + ecc: For Ed448, it's only for EdDSA. + + commit a6177e1bc948a7af052d62bcd62aa6b5825bfaff + * cipher/ecc.c (ecc_sign): Ed448 is only for EdDSA. + Hash algo is determined by the curve. + (ecc_verify): Likewise. + * tests/t-ed448.c (one_test): Don't specify (flags eddsa). + Don't specify hash-algo. + + ecc: Fix the condition for EdDSA data handling. + + commit f2847d56cce2afdd993f797812a673495a41c234 + * cipher/pubkey-util.c (_gcry_pk_util_data_to_mpi): It may be + the encoding context which determines EdDSA. Hash-algo can be + omitted. Flags are OR-ed. + + ecc: Support EdDSA with context and enabling PH(M). + + commit ba78ad8f19674b94edfdf4998f40feee081481bc + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_compute_h_d): Simplify. + (DOM4_0_NONE, DOM4_0_NONE_LEN): Remove. + (DOM25519, DOM25519_LEN): New. + (DOM448, DOM448_LEN): New. + (_gcry_ecc_eddsa_sign): Support EdDSA with context and PH. + (_gcry_ecc_eddsa_verify): Likewise. + * tests/t-ed448.c: Add tests with context and PH=1. + * tests/t-ed448.inp: Add test data. + + ecc: Change EdDSA internal API. + + commit 2856ac14ae3e4c9e6288e1f0d8bc1945bb874081 + * cipher/ecc-common.h (_gcry_ecc_eddsa_sign): Last arg is CTX. + (_gcry_ecc_eddsa_verify): Ditto. + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_sign): Get hash algo from CTX. + (_gcry_ecc_eddsa_verify): Ditto. + * cipher/ecc.c (ecc_sign, ecc_verify): Follow the change. + +2020-06-17 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Support "label" for EdDSA context in data. + + commit 1cf49754694611620fd383327cf127e91f6883df + * cipher/pubkey-util.c (_gcry_pk_util_data_to_mpi): Handle ctx->label. + + ecc: Initialize key before handling data. + + commit d51a9c259d49c63121fab48bce48d826e9b57733 + * cipher/ecc.c (ecc_sign): Initialize key at first. + (ecc_verify): Likewise. + + ecc: Add new flag "prehash". + + commit 9a640eba6dd7504c90a65151cdaf1e4093a8b475 + * src/cipher.h (PUBKEY_FLAG_PREHASH): New. + * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist): Parse it. + + ecc: No (flags eddsa) required for Ed448. + + commit b1721f9b291a4c226caa2bfbe4fefe8fde5216e0 + * cipher/ecc.c (check_secret_key): Ed448 means EdDSA. + (ecc_generate): Likewise. + * tests/t-ed448.c (one_test): Remove the flag in key. + + ecc: Support Ed448 by _gcry_ecc_compute_public. + + commit 5585ee4947082f932ee01d93dfe295c769e96671 + * cipher/ecc-misc.c (_gcry_ecc_compute_public): Handle Ed448. + +2020-06-16 Tianjia Zhang <tianjia.zhang@linux.alibaba.com> + + tests: Add basic test-vectors for SM4. + + commit c1535d0b8797e9b3bbfb5193b6ab23bf788ffd36 + * tests/basic.c (check_ciphers): Add SM4 check and test-vectors. + + Add SM4 symmetric cipher algorithm. + + commit ddcce166ab8bc6f51f5b509bcbea13a8746384ec + * cipher/Makefile.am (EXTRA_libcipher_la_SOURCES): Add sm4.c. + * cipher/cipher.c (cipher_list, cipher_list_algo301): Add + _gcry_cipher_spec_sm4. + * cipher/mac-cmac.c (map_mac_algo_to_cipher): Add cmac SM4. + (_gcry_mac_type_spec_cmac_sm4): Add cmac SM4. + * cipher/mac-internal.h: Declare spec_cmac_sm4. + * cipher/mac.c (mac_list, mac_list_algo201): Add cmac SM4. + * cipher/sm4.c: New. + * configure.ac (available_ciphers): Add sm4. + * doc/gcrypt.texi: Add SM4 document. + * src/cipher.h: Add declarations for SM4 and cmac SM4. + * src/gcrypt.h.in (gcry_cipher_algos): Add algorithm ID for SM4. + +2020-06-16 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + doc: add GCRY_MD_SM3, GCRY_MAC_HMAC_SM3 and GCRY_MAC_GOST28147_IMIT. + + commit 6c571bfda6409d7d668f5d44cea0c6c31e2688be + * doc/gcrypt.texi: add GCRY_MD_SM3, GCRY_MAC_HMAC_SM3 and + GCRY_MAC_GOST28147_IMIT. + +2020-06-16 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix Ed448 key generation. + + commit c15cc1a38199cf0d758579eb01d0e88c99cd4b80 + * cipher/ecc.c (ecc_generate): Fix point representation for Ed448. + + ecc,test: Add testing Ed448. + + commit c7779e499e9051ee79ed720f576dbf40d90cdfb1 + + + ecc: Support Ed448 for verify. + + commit d1baad35c65030e41fcba69854c57032eee0d111 + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_verify): Support Ed448. + + ecc: Support Ed448 signing. + + commit 951b37c5038667b461692454397bb058b5e1e184 + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_sign): Support Ed448. + + ecc: Use SHAKE256 in EdDSA with Ed448. + + commit 32d6d73d44d372dd1ec0b08ba03f1b7b085c09d9 + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_compute_h_d): Fix for SHAKE256. + + ecc: Support shake128 and shake256 for message digest. + + commit f6815a96e51be44a361ddcd3a20a5b969b1dab1b + * cipher/pubkey-util.c (get_hash_algo): Add shake128 and shake256. + + ecc: Support Ed448 for key generation. + + commit e25446ecc04442b399302ce72db6d5ea2e9e85e8 + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_compute_h_d): Support Ed448. + (_gcry_ecc_eddsa_genkey): Support Ed448, using + _gcry_ecc_eddsa_compute_h_d. + + ecc: Support Ed448 in decoding point. + + commit bd22b029bbf50737f90535c506fba4f812bcf040 + * cipher/ecc-eddsa.c (ecc_ed448_recover_x): New. + (_gcry_ecc_eddsa_recover_x): Support Ed448. + (_gcry_ecc_eddsa_decodepoint): Support Ed448. + * mpi/ec.c (_gcry_mpi_ec_decode_point): For Ed448, use + _gcry_ecc_eddsa_decodepoint. + + ecc: Add new curve: Ed448. + + commit 339b03acf0971a31997901dd674fb75c4dde31d0 + * cipher/ecc-curves.c (curve_aliases): Add Ed448. + (domain_parms): Add domain parameters for Ed448. + * tests/curves.c (N_CURVES): Increment. + + ecc: Fix EdDSA encoding for Ed448. + + commit 3386aaf84d4d89b6ff931533df2ff82ed3f7c7f9 + * cipher/ecc-curves.c (mpi_ec_setup_elliptic_curve): Fix point/scalar + length condition. + * cipher/ecc-eddsa.c (eddsa_encodempi): The second argument is NBITS. + (eddsa_encode_x_y): Likewise. + (_gcry_ecc_eddsa_encodepoint): Follow the change. + (_gcry_ecc_eddsa_ensure_compact): Likewise. + (_gcry_ecc_eddsa_decodepoint): Likewise. + (_gcry_ecc_eddsa_sign): Likewise. Remove restriction of 256 bits. + +2020-06-12 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix NBITS in domain_parms. + + commit db7b2c591004868abedbc2c19d3bb2efebf8529d + * cipher/ecc-curves.c (cipher/ecc-curves.c): It's NBITS of 'p'. + +2020-06-08 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael: fix UBSAN warning on left shift by 24 places with type 'int' + + commit 6cdd7268fe19b066ddb373e2f3c0b7ebf9b938dd + * cipher/rijndael.c (do_encrypt_fn, do_decrypt_fn): Cast final + sbox/inv_sbox look-ups to 'u32' type. + + Disable all assembly modules with --disable-asm. + + commit 3060aadec396802af13f08c4b2dd1b28f2a68c5d + * configure.ac (try_asm_modules): Update description, + "MPI" => "MPI and cipher". + (gcry_cv_gcc_arm_platform_as_ok, gcry_cv_gcc_aarch64_platform_as_ok) + (gcry_cv_gcc_inline_asm_ssse3, gcry_cv_gcc_inline_asm_pclmul) + (gcry_cv_gcc_inline_asm_shaext, gcry_cv_gcc_inline_asm_sse41) + (gcry_cv_gcc_inline_asm_avx, gcry_cv_gcc_inline_asm_avx2) + (gcry_cv_gcc_inline_asm_bmi2, gcry_cv_gcc_amd64_platform_as_ok) + (gcry_cv_gcc_platform_as_ok_for_intel_syntax) + (gcry_cv_cc_arm_arch_is_v6, gcry_cv_gcc_inline_asm_neon) + (gcry_cv_gcc_inline_asm_aarch32_crypto) + (gcry_cv_gcc_inline_asm_aarch64_neon) + (gcry_cv_gcc_inline_asm_aarch64_crypto) + (gcry_cv_cc_ppc_altivec, gcry_cv_gcc_inline_asm_ppc_altivec) + (gcry_cv_gcc_inline_asm_ppc_arch_3_00): Check for "try_asm_modules". + * mpi/config.links: Set "mpi_cpu_arch" to "disabled" + with --disable-asm. + +2020-06-05 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + mpicalc: fix typo. + + commit 2dd3e27fc53cf408f799d2e7b379c1441e0d62c8 + * src/mpicalc.c (print_help): fix typo in commands description. + +2020-06-04 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Fix flags in mpi_copy for opaque MPI. + + commit 78a5a1aa7627afaa24e2ea1eb9b08f1cfdd71561 + * mpi/mpiutil.c (_gcry_mpi_copy): Copy flags. + +2020-06-03 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Use opaque MPI for 'd' of Ed25519/EdDSA. + + commit 0d8346f84a1f5865da3375ce92420d92fb5ae652 + * cipher/ecc-curves.c (mpi_ec_setup_elliptic_curve): Add FLAGS. + Use opaque MPI for Ed25519/EdDSA, too. + (_gcry_mpi_ec_internal_new): Follow the change. + (_gcry_mpi_ec_new): Likewise. + +2020-06-01 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + cipher-ocb: fix out-of-array stack memory access. + + commit 8cfaeae42522778052c36fceccab504826a30cbf + * cipher/cipher-ocb.c (bit_copy): Do not access memory beyond + 's' array when bitoff > 8. + +2020-06-01 NIIBE Yutaka <gniibe@fsij.org> + + mpi: More fix of off-by-one mistake mpi_invm_pow2. + + commit 6a2cd0fe78a9cdc78911694a84b08762dd8658b4 + * mpi/mpi-inv.c (mpi_invm_pow2): Avoid out-of-band read/write. + + ecc: Consistently handle parameters as unsigned value. + + commit 6f8b1d4cb798375e6d830fd6b73c71da93ee5f3f + * cipher/ecc-curves.c (_gcry_ecc_get_curve): Parse as unsigned value. + +2020-05-27 NIIBE Yutaka <gniibe@fsij.org> + + sexp: Fix coding of line break. + + commit 33c972b6a6fe79aacb0a732d1df9a9deacafca29 + * src/sexp.c (_gcry_sexp_vextract_param): Add missing newline. + +2020-05-14 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Make sure it's the fixed size bytes. + + commit eb2288f3b1f338a9aec11d559ec84bdb201960e1 + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_decodepoint): Checking the size + of EC point representation, return GPG_ERR_INV_OBJ if not valid. + +2020-05-13 Werner Koch <wk@gnupg.org> + + ecc: Detect the use of a Montgomery curve earlier in ecc_verify. + + commit d0f995afe2e0228d3b9e30b0fc7091631d7d0090 + * cipher/ecc.c (ecc_verify): Do not allow a Montgomery curve. + +2020-05-13 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Fix off-by-one mistake mpi_invm_pow2. + + commit 69b55f87053ce2494cd4b38dc600f867bc4355be + * mpi/mpi-inv.c (mpi_invm_pow2): Avoid out-of-band read/write. + +2020-05-12 Werner Koch <wk@gnupg.org> + + ecc: Initialize a dummy parameter. + + commit 75a7b17878e02c3882070d6c86e0d2efbc3d680a + * cipher/ecc.c (ecc_verify): Rename flags to dummy_flags and + initialize. + +2020-05-06 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + tests/benchmark.c: fix error message for invalid MAC algo. + + commit 79e196a610b1b734a1f573288b148d62787f5281 + + +2020-04-27 Tianjia Zhang <tianjia.zhang@linux.alibaba.com> + + ecc: Fix typo error in ecc-gost. + + commit fe688ce7e14f14d7d3a7e16aa0304d24b5b1a179 + * cipher/ecc-gost.c (_gcry_ecc_gost_verify): Fix typo in comment. + +2020-04-27 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Fix the return value of mpi_invm_generic. + + commit f10eb240a30ac115cfeb63848c67a936e1059ab9 + * mpi/mpi-inv.c (mpi_invm_generic): Return correct value. + +2020-04-24 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Fix return value of mpi_invm_generic. + + commit bc3b6a6a45cf9fa6cc0556da870628c53570f52f + * mpi/mpi-inv.c (mpi_invm_generic): Return 0 if inverse does not exist. + + mpi: More use of mpih API for _gcry_mpi_invm. + + commit 559ba9b36c9cdf4762d28beb3b4c59665c671818 + * mpi/mpi-inv.c (mpi_invm_pow2): Remove. + (_gcry_mpi_invm): Use mpih_invm_pow2 instead. + + mpi: Use mpih interface internally for mpi-inv. + + commit beefbb90d71d7fbd0b4429472b7d4b39670ff64b + * mpi/mpi-inv.c (mpih_invm_pow2): Converted from mpi_invm_pow2. + (mpi_invm_pow2): Use mpih_invm_pow2. + + mpi: Fix size of A in mpi_invm_pow2. + + commit efa5151ea1c2a2c049b2651581e71b6becba4e16 + * mpi/mpi-inv.c (mpi_invm_pow2): Fix size of A. + +2020-04-23 NIIBE Yutaka <gniibe@fsij.org> + + mpi: More fix for _gcry_mpi_invm. + + commit f81a1dd7317513000e5bc4d1bfffd6d2bfb8c2a2 + * mpi/mpi-inv.c (_gcry_mpi_invm): Fix comments and use of CRT path. + +2020-04-22 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Fix off-by-one mistake mpi_invm_pow2. + + commit 3bb9f74764b3626ed1116fc7e517921232d6be54 + * mpi/mpi-inv.c (mpi_invm_pow2): Fix computation of iterations. + +2020-04-21 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Use mpi_invm_pow2 for mpi_invm. + + commit bac01a6cfb3d645ff8439cbd3b310d255735d792 + * mpi/mpi-inv.c (_gcry_mpi_invm): Use mpi_invm_pow2. + + mpi: Fix mpi_invm_pow2. + + commit 2a3c58a0b4db01c17da0bf8c035fb1def2af114c + * mpi/mpi-inv.c (mpi_invm_pow2): Fix the algo implementation. + +2020-04-19 Dmitry Baryshkov <dbaryshkov@gmail.com> + + gost28147: implement special MAC mode called imitovstavka (IMIT) + + commit 45f21f871982753716d4a7676d948e8c7d644db5 + * src/gcrypt.h.in (GCRY_MAC_GOST28147_IMIT): New. + * cipher/gost28147.c (gost_imit_open, gost_imit_close) + (gost_imit_setkey, gost_imit_setiv, gost_imit_reset, _gost_imit_block) + (gost_imit_block, gost_imit_write, gost_imit_finish, gost_imit_read) + (gost_imit_verify, gost_imit_get_maclen, gost_imit_get_keylen) + (gost_imit_set_extra_info): New functions implementing GOST 28147-89 + MAC (imitovstavka, IMIT) mode. + * cipher/gost28147.c (gost_imit_ops) + (_gcry_mac_type_spec_gost28147_imit): declare GOST 28147-89 IMIT + handler. + * cipher/mac-internal.h (gcry_mac_handle): add fields to support GOST + 28147-89 IMIT mode. + * cipher/mac.c (mac_list): add _gcry_mac_type_spec_gost28147_imit. + (spec_from_algo): handle GCRY_MAC_GOST28147_IMIT. + * tests/basic.c (check_mac): add GOST28147-89 IMIT test vector. + + mac: add support for gcry_mac_ctl(GCRYCTL_SET_SBOX) + + commit d7fa70ed9ddc6e0189a8b59016b1f17717a26865 + * cipher/mac-internal.h (gcry_mac_spec_ops_t): add set_extra_info field + for providing additional settings. + * cipher/mac.c (_gcry_mac_ctl): support GCRYCTL_SET_SBOX call. + * cipher/mac-cmac.c (cmac_ops): set set_extra_info to NULL. + * cipher/mac-gmac.c (gmac_ops): the same. + * cipher/mac-hmac.c (hmac_ops): the same. + * cipher/mac-poly1305.c (poly1305mac_ops): the same. + +2020-04-17 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Use mpi_invm_pow2 for N=2^k. + + commit 469e2fefb64e3a4bd80995935f82caf416e3a4ae + * mpi/mpi-inv.c (mpi_invm_pow2): Fix. + (_gcry_mpi_invm): Use mpi_invm_pow2. + + mpi: Rewrite mpi_invm_odd into mpih_invm_odd. + + commit 05ceac8e2f6f28f97428c005d0a318d71d7cf9d9 + * mpi/mpi-inv.c (mpih_invm_odd): Use mpi_ptr_t API. + (_gcry_mpi_invm): Use _gcry_mpih_mod and mpih_invm_odd. + + mpi: Add _gcry_mpih_cmp_ui. + + commit 128045a12139fe2e4be877df59da10c7d4857d9a + * mpi/mpih-const-time.c (_gcry_mpih_cmp_ui): New. + + mpi: Add internal functipn mpi_invm_pow2. + + commit 515bd6e9fae448e966f71e23635503716201158d + * mpi/mpi-inv.c (mpi_invm_pow2): New. + +2020-04-16 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Add mpi_set_bit_cond. + + commit a91bd0211c4e5f0ce575b3a63a36049dd9edbf90 + * mpi/mpiutil.c (_gcry_mpi_set_bit_cond): New. + * src/mpi.h (mpi_set_bit_cond): New macro. + (_gcry_mpi_set_bit_cond): New. + + mpi: Add _gcry_mpih_mod. + + commit 95bdfd9ce9e114f447f3639e551e8f4f63d024fe + * mpi/mpi-internal.h (mpih_mod, _gcry_mpih_mod): New. + * mpi/mpih-const-time.c (_gcry_mpih_mod): New. + + mpih: Expose const-time MPI helper functions. + + commit 9b7e0d89006fce0641da05d8ef2696b1fb73145b + * mpi/Makefile.am (libmpi_la_SOURCES): Add mpih-const-time.c. + * mpi/ec.c (mpih_set_cond): Move to mpih-const-time.c. + * mpi/mpi-internal.h: Add macros and declarations. + * mpi/mpi-inv.c (mpih_add_n_cond): Likewise. + (mpih_sub_n_cond, mpih_swap_cond, mpih_abs_cond): Likewise. + * mpi/mpih-const-time.c: New. + +2020-04-14 Werner Koch <wk@gnupg.org> + + sexp: Extend gcry_sexp_extract_param with a multi-string extractor. + + commit 32b08e38628b3ed409054db05a7f73b1ab86464a + * src/sexp.c (_gcry_sexp_vextract_param): Implement "%#s" control + sequence. + +2020-04-14 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Remove hard-coded value for ECC_DIALECT_ED25519. + + commit 0ff36e04f7cdef961610e7bc674a9c9ef0fd4853 + * mpi/ec.c (ec_p_init): Remove special handling for Ed25519. + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_encodepoint): Fix assumption + ec->nbits is 256 for EdDSA. + (_gcry_ecc_eddsa_decodepoint): Likewise. + (_gcry_ecc_eddsa_verify): Likewise. + +2020-04-09 Werner Koch <wk@gnupg.org> + + sexp: Extend gcry_sexp_extract_param with new format specifiers. + + commit 60c179b59e538aebb3a5f7621d92eee60b90c785 + * src/sexp.c (_gcry_sexp_vextract_param): Add new conversion methods. + * tests/t-sexp.c (check_extract_param): Add corresponding tests. + +2020-04-04 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + ppc: avoid using vec_vsx_ld/vec_vsx_st for 2x64-bit vectors. + + commit 1250a9cd859d99f487ca8d76a98d70d464324bbe + * cipher/crc-ppc.c (CRC_VEC_U64_LOAD, CRC_VEC_U64_LOAD_LE) + (CRC_VEC_U64_LOAD_BE): Remove vec_vsx_ld usage. + (asm_vec_u64_load, asm_vec_u64_load_le): New. + * cipher/sha512-ppc.c (vec_vshasigma_u64): Use '__asm__' instead of + 'asm' for assembly block. + (vec_u64_load, vec_u64_store): New. + (_gcry_sha512_transform_ppc8): Use vec_u64_load/store instead of + vec_vsx_ld/vec_vsx_st. + * configure.ac (gcy_cv_cc_ppc_altivec) + (gcy_cv_cc_ppc_altivec_cflags): Add check for vec_vsx_ld with + 'unsigned int *' pointer type. + +2020-04-02 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + asm-poly1305-aarch64: fix building with clang. + + commit 89b3ded8df969fe5fb31313c60419dd34d36b605 + * cipher/asm-poly1305-aarch64.h (POLY1305_BLOCK_PART25): Use correct + instruction format for right-shifting. + +2020-03-31 Daniel Kahn Gillmor <dkg@fifthhorseman.net> + + libgcrypt.m4: Fix spelling. + + commit 6a5743469a4366b1e238d378e427442f04400950 + + + libgcrypt.m4: Fix spelling. + + commit e16e7e619183f36720d17855419860d1dc6fe3a5 + + +2020-03-20 Dmitry Baryshkov <dbaryshkov@gmail.com> + + tests/basic: add GOST 28147 keymeshing testcase from LibreSSL testsuite. + + commit 3441f4c94c49a589c5e323b1526d2d6b5974cf2f + * tests/basic.c (check_cfb_cipher): add check for GOST 28147 CFB with + KeyMeshing enabled. + + gost28147: add support for CryptoPro key meshing per RFC 4357. + + commit dcee00adbd1c0a2cde1aeed1bb94421e81d0de3b + * cipher/gost28147.c (gost_do_set_sbox, cryptopro_key_meshing, + CryptoProMeshingKey, gost_encrypt_block_mesh): New. + (_gcry_cipher_spec_gost28147_mesh): New cipher with keymeshing, + (_gcry_cipher_spec_gost28147): Remove OIDs for this cipher should not + be selected using these OIDs (they are for CFB with keymeshing). + + * cipher/cipher.c (cipher_list, cipher_list_algo301): add + _gcry_cipher_spec_gost28147_mesh. + + * src/gcrypt.h.in (GCRY_CIPHER_GOST28147_MESH): New cipher with + keymeshing. + + * doc/gcrypt.texi (GCRY_CIPHER_GOST28147_MESH): Add definition. + + * tests/basic.c (check_gost28147_cipher, check_gost28147_cipher_basic): + Run basic tests on GCRY_CIPHER_GOST28147_MESH. + + gost: add keymeshing support per RFC 4357. + + commit 18cd3f0c473ae909cdaa5a820faef50d7670fcbb + * cipher/gost-s-box.c (gost_sbox): define if keymeshing should be + enabled or not. + (main): output whether we should enable or disable keymeshing for a + particular parameters set. + +2020-03-18 NIIBE Yutaka <gniibe@fsij.org> + + DSA,ECDSA: Fix use of mpi_invm. + + commit ada758e3019c2585213a132960613b1ac48502b8 + * cipher/dsa.c (sign): Call mpi_invm before _gcry_dsa_modify_k. + * cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_sign): Likewise. + + mpi: Constant time mpi_inv with some conditions. + + commit 20082ca965eab5665af60956c4ed72709836b1ed + * mpi/mpi-inv.c (mpih_add_n_cond, mpih_sub_n_cond, mpih_swap_cond) + (mpih_abs_cond): New. + (mpi_invm_odd): New. + (mpi_invm_generic): Rename from _gcry_mpi_invm. + (_gcry_mpi_invm): Use mpi_invm_odd for usual odd cases. + +2020-03-11 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Support opaque MPI with gcry_mpi_print. + + commit b4b04ae6c2e55bc2b24efc663d1eeaa0b3613f4c + * mpi/mpicoder.c (_gcry_mpi_get_buffer): Return the bytes as-is. + +2020-03-09 Werner Koch <wk@gnupg.org> + + mpi: Abort on division by zero also in _gcry_mpi_tdiv_qr. + + commit afbab896fa04d9481dbb9f4d01f607b12e31dcbf + * mpi/mpi-div.c (_gcry_mpi_tdiv_qr): Error out on division by zero. + +2020-02-25 NIIBE Yutaka <gniibe@fsij.org> + + build: More accurate dependency to -lgpg-error. + + commit 9b8ac13761f0407bd701e43b0a65fbada204958f + * configure.ac (LIBGCRYPT_CONFIG_LIBS): Remove DL_LIBS. + * src/libgcrypt.c.in: Distinguish static link use case. + * tests/Makefile.am: Fix use of -lgpg-error. + + build: Fix linking -ldl. + + commit c21e5d72e24e62752559f92b1825287298ae2f03 + * src/Makefile.am (libgcrypt_la_LIBADD): Add DL_LIBS. + (mpicalc_LDADD): Remove DL_LIBS. + * tests/Makefile.am (standard_ldadd): Remove DL_LIBS. + +2020-02-02 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + crc-ppc: fix bad register used for vector load/store assembly. + + commit b64b029318e7d0b66123015146614118f466a7a9 + * cipher/crc-ppc.c (CRC_VEC_U64_LOAD_BE): Move implementation to... + (asm_vec_u64_load_be): ...here; Add "r0" to clobber list for load + instruction when offset is not zero; Add zero offset path. + + rinjdael-aes: use zero offset vector load/store when possible. + + commit 89776d45c824032409f581e5fd1db6bf149df57f + * cipher/rijndael-ppc-common.h (asm_aligned_ld, asm_aligned_st): Use + zero offset instruction variant when input offset is constant zero. + * cipher/rijndael-ppc.c (asm_load_be_noswap) + (asm_store_be_noswap): Likewise. + + Add POWER9 little-endian variant of PPC AES implementation. + + commit 114bbc45e9717f9ad9641f64d8df8690db8da434 + * configure.ac: Add 'rijndael-ppc9le.lo'. + * cipher/Makefile.am: Add 'rijndael-ppc9le.c', 'rijndael-ppc-common.h' + and 'rijndael-ppc-functions.h'. + * cipher/rijndael-internal.h (USE_PPC_CRYPTO_WITH_PPC9LE): New. + (RIJNDAEL_context_s): Add 'use_ppc9le_crypto'. + * cipher/rijndael.c (_gcry_aes_ppc9le_encrypt) + (_gcry_aes_ppc9le_decrypt, _gcry_aes_ppc9le_cfb_enc) + (_gcry_aes_ppc9le_cfb_dec, _gcry_aes_ppc9le_ctr_enc) + (_gcry_aes_ppc9le_cbc_enc, _gcry_aes_ppc9le_cbc_dec) + (_gcry_aes_ppc9le_ocb_crypt, _gcry_aes_ppc9le_ocb_auth) + (_gcry_aes_ppc9le_xts_crypt): New. + (do_setkey, _gcry_aes_cfb_enc, _gcry_aes_cbc_enc) + (_gcry_aes_ctr_enc, _gcry_aes_cfb_dec, _gcry_aes_cbc_dec) + (_gcry_aes_ocb_crypt, _gcry_aes_ocb_auth, _gcry_aes_xts_crypt) + [USE_PPC_CRYPTO_WITH_PPC9LE]: New. + * cipher/rijndael-ppc.c: Split common code to headers + 'rijndael-ppc-common.h' and 'rijndael-ppc-functions.h'. + * cipher/rijndael-ppc-common.h: Split from 'rijndael-ppc.c'. + (asm_add_uint64, asm_sra_int64, asm_swap_uint64_halfs): New. + * cipher/rijndael-ppc-functions.h: Split from 'rijndael-ppc.c'. + (CFB_ENC_FUNC, CBC_ENC_FUNC): Unroll loop by 2. + (XTS_CRYPT_FUNC, GEN_TWEAK): Tweak generation without vperm + instruction. + * cipher/rijndael-ppc9le.c: New. + + Add gcry_cipher_ctl command to allow weak keys in testing use-cases. + + commit 5beadf201312d0c649971b0c1d4c3827b434a0b5 + * cipher/cipher-internal.h (gcry_cipher_handle): Add + 'marks.allow_weak_key' flag. + * cipher/cipher.c (cipher_setkey): Do not handle weak key as error when + weak keys are allowed. + (cipher_reset): Preserve 'marks.allow_weak_key' flag on object reset. + (_gcry_cipher_ctl): Add handling for GCRYCTL_SET_ALLOW_WEAK_KEY. + * src/gcrypt.h.in (gcry_ctl_cmds): Add GCRYCTL_SET_ALLOW_WEAK_KEY. + * tests/basic.c (check_ecb_cipher): Add tests for weak key errors and + for GCRYCTL_SET_ALLOW_WEAK_KEY. + +2020-01-23 NIIBE Yutaka <gniibe@fsij.org> + + random: Fix include of config.h. + + commit e0898d0628789414da23e0526c87df1885c8b3ae + * random/random-drbg.c: Include config.h earlier. + +2020-01-22 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + sexp: fix cast from 'int' pointer to 'size_t' pointer. + + commit 8b31091da092e22dba78b2402c2f436bbffc1c73 + * src/sexp.c (do_vsexp_sscan): Change 'datalen' from 'int' to + 'size_t'; Remove &datalen pointer cast to 'size_t *' type. + + mpi/i386: fix DWARF CFI for _gcry_mpih_sub_n and _gcry_mpih_add_n. + + commit 5f098f7e6ceb899ac27a0a30ee036de5f1be4e3d + * mpi/i386/mpih-add1.S (_gcry_mpih_add_n) [PIC]: Adjust CFI CFA offset + when making call and restoring stack pointer. + * mpi/i386/mpih-sub1.S (_gcry_mpih_sub_n) [PIC]: Ditto. + +2020-01-22 H.J. Lu <hjl.tools@gmail.com> + + i386: Add _CET_ENDBR to indirect jump targets. + + commit cb9f0a2df8225eed071ae0a56265e38e9f6ff184 + * mpi/i386/mpih-add1.S (_gcry_mpih_add_n): Save and restore + %ebx if IBT is enabed. Add _CET_ENDBR to indirect jump targets + and adjust jump destination for _CET_ENDBR. + * mpi/i386/mpih-sub1.S (_gcry_mpih_sub_n): Likewise. + + amd64: Always include <config.h> in cipher assembly codes. + + commit 22e577071790834f07753c42a191a568c9f2644d + * cipher/camellia-aesni-avx-amd64.S: Always include <config.h>. + * cipher/camellia-aesni-avx2-amd64.S: Likewise. + * cipher/serpent-avx2-amd64.S: Likewise. + + mpi: Add .note.gnu.property section for Intel CET. + + commit 24b4d5c10a97aaf82ac7402cc3a5b429d580cd66 + * mpi/config.links: Include <cet.h> in <asm-syntax.h>. + + x86: Add .note.gnu.property section for Intel CET. + + commit 4c88c2bd2a418435506325cd53246acaaa52750c + * configure.ac: Include <cet.h> in <config.h> for assembly + codes. + +2020-01-22 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + tests/basic: add vector cluttering to detect implementation bugs. + + commit 4aa8ff904262f331abbb8c988069a7029ca13502 + * src/global.c (_gcry_check_version): Fix missing newline. + * src/basic.c (ALWAYS_INLINE, CLUTTER_REGISTER_*, prepare_vector_data) + (clutter_vector_registers): New. + (progress_handler): Make static function. + (check_bulk_cipher_modes, check_one_cipher_core_reset) + (check_one_cipher_core, check_one_md, check_one_md_multi) + (check_one_md_final, check_one_mac): Clutter vector registers before + gcry_* calls to cipher/md/mac algorithms. + +2020-01-22 Marvin W <git@larma.de> + + Set vZZ.16b register to zero before use in armv8 gcm implementation. + + commit 79ed620ec46adbb08f5cea6a4865a95a436e4109 + * cipher/cipher-gcm-armv8-aarch64-ce.S + (_gcry_ghash_setup_armv8_ce_pmull): Set vZZ to zero. + +2020-01-21 Tianjia Zhang <tianjia.zhang@linux.alibaba.com> + + tests: Add basic test cases for sm2. + + commit aa9c78afa1d867bb7b9b3c695cf31a832c9419e5 + * tests/basic.c (check_pubkey): Add test cases for ecc-sm2. + + Add elliptic curve SM2 implementation. + + commit 6b55246c77089dd372eb1807808111660fd789c7 + * configure.ac (enabled_pubkey_ciphers): Add ecc-sm2. + * cipher/Makefile.am (EXTRA_libcipher_la_SOURCES): Add ecc-sm2.c. + * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist, + _gcry_pk_util_preparse_sigval): Add sm2 flags. + * cipher/ecc.c: Support ecc-sm2. + * cipher/ecc-common.h: Add declarations for ecc-sm2. + * cipher/ecc-sm2.c: New. + * src/cipher.h: Define PUBKEY_FLAG_SM2. + + ecc: Simplify signature code. + + commit 8d9958910e54f3fecbab6e133c3971843f6ef310 + * cipher/ecc-gost.c (_gcry_ecc_gost_sign): Use implemented function. + * cipher/ecc.c (ecc_verify): Remove redundant code. + +2020-01-21 NIIBE Yutaka <gniibe@fsij.org> + NIIBE Yutaka <gniibe@fsij.org> + + tests: Fix check_pubkey. + + commit 95e9cee802419adf6f4b01b29d7874793004fa8d + * tests/basic.c (check_pubkey): Fix constants of pubkeys. + +2020-01-21 NIIBE Yutaka <gniibe@fsij.org> + + Avoid use of ulong in internal code. + + commit 4997139b3e83761c9af0246cec829305c3d7d13b + * configure.ac (HAVE_ULONG_TYPEDEF): Remove. + * mpi/mpi-div.c (_gcry_mpi_fdiv_r_ui): Use unsigned long. + (_gcry_mpi_divisible_ui): Likewise. + * random/rndunix.c (_gcry_rndunix_gather_random): Likewise. + * random/rndw32.c (_gcry_rndw32_gather_random_fast): Likewise. + (ADDINT): Likewise. + * random/rndw32ce.c (_gcry_rndw32ce_gather_random_fast): Likewise. + * src/mpi.h: Follow the change. + * src/types.h (HAVE_ULONG_TYPEDEF): Remove. + +2020-01-19 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + gcrypt.texi: fix GCRYCTL_GET_ALGO_NENCR typo. + + commit 5ebb2f0671c902863eee91cbcfc85a72be506410 + * doc/gcrypt.texi: Fix GCRYCTL_GET_ALGO_NENC to GCRYCTL_GET_ALGO_NENCR. + +2020-01-19 Tianjia Zhang <tianjia.zhang@linux.alibaba.com> + + mpi: Fix error that point not uninitialized. + + commit 7e3aac7ba49b3b6e6c5ebe7c880b5b323c423ef7 + * cipher/ecc-curves.c (mpi_ec_get_elliptic_curve): Initialize E->G poing + + ecc: Wrong flag and elements_enc fix. + + commit 43cfc1632dd3a9579a906f31cd3b6c88d242d1a5 + * cipher/ecc.c (ecc_generate): Fix wrong flag and elements_enc. + + Update .gitignore. + + commit 176a5f162acd0cfebc5517d061205681bc3658d0 + + +2020-01-16 Tianjia Zhang <tianjia.zhang@linux.alibaba.com> + + Add new curve named sm2p256v1. + + commit d154c1e9e11019980253f0a65758932cd0656470 + * cipher/ecc-curves.c (domain_parms): Add sm2p256v1 for SM2. + * tests/curves.c (N_CURVES): Update N_CURVES for SM2. + +2019-12-23 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael-ppc: performance improvements. + + commit 110077505acacae62cec3d09b32a084b9cee0368 + * cipher/rijndael-ppc.c (ALIGNED_LOAD, ALIGNED_STORE, VEC_LOAD_BE) + (VEC_STORE_BE): Rewrite. + (VEC_BE_SWAP, VEC_LOAD_BE_NOSWAP, VEC_STORE_BE_NOSWAP): New. + (PRELOAD_ROUND_KEYS, AES_ENCRYPT, AES_DECRYPT): Adjust to new + input parameters for vector load macros. + (ROUND_KEY_VARIABLES_ALL, PRELOAD_ROUND_KEYS_ALL) + (AES_ENCRYPT_ALL): New. + (vec_bswap32_const_neg): New. + (vec_aligned_ld, vec_aligned_st, vec_load_be_const): Rename to... + (asm_aligned_ls, asm_aligned_st, asm_load_be_const): ...these. + (asm_be_swap, asm_vperm1, asm_load_be_noswap) + (asm_store_be_noswap): New. + (vec_add_uint128): Rename to... + (asm_add_uint128): ...this. + (asm_xor, asm_cipher_be, asm_cipherlast_be, asm_ncipher_be) + (asm_ncipherlast_be): New inline assembly functions with volatile + keyword to allow manual instruction ordering. + (_gcry_aes_ppc8_setkey, aes_ppc8_prepare_decryption) + (_gcry_aes_ppc8_encrypt, _gcry_aes_ppc8_decrypt) + (_gcry_aes_ppc8_cfb_enc, _gcry_aes_ppc8_cbc_enc) + (_gcry_aes_ppc8_ocb_auth): Update to use new&rewritten helper macros. + (_gcry_aes_ppc8_cfb_dec, _gcry_aes_ppc8_cbc_dec) + (_gcry_aes_ppc8_ctr_enc, _gcry_aes_ppc8_ocb_crypt) + (_gcry_aes_ppc8_xts_crypt): Update to use new&rewritten helper + macros; Tune 8-block parallel paths with manual instruction ordering. + + rijndael-ppc: fix bad register used for vector load/store assembly. + + commit 0837d7e6be3e604c1f7b86d18c582d8aa7ed858c + * cipher/rijndael-ppc.c (vec_aligned_ld, vec_load_be, vec_aligned_st) + (vec_store_be): Add "r0" to clobber list for load/store instructions. + +2019-12-22 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + cipher: fix typo in error log. + + commit 5b9ea3df0dc355d77b9f061f63064614a97b8b67 + * cipher/cipher.c (_gcry_cipher_encrypt): Fix log "cipher_decrypt: ..." + to "cipher_encrypt: ...". + +2019-11-21 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + gost28147: inline gost_val function to speed up code. + + commit e5c4cf0efb8fd297963e6b4392ab98c41dbad536 + * cipher/gost28147.c (gost_val): mark function as inline + + gost28147: do not use GOST28147_CONTEXT outside of GOST 28147 calculation + + commit f9894240bed36eab17fabf5aa482799b148618e2 + * cipher/gost28147.c (_gcry_gost_enc_data): remove unused context + argument + * cipher/gostr3411-94.c (GOSTR3411_CONTEXT, gostr3411_init, + do_hash_step): remove unused GOST 28147-89 context. + + gost28147: simplify internal code. + + commit d164a8e7f6829163f1279517f07b61805311f8f2 + * cipher/gost28147.c (gost_val, _gost_encrypt_data): don't use gost + context internally + * cipher/gost28147.c (gost_encrypt_block, gost_decrypt_block, + _gcry_gost_enc_data): adapt to internal changes. + + gostr3411-94: small speedup. + + commit 8f573a67d12e6d9026f1676a6dae7813105bc490 + * cipher/gostr3411-94.c (do_p): unroll loop for a small spedup + +2019-11-18 Paul Wolneykien <manowar@altlinux.org> + + ecc: update GOST2012 curves. + + commit a3a866f63e7a527fe3c053758b84d70c142f8283 + * cipher/ecc-curves.c (domain_parms): rename GOST 2012 curves to contain + curve bit size + (curve_aliases): rename curves, provide backwards-compatible + aliases, add new OIDs and two new curves. + * cipher/ecc-curves.c (curve_aliases): add new OIDs and aliases for + * tests/basic.c (check_pubkey): use new name for GOST2012 512-bit test + curve. + * tests/benchmark.c (ecc_bench): use new name for GOST2012 512-bit test + curve. + +2019-11-05 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + ec: fix left shift overflows on WIN64 build. + + commit bdbd032d1626dbb34e1840e5f5393524dd546a1d + * mpi/ec.c (ec_mulm_448): Cast constants to (mpi_limb_t) before + shifting left by 32. + + mpi/amd64: use SSE2 for shifting instead of MMX. + + commit 1322c6a5d1e9aa0c69a2b259aa5ec7bcf5cb5653 + * mpi/amd64/mpih-lshift.S: Convert to SSE2. + * mpi/amd64/mpih-rshift.S: Ditto. + + Add i386/SSSE3 implementation of SHA512. + + commit b52dde860963c794b12d14b0a9c5848bca7ba51e + * LICENSES: Add 'sha512-ssse3-i386.c'. + * configure.ac: Add 'sha512-ssse3-i386.lo'. + * cipher/Makefile.am: Add 'sha512-ssse3-i386.c'. + * cipher/sha512-ssse3-i386.c: New. + * cipher/sha512.c (USE_SSSE3_I386, _gcry_sha512_transform_i386_ssse3) + (do_sha512_transform_i386_ssse3): New. + (_gcry_sha512_transform_arm) [USE_SSSE3_I386]: Use i386/SSSE3 transform + function if supported by CPU. + +2019-10-28 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Add Curve for X448 with ECC_DIALECT_SAFECURVE. + + commit d9c418305e1053decebefbd5a98a95f845404a09 + * cipher/ecc-curves.c (domain_parms): Add X448. + * cipher/ecc-ecdh.c (_gcry_ecc_mul_point): Support X448. + * mpi/ec.c (ec_addm_448, ec_subm_448, ec_mulm_448): New. + (ec_mul2_448, ec_pow2_448): New. + (field_table): Add for X448. + (curve448_bad_points): New. + (bad_points_table): New. + (ec_p_init): Use bad_points_table. + * tests/Makefile.am (t-x448): Add. + * tests/curves.c (N_CURVES): Update. + * tests/t-x448.c: New. + +2019-10-25 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Introduce new dialect: ECC_DIALECT_SAFECURVE. + + commit 498ab6d9f2f8b0775da41553be7868e59cf4cc2e + * src/mpi.h (ECC_DIALECT_SAFECURVE): New. + * cipher/ecc-misc.c (_gcry_ecc_dialect2str): Support the new dialect. + * cipher/ecc-curves.c (mpi_ec_setup_elliptic_curve): Support opaque + MPI handling of secret 'd' for ECC_DIALECT_SAFECURVE. + * cipher/ecc.c (nist_generate_key): Support opaque secret for + ECC_DIALECT_SAFECURVE. + (test_ecdh_only_keys): Likewise. + (ecc_generate): Support native point representation for + ECC_DIALECT_SAFECURVE. + (ecc_encrypt_raw): Support opaque MPI handling of secret and + native point representation for ECC_DIALECT_SAFECURVE. + (ecc_decrypt_raw): Support native point representation for + ECC_DIALECT_SAFECURVE. + (_gcry_pk_ecc_get_sexp): Likewise. + + ecc: Make _gcry_mpi_ec_mul_point friendly to X25519 computation. + + commit 2dfedafe08ac57a87e6892d1af4d72cbb398fe40 + * mpi/ec.c (_gcry_mpi_ec_mul_point): Support scalar input as an opaque + MPI in little-endian native format. + * cipher/ecc-ecdh.c (_gcry_ecc_mul_point): Use an opaque scalar. + + pubkey: Support a method to get data as an opaque MPI. + + commit 050e0b4accfae6a49dda6b1bac52749edec5ce22 + * cipher/pubkey-util.c (_gcry_pk_util_data_to_mpi): Support an + opaque MPI in old style. + +2019-10-24 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Support an opaque MPI handling in mpi_from_keyparam. + + commit 05a7d2f262bc5c2d108dcfa6e3d907dd895a4074 + * cipher/ecc-curves.c (mpi_from_keyparam): Add OPAQUE argument. + + ecc: Fix handling of point representation in EdDSA. + + commit 3d5a05767b84e0f781ed5dfe434adb4d4e9d2aa5 + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_ensure_compact): Use + GCRYMPI_FMT_USG, since integer is defined as unsigned in SEC1. + (_gcry_ecc_eddsa_decodepoint): Likewise. + + ecc: Return an opaque MPI by _gcry_ecc_ec2os. + + commit 8fce1027c2531127dd52a8b883f34333ffd3763b + * cipher/ecc-misc.c (_gcry_ecc_ec2os): Use mpi_set_opaque instead of + _gcry_mpi_scan to make an opaque MPI. + + ecc: String constant fix. + + commit 35c1faaea2b0aee9b127d02d93158826d17eb107 + * cipher/ecc-curves.c (domain_parms): Same string length for NIST + P-521. + + ecc: Simplify _gcry_ecc_compute_public. + + commit ad8927f40169364003f72fc188ea60b295ef5e59 + * cipher/ecc-misc.c (_gcry_ecc_compute_public): Don't need G and d. + Use ec->G and ec->d. + * cipher/ecc-curves.c (_gcry_ecc_get_mpi): Follow the change. + (_gcry_ecc_get_point): Likewise. + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_compute_h_d): Don't need d, + but use ec->d. + (_gcry_ecc_eddsa_sign): Follow the change. + +2019-10-23 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Use opaque MPI for _gcry_ecc_mul_point. + + commit c5a7191c1bd18292a34ad4da45d743dfac035f9a + * cipher/ecc-ecdh.c (_gcry_ecc_mul_point): Use opaque MPI for U. + + ecc: Fix _gcry_ecc_mont_decodepoint for data by old implementation. + + commit bbe15758c893dbf546416c1a6bccdad1ab000ad7 + * cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Support data by old + implementation by opaque public key. + Fix confusion of endian, in the handling of data by normal MPI key. + + ecc: ECDH clean up for use of ec->nbits. + + commit 27e848666b4a03939b0c8db15aa6e6f79bc7db30 + * cipher/ecc-ecdh.c (_gcry_ecc_mul_point): Use ec->nbits. + * cipher/ecc.c (test_ecdh_only_keys): Likewise. + (ecc_encrypt_raw): Likewise. + (ecc_generate): Fix debug output format. + +2019-10-22 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix key generation for ECDH. + + commit 82441bbb82903c21cd2b9b4e2d50202b14fdc24c + * cipher/ecc.c (test_ecdh_only_keys): Don't free EC here. + + ecc: Fix debug output. + + commit 6d93812aa312a92d4de2dc034bdf87c276a24b8a + * cipher/ecc-curves.c (_gcry_mpi_ec_internal_new): Fix debug output. + + ecc: Simplify using mpi_ec_t directly. + + commit 6a30a9a2cc48d2343c3e9815567dbd4bf9eec058 + * cipher/ecc-common.h (ECC_public_key, ECC_secret_key): Remove. + (_gcry_ecc_ecdsa_sign, _gcry_ecc_ecdsa_verify): Use mpi_ec_t. + (_gcry_ecc_eddsa_genkey, gcry_ecc_eddsa_sign): Likewise. + (_gcry_ecc_eddsa_verify): Likewise. + (_gcry_ecc_gost_sign, _gcry_ecc_gost_verify): Likewise. + * cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_sign): Use mpi_ec_t directly. + (_gcry_ecc_ecdsa_verify): Likewise. + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_genkey): Likewise. + (_gcry_ecc_eddsa_sign, _gcry_ecc_eddsa_verify): Likewise. + * cipher/ecc-gost.c (_gcry_ecc_gost_sign): Likewise. + (_gcry_ecc_gost_verify): Likewise. + + ecc: Fix for NBITS support. + + commit 975de38796917392e83152447c6575648a5a5ee3 + * cipher/ecc-curves.c (mpi_ec_get_elliptic_curve): Fill curve + parameters by NBITS. + (_gcry_mpi_ec_internal_new): Show "EdDSA". + + ecc: Add NAME member to struct mpi_ec_ctx_s. + + commit e921ad5b3ad093304312aca90a3c971de05cbf03 + * src/ec-context.h (struct mpi_ec_ctx_s): Add NAME. + * cipher/ecc-curves.c (mpi_ec_setup_elliptic_curve): Initialize NAME. + + ecc: Add key generation support to mpi_ec_get_elliptic_curve. + + commit 488704be6e044e23770d95344511c5a347b533c5 + * cipher/ecc-curves.c (mpi_ec_get_elliptic_curve): Handle params for + key generation. + (_gcry_mpi_ec_internal_new): Remove duplication for handling of flags. + + ecc: Consolidate with _gcry_mpi_ec_internal_new. + + commit 5415bc578080018e1cd36aa44cf5c0a9995cbafc + * cipher/ecc-ecdh.c (prepare_ec): Use _gcry_mpi_ec_internal_new. + (_gcry_ecc_mul_point): Don't need to have E of elliptic_curve_t. + * cipher/ecc.c (ecc_encrypt_raw): Use _gcry_mpi_ec_internal_new. + (ecc_decrypt_raw): Likewise. + + ecc: Support flags and debug print in _gcry_mpi_ec_internal_new. + + commit c2aa333dd88b4cd337329128a2018dd3b00f5114 + * cipher/ecc-curves.c (mpi_ec_get_elliptic_curve): Don't set *r_flags. + (_gcry_mpi_ec_internal_new): Add r_flags argument. + Parse the flag list. + Output to debug channel when DBG_CIPHER. + +2019-10-21 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Add new function _gcry_mpi_ec_internal_new. + + commit c7b97ac9bdf96f5a89ae553cac12954043ab174d + * cipher/ecc-curves.c (mpi_ec_get_elliptic_curve) + (mpi_ec_setup_elliptic_curve): Factor out from _gcry_mpi_ec_new. + (_gcry_mpi_ec_internal_new): New. + (_gcry_mpi_ec_new): Rewrite using mpi_ec_get_elliptic_curve and + mpi_ec_setup_elliptic_curve. + + ecc: Simplify ecc_encrypt_raw and ecc_decrypt_raw. + + commit 10b8cc280a535f14b017106c87f2b26bb68d9489 + * cipher/ecc.c (ecc_encrypt_raw): Use elliptic_curve_t directly. + (ecc_decrypt_raw): Likewise. + + ecc: More fixes for cofactor with PUBKEY_FLAG_PARAM. + + commit 61a0518282537ad52367354c96986c3d1b698d6f + * cipher/ecc.c (ecc_check_secret_key): Support "h" in KEYPARMS. + (ecc_sign, ecc_verify, ecc_encrypt_raw, ecc_decrypt_raw): Likewise. + + ecc: Simply use unsigned int for cofactor, not MPI. + + commit a258ae728de62607b3ef4eca940cfbcf9965fa5f + * cipher/ecc-common.h (elliptic_curve_t): Use unsigned int for H. + * src/ec-context.h (struct mpi_ec_ctx_s): Ditto. + * cipher/ecc-curves.c (ecc_domain_parms_t): Ditto. + (domain_parms): Update for the cofactors. + (_gcry_ecc_fill_in_curve): H is no longer MPI, but unsigned int. + (_gcry_ecc_get_curve): Remove handling for H. + (_gcry_mpi_ec_new): In KEYPARM, cofactor is still MPI. + (_gcry_ecc_get_param_sexp): H is no longer MPI, but unsigned int. + (_gcry_ecc_get_mpi): Keep the API, returning MPI for "h". + (_gcry_ecc_set_mpi): Likewise. + * cipher/ecc-ecdh.c (_gcry_ecc_mul_point): Fix for unsigned int. + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_genkey): Likewise. + * cipher/ecc-misc.c (_gcry_ecc_curve_free): Likewise. + * cipher/ecc.c (nist_generate_key, test_ecdh_only_keys): Likewise. + (test_ecdh_only_keys, ecc_generate, ecc_check_secret_key): Likewise. + (ecc_sign, ecc_verify, ecc_encrypt_raw, ecc_decrypt_raw): Likewise. + (_gcry_pk_ecc_get_sexp): Likewise. + * mpi/ec.c (ec_deinit): Likewise. + +2019-10-18 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Simplify compute_keygrip. + + commit 579d5d6017d63b5eabec588b24d1a22566455bac + * cipher/ecc-curves.c (_gcry_ecc_update_curve_param): Remove H. + * cipher/ecc.c (compute_keygrip): Don't get H, since it's not + used in the computation. + + ecc: Clean up key generation code. + + commit 95cc9b8f4483fd7edfc7555199f6a05cfa68a236 + * cipher/ecc.c (test_ecdh_only_keys): No need to make PK by SK. + +2019-10-14 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix building t-lock for WIN32. + + commit 7e1383cfd43fdc2b6f743e6a1304f0f0b2142847 + * tests/t-lock.c (external_lock_test_init, external_lock_test_lock) + (externel_lock_test_unlock, external_lock_test_destroy) + (nonce_thread, get_rand, pick_account, pick_value, revision_thread) + (accountant_thread): Build also if _WIN32 defined in addition to + HAVE_PTHREAD. + + hash-common: avoid integer division to reduce call overhead. + + commit f9d8b5a0369cc94e125d36d9c8864d5cd2eaa1d2 + * cipher/hash-common.h (gcry_md_block_ctx): Replace 'blocksize' with + 'blocksize_shift'. + * cipher/hash-common.c (_gcry_md_block_write): Use bit-level operations + instead of division to get number of blocks. + * cipher/gostr2411-94.c (gost3411_init): Initialize 'blocksize_shift' + instead of 'blocksize'. + * cipher/md2.c (md2_init): Ditto. + * cipher/md4.c (md4_init): Ditto. + * cipher/md5.c (md5_init): Ditto. + * cipher/rmd160.c (rmd160_init): Ditto. + * cipher/sha1.c (sha1_init): Ditto. + * cipher/sha256.c (sha256_common_init): Ditto. + * cipher/sha512.c (sha512_init_common): Ditto. + * cipher/sm3.c (sm3_init): Ditto. + * cipher/stribog.c (stribog_init_512): Ditto. + * cipher/tiger.c (do_init): Ditto. + * cipher/whirlpool.c (whirlpool_init): Ditto. + +2019-10-11 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Handle ephemeral key as opaque octets. + + commit ff0f1782560eb45458d9a8dd97088dabeddb34e7 + * cipher/ecc.c (ecc_decrypt_raw): Extract an ephemeral key + as opaque octets. + +2019-10-10 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Consolidate encoding a point for Montgomery curve. + + commit 80cf289905ace9f174eb06d7f55f38980f7e4dbd + * cipher/ecc-common.h (_gcry_ecc_mont_encodepoint): New. + * cipher/ecc-misc.c (_gcry_ecc_mont_encodepoint): New. + * cipher/ecc.c (ecc_generate): Use _gcry_ecc_mont_encodepoint. + (ecc_encrypt_raw, ecc_decrypt_raw, _gcry_pk_ecc_get_sexp): Likewise. + +2019-10-09 NIIBE Yutaka <gniibe@fsij.org> + + ecc: More clean-up for Ed25519 and Curve25519. + + commit ba0b31f2636632b1b39ebd2202de3ba5d60588b8 + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_ensure_compact): Fix calc for + bytes. + * cipher/ecc.c (ecc_encrypt_raw): Use public key as opaque byte-string + with "/q" for both cases, since it is always fixed size with a prefix. + (compute_keygrip): Likewise. + Fix hard-coded value of 256 for Ed25519. + Handle Curve25519 differently. + +2019-10-08 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix hard-coded value for 25519 to allow other modern curves. + + commit d66a4856eb0c39823bf3414b3ca4cf6322f32aef + * cipher/ecc.c (nist_generate_key): Support other modern curves. + (test_ecdh_only_keys): Likewise. + (check_secret_key): Don't use ECC_DIALECT_ED25519 for the check. + (_gcry_pk_ecc_get_sexp): Support Montgomery curve. + + ecc: Clean up for decoding point. + + commit 254c5279058f0aea2d3568d6e756002242e82f8f + * cipher/ecc-curves.c (point_from_keyparam): Possibly supporting + Montgomery curve, use _gcry_mpi_ec_decode_point. + (_gcry_ecc_set_mpi): Likewise. + * cipher/ecc.c (ecc_check_secret_key): Likewise. + + random: Clean up unused old internal API. + + commit 6e57242c61bca38b3cc8fdf424b5667ab953e4cd + * random/random.h (_gcry_get_random_bits): Remove. + +2019-10-02 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix regression in keygrip computation for cv25519 (2). + + commit 1cfe2329b91cc7be30f7c3a14fc634ec89a1be96 + * cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Recover g_y + for Curve25519. + +2019-09-28 Werner Koch <wk@gnupg.org> + + ecc: Fix regression in keygrip computation for cv25519. + + commit f67b6492e0b0a2a661cd53a08b20f23e6e3f9f89 + * cipher/ecc-curves.c (domain_parms): Revert g_y for cv25519. + * tests/keygrip.c: Add test case for cv25519. + +2019-09-24 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add stitched ChaCha20-Poly1305 ARMv8/AArch64 implementation. + + commit 4bebafb7bae8343f543728937caf7d3453c88b7c + * cipher/Makefile.am: Add 'asm-poly1305-aarch64.h'. + * cipher/asm-poly1305-aarch64.h: New. + * cipher/chacha20-aarch64.S (ROT8, _, ROTATE2_8): New. + (ROTATE2): Add interleave operator. + (QUARTERROUND2): Add interleave operators; Use ROTATE2_8. + (chacha20_data): Rename to... + (_gcry_chacha20_aarch64_blocks4_data_inc_counter): ...to this. + (_gcry_chacha20_aarch64_blocks4_data_rot8): New. + (_gcry_chacha20_aarch64_blocks4): Preload ROT8; Fill empty parameters + for QUARTERROUND2 interleave operators. + (_gcry_chacha20_poly1305_aarch64_blocks4): New. + * cipher/chacha20.c + [USE_AARCH64_SIMD] (_gcry_chacha20_poly1305_aarch64_blocks4): New. + (_gcry_chacha20_poly1305_encrypt, _gcry_chacha20_poly1305_decrypt) + [USE_AARCH64_SIMD]: Use stitched implementation if ctr->use_neon is + set. + +2019-09-22 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Small tweak for PowerPC Chacha20-Poly1305 round loop. + + commit 96b91e164160dfbd913aefe258f472d386f5b642 + * cipher/chacha20-ppc.c (_gcry_chacha20_poly1305_ppc8_block4): Use + inner/outer round loop structure instead of two separate loops for + stitched and non-stitched parts. + + Reduce size of x86-64 stitched Chacha20-Poly1305 implementations. + + commit 664370ea02df883d16db1ffdd9ada023335b0f63 + * cipher/chacha20-amd64-avx2.c + (_gcry_chacha20_poly1305_amd64_avx2_blocks8): De-unroll round loop. + * cipher/chacha20-amd64-ssse3.c + (_gcry_chacha20_poly1305_amd64_ssse3_blocks4): + (_gcry_chacha20_poly1305_amd64_ssse3_blocks1): Ditto. + +2019-09-16 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add PowerPC extra CFLAGS also for chacha20-ppc and crc-ppc. + + commit 5516072451d46be8827455afff840eb6d49155fb + * cipher/Makefile.am: Add 'ppc_vcrypto_cflags' for chacha20-ppc.o/.lo + and crc-ppc.o/.lo. + +2019-09-15 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add PowerPC vpmsum implementation of CRC. + + commit 0486b85bd1fb65013e77f858cae9ea4530f868df + * cipher/Makefile.am: Add 'crc-ppc.c'. + * cipher/crc-armv8-ce.c: Remove 'USE_INTEL_PCLMUL' comment. + * cipher/crc-ppc.c: New. + * cipher/crc.c (USE_PPC_VPMSUM): New. + (CRC_CONTEXT): Add 'use_vpmsum'. + (_gcry_crc32_ppc8_vpmsum, _gcry_crc24rfc2440_ppc8_vpmsum): New. + (crc32_init, crc24rfc2440_init): Add HWF check for 'use_vpmsum'. + (crc32_write, crc24rfc2440_write): Add 'use_vpmsum' code-path. + * configure.ac: Add 'vpmsumd' instruction to PowerPC VSX inline + assembly check; Add 'crc-ppc.lo'. + + Add PowerPC vector implementation of ChaCha20. + + commit 557702f0d53a7ad1cf2ce0333c9df799a8abad59 + * cipher/Makefile.am: Add 'chacha20-ppc.c'. + * cipher/chacha20-ppc.c: New. + * cipher/chacha20.c (USE_PPC_VEC, _gcry_chacha20_ppc8_blocks4) + (_gcry_chacha20_ppc8_blocks1, USE_PPC_VEC_POLY1305) + (_gcry_chacha20_poly1305_ppc8_blocks4): New. + (CHACHA20_context_t): Add 'use_ppc'. + (chacha20_blocks, chacha20_keysetup) + (do_chacha20_encrypt_stream_tail): Add USE_PPC_VEC code. + (_gcry_chacha20_poly1305_encrypt, _gcry_chacha20_poly1305_decrypt): Add + USE_PPC_VEC_POLY1305 code. + * configure.ac: Add 'chacha20-ppc.lo'. + * src/g10lib.h (HWF_PPC_ARCH_2_07): New. + * src/hwf-ppc.c (PPC_FEATURE2_ARCH_2_07): New. + (ppc_features): Add HWF_PPC_ARCH_2_07. + * src/hwfeatures.c (hwflist): Add 'ppc-arch_2_07'. + +2019-09-06 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + poly1305: add fast addition macro for ppc64. + + commit 0564757b934d24c7fef10df8594099985fbbc0ac + * cipher/poly1305.c [USE_MPI_64BIT && __powerpc__] (ADD_1305_64): New. + +2019-09-03 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add SHA-512 implementations for POWER8 and POWER9. + + commit 93632f1adf57f142e5d9e9653c405f2ca8c601c0 + * cipher/Makefile.am: Add 'sha512-ppc.c'; Add extra CFLAG handling for + 'sha512-ppc.c'. + * cipher/sha512-ppc.c: New. + * cipher/sha512.c (USE_PPC_CRYPTO, _gcry_sha512_transform_ppc8) + (_gcry_sha512_transform_ppc9, do_sha512_transform_ppc8) + (do_sha512_transform_ppc9): New. + (sha512_init_common): Add PowerPC HW feature detection and + implementation selection. + * configure.ac: Add 'vshasigmad' instruction to PowerPC assembly + support check; Add 'sha512-ppc.lo'. + +2019-08-31 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add SHA-256 implementations for POWER8 and POWER9. + + commit e19dc973bc8e2a0ce92dd87515df3ee338265a8d + * cipher/Makefile.am: Add 'sha256-ppc.c'; Add extra CFLAG handling for + 'sha256-ppc.c'. + * cipher/sha256-ppc.c: New. + * cipher/sha256.c (USE_PPC_CRYPTO, _gcry_sha256_transform_ppc8) + (_gcry_sha256_transform_ppc9, do_sha256_transform_ppc8) + (do_sha256_transform_ppc9): New. + (sha256_init, sha224_init): Split common part to new function named... + (sha256_common_init): ...this; Add PowerPC HW feature detection and + implementation selection. + * configure.ac: Add 'vshasigmaw' instruction to PowerPC assembly + support check; Add 'sha256-ppc.lo'. + +2019-08-26 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + hwf-ppc: add detection for PowerISA 3.00. + + commit 418179593080f3028426657c4ef1941cdad85513 + * src/g10lib.h (HWF_PPC_ARCH_3_00): New. + * src/hwf-ppc.c (feature_map_s): Remove unused 'feature_match'. + (PPC_FEATURE2_ARCH_3_00): New. + (ppc_features, get_hwcap): Add PowerISA 3.00. + * src/hwfeatures.c (hwflist): Rename "ppc-crypto" to "ppc-vcrypto"; Add + "ppc-arch_3_00". + + rijndael-ppc: add bulk modes for CBC, CFB, CTR and XTS. + + commit 81d555d3473016eb9382fb1df153ba1effbbe32e + * cipher/rijndael-ppc.c (vec_add_uint128, _gcry_aes_ppc8_cfb_enc) + (_gcry_aes_ppc8_cfb_dec, _gcry_aes_ppc8_cbc_enc) + (_gcry_aes_ppc8_cbc_dec, _gcry_aes_ppc8_ctr_enc) + (_gcry_aes_ppc8_xts_crypt): New. + * cipher/rijndael.c [USE_PPC_CRYPTO] (_gcry_aes_ppc8_cfb_enc) + (_gcry_aes_ppc8_cfb_dec, _gcry_aes_ppc8_cbc_enc) + (_gcry_aes_ppc8_cbc_dec, _gcry_aes_ppc8_ctr_enc) + (_gcry_aes_ppc8_xts_crypt): New. + (do_setkey, _gcry_aes_cfb_enc, _gcry_aes_cfb_dec, _gcry_aes_cbc_enc) + (_gcry_aes_cbc_dec, _gcry_aes_ctr_enc) + (_gcry_aes_xts_crypto) [USE_PPC_CRYPTO]: Enable PowerPC AES + CFB/CBC/CTR/XTS bulk implementations. + * configure.ac (gcry_cv_gcc_inline_asm_ppc_altivec): Add 'vadduwm' + instruction. + + rijndael-ppc: add bulk mode for ocb_auth. + + commit bd1367bb607846d582ad09ded6c4ce4be4e52778 + * cipher/rijndael-ppc.c (_gcry_aes_ppc8_ocb_auth): New. + * cipher/rijndael.c [USE_PPC_CRYPTO] (_gcry_aes_ppc8_ocb_auth): New + prototype. + (do_setkey, _gcry_aes_ocb_auth) [USE_PPC_CRYPTO]: Add PowerPC AES + ocb_auth. + + rijndael-ppc: enable PowerPC AES-OCB implemention. + + commit 821602c60c7d144c978c335f91ae1641cf668df5 + * cipher/rijndael-ppc.c (ROUND_KEY_VARIABLES, PRELOAD_ROUND_KEYS) + (AES_ENCRYPT, AES_DECRYPT): New. + (_gcry_aes_ppc8_prepare_decryption): Rename to... + (aes_ppc8_prepare_decryption): ... this. + (_gcry_aes_ppc8_prepare_decryption): New. + (aes_ppc8_encrypt_altivec, aes_ppc8_decrypt_altivec): Remove. + (_gcry_aes_ppc8_encrypt): Use AES_ENCRYPT macro. + (_gcry_aes_ppc8_decrypt): Use AES_DECRYPT macro. + (_gcry_aes_ppc8_ocb_crypt): Uncomment; Optimizations for OCB offset + calculations, etc; Use new load/store and encryption/decryption macros. + * cipher/rijndaelc [USE_PPC_CRYPTO] (_gcry_aes_ppc8_ocb_crypt): New + prototype. + (do_setkey, _gcry_aes_ocb_crypt) [USE_PPC_CRYPTO]: Add PowerPC AES OCB + encryption/decryption. + + rijndael-ppc: add key setup and enable single block PowerPC AES. + + commit 9dca65ef71b4bdbd89a087f41f4dbba71e6d2822 + * cipher/Makefile.am: Add 'rijndael-ppc.c'. + * cipher/rijndael-internal.h (USE_PPC_CRYPTO): New. + (RIJNDAEL_context): Add 'use_ppc_crypto'. + * cipher/rijndael-ppc.c (backwards, swap_if_le): Remove. + (u128_t, ALWAYS_INLINE, NO_INLINE, NO_INSTRUMENT_FUNCTION) + (ASM_FUNC_ATTR, ASM_FUNC_ATTR_INLINE, ASM_FUNC_ATTR_NOINLINE) + (ALIGNED_LOAD, ALIGNED_STORE, VEC_LOAD_BE, VEC_STORE_BE) + (vec_bswap32_const, vec_aligned_ld, vec_load_be_const) + (vec_load_be, vec_aligned_st, vec_store_be, _gcry_aes_sbox4_ppc8) + (_gcry_aes_ppc8_setkey, _gcry_aes_ppc8_prepare_decryption) + (aes_ppc8_encrypt_altivec, aes_ppc8_decrypt_altivec): New. + (_gcry_aes_ppc8_encrypt, _gcry_aes_ppc8_decrypt): Rewrite. + (_gcry_aes_ppc8_ocb_crypt): Comment out. + * cipher/rijndael.c [USE_PPC_CRYPTO] (_gcry_aes_ppc8_setkey) + (_gcry_aes_ppc8_prepare_decryption, _gcry_aes_ppc8_encrypt) + (_gcry_aes_ppc8_decrypt): New prototypes. + (do_setkey) [USE_PPC_CRYPTO]: Add setup for PowerPC AES. + (prepare_decryption) [USE_PPC_CRYPTO]: Ditto. + * configure.ac: Add 'rijndael-ppc.lo'. + (gcry_cv_ppc_altivec, gcry_cv_cc_ppc_altivec_cflags) + (gcry_cv_gcc_inline_asm_ppc_altivec) + (gcry_cv_gcc_inline_asm_ppc_arch_3_00): New checks. + +2019-08-26 Shawn Landden <shawn@git.icu> + + rijndael/ppc: implement single-block mode, and implement OCB block cipher + + commit 92f38a619b1cf759057e9cd532ae7c1d0331100f + * cipher/rijndael-ppc.c: New implementation of single-block mode, and + implementation of OCB mode. + + hwf: add detection of PowerPC hardware features. + + commit b4a3c76fabfa07c10fd18b90230f60b806ad9620 + * src/Makefile.am: PowerPC hardware detection. + * src/g10lib.h: Likewise. + * src/hwf-common.h: Likewise. + * src/hwf-ppc.c: Likewise. + * src/hwfeatures.c: Likewise. + * configure.ac: Likewise. + +2019-08-20 NIIBE Yutaka <gniibe@fsij.org> + + pkgconfig: Fix libgcrypt.pc. + + commit 761d12f140b77b907087590646651d9578b68a54 + * src/libgcrypt.pc.in (Cflags, Libs): Have flags. + +2019-08-16 NIIBE Yutaka <gniibe@fsij.org> + + build: Fix build with !HAVE_PTHREAD. + + commit 900647d96cb7806cd9b2de343e4a4bd66c073fba + * tests/t-lock.c [!HAVE_PTHREAD]: Buildable now. + + ecdsa: Fix unblinding too early. + + commit cdaeb86f067b94d9dff4235ade20dde6479d9bb8 + * cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_sign): Keep the blinding until + the last step. + +2019-08-12 NIIBE Yutaka <gniibe@fsij.org> + + build: Fix testapi.c to be buildable. + + commit 376124f86097414cf1f9cbbc17af935d30064c82 + * tests/testapi.c: Fix for xgcry_control. + +2019-08-08 NIIBE Yutaka <gniibe@fsij.org> + + dsa,ecdsa: Fix use of nonce, use larger one. + + commit 7c2943309d14407b51c8166c4dcecb56a3628567 + * cipher/dsa-common.c (_gcry_dsa_modify_k): New. + * cipher/pubkey-internal.h (_gcry_dsa_modify_k): New. + * cipher/dsa.c (sign): Use _gcry_dsa_modify_k. + * cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_sign): Likewise. + * cipher/ecc-gost.c (_gcry_ecc_gost_sign): Likewise. + +2019-08-07 NIIBE Yutaka <gniibe@fsij.org> + Ján Jančár <johny@neuromancer.sk> + + ecc: Add mitigation against timing attack. + + commit b9577f7c89b4327edc09f2231bc8b31521102c79 + * cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_sign): Add the order N to K. + * mpi/ec.c (_gcry_mpi_ec_mul_point): Compute with NBITS of P or larger. + +2019-08-07 NIIBE Yutaka <gniibe@fsij.org> + + dsa,ecdsa: Allocate secure memory for RFC6979 generation. + + commit 75c2fbc43d2f2cf5f4c60cb28001fda7324185c2 + * cipher/dsa-common.c (_gcry_dsa_gen_rfc6979_k): Use secure memory + just like _gcry_dsa_gen_k does. + +2019-07-22 NIIBE Yutaka <gniibe@fsij.org> + + build: Fix previous commit. + + commit 6126fc2f180a9b61064cea5c838d2ff7e0b7774a + + + build: Use {CFLAGS,CPPFLAGS,LDFLAGS}_FOR_BUILD for helper programs. + + commit 6d80f3f12dc2ff04b0eaa3ba29ee8725b6fb4f69 + * configure.ac (CC_FOR_BUILD): Use AX_CC_FOR_BUILD. + * cipher/Makefile.am (gost-s-box): Add + {CFLAGS,CPPFLAGS,LDFLAGS}_FOR_BUILD. + * doc/Makefile.am (yat2m): Likewise. + * m4/ax_cc_for_build.m4: New. + +2019-07-18 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix use of AVX instruction in SHA1/SSSE3 assembly. + + commit 320ed47963032aab7aadd8aefa054b9a7725c9f7 + * cipher/sha1-ssse3-amd64.S: Replace 'vmovdqa' with 'movdqa' + instruction. + +2019-07-15 Werner Koch <wk@gnupg.org> + + sexp: Improve argument checking of sexp parser. + + commit 1c2cecbb35e1a0760121d76c327651fe7b2b791a + * src/sexp.c (do_vsexp_sscan): Check for bad length in '%b'. + +2019-07-15 NIIBE Yutaka <gniibe@fsij.org> + + tests: t-mpi-point: Remove implementation dependent checks. + + commit 8a0bde8c211c70756a2d8aa46e1bcf1f6f89e55d + * tests/t-mpi-point.c (basic_ec_math): Remove comparing X and Y, + only comparison of Z is relevant, mathematically. + Remove useless check, where different values in equivalence class + exist. + (basic_ec_math_simplified): Likewise. + +2019-06-25 NIIBE Yutaka <gniibe@fsij.org> + + sexp: Support reading base64. + + commit ab57613f10ad57d2fec648017c18d7abb189863b + * configure.ac (NEED_GPG_ERROR_VERSION): Require libgpg-error >= 1.27. + * src/sexp.c (do_vsexp_sscan): Support data in base64 format. + * tests/t-sexp.c (check_extract_param): Add a test case. + +2019-06-24 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Correctly return an error. + + commit b4a1114dc77617f0e772ddc4faf8820399b4354a + * cipher/ecc-ecdh.c (_gcry_ecc_get_algo_keylen): Return 0 for + unknow algorithm. + (_gcry_ecc_mul_point): Return GPG_ERR_UNSUPPORTED_ALGORITHM for + GCRY_ECC_CURVE448 for now. + Return GPG_ERR_UNKNOWN_ALGORITHM, otherwise. + +2019-06-21 NIIBE Yutaka <gniibe@fsij.org> + + tests: Fix the Curve25519 test. + + commit 6934711d572e13e9e78fb2c53bb119034b088c5a + * tests/t-cv25519.c (test_cv_x25519): Initialize SCALAR. + + ecc: Improve new ECDH API. + + commit a658c9ccc2c741f40b0b5cdbcd184cfb9a841d17 + * cipher/ecc-ecdh.c (_gcry_ecc_get_algo_keylen): New. + (_gcry_ecc_mul_point): Fill into the RESULT buffer, instead of + allocating new buffer. + * src/gcrypt-int.h: Change the API. + * src/gcrypt.h.in: Likewise. + * src/libgcrypt.def (gcry_ecc_get_algo_keylen): New. + * src/libgcrypt.vers (gcry_ecc_get_algo_keylen): New. + * src/visibility.c (gcry_ecc_get_algo_keylen): New. + * src/visibility.h (gcry_ecc_get_algo_keylen): New. + * tests/t-cv25519.c: Fix the use case. + +2019-06-20 NIIBE Yutaka <gniibe@fsij.org> + + ecc: X25519 API change to allow NULL for POINT. + + commit 6d77c2054ea0358fb4c6f59b4c91c673c0a83b03 + * cipher/ecc-ecdh.c (_gcry_ecc_mul_point): Allow NULL for point, + meaning G. + + ecc: Add an API for X25519 function as gcry_ecc_mul_point. + + commit ec8c2cdf977aa8d9ca5af0a9bd25aeb9190570b3 + * configure.ac: Add ecc-ecdh.lo. + * cipher/Makefile.am: Add ecc-ecdh.c. + * cipher/ecc-common.h (reverse_buffer): Expose. + * cipher/ecc-eddsa.c (reverse_buffer): Expose. + * cipher/ecc-curves.c (domain_parms): Fix as the errata of RFC. + * cipher/ecc-ecdh.c: New. + * cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Fix for other curves + than Curve25519. + * src/gcrypt-int.h (_gcry_ecc_mul_point): New. + * src/gcrypt.h.in (enum gcry_ecc_curves): New. + (gcry_ecc_mul_point): new. + * src/libgcrypt.def (gcry_ecc_mul_point): New. + * src/libgcrypt.vers (gcry_ecc_mul_point): New. + * src/visibility.h (gcry_ecc_mul_point): New. + * src/visibility.c (gcry_ecc_mul_point): New. + * tests/t-cv25519.c (test_cv_hl): Rename from test_cv. + (test_cv_x25519): New. + (test_cv): Call both of test_cv_hl and test_cv_x25519. + +2019-06-05 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + tests/basic: add CTR mode carry overflow test vectors. + + commit 971d372f512ff6805d5b8b54e9ac1446f3f66643 + * tests/basic.c (check_ctr_cipher): Change tv structure 'plaintext' + and 'out' to pointers; Add counter carry overflow test vectors; Make + temporary buffer large enough for new test vectors. + + GCM: move look-up table to .data section and unshare between processes. + + commit a4c561aab1014c3630bc88faf6f5246fee16b020 + * cipher/cipher-gcm.c (ATTR_ALIGNED_64): New. + (gcmR): Move to 'gcm_table' structure. + (gcm_table): New structure for look-up table with counters before and + after. + (gcmR): New macro. + (prefetch_table): Handle input with length not multiple of 256. + (do_prefetch_tables): Modify pre- and post-table counters to unshare + look-up table pages between processes. + + AES: move look-up tables to .data section and unshare between processes. + + commit daedbbb5541cd8ecda1459d3b843ea4d92788762 + * cipher/rijndael-internal.h (ATTR_ALIGNED_64): New. + * cipher/rijndael-tables.h (encT): Move to 'enc_tables' structure. + (enc_tables): New structure for encryption table with counters before + and after. + (encT): New macro. + (dec_tables): Add counters before and after encryption table; Move + from .rodata to .data section. + (do_encrypt): Change 'encT' to 'enc_tables.T'. + (do_decrypt): Change '&dec_tables' to 'dec_tables.T'. + * cipher/cipher-gcm.c (prefetch_table): Make inline; Handle input + with length not multiple of 256. + (prefetch_enc, prefetch_dec): Modify pre- and post-table counters + to unshare look-up table pages between processes. + +2019-05-19 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + cipher/Makefile.am: add '-fcoverage-*' to instrumentation munging. + + commit c6ffa216976d80a13486b13f64d6776cdb8b6ccf + * cipher/Makefile.am: Remove '-fcoverage-*' flag for mixed asm/C + i386+amd64 implementations. + +2019-05-15 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + md: fix UBSAN warning. + + commit dad94696d9c48c18b59576776c7caa95123dfa1b + * cipher/md.c (gcry_md_list): Define 'context' as array of + PROPERLY_ALIGNED_TYPE. + (md_enable, _gcry_md_reset, _gcry_md_close, md_final, md_set_key) + (prepare_macpads, md_read, md_extract): Access md context through + 'gcry_md_list->context' pointer instead of 'gcry_md_list->context.c'. + + Disable instrumentation on mixed Intel SSE C/assembly implementations. + + commit d24dae4538dbbda9e6c72a34fae69682cfb2fef0 + * cipher/Makefile.am: Make 'tiger.o' and 'tiger.lo' depend on Makefile; + Add instrumentation option munging. + * cipher/cipher-gcm-intel-pcmul.c (ALWAYS_INLINE) + (NO_INSTRUMENT_FUNCTION, ASM_FUNC_ATTR, ASM_FUNC_ATTR_INLINE): New. + (reduction, gfmul_pclmul, gfmul_pclmul_aggr4, gfmul_pclmul_aggr8) + (gcm_lsh): Define with 'ASM_FUNC_ATTR_INLINE' instead of 'inline'. + (_gcry_ghash_setup_intel_pclmul, _gcry_ghash_intel_pclmul): Define with + 'ASM_FUNC_ATTR'. + * cipher/crc-intel-pcmul.c (ALWAYS_INLINE, NO_INSTRUMENT_FUNCTION) + (ASM_FUNC_ATTR, ASM_FUNC_ATTR_INLINE): New. + (crc32_reflected_bulk, crc32_reflected_less_than_16, crc32_bulk) + (crc32_less_than_16): Define with 'ASM_FUNC_ATTR_INLINE' instead of + 'inline'. + (_gcry_crc32_intel_pclmul, _gcry_crc24rfc2440_intel_pclmul): Define + with 'ASM_FUNC_ATTR'. + * cipher/rijndael-aesni.c (NO_INSTRUMENT_FUNCTION, ASM_FUNC_ATTR) + (ASM_FUNC_ATTR_INLINE, ASM_FUNC_ATTR_NOINLINE): New. + (aes_ocb_get_l, do_aesni_prepare_decryption, do_aesni_enc) + (do_aesni_dec, do_aesni_enc_vec4, do_aesni_dec_vec4, do_aesni_enc_vec8) + (do_aesni_dec_vec8, aesni_ocb_checksum): Define with + 'ASM_FUNC_ATTR_INLINE' instead of 'inline'. + (do_aesni_ctr, do_aesni_ctr_4, do_aesni_ctr_8): Define wtih + 'ASM_FUNC_ATTR_INLINE'. + (aesni_ocb_enc, aesni_ocb_dec): Define with 'ASM_FUNC_ATTR_NOINLINE' + instead of 'NO_INLINE'. + (_gcry_aes_aesni_do_setkey, _gcry_aes_aesni_prepare_decryption) + (_gcry_aes_aesni_encrypt, _gcry_aes_aesni_cfg_enc) + (_gcry_aes_aesni_cbc_enc, _gcry_aes_aesni_ctr_enc) + (_gcry_aes_aesni_decrypt, _gcry_aes_aesni_cfb_dec) + (_gcry_aes_aesni_cbc_dec, _gcry_aes_aesni_ocb_crypt) + (_gcry_aes_aesni_ocb_auth, _gcry_aes_aesni_xts_enc) + (_gcry_aes_aesni_xts_dec, _gcry_aes_aesni_xts_crypt): Define with + 'ASM_FUNC_ATTR'. + * cipher/rijndael-ssse3-amd64.c (ALWAYS_INLINE, NO_INSTRUMENT_FUNCTION) + (ASM_FUNC_ATTR, ASM_FUNC_ATTR_INLINE): New. + (aes_ocb_get_l, do_ssse3_prepare_decryption, do_vpaes_ssse3_enc) + (do_vpaes_ssse3_dec): Define with 'ASM_FUNC_ATTR_INLINE' instead of + 'inline'. + (_gcry_aes_ssse3_do_setkey, _gcry_aes_ssse3_prepare_decryption) + (_gcry_aes_ssse3_encrypt, _gcry_aes_ssse3_cfb_enc) + (_gcry_aes_ssse3_cbc_enc, _gcry_aes_ssse3_ctr_enc) + (_gcry_aes_ssse3_decrypt, _gcry_aes_ssse3_cfb_dec) + (_gcry_aes_ssse3_cbc_dec, ssse3_ocb_enc, ssse3_ocb_dec) + (_gcry_aes_ssse3_ocb_crypt, _gcry_aes_ssse3_ocb_auth): Define with + 'ASM_FUNC_ATTR'. + * cipher/sha1-intel-shaext.c (NO_INSTRUMENT_FUNCTION) + (ASM_FUNC_ATTR): New. + (_gcry_sha1_transform_intel_shaext): Define with 'ASM_FUNC_ATTR'. + * cipher/sha256-intel-shaext.c (NO_INSTRUMENT_FUNCTION) + (ASM_FUNC_ATTR): New. + (_gcry_sha256_transform_intel_shaext): Define with 'ASM_FUNC_ATTR'. + * configure.ac (ENABLE_INSTRUMENTATION_MUNGING): New. + + tests/basic: fix signed interger overflow. + + commit 3c7ff6bd1c40d5216d6c12b6b28f77fd1a57baa7 + * tests/basic.c (check_ocb_cipher_largebuf_split): Cast to unsigned + when generating buffer values. + +2019-05-14 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + tests: do not use GCC variadic macro extension for xgcry_control. + + commit be567cb5dd629e9aa22d81b29d4326e5aa97efa7 + * tests/t-common.h (xgcry_control): Use doubly nested parenthesis for + passing arguments for gcry_control instead of GCC specific variadic + macro extension. + * tests/aeswrap.c: Change xgcry_control to use doubly nested + parenthesis. + * tests/basic.c: Ditto. + * tests/bench-slope.c: Ditto. + * tests/benchmark.c: Ditto. + * tests/curves.c: Ditto. + * tests/dsa-rfc6979.c: Ditto. + * tests/fips186-dsa: Ditto. + * tests/fipsdrv.c: Ditto. + * tests/fipsrngdrv.c: Ditto. + * tests/gchash.c: Ditto. + * tests/hashtest.c: Ditto. + * tests/hmac.c: Ditto. + * tests/keygen.c: Ditto. + * tests/keygrip.c: Ditto. + * tests/mpitests.c: Ditto. + * tests/pkbench.c: Ditto. + * tests/pkcs1v2.c: Ditto. + * tests/prime.c: Ditto. + * tests/pubkey.c: Ditto. + * tests/random.c: Ditto. + * tests/rsacvt.c: Ditto. + * tests/t-convert.c: Ditto. + * tests/t-cv25519.c: Ditto. + * tests/t-ed25519.c: Ditto. + * tests/t-kdf.c: Ditto. + * tests/t-lock.c: Ditto. + * tests/t-mpi-bit.c: Ditto. + * tests/t-mpi-point.c: Ditto. + * tests/t-secmem.c: Ditto. + * tests/t-sexp.c: Ditto. + * tests/version.c: Ditto. + +2019-05-10 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + tests/basic: mark CFB and CFB8 as stream block cipher modes. + + commit 34e9306a66b47785ddbab6594ae4c23581d35b5a + * tests/basic.c (get_algo_mode_blklen): Return '1' for CFB and CFB8. + +2019-05-09 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix message digest final function for MD4, MD5 and RMD160. + + commit 15592cd52f543aadb2fab8f6c112c68075309ad6 + * cipher/md4.c (md4_final): Use buffer offset '64 + 56' for bit count + on 'need one extra block' path. + * cipher/md5.c (md5_final): Ditto. + * cipher/rmd160.c (rmd160_final): Ditto. + * tests/basic.c (check_one_md_final): New. + (check_digest): Add new '*' test vectors and handle them with + check_one_md_final. + +2019-05-06 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Fix carry overflow in Stribog in 512-bit addition. + + commit da6cd4fea30f79cf9d8f9b2f1c6daf3aea39fa9c + * cipher/stribog.c (transform_bits): properly calculate carry flag + * tests/basic.c (check_digests): add two more test cases + +2019-04-27 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add support for explicit_memset. + + commit 71b0eb3fb75d2e6bbd86df055dc667b2debab0c1 + * configure.ac: Add function check for 'explicit_memset'. + * src/misc.c (_gcry_fast_wipememory, _gcry_fast_wipememory2): Use + explicit_memset if available. + + Fix CFI_PUSH/CFI_POP redefine build warning with AMD64 MPI. + + commit 78b1047eded8d5f8a13162d13160fce1809f6ee4 + * mpi/amd64/func_abi.h: Move CFI macros into [__x86_64__] block. + * mpi/i386/syntax.h: Move CFI macros into [__i386__] block. + + Enable four block aggregated GCM Intel PCLMUL implementation on i386. + + commit a6e7c411e5f67a9473675ca8d49017a4d13a8d3e + * cipher/cipher-gcm-intel-pclmul.c (reduction): Change "%%xmm7" to + "%%xmm5". + (gfmul_pclmul_aggr4): Move outside [__x86_64__] block; Remove usage of + XMM8-XMM15 registers; Do not preload H-values and be_mask to reduce + register usage for i386. + (_gcry_ghash_setup_intel_pclmul): Enable calculation of H2, H3 and H4 + on i386. + (_gcry_ghash_intel_pclmul): Adjust to above gfmul_pclmul_aggr4 + changes; Move 'aggr4' code path outside [__x86_64__] block. + + Prefetch GCM look-up tables. + + commit 1374254c2904ab5b18ba4a890856824a102d4705 + * cipher/cipher-gcm.c (prefetch_table, do_prefetch_tables) + (prefetch_tables): New. + (ghash_internal): Call prefetch_tables. + + Optimizations for generic table-based GCM implementations. + + commit ecd02cdd61e8c690f48637656f0e1e08b750fe30 + * cipher/cipher-gcm.c [GCM_TABLES_USE_U64] (do_fillM): Precalculate + M[32..63] values. + [GCM_TABLES_USE_U64] (do_ghash): Split processing of two 64-bit halfs + of the input to two separate loops; Use precalculated M[] values. + [GCM_USE_TABLES && !GCM_TABLES_USE_U64] (do_fillM): Precalculate + M[64..127] values. + [GCM_USE_TABLES && !GCM_TABLES_USE_U64] (do_ghash): Use precalculated + M[] values. + [GCM_USE_TABLES] (bshift): Avoid conditional execution for mask + calculation. + * cipher/cipher-internal.h (gcry_cipher_handle): Double gcm_table size. + +2019-04-26 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Optimizations for GCM Intel/PCLMUL implementation. + + commit af5f3fb08674608acf6617ea622ed0b9a2ee77a5 + * cipher/cipher-gcm-intel-pclmul.c (reduction): New. + (glmul_pclmul): Include shifting to left into pclmul operations; Use + 'reduction' helper function. + [__x86_64__] (gfmul_pclmul_aggr4): Reorder instructions and adjust + register usage to free up registers; Use 'reduction' helper function; + Include shifting to left into pclmul operations; Moving load H values + and input from caller into this function. + [__x86_64__] (gfmul_pclmul_aggr8): New. + (gcm_lsh): New. + (_gcry_ghash_setup_intel_pclmul): Left shift H values to left by + one; Preserve XMM6-XMM15 registers on WIN64. + (_gcry_ghash_intel_pclmul) [__x86_64__]: Use 8 block aggregated + reduction function. + + Move data pointer macro for 64-bit ARM assembly to common header. + + commit b9be297bb8eba7a09fa8413261de1587adcfd381 + * cipher/asm-common-aarch64.h (GET_DATA_POINTER): New. + * cipher/chacha20-aarch64.S (GET_DATA_POINTER): Remove. + * cipher/cipher-gcm-armv8-aarch64-ce.S (GET_DATA_POINTER): Remove. + * cipher/crc-armv8-aarch64-ce.S (GET_DATA_POINTER): Remove. + * cipher/rijndael-armv8-aarch64-ce.S (GET_DATA_POINTER): Remove. + * cipher/sha1-armv8-aarch64-ce.S (GET_DATA_POINTER): Remove. + * cipher/sha256-armv8-aarch64-ce.S (GET_DATA_POINTER): Remove. + + Add CFI unwind assembly directives for 64-bit ARM assembly. + + commit 5a2a96a63517838e04f9fc0fb2d932fac5124b8a + * cipher/asm-common-aarch64.h (CFI_STARTPROC, CFI_ENDPROC) + (CFI_REMEMBER_STATE, CFI_RESTORE_STATE, CFI_ADJUST_CFA_OFFSET) + (CFI_REL_OFFSET, CFI_DEF_CFA_REGISTER, CFI_REGISTER, CFI_RESTORE) + (DW_REGNO_SP, DW_SLEB128_7BIT, DW_SLEB128_28BIT, CFI_CFA_ON_STACK) + (CFI_REG_ON_STACK): New. + * cipher/camellia-aarch64.S: Add CFI directives. + * cipher/chacha20-aarch64.S: Add CFI directives. + * cipher/cipher-gcm-armv8-aarch64-ce.S: Add CFI directives. + * cipher/crc-armv8-aarch64-ce.S: Add CFI directives. + * cipher/rijndael-aarch64.S: Add CFI directives. + * cipher/rijndael-armv8-aarch64-ce.S: Add CFI directives. + * cipher/sha1-armv8-aarch64-ce.S: Add CFI directives. + * cipher/sha256-armv8-aarch64-ce.S: Add CFI directives. + * cipher/twofish-aarch64.S: Add CFI directives. + * mpi/aarch64/mpih-add1.S: Add CFI directives. + * mpi/aarch64/mpih-mul1.S: Add CFI directives. + * mpi/aarch64/mpih-mul2.S: Add CFI directives. + * mpi/aarch64/mpih-mul3.S: Add CFI directives. + * mpi/aarch64/mpih-sub1.S: Add CFI directives. + * mpi/asm-common-aarch64.h: Include "../cipher/asm-common-aarch64.h". + (ELF): Remove. + + Add 64-bit ARMv8/CE PMULL implementation of CRC. + + commit 14c8a593ede42f51f567ed7ba77b53124151aa38 + * cipher/Makefile.am: Add 'crc-armv8-ce.c' and + 'crc-armv8-aarch64-ce.S'. + * cipher/asm-common-aarch64.h [HAVE_GCC_ASM_CFI_DIRECTIVES]: Add CFI + helper macros. + * cipher/crc-armv8-aarch64-ce.S: New. + * cipher/crc-armv8-ce.c: New. + * cipher/crc.c (USE_ARM_PMULL): New. + (CRC_CONTEXT) [USE_ARM_PMULL]: Add 'use_pmull'. + [USE_ARM_PMULL] (_gcry_crc32_armv8_ce_pmull) + (_gcry_crc24rfc2440_armv8_ce_pmull): New prototypes. + (crc32_init, crc32rfc1510_init, crc24rfc2440_init): Enable ARM PMULL + implementations if supported by HW features. + (crc32_write, crc24rfc2440_write) [USE_ARM_PMULL]: Use ARM PMULL + implementations if enabled. + * configure.ac: Add 'crc-armv8-ce.lo' and 'crc-armv8-aarch64-ce.lo'. + +2019-04-18 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + mpi: make stack unwinding work at i386 mpi functions. + + commit b878a986f3ab2c35aff89c7f66f137a91542ed5b + * mpi/i386/syntax.h: Include 'config.h'. + (CFI_STARTPROC, CFI_ENDPROC, CFI_ADJUST_CFA_OFFSET, CFI_REL_OFFSET) + (CFI_RESTORE, CFI_PUSH, CFI_POP): New. + * mpi/i386/mpih-add1.S: Add CFI directives. + * mpi/i386/mpih-lshift.S: Add CFI directives. + * mpi/i386/mpih-mul1.S: Add CFI directives. + * mpi/i386/mpih-mul2.S: Add CFI directives. + * mpi/i386/mpih-mul3.S: Add CFI directives. + * mpi/i386/mpih-rshift.S: Add CFI directives. + * mpi/i386/mpih-sub1.S: Add CFI directives. + + hwf-x86: make stack unwinding work at i386 cpuid functions. + + commit 0bd18e8bf7d67072f8c77352140b4ed4cfde3c6c + * src/hwf-x86.c (FORCE_FUNC_FRAME_POINTER): New. + [__i386__] (is_cpuid_available): Force use of stack frame pointer as + inline assembly modifies stack register; Add 'memory' constraint for + inline assembly. + [__i386__] (get_cpuid): Avoid push/pop instruction when preserving + %ebx register over cpuid. + + Limit and document Blowfish key lengths to 8-576 bits. + + commit 3546599e5578f89f9e77b08bf599f9c44b23da5f + * cipher/blowfish.c (BLOWFISH_KEY_MIN_BITS) + (BLOWFISH_KEY_MAX_BITS): New. + (do_bf_setkey): Check input key length to MIN_BITS and MAX_BITS. + * doc/gcrypt.texi: Update supported Blowfish key lengths. + * tests/basic.c (check_ecb_cipher): New, with Blowfish test vectors + for different key lengths. + (check_cipher_modes): Call 'check_ecb_cipher'. + +2019-04-16 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add CFI unwind assembly directives for AMD64 assembly. + + commit d11ae95d05dc39ec6b825d1109afadd964589880 + * configure.ac (gcry_cv_gcc_asm_cfi_directives): New. + * cipher/asm-common-amd64.h (ADD_RIP, CFI_STARTPROC, CFI_ENDPROC) + (CFI_REMEMBER_STATE, CFI_RESTORE_STATE, CFI_ADJUST_CFA_OFFSET) + (CFI_REL_OFFSET, CFI_DEF_CFA_REGISTER, CFI_REGISTER, CFI_RESTORE) + (CFI_PUSH, CFI_POP, CFI_POP_TMP_REG, CFI_LEAVE, DW_REGNO) + (DW_SLEB128_7BIT, DW_SLEB128_28BIT, CFI_CFA_ON_STACK) + (CFI_REG_ON_STACK): New. + (ENTER_SYSV_FUNCPARAMS_0_4, EXIT_SYSV_FUNC): Add CFI directives. + * cipher/arcfour-amd64.S: Add CFI directives. + * cipher/blake2b-amd64-avx2.S: Add CFI directives. + * cipher/blake2s-amd64-avx.S: Add CFI directives. + * cipher/blowfish-amd64.S: Add CFI directives. + * cipher/camellia-aesni-avx-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/camellia-aesni-avx2-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/cast5-amd64.S: Add CFI directives. + * cipher/chacha20-amd64-avx2.S: Add CFI directives. + * cipher/chacha20-amd64-ssse3.S: Add CFI directives. + * cipher/des-amd64.S: Add CFI directives. + * cipher/rijndael-amd64.S: Add CFI directives. + * cipher/rijndael-ssse3-amd64-asm.S: Add CFI directives. + * cipher/salsa20-amd64.S: Add CFI directives; Use 'asm-common-amd64.h'. + * cipher/serpent-avx2-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/serpent-sse2-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/sha1-avx-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/sha1-avx-bmi2-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/sha1-avx2-bmi2-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/sha1-ssse3-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/sha256-avx-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/sha256-avx2-bmi2-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/sha256-ssse3-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/sha512-avx-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/sha512-avx2-bmi2-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/sha512-ssse3-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/twofish-amd64.S: Add CFI directives. + * cipher/twofish-avx2-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * cipher/whirlpool-sse2-amd64.S: Add CFI directives; Use + 'asm-common-amd64.h'. + * mpi/amd64/func_abi.h: Include 'config.h'. + (CFI_STARTPROC, CFI_ENDPROC, CFI_ADJUST_CFA_OFFSET, CFI_REL_OFFSET) + (CFI_RESTORE, CFI_PUSH, CFI_POP): New. + (FUNC_ENTRY, FUNC_EXIT): Add CFI directives. + +2019-04-15 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + twofish-amd64: do not use xchg instruction. + + commit 0903b215ef5a18332b740a24e6e2bfbed9e1d97b + * cipher/twofish-amd64.S (g1g2_3): Swap ab and cd registers using + 'movq' instructions instead of 'xchgq'. + +2019-04-09 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Use FreeBSD's elf_aux_info for detecting ARM HW features. + + commit 2ffc689d4757f31f1e2c4961b94b0b0c8dc302b7 + * configure.ac: Add function check for 'elf_aux_info'. + * src/hwf-arm.c [HAVE_ELF_AUX_INFO]: Include 'sys/auxv.h'. + [HAVE_ELF_AUX_INFO && !HAVE_GETAUXVAL] (HAVE_GETAUXVAL) + (getauxval): New. + +2019-04-08 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Use getauxval system function for detecting ARM HW features. + + commit 6812a2c5bd2d9129bfdf34f3daf89cd8543ed8e5 + * configure.ac: Add header check for 'sys/auxv.h'; Add function check + for 'getauxval'. + * src/hwf-arm.c [HAVE_SYS_AUXV_H && HAVE_GETAUXVAL]: Include + 'sys/auxv.h'. + (HAS_SYS_AT_HWCAP): Enable AT_HWCAP if have 'getauxval' in addition of + __linux__. + (AT_HWCAP, AT_HWCAP2, HWCAP_NEON, HWCAP2_AES, HWCAP2_PMULL) + (HWCAP2_SHA1, HWCAP2_SHA2, HWCAP_ASIMD, HWCAP_AES) + (HWCAP_PMULL, HWCAP_SHA1, HWCAP_SHA2): Define these macros only if not + already defined. + (get_hwcap) [HAVE_SYS_AUXV_H && HAVE_GETAUXVAL]: Use 'getauxval' to + fetch HW capability flags. + + Disable SM3 in FIPS mode. + + commit 04a6c3c7482dd1ecb5113a049b1765b0d5f212fb + * cipher/sm3.h (_gcry_digest_spec_sm3): Set flags.fips to zero. + +2019-04-07 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Tune SHA-512/AVX2 and SHA-256/AVX2 implementations. + + commit 478581c5107ae75281c54e56cdcef5165f3155ca + * cipher/sha256-avx2-bmi2-amd64.S (ONE_ROUND_PART1, ONE_ROUND_PART2) + (ONE_ROUND): New round function. + (FOUR_ROUNDS_AND_SCHED, FOUR_ROUNDS): Use new round function. + (_gcry_sha256_transform_amd64_avx2): Exit early if number of blocks is + zero; Writing XFER to stack earlier and handle XREF writing in + FOUR_ROUNDS_AND_SCHED. + * cipher/sha512-avx2-bmi2-amd64.S (MASK_YMM_LO, MASK_YMM_LOx): New. + (ONE_ROUND_PART1, ONE_ROUND_PART2, ONE_ROUND): New round function. + (FOUR_ROUNDS_AND_SCHED, FOUR_ROUNDS): Use new round function. + (_gcry_sha512_transform_amd64_avx2): Writing XFER to stack earlier and + handle XREF writing in FOUR_ROUNDS_AND_SCHED. + +2019-04-05 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add SHA512/224 and SHA512/256 algorithms. + + commit a3683b6f623189a4b65bb584bb9e65e3ad7b3139 + * cipher/mac-hmac.c (map_mac_algo_to_md): Add mapping for SHA512/224 + and SHA512/256. + (_gcry_mac_type_spec_hmac_sha512_256) + (_gcry_mac_type_spec_hmac_sha512_224): New. + * cipher/mac-internal.h (_gcry_mac_type_spec_hmac_sha512_256) + (_gcry_mac_type_spec_hmac_sha512_224): New. + * cipher/mac.c (mac_list, mac_list_algo101): Add SHA512/224 and + SHA512/256. + * cipher/md.c (digest_list, digest_list_algo301) + (prepare_macpads): Ditto. + * cipher/sha512.c (run_selftests): Ditto. + (sha512_init_common): Move common initialization here. + (sha512_init, sha384_init): Use common initialization function. + (sha512_224_init, sha512_256_init, _gcry_sha512_224_hash_buffer) + (_gcry_sha512_224_hash_buffers, _gcry_sha512_256_hash_buffer) + (_gcry_sha512_256_hash_buffers, selftests_sha512_224) + (selftests_sha512_256, sha512_224_asn, oid_spec_sha512_224) + (_gcry_digest_spec_sha512_224, sha512_256_asn, oid_spec_sha512_256) + (_gcry_digest_spec_sha512_256): New. + * doc/gcrypt.texi: Add SHA512/224 and SHA512/256; Add missing + HMAC-BLAKE2s and HMAC-BLAKE2b. + * src/cipher.h (_gcry_digest_spec_sha512_224) + (_gcry_digest_spec_sha512_256): New. + * src/gcrypt.h.in (GCRY_MD_SHA512_256, GCRY_MD_SHA512_224): New. + (GCRY_MAC_HMAC_SHA512_256, GCRY_MAC_HMAC_SHA512_224): New. + * tests/basic.c (check_digests): Add SHA512/224 and SHA512/256 + test vectors. + + Remove extra buffer flush at begining of digest final functions. + + commit c6055aaccac86e1ca8a9d35c980d7abbacf2a9ff + * cipher/md2.c (md2_final): Remove _gcry_md_block_write flush call + from entry. + * cipher/md4.c (md4_final): Ditto. + * cipher/md5.c (md5_final): Ditto. + * cipher/rmd160.c (rmd160_final): Ditto. + * cipher/sha1.c (sha1_final): Ditto. + * cipher/sha256.c (sha256_final): Ditto. + * cipher/sha512.c (sha512_final): Ditto. + * cipher/sm3.c (sm3_final): Ditto. + * cipher/stribog.c (stribog_final): Ditto. + * cipher/tiger.c (tiger_final): Ditto. + + Optimizations for digest final functions. + + commit e76cd0e2b1f6025c1319576a5848815d1d231aeb + * cipher/md4.c (md4_final): Avoid byte-by-byte buffer setting when + padding; Merge extra and last block processing. + * cipher/md5.c (md5_final): Ditto. + * cipher/rmd160.c (rmd160_final): Ditto. + * cipher/sha1.c (sha1_final): Ditto. + * cipher/sha256.c (sha256_final): Ditto. + * cipher/sm3.c (sm3_final): Ditto. + * cipher/tiger.c (tiger_final): Ditto. + * cipher/sha512.c (sha512_final): Avoid byte-by-byte buffer setting + when padding. + * cipher/stribog.c (stribog_final): Ditto. + * cipher/whirlpool.c (whirlpool_final): Ditto. + + tests/basic: add hash test for small block sizes. + + commit c54b1c96c644c941f3eb3d2a09432b82f25b6ff1 + * tests/basic.c (check_one_md): Compare hashing buffers sizes from 1 to + 129 as full buffer input and byte-by-byte input. + + Burn stack in transform functions for SHA2 AMD64 implementations. + + commit 74ef3ecbf94e704975e238a99c0e0480cebf46ac + * cipher/sha256-avx-amd64.S: Burn stack inside transform functions. + * cipher/sha256-avx2-bmi2-amd64.S: Ditto. + * cipher/sha256-ssse3-amd64.S: Ditto. + * cipher/sha512-avx-amd64.S: Ditto. + * cipher/sha512-avx2-bmi2-amd64.S: Ditto. + * cipher/sha512-ssse3-amd64.S: Ditto. + + Burn stack in transform functions for SHA1 AMD64 implementations. + + commit f3d4bd90662faaedd37ce0dae1f9e7f91748e91e + * cipher/sha1-avx-amd64.S: Burn stack inside transform functions. + * cipher/sha1-avx-bmi2-amd64.S: Ditto. + * cipher/sha1-avx2-bmi2-amd64.S: Ditto. + * cipher/sha1-ssse3-amd64.S: Ditto. + + Add AVX2/BMI2 implementation of SHA1. + + commit b982900bfe6403e95a157271d8d811c9c573af9e + * cipher/Makefile.am: Add 'sha1-avx2-bmi2-amd64.S'. + * cipher/hash-common.h (MD_BLOCK_CTX_BUFFER_SIZE): New. + (gcry_md_block_ctx): Change buffer length to MD_BLOCK_CTX_BUFFER_SIZE. + * cipher/sha1-avx-amd64.S: Add missing .size for transform function. + * cipher/sha1-ssse3-amd64.S: Add missing .size for transform function. + * cipher/sha1-avx-bmi2-amd64.S: Add missing .size for transform + function; Tweak implementation for small ~1% speed increase. + * cipher/sha1-avx2-bmi2-amd64.S: New. + * cipher/sha1.c (USE_AVX2, _gcry_sha1_transform_amd64_avx2_bmi2) + (do_sha1_transform_amd64_avx2_bmi2): New. + (sha1_init) [USE_AVX2]: Enable AVX2 implementation if supported by + HW features. + (sha1_final): Merge processing of two last blocks when extra block is + needed. + +2019-03-31 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + blowfish: add three rounds parallel handling to generic C implementation + + commit ced7508c857c0cc37da2299a393e5b167dd28e54 + * cipher/blowfish.c (BLOWFISH_ROUNDS): Remove. + [BLOWFISH_ROUNDS != 16] (function_F): Remove. + (F): Replace big-endian and little-endian version with single + endian-neutral version. + (R3, do_encrypt_3, do_decrypt_3): New. + (_gcry_blowfish_ctr_enc, _gcry_blowfish_cbc_dec) + (_gcry_blowfish_cfb_dec): Use new three block functions. + + cast5: add three rounds parallel handling to generic C implementation. + + commit 4ec566b3689eff4a712eacfcbb4161eb243bb1df + * cipher/cast5.c (do_encrypt_block_3, do_decrypt_block_3): New. + (_gcry_cast5_ctr_enc, _gcry_cast5_cbc_dec, _gcry_cast5_cfb_dec): Use + new three block functions. + + cast5: read Kr four blocks at time and shift for current round. + + commit 8a0e68be1020d0c359bf8191159ac1ebe32a5aa0 + * cipher/cast5.c (do_encrypt_block, do_decrypt_block): Read Kr as + 32-bit words instead of bytes and shift value for each round. + + Add helper function for adding value to cipher block. + + commit 0fe918fa897cca9e01cbdb80d14106cfe5af680e + * cipher/cipher-internal.h (cipher_block_add): New. + * cipher/blowfish.c (_gcry_blowfish_ctr_enc): Use new helper function + for CTR block increment. + * cipher/camellia-glue.c (_gcry_camellia_ctr_enc): Ditto. + * cipher/cast5.c (_gcry_cast5_ctr_enc): Ditto. + * cipher/cipher-ctr.c (_gcry_cipher_ctr_encrypt): Ditto. + * cipher/des.c (_gcry_3des_ctr_enc): Ditto. + * cipher/rijndael.c (_gcry_aes_ctr_enc): Ditto. + * cipher/serpent.c (_gcry_serpent_ctr_enc): Ditto. + * cipher/twofish.c (_gcry_twofish_ctr_enc): Ditto. + +2019-03-28 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Optimize OCB set_key and set_nonce. + + commit efd700e31dc8e1e386d367d1b682000977e0c810 + * cipher/cipher-ocb.c (double_block): Change to input/output + host-endian block instead of big-endian buffer. + (double_block_cpy): Remove. + (bit_copy): Use fixed length copy and 'u64' for calculations. + (ocb_get_L_big): Handle block endian conversions for double_block. + (_gcry_cipher_ocb_setkey): Handle block endian conversions for + double_block. + (_gcry_cipher_ocb_set_nonce): Set full length of 'ktop' to zero; Drop + length parameter for bit_copy. + + AES-NI/OCB: Optimize last and first key XORing. + + commit eacbd59b1333b95858886999c8049e04bf72ad74 + * cipher/rijndael-aesni.c (aesni_ocb_enc, aesni_ocb_dec) + [__x86_64__]: Reorder and mix first and last key XORing with OCB offset + XOR operations. + + AES-NI/OCB: Perform checksumming inline with encryption. + + commit e924ce456d5728a81c148de4a6eb23373cb70ca0 + * cipher/rijndael-aesni.c (aesni_ocb_enc): Remove call to + 'aesni_ocb_checksum', instead perform checksumming inline with offset + calculations. + +2019-03-27 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + AES-NI/OCB: Use stack for temporary storage. + + commit b82dbbedf027327e0b4444a01edb045f51c4152b + * cipher/rijndael-aesni.c (aesni_ocb_enc, aesni_ocb_dec): Use stack + allocated 'tmpbuf' instead of output buffer as temporary storage. + +2019-03-26 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + tests/basic: add large buffer testing for ciphers. + + commit cabeebfc1179c8f5982834a8cbce02c55b3468e2 + * tests/basic.c (check_one_cipher_core): Allocate buffers from heap. + (check_one_cipher): Add testing with large buffer (~65 KiB) in addition + to medium size buffer (~2 KiB). + + chacha20-poly1305: fix wrong en/decryption on large input buffers. + + commit 049376470b31832d3331fc0037d273b4147e9d38 + * cipher/chacha20.c (_gcry_chacha20_poly1305_encrypt) + (_gcry_chacha20_poly1305_decrypt): Correctly use 'currlen' for chacha20 + on the non-stitched code path. + +2019-03-24 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + doc: add mention about aligning data to cachelines for best performance. + + commit bb03edcbba95e06686188957a65c1967ee07cd6a + * doc/gcrypt.text: Add mention about aligning data to cachelines for + best performance. + + random-drbg: do not use calloc for zero ctr. + + commit 5a20151213c2e496513c541c36e4ebd086b20be9 + * random/random-drbg.c (DRBG_CTR_NULL_LEN): Move to 'constants' + section. + (drbg_state_s): Remove 'ctr_null' member. + (drbg_ctr_generate): Add 'drbg_ctr_null'. + (drbg_sym_fini, drbg_sym_init): Remove 'drbg->ctr_null' usage. + +2019-03-23 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add ARMv7/NEON accelerated GCM implementation. + + commit 2445cf7431fab921f6c1870da7084ee698992064 + * cipher/Makefile.am: Add 'cipher-gcm-armv7-neon.S'. + * cipher/cipher-gcm-armv7-neon.S: New. + * cipher/cipher-gcm.c [GCM_USE_ARM_NEON] (_gcry_ghash_setup_armv7_neon) + (_gcry_ghash_armv7_neon, ghash_setup_armv7_neon) + (ghash_armv7_neon): New. + (setupM) [GCM_USE_ARM_NEON]: Use armv7/neon implementation if have + HWF_ARM_NEON. + * cipher/cipher-internal.h (GCM_USE_ARM_NEON): New. + + Use memset instead of setting buffers byte by byte. + + commit 6f2391d2df029b0e1a4e5dde17c3d97cc594a1c7 + * cipher/cipher-ccm.c (do_cbc_mac): Replace buffer setting loop with memset call. + * cipher/cipher-gcm.c (do_ghash_buf): Ditto. + * cipher/poly1305.c (poly1305_final): Ditto. + + Use buf_cpy instead of copying buffers byte by byte. + + commit 4db6d8796c0d95ab89e9ad69336509b604b957cd + * cipher/bufhelp.h (buf_cpy): Skip memcpy if length is zero. + * cipher/cipher-ccm.c (do_cbc_mac): Replace buffer copy loops with buf_cpy call. + * cipher/cipher-cmac.c (_gcry_cmac_write): Ditto. + * cipher/cipher-ocb.c (_gcry_cipher_ocb_authenticate): Ditto. + + Reduce overhead on generic hash write function. + + commit e76617cbab018dd8f41fd6b4ec6740b5303f7e13 + * cipher/hash-common.c (_gcry_md_block_write): Remove recursive + function call; Use buf_cpy for copying buffers; Burn stack only once. + + sha1-avx: use vmovdqa instead of movdqa. + + commit f8d14df1abd645c3279b14da43b4a7983d87f89f + * cipher/sha1-avx-amd64.S: Replace 'movdqa' with 'vmovdqa'. + * cipher/sha1-avx-bmi2-amd64.S: Replace 'movdqa' with 'vmovdqa'. + + doc/gcrypt.texi: update HW feature list. + + commit 7abf65da84c7106250a5ed2de78b05610cf251f4 + * doc/gcrypt.texi: Update FW feature list. + +2019-03-20 Daniel Kahn Gillmor <dkg@fifthhorseman.net> + + ecc: Adjust debugging output. + + commit 54db6a4b44124ed7e95897174f32262482b4b0cb + * cipher/ecc.c (ecc_check_secret_key): Adjust debugging output to use + full column titles. + +2019-02-25 NIIBE Yutaka <gniibe@fsij.org> + + fips: Only test check_binary_integrity when fips_mode is enabled. + + commit ad133fc79757236359252e92244fe16e9adb45a3 + * src/fips.c (_gcry_fips_run_selftests): Check the status of fips_mode + before calling check_binary_integrity. + +2019-02-07 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add 2-way path for SSSE3 version of ChaCha20. + + commit d455068988e5779b0200c51415ddab6b51e12dc4 + * cipher/chacha20-amd64-ssse3.S (_gcry_chacha20_amd64_ssse3_blocks1) + (_gcry_chacha20_poly1305_amd64_ssse3_blocks1): Add 2-way code paths. + * cipher/chacha20.c (_gcry_chacha20_poly1305_encrypt): Add + preprosessing of 2 blocks with SSSE3. + +2019-01-27 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Do not precalculate OCB offset L0+L1+L0. + + commit afab94d222425ecb838eb56cb0723bdaf3e5de36 + * cipher/cipher-internal.h (gcry_cipher_handle): Remove OCB L0L1L0. + * cipher/cipher-ocb.c (_gcry_cipher_ocb_setkey): Ditto. + * cipher/rijndael-aesni.c (aesni_ocb_enc, aesni_ocb_dec) + (_gcry_aes_aesni_ocb_auth): Replace L0L1L0 use with L1. + + Calculate OCB L-tables when setting key instead of when setting nonce. + + commit c15409c49993166ab1325d45360b3a8fe72a5556 + * cipher/cipher-internal.h (gcry_cipher_handle): Mark areas of + u_mode.ocb that are and are not cleared by gcry_cipher_reset. + (_gcry_cipher_ocb_setkey): New. + * cipher/cipher-ocb.c (_gcry_cipher_ocb_set_nonce): Split + L-table generation to ... + (_gcry_cipher_ocb_setkey): ... this new function. + * cipher/cipher.c (cipher_setkey): Add handling for OCB mode. + (cipher_reset): Do not clear L-values for OCB mode. + + chacha20-amd64-avx2: optimize output xoring. + + commit 08e0650c21984bb9ddf5a1dabb1cc890fabf63ab + * cipher/chacha20-amd64-avx2.S (STACK_TMP2): Remove. + (transpose_16byte_2x2, xor_src_dst): New. + (BUF_XOR_256_TO_128): Remove. + (_gcry_chaha20_amd64_avx2_blocks8) + (_gcry_chacha20_poly1305_amd64_avx2_blocks8): Replace + BUF_XOR_256_TO_128 with transpose_16byte_2x2/xor_src_dst; Reduce stack + usage; Better interleave chacha20 state merging and output xoring. + + tests/bench-slope: prevent auto-mhz detection getting stuck. + + commit 28614a77a28190ab902a2b98039de2cd0635c7c7 + * cipher/bench-slope.c (bench_ghz, bench_ghz_diff): New static + variables. + (AUTO_GHZ_TARGET_DIFF): New macro. + (do_slope_benchmark): Reduce target auto-mhz accuracy after + repeated failures. + (bench_print_result_csv, bench_print_result_std): Print auto-ghz + different if 1 Mhz or more. + (do_slope_benchmark, bench_print_result_csv, bench_print_result_std) + (bench_print_result): Remove 'bench_ghz' parameter. + (cipher_bench_one, hash_bench_one, mac_bench_one) + (kdf_bench_one): Remove 'bench_ghz' variable. + + tests/bench-slope: add missing cipher context reset. + + commit 546f13ae08918726791600cdd0d0be56cc52c790 + * tests/bench-slope.c (bench_encrypt_do_bench) + (bench_decrypt_do_bench): Add call to 'gcry_cipher_reset'. + + Add stitched ChaCha20-Poly1305 SSSE3 and AVX2 implementations. + + commit d6330dfb4b0e9fb3f8eef65ea13146060b804a97 + * cipher/asm-poly1305-amd64.h: New. + * cipher/Makefile.am: Add 'asm-poly1305-amd64.h'. + * cipher/chacha20-amd64-avx2.S (QUATERROUND2): Add interleave + operators. + (_gcry_chacha20_poly1305_amd64_avx2_blocks8): New. + * cipher/chacha20-amd64-ssse3.S (QUATERROUND2): Add interleave + operators. + (_gcry_chacha20_poly1305_amd64_ssse3_blocks4) + (_gcry_chacha20_poly1305_amd64_ssse3_blocks1): New. + * cipher/chacha20.c (_gcry_chacha20_poly1305_amd64_ssse3_blocks4) + (_gcry_chacha20_poly1305_amd64_ssse3_blocks1) + (_gcry_chacha20_poly1305_amd64_avx2_blocks8): New prototypes. + (chacha20_encrypt_stream): Split tail to... + (do_chacha20_encrypt_stream_tail): ... new function. + (_gcry_chacha20_poly1305_encrypt) + (_gcry_chacha20_poly1305_decrypt): New. + * cipher/cipher-internal.h (_gcry_chacha20_poly1305_encrypt) + (_gcry_chacha20_poly1305_decrypt): New prototypes. + * cipher/cipher-poly1305.c (_gcry_cipher_poly1305_encrypt): Call + '_gcry_chacha20_poly1305_encrypt' if cipher is ChaCha20. + (_gcry_cipher_poly1305_decrypt): Call + '_gcry_chacha20_poly1305_decrypt' if cipher is ChaCha20. + * cipher/poly1305-internal.h (_gcry_cipher_poly1305_update_burn): New + prototype. + * cipher/poly1305.c (poly1305_blocks): Make static. + (_gcry_poly1305_update): Split main function body to ... + (_gcry_poly1305_update_burn): ... new function. + + Add SSSE3 optimized non-parallel ChaCha20 function. + + commit 7d9b2f114f3edf4d13640616cf34c79364234781 + * cipher/chacha20-amd64-ssse3.S (ROTATE_SHUF, ROTATE, WORD_SHUF) + (QUARTERROUND4, _gcry_chacha20_amd64_ssse3_blocks1): New. + * cipher/chacha20.c (_gcry_chacha20_amd64_ssse3_blocks1): New + prototype. + (chacha20_blocks): Rename to ... + (do_chacha20_blocks): ... this. + (chacha20_blocks): New. + (chacha20_encrypt_stream): Adjust for new chacha20_blocks function. + + tests/basic: increase buffer size for check_one_cipher. + + commit 88e482d16ee80de41b6f133e77f0d15423fcd266 + * tests/basic.c (check_one_cipher_core) + (check_one_cipher): Increase buffer from 1040 to 1904 bytes. + + tests/basic: check AEAD tags in check_one_cipher test. + + commit eee1f152a5b3040f6723d287d1b01fb939be67b7 + * tests/basic.c (get_algo_mode_taglen): New. + (check_one_cipher_core_reset): Check that tags are same with + AEAD modes. + +2019-01-15 NIIBE Yutaka <gniibe@fsij.org> + + build: With LD_LIBRARY_PATH defined, use --disable-new-dtags. + + commit e5c2f8a2cd2b89d90ea30de2dedb0e92498a5f70 + * configure.ac (LDADD_FOR_TESTS_KLUDGE): New for --disable-new-dtags. + * tests/Makefile.am (LDADD, t_lock_LDADD): Use LDADD_FOR_TESTS_KLUDGE. + + random: Fix previous commit for getentropy function. + + commit 17f246c7044ab9ed236f6ec73fc126654257f0f9 + * random/rndlinux.c [__NR_getrandom] (_gcry_rndlinux_gather_random): + Check return value only for use of syscall. + + random: Use getentropy when available for not GNU/Linux. + + commit 2677d7d482bf2d078c1dce64854747c5b148924b + * configure.ac: Detect getentropy. + * random/rndlinux.c [__linux__] (getentropy): Macro defined. + [HAVE_GETENTROPY] (_gcry_rndlinux_gather_random): Use getentropy. + +2019-01-14 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + camellia-aarch64: do not export look-up table globally. + + commit 09c27280cc09798d15369b3a143036b7ab5ddd69 + * cipher/camellia-aarch64.S (_gcry_camellia_arm_tables): Remove + '.globl' export. + +2019-01-02 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Process CCM/EAX/GCM/Poly1305 AEAD cipher modes input in 24 KiB chucks. + + commit 3ee6588de8311b461ef8707c70ff86d2b252966d + * cipher/cipher-ccm.c (_gcry_cipher_ccm_encrypt) + (_gcry_cipher_ccm_decrypt): Process data in 24 KiB chunks. + * cipher/cipher-eax.c (_gcry_cipher_eax_encrypt) + (_gcry_cipher_eax_decrypt): Ditto. + * cipher/cipher-gcm.c (_gcry_cipher_gcm_encrypt) + (_gcry_cipher_gcm_decrypt): Ditto. + * cipher/cipher-poly1305.c (_gcry_cipher_poly1305_encrypt) + (_gcry_cipher_poly1305_decrypt): Ditto. + + tests/benchmark: add Chacha20-Poly1305 benchmarking. + + commit 4871f11745f33c5c5051bfe6f325ac1c10764b04 + * tests/benchmark.c (cipher_bench): Add Chacha20-Poly1305. + + tests/benchmark: add --huge-buffers option for cipher tests. + + commit edde61f325e4b345f17c47369f3b6b1400656f04 + * tests/benchmark.c (huge_buffers, cipher_encrypt, cipher_decrypt): New. + (cipher_bench): Add 'max_inlen' to modes structure; add huge buffers + mode selection. + (main): Add '--huge-buffers'. + +2018-12-19 NIIBE Yutaka <gniibe@fsij.org> + + random: Add finalizer for rndjent. + + commit 3028a221d39c1b593ea0c1bcbfccd33959769692 + * random/rand-internal.h (_gcry_rndjent_fini): New. + * random/rndjent.c (_gcry_rndjent_fini): New. + * random/rndlinux.c (_gcry_rndlinux_gather_random): Call the finalizer + when GCRYCTL_CLOSE_RANDOM_DEVICE. + +2018-12-12 Werner Koch <wk@gnupg.org> + + secmem: Prepare for easier debugging. + + commit 876f7280e8604bc99ddda0526339ec5ec6b23c4b + * src/secmem.c (_gcry_secmem_dump_stats): Factor code out to ... + (secmem_dump_stats_internal): new. + +2018-12-01 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael-aesni: interleave last CTR encryption round with xoring. + + commit 66d2b7fc17258f1424f4ca4adb1096e48b818bd0 + * cipher/rijndael-aesni.c (do_aesni_ctr_8): Interleave aesenclast + with input xoring. + +2018-11-20 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Use explicit_bzero for wipememory. + + commit 168668228c7c49e70612cb4d602d6d603a2add2c + * configure.ac (AC_CHECK_FUNCS): Check for 'explicit_bzero'. + * src/g10lib.h (wipememory2): Use _gcry_fast_wipememory if _SET is + zero. + (_gcry_fast_wipememory): New. + (_gcry_wipememory2): Rename to... + (_gcry_fast_wipememory2): ...this. + * src/misc.c (_gcry_wipememory): New. + (_gcry_wipememory2): Rename to... + (_gcry_fast_wipememory2): ...this. + (_gcry_fast_wipememory2) [HAVE_EXPLICIT_BZERO]: Use explicit_bzero if + SET is zero. + (_gcry_burn_stack): Use _gcry_fast_wipememory. + + Add clang target pragma for mixed C/assembly x86-64 implementations. + + commit 9d9c4fd18b445ff414d11678285d54af3afdb222 + * cipher/cipher-gcm-intel-pclmul.c: Add target 'no-sse' attribute + pragma for clang. + * cipher/crc-intel-pclmul.c: Ditto. + * cipher/rijndael-aesni.c: Ditto. + * cipher/rijndael-ssse3-amd64.c: Ditto. + * cipher/sha1-intel-shaext.c: Ditto. + * cipher/sha256-intel-shaext.c: Ditto. + + Optimizations for AES-NI OCB. + + commit b42de67f34871a2520cfe370af513f2aab6e4f75 + * cipher/cipher-internal.h (gcry_cipher_handle): New pre-computed OCB + values L0L1 and L0L1L0; Swap dimensions for OCB L table. + * cipher/cipher-ocb.c (_gcry_cipher_ocb_set_nonce): Setup L0L1 and + L0L1L0 values. + (ocb_crypt): Process input in 24KiB chunks for better cache locality + for checksumming. + * cipher/rijndael-aesni.c (ALWAYS_INLINE): New macro for always + inlining functions, change all functions with 'inline' to use + ALWAYS_INLINE. + (NO_INLINE): New macro. + (aesni_prepare_2_6_variable, aesni_prepare_7_15_variable): Rename to... + (aesni_prepare_2_7_variable, aesni_prepare_8_15_variable): ...these and + adjust accordingly (xmm7 moved from *_7_15 to *_2_7). + (aesni_prepare_2_6, aesni_prepare_7_15): Rename to... + (aesni_prepare_2_7, aesni_prepare_8_15): ...these and adjust + accordingly. + (aesni_cleanup_2_6, aesni_cleanup_7_15): Rename to... + (aesni_cleanup_2_7, aesni_cleanup_8_15): ...these and adjust + accordingly. + (aesni_ocb_checksum): New. + (aesni_ocb_enc, aesni_ocb_dec): Calculate OCB offsets in parallel + with help of pre-computed offsets L0+L1 ja L0+L1+L0; Do checksum + calculation as separate pass instead of inline; Use NO_INLINE. + (_gcry_aes_aesni_ocb_auth): Calculate OCB offsets in parallel + with help of pre-computed offsets L0+L1 ja L0+L1+L0. + * cipher/rijndael-internal.h (RIJNDAEL_context_s) [USE_AESNI]: Add + 'use_avx2' and 'use_avx'. + * cipher/rijndael.c (do_setkey) [USE_AESNI]: Set 'use_avx2' if + Intel AVX2 HW feature is available and 'use_avx' if Intel AVX HW + feature is available. + * tests/basic.c (do_check_ocb_cipher): New test vector; increase + size of temporary buffers for new test vector. + (check_ocb_cipher_largebuf_split): Make test plaintext non-uniform + for better checksum testing. + (check_ocb_cipher_checksum): New. + (check_ocb_cipher_largebuf): Call check_ocb_cipher_checksum. + (check_ocb_cipher): New expected tags for check_ocb_cipher_largebuf + test runs. + +2018-11-19 Andreas Metzler <ametzler@bebt.de> + + doc: Fix library initialization examples. + + commit af0bbdb9019e0b4a72e87e8b1b4a55506d349834 + + +2018-11-14 Werner Koch <wk@gnupg.org> + + random: Initialize variable as requested by valgrind. + + commit aa686dfc9b563ff79c01d2f8560b88f69c42ecba + random/jitterentropy-base.c: Init. + +2018-11-13 NIIBE Yutaka <gniibe@fsij.org> + + libgcrypt.m4: Prefer gpgrt-config to SYSROOT support. + + commit 852245390ef7fd8ca9e36010886a4cf42cf710bf + * libgcrypt.m4: Move SYSROOT support after check of GPGRT_CONFIG. + + build: Update autogen.rc. + + commit bea193446351c24b10a4342466978d57bd53f599 + * autogen.rc: Remove obsolete --with-gpg-error-prefix option. + +2018-11-07 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix 'variable may be used uninitialized' warning for CTR mode. + + commit 3f76319803a4abcd33fa29a0ac39f8ed9d646226 + * cipher/cipher-ctr.c (_gcry_cipher_ctr_encrypt): Set N to BLOCKSIZE + before counter loop. + +2018-11-06 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix inlining of ocb_get_l for x86 AES implementations. + + commit 9d6431604b5ee21572c1c2cfa8376e6d81162cbb + * cipher/rijndael-aesni.c (aes_ocb_get_l): New. + (aesni_ocb_enc, aesni_ocb_dec, _gcry_aes_aesni_ocb_auth): Use + 'aes_ocb_get_l'. + * cipher/rijndael-ssse3-amd4.c (aes_ocb_get_l): New. + (ssse3_ocb_enc, ssse3_ocb_dec, _gcry_aes_ssse3_ocb_auth): Use + 'aes_ocb_get_l'. + +2018-11-05 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + stdmem: free: only call _gcry_secmem_free if needed. + + commit 23f56d3359ca7d152aa87874ddd6305171a91408 + * src/stdmem.c (_gcry_private_free): Check if memory is secure before + calling _gcry_secmem_free to avoid unnecessarily taking secmem lock. + + secmem: fix potential memory visibility issue. + + commit d6c6680ca31c05bafbb8becda56da051346eceb3 + * configure.ac (gcry_cv_have_sync_synchronize): New check. + * src/secmem.c (pooldesc_s): Make next pointer volatile. + (memory_barrier): New. + (_gcry_secmem_malloc_internal): Insert memory barrier between + pool->next and mainpool.next assigments. + (_gcry_private_is_secure): Update comments. + + wipememory: use memset for non-constant length or large buffer wipes. + + commit 4faeaa1cbd235a2560fa04a8ac3766a07029acd8 + * src/g10lib.h (CONSTANT_P): New. + (_gcry_wipememory2): New prototype. + (wipememory2): Use _gcry_wipememory2 if _len not constant expression or + lenght is larger than 64 bytes. + (FASTWIPE_T, FASTWIPE_MULT, fast_wipememory2_unaligned_head): Remove. + (fast_wipememory2): Always handle buffer as unaligned. + * src/misc.c (__gcry_burn_stack): Move memset_ptr variable to... + (memset_ptr): ... here. New. + (_gcry_wipememory2): New. + + Change buf_cpy and buf_xor* functions to use buf_put/buf_get helpers. + + commit 0068d41d9304ebcdb2caba1fa8848925e2bfaac7 + * cipher/bufhelp.h (BUFHELP_FAST_UNALIGNED_ACCESS) + (bufhelp_int_s, buf_xor_1): Remove. + (buf_cpy, buf_xor, buf_xor_2dst, buf_xor_n_copy_2): Use + buf_put/buf_get helpers to handle unaligned memory accesses. + + rijndael: fix unused parameter warning. + + commit 30e783ec487466132324673f197d36b85a91b060 + * cipher/rijndael.c (do_setkey): Silence unused 'hd' warning. + + mpi/longlong.h: enable inline assembly for powerpc64. + + commit ec49013d23d9a7b874c42d77ceb08bd313ba69e1 + * mpi/longlong.h [__powerpc__ && W_TYPE_SIZE == 64]: Remove '#if 0'. + + Change remaining users of _gcry_fips_mode to use fips_mode. + + commit 2aece89d3967e692743541cea857f2e4771b0b62 + * src/fips.c (_gcry_fips_mode): Remove. + (_gcry_enforced_fips_mode, _gcry_inactivate_fips_mode) + (_gcry_is_fips_mode_inactive): Use fips_mode. + * src/g10lib.h (_gcry_fips_mode): Remove. + +2018-11-02 NIIBE Yutaka <gniibe@fsij.org> + + aarch64: mpi: Distribute the header file as a part of source. + + commit a2e0cb1542818ad8a71de34ccbf191adab0a0b86 + * mpi/Makefile.am (EXTRA_libmpi_la_SOURCES): Add asm-common-aarch64.h. + + build: Fix GCRYPT_HWF_MODULES. + + commit f7395338d71d4d82180a11707fd6e77787162e24 + * configure.ac (GCRYPT_HWF_MODULES): Add libgcrypt_la- prefix. + + build: Update gpg-error.m4 and libgcrypt.m4. + + commit f46286851158878d5041ac5381b2807ecec541eb + * m4/gpg-error.m4: Update to 2018-11-02. + * src/libgrypt.m4: Add AC_MSG_NOTICE. + Bump the version date. + +2018-10-29 NIIBE Yutaka <gniibe@fsij.org> + + build: Update gpg-error.m4 and ksba.m4. + + commit 4a4d4a284ca996df874e2534f8529c1611289943 + * m4/gpg-error.m4: Update to 2018-10-29. + * src/libgrypt.m4: Follow the change of gpgrt-config. + Bump the version date. + +2018-10-27 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix missing global initialization in fips_is_operational. + + commit 6e669e09603e5a98b59dcf35f77f346db6c81eac + * src/g10lib.h (_gcry_global_any_init_done): New extern. + (fips_is_operational): Check for _gcry_global_any_init_done and call + _gcry_global_is_operational. + * src/global.c (any_init_done): Rename to ... + (_gcry_global_any_init_done): ... this and make externally available. + +2018-10-26 Daniel Kahn Gillmor <dkg@fifthhorseman.net> + + random: use getrandom() on Linux where available. + + commit 7e662680c170968661ee0105d132813f8281d229 + * random/rndlinux.c (_gcry_rndlinux_gather_random): use the + getrandom() syscall on Linux if it exists, regardless of what kind of + entropy was requested. + +2018-10-26 Werner Koch <wk@gnupg.org> + + random: Make sure to re-open /dev/random after a fork. + + commit 319f55e6e5793c59f1ba4cfe481b562bca42194d + * random/rndlinux.c (_gcry_rndlinux_gather_random): Detect fork and + re-open devices. + + primes: Avoid leaking bits of the prime test to pageable memory. + + commit 2e2e68ad4874a4678cfbe452b70ae987e0402eca + * cipher/primegen.c (gen_prime): Allocate MODS in secure memory. + +2018-10-26 NIIBE Yutaka <gniibe@fsij.org> + + libgcrypt.m4: Better compatibility support. + + commit a755bd0ea09af2ae5a66e3f5aeb8707673c687cf + * src/gpg-error.m4: Update. + * src/libgcrypt.m4: Don't assume libgcrypt-config is newer. + + build: Fix libgcrypt.m4. + + commit 630ece1b7e0a94442bca91d8e96d9b1d4cd3ec66 + * src/libgcrypt.m4: Use AC_PATH_PROG to detect libgcrypt-config. + + build: Relax build requirements. + + commit 8e5641ed65f86783542d5caccdeeee42eeb9457c + * m4/gpg-error.m4: Update from libgpg-error 1.33. + * src/libgcrypt.m4: Don't require AM_PATH_GPG_ERROR. Use GPGRT_CONFIG + instead of libgcrypt-config when it is confirmed that it is available + and working well. + * configure.ac (AM_PATH_GPG_ERROR): No requirement for newer version + (It was because of new gpgrt-config which supports *.pc files). + +2018-10-25 NIIBE Yutaka <gniibe@fsij.org> + + build: Require libgpg-error >= 1.33. + + commit b376dc2abbb208b10bbc76998ff39adb2f301905 + * configure.ac (NEED_GPG_ERROR_VERSION): Require 1.33. + * m4/gpg-error.m4: Update from libgpg-error 1.33. + * src/libgcrypt.m4: Bump version date. + Use --variable option. + +2018-10-24 Werner Koch <wk@gnupg.org> + + build: Add release make target. + + commit 03bb25ee7ed6f1076bf788ab981ca68672880daa + * Makefile.am (release, sign-release): New targets. + + build: Make distcheck work again. + + commit b0ad66e48c46b79af69349606e276cf0a6b9a020 + * cipher/Makefile.am: Prettified source file lists. + EXTRA_libcipher_la_SOURCES): Add missing asm-common-aarch64.h. + + Fix memory leak in secmem in out of core conditions. + + commit f74687fd43f5772a372f54031d5a9527597f4ce4 + * src/secmem.c (_gcry_secmem_malloc_internal): Release pool descriptor + if the pool could not be allocated. + + ecc: Fix memory leak in the error case of ecc_encrypt_raw. + + commit e57e75ea517f32109b508113f18298fc69fd1192 + * cipher/ecc.c (ecc_encrypt_raw): Add proper error cleanup in the main + block. + + ecc: Fix possible memory leakage in parameter check of eddsa. + + commit 149ceb3cae03d0385341d32430aa5ae57de90007 + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_verify): Fix mem leak. + +2018-10-24 NIIBE Yutaka <gniibe@fsij.org> + + build: Fix libgcrypt.pc. + + commit 0e071372fc0e6fed4a449955ed0789803ba5e709 + * src/libgcrypt.pc.in: Fix typo. + + build: Compatibility to pkg-config. + + commit c60eabb11435665fa84a3a82b2a15f48870cc4d7 + * src/libgcrypt-config.in: Support --variable and --modversion. + + build: Make libgcrypt.m4 use gpg-error-config. + + commit 7da887d69d72ea0ea0d106054c48a8c03e242a18 + * src/libgcrypt.m4: Use gpg-error-config. + + build: Provide libgcrypt.pc, generated by configure. + + commit 97194b422bc89a6137f4e218d4cdee118c63e96e + * configure.ac: Generate src/libgcrypt.pc. + * src/Makefile.am (pkgconfigdir, pkgconfig_DATA): New. + (EXTRA_DIST): Add libgcrypt.pc.in. + * src/libgcrypt-config.in: Use @PACKAGE_VERSION@. + * src/libgcrypt.pc.in: New. + + build: Update gpg-error.m4 from libgpg-error. + + commit 5b1febb5e40d92072bef425bd9e63f7a07edd57e + * m4/gpg-error.m4: Update from libgpg-error 1.33. + + build: Don't default to underscore=yes for cross-build. + + commit 0f4545b441b6fbdd6e9c4e95f5f2a367483e78ad + * acinclude.m4: Don't set ac_cv_sys_symbol_underscore + for cross build. + +2018-10-23 Werner Koch <wk@gnupg.org> + + ecc: Fix potential unintended freeing of an internal param. + + commit e2da4e8dee4b371804f3b2659b53431fb6380d93 + * cipher/ecc-curves.c (_gcry_ecc_get_mpi): Fix c+p error + + sexp: Fix uninitialized use of a var in the error case. + + commit 9f2c7ec4d8b07e82663ad084c90c016d3c3b80c2 + * src/sexp.c (_gcry_sexp_vextract_param): Initialize L1. + +2018-10-16 NIIBE Yutaka <gniibe@fsij.org> + + build: Let configure create the VERSION file. + + commit 0f2c6ce2c9504c6df435463243edaa669e57b109 + * autogen.sh: Update from libgpg-error. + * configure.ac: Use mym4_versoin to create VERSION file. + * Makefile.am (dist-hook): Do not create VERSION file. + (EXTRA_DIST): Add VERSION. + +2018-07-21 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add size optimized cipher block copy and xor functions. + + commit 86e5e06a97ae13b8bbf6923ecc76e02b9c429b46 + * cipher/bufhelp.h (buf_get_he32, buf_put_he32, buf_get_he64) + (buf_put_he64): New. + * cipher/cipher-internal.h (cipher_block_cpy, cipher_block_xor) + (cipher_block_xor_1, cipher_block_xor_2dst, cipher_block_xor_n_copy_2) + (cipher_block_xor_n_copy): New. + * cipher/cipher-gcm-intel-pclmul.c + (_gcry_ghash_setup_intel_pclmul): Use assembly for swapping endianness + instead of buf_get_be64 and buf_cpy. + * cipher/blowfish.c: Use new cipher_block_* functions for cipher block + sized buf_cpy/xor* operations. + * cipher/camellia-glue.c: Ditto. + * cipher/cast5.c: Ditto. + * cipher/cipher-aeswrap.c: Ditto. + * cipher/cipher-cbc.c: Ditto. + * cipher/cipher-ccm.c: Ditto. + * cipher/cipher-cfb.c: Ditto. + * cipher/cipher-cmac.c: Ditto. + * cipher/cipher-ctr.c: Ditto. + * cipher/cipher-eax.c: Ditto. + * cipher/cipher-gcm.c: Ditto. + * cipher/cipher-ocb.c: Ditto. + * cipher/cipher-ofb.c: Ditto. + * cipher/cipher-xts.c: Ditto. + * cipher/des.c: Ditto. + * cipher/rijndael.c: Ditto. + * cipher/serpent.c: Ditto. + * cipher/twofish.c: Ditto. + +2018-07-04 NIIBE Yutaka <gniibe@fsij.org> + + RFC-8439 was published. + + commit 9660c3fafd732b1857bb2697c6f43aed077b9ad6 + * cipher/cipher-poly1305.c: Update RFC reference. + +2018-06-19 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Clean-up implementation selection for SHA1 and SHA2. + + commit 8a44c55d2fb758f726b8b436aa5c0b88a6c6f112 + * cipher/sha1.c (ASM_EXTRA_STACK): Increase by sizeof(void*)*4. + (do_sha1_transform_amd64_ssse3, do_sha1_transform_amd64_avx) + (do_sha1_transform_amd64_avx_bmi2, do_sha1_transform_intel_shaext) + (do_sha1_transform_armv7_neon, do_sha1_transform_armv8_ce): New. + (transform_blk, transform): Merge to ... + (do_transform_generic): ... this and remove calls to assembly + implementations. + (sha1_init): Select hd->bctx.bwrite based on HW features. + (_gcry_sha1_mixblock, sha1_final): Call hd->bctx.bwrite instead of + transform. + * cipher/sha1.h (SHA1_CONTEXT): Remove implementation selection bits. + * cipher/sha256.h (SHA256_CONTEXT): Remove implementation selection + bits. + (ASM_EXTRA_STACK): Increase by sizeof(void*)*4. + (do_sha256_transform_amd64_ssse3, do_sha256_transform_amd64_avx) + (do_sha256_transform_amd64_avx2, do_sha256_transform_intel_shaext) + (do_sha256_transform_armv8_ce): New. + (transform_blk, transform): Merge to ... + (do_transform_generic): ... this and remove calls to assembly + implementations. + (sha256_init, sha224_init): Select hd->bctx.bwrite based on HW + features. + (sha256_final): Call hd->bctx.bwrite instead of transform. + * cipher/sha512-armv7-neon.S + (_gcry_sha512_transform_armv7_neon): Return zero. + * cipher/sha512.h (SHA512_CONTEXT): Remove implementation selection + bits. + (ASM_EXTRA_STACK): Increase by sizeof(void*)*4. + (do_sha512_transform_armv7_neon, do_sha512_transform_amd64_ssse3) + (do_sha512_transform_amd64_avx, do_sha512_transform_amd64_avx2): New. + [USE_ARM_ASM] (do_transform_generic): New. + (transform_blk, transform): Merge to ... + [!USE_ARM_ASM] (do_transform_generic): ... this and remove calls to + assembly implementations. + (sha512_init, sha384_init): Select hd->bctx.bwrite based on HW + features. + (sha512_final): Call hd->bctx.bwrite instead of transform. + + Add hash_buffer and hash_buffers for SHA-224, SHA-385, SHA3 and BLAKE2. + + commit 59c4e344eec61cff45185e1caea6815b3266a0f8 + * cipher/blake2.c (DEFINE_BLAKE2_VARIANT): Add hash_buffer and + hash_buffers functions for BLAKE2 variants. + * cipher/keccak.c (_gcry_sha3_hash_buffer, _gcry_sha3_hash_buffers) + (_gcry_sha3_224_hash_buffer, _gcry_sha3_224_hash_buffers) + (_gcry_sha3_256_hash_buffer, _gcry_sha3_256_hash_buffers) + (_gcry_sha3_384_hash_buffer, _gcry_sha3_384_hash_buffers) + (_gcry_sha3_512_hash_buffer, _gcry_sha3_512_hash_buffers): New. + * cipher/sha256.c (_gcry_sha224_hash_buffer) + (_gcry_sha224_hash_buffers): New. + * cipher/sha512.c (_gcry_sha384_hash_buffer) + (_gcry_sha384_hash_buffers): New. + + Add hash_buffer and hash_buffers pointers to message digest spec. + + commit b136703ea0ddbd9fec6dfd1f8dfda8373653ba39 + * src/cipher-proto.h (gcry_md_hash_buffer_t) + (gcry_md_hash_buffers_t): New. + (gcry_md_spec): Add hash_buffer and hash_buffers. + * cipher/md.c (_gcry_md_hash_buffer, _gcry_md_hash_buffers): Use + hash_buffer/hash_buffers from MD spec instead of hard-coding supported + algorithms. + * cipher/blake2.c: Add NULL to MD spec hash_buffer and hash_buffers + pointers. + * cipher/crc.c: Ditto. + * cipher/gostr3411-94.c: Ditto. + * cipher/keccak.c: Ditto. + * cipher/md2.c: Ditto. + * cipher/md4.c: Ditto. + * cipher/md5.c: Ditto. + * cipher/stribog.c: Ditto. + * cipher/tiger.c: Ditto. + * cipher/whirlpool.c: Ditto. + * cipher/rmd160.c (_gcry_rmd160_hash_buffers): New. + (_gcry_digest_spec_rmd160): Add hash_buffer and hash_buffers functions. + * cipher/sha1.c (_gcry_digest_spec_sha1): Add hash_buffer and + hash_buffers functions. + * cipher/sha256.c (_gcry_digest_spec_sha256): Add hash_buffer and + hash_buffers functions. + (_gcry_digest_spec_sha224): Add NULL pointers for hash_buffer and + hash_buffers. + * cipher/sha512.c (_gcry_digest_spec_sha1): Add hash_buffer and + hash_buffers functions. + (_gcry_digest_spec_sha384): Add NULL pointers for hash_buffer and + hash_buffers. + * cipher/sm3.c (_gcry_digest_spec_sha1): Add hash_buffer and + hash_buffers functions. + + AES: setup cipher object bulk routines with optimized versions. + + commit a15c1def7e0f170f6663635db84fecab1cbfcca7 + * cipher/rijndael-aesni.c + (_gcry_aes_aesni_prepare_decryption): Rename... + (do_aesni_prepare_decryption): .. to this. + (_gcry_aes_aesni_prepare_decryption): New. + (_gcry_aes_aesni_cfb_enc, _gcry_aes_aesni_cbc_enc) + (_gcry_aes_aesni_ctr_enc, _gcry_aes_aesni_cfb_dec) + (_gcry_aes_aesni_cbc_dec): Reorder parameters to match bulk + operations. + (_gcry_aes_aesni_cbc_dec, aesni_ocb_dec) + (_gcry_aes_aesni_xts_dec): Check and prepare decryption. + (_gcry_aes_aesni_ocb_crypt, _gcry_aes_aesni_ocb_auth): Change return + type to size_t. + * cipher/rijndael-armv8-ce.c + (_gcry_aes_armv8_ce_cfb_enc, _gcry_aes_armv8_ce_cbc_enc) + (_gcry_aes_armv8_ce_ctr_enc, _gcry_aes_armv8_ce_cfb_dec) + (_gcry_aes_armv8_ce_cbc_dec): Reorder parameters to match bulk + operations. + (_gcry_aes_armv8_ce_cbc_dec, _gcry_aes_armv8_ce_ocb_crypt) + (_gcry_aes_armv8_ce_xts_dec): Check and prepare decryption. + (_gcry_aes_armv8_ce_ocb_crypt, _gcry_aes_armv8_ce_ocb_auth): Change + return type to size_t. + * cipher/rijndael-ssse3-amd64.c + (_gcry_ssse3_prepare_decryption): Rename... + (do_ssse3_prepare_decryption): .. to this. + (_gcry_ssse3_prepare_decryption): New. + (_gcry_aes_ssse3_cfb_enc, _gcry_aes_ssse3_cbc_enc) + (_gcry_aes_ssse3_ctr_enc, _gcry_aes_ssse3_cfb_dec) + (_gcry_aes_ssse3_cbc_dec): Reorder parameters to match bulk + operations. + (_gcry_aes_ssse3_cbc_dec, ssse3_ocb_dec): Check and prepare decryption. + (_gcry_aes_ssse3_ocb_crypt, _gcry_aes_ssse3_ocb_auth): Change return + type to size_t. + * cipher/rijndael.c + (_gcry_aes_aesni_cfb_enc, _gcry_aes_aesni_cbc_enc) + (_gcry_aes_aesni_ctr_enc, _gcry_aes_aesni_cfb_dec) + (_gcry_aes_aesni_cbc_dec, _gcry_aes_aesni_ocb_crypt) + (_gcry_aes_aesni_ocb_auth, _gcry_aes_aesni_xts_crypt) + (_gcry_aes_ssse3_cfb_enc, _gcry_aes_ssse3_cbc_enc) + (_gcry_aes_ssse3_ctr_enc, _gcry_aes_ssse3_cfb_dec) + (_gcry_aes_ssse3_cbc_dec, _gcry_aes_ssse3_ocb_crypt) + (_gcry_aes_ssse3_ocb_auth, _gcry_aes_ssse3_xts_crypt) + (_gcry_aes_armv8_ce_cfb_enc, _gcry_aes_armv8_ce_cbc_enc) + (_gcry_aes_armv8_ce_ctr_enc, _gcry_aes_armv8_ce_cfb_dec) + (_gcry_aes_armv8_ce_cbc_dec, _gcry_aes_armv8_ce_ocb_crypt) + (_gcry_aes_armv8_ce_ocb_auth, _gcry_aes_armv8_ce_xts_crypt): Change + prototypes to match bulk operations. + (do_setkey): Setup bulk operations with optimized implementations. + (_gcry_aes_cfb_enc, _gcry_aes_cbc_enc, _gcry_aes_ctr_enc) + (_gcry_aes_cfb_dec, _gcry_aes_cbc_dec, _gcry_aes_ocb_crypt) + (_gcry_aes_ocb_crypt, _gcry_aes_ocb_auth, _gcry_aes_xts_crypt): Update + usage to match new prototypes, avoid prefetch and decryption + preparation on optimized code paths. + + Pass cipher object pointer to setkey functions. + + commit ca21a24808efa5d562ac91f683504ae0d6dfa69f + * cipher/cipher.c (cipher_setkey): Pass cipher object pointer to + cipher's setkey function. + * cipher/arcfour.c: Add gcry_cipher_hd_t parameter for setkey + functions and update selftests to pass NULL pointer. + * cipher/blowfish.c: Ditto. + * cipher/camellia-glue.c: Ditto. + * cipher/cast5.c: Ditto. + * cipher/chacha20.c: Ditto. + * cipher/cipher-selftest.c: Ditto. + * cipher/des.c: Ditto. + * cipher/gost28147.c: Ditto. + * cipher/idea.c: Ditto. + * cipher/rfc2268.c: Ditto. + * cipher/rijndael.c: Ditto. + * cipher/salsa20.c: Ditto. + * cipher/seed.c: Ditto. + * cipher/serpent.c: Ditto. + * cipher/twofish.c: Ditto. + * src/cipher-proto.h: Ditto. + + Add fast path for _gcry_fips_is_operational. + + commit b6e6ace324440f564df664e27f8276ef01f76795 + * src/fips.c (no_fips_mode_required): Rename to... + (_gcry_no_fips_mode_required): ...this and make externally available. + * src/g10lib.h (_gcry_no_fips_mode_required): New extern. + (fips_mode): Inline _gcry_fips_mode to macro, use + _gcry_no_fips_mode_required directly. + (fips_is_operational): Inline fips_mode check from + _gcry_fips_in_operational. + + Access cipher mode routines through routine pointers. + + commit 233e2049a2cc1c1110f541b6a7ef145a737e2c65 + * cipher/cipher-internal.h (gcry_cipher_handle): Add function pointers + for mode operations. + (_gcry_cipher_xts_crypt): Remove. + (_gcry_cipher_xts_encrypt, _gcry_cipher_xts_decrypt): New. + * cipher/cipher-xts.c (_gcry_cipher_xts_encrypt) + (_gcry_cipher_xts_decrypt): New. + * cipher/cipher.c (_gcry_cipher_setup_mode_ops): New. + (_gcry_cipher_open_internal): Setup mode routines. + (cipher_encrypt, cipher_decrypt): Remove. + (do_stream_encrypt, do_stream_decrypt, do_encrypt_none_unknown) + (do_decrypt_none_unknown): New. + (_gcry_cipher_encrypt, _gcry_cipher_decrypt, _gcry_cipher_setiv) + (_gcry_cipher_authenticate, _gcry_cipher_gettag) + (_gcry_cipher_checktag): Adapted to use mode routines through pointers. + + Add separate handlers for CBC-CTS variant. + + commit 87d8caa47e00f1b1cea968fe38cf30c0ccc9749c + * cipher/cipher-cbc.c (cbc_encrypt_inner, cbc_decrypt_inner) + (_gcry_cipher_cbc_cts_encrypt, _gcry_cipher_cbc_cts_decrypt): New. + (_gcry_cipher_cbc_encrypt, _gcry_cipher_cbc_decrypt): Remove CTS + handling. + * cipher/cipher-internal.h (_gcry_cipher_cbc_cts_encrypt) + (_gcry_cipher_cbc_cts_decrypt): New. + * cipher/cipher.c (cipher_encrypt, cipher_decrypt): Call CBC-CTS + handler if CBC-CTS flag is set. + + Avoid division by spec->blocksize in cipher mode handlers. + + commit f5168091c1930e948af8f25da11cad5dfa62c7ba + * cipher/cipher-internal.h (_gcry_blocksize_shift): New. + * cipher/cipher-cbc.c (_gcry_cipher_cbc_encrypt) + (_gcry_cipherp_cbc_decrypt): Use bit-level operations instead of + division to get number of blocks and check input length against + blocksize. + * cipher/cipher-cfb.c (_gcry_cipher_cfb_encrypt) + (_gcry_cipher_cfb_decrypt): Ditto. + * cipher/cipher-cmac.c (_gcry_cmac_write): Ditto. + * cipher/cipher-ctr.c (_gcry_cipher_ctr_crypt): Ditto. + * cipher/cipher-ofb.c (_gcry_cipher_ofb_encrypt) + (_gcry_cipher_ofb_decrypt): Ditto. + + Fix CBC-CTS+CBC-MAC flag check. + + commit a69021535b472556651eb2bab65666206c56c24b + * cipher/cipher.c (_gcry_cipher_open_internal): Check flags separately + instead of AND masking two flags to zero. + + tests/basic: silence GCC-8 warning. + + commit 2a94bdfc0538a340a24c1a7b524bb0c5f606457c + * tests/basic.c (check_ofb_cipher, check_stream_cipher): Change + tv[].data[].inlen type from signed to unsigned integer. + +2018-06-19 Will Dietz <w@wdtz.org> + + random: Fix hang of _gcry_rndjent_get_version. + + commit 355f5b7f69075c010fe33aa5b10ac60c08fae0c7 + * random/rndjent.c (_gcry_rndjent_get_version): Move locking. + +2018-06-13 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Add blinding for ECDSA. + + commit 9010d1576e278a4274ad3f4aa15776c28f6ba965 + * cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_sign): Blind secret D with + randomized nonce B. + +2018-06-06 Werner Koch <wk@gnupg.org> + + ecc: Improve gcry_mpi_ec_curve_point. + + commit 7b6c2afd699e889f5f054cc3d202a61bd0ee1dcf + * mpi/ec.c (_gcry_mpi_ec_curve_point): Check range of coordinates. + * tests/t-mpi-point.c (point_on_curve): New. + +2018-06-05 Werner Koch <wk@gnupg.org> + + mpi: New internal function _gcry_mpi_cmpabs. + + commit 6606ae44e0de1069b29dd4215ee9748280940e1b + * mpi/mpi-cmp.c (_gcry_mpi_cmp): Factor out to ... + (do_mpi_cmp): New. Add arg absmode. + (_gcry_mpi_cmpabs): New. + * src/gcrypt-int.h (mpi_cmpabs): New macro. + +2018-04-29 Werner Koch <wk@gnupg.org> + + build: Convince gcc not to delete NULL ptr checks. + + commit 61dbb7c08ab11c10060e193b52e3e1d2ec6dd062 + * configure.ac: Try to use -fno-delete-null-pointer-checks. + +2018-04-28 Werner Koch <wk@gnupg.org> + + prime: Avoid rare assertion failure in gcry_prime_check. + + commit f3362f10f6f671246c38115ed12b0047966c200e + * cipher/primegen.c (is_prime): Don't fail on the assert X > 1. + +2018-04-17 Werner Koch <wk@gnupg.org> + + mpi: Fix for buidling for MIPS64 with Clang. + + commit e7ae0ae243c8978a67c802169183187d88557be8 + * mpi/longlong.h [MIPS64][__clang__]: Use the C version like we + already do for 32 bit MIPS. + +2018-04-11 NIIBE Yutaka <gniibe@fsij.org> + + hmac: Use xtrymalloc. + + commit 3e3b520fb32a37c5c23762531a7b3168e112ac36 + * src/hmac256.c (_gcry_hmac256_new): Use xtrymalloc. + (_gcry_hmac256_file): Likewise. + +2018-04-10 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + basic_all_hwfeature_combinations.sh: use $njobs to limit parallel tasks. + + commit 5e01705ca90830c27a4cbd8bad41243915f4538a + * tests/basic_all_hwfeature_combinations.sh: Use $njobs to limit + parallel tasks instead of fixed number "8". + + Faster look-up for spec by algo for digests, ciphers and MAC. + + commit 634a85412a4073aa1890589ce5e97eac7b0f3ca3 + * cipher/cipher.c (cipher_list_algo0, cipher_list_algo301): New cipher + spec lists with same order and spacing as 'gcry_cipher_algos' + enumeration. + (spec_from_algo): Use new spec lists for faster look-up. + * cipher/mac.c (mac_list_algo101, mac_list_algo201, mac_list_algo401) + (mac_list_algo501): New MAC spec lists with same order and spacing as + 'gcry_mac_algos' enumeration. + (spec_from_algo): Use new spec lists for faster look-up. + * cipher/md.c (digest_list_algo0, digest_list_algo301): New digest + spec lists with same order and spacing as 'gcry_md_algos' + enumeration. + (spec_from_algo): Use new spec lists for faster look-up. + + Fix building with BLAKE2 disabled. + + commit 35b59d0ea52e8a1c30c43554dc4dbca97da4bf87 + * cipher/md.c (md_setkey): Enclose Blake2 part with USE_BLAKE2. + + Add missing BLAKE2, SM3 and GOSTR3411_CP to MAC-HMAC interface. + + commit 52e52eb0e3e5541cfc86e04c5047500db5d538b7 + * cipher/mac-hmac.c (map_mac_algo_to_md): Add GOSTR3411_CP, BLAKE2 and + SM3. + (_gcry_mac_type_spec_hmac_gost3411_cp) + (_gcry_mac_type_spec_hmac_blake2b_512) + (_gcry_mac_type_spec_hmac_blake2b_384) + (_gcry_mac_type_spec_hmac_blake2b_256) + (_gcry_mac_type_spec_hmac_blake2b_160) + (_gcry_mac_type_spec_hmac_blake2s_256) + (_gcry_mac_type_spec_hmac_blake2s_224) + (_gcry_mac_type_spec_hmac_blake2s_160) + (_gcry_mac_type_spec_hmac_blake2s_128) + (_gcry_mac_type_spec_hmac_sm3): New. + * cipher/mac-internal.h (_gcry_mac_type_spec_hmac_gost3411_cp) + (_gcry_mac_type_spec_hmac_blake2b_512) + (_gcry_mac_type_spec_hmac_blake2b_384) + (_gcry_mac_type_spec_hmac_blake2b_256) + (_gcry_mac_type_spec_hmac_blake2b_160) + (_gcry_mac_type_spec_hmac_blake2s_256) + (_gcry_mac_type_spec_hmac_blake2s_224) + (_gcry_mac_type_spec_hmac_blake2s_160) + (_gcry_mac_type_spec_hmac_blake2s_128) + (_gcry_mac_type_spec_hmac_sm3): New. + * cipher/mac.c (mac_list): Add GOSTR3411_CP, BLAKE2 and SM3. + * src/gcrypt.h.in (GCRY_MAC_HMAC_GOSTR3411_CP) + (GCRY_MAC_HMAC_BLAKE2B_512, GCRY_MAC_HMAC_BLAKE2B_384) + (GCRY_MAC_HMAC_BLAKE2B_256, GCRY_MAC_HMAC_BLAKE2B_160) + (GCRY_MAC_HMAC_BLAKE2S_256, GCRY_MAC_HMAC_BLAKE2S_224) + (GCRY_MAC_HMAC_BLAKE2S_160, GCRY_MAC_HMAC_BLAKE2S_128) + (GCRY_MAC_HMAC_SM3): New. + +2018-04-10 NIIBE Yutaka <gniibe@fsij.org> + + random: Protect another use of jent_rng_collector. + + commit 0de2a22fcf6607d0aecb550feefa414cee3731b2 + * random/rndjent.c (_gcry_rndjent_get_version): Lock the access. + +2018-03-28 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + aarch64/assembly: only use the lower 32 bit of an int parameters. + + commit 9b58e4a03ba3aeff7bae3f40da706977870c9649 + * cipher/camellia-aarch64.S (_gcry_camellia_arm_encrypt_block) + (__gcry_camellia_arm_decrypt_block): Make comment section about input + registers match usage. + * cipher/rijndael-armv8-aarch64-ce.S (_gcry_aes_ocb_auth_armv8_ce): Use + 'w12' and 'w7' instead of 'x12' and 'x7'. + (_gcry_aes_xts_enc_armv8_ce, _gcry_aes_xts_dec_armv8_ce): Fix function + prototype in comments. + * mpi/aarch64/mpih-add1.S: Use 32-bit registers for 32-bit mpi_size_t + parameters. + * mpi/aarch64/mpih-mul1.S: Ditto. + * mpi/aarch64/mpih-mul2.S: Ditto. + * mpi/aarch64/mpih-mul3.S: Ditto. + * mpi/aarch64/mpih-sub1.S: Ditto. + + poly1305: silence compiler warning on clang/aarch64. + + commit 8cdb010f04528703a502344e00d52447de12547d + * cipher/poly1305.c (MUL_MOD_1305_64): cast zero constant to 64-bits. + +2018-03-28 Martin Storsjö <martin@martin.st> + + aarch64: Enable building the aarch64 cipher assembly for windows. + + commit 0de2191a07d69ef1fa34ca4c5d5fc4985ff7b4c4 + * cipher/asm-common-aarch64.h: New. + * cipher/camellia-aarch64.S: Use ELF macro, use x19 instead of x18. + * cipher/chacha20-aarch64.S: Use ELF macro, don't use GOT on windows. + * cipher/cipher-gcm-armv8-aarch64-ce.S: Use ELF macro. + * cipher/rijndael-aarch64.S: Use ELF macro. + * cipher/rijndael-armv8-aarch64-ce.S: Use ELF macro. + * cipher/sha1-armv8-aarch64-ce.S: Use ELF macro. + * cipher/sha256-armv8-aarch64-ce.S: Use ELF macro. + * cipher/twofish-aarch64.S: Use ELF macro. + * configure.ac: Don't require .size and .type in aarch64 assembly check. + + aarch64: camellia: Only use the lower 32 bit of an int parameter. + + commit 4e1b628f492643d4e9b830bcdab7b49daaec5854 + * cipher/camellia-aarch64.S: Use 'w3' instead of 'x3'. + + aarch64: Fix assembling chacha20-aarch64.S with clang/llvm. + + commit 36e916fc332eda74963192b1c0bf6860a3e5d67b + * cipher/chacha20-aarch64.S: Remove superfluous lane counts. + + aarch64: mpi: Fix building the mpi aarch64 assembly for windows. + + commit ec0a2f25c0f64a7b65b373508ce9081e10461965 + * mpi/aarch64/mpih-add1.S: Use ELF macro. + * mpi/aarch64/mpih-mul1.S: Use ELF macro. + * mpi/aarch64/mpih-mul2.S: Use ELF macro. + * mpi/aarch64/mpih-mul3.S: Use ELF macro. + * mpi/aarch64/mpih-sub1.S: Use ELF macro. + * mpi/asm-common-aarch64.h: New. + + random: Don't assume that _WIN64 implies x86_64. + + commit ed41d6d6fb4551342b22ef763de1bd60e964e186 + * random/rndw32.c: Change _WIN64 ifdef into __x86_64__. + +2018-03-22 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + tests/aeswrap: add in-place encryption/decryption testing. + + commit 885f031fbd17abc1c0fedbb98df22823b647fc11 + * tests/aeswrap.c (check): Rename to... + (check_one): ...this and add in-place testing. + (check): New. + +2018-03-22 Stephan Mueller <smueller@chronox.de> + + AES-KW: fix in-place encryption. + + commit 330ec66e0babdabb658dc7d6db78f37b2a1b996e + * cipher/cipher-aeswrap.c: move memmove call before KW IV setting + +2018-03-22 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + bench-slope: add CPU frequency auto-detection. + + commit 617f5e746f8295cc36d1002c8c53edc95d04d0f6 + * tests/bench-slope.c (bench_obj): Add 'hd'. + (bench_encrypt_init, bench_encrypt_free, bench_encrypt_do_bench) + (bench_decrypt_do_bench, bench_xts_encrypt_init) + (bench_xts_encrypt_do_bench, bench_xts_decrypt_do_bench) + (bench_ccm_encrypt_init, bench_ccm_encrypt_do_bench) + (bench_ccm_decrypt_do_bench, bench_aead_encrypt_init) + (bench_aead_encrypt_do_bench, bench_aead_decrypt_do_bench) + (bench_hash_init, bench_hash_free, bench_hash_do_bench) + (bench_mac_init, bench_mac_free, bench_mac_do_bench): Use 'obj->hd' + for storing pointer to crypto context. + (auto_ghz): New. + (do_slope_benchmark): Rename to... + (slope_benchmark): ...this. + (auto_ghz_init, auto_ghz_free, auto_ghz_bench, auto_ghz_detect_ops) + (get_auto_ghz, do_slope_benchmark): New. + (double_to_str): Round number larger than 1000 to integer. + (bench_print_result_csv, bench_print_result_std) + (bench_print_result, bench_print_header, cipher_bench_one) + (hash_bench_one, mac_bench_one, kdf_bench_one, kdf_bench): Add + auto-detected frequency printing. + (print_help): Help for CPU speed auto-detection mode. + (main): Add parsing for "--cpu-mhz auto". + + _gcry_burn_stack: use memset for clearing memory. + + commit 3841b23c0ccb24d555b7570083bba958e3126d26 + * src/misc.c (__gcry_burn_stack) [HAVE_VLA]: Use 'memset' for clearing + stack. + + Improve constant-time buffer compare. + + commit a1127dbbada4302abf09eec90fbaceca87bfcdf0 + * cipher/bufhelp.h (buf_eq_const): Rewrite logic. + +2018-02-16 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add Intel SHA Extensions accelerated SHA256 implementation. + + commit 0b3ec359e2279c3b46b171372b1b7733bba20cd7 + * cipher/Makefile.am: Add 'sha256-intel-shaext.c'. + * cipher/sha256-intel-shaext.c: New. + * cipher/sha256.c (USE_SHAEXT) + (_gcry_sha256_transform_intel_shaext): New. + (SHA256_CONTEXT): Add 'use_shaext'. + (sha256_init, sha224_init) [USE_SHAEXT]: Use shaext if supported. + (transform) [USE_SHAEXT]: Use shaext if enabled. + (transform): Only add ASM_EXTRA_STACK if returned burn length is not + zero. + * configure.ac: Add 'sha256-intel-shaext.lo'. + + Add Intel SHA Extensions accelerated SHA1 implementation. + + commit d02958bd300d2c80bc92b1e072103e95e256b297 + * cipher/Makefile.am: Add 'sha1-intel-shaext.c'. + * cipher/sha1-intel-shaext.c: New. + * cipher/sha1.c (USE_SHAEXT, _gcry_sha1_transform_intel_shaext): New. + (sha1_init) [USE_SHAEXT]: Use shaext implementation is supported. + (transform) [USE_SHAEXT]: Use shaext if enabled. + (transform): Only add ASM_EXTRA_STACK if returned burn length is not + zero. + * cipher/sha1.h (SHA1_CONTEXT): Add 'use_shaext'. + * configure.ac: Add 'sha1-intel-shaext.lo'. + (shaextsupport, gcry_cv_gcc_inline_asm_shaext): New. + * src/g10lib.h: Add HWF_INTEL_SHAEXT and reorder HWF flags. + * src/hwf-x86.c (detect_x86_gnuc): Detect SHA Extensions. + * src/hwfeatures.c (hwflist): Add 'intel-shaext'. + + AVX implementation of BLAKE2s. + + commit da58a62ac1b7a8d97b0895dcb41d15af531e45e5 + * cipher/Makefile.am: Add 'blake2s-amd64-avx.S'. + * cipher/blake2.c (USE_AVX, _gry_blake2s_transform_amd64_avx): New. + (BLAKE2S_CONTEXT) [USE_AVX]: Add 'use_avx'. + (blake2s_transform): Rename to ... + (blake2s_transform_generic): ... this. + (blake2s_transform): New. + (blake2s_final): Pass 'ctx' pointer to transform function instead of + 'S'. + (blake2s_init_ctx): Check HW features and enable AVX implementation + if supported. + * cipher/blake2s-amd64-avx.S: New. + * configure.ac: Add 'blake2s-amd64-avx.lo'. + +2018-02-04 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + AVX2 implementation of BLAKE2b. + + commit af7fc732f9a7af7a70276f1e8364d2132db314f1 + * cipher/Makefile.am: Add 'blake2b-amd64-avx2.S'. + * cipher/blake2.c (USE_AVX2, ASM_FUNC_ABI, ASM_EXTRA_STACK) + (_gry_blake2b_transform_amd64_avx2): New. + (BLAKE2B_CONTEXT) [USE_AVX2]: Add 'use_avx2'. + (blake2b_transform): Rename to ... + (blake2b_transform_generic): ... this. + (blake2b_transform): New. + (blake2b_final): Pass 'ctx' pointer to transform function instead of + 'S'. + (blake2b_init_ctx): Check HW features and enable AVX2 implementation + if supported. + * cipher/blake2b-amd64-avx2.S: New. + * configure.ac: Add 'blake2b-amd64-avx2.lo'. + +2018-01-31 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix incorrect counter overflow handling for GCM. + + commit ffdc6f3623a0bcb41324d562340b2cd1c288e387 + * cipher/cipher-gcm.c (gcm_ctr_encrypt): New function to handle + 32-bit CTR increment for GCM. + (_gcry_cipher_gcm_encrypt, _gcry_cipher_gcm_decrypt): Do not use + generic CTR implementation directly, use gcm_ctr_encrypt instead. + * tests/basic.c (_check_gcm_cipher): Add test-vectors for 32-bit + CTR overflow. + (check_gcm_cipher): Add 'split input to 15 bytes and 17 bytes' + test-runs. + +2018-01-22 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix use of AVX instructions in Chaha20 SSSE3 implementation. + + commit 0b55f349a8b8f4b0ac9ed724c2d5b8dcc9f5401c + * cipher/chacha20-amd64-ssse3.S: Replace two 'vmovdqa' instructions + with 'movdqa'. + +2018-01-20 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + doc: fix double "See" in front of reference. + + commit bd75f0e89817b5708c57efab49e3eb4e035186e2 + * doc/gcrypt.texi: Change @xref to @ref when text already has 'see' in + the front. + + Add EAX mode. + + commit e8629e535bd0e9711b07904d4501de8ad57aaecd + * cipher/Makefile.am: Add 'cipher-eax.c'. + * cipher/cipher-cmac.c (cmac_write): Rename to ... + (_gcry_cmac_write): ... this; Take CMAC context as new input + parameter; Return error code. + (cmac_generate_subkeys): Rename to ... + (_gcry_cmac_generate_subkeys): ... this; Take CMAC context as new + input parameter; Return error code. + (cmac_final): Rename to ... + (_gcry_cmac_final): ... this; Take CMAC context as new input + parameter; Return error code. + (cmac_tag): Take CMAC context as new input parameter. + (_gcry_cmac_reset): New. + (_gcry_cipher_cmac_authenticate): Remove duplicate tag flag check; + Adapt to changes above. + (_gcry_cipher_cmac_get_tag): Adapt to changes above. + (_gcry_cipher_cmac_check_tag): Ditto. + (_gcry_cipher_cmac_set_subkeys): Ditto. + * cipher-eax.c: New. + * cipher-internal.h (gcry_cmac_context_t): New. + (gcry_cipher_handle): Update u_mode.cmac; Add u_mode.eax. + (_gcry_cmac_write, _gcry_cmac_generate_subkeys, _gcry_cmac_final) + (_gcry_cmac_reset, _gcry_cipher_eax_encrypt, _gcry_cipher_eax_decrypt) + (_gcry_cipher_eax_set_nonce, _gcry_cipher_eax_authenticate) + (_gcry_cipher_eax_get_tag, _gcry_cipher_eax_check_tag) + (_gcry_cipher_eax_setkey): New prototypes. + * cipher/cipher.c (_gcry_cipher_open_internal, cipher_setkey) + (cipher_reset, cipher_encrypt, cipher_decrypt, _gcry_cipher_setiv) + (_gcry_cipher_authenticate, _gcry_cipher_gettag, _gcry_cipher_checktag) + (_gcry_cipher_info): Add EAX mode. + * doc/gcrypt.texi: Add EAX mode. + * src/gcrypt.h.in (GCRY_CIPHER_MODE_EAX): New. + * tests/basic.c (_check_gcm_cipher, _check_poly1305_cipher): Constify + test vectors array. + (_check_eax_cipher, check_eax_cipher): New. + (check_ciphers, check_cipher_modes): Add EAX mode. + * tests/bench-slope.c (bench_eax_encrypt_do_bench) + (bench_eax_decrypt_do_bench, bench_eax_authenticate_do_bench) + (eax_encrypt_ops, eax_decrypt_ops, eax_authenticate_ops): New. + (cipher_modes): Add EAX mode. + * tests/benchmark.c (cipher_bench): Add EAX mode. + + cipher: constify spec arrays. + + commit cd7ed2e3546b12dd98df4211949f1cdbf5827013 + * cipher/cipher.c (cipher_list): Constify array. + * cipher/mac.c (mac_list): Constify array. + * cipher/md.c (digest_list): Constify array. + * cipher/pubkey.c (pubkey_list): Constify array. + + Add ARMv8/CE acceleration for AES-XTS. + + commit 93503c127a52c1f6a193750e2bf181a744ba3e6b + * cipher/rijndael-armv8-aarch32-ce.S (_gcry_aes_xts_enc_armv8_ce) + (_gcry_aes_xts_dec_armv8_ce): New. + * cipher/rijndael-armv8-aarch64-ce.S (_gcry_aes_xts_enc_armv8_ce) + (_gcry_aes_xts_dec_armv8_ce): New. + * cipher/rijndael-armv8-ce.c (_gcry_aes_xts_enc_armv8_ce) + (_gcry_aes_xts_dec_armv8_ce, xts_crypt_fn_t) + (_gcry_aes_armv8_ce_xts_crypt): New. + * cipher/rijndael.c (_gcry_aes_armv8_ce_xts_crypt): New. + (_gcry_aes_xts_crypt) [USE_ARM_CE]: New. + +2018-01-09 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael-ssse3: call assembly functions directly. + + commit c3d60acc3ab5c6d60c2258882175bf31351cc998 + * cipher/rijndael-ssse3-amd64-asm.S (_gcry_aes_ssse3_enc_preload) + (_gcry_aes_ssse3_dec_preload, _gcry_aes_ssse3_encrypt_core) + (_gcry_aes_ssse3_decrypt_core, _gcry_aes_schedule_core): Add + ENTER_SYSV_FUNC_PARAMS_* at function entry and EXIT_SYSV_FUNC at exit. + (_gcry_aes_ssse3_encrypt_core, _gcry_aes_ssse3_decrypt_core): Change + to input parameters to RDI and RSI registers. + * cipher/rijndael-ssse3-amd64.c (_gcry_aes_ssse3_encrypt_core) + (_gcry_aes_ssse3_decrypt_core, _gcry_aes_schedule_core): Add parameters + for function prototypes. + (PUSH_STACK_PTR, POP_STACK_PTR): Remove. + (vpaes_ssse3_prepare_enc, vpaes_ssse3_prepare_dec) + (_gcry_aes_ssse3_do_setkey, _gcry_aes_ssse3_prepare_decryption) + (do_vpaes_ssse3_enc, do_vpaes_ssse3_dec): Remove inline assembly to + call functions, and call directly instead. + + Move AMD64 MS to SysV calling convention conversion to assembly side. + + commit a518b6680ea80a4325731028545a701c1d71fc02 + * cipher/Makefile.am: Add 'asm-common-amd64.h'. + * cipher/asm-common-amd64.h: New. + * cipher/blowfish-amd64.S: Add ENTER_SYSV_FUNC_* and EXIT_SYSV_FUNC for + each global function from 'asm-common-amd64.h'. + * cipher/cast5-amd64.S: Ditto. + * cipher/des-amd64.S: Ditto. + * cipher/rijndael-amd64.S: Ditto. + * cipher/twofish-amd64.S: Ditto. + * cipher/arcfour-amd64.S: Ditto. + * cipher/blowfish.c [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS] + (call_sysv_fn): Remove. + * cipher/cast5.c [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS] + (call_sysv_fn): Remove. + * cipher/twofish.c [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS] + (call_sysv_fn, call_sysv_fn5, call_sysv_fn6): Remove. + * cipher/rijndael.c (do_encrypt, do_decrypt) + [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS]: Remove assembly block for + calling SysV ABI function. + * cipher/arcfour.c [USE_AMD64_ASM] (encrypt_stream): Ditto. + + Make BMI2 inline assembly check more robust. + + commit 135250e3060e79be698d4f36a819aa8a880789f8 + * configure.ac (gcry_cv_gcc_inline_asm_bmi2): New assembly test. + + Add AES-NI acceleration for AES-XTS. + + commit a00c5b2988cea256c7823a76ce601febf02c790f + * cipher/cipher-internal.h (gcry_cipher_handle): Change bulk + XTS function to take cipher context. + * cipher/cipher-xts.c (_gcry_cipher_xts_crypt): Ditto. + * cipher/cipher.c (_gcry_cipher_open_internal): Setup AES-NI + XTS bulk function. + * cipher/rijndael-aesni.c (xts_gfmul_const, _gcry_aes_aesni_xts_enc) + (_gcry_aes_aesni_xts_enc, _gcry_aes_aesni_xts_crypt): New. + * cipher/rijndael.c (_gcry_aes_aesni_xts_crypt) + (_gcry_aes_xts_crypt): New. + * src/cipher.h (_gcry_aes_xts_crypt): New. + + AES-NI improvements for AMD64. + + commit c9e9cb2eb6a1c659d3825ca627228b732f2f2152 + * cipher/rijndael-aesni.c [__x86_64__] (aesni_prepare_7_15_variable) + (aesni_prepare_7_15, aesni_cleanup_7_15, do_aesni_enc_vec8) + (do_aesni_dec_vec8, do_aesni_ctr_8): New. + (_gcry_aes_aesni_ctr_enc, _gcry_aes_aesni_cfb_dec) + (_gcry_aes_aesni_cbc_dec, aesni_ocb_enc, aesni_ocb_dec) + (_gcry_aes_aesni_ocb_auth) [__x86_64__]: Add 8 parallel blocks + processing. + + Add ARMv8/AArch64 implementation of chacha20. + + commit b3ec0f752c925cde36f560f0f9309ab6450bbfd9 + * cipher/Makefile.am: Add 'chacha20-aarch64.S'. + * cipher/chacha20-aarch64.S: New. + * cipher/chacha20.c (USE_AARCH64_SIMD): New. + (_gcry_chacha20_aarch_blocks4): New. + (chacha20_do_setkey): Add HWF selection for Aarch64 implementation. + * configure.ac: Add 'chacha20-aarch64.lo'. + + New ChaCha implementations. + + commit 172ad09cbedc893f147180875335f4c525393c0b + * cipher/Makefile.am: Remove 'chacha20-sse2-amd64.S', + 'chacha20-ssse3-amd64.S', 'chacha20-avx2-amd64.S'; Add + 'chacha20-amd64-ssse3.S', 'chacha20-amd64-avx2.S'. + * cipher/chacha20-amd64-avx2.S: New. + * cipher/chacha20-amd64-ssse3.S: New. + * cipher/chacha20-armv7-neon.S: Rewrite. + * cipher/chacha20-avx2-amd64.S: Remove. + * cipher/chacha20-sse2-amd64.S: Remove. + * cipher/chacha20-ssse3-amd64.S: Remove. + * cipher/chacha20.c (CHACHA20_INPUT_LENGTH, USE_SSE2, USE_NEON) + (ASM_EXTRA_STACK, chacha20_blocks_t, _gcry_chacha20_amd64_sse2_blocks) + (_gcry_chacha20_amd64_ssse3_blocks, _gcry_chacha20_amd64_avx2_blocks) + (_gcry_chacha20_armv7_neon_blocks, QROUND, QOUT, chacha20_core) + (chacha20_do_encrypt_stream): Remove. + (_gcry_chacha20_amd64_ssse3_blocks4, _gcry_chacha20_amd64_avx2_blocks8) + (_gcry_chacha20_armv7_neon_blocks4, ROTATE, XOR, PLUS, PLUSONE) + (QUARTERROUND, BUF_XOR_LE32): New. + (CHACHA20_context_s, chacha20_blocks, chacha20_keysetup) + (chacha20_encrypt_stream): Rewrite. + (chacha20_do_setkey): Adjust for new CHACHA20_context_s. + * configure.ac: Remove 'chacha20-sse2-amd64.lo', + 'chacha20-ssse3-amd64.lo', 'chacha20-avx2-amd64.lo'; Add + 'chacha20-amd64-ssse3.lo', 'chacha20-amd64-avx2.lo'. + + New Poly1305 implementations. + + commit b9a471ccf5f02f89e25c7ccc29898d0e4e486099 + * cipher/Makefile.am: Include '../mpi' for 'longlong.h'; Remove + 'poly1305-sse2-amd64.S', 'poly1305-avx2-amd64.S' and + 'poly1305-armv7-neon.S'. + * cipher/poly1305-armv7-neon.S: Remove. + * cipher/poly1305-avx2-amd64.S: Remove. + * cipher/poly1305-sse2-amd64.S: Remove. + * cipher/poly1305-internal.h (POLY1305_BLOCKSIZE) + (POLY1305_STATE): New. + (POLY1305_SYSV_FUNC_ABI, POLY1305_REF_BLOCKSIZE) + (POLY1305_REF_STATESIZE, POLY1305_REF_ALIGNMENT) + (POLY1305_USE_SSE2, POLY1305_SSE2_BLOCKSIZE, POLY1305_SSE2_STATESIZE) + (POLY1305_SSE2_ALIGNMENT, POLY1305_USE_AVX2, POLY1305_AVX2_BLOCKSIZE) + (POLY1305_AVX2_STATESIZE, POLY1305_AVX2_ALIGNMENT) + (POLY1305_USE_NEON, POLY1305_NEON_BLOCKSIZE, POLY1305_NEON_STATESIZE) + (POLY1305_NEON_ALIGNMENT, POLY1305_LARGEST_BLOCKSIZE) + (POLY1305_LARGEST_STATESIZE, POLY1305_LARGEST_ALIGNMENT) + (POLY1305_STATE_BLOCKSIZE, POLY1305_STATE_STATESIZE) + (POLY1305_STATE_ALIGNMENT, OPS_FUNC_ABI, poly1305_key_s) + (poly1305_ops_s): Remove. + (poly1305_context_s): Rewrite. + * cipher/poly1305.c (_gcry_poly1305_amd64_sse2_init_ext) + (_gcry_poly1305_amd64_sse2_finish_ext) + (_gcry_poly1305_amd64_sse2_blocks, poly1305_amd64_sse2_ops) + (poly1305_init_ext_ref32, poly1305_blocks_ref32) + (poly1305_finish_ext_ref32, poly1305_default_ops) + (_gcry_poly1305_amd64_avx2_init_ext) + (_gcry_poly1305_amd64_avx2_finish_ext) + (_gcry_poly1305_amd64_avx2_blocks) + (poly1305_amd64_avx2_ops, poly1305_get_state): Remove. + (poly1305_init): Rewrite. + (USE_MPI_64BIT, USE_MPI_32BIT): New. + [USE_MPI_64BIT] (ADD_1305_64, MUL_MOD_1305_64, poly1305_blocks) + (poly1305_final): New implementation using 64-bit limbs. + [USE_MPI_32BIT] (UMUL_ADD_32, ADD_1305_32, MUL_MOD_1305_32) + (poly1305_blocks): New implementation using 32-bit limbs. + (_gcry_poly1305_update, _gcry_poly1305_finish) + (_gcry_poly1305_init): Adapt to new implementation. + * configure.ac: Remove 'poly1305-sse2-amd64.lo', + 'poly1305-avx2-amd64.lo' and 'poly1305-armv7-neon.lo'. + + mpi/ec: fix when 'unsigned long' is 32-bit but limb size is 64-bit. + + commit d39deb0a41dbeec81174704904d3d29c66d10d7e + * mpi/ec.c (ec_addm_25519, ec_subm_25519, ec_mulm_25519): Cast '1' to + mpi_limb_t before left shift. + +2017-11-24 Werner Koch <wk@gnupg.org> + + sexp: Avoid a fatal error in case of ENOMEM in called functions. + + commit 2ad912d5b7794fb32192fddab1b559c7b86303a2 + * src/sexp.c (do_vsexp_sscan): Replace BUG() by a proper error + return. Replace sprintf by snprintf. + (convert_to_hex): Replace sprintf by snprintf. + (convert_to_string): Ditto. + (_gcry_sexp_sprint): Ditto. + + api: Add GCRYCTL_AUTO_EXPAND_SECMEM. + + commit 1f6b2f6099ebcfd785e2d2ae0aeca810394dbbac + * src/gcrypt.h.in (GCRYCTL_AUTO_EXPAND_SECMEM): New enum. + * src/global.c (_gcry_vcontrol): Implement that. + * src/secmem.c (auto_expand): New var. + (_gcry_secmem_set_auto_expand): New. + (_gcry_secmem_malloc_internal): Act upon AUTO_EXPAND. + +2017-11-14 NIIBE Yutaka <gniibe@fsij.org> + + tests: Add HAVE_MMAP check for MinGW. + + commit c594f187bd457b757112adc551ffa4db92962dc1 + * tests/t-secmem.c (main): Conditionalize with HAVE_MMAP. + +2017-11-09 NIIBE Yutaka <gniibe@fsij.org> + + Fix secmem test for machine with larger page. + + commit 621f5c4e837347308a6b06a8cfbfc47ca9fae69e + * tests/t-secmem.c (main): Detect page size and setup chunk size. + * src/secmem.c (init_pool): Simplify the expression. + +2017-10-25 NIIBE Yutaka <gniibe@fsij.org> + + Add OID information for SM3. + + commit 94b84360ca55c407222a3eb8222d8b1816fc617f + * cipher/sm3.c (asn_sm3, oid_spec_sm3): New. + (_gcry_digest_spec_sm3): Add asn_sm3, oid_spec_sm3. + +2017-10-24 Jia Zhang <qianyue.zj@alibaba-inc.com> + + Add crypto hash SM3. + + commit 4423bf3cc4432b9bfe801ff74cb05e6f0dd3eccd + * configure.ac (available_digests): Add sm3. + * src/cipher.h: Add declarations for SM3. + * cipher/Makefile.am (EXTRA_libcipher_la_SOURCES): Add sm3.c. + * cipher/md.c [USE_SM3] (digest_list): Add _gcry_digest_spec_sm3. + * cipher/pubkey-util.c (hashnames): Add "sm3". + * cipher/sm3.c: New. + * tests/basic.c (check_digests): Add test vectors for SM3. + * tests/hashtest-256g.in (algos): Add SM3. + * tests/hashtest.c (testvectors): Add for SM3. + +2017-10-24 NIIBE Yutaka <gniibe@fsij.org> + + Add new constant GCRY_MD_SM3 for crypto hash SM3. + + commit 5b31e22d9fc542bdccb1586ef2c83d9794a731d3 + * src/gcrypt.h.in (GCRY_MD_SM3): New. + +2017-10-17 Werner Koch <wk@gnupg.org> + + api: New function gcry_mpi_get_ui. + + commit c6e42e7ec3d1046969d783c443c13aad7cb61bb8 + * src/gcrypt.h.in (gcry_mpi_get_ui): New. + (mpi_get_ui): New macro. + * src/libgcrypt.def, src/libgcrypt.vers: Add new function. + * src/visibility.c (gcry_mpi_get_ui): New. + * src/visibility.h: Mark that function. + (gcry_mpi_get_ui): New. + * mpi/mpiutil.c (MY_UINT_MAX): New macro. + (_gcry_mpi_get_ui): Re-implemented. This function existed but was + never imported or used. + * tests/mpitests.c (test_maxsize): Add some test for this function. + +2017-08-29 NIIBE Yutaka <gniibe@fsij.org> + + Tweak GCC version check. + + commit e4dc458b0b7dc9b8417a2177ef17822d9b9064ec + * src/global.c (_gcry_vcontrol): It's GCC 4.2 which started to support + diagnostic pragma. + + random: Fix warnings on Windows. + + commit 8126a6717c80d4fc1766d7f975e872bee2f9f203 + * random/random-csprng.c (lock_seed_file): Vars with no use. + + tests: Fix warnings on Windows. + + commit a848ef44470a524c05624afb54b92cf25595acd2 + * tests/fipsdrv.c (print_dsa_domain_parameters, print_ecdsa_dq): Fix. + + ecc: Fix scratch MPI. + + commit db3a8d6890fb4a6436e082b49378c0bd891563ca + * mpi/ec.c (ec_p_init): Check if scratch MPI is allocated. + + ecc: Fix ec_mulm_25519. + + commit 1d5f726668b9cc32d6bb601f2329987058146c6c + * mpi/ec.c (ec_mulm_25519): Improve reduction to 25519. + + ecc: Use 25519 method also for ed25519. + + commit fab712d654b2ccd24696ed90bc239860a128ad5b + * cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Don't use mpi_add + since it resizes to have more limbs. + * mpi/ec.c (point_resize): Fix for Edwards curve. + (ec_p_init): Support Edwards curve. + (_gcry_mpi_ec_get_affine): Use the methods. + (dup_point_edwards, add_points_edwards, sub_points_edwards): Ditto. + (_gcry_mpi_ec_mul_point): Resize MPIs of point to fixed size. + (_gcry_mpi_ec_curve_point): Use the methods. + + ecc: Clean up curve specific method support. + + commit 1ac3d3637dd80013b78e03b9b9f582091710d908 + * src/ec-context.h (struct mpi_ec_ctx_s): Remove MOD method. + * mpi/ec.c (ec_mod_25519): Remove. + (ec_p_init): Follow the removal of the MOD method. + + ecc: Relax condition for 25519 computations. + + commit e9be23c4ad9f42c9d3198c706f912b7e27f574bc + * mpi/ec.c (ec_addm_25519, ec_subm_25519, ec_mulm_25519): Check number + of limbs, allocated more is OK. + + ecc: Fix ec_mulm_25519. + + commit 449459a2770d3aecb1f36502bf1903e0cbd2873e + * mpi/ec.c (ec_mulm_25519): Fix the cases of 0 to 18. + + ecc: field specific routines for 25519. + + commit 9ed0fb37bd637d1a2e9498c24097cfeadec682ec + * mpi/ec.c (point_resize): Improve for X25519. + (mpih_set_cond): New. + (ec_mod_25519, ec_addm_25519, ec_subm_25519, ec_mulm_25519) + (ec_mul2_25519, ec_pow2_25519): New. + (ec_p_init): Fill by FIELD_TABLE. + + ecc: Add field specific computation methods. + + commit d4cd381defe5b37dda19bbda0986bdd38065bd31 + * src/ec-context.h (struct mpi_ec_ctx_s): Add methods. + * mpi/ec.c (ec_p_init): Initialize the default methods. + (montgomery_ladder): Use the methods. + +2017-08-27 Werner Koch <wk@gnupg.org> + + Release 1.8.1. + + commit 80fd8615048c3897b91a315cca22ab139b056ccd + * configure.ac: Set LT version to C22/A2/R1. + +2017-08-27 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Add input validation for X25519. + + commit bf76acbf0da6b0f245e491bec12c0f0a1b5be7c9 + * cipher/ecc.c (ecc_decrypt_raw): Add input validation. + * mpi/ec.c (ec_p_init): Use scratch buffer for bad points. + (_gcry_mpi_ec_bad_point): New. + +2017-08-07 Marcus Brinkmann <marcus.brinkmann@ruhr-uni-bochum.de> + + cipher: Add OID for SHA384WithECDSA. + + commit a7bd2cbd3eabda88fb3cac5cbc13c21c97a7b315 + * cipher/sha512.c (oid_spec_sha384): Add SHA384WithECDSA. + +2017-08-02 Werner Koch <wk@gnupg.org> + + tests: Fix a printf glitch for a Windows test. + + commit df1e221b3012e96bbffbc7d5fd70836a9ae1cc19 + * tests/t-convert.c (check_formats): Fix print format glitch on + Windows. + * tests/t-ed25519.c: Typo fix. + + tests: Add benchmarking option to tests/random. + + commit 21d0f068a721c022f955084c28304934fd198c5e + * tests/random.c: Always include unistd.h. + (prepend_srcdir): New. + (run_benchmark): New. + (main): Add options --benchmark and --with-seed-file. Print whetehr + JENT has been used. + * tests/t-common.h (split_fields_colon): New. Taken from GnuPG. + License of that code changed to LGPLv2.1. + + random: Add more bytes to the pool in addition to the seed file. + + commit eea36574f37830a6a80b4fad884825e815b2912f + * random/random-csprng.c (read_seed_file): Read 128 or 32 butes + depending on whether we have the Jitter RNG. + +2017-08-01 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add script to run basic tests with all supported HWF combinations. + + commit 94a92a3db909aef0ebcc009c2d7f5a2663e99004 + * tests/basic_all_hwfeature_combinations.sh: New. + * tests/Makefile.am: Add basic_all_hwfeature_combinations.sh. + +2017-07-29 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix return value type for _gcry_md_extract. + + commit cf1528e7f2761774d06ace0de48f39c96b52dc4f + * src/gcrypt-int.h (_gcry_md_extract): Use gpg_err_code_t instead of + gpg_error_t for internal function return type. + + Fix building AArch32 CE implementations when target is ARMv6 arch. + + commit 4a7aa30ae9f3ce798dd886c2f2d4164c43027748 + * cipher/cipher-gcm-armv8-aarch32-ce.S: Select ARMv8 architecure. + * cipher/rijndael-armv8-aarch32-ce.S: Ditto. + * cipher/sha1-armv8-aarch32-ce.S: Ditto. + * cipher/sha256-armv8-aarch32-ce.S: Ditto. + * configure.ac (gcry_cv_gcc_inline_asm_aarch32_crypto): Ditto. + +2017-07-25 NIIBE Yutaka <gniibe@fsij.org> + + sexp: Add fall through annotation. + + commit b7cd44335d9cde43be6f693dca6399ed0762649c + * src/dumpsexp.c (parse_and_print): It's fall through. + +2017-07-24 Werner Koch <wk@gnupg.org> + + random: Fix the command line munging for jitterbase. + + commit ac39522ab08fcd2483edc223334c6ab9d19e91f3 + * random/Makefile.am (o_flag_munging): Make the first sed term also + global. + +2017-07-19 NIIBE Yutaka <gniibe@fsij.org> + + Remove byte order mark. + + commit 1d8e4c2c3a7d0a4154caf5bd720a9a0b04179390 + * random/jitterentropy-base.c, random/jitterentropy.h: Remove + byte order mark. + +2017-07-18 Werner Koch <wk@gnupg.org> + + Release 1.8.0. + + commit 850aca744eeda5fd410f478a0778e353045ac962 + + + mac: Add selftests for HMAC-SHA3-xxx. + + commit 95194c550443e8d5558856633f920daec8a975c4 + * cipher/hmac-tests.c (check_one): Add arg trunc and change all + callers to pass false. + (selftests_sha3): New. + (run_selftests): Call new selftests. + + api: New function gcry_mpi_point_copy. + + commit ecf73dafb7aafed0d0f339d07235b58c2113f94c + * src/gcrypt.h.in (gcry_mpi_point_copy): New. + (mpi_point_copy): New macro. + * src/visibility.c (gcry_mpi_point_copy): New. + * src/libgcrypt.def, src/libgcrypt.vers: Add function. + * mpi/ec.c (_gcry_mpi_point_copy): New. + * tests/t-mpi-point.c (set_get_point): Add test. + +2017-07-17 Werner Koch <wk@gnupg.org> + + random: Minor fix for getting the rndjent version. + + commit 9d99c6b973caa7fdf93b53cf764066214f763803 + * random/rndjent.c (_gcry_rndjent_get_version): Always set R_ACTIVE. + * tests/version.c (test_get_config): Check number of fields for + rng-type. + +2017-07-07 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Minor fix of mpi_pow. + + commit 61b0f52c1cc85bf8c3cac9aba40e28682e4e1b8b + * mpi/mpi-pow.c (_gcry_mpi_powm): Allocate size fix. + + mpi: Fix mpi_pow alternative implementation. + + commit 66ed4d53789892def7b237756d8a0ab28df9d222 + * mpi/mpi-pow.c + [USE_ALGORITHM_SIMPLE_EXPONENTIATION] (_gcry_mpi_powm): Use + mpi_set_cond. + + Fix mpi_pow alternative implementation. + + commit 619ebae9847831f43314a95cc3180f4b329b4d3b + * mpi/mpi-pow.c [USE_ALGORITHM_SIMPLE_EXPONENTIATION] (_gcry_mpi_powm): + Allocate size fix. + +2017-07-06 Werner Koch <wk@gnupg.org> + + rsa: Use modern MPI allocation function. + + commit 208aba6f9a0475ba049f5a66fe02cf9a6214a887 + * cipher/rsa.c (secret_core_crt): Use modern function _gcry_mpi_snew. + +2017-07-05 Werner Koch <wk@gnupg.org> + + build: Minor API fixes to fix build problems on AIX. + + commit 85a9a913da9ecc6b2cd6f743e90e49983251d706 + * src/gcrypt.h.in (gcry_error_from_errno): Fix return type. + * src/visibility.c (gcry_md_extract): Change return type to match the + prototype. + + tools: Add left shift to mpicalc. + + commit 0d30a4a9791d20c8881b5b12bd44611d9f4274cd + * src/mpicalc.c (do_lshift): New. + (main): Handle '<'. + +2017-07-04 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Fix mpi_set_secure. + + commit 5feaf1cc8f22c1f8d19a34850d86fe190f1432e2 + * mpi/mpiutil.c (mpi_set_secure): Allocate by ->alloced. + +2017-06-29 NIIBE Yutaka <gniibe@fsij.org> + Werner Koch <wk@gnupg.org> + + rsa: Add exponent blinding. + + commit 8725c99ffa41778f382ca97233183bcd687bb0ce + * cipher/rsa.c (secret_core_crt): Blind secret D with randomized + nonce R for mpi_powm computation. + +2017-06-28 NIIBE Yutaka <gniibe@fsij.org> + + Same computation for square and multiply. + + commit 78130828e9a140a9de4dafadbc844dbb64cb709a + * mpi/mpi-pow.c (_gcry_mpi_powm): Compare msize for max_u_size. Move + the assignment to base_u into the loop. Copy content refered by RP to + BASE_U except the last of the loop. + +2017-06-24 Werner Koch <wk@gnupg.org> + + rsa: Minor refactoring. + + commit e6a3dc9900433bbc8ad362a595a3837318c28fa9 + * cipher/rsa.c (secret): Factor code out to ... + (secret_core_std, secret_core_crt): new functions. + +2017-06-23 Werner Koch <wk@gnupg.org> + + random: Add missing dependency. + + commit d091610377b2c92cf385282b1adfc30fa6cd5c75 + * random/Makefile.am (EXTRA_librandom_la_SOURCES): Fix file name. + (rndjent.o, rndjent.lo): Depend on jitterentropy-base-user.h. + + random: Update jitterentropy to 2.1.0. + + commit 8dfae89ecd3e9ae0967586cb38d12ef9111fc7cd + * random/rndjent.c (jent_get_nstime, jent_zfree) + (jent_fips_enabled, jent_zalloc): Move functions and macros to ... + * random/jitterentropy-base-user.h: this file. That files was not + used before. + * random/Makefile.am (EXTRA_librandom_la_SOURCES): Add + jitterentropy-base-user. + * random/jitterentropy-base.c: Update to version 2.1.0. + * random/jitterentropy.h: Ditto. + +2017-06-21 Werner Koch <wk@gnupg.org> + + api: New function gcry_get_config. + + commit 27148e60ba15b0cb73b47a75c688fcb48a1a3444 + * src/misc.c (_gcry_log_info_with_dummy_fp): Remove. + * src/global.c (print_config): New arg WHAT. Remove arg FNC and use + gpgrt_fprintf directly. + (_gcry_get_config): New. + (_gcry_vcontrol) <GCRYCTL_PRINT_CONFIG>: Use _gcry_get_config instead + of print_config. + * src/gcrypt.h.in (gcry_get_config): New. + * src/libgcrypt.def, src/libgcrypt.vers: Add new function. + * src/visibility.c (gcry_get_config): New. + * src/visibility.h: Mark new function. + + * tests/version.c (test_get_config): New. + (main): Call new test. + + random: Allow building rndjent on non-x86. + + commit c2319464b03e61aaf34ef6d5f4b59b0c0483a373 + * random/jitterentropy-base.c (jent_version): Uncomment function. + * random/rndjent.c: Include time.h + (JENT_USES_RDTSC): New. + (JENT_USES_GETTIME): New. + (JENT_USES_READ_REAL_TIME): New. + (jent_get_nstime): Support clock_gettime and AIX specific + function. Taken from Stephan Müller's code. + (is_rng_available): New. + (_gcry_rndjent_dump_stats): Use that function. + (_gcry_rndjent_poll): Use that fucntion. Allow an ADD of NULL for an + intialize only mode. + (_gcry_rndjent_get_version): New. + +2017-06-18 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael-padlock: change asm operands from read-only to read/write. + + commit 32b4ab209067f6f08b87b27bc78ec27dc497b708 + * cipher/rijndael-padlock.c (do_padlock): Change ESI/EDI/ECX to use + read/write operands as XCRYPT instruction modifies these registers. + +2017-06-16 Werner Koch <wk@gnupg.org> + + random: Make rndjent.c NTG.1 compliant. + + commit 82bc052eda5b3897724c7ad11e54f8203e8e88e9 + * random/rndjent.c (_gcry_rndjent_poll): Hash the retrieved jitter. + + md: Optimize gcry_md_hash_buffers for SHA-256 and SHA-512. + + commit e6f90a392a1fd59b19b16f7a2bc7c439ae369d5f + * cipher/sha256.c (_gcry_sha256_hash_buffer): New. + (_gcry_sha256_hash_buffers): New. + * cipher/sha512.c (_gcry_sha512_hash_buffer): New. + (_gcry_sha512_hash_buffers): New. + * cipher/md.c (_gcry_md_hash_buffer): Optimize for SHA246 and SHA512. + (_gcry_md_hash_buffers): Ditto. + + random: Allow building rndjent.c with stats collecting enabled. + + commit ee3a74f5539cbc5182ce089994e37c16ce612149 + * random/rndjent.c: Change license to the one used by jitterentropy.h. + (jent_init_statistic): New. + (jent_bit_count): New. + (jent_statistic_copy_stat): new. + (jent_calc_statistic): New. + + New global config option "only-urandom". + + commit 8f6082e95f30c1ba68d2de23da90146f87f0c66c + * random/rand-internal.h (RANDOM_CONF_ONLY_URANDOM): New. + * random/random.c (_gcry_random_read_conf): Add option "only-urandom". + * random/rndlinux.c (_gcry_rndlinux_gather_random): Implement that + option. + * tests/keygen.c (main): Add option --no-quick for better manual + tests. + + Implement global config file /etc/gcrypt/random.conf. + + commit b05a4abc358b204dba343d9cfbd59fdc828c1686 + * src/hwfeatures.c (my_isascii): Move macro to ... + * src/g10lib.h: here. + * tests/random.c (main): Dump random stats. + * random/random.c (RANDOM_CONF_FILE): New. + (_gcry_random_read_conf): New. + (_gcry_random_dump_stats): Call rndjent stats. + * random/rndjent.c (jent_rng_totalcalls, jent_rng_totalbytes): New. + (_gcry_rndjent_poll): Take care of config option disable-jent. Wipe + buffer. Bump counters. + (_gcry_rndjent_dump_stats): New. + +2017-06-14 Werner Koch <wk@gnupg.org> + + random: Add jitter RND based entropy collector. + + commit f5e7763ddca59dcd9ac9f2f4d50cb41b14a34a9e + * random/rndjent.c: New. + * random/rndlinux.c (_gcry_rndlinux_gather_random): Use rndjent. + * random/rndw32.c (_gcry_rndw32_gather_random): Use rndjent. + (slow_gatherer): Fix compiler warning. + * random/Makefile.am (librandom_la_SOURCES): Add rndjent.c + (EXTRA_librandom_la_SOURCES): Add jitterentropy-base.c and + jitterentropy.h. + (rndjent.o, rndjent.lo): New rules. + * configure.ac: New option --disbale-jent-support + (ENABLE_JENT_SUPPORT): New ac-define. + + cipher: New helper function rol64. + + commit 6c882fb1fdb6c7cba2215fa7391110d63e24b9dc + * cipher/bithelp.h (rol64): New inline functions. + + New hardware feature flag HWF_INTEL_RDTSC. + + commit 06f303a633ea2b992259688bef2b023c3f388f73 + * src/g10lib.h (HWF_INTEL_RDTSC): New. + * src/hwfeatures.c (hwflist): Add "intel-rdtsc". + * src/hwf-x86.c (detect_x86_gnuc): Get EDX features and test for TSC. + + random: Changes to original Jitter RNG implementation. + + commit a44c45675f8b631e11048a540bb1fbb7a022ebb4 + * random/jitterentropy-base.c: Change double underscore symbols and + make all functions static. + * random/jitterentropy.h: Likewise. + +2017-06-13 Stephan Mueller <smueller@chronox.de> + + random: Add original Jitter RNG implementation. + + commit f0ae18ecf48fbe2da0b9fb3f354d0dd3173d91d3 + * random/jitterentropy-base-user.h: New. + * random/jitterentropy-base.c: New. + * random/jitterentropy.h: New. + +2017-06-08 Werner Koch <wk@gnupg.org> + + build: Fix ChangeLog building for builds from other worktrees. + + commit cdfd7ea72a44657f037dd0dbba6e5ea0c2b344aa + * Makefile.am (gen-ChangeLog): Test for existance of ".git" regardless + on whether it is a file or directory. + +2017-06-02 NIIBE Yutaka <gniibe@fsij.org> + + secmem: Fix SEGV and stat calculation. + + commit e0958debe1a7db1bec1283115cdc6a14bf3b43e5 + * src/secmem (init_pool): Care about the header size. + (_gcry_secmem_malloc_internal): Likewise. + (_gcry_secmem_malloc_internal): Use mb->size for stats. + +2017-06-01 Jo Van Bulck <jo.vanbulck@cs.kuleuven.be> + + ecc: Store EdDSA session key in secure memory. + + commit 5a22de904a0a366ae79f03ff1e13a1232a89e26b + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_sign): use mpi_snew to allocate + session key. + +2017-05-31 Werner Koch <wk@gnupg.org> + + api: Deprecate gcry_md_info. + + commit 45c39340c9926c2c5801dbab7609687c41e9ff1f + + +2017-05-30 Werner Koch <wk@gnupg.org> + + mpi: Distribute asm files for aarch64 and asm. + + commit c65f9558f12ffa2810538ef616e71b4052dacb81 + * mpi/aarch64/distfiles: New. + * mpi/arm/distfiles: New. + + mpi: Distribute asm definitions for amd64. + + commit 87e481137debabb7f989d7fa9b1c21c336e10c98 + * mpi/amd64/distfiles: Add mpi-asm-defs.h. + +2017-05-23 Werner Koch <wk@gnupg.org> + + cipher: Fix compiler warnings. + + commit d764c9894013727ff82eb194da6030209c273528 + * cipher/poly1305.c (poly1305_default_ops): Move to the top. Add + prototypes and compile only if USE_SSE2 is not defined. + (poly1305_init_ext_ref32): Compile only if USE_SSE2 is not defined. + (poly1305_blocks_ref32): Ditto. + (poly1305_finish_ext_ref32): Ditto. + + doc: Comment fixes. + + commit c1bb3d9fdb6fe5f336af1d5a03fc42bfdc1f8b0b + + +2017-05-18 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael-ssse3: fix functions calls from assembly blocks. + + commit 4cd94994a9abec9b92fa5972869baf089a28fa76 + * cipher/rijndael-ssse3-amd64.c (PUSH_STACK_PTR, POP_STACK_PTR): New. + (vpaes_ssse3_prepare_enc, vpaes_ssse3_prepare_dec) + (_gcry_aes_ssse3_do_setkey, _gcry_aes_ssse3_prepare_decryption) + (do_vpaes_ssse3_enc, do_vpaes_ssse3_dec): Use PUSH_STACK_PTR and + POP_STACK_PTR. + + chacha20-armv7-neon: fix to use fast code path when memory is aligned. + + commit 68861ae5d3e007d7a39f14ea27dc3dd8ef13ba02 + * cipher/chacha20-armv7-neon.S (UNALIGNED_LDMIA4): Uncomment + instruction for jump to aligned code path. + + Move data in AMD64 assembly to text section. + + commit 1a094bc5b2aa730833faf593a931d4e5d7f9ab4d + * cipher/camellia-aesni-avx-amd64.S: Move data to .text section to + ensure that RIP relative addressing of data will work. + * cipher/camellia-aesni-avx2-amd64.S: Ditto. + * cipher/chacha20-avx2-amd64.S: Ditto. + * cipher/chacha20-ssse3-amd64.S: Ditto. + * cipher/des-amd64.S: Ditto. + * cipher/serpent-avx2-amd64.S: Ditto. + * cipher/sha1-avx-amd64.S: Ditto. + * cipher/sha1-avx-bmi2-amd64.S: Ditto. + * cipher/sha1-ssse3-amd64.S: Ditto. + * cipher/sha256-avx-amd64.S: Ditto. + * cipher/sha256-avx2-bmi2-amd64.S: Ditto. + * cipher/sha256-ssse3-amd64.S: Ditto. + * cipher/sha512-avx-amd64.S: Ditto. + * cipher/sha512-avx2-bmi2-amd64.S: Ditto. + * cipher/sha512-ssse3-amd64.S: Ditto. + + cast5-amd64: use 64-bit relocation with large PIC memory model. + + commit ff02fca39c83bcf30c79368611ac65e273e77f6c + * cipher/cast5-amd64.S [__code_model_large__] + (GET_EXTERN_POINTER): New. + +2017-05-13 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix building with x86-64 medium and large memory models. + + commit 434d4f2af39033fc626044ba9a060da298522293 + * cipher/cast5-amd64.S [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS] + (GET_EXTERN_POINTER): Load 64-bit address instead of 32-bit. + * cipher/rijndael.c (do_encrypt, do_decrypt) + [USE_AMD64_ASM && !HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS]: Load + table pointer through register instead of generic reference. + +2017-04-04 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Simplify mpi_powm. + + commit 719468e53133d3bdf12156c5bfdea2bf15f9f6f1 + * mpi/mpi-pow.c (_gcry_mpi_powm): Simplify the loop. + +2017-03-08 Justus Winter <justus@g10code.com> + + build: Use macOS' compatibility macros to enable all features. + + commit 654024081cfa103c87bb163b117ea3568171d408 + * configure.ac: On macOS, use the compatibility macros to expose every + feature of the libc. This is the equivalent of _GNU_SOURCE on GNU + libc. + +2017-02-27 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add BLAKE2b and BLAKE2s hash algorithms (RFC 7693) + + commit 5bd530b8a4624f101b8d42e68f1b28bcc13f4f76 + * cipher/blake2.c: New. + * cipher/Makefile.am: Add 'blake2.c'. + * cipher/md.c (digest_list, prepare_macpads): Add BLAKE2. + (md_setkey): New. + (_gcry_md_setkey): Call 'md_setkey' for non-HMAC md. + * configure.ac: Add BLAKE2 digest. + * doc/gcrypt.texi: Add BLAKE2. + * src/cipher.h (_gcry_blake2_init_with_key) + (_gcry_digest_spec_blake2b_512, _gcry_digest_spec_blake2b_384) + (_gcry_digest_spec_blake2b_256, _gcry_digest_spec_blake2b_160) + (_gcry_digest_spec_blake2s_256, _gcry_digest_spec_blake2s_224) + (_gcry_digest_spec_blake2s_160, _gcry_digest_spec_blake2s_128): New. + * src/gcrypt.h.in (GCRY_MD_BLAKE2B_512, GCRY_MD_BLAKE2B_384) + (GCRY_MD_BLAKE2B_256, GCRY_MD_BLAKE2B_160, GCRY_MD_BLAKE2S_256) + (GCRY_MD_BLAKE2S_224, GCRY_MD_BLAKE2S_160, GCRY_MD_BLAKE2S_128): New. + * tests/basic.c (check_one_md): Add testing for keyed hashes. + (check_digests): Add BLAKE2 test vectors; Add testing for keyed hashes. + * tests/blake2b.h: New. + * tests/blake2s.h: New. + * tests/Makefile.am: Add 'blake2b.h' and 'blake2s.h'. + + Fix building with clang on ARM64/FreeBSD. + + commit da213db2c6cda6f57e5853e8c591d69bfa1cfa74 + * cipher/cipher-gcm-armv8-aarch64-ce.S: Use '.cpu generic+simd+crypto' + instead of '.arch armv8-a+crypto'. + * cipher/rijndael-armv8-aarch64-ce.S: Ditto. + * cipher/sha1-armv8-aarch64-ce.S: Ditto. + * cipher/sha256-armv8-aarch64-ce.S: Ditto. + * configure.ac (gcry_cv_gcc_inline_asm_aarch64_neon): Ditto. + (gcry_cv_gcc_inline_asm_aarch64_crypto): Ditto; and include NEON + instructions to crypto instructions check. + +2017-02-07 Justus Winter <justus@g10code.com> + + Fix building with a pre C99 compiler. + + commit 75d91ffeaf83098ade325bb3b6b2c8a76eb1f6a6 + * cipher/cipher-cfb.c (_gcry_cipher_cfb8_encrypt): Move the + declaration of 'i' out of the loop. + (_gcry_cipher_cfb8_decrypt): Likewise. + +2017-02-04 Mathias L. Baumann <mathias.baumann_at_sociomantic.com> + + Implement CFB with 8-bit mode. + + commit d1ee9a660571ce4a998c9ab2299d4f2419f99127 + * cipher/cipher-cfb.c (_gcry_cipher_cfb8_encrypt) + (_gcry_cipher_cfg8_decrypt): Add 8-bit variants of decrypt/encrypt + functions. + * cipher/cipher-internal.h (_gcry_cipher_cfb8_encrypt) + (_gcry_cipher_cfg8_decrypt): Ditto. + * cipher/cipher.c: Adjust code flow to work with GCRY_CIPHER_MODE_CFB8. + * tests/basic.c: Add tests for cfb8 with AES and 3DES. + +2017-02-04 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rndhw: add missing "memory" clobbers. + + commit c67c728478e8f47b6e8296b643fd35d66d4a1052 + * random/rndhw.c: (poll_padlock, rdrand_long): Add "memory" to asm + clobbers. + + Add UNLIKELY and LIKELY macros. + + commit 4b7451d3e8e7b87d8e407fbbd924ad5b13bd0f00 + * src/g10lib.h (LIKELY, UNLIKELY): New. + (gcry_assert): Use LIKELY for assert check. + (fast_wipememory2_unaligned_head): Use UNLIKELY for unaligned + branching. + * cipher/bufhelp.h (buf_cpy, buf_xor, buf_xor_1, buf_xor_2dst) + (buf_xor_n_copy_2): Ditto. + + rndhw: avoid type-punching. + + commit 37b537600f33fcf8e1c8dc2c658a142fbba44199 + * random/rndhw.c (rdrand_long, rdrand_nlong): Add 'volatile' for + pointer. + (poll_drng): Convert buffer to 'unsigned long[]' and make use of DIM + macro. + +2017-01-28 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + hwf-x86: avoid type-punching. + + commit 1407317a6112a23d4fec5827a9d74faef4196f66 + * src/hwf-x86.c (detect_x86_gnuc): Use union for vendor_id. + + cipher: add explicit blocksize checks to allow better optimization. + + commit efa9042f82ffed3d076b8e26ac62d29e00bb756a + * cipher/cipher-cbc.c (_gcry_cipher_cbc_encrypt) + (_gcry_cipher_cbc_decrypt): Add explicit check for cipher blocksize of + 64-bit or 128-bit. + * cipher/cipher-cfb.c (_gcry_cipher_cfb_encrypt) + (_gcry_cipher_cfb_decrypt): Ditto. + * cipher/cipher-cmac.c (cmac_write, cmac_generate_subkeys) + (cmac_final): Ditto. + * cipher/cipher-ctr.c (_gcry_cipher_ctr_encrypt): Ditto. + * cipher/cipher-ofb.c (_gcry_cipher_ofb_encrypt): Ditto. + + bufhelp: use unaligned dword and qword types for endianess helpers. + + commit e7b941c3de9c9b6319298c02f844cc0cadbf8562 + * cipher/bufhelp.h (BUFHELP_UNALIGNED_ACCESS): New, defined + if attributes 'packed', 'aligned' and 'may_alias' are supported. + (BUFHELP_FAST_UNALIGNED_ACCESS): Define if have + BUFHELP_UNALIGNED_ACCESS. + + rijndael-aesni: fix u128_t strict-aliasing rule breaking. + + commit 92b4a29d2453712192ced2d7226abc49679dcb1e + * cipher/rijndael-aesni.c (u128_t): Add attributes to tell GCC and clang + that casting from 'char *' to 'u128_t *' is ok. + + cipher-xts: fix pointer casting to wrong alignment and aliasing. + + commit 4f31d816dcc1e95dc647651e92acbdfed53f5c14 + * cipher/cipher-xts.c (xts_gfmul_byA, xts_inc128): Use buf_get_le64 + and buf_put_le64 for accessing data; Change parameter pointers to + 'unsigned char *' type. + (_gcry_cipher_xts_crypt): Do not cast buffer pointers to 'u64 *' + for helper functions. + + crc-intel-pclmul: fix undefined behavior with unaligned access. + + commit 55cf1b5588705cab5f45e2817c4aa1d204dc0042 + * cipher/crc-intel-pclmul.c (u16_unaligned_s): New. + (crc32_reflected_less_than_16, crc32_less_than_16): Use + 'u16_unaligned_s' for unaligned memory access. + + configure.ac: fix attribute checks. + + commit b29b1b9f576f501d4b993be0a751567045274a1a + * configure.ac: Add -Werror flag for attribute checks. + + configure.ac: fix may_alias attribute check. + + commit 136c8416ea540dd126be3997d94d7063b3aaf577 + * configure.ac: Test may_alias attribute on type, not on variable. + + bufhelp: add 'may_alias' attribute for properly aligned 'bufhelp_int_t' + + commit d1ae52a0e23308f33b78cffeba56005b687f23c0 + * cipher/bufhelp.h [!BUFHELP_FAST_UNALIGNED_ACCESS] + (bufhelp_int_t): Add 'may_alias' attribute. + +2017-01-27 Werner Koch <wk@gnupg.org> + + w32: New envvar GCRYPT_RNDW32_DBG. + + commit a351fbde8548ce3f57298c618426f043844fbc78 + * random/rndw32.c (_gcry_rndw32_gather_random): Use getenv to set + DEBUG_ME. + +2017-01-23 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael-ssse3-amd64: fix building on x32. + + commit 39b9302da5d08bd52688d20befe626fee0b6c41d + * cipher/rijndael-ssse3-amd64.c: Use 64-bit call instructions + with 64-bit registers. + + bufhelp: use 'may_alias' attribute unaligned pointer types. + + commit bf9e0b79e620ca2324224893b07522462b125412 + * configure.ac (gcry_cv_gcc_attribute_may_alias) + (HAVE_GCC_ATTRIBUTE_MAY_ALIAS): New check for 'may_alias' attribute. + * cipher/bufhelp.h (BUFHELP_FAST_UNALIGNED_ACCESS): Enable only if + HAVE_GCC_ATTRIBUTE_MAY_ALIAS is defined. + [BUFHELP_FAST_UNALIGNED_ACCESS] (bufhelp_int_t, bufhelp_u32_t) + (bufhelp_u64_t): Add 'may_alias' attribute. + * src/g10lib.h (fast_wipememory_t): Add HAVE_GCC_ATTRIBUTE_MAY_ALIAS + defined check; Add 'may_alias' attribute. + +2017-01-18 Werner Koch <wk@gnupg.org> + + random: Call getrandom before select and emitting a progress callback. + + commit 623aab8a940ea61afe3fef650ad485a755ed9fe7 + * random/rndlinux.c (_gcry_rndlinux_gather_random): Move the getrandom + call before the select. + +2017-01-06 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + mpi: amd64: fix too large jump alignment in mpih-rshift. + + commit ddcfe31e2425e88b280e7cdaf3f0eaaad8ccc023 + * mpi/amd64/mpih-rshift.S (_gcry_mpih_rshift): Use 16-byte alignment + with 'ALIGN(4)' instead of 256-byte. + + rijndael-ssse3: move assembly functions to separate source-file. + + commit 54c57bc49edb5c00e9ed8103cc4837bb72c5e863 + * cipher/Makefile.am: Add 'rinjdael-ssse3-amd64-asm.S'. + * cipher/rinjdael-ssse3-amd64-asm.S: Moved assembly functions + here ... + * cipher/rinjdael-ssse3-amd64.c: ... from this file. + (_gcry_aes_ssse3_enc_preload, _gcry_aes_ssse3_dec_preload) + (_gcry_aes_ssse3_shedule_core, _gcry_aes_ssse3_encrypt_core) + (_gcry_aes_ssse3_decrypt_core): New. + (vpaes_ssse3_prepare_enc, vpaes_ssse3_prepare_dec) + (_gcry_aes_ssse3_do_setkey, _gcry_aes_ssse3_prepare_decryption) + (do_vpaes_ssse3_enc, do_vpaes_ssse3_dec): Update to use external + assembly functions; remove 'aes_const_ptr' variable usage. + (_gcry_aes_ssse3_encrypt, _gcry_aes_ssse3_decrypt) + (_gcry_aes_ssse3_cfb_enc, _gcry_aes_ssse3_cbc_enc) + (_gcry_aes_ssse3_ctr_enc, _gcry_aes_ssse3_cfb_dec) + (_gcry_aes_ssse3_cbc_dec, ssse3_ocb_enc, ssse3_ocb_dec) + (_gcry_aes_ssse3_ocb_auth): Remove 'aes_const_ptr' variable usage. + * configure.ac: Add 'rinjdael-ssse3-amd64-asm.lo'. + + Add AVX2/vpgather bulk implementation of Twofish. + + commit c59a8ce51ceb9a80169c44ef86a67e95cf8528c3 + * cipher/Makefile.am: Add 'twofish-avx2-amd64.S'. + * cipher/twofish-avx2-amd64.S: New. + * cipher/twofish.c (USE_AVX2): New. + (TWOFISH_context) [USE_AVX2]: Add 'use_avx2' member. + (ASM_FUNC_ABI): New. + (twofish_setkey): Add check for AVX2 and fast VPGATHER HW features. + (_gcry_twofish_avx2_ctr_enc, _gcry_twofish_avx2_cbc_dec) + (_gcry_twofish_avx2_cfb_dec, _gcry_twofish_avx2_ocb_enc) + (_gcry_twofish_avx2_ocb_dec, _gcry_twofish_avx2_ocb_auth): New. + (_gcry_twofish_ctr_enc, _gcry_twofish_cbc_dec, _gcry_twofish_cfb_dec) + (_gcry_twofish_ocb_crypt, _gcry_twofish_ocb_auth): Add AVX2 bulk + handling. + (selftest_ctr, selftest_cbc, selftest_cfb): Increase nblocks from + 3+X to 16+X. + * configure.ac: Add 'twofish-avx2-amd64.lo'. + * src/g10lib.h (HWF_INTEL_FAST_VPGATHER): New. + * src/hwf-x86.c (detect_x86_gnuc): Add detection for + HWF_INTEL_FAST_VPGATHER. + * src/hwfeatures.c (HWF_INTEL_FAST_VPGATHER): Add + "intel-fast-vpgather" for HWF_INTEL_FAST_VPGATHER. + + Add XTS cipher mode. + + commit 232a129b1f915fc54881506e4b07c89cf84932e6 + * cipher/Makefile.am: Add 'cipher-xts.c'. + * cipher/cipher-internal.h (gcry_cipher_handle): Add 'bulk.xts_crypt' + and 'u_mode.xts' members. + (_gcry_cipher_xts_crypt): New prototype. + * cipher/cipher-xts.c: New. + * cipher/cipher.c (_gcry_cipher_open_internal, cipher_setkey) + (cipher_reset, cipher_encrypt, cipher_decrypt): Add XTS mode handling. + * doc/gcrypt.texi: Add XTS mode to documentation. + * src/gcrypt.h.in (GCRY_CIPHER_MODE_XTS, GCRY_XTS_BLOCK_LEN): New. + * tests/basic.c (do_check_xts_cipher, check_xts_cipher): New. + (check_bulk_cipher_modes): Add XTS test-vectors. + (check_one_cipher_core, check_one_cipher, check_ciphers): Add XTS + testing support. + (check_cipher_modes): Add XTS test. + * tests/bench-slope.c (bench_xts_encrypt_init) + (bench_xts_encrypt_do_bench, bench_xts_decrypt_do_bench) + (xts_encrypt_ops, xts_decrypt_ops): New. + (cipher_modes, cipher_bench_one): Add XTS. + * tests/benchmark.c (cipher_bench): Add XTS testing. + +2017-01-04 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael-ssse3: fix counter operand from read-only to read/write. + + commit aada604594fd42224d366d3cb98f67fd3b989cd6 + * cipher/rijndael-ssse3-amd64.c (_gcry_aes_ssse3_ctr_enc): Change + 'ctrlow' operand from read-only to read-write. + +2017-01-03 Werner Koch <wk@gnupg.org> + + Extend GCRYCTL_PRINT_CONFIG to print compiler version. + + commit 98b49695b1ffe3c406ae39a45051b8594f903b9d + * src/global.c (print_config): Print version of libgpg-error and used + compiler. + + tests: Add option --disable-hwf to the version utility. + + commit 3582641469f1c74078f0d758c4d5458cc0ee5649 + * src/hwfeatures.c (_gcry_disable_hw_feature): Rewrite to allow + passing a colon delimited feature set. + (parse_hwf_deny_file): Remove unused var I. + * tests/version.c (main): Add options --verbose and --disable-hwf. + +2016-12-15 Werner Koch <wk@gnupg.org> + Nicolas Porcel <nicolasporcel06@gmail.com> + + Fix regression in broken mlock detection. + + commit 0a90f87799903a3fb97189ef7cba19e7b3534e1c + * acinclude.m4 (GNUPG_CHECK_MLOCK): Fix typo EGAIN->EAGAIN. + +2016-12-10 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + hwfeatures: add 'all' for disabling all hardware features. + + commit c83d0d2a26059cf471d09f5cb8e7fc5d76c4907b + * .gitignore: Add 'tests/basic-disable-all-hwf'. + * configure.ac: Ditto. + * tests/Makefile.am: Ditto. + * src/hwfeatures.c (_gcry_disable_hw_feature): Match 'all' for + masking all HW features off. + (parse_hwf_deny_file): Use '_gcry_disable_hw_feature' for matching. + * tests/basic-disable-all-hwf.in: New. + + tests/hashtest-256g: add missing executable extension for Win32. + + commit 2b7b227b8a0bd5ff286258bc187782efac180a7e + * tests/hashtest-256g.in: Add @EXEEXT@. + + OCB ARM CE: Move ocb_get_l handling to assembly part. + + commit 5c418e597f0f20a546d953161695e6caf1f57689 + * cipher/rijndael-armv8-aarch32-ce.S: Add OCB 'L_{ntz(i)}' calculation. + * cipher/rijndael-armv8-aarch64-ce.S: Ditto. + * cipher/rijndael-armv8-ce.c (_gcry_aes_ocb_enc_armv8_ce) + (_gcry_aes_ocb_dec_armv8_ce, _gcry_aes_ocb_auth_armv8_ce) + (ocb_cryt_fn_t): Updated arguments. + (_gcry_aes_armv8_ce_ocb_crypt, _gcry_aes_armv8_ce_ocb_auth): Remove + 'ocb_get_l' handling and splitting input to 32 block chunks, instead + pass full buffers to assembly. + + OCB: Move large L handling from bottom to upper level. + + commit 2d2e5286d53e1f62fe040dff4c6e01961f00afe2 + * cipher/cipher-ocb.c (_gcry_cipher_ocb_get_l): Remove. + (ocb_get_L_big): New. + (_gcry_cipher_ocb_authenticate): L-big handling done in upper + processing loop, so that lower level never sees the case where + 'aad_nblocks % 65536 == 0'; Add missing stack burn. + (ocb_aad_finalize): Add missing stack burn. + (ocb_crypt): L-big handling done in upper processing loop, so that + lower level never sees the case where 'data_nblocks % 65536 == 0'. + * cipher/cipher-internal.h (_gcry_cipher_ocb_get_l): Remove. + (ocb_get_l): Remove 'l_tmp' usage and simplify since input + is more limited now, 'N is not multiple of 65536'. + * cipher/rijndael-aesni.c (get_l): Remove. + (aesni_ocb_enc, aesni_ocb_dec, _gcry_aes_aesni_ocb_auth): Remove + l_tmp; Use 'ocb_get_l'. + * cipher/rijndael-ssse3-amd64.c (get_l): Remove. + (ssse3_ocb_enc, ssse3_ocb_dec, _gcry_aes_ssse3_ocb_auth): Remove + l_tmp; Use 'ocb_get_l'. + * cipher/camellia-glue.c: Remove OCB l_tmp usage. + * cipher/rijndael-armv8-ce.c: Ditto. + * cipher/rijndael.c: Ditto. + * cipher/serpent.c: Ditto. + * cipher/twofish.c: Ditto. + + OCB: remove 'int64_t' usage. + + commit 161d339f48c03be7fd0f4249d730f7f1767ef8e4 + * cipher/cipher-ocb.c (double_block): Use alternative way to generate + sign-bit mask, without 'int64_t'. + + random-drbg: use bufhelp function for big-endian store. + + commit 0b03b658bebc69a84d87ef13f9b60a27b0c42305 + * random/random-drbg.c (drbg_cpu_to_be32): Remove. + (drbg_ctr_df, drbg_hash_df): Use 'buf_put_be32' instead of + 'drbg_cpu_to_be32'. + +2016-12-09 Werner Koch <wk@gnupg.org> + + Improve handling of mlock error codes. + + commit 618b8978f46f4011c11512fd5f30c15e01652e2e + * acinclude.m4 (GNUPG_CHECK_MLOCK): Check also for EAGAIN which is a + legitimate return code and does not indicate a broken mlock(). + * src/secmem.c (lock_pool_pages): Test ERR instead of ERRNO which + could have been overwritten by cap_from+text et al. + +2016-12-08 Stephan Mueller <smueller@chronox.de> + + random: Eliminate unneeded memcpy invocations in the DRBG. + + commit 656395ba4cf34f42dda3a120bda3ed1220755a3d + * random/random-drbg.c (drbg_hash): Remove arg 'outval' and return a + pointer instead. + (drbg_instantiate): Reduce size of scratchpad. + (drbg_hmac_update): Avoid use of scratch buffers for the hash. + (drbg_hmac_generate, drbg_hash_df): Ditto. + (drbg_hash_process_addtl): Ditto. + (drbg_hash_hashgen): Ditto. + (drbg_hash_generate): Ditto. + + random: Add performance improvements for the DRBG. + + commit 20886fdcb841b0bf89bb1d44303d42f1804e38cb + * random/random-drbg.c (struct drbg_state_ops_s): New function + pointers 'crypto_init' and 'crypto-fini'. + (struct drbg_state_s): New fields 'priv_data', 'ctr_handle', and + 'ctr_null'. + (drbg_hash_init, drbg_hash_fini): New. + (drbg_hmac_init, drbg_hmac_setkey): New. + (drbg_sym_fini, drbg_sym_init, drbg_sym_setkey): New. + (drbg_sym_ctr): New. + (drbg_ctr_bcc): Set the key. + (drbg_ctr_df): Ditto. + (drbg_hmac_update): Ditto. + (drbg_hmac_generate): Replace drgb_hmac by drbg_hash. + (drbg_hash_df): Ditto. + (drbg_hash_process_addtl): Ditto. + (drbg_hash_hashgen): Ditto. + (drbg_ctr_update): Rework. + (drbg_ctr_generate): Rework. + (drbg_ctr_ops): Init new functions pointers. + (drbg_uninstantiate): Call fini function. + (drbg_instantiate): Call init function. + + cipher: New function for reading the counter in CTR mode. + + commit 227099f179df9dcf083d0ef6be9883c775df0874 + * cipher/cipher.c (gcry_cipher_getctr): New. + +2016-12-07 Werner Koch <wk@gnupg.org> + + Document the overflow pools and add a stupid test case. + + commit 95bac312644ad45e486c94c2efd25d0748b9a20b + * tests/t-secmem.c (test_secmem_overflow): New func. + (main): Disable warning and call new function. + + Implement overflow secmem pools for xmalloc style allocators. + + commit b6870cf25c0b1eb9c127a94af8326c446421a472 + * src/secmem.c (pooldesc_s): Add fields next, cur_alloced, and + cur_blocks. + (cur_alloced, cur_blocks): Remove vars. + (ptr_into_pool_p): Make it inline. + (stats_update): Add arg pool and update the new pool specific + counters. + (_gcry_secmem_malloc_internal): Add arg xhint and allocate overflow + pools as needed. + (_gcry_secmem_malloc): Pass XHINTS along. + (_gcry_secmem_realloc_internal): Ditto. + (_gcry_secmem_realloc): Ditto. + (_gcry_secmem_free_internal): Take multiple pools in account. Add + return value to indicate whether the arg was freed. + (_gcry_secmem_free): Add return value to indicate whether the arg was + freed. + (_gcry_private_is_secure): Take multiple pools in account. + (_gcry_secmem_term): Release all pools. + (_gcry_secmem_dump_stats): Print stats for all pools. + * src/stdmem.c (_gcry_private_free): Replace _gcry_private_is_secure + test with a direct call of _gcry_secmem_free to avoid double checking. + + Give the secmem allocators a hint when a xmalloc calls them. + + commit b7df907dca4d525f8930c533b763ffce44ceed87 + * src/secmem.c (_gcry_secmem_malloc): New not yet used arg XHINT. + (_gcry_secmem_realloc): Ditto. + * src/stdmem.c (_gcry_private_malloc_secure): New arg XHINT to be + passed to the secmem functions. + (_gcry_private_realloc): Ditto. + * src/g10lib.h (GCRY_ALLOC_FLAG_XHINT): New. + * src/global.c (do_malloc): Pass this flag as XHINT to the private + allocator. + (_gcry_malloc_secure): Factor code out to ... + (_gcry_malloc_secure_core): this. Add arg XHINT. + (_gcry_realloc): Factor code out to ... + (_gcry_realloc_core): here. Add arg XHINT. + (_gcry_strdup): Factor code out to ... + (_gcry_strdup_core): here. Add arg XHINT. + (_gcry_xrealloc): Use the core function and pass true for XHINT. + (_gcry_xmalloc_secure): Ditto. + (_gcry_xstrdup): Ditto. + + tests: New test t-secmem. + + commit e366c19b34922c770af82cd035fd815680b29dee + * src/secmem.c (_gcry_secmem_dump_stats): Add arg EXTENDED and adjust + caller. + * src/gcrypt-testapi.h (PRIV_CTL_DUMP_SECMEM_STATS): New. + * src/global.c (_gcry_vcontrol): Implement that. + * tests/t-secmem.c: New. + * tests/Makefile.am (tests_bin): Add that test. + +2016-12-06 Werner Koch <wk@gnupg.org> + + Fix compiler warning about possible-NULL-dreference. + + commit 995ce697308320c6a52a307f83dc49eeb8d784b4 + * src/mpi.h (mpi_is_const, mpi_is_immutable): Do check arg before + deref-ing. The are only used at places where the arg shall not be NULL. + + Fix possible NULL-deref in gcry_log_debugsxp. + + commit 984a97f0750f812f0ad3c343ee6a67560953a504 + * src/misc.c (_gcry_log_printsxp): Prevent passing NULL to strlen. + + Reorganize code in secmem.c. + + commit 603f479a919311f720a05da738150c2192d5e562 + * src/secmem.c (pooldesc_t): New type to collect information about one + pool. + (pool_size): Remove. Now a member of pooldesc_t. + (pool_okay): Ditto. + (pool_is_mmapped): Ditto. + (pool): Rename variable ... + (mainpool): And change type to pooldesc_t. + (ptr_into_pool_p): Add arg 'pool'. + (mb_get_next): Ditto. + (mb_get_prev): Ditto. + (mb_merge): Ditto. + (mb_get_new): Ditto. + (init_pool): Ditto. + (lock_pool): Rename to ... + (look_pool_pages: this. + (secmem_init): Rename to ... + (_gcry_secmem_init_internal): this. Add local var POOL and init with + address of MAINPOOL. + (_gcry_secmem_malloc_internal): Add local var POOL and init with + address of MAINPOOL. + (_gcry_private_is_secure): Ditto. + (_gcry_secmem_term): Ditto. + (_gcry_secmem_dump_stats): Ditto. + (_gcry_secmem_free_internal): Ditto. Remove check for NULL arg. + (_gcry_secmem_free): Add check for NULL arg before taking the lock. + (_gcry_secmem_realloc): Factor most code out to ... + (_gcry_secmem_realloc_internal): this. + +2016-11-28 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + tests: Add PBKDF2 tests for Stribog512. + + commit a0580d446fef648a177ca4ab060d0e449780db84 + * tests/t-kdf.c (check_pbkdf2): Add Stribog512 test cases from TC26's + additions to PKCS#5. + + tests: Add Stribog HMAC tests from TC26ALG. + + commit fe6077e6ee8565bfcc91bad14a73e68f45b3c32b + * tests/basic.c (check_mac): add HMAC test vectors from TC26ALG document + for Stribog. + + cipher: Add Stribog OIDs from TC26 space. + + commit ccffacaf6c3abe6120a0898db922981d28ab7af2 + * cipher/stribog.c (oid_spec_stribog256, oid_spec_stribog512): New. + +2016-11-25 Justus Winter <justus@g10code.com> + + tests: Fix memory leak. + + commit 5530a8234d703ce9b685f78fb6e951136eb0aeb2 + * tests/basic.c (check_gost28147_cipher): Free cipher handles. + +2016-11-25 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Cast oid argument of gcry_cipher_set_sbox to disable compiler warning. + + commit 1a67e3195896704f8b3ba09e3db1214bab834491 + * src/gcrypt.h.in (gcry_cipher_set_sbox): Cast oid to (void *). + + gost: Rename tc26 s-box from A to Z. + + commit dc8ceb8d2dfef949f3afa14fc75f9de8cd07c7ad + * cipher/gost-s-box.c (gost_sboxes): Rename TC26_A to TC26_Z as it is + the name that ended up in all standards. + + tests: Add test to verify GOST 28147-89 against known results. + + commit 4f5c26c73c66daf2e4aff966e43c22b2db7e0138 + * tests/basic.c (check_gost28147_cipher): new test function. + +2016-11-17 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + cipher/gost28147: Fix CryptoPro-B S-BOX. + + commit 5ca63c92825453fdb369a97bbc19cb95b49b4296 + * cipher/gost-s-box.c: CryptoPro_B s-box missed one line, resulting in + incorrect encryption/decryption using that s-box. Add missing data. + +2016-11-12 Werner Koch <wk@gnupg.org> + + Put blocking calls into Libgpg-error's system call clamp. + + commit b829dfe9f0eeff08c956ba3f3a6b559b9d2199dd + * src/gcrypt.h.in (GCRYCTL_REINIT_SYSCALL_CLAMP): New. + * configure.ac: Require Libgpg-error 1.25. Set version number to + 1.8.0. + * src/gcrypt-int.h: Remove error code emulation. + * src/global.c (pre_syscall_func, post_syscall_func): New. + (global_init): Call gpgrt_get_syscall_clamp. + (_gcry_vcontrol) <GCRYCTL_REINIT_SYSCALL_CLAMP>: Ditto. + (_gcry_pre_syscall, _gcry_post_syscall): New. + * random/rndlinux.c (_gcry_rndlinux_gather_random): Use the new + functions. + +2016-11-01 NIIBE Yutaka <gniibe@fsij.org> + + cipher: Fix IDEA cipher for clearing memory. + + commit bf6d5b10cb4173826f47ac080506b68bb001acb2 + * cipher/idea.c (invert_key): Use wipememory, since this kind of memset + may be removed by compiler optimization. + +2016-10-09 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + GCM: Add bulk processing for ARMv8/AArch64 implementation. + + commit bfd732f53a9b5dfe14217a68a0fa289bf6913ec0 + * cipher/cipher-gcm-armv8-aarch64-ce.S: Add 6 blocks bulk processing. + + GCM: Add bulk processing for ARMv8/AArch32 implementation. + + commit 27747921cb1dfced83c5666cd1c474764724c52b + * cipher/cipher-gcm-armv8-aarch32-ce.S: Add 4 blocks bulk processing. + * tests/basic.c (check_digests): Print correct data length for "?" + tests. + (check_one_mac): Add large 1000000 bytes tests, when input is "!" or + "?". + (check_mac): Add "?" tests vectors for HMAC, CMAC, GMAC and POLY1305. + +2016-09-11 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add Aarch64 assembly implementation of Twofish. + + commit 5418d9ca4c0e087fd6872ad350a996fe74880d86 + * cipher/Makefile.am: Add 'twofish-aarch64.S'. + * cipher/twofish-aarch64.S: New. + * cipher/twofish.c: Enable USE_ARM_ASM if __AARCH64EL__ and + HAVE_COMPATIBLE_GCC_AARCH64_PLATFORM_AS defined. + * configure.ac [host=aarch64]: Add 'twofish-aarch64.lo'. + +2016-09-05 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add Aarch64 assembly implementation of Camellia. + + commit de73a2e7237ba7c34ce48bb5fb671aa3993de832 + * cipher/Makefile.am: Add 'camellia-aarch64.S'. + * cipher/camellia-aarch64.S: New. + * cipher/camellia-glue.c [USE_ARM_ASM][__aarch64__]: Set stack burn + size to zero. + * cipher/camellia.h: Enable USE_ARM_ASM if __AARCH64EL__ and + HAVE_COMPATIBLE_GCC_AARCH64_PLATFORM_AS defined. + * configure.ac [host=aarch64]: Add 'rijndael-aarch64.lo'. + + Add ARMv8/AArch64 Crypto Extension implementation of AES. + + commit 4cd8d40d698564d24ece2af24546e34c58bf2961 + * cipher/Makefile.am: Add 'rijndael-armv-aarch64-ce.S'. + * cipher/rijndael-armv8-aarch64-ce.S: New. + * cipher/rijndael-internal.h (USE_ARM_CE): Enable for ARMv8/AArch64. + * configure.ac: Add 'rijndael-armv-aarch64-ce.lo' and + 'rijndael-armv8-ce.lo' for ARMv8/AArch64. + + Add ARMv8/AArch64 Crypto Extension implementation of GCM. + + commit 0b332c1aef03a735c1fb0df184f74d523deb2f98 + * cipher/Makefile.am: Add 'cipher-gcm-armv8-aarch64-ce.S'. + * cipher/cipher-gcm-armv8-aarch64-ce.S: New. + * cipher/cipher-internal.h (GCM_USE_ARM_PMULL): Enable on + ARMv8/AArch64. + + Add ARMv8/AArch64 Crypto Extension implementation of SHA-256. + + commit 2d4bbc0ad62c54bbdef77799f9db82d344b7219e + * cipher/Makefile.am: Add 'sha256-armv8-aarch64-ce.S'. + * cipher/sha256-armv8-aarch64-ce.S: New. + * cipher/sha256-armv8-aarch32-ce.S: Move round macros to correct + section. + * cipher/sha256.c (USE_ARM_CE): Enable on ARMv8/AArch64. + * configure.ac: Add 'sha256-armv8-aarch64-ce.lo'; Swap places for + 'sha512-arm.lo' and 'sha256-armv8-aarch32-ce.lo'. + + Add ARMv8/AArch64 Crypto Extension implementation of SHA-1. + + commit e4eb03f56683317c908cb55be727832810dc8c72 + * cipher/Makefile.am: Add 'sha1-armv8-aarch64-ce.S'. + * cipher/sha1-armv8-aarch64-ce.S: New. + * cipher/sha1.c (USE_ARM_CE): Enable on ARMv8/AArch64. + * configure.ac: Add 'sha1-armv8-aarch64-ce.lo'. + +2016-09-04 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add AArch64 assembly implementation of AES. + + commit 595251ad37bf1968261d7e781752513f67525803 + * cipher/Makefile.am: Add 'rijndael-aarch64.S'. + * cipher/rijndael-aarch64.S: New. + * cipher/rijndael-internal.h: Enable USE_ARM_ASM if __AARCH64EL__ and + HAVE_COMPATIBLE_GCC_AARCH64_PLATFORM_AS defined. + * configure.ac (gcry_cv_gcc_aarch64_platform_as_ok): New check. + [host=aarch64]: Add 'rijndael-aarch64.lo'. + +2016-08-17 Werner Koch <wk@gnupg.org> + + Release 1.7.3. + + commit f8241874971478bdcd2bc2082d901d05db7b256d + * configure.ac: Set LT version to C21/A1/R3. + + random: Hash continuous areas in the csprng pool. + + commit 8dd45ad957b54b939c288a68720137386c7f6501 + * random/random-csprng.c (mix_pool): Store the first hash at the end + of the pool. + + random: Improve the diagram showing the random mixing. + + commit 2f62103b4bb6d6f9ce806e01afb7fdc58aa33513 + * random/random-csprng.c (mix_pool): Use DIGESTLEN instead of 20. + +2016-07-19 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + crc-intel-pclmul: split assembly block to ease register pressure. + + commit f38199dbc290003898a1799adc367265267784c2 + * cipher/crc-intel-pclmul.c (crc32_less_than_16): Split inline + assembly block handling 4 byte input into multiple blocks. + + rijndael-aesni: split assembly block to ease register pressure. + + commit a4d1595a2638db63ac4c73e722c8ba95fdd85ff7 + * cipher/rijndael-aesni.c (do_aesni_ctr_4): Use single register + constraint for passing 'bige_addb' to assembly block; split + first inline assembly block into two parts. + +2016-07-14 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add ARMv8/AArch32 Crypto Extension implementation of AES. + + commit 05a4cecae0c02d2b4ee1cadd9c08115beae3a94a + * cipher/Makefile.am: Add 'rijndael-armv8-ce.c' and + 'rijndael-armv-aarch32-ce.S'. + * cipher/rijndael-armv8-aarch32-ce.S: New. + * cipher/rijndael-armv8-ce.c: New. + * cipher/rijndael-internal.h (USE_ARM_CE): New. + (RIJNDAEL_context_s): Add 'use_arm_ce'. + * cipher/rijndael.c [USE_ARM_CE] (_gcry_aes_armv8_ce_setkey) + (_gcry_aes_armv8_ce_prepare_decryption) + (_gcry_aes_armv8_ce_encrypt, _gcry_aes_armv8_ce_decrypt) + (_gcry_aes_armv8_ce_cfb_enc, _gcry_aes_armv8_ce_cbc_enc) + (_gcry_aes_armv8_ce_ctr_enc, _gcry_aes_armv8_ce_cfb_dec) + (_gcry_aes_armv8_ce_cbc_dec, _gcry_aes_armv8_ce_ocb_crypt) + (_gcry_aes_armv8_ce_ocb_auth): New. + (do_setkey) [USE_ARM_CE]: Add ARM CE/AES HW feature check and key + setup for ARM CE. + (prepare_decryption, _gcry_aes_cfb_enc, _gcry_aes_cbc_enc) + (_gcry_aes_ctr_enc, _gcry_aes_cfb_dec, _gcry_aes_cbc_dec) + (_gcry_aes_ocb_crypt, _gcry_aes_ocb_auth) [USE_ARM_CE]: Add + ARM CE support. + * configure.ac: Add 'rijndael-armv8-ce.lo' and + 'rijndael-armv8-aarch32-ce.lo'. + + Add ARMv8/AArch32 Crypto Extension implementation of GCM. + + commit 962b15470663db11e5c35b86768f1b5d8e600017 + * cipher/Makefile.am: Add 'cipher-gcm-armv8-aarch32-ce.S'. + * cipher/cipher-gcm-armv8-aarch32-ce.S: New. + * cipher/cipher-gcm.c [GCM_USE_ARM_PMULL] + (_gcry_ghash_setup_armv8_ce_pmull, _gcry_ghash_armv8_ce_pmull) + (ghash_setup_armv8_ce_pmull, ghash_armv8_ce_pmull): New. + (setupM) [GCM_USE_ARM_PMULL]: Enable ARM PMULL implementation if + HWF_ARM_PULL HW feature flag is enabled. + * cipher/cipher-gcm.h (GCM_USE_ARM_PMULL): New. + + Add ARMv8/AArch32 Crypto Extension implemenation of SHA-256. + + commit 34c64eb03178fbfd34190148fec5a189df2b8f83 + * cipher/Makefile.am: Add 'sha256-armv8-aarch32-ce.S'. + * cipher/sha256-armv8-aarch32-ce.S: New. + * cipher/sha256.c (USE_ARM_CE): New. + (sha256_init, sha224_init): Check features for HWF_ARM_SHA1. + [USE_ARM_CE] (_gcry_sha256_transform_armv8_ce): New. + (transform) [USE_ARM_CE]: Use ARMv8 CE implementation if HW supports. + (SHA256_CONTEXT): Add 'use_arm_ce'. + * configure.ac: Add 'sha256-armv8-aarch32-ce.lo'. + + Add ARMv8/AArch32 Crypto Extension implementation of SHA-1. + + commit 3d6334f8d94c2a4df10eed203ae928298a4332ef + * cipher/Makefile.am: Add 'sha1-armv8-aarch32-ce.S'. + * cipher/sha1-armv7-neon.S (_gcry_sha1_transform_armv7_neon): Add + missing size. + * cipher/sha1-armv8-aarch32-ce.S: New. + * cipher/sha1.c (USE_ARM_CE): New. + (sha1_init): Check features for HWF_ARM_SHA1. + [USE_ARM_CE] (_gcry_sha1_transform_armv8_ce): New. + (transform) [USE_ARM_CE]: Use ARMv8 CE implementation if HW supports + it. + * cipher/sha1.h (SHA1_CONTEXT): Add 'use_arm_ce'. + * configure.ac: Add 'sha1-armv8-aarch32-ce.lo'. + + Add HW feature check for ARMv8 AArch64 and crypto extensions. + + commit eee78f6e1fbce7d54c43fb7efc5aa8be9f52755f + * configure.ac: Add '--disable-arm-crypto-support'; enable hwf-arm + module on 64-bit ARM. + (armcryptosupport, gcry_cv_gcc_inline_aarch32_crypto) + (gcry_cv_inline_asm_aarch64_neon) + (gcry_cv_gcc_inline_asm_aarch64_crypto): New. + * src/g10lib.h (HWF_ARM_AES, HWF_ARM_SHA1, HWF_ARM_SHA2) + (HWF_ARM_PMULL): New. + * src/hwf-arm.c [__aarch64__]: Enable building in AArch64 mode. + (feature_map_s): New. + [__arm__] (AT_HWCAP, AT_HWCAP2, HWCAP2_AES, HWCAP2_PMULL) + (HWCAP2_SHA1, HWCAP2_SHA2, arm_features): New. + [__aarch64__] (AT_HWCAP, AT_HWCAP2, HWCAP_ASIMD, HWCAP_AES) + (HWCAP_PMULL, HWCAP_SHA1, HWCAP_SHA2, arm_features): New. + (get_hwcap): Add reading of 'AT_HWCAP2'; Change auxv use + 'unsigned long'. + (detect_arm_at_hwcap): Add mapping of HWCAP/HWCAP2 to HWF flags. + (detect_arm_proc_cpuinfo): Add mapping of CPU features to HWF flags. + (_gcry_hwf_detect_arm): Use __ARM_NEON instead of legacy __ARM_NEON__. + * src/hwfeatures.c (hwflist): Add 'arm-aes', 'arm-sha1', 'arm-sha2' + and 'arm-pmull'. + +2016-07-14 Werner Koch <wk@gnupg.org> + + Release 1.7.2. + + commit be0bec7d9208b2f2d2ffce9cc2ca6154853e7e59 + * configure.ac: Set LT version to C21/A1/R2. + * Makefile.am (distcheck-hook): New. + +2016-07-13 Werner Koch <wk@gnupg.org> + + build: Update config.{guess,sub} to {2016-05-15,2016-06-20}. + + commit e535ea1bdc42309553007d60599d3147b8defe93 + * build-aux/config.guess: Update. + * build-aux/config.sub: Update. + +2016-07-08 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix unaligned accesses with ldm/stm in ChaCha20 and Poly1305 ARM/NEON. + + commit 1111d311fd6452abd4080d1072c75ddb1b5a3dd1 + * cipher/chacha20-armv7-neon.S (UNALIGNED_STMIA8) + (UNALIGNED_LDMIA4): New. + (_gcry_chacha20_armv7_neon_blocks): Use new helper macros instead of + ldm/stm instructions directly. + * cipher/poly1305-armv7-neon.S (UNALIGNED_LDMIA2) + (UNALIGNED_LDMIA4): New. + (_gcry_poly1305_armv7_neon_init_ext, _gcry_poly1305_armv7_neon_blocks) + (_gcry_poly1305_armv7_neon_finish_ext): Use new helper macros instead + of ldm instruction directly. + +2016-07-03 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + bench-slope: add unaligned buffer mode. + + commit 496790940753226f96b731a43d950bd268acd97a + * tests/bench-slope.c (unaligned_mode): New. + (do_slope_benchmark): Unalign buffer if in unaligned mode enabled. + (print_help, main): Add '--unaligned' parameter. + +2016-07-01 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix static build. + + commit cb79630ec567a5f2e03e5f863cda168faa7b8cc8 + * tests/pubkey.c (_gcry_pk_util_get_nbits): Make function 'static'. + +2016-06-30 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Disallow encryption/decryption if key is not set. + + commit 07de9858032826f5a7b08c372f6bcc73bbb503eb + * cipher/cipher.c (cipher_encrypt, cipher_decrypt): If mode is not + NONE, make sure that key is set. + * cipher/cipher-ccm.c (_gcry_cipher_ccm_set_nonce): Do not clear + 'marks.key' when reseting state. + + Avoid unaligned accesses with ARM ldm/stm instructions. + + commit a6158a01a4d81a5d862e1e0a60bfd6063443311d + * cipher/rijndael-arm.S: Remove __ARM_FEATURE_UNALIGNED ifdefs, always + compile with unaligned load/store code paths. + * cipher/sha512-arm.S: Ditto. + + Fix non-PIC reference in PIC for poly1305/ARMv7-NEON. + + commit a09126242a51c4ea4564b0f70b808e4f27fe5a91 + * cipher/poly1305-armv7-neon.S (GET_DATA_POINTER): New. + (_gcry_poly1305_armv7_neon_init_ext): Use GET_DATA_POINTER. + + Fix wrong CPU feature #ifdef for SHA1/AVX. + + commit 4a983e3bef58b9d056517e25e0ab10b72d12ceba + * cipher/sha1-avx-amd64.S: Check for HAVE_GCC_INLINE_ASM_AVX instead of + HAVE_GCC_INLINE_ASM_AVX2 & HAVE_GCC_INLINE_ASM_BMI2. + +2016-06-30 Werner Koch <wk@gnupg.org> + + random: Remove debug message about not supported getrandom syscall. + + commit 6965515c73632a088fb126a4a55e95121671fa98 + * random/rndlinux.c (_gcry_rndlinux_gather_random): Remove log_debug + for getrandom error ENOSYS. + +2016-06-27 Werner Koch <wk@gnupg.org> + + tests: Do not test SHAKE128 et al with gcry_md_hash_buffer. + + commit 4d634a098742ff425b324e9f2a67b9f62de09744 + * tests/benchmark.c (md_bench): Do not test variable lengths algos + with the gcry_md_hash_buffer. + + md: Improve diagnostic when using SHAKE128 with gcry_md_hash_buffer. + + commit ae26edf4b60359bfa5fe3a27b2c24b336e7ec35c + * cipher/md.c (md_read): Detect missing read function. + (_gcry_md_hash_buffers): Return an error. + +2016-06-25 Werner Koch <wk@gnupg.org> + + ecc: Fix memory leak. + + commit 7a7f7c147f888367dfee6093d26bfeaf750efc3a + * cipher/ecc.c (ecc_check_secret_key): Do not init point if already + set. + + doc: Update yat2m. + + commit 1feb01940062a74c27230434fc3babdddca8caf4 + * doc/yat2m.c: Update from Libgpg-error + + tests: Add attributes to helper functions. + + commit c870cb5d385c1d6e1e28ca481cf9cf44b3bfeea9 + * tests/t-common.h (die, fail, info): Add attributes. + * tests/random.c (die, inf): Ditto. + * tests/pubkey.c (die, fail, info): Add attributes. + * tests/fipsdrv.c (die): Add attribute. + (main): Take care of missing --key,--iv,--dt options. + + Improve robustness and help lint. + + commit 5a5b055b81ee60a22a846bdf2031516b1c24df98 + * cipher/rsa.c (rsa_encrypt): Check for !DATA. + * cipher/md.c (search_oid): Check early for !OID. + (md_copy): Use gpg_err_code_from_syserror. Replace chains of if(!err) + tests. + * cipher/cipher.c (search_oid): Check early for !OID. + * src/misc.c (do_printhex): Allow for BUFFER==NULL even with LENGTH>0. + * mpi/mpicoder.c (onecompl): Allow for A==NULL to help static + analyzers. + + cipher: Improve fatal error message for bad use of gcry_md_read. + + commit 3f98b1e92d5afd720d7cea5b4e8295c5018bf9ac + * cipher/md.c (md_read): Use _gcry_fatal_error instead of BUG. + +2016-06-16 Niibe Yutaka <gniibe@fsij.org> + + ecc: Default cofactor 1 for PUBKEY_FLAG_PARAM. + + commit b0b70e7fe37b1bf13ec0bfc8effcb5c7f5db6b7d + * cipher/ecc.c (ecc_check_secret_key, ecc_sign, ecc_verify) + (ecc_encrypt_raw, ecc_decrypt_raw, compute_keygrip): Set default + cofactor as 1, when not specified. + + ecc: Default cofactor 1 for PUBKEY_FLAG_PARAM. + + commit 0f3a069211d8d24a61aa0dc2cc6c4ef04cc4fab7 + * cipher/ecc.c (ecc_check_secret_key, ecc_sign, ecc_verify) + (ecc_encrypt_raw, ecc_decrypt_raw, compute_keygrip): Set default + cofactor as 1, when not specified. + +2016-06-15 Werner Koch <wk@gnupg.org> + + Release 1.7.1. + + commit 48aa6d6602564d6ba0cef10cf08f9fb0c59b3223 + + + doc: Describe envvars. + + commit c3173bbe3f1a9c73f81a538dd49ccfa0447bfcdc + * doc/gcrypt.texi: Add chapter Configuration. + + random: Change names of debug envvars. + + commit 131b4f0634cee0e5c47d2250c59f51127b10f7b3 + * random/rndunix.c (start_gatherer): Change GNUPG_RNDUNIX_DBG to + GCRYPT_RNDUNIX_DBG, change GNUPG_RNDUNIX_DBG to GCRYPT_RNDUNIX_DBG. + * random/rndw32.c (registry_poll): Change GNUPG_RNDW32_NOPERF to + GCRYPT_RNDW32_NOPERF. + +2016-06-14 Werner Koch <wk@gnupg.org> + + cipher: Assign OIDs to the Serpent cipher. + + commit e13a6a1ba53127af602713d0c2aaa85c94b3cd7e + * cipher/serpent.c (serpent128_oids, serpent192_oids) + (serpent256_oids): New. Add them to the specs blow. + (serpent128_aliases): Add "SERPENT-128". + (serpent256_aliases, serpent192_aliases): New. + + cipher: Assign OIDs to the Serpent cipher. + + commit 6cc2100c00a65dff07b095dea7b32cb5c5cd96d4 + * cipher/serpent.c (serpent128_oids, serpent192_oids) + (serpent256_oids): New. Add them to the specs blow. + (serpent128_aliases): Add "SERPENT-128". + (serpent256_aliases, serpent192_aliases): New. + +2016-06-08 Werner Koch <wk@gnupg.org> + + rsa: Implement blinding also for signing. + + commit 1f769e3e8442bae2f1f73c656920bb2df70153c0 + * cipher/rsa.c (rsa_decrypt): Factor blinding code out to ... + (secret_blinded): new. + (rsa_sign): Use blinding by default. + + random: Remove debug output for getrandom(2) output. + + commit 52cdfb1960808aaad48b5a501bbce0e3141c3961 + * random/rndlinux.c (_gcry_rndlinux_gather_random): Remove debug + output. + + Fix gcc portability on Solaris 9 SPARC boxes. + + commit b766ea14ad1c27d6160531b200cc70aaa479c6dc + * mpi/longlong.h: Use __sparcv8 as alias for __sparc_v8__. + +2016-06-08 Jérémie Courrèges-Anglas <jca@wxcvbn.org> + + Check for compiler SSE4.1 support in PCLMUL CRC code. + + commit dc76313308c184c92eb78452b503405b90fc7ebd + * cipher/crc-intel-pclmul.c: Build PCLMUL CRC implementation only if + compiler supports PCLMUL *and* SSE4.1 + * cipher/crc.c: Ditto + * configure.ac (sse41support, gcry_cv_gcc_inline_asm_sse41): New. + +2016-06-08 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix ecc_verify for cofactor support. + + commit bd39eb9fba47dc8500c83769a679cc8b683d6c6e + * cipher/ecc.c (ecc_verify): Fix the argument for cofactor "h". + +2016-06-08 Werner Koch <wk@gnupg.org> + + random: Try to use getrandom() instead of /dev/urandom (Linux only). + + commit c05837211e5221d3f56146865e823bc20b4ff1ab + * configure.ac: Check for syscall. + * random/rndlinux.c [HAVE_SYSCALL]: Include sys/syscall.h. + (_gcry_rndlinux_gather_random): Use getrandom is available. + +2016-06-03 Werner Koch <wk@gnupg.org> + + rsa: Implement blinding also for signing. + + commit ef6e4d004b10f5740bcd2125fb70e199dd21e3e8 + * cipher/rsa.c (rsa_decrypt): Factor blinding code out to ... + (secret_blinded): new. + (rsa_sign): Use blinding by default. + + random: Remove debug output for getrandom(2) output. + + commit 82df6c63a72fdd969c3923523f10d0cef5713ac7 + * random/rndlinux.c (_gcry_rndlinux_gather_random): Remove debug + output. + +2016-06-02 Werner Koch <wk@gnupg.org> + + Fix gcc portability on Solaris 9 SPARC boxes. + + commit 4121f15122501d8946f1589b303d1f7949c15e30 + * mpi/longlong.h: Use __sparcv8 as alias for __sparc_v8__. + +2016-05-28 Jérémie Courrèges-Anglas <jca@wxcvbn.org> + + Check for compiler SSE4.1 support in PCLMUL CRC code. + + commit 3e8074ecd3a534e8bd7f11cf17f0b22d252584c8 + * cipher/crc-intel-pclmul.c: Build PCLMUL CRC implementation only if + compiler supports PCLMUL *and* SSE4.1 + * cipher/crc.c: Ditto + * configure.ac (sse41support, gcry_cv_gcc_inline_asm_sse41): New. + +2016-05-06 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix ecc_verify for cofactor support. + + commit c7430aa752232aa690c5d8f16575a345442ad8d7 + * cipher/ecc.c (ecc_verify): Fix the argument for cofactor "h". + +2016-04-26 Werner Koch <wk@gnupg.org> + + random: Try to use getrandom() instead of /dev/urandom (Linux only). + + commit ee5a32226a7ca4ab067864e06623fc11a1768900 + * configure.ac: Check for syscall. + * random/rndlinux.c [HAVE_SYSCALL]: Include sys/syscall.h. + (_gcry_rndlinux_gather_random): Use getrandom is available. + +2016-04-19 Werner Koch <wk@gnupg.org> + + asm fix for older gcc versions. + + commit caa9d14c914bf6116ec3f773a322a94e2be0c0fb + * cipher/crc-intel-pclmul.c: Remove extra trailing colon from + asm statements. + + asm fix for older gcc versions. + + commit 4545372c0f8dd35aef2a7abc12b588ed1a4a0363 + * cipher/crc-intel-pclmul.c: Remove extra trailing colon from + asm statements. + +2016-04-15 Werner Koch <wk@gnupg.org> + + Release 1.7.0. + + commit 795f9cb090c776658a0e3117996e3fb7e2ebd94a + + +2016-04-14 Werner Koch <wk@gnupg.org> + + tests: Add test vectors for 256 GiB test of SHA3-256. + + commit 1737c546dc7268fa9edcd4a23b7439c56d37ee4f + * tests/hashtest.c: Add new test vectros. + +2016-04-14 Justus Winter <justus@g10code.com> + + src: Improve S-expression parsing. + + commit 491586bc7f7b9edc6b78331a77e653543983c9e4 + * src/sexp.c (do_vsexp_sscan): Return an error if a closing + parenthesis is encountered with no matching opening parenthesis. + +2016-04-14 Werner Koch <wk@gnupg.org> + + cipher: Add constant for 8 bit CFB mode. + + commit 47c6a1f88eb763e9baa394e34d873b761abcebbe + * src/gcrypt.h.in (GCRY_CIPHER_MODE_CFB8): New. + * tests/basic.c (check_cfb_cipher): Prepare for CFB-8 tests. + + tests: Add a new test for S-expressions. + + commit 88c6b98350193abbdcfb227754979b0c097ee09c + * tests/t-sexp.c (compare_to_canon): New. + (back_and_forth_one): Add another test. + +2016-04-13 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix corner cases for X25519. + + commit 8472b71812e71c69d66e2fcc02a6e21b66755f8b + * cipher/ecc.c (ecc_encrypt_raw): For invalid input, returns + GPG_ERR_INV_DATA instead of aborting with log_fatal. For X25519, + it's not an error, thus, let it return 0. + (ecc_decrypt_raw): Use the flag PUBKEY_FLAG_DJB_TWEAK to distinguish + X25519, not by the name of the curve. + (ecc_decrypt_raw): For invalid input, returns GPG_ERR_INV_DATA instead + of aborting with log_fatal. For X25519, it's not an error by its + definition, but we deliberately let it return the error to detect + looks-like-encrypted-message. + * tests/t-cv25519.c: Add points to record the issue. + +2016-04-12 Werner Koch <wk@gnupg.org> + + cipher: Buffer data from gcry_cipher_authenticate in OCB mode. + + commit b6d2a25a275a35ec4dbd53ecaa9ea0ed7aa99c7b + * cipher/cipher-internal.h (gcry_cipher_handle): Add fields + aad_leftover and aad_nleftover to u_mode.ocb. + * cipher/cipher-ocb.c (_gcry_cipher_ocb_set_nonce): Clear + aad_nleftover. + (_gcry_cipher_ocb_authenticate): Add buffering and facor some code out + to ... + (ocb_aad_finalize): new. + (compute_tag_if_needed): Call new function. + * tests/basic.c (check_ocb_cipher_splitaad): New. + (check_ocb_cipher): Call new function. + (main): Also call check_cipher_modes with --ciper-modes. + +2016-04-12 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix X25519 computation on Curve25519. + + commit ee7e1a0e835f8ffcfbcba2a44abab8632db8fed5 + * cipher/ecc.c (ecc_encrypt_raw): Tweak of bits when + PUBKEY_FLAG_DJB_TWEAK is enabled. + (ecc_decrypt_raw): Return 0 when PUBKEY_FLAG_DJB_TWEAK is enabled. + * tests/t-cv25519.c (test_cv): Update by using gcry_pk_encrypt. + + ecc: Fix initialization of EC context. + + commit 7fbdb99b8c56360adfd1fb4e7f4c95e0f8aa34de + * cipher/ecc.c (test_ecdh_only_keys, ecc_generate) + (ecc_check_secret_key, ecc_encrypt_raw, ecc_decrypt_raw): Initialize + by _gcry_mpi_ec_p_internal_new should carry FLAGS. + +2016-04-06 Werner Koch <wk@gnupg.org> + + Allow building with configure option --enable-hmac-binary-check. + + commit 65c63144b66392f40b991684789b8b793248e3ba + * src/Makefile.am (mpicalc_LDADD): Add DL_LIBS. + * src/fips.c (check_binary_integrity): Allow use of hmac256 output. + * src/hmac256.c (main): Add option --stdkey + +2016-04-06 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Positive values in computation. + + commit 6f386ceae86a058e26294f744750f1ed2a95e604 + * cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Make sure + coefficients A and B are positive. + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_recover_x): For negation, do + "P - T" instead of "-T", so that the result will be positive. + (_gcry_ecc_eddsa_verify): Likewise. + * cipher/ecc.c (ecc_check_secret_key): Use _gcry_ecc_fill_in_curve + instead of _gcry_ecc_update_curve_param. + * mpi/ec.c (ec_subm): Make sure the result will be positive. + (dup_point_edwards, sub_points_edwards, _gcry_mpi_ec_curve_point): Use + mpi_sub instead of mpi_neg. + (add_points_edwards): Simply use ec_addm. + * tests/t-mpi-point.c (test_curve): Define curves with positive + coefficients. + +2016-04-01 Werner Koch <wk@gnupg.org> + + mpi: Explicitly limit the allowed input length for gcry_mpi_scan. + + commit 862cf19a119427dd7ee7959a36c72d905f5ea5ca + * mpi/mpicoder.c (MAX_EXTERN_SCAN_BYTES): New. + (mpi_fromstr): Check against this limit. + (_gcry_mpi_scan): Ditto. + * tests/mpitests.c (test_maxsize): New. + (main): Cal that test. + +2016-03-31 Werner Koch <wk@gnupg.org> + + cipher: Remove specialized rmd160 functions. + + commit fcce0cb6e8af70b134c6ecc3f56afa07a7d31f27 + * cipher/rmd160.c: Replace rmd.h by hash-common.h. + (RMD160_CONTEXT): Move from rmd.h to here. + (_gcry_rmd160_init): Remove. + (_gcry_rmd160_mixblock): Remove. + (_gcry_rmd160_hash_buffer): Use rmd160_init directly. + * cipher/md.c: Remove rmd.h which was not actually used. + * cipher/rmd.h: Remove. + * cipher/Makefile.am (libcipher_la_SOURCES): Remove rmd.h. + * configure.ac (USE_RMD160): Allow to build without RMD160. + + random: Replace RMD160 by SHA-1 for mixing the CSPRNG pool. + + commit a9cbe2d1f6a517a831517da8bc1d29e3e0b2c0c0 + * cipher/sha1.c (_gcry_sha1_mixblock_init): New. + (_gcry_sha1_mixblock): New. + * random/random-csprng.c: Include sha1.h instead of rmd.h. + (mix_pool): Use SHA-1 instead of RIPE-MD-160 for mixing. + + cipher: Move sha1 context definition to a separate file. + + commit 142a479a484cb4e84d0561be9b05b44dac9e6fe2 + * cipher/sha1.c: Replace hash-common.h by sha1.h. + (SHA1_CONTEXT): Move to ... + * cipher/sha1.h: new. Always include all flags. + * cipher/Makefile.am (libcipher_la_SOURCES): Add sha1.h. + +2016-03-29 Werner Koch <wk@gnupg.org> + + tests: Fix buffer overflow in bench-slope. + + commit 48ee918400762281bec5b6fc218a9f0d119aac7c + * tests/bench-slope.c (bench_print_result_std): Remove wrong use of + strncat. + +2016-03-27 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + cipher: GCM: check that length of supplied tag is one of valid lengths. + + commit f2260e3a2e962ac80124ef938e54041bbea08561 + * cipher/cipher-gcm.c (is_tag_length_valid): New. + (_gcry_cipher_gcm_tag): Check that 'outbuflen' has valid tag length. + * tests/basic.c (_check_gcm_cipher): Add test-vectors with different + valid tag lengths and negative test vectors with invalid lengths. + +2016-03-24 Peter Wu <peter@lekensteyn.nl> + + cipher: Fix memleaks in (self)tests. + + commit 4a064e2a06fe737f344d1dfd8a45cc4c2abbe4c9 + * cipher/dsa.c: Release memory for MPI and sexp structures. + * cipher/ecc.c: Release memory for sexp structure. + * tests/keygen.c: Likewise. + + Mark constant MPIs as non-leaked. + + commit 470a30db241a2d567739ef2adb2a2ee64992d8b4 + * mpi/mpiutil.c: Mark "constant" MPIs as explicitly leaked. + +2016-03-23 Werner Koch <wk@gnupg.org> + + Add new control GCRYCTL_GET_TAGLEN for use with gcry_cipher_info. + + commit fea5971488e049f902d7912df22a945bc755ad6d + * src/gcrypt.h.in (GCRYCTL_GET_TAGLEN): New. + * cipher/cipher.c (_gcry_cipher_info): Add GCRYCTL_GET_TAGLEN feature. + + * tests/basic.c (_check_gcm_cipher): Check that new feature. + (_check_poly1305_cipher): Ditto. + (check_ccm_cipher): Ditto. + (do_check_ocb_cipher): Ditto. + (check_ctr_cipher): Add negative test for new feature. + + cipher: Avoid NULL-segv in GCM mode if a key has not been set. + + commit e709d86fe596a4bcf235799468947c13ae657d78 + * cipher/cipher-gcm.c (_gcry_cipher_gcm_encrypt): Check that GHASH_FN + has been initialized. + (_gcry_cipher_gcm_decrypt): Ditto. + (_gcry_cipher_gcm_authenticate): Ditto. + (_gcry_cipher_gcm_initiv): Ditto. + (_gcry_cipher_gcm_tag): Ditto. + + cipher: Check length of supplied tag in _gcry_cipher_poly1305_check_tag. + + commit 7c9c82feecf94a455c66d9c38576f36c9c4b484c + * cipher/cipher-poly1305.c (_gcry_cipher_poly1305_tag): Check that the + provided tag length matches the actual tag length. + +2016-03-23 Peter Wu <peter@lekensteyn.nl> + + Fix buffer overrun in gettag for Poly1305. + + commit 6821e1bd94969106a70e3de17b86f6e6181f4e59 + * cipher/cipher-poly1305.c: copy a fixed length instead of the + user-supplied number. + +2016-03-23 Werner Koch <wk@gnupg.org> + + cipher: Check length of supplied tag in _gcry_cipher_gcm_check_tag. + + commit 15785bc9fb1787554bf371945ecb191830c15bfd + * cipher/cipher-gcm.c (_gcry_cipher_gcm_tag): Check that the provided + tag length matches the actual tag length. Avoid gratuitous return + statements. + +2016-03-23 Peter Wu <peter@lekensteyn.nl> + + Fix buffer overrun in gettag for GCM. + + commit d3d7bdf8215275b3b20690dfde3f43dbe25b6f85 + * cipher/cipher-gcm.c: copy a fixed length instead of the user-supplied + number. + +2016-03-22 Werner Koch <wk@gnupg.org> + + tests: Add options --fips to keygen for manual tests. + + commit d328095dd4de83b839d9d8c4bdbeec0956971016 + (main): Add option --fips. + * tests/keygen.c (check_rsa_keys): Create an 2048 bit key with e=65539 + because that is valid in FIPS mode. Check that key generation fails + for too short keys in FIPS mode. + (check_ecc_keys): Check that key generation fails for Ed25519 keys in + FIPS mode. + +2016-03-22 Tomáš Mráz <tmraz@redhat.com> + + rsa: Add FIPS 186-4 compliant RSA probable prime key generator. + + commit 5f9b3c2e220ca6d0eaff32324a973ef67933a844 + * cipher/primegen.c (_gcry_fips186_4_prime_check): New. + * cipher/rsa.c (generate_fips): New. + (rsa_generate): Use new function in fips mode or with test-parms. + + * tests/keygen.c (check_rsa_keys): Add test using e=65539. + +2016-03-20 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix ARM NEON support detection on ARMv6 target. + + commit 583919d70763671ed9feeaa14e1f66379aff88cc + * configure.ac (gcry_cv_gcc_inline_asm_neon): Use '.arm' directive + instead of '.thumb'. + +2016-03-18 Werner Koch <wk@gnupg.org> + + Always require a 64 bit integer type. + + commit 897ccd21b7221982806b5c024518f4e989152f14 + * configure.ac (available_digests_64): Merge with available_digests. + (available_kdfs_64): Merge with available_kdfs. + <64 bit datatype test>: Bail out if no such type is available. + * src/types.h: Emit #error if no u64 can be defined. + (PROPERLY_ALIGNED_TYPE): Always add u64 type. + * cipher/bithelp.h: Remove all code paths which handle the + case of !HAVE_U64_TYPEDEF. + * cipher/bufhelp.h: Ditto. + * cipher/cipher-ccm.c: Ditto. + * cipher/cipher-gcm.c: Ditto. + * cipher/cipher-internal.h: Ditto. + * cipher/cipher.c: Ditto. + * cipher/hash-common.h: Ditto. + * cipher/md.c: Ditto. + * cipher/poly1305.c: Ditto. + * cipher/scrypt.c: Ditto. + * cipher/tiger.c: Ditto. + * src/g10lib.h: Ditto. + * tests/basic.c: Ditto. + * tests/bench-slope.c: Ditto. + * tests/benchmark.c: Ditto. + +2016-03-18 Vitezslav Cizek <vcizek@suse.com> + + tests: Fix testsuite after the FIPS adjustments. + + commit 9ecc2690181ba0bb44f66451a7dce2fc19965793 + * tests/benchmark.c (ecc_bench): Avoid not approved curves in FIPS. + * tests/curves.c (check_get_params): Skip Brainpool curves in FIPS. + * tests/keygen.c (check_dsa_keys): Generate 2048 and 3072 bits keys. + (check_ecc_keys): Skip Ed25519 in FIPS mode. + * tests/random.c (main): Don't switch DRBG in FIPS mode. + * tests/t-ed25519.c (main): Ed25519 isn't supported in FIPS mode. + * tests/t-kdf.c (check_openpgp): Skip vectors using md5 in FIPS. + * tests/t-mpi-point.c (context_param): Skip P-192 and Ed25519 in FIPS. + (main): Skip math tests that use P-192 and Ed25519 in FIPS. + + tests: Add new --pss option to fipsdrv. + + commit 1a02d741cacc3b57fe3d6ffebd794d53a60c9e97 + * tests/fipsdrv.c (run_rsa_sign, run_rsa_verify): Set salt-length + to 0 for PSS. + + cipher: Add option to specify salt length for PSS verification. + + commit 0bd8137e68c201b6c2290710e348aaf57efa2b2e + * cipher/pubkey-util.c (_gcry_pk_util_data_to_mpi): Check for + salt-length token. + + tests: Add support for RSA keygen tests to fipsdrv. + + commit 2e139456369a834cf87d983da4f61241fda76efe + * tests/fipsdrv.c (run_rsa_keygen): New. + (main): Support RSA keygen and RSA keygen KAT tests. + + tests: Fixes for RSA testsuite in FIPS mode. + + commit c690230af5a66b809f8f6fbab1a6262a5ba078cb + * tests/basic.c (get_keys_new): Generate 2048 bit key. + * tests/benchmark.c (rsa_bench): Skip keys of lengths different + than 2048 and 3072 in FIPS mode. + * tests/keygen.c (check_rsa_keys): Failure if short keys can be + generated in FIPS mode. + (check_dsa_keys): Ditto for DSA keys. + * tests/pubkey.c (check_x931_derived_key): Skip keys < 2048 in FIPS. + + rsa: Use 2048 bit RSA keys for selftest. + + commit 78cec8b4754fdf774edb2d575000cb3e972e244c + * cipher/rsa.c (selftests_rsa): Use 2048 bit keys. + (selftest_encr_1024): Replaced by selftest_encr_2048. + (selftest_sign_1024): Replaced by selftest_sign_2048. + (selftest_encr_2048): Add check against known ciphertext. + (selftest_sign_2048): Add check against known signature. + (selftest_sign_2048): Free SIG_MPI. + * tests/pubkey.c (get_keys_new): Generate 2048 bit keys. + + Disable non-allowed algorithms in FIPS mode. + + commit ce1cbe16992a7340edcf8e6576973e3508267640 + * cipher/cipher.c (_gcry_cipher_init), + * cipher/mac.c (_gcry_mac_init), + * cipher/md.c (_gcry_md_init), + * cipher/pubkey.c (_gcry_pk_init): In the FIPS mode, disable all the + non-allowed ciphers. + * cipher/md5.c: Mark MD5 as not allowed in FIPS. + * src/g10lib.h (_gcry_mac_init): New. + * src/global.c (global_init): Call the new _gcry_mac_init. + * tests/basic.c (check_ciphers): Fix a typo. + +2016-03-18 Werner Koch <wk@gnupg.org> + + kdf: Make PBKDF2 check work on all platforms. + + commit c478cf175887c84dc071c4f73a7667603b354789 + * cipher/kdf.c (_gcry_kdf_pkdf2): Chnage DKLEN to unsigned long. + +2016-03-18 Vitezslav Cizek <vcizek@suse.com> + + kdf: Add upper bound for derived key length in PBKDF2. + + commit 0f741b0704bac5c0e2d2a0c2b34b44b35baa76d6 + * cipher/kdf.c (_gcry_kdf_pkdf2): limit dkLen. + + ecc: ECDSA adjustments for FIPS 186-4. + + commit a242e3d9185e6e2dc13902ea9331131755bbba01 + * cipher/ecc-curves.c: Unmark curve P-192 for FIPS. + * cipher/ecc.c: Add ECDSA self test. + * cipher/pubkey-util.c (_gcry_pk_util_init_encoding_ctx): Use SHA-2 + in FIPS mode. + * tests/fipsdrv.c: Add support for ECDSA signatures. + +2016-03-18 Werner Koch <wk@gnupg.org> + + dsa: Make regression tests work. + + commit e40939b2141306238cc30a340b867b60fa4dc2a3 + * cipher/dsa.c (sample_secret_key_1024): Comment out unused constant. + (ogenerate_fips186): Make it work with use-fips183-2 flag. + * cipher/primegen.c (_gcry_generate_fips186_3_prime): Use Emacs + standard comment out format. + * tests/fips186-dsa.c (check_dsa_gen_186_3): New dummy fucntion. + (main): Call it. + (main): Compare against current version. + * tests/pubkey.c (get_dsa_key_fips186_new): Create 2048 bit key. + (get_dsa_key_fips186_with_seed_new): Ditto. + (get_dsa_key_fips186_with_domain_new): Comment out. + (check_run): Do not call that function. + +2016-03-18 Vitezslav Cizek <vcizek@suse.com> + + dsa: Adjustments to conform with FIPS 186-4. + + commit 80e9f95e6f419daa765e4876c858e3e36e808897 + * cipher/dsa.c (generate_fips186): FIPS 186-4 adjustments. + * cipher/primegen.c (_gcry_generate_fips186_3_prime): Fix incorrect + buflen passed to _gcry_mpi_scan. + +2016-03-16 Justus Winter <justus@g10code.com> + + Update documentation for 'gcry_sexp_extract_param'. + + commit 4051fe7fec6ffdc7a2f5c3856665478866991ee7 + * doc/gcrypt.texi (gcry_sexp_extract_param): Mention that all MIPs + must be set to NULL first, and document how the function behaves in + case of errors. + * src/sexp.c (_gcry_sexp_extract_param): Likewise. + * src/gcrypt.h.in (gcry_sexp_extract_param): Copy the comment from + '_gcry_sexp_extract_param'. + + cipher: Update comment. + + commit fcf4358a7a7ba8d32bf385ea99ced5f47cbd3ae2 + * cipher/ecc.c (ecc_get_nbits): Update comment to reflect the fact + that a curve parameter can be given. + +2016-03-12 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add Intel PCLMUL implementations of CRC algorithms. + + commit 5d601dd57fcb41aa2015ab655fd6fc51537da667 + * cipher/Makefile.am: Add 'crc-intel-pclmul.c'. + * cipher/crc-intel-pclmul.c: New. + * cipher/crc.c (USE_INTEL_PCLMUL): New macro. + (CRC_CONTEXT) [USE_INTEL_PCLMUL]: Add 'use_pclmul'. + [USE_INTEL_PCLMUL] (_gcry_crc32_intel_pclmul) + (gcry_crc24rfc2440_intel_pclmul): New. + (crc32_init, crc32rfc1510_init, crc24rfc2440_init) + [USE_INTEL_PCLMUL]: Select PCLMUL implementation if SSE4.1 and PCLMUL + HW features detected. + (crc32_write, crc24rfc2440_write) [USE_INTEL_PCLMUL]: Use PCLMUL + implementation if enabled. + (crc24_init): Document storage format of 24-bit CRC. + (crc24_next4): Use only 'data' for last table look-up. + * configure.ac: Add 'crc-intel-pclmul.lo'. + * src/g10lib.h (HWF_*, HWF_INTEL_SSE4_1): Update HWF flags to include + Intel SSE4.1. + * src/hwf-x86.c (detect_x86_gnuc): Add SSE4.1 detection. + * src/hwfeatures.c (hwflist): Add 'intel-sse4.1'. + * tests/basic.c (fillbuf_count): New. + (check_one_md): Add "?" check (million byte data-set with byte pattern + 0x00,0x01,0x02,...); Test all buffer sizes 1 to 1000, for "!" and "?" + checks. + (check_one_md_multi): Skip "?". + (check_digests): Add "?" test-vectors for MD5, SHA1, SHA224, SHA256, + SHA384, SHA512, SHA3_224, SHA3_256, SHA3_384, SHA3_512, RIPEMD160, + CRC32, CRC32_RFC1510, CRC24_RFC2440, TIGER1 and WHIRLPOOL; Add "!" + test-vectors for CRC32_RFC1510 and CRC24_RFC2440. + +2016-02-25 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Normalize EXPO for mpi_powm. + + commit fdfa5bfefdde316688a3c8021bd3528c5273b0f4 + * mpi/mpi-pow.c (gcry_mpi_powm): Normalize EP. + +2016-02-22 Andreas Metzler <ametzler@bebt.de> + + Do not ship generated header file in tarball. + + commit 2b40a16333fa75f1cee85ab901a5aa9cff845a92 + * src/Makefile.am: Move gcrypt.h from include_HEADERS to + nodist_include_HEADERS to prevent inclusion in release tarball. + This could break out-of-tree-builds because the potentially outdated + src/gcrypt.h was not updated but was in the compiler search path. + +2016-02-20 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix building random-drbg for Win32/64. + + commit 531b25aa94c58f6d2168a9537c8cea6c53d7bbe0 + * random/random-drbg.c: Remove include for sys/types.h and asm/types.h. + (DRBG_PREDICTION_RESIST, DRBG_CTRAES, DRBG_CTRSERPENT, DRBG_CTRTWOFISH) + (DRBG_HASHSHA1, DRBG_HASHSHA224, DRBG_HASHSHA256, DRBG_HASHSHA384) + (DRBG_HASHSHA512, DRBG_HMAC, DRBG_SYM128, DRBG_SYM192) + (DRBG_SYM256): Change 'u_int32_t' to 'u32'. + (drbg_get_entropy) [USE_RNDUNIX, USE_RNDW32]: Fix parameters + 'drbg_read_cb' and 'len'. + +2016-02-20 Werner Koch <wk@gnupg.org> + + tests: Do not test DRBG_REINIT from "make check" + + commit 839d12c221430b60db5e0d6fbb107f22e0a6837f + * tests/random.c (main): Run check_drbg_reinit only if the envvar + GCRYPT_IN_REGRESSION_TEST is set. + + doc: Fix possible dependency problem. + + commit 3b57e5a1ba68e26dcaea38b763287fddba9b6b7c + * doc/Makefile.am (gcrypt.texi): Use the right traget. + +2016-02-19 Stephan Mueller <smueller@chronox.de> + + random: Remove ANSI X9.31 DRNG. + + commit e9b692d25d1c149b5417b70e18f2ce173bc25b6d + * random-fips.c: Remove. + +2016-02-19 Werner Koch <wk@gnupg.org> + + random: Add a test case for DRBG_REINIT. + + commit 934ba2ae5a95a96fdbb3b935b51ba43df66f11df + * src/global.c (_gcry_vcontrol) <DRBG_REINIT>: Test for FIPS RNG. + * tests/random.c (check_drbg_reinit): New. + (main): Call new test. + + random: Allow DRBG_REINIT before initialization. + + commit 7cdbd6e6a3cf1ee366b981e148d41b1187a6fdcf + * random/random-drbg.c (DRBG_DEFAULT_TYPE): New. + (_drbg_init_internal): Set the default type if no type has been set + before. + (_gcry_rngdrbg_inititialize): Pass 0 for flags to use the default. + + Add new private header gcrypt-testapi.h. + + commit 744b030cff61fd25114b0b25394c62782c153343 + * src/gcrypt-testapi.h: New. + * src/Makefile.am (libgcrypt_la_SOURCES): Add new file. + * random/random.h: Include gcrypt-testapi.h. + (struct gcry_drbg_test_vector) : Move to gcrypt-testapi.h. + * src/global.c: Include gcrypt-testapi.h. + (_gcry_vcontrol): Use PRIV_CTL_* constants instead of 58, 59, 60, 61. + * cipher/cipher.c: Include gcrypt-testapi.h. + (_gcry_cipher_ctl): Use PRIV_CIPHERCTL_ constants instead of 61, 62. + * tests/fipsdrv.c: Include gcrypt-testapi.h. Remove definition of + PRIV_CTL_ constants and replace their use by the new PRIV_CIPHERCTL_ + constants. + * tests/t-lock.c: Include gcrypt-testapi.h. Remove + PRIV_CTL_EXTERNAL_LOCK_TEST and EXTERNAL_LOCK_TEST_ constants. + + * random/random-drbg.c (gcry_rngdrbg_cavs_test): Rename to ... + (_gcry_rngdrbg_cavs_test): this. + (gcry_rngdrbg_healthcheck_one): Rename to ... + (_gcry_rngdrbg_healthcheck_one): this. + + random: Make the DRBG C-90 clean and use a flag string. + + commit 95f1db3affb9f5b8a2c814c211d4a02b30446c15 + * random/random.h (struct gcry_drbg_test_vector): Rename "flags" to + "flagstr" and turn it into a string. + * random/random-drbg.c (drbg_test_pr, drbg_test_nopr): Replace use of + designated initializers. Use a string for the flags. + (gcry_rngdrbg_cavs_test): Parse the flag string into a flag value. + (drbg_healthcheck_sanity): Ditto. + + random: Symbol name cleanup for random-drbg.c. + + commit 85ed07790552297586258e8fe09b546eee357a8b + * random/random-drbg.c: Rename all static objects and macros from + "gcry_drbg" to "drbg". + (drbg_string_t): New typedef. + (drbg_gen_t): New typedef. + (drbg_state_t): New typedef. Replace all "struct drbg_state_s *" by + this. + (_drbg_init_internal): Replace xcalloc_secure by xtrycalloc_secure so + that an error if actually returned. + (gcry_rngdrbg_cavs_test): Ditto. + (gcry_drbg_healthcheck_sanity): Ditto. + + random: Use our symbol name pattern also for drbg functions. + + commit 7cf3c929331133e4381dbceac53d3addd921c929 + * random/random-drbg.c: Rename global functions from _gcry_drbg_* + to _gcry_rngdrbg_*. + * random/random.c: Adjust for this change. + * src/global.c: Ditto. + + random: Rename drbg.c to random-drbg.c. + + commit e49b3f2c10e012509b5930c0df4d6df378d3b9f4 + * random/drbg.c: Rename to ... + * random/random-drbg.c: this. + * random/Makefile.am (librandom_la_SOURCES): Adjust accordingly. + + random: Remove the new API introduced by the new DRBG. + + commit dfac2b13d0068b2b1b420d77e9771a49964b81c1 + * src/gcrypt.h.in (struct gcry_drbg_gen): Move to random/drbg.c. + (struct gcry_drbg_string): Ditto. + (gcry_drbg_string_fill): Ditto. + (gcry_randomize_drbg): Remove. + * random/drbg.c (parse_flag_string): New. + (_gcry_drbg_reinit): Change the way the arguments are passed. + * src/global.c (_gcry_vcontrol) <GCRYCTL_DRBG_REINIT>: Change calling + convention. + + Add helper function _gcry_strtokenize. + + commit 4e134b6e77f558730ec1eceb6b816b0bcfd845e9 + * src/misc.c (_gcry_strtokenize): New. + +2016-02-18 Werner Koch <wk@gnupg.org> + + random: Remove DRBG constants from the public API. + + commit fd13372fa9069d3a72947ea59c57e33637c936bf + * src/gcrypt.h.in (GCRY_DRBG_): Remove all new flags to ... + * random/drbg.c: here. + +2016-02-18 Stephan Mueller <smueller@chronox.de> + + random: Add SP800-90A DRBG. + + commit ed57fed6de1465e02ec5e3bc0affeabdd35e2eb7 + * random/drbg.c: New. + * random/random.c (_gcry_random_initialize): Replace rngfips init by + drbg init. + (__gcry_random_close_fds): Likewise. + (_gcry_random_dump_stats): Likewise. + (_gcry_random_is_faked): Likewise. + (do_randomize): Likewise. + (_gcry_random_selftest): Likewise. + (_gcry_create_nonce): Replace rngfips_create_noce by drbg_randomize. + (_gcry_random_init_external_test): Remove. + (_gcry_random_run_external_test): Remove. + (_gcry_random_deinit_external_test): Remove. + * random/random.h (struct gcry_drbg_test_vector): New. + * src/gcrypt.h.in (struct gcry_drbg_gen): New. + (struct gcry_drbg_string): New. + (gcry_drbg_string_fill): New. + (gcry_randomize_drbg): New. + (GCRY_DRBG_): Lots of new macros. + * src/global.c (_gcry_vcontrol) <Init external random test>: Turn into + a nop. + (_gcry_vcontrol) <Deinit external random test>: Ditto. + (_gcry_vcontrol) <Run external random test>: Change. + (_gcry_vcontrol) <GCRYCTL_DRBG_REINIT>: New. + +2016-02-13 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + bufhelp: disable unaligned memory accesses on powerpc. + + commit 1da793d089b65ac8c1ead65dacb6b8699f5b6e69 + * cipher/bufhelp.h (BUFHELP_FAST_UNALIGNED_ACCESS): Disable for + __powerpc__ and __powerpc64__. + +2016-02-12 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Not validate input point for Curve25519. + + commit 7a019bc7ecdbdfdef51094e090ce95e062da9b64 + * cipher/ecc.c (ecc_decrypt_raw): Curve25519 is an exception. + +2016-02-10 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix memory leaks on error. + + commit b12dd550fd6af687ef95c584d0d8366c34965cc8 + * cipher/ecc.c (ecc_decrypt_raw): Go to leave to release memory. + * mpi/ec.c (_gcry_mpi_ec_curve_point): Likewise. + +2016-02-09 NIIBE Yutaka <gniibe@fsij.org> + + ecc: input validation on ECDH. + + commit 23b72901f8a5ba9a78485b235c7a917fbc8faae0 + * cipher/ecc.c (ecc_decrypt_raw): Validate the point. + +2016-02-08 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add ARM assembly implementation of SHA-512. + + commit 8353884bc65c820d5bcacaf1ac23cdee72091a09 + * cipher/Makefile.am: Add 'sha512-arm.S'. + * cipher/sha512-arm.S: New. + * cipher/sha512.c (USE_ARM_ASM): New. + (_gcry_sha512_transform_arm): New. + (transform) [USE_ARM_ASM]: Use ARM assembly implementation instead of + generic. + * configure.ac: Add 'sha512-arm.lo'. + +2016-02-03 NIIBE Yutaka <gniibe@fsij.org> + + tests: Add a test for Curve25519. + + commit b8b3361504950689ef1e779fb3357cecf8a9f739 + * tests/Makefile.am (tests_bin): Add t-cv25519. + * tests/t-cv25519.c: New. + +2016-02-02 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix Curve25519 for data by older implementation. + + commit 6cb6df9dddac6ad246002b83c2ce0aaa0ecf30e5 + * cipher/ecc-misc.c (gcry_ecc_mont_decodepoint): Fix code path for + short length data. + + ecc: more fix of Curve25519. + + commit 48ba5a50066611ecacea850ced13f5cb66097a81 + * cipher/ecc-misc.c (gcry_ecc_mont_decodepoint): Fix removing of + prefix. Clear the MSB, according to RFC7748. + + ecc: Fix ECDH of Curve25519. + + commit a2f9afcd7fcdafd5951498b07f34957f9766dce9 + * cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Fix calc of NBITS + and prefix detection. + * cipher/ecc.c (ecc_generate): Use NBITS instead of CTX->NBITS. + (ecc_encrypt_raw): Use NBITS from curve instead of from P. + Fix rawmpilen calculation. + (ecc_decrypt_raw): Likewise. Add debug output. + +2016-01-29 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Improve performance of generic SHA256 implementation. + + commit f3e51161036382429c3491c7c881f36c0a653c7b + * cipher/sha256.c (R): Let caller do variable shuffling. + (Chro, Maj, Sum0, Sum1): Convert from inline functions to macros. + (W, I): New. + (transform_blk): Unroll round loop; inline message expansion to rounds + to make message expansion buffer smaller. + +2016-01-28 Werner Koch <wk@gnupg.org> + + ecc: New API function gcry_mpi_ec_decode_point. + + commit 2cf2ca7bb9741ac86e8aa92d8f03b1c5f5938897 + * mpi/ec.c (_gcry_mpi_ec_decode_point): New. + * cipher/ecc-common.h: Move two prototypes to ... + * src/ec-context.h: here. + * src/gcrypt.h.in (gcry_mpi_ec_decode_point): New. + * src/libgcrypt.def (gcry_mpi_ec_decode_point): New. + * src/libgcrypt.vers (gcry_mpi_ec_decode_point): New. + * src/visibility.c (gcry_mpi_ec_decode_point): New. + * src/visibility.h: Add new function. + +2016-01-15 Werner Koch <wk@gnupg.org> + + Fix build problem for rndegd.c. + + commit 191c2e4fe2dc0e00f61aa44e011a9596887e6ce1 + * Makefile.am (DISTCHECK_CONFIGURE_FLAGS): Test all RND modules. + * random/rndegd.c (_gcry_rndegd_connect_socket) + (my_make_filename): Use functions with '_' prefix. + + random: Fix possible AIX problem with sysconf in rndunix. + + commit 6303b0e83856ee89374b447e710f0ab2af61caec + * random/rndunix.c [HAVE_STDINT_H]: Include stdint.h. + (start_gatherer): Detect misbehaving sysconf. + +2015-12-27 Werner Koch <wk@gnupg.org> + + random: Take at max 25% from RDRAND. + + commit 5a78e7f15e0dd96a8bf64e2bb142880bf8ea6965 + * random/rndlinux.c (_gcry_rndlinux_gather_random): Change use of + RDRAND from 50% to 25%. + +2015-12-07 Justus Winter <justus@g10code.com> + + cipher: Improve error handling. + + commit b9c02fbeb7efb7d0593b33485fb30c298291cf80 + * cipher/ecc.c (ecc_decrypt_raw): Improve error handling. + + cipher: Initialize 'flags'. + + commit ca06cd7f77acb317c2649c58918908f043dfe6bd + * cipher/ecc.c (ecc_encrypt_raw): Initialize 'flags' to 0. + +2015-12-05 NIIBE Yutaka <gniibe@fsij.org> + + ecc: CHANGE point representation of Curve25519. + + commit dd3d06e7f113cf7608f060ceb043262efd0b0c9d + * cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Decode point with + the prefix 0x40, additional 0x00 by MPI handling, and shorter octets + by MPI normalization. + * cipher/ecc.c (ecc_generate, ecc_encrypt_raw, ecc_decrypt_raw): + Always add the prefix 0x40. + +2015-12-03 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + chacha20: fix alignment of self-test context. + + commit 6fadbcd088e2af3e48407b95d8d0c2a8b7ad6c38 + * cipher/chacha20.c (selftest): Ensure 16-byte alignment for chacha20 + context structure. + + salsa20: fix alignment of self-test context. + + commit 2cba0dbda462237f55438d4199eccd10c5e3f6ca + * cipher/salsa20.c (selftest): Ensure 16-byte alignment for salsa20 + context structure. + +2015-12-02 Justus Winter <justus@g10code.com> + + random: Drop fake entropy gathering function. + + commit d421ac283ec46d0ecaf6278ba4c24843f65fb2fa + * random/random-csprng.c (faked_rng): Drop variable. + (gather_faked): Drop prototype and function. + (initialize): Drop fallback code. + (_gcry_rngcsprng_is_faked): Change accordingly. + + random: Fix selection of entropy gathering function. + + commit 468a5796ffb1a7776db4004d534376c1b981d740 + * random/random-csprng.c (getfnc_gather_random): Do return NULL if no + usable entropy gathering function is found. The callsite then + installs the fake gather function. + +2015-11-26 NIIBE Yutaka <gniibe@fsij.org> + + ecc: minor improvement of point multiplication. + + commit 3658afd09c3b03b4398aaa5748387220c93b1a94 + * mpi/ec.c (_gcry_mpi_ec_mul_point): Move ec_subm out of the loop. + +2015-11-25 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Constant-time multiplication for Weierstrass curve. + + commit 88e1358962e902ff1cbec8d53ba3eee46407851a + * mpi/ec.c (_gcry_mpi_ec_mul_point): Use simple left-to-right binary + method for Weierstrass curve when SCALAR is secure. + + mpi: fix gcry_mpi_swap_cond. + + commit f88adee3e1f3e2de7d63f92f90bfb3078afd3b4f + * mpi/mpiutil.c (_gcry_mpi_swap_cond): Relax the condition. + + mpi: Fix mpi_set_cond and mpi_swap_cond . + + commit 8ad682c412047d3b9196950709dbd7bd14ac8732 + * mpi/mpiutil.c (_gcry_mpi_set_cond, _gcry_mpi_swap_cond): Don't use + the operator of !!, but assume SET/SWAP is 0 or 1. + + ecc: multiplication of Edwards curve to be constant-time. + + commit 295b1c3540752af4fc5e6f41480e6db215222fba + * mpi/ec.c (_gcry_mpi_ec_mul_point): Use point_swap_cond. + + ecc: Add point_resize and point_swap_cond. + + commit b6015176df6bfae107ac82f9baa29ef2c175c9f9 + * mpi/ec.c (point_resize, point_swap_cond): New. + (_gcry_mpi_ec_mul_point): Use point_resize and point_swap_cond. + +2015-11-18 Justus Winter <justus@g10code.com> + + cipher: Fix error handling. + + commit 940dc8adc034a6c6c38742f6bfd7d837a532d537 + * cipher/cipher.c (_gcry_cipher_ctl): Fix error handling. + +2015-11-18 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Tweak Keccak for small speed-up. + + commit 6571a64331839d7d952292163afbf34c8bef62e0 + * cipher/keccak_permute_32.h (KECCAK_F1600_PERMUTE_FUNC_NAME): Track + rounds with round constant pointer instead of separate round counter. + * cipher/keccak_permute_64.h (KECCAK_F1600_PERMUTE_FUNC_NAME): Ditto. + (KECCAK_F1600_ABSORB_FUNC_NAME): Tweak lanes pointer increment for bulk + absorb loops. + + Update license information for CRC. + + commit 15ea0acf8bb0aa307eccc23024a0bd7878fb8080 + * LICENSES: Remove 'Simple permissive' and 'IETF permissive' licenses + for 'cipher/crc.c' as result of rewrite of CRC implementations. + +2015-11-17 Justus Winter <justus@g10code.com> + + Fix typos found using codespell. + + commit 0e395944b70c7a92a6437f6bcc14f287c19ce9de + * cipher/cipher-ocb.c: Fix typos. + * cipher/des.c: Likewise. + * cipher/dsa-common.c: Likewise. + * cipher/ecc.c: Likewise. + * cipher/pubkey.c: Likewise. + * cipher/rsa-common.c: Likewise. + * cipher/scrypt.c: Likewise. + * random/random-csprng.c: Likewise. + * random/random-fips.c: Likewise. + * random/rndw32.c: Likewise. + * src/cipher-proto.h: Likewise. + * src/context.c: Likewise. + * src/fips.c: Likewise. + * src/gcrypt.h.in: Likewise. + * src/global.c: Likewise. + * src/sexp.c: Likewise. + * tests/mpitests.c: Likewise. + * tests/t-lock.c: Likewise. + +2015-11-01 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Improve performance of Tiger hash algorithms. + + commit 89fa74d6b3e58cd4fcd6e0939a35e46cbaca2ea0 + * cipher/tiger.c (tiger_round, pass, key_schedule): Convert functions + to macros. + (transform_blk): Pass variable names instead of pointers to 'pass'. + + Add ARMv7/NEON implementation of Keccak. + + commit a1cc7bb15473a2419b24ecac765ae0ce5989a13b + * cipher/Makefile.am: Add 'keccak-armv7-neon.S'. + * cipher/keccak-armv7-neon.S: New. + * cipher/keccak.c (USE_64BIT_ARM_NEON): New. + (NEED_COMMON64): Select if USE_64BIT_ARM_NEON. + [NEED_COMMON64] (round_consts_64bit): Rename to... + [NEED_COMMON64] (_gcry_keccak_round_consts_64bit): ...this; Add + terminator at end. + [USE_64BIT_ARM_NEON] (_gcry_keccak_permute_armv7_neon) + (_gcry_keccak_absorb_lanes64_armv7_neon, keccak_permute64_armv7_neon) + (keccak_absorb_lanes64_armv7_neon, keccak_armv7_neon_64_ops): New. + (keccak_init) [USE_64BIT_ARM_NEON]: Select ARM/NEON implementation + if supported by HW. + * cipher/keccak_permute_64.h (KECCAK_F1600_PERMUTE_FUNC_NAME): Update + to use new round constant table. + * configure.ac: Add 'keccak-armv7-neon.lo'. + + Optimize Keccak 64-bit absorb functions. + + commit 2857cb89c6dc1c02266600bc1fd2967a3cd5cf88 + * cipher/keccak.c [USE_64BIT] [__x86_64__] (absorb_lanes64_8) + (absorb_lanes64_4, absorb_lanes64_2, absorb_lanes64_1): New. + * cipher/keccak.c [USE_64BIT] [!__x86_64__] (absorb_lanes64_8) + (absorb_lanes64_4, absorb_lanes64_2, absorb_lanes64_1): New. + [USE_64BIT] (KECCAK_F1600_ABSORB_FUNC_NAME): New. + [USE_64BIT] (keccak_absorb_lanes64): Remove. + [USE_64BIT_SHLD] (KECCAK_F1600_ABSORB_FUNC_NAME): New. + [USE_64BIT_SHLD] (keccak_absorb_lanes64_shld): Remove. + [USE_64BIT_BMI2] (KECCAK_F1600_ABSORB_FUNC_NAME): New. + [USE_64BIT_BMI2] (keccak_absorb_lanes64_bmi2): Remove. + * cipher/keccak_permute_64.h (KECCAK_F1600_ABSORB_FUNC_NAME): New. + +2015-10-31 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Enable CRC test vectors with zero bytes. + + commit 07e4839e75a7bca3a6c0a94aecfe75efe61d7ff2 + * tests/basic.c (check_digests): Enable CRC test-vectors with zero + bytes. + + Keccak: Add SHAKE Extendable-Output Functions. + + commit c0b9eee2d93a13930244f9ce0c14ed6b4aeb6c29 + * src/hash-common.c (_gcry_hash_selftest_check_one): Add handling for + XOFs. + * src/keccak.c (keccak_ops_t): Rename 'extract_inplace' to 'extract' + and add 'pos' argument. + (KECCAK_CONTEXT): Add 'suffix'. + (keccak_extract_inplace64): Rename to... + (keccak_extract64): ...this; Add handling for 'pos' argument. + (keccak_extract_inplace32bi): Rename to... + (keccak_extract32bi): ...this; Add handling for 'pos' argument. + (keccak_extract_inplace64): Rename to... + (keccak_extract64): ...this; Add handling for 'pos' argument. + (keccak_extract_inplace32bi_bmi2): Rename to... + (keccak_extract32bi_bmi2): ...this; Add handling for 'pos' argument. + (keccak_init): Setup 'suffix'; add SHAKE128 & SHAKE256. + (shake128_init, shake256_init): New. + (keccak_final): Do not initial permute for SHAKE output; use correct + suffix for SHAKE. + (keccak_extract): New. + (keccak_selftests_keccak): Add SHAKE128 & SHAKE256 test-vectors. + (run_selftests): Add SHAKE128 & SHAKE256. + (shake128_asn, oid_spec_shake128, shake256_asn, oid_spec_shake256) + (_gcry_digest_spec_shake128, _gcry_digest_spec_shake256): New. + * cipher/md.c (digest_list): Add SHAKE128 & SHAKE256. + * doc/gcrypt.texi: Ditto. + * src/cipher.h (_gcry_digest_spec_shake128) + (_gcry_digest_spec_shake256): New. + * src/gcrypt.h.in (GCRY_MD_SHAKE128, GCRY_MD_SHAKE256): New. + * tests/basic.c (check_one_md): Add XOF check; Add 'elen' argument. + (check_one_md_multi): Skip if algo is XOF. + (check_digests): Add SHAKE128 & SHAKE256 test vectors. + * tests/bench-slope.c (kdf_bench_one): Skip XOFs. + + Few updates to documentation. + + commit 28de6f9e16e386018e81a9cdaee596be7616ccab + * doc/gcrypt.text: Add mention of new 'intel-fast-shld' hw feature + flag; Add mention of x86 RDRAND support in rndhw. + + Add HMAC-SHA3 test vectors. + + commit 92ad19873562cfce7bcc4a0b5aed8195d8284cfc + * tests/basic.c (check_mac): Add HMAC_SHA3 test vectors. + +2015-10-28 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + md: add variable length output interface. + + commit 577dc2b63ceca6a8a716256d034ea4e7414f65fa + * cipher/crc.c (_gcry_digest_spec_crc32) + (_gcry_digest_spec_crc32_rfc1510, _gcry_digest_spec_crc24_rfc2440): Set + 'extract' NULL. + * cipher/gostr3411-94.c (_gcry_digest_spec_gost3411_94) + (_gcry_digest_spec_gost3411_cp): Ditto. + * cipher/keccak.c (_gcry_digest_spec_sha3_224) + (_gcry_digest_spec_sha3_256, _gcry_digest_spec_sha3_384) + (_gcry_digest_spec_sha3_512): Ditto. + * cipher/md2.c (_gcry_digest_spec_md2): Ditto. + * cipher/md4.c (_gcry_digest_spec_md4): Ditto. + * cipher/md5.c (_gcry_digest_spec_md5): Ditto. + * cipher/rmd160.c (_gcry_digest_spec_rmd160): Ditto. + * cipher/sha1.c (_gcry_digest_spec_sha1): Ditto. + * cipher/sha256.c (_gcry_digest_spec_sha224) + (_gcry_digest_spec_sha256): Ditto. + * cipher/sha512.c (_gcry_digest_spec_sha384) + (_gcry_digest_spec_sha512): Ditto. + * cipher/stribog.c (_gcry_digest_spec_stribog_256) + (_gcry_digest_spec_stribog_512): Ditto. + * cipher/tiger.c (_gcry_digest_spec_tiger) + (_gcry_digest_spec_tiger1, _gcry_digest_spec_tiger2): Ditto. + * cipher/whirlpool.c (_gcry_digest_spec_whirlpool): Ditto. + * cipher/md.c (md_enable): Do not allow combination of HMAC and + 'expandable-output function'. + (md_final): Check if spec->read is NULL before calling. + (md_read): Ditto. + (md_extract, _gcry_md_extract): New. + * doc/gcrypt.texi: Add SHA3 algorithms and gcry_md_extract. + * src/cipher-proto.h (gcry_md_extract_t): New. + (gcry_md_spec_t): Add 'extract'. + * src/gcrypt-int.g (_gcry_md_extract): New. + * src/gcrypt.h.in (gcry_md_extract): New. + * src/libgcrypt.def: Add gcry_md_extract. + * src/libgcrypt.vers: Add gcry_md_extract. + * src/visibility.c (gcry_md_extract): New. + * src/visibility.h (gcry_md_extract): New. + + md: check hmac flag in prepare_macpads. + + commit cee2e122ec6c1886957a8d47498eb63a6a921725 + * cipher/md.c (prepare_macpads): Check hmac flag. + + keccak: rewrite for improved performance. + + commit 74184c28fbe7ff58cf57f0094ef957d94045da7d + * cipher/Makefile.am: Add 'keccak_permute_32.h' and + 'keccak_permute_64.h'. + * cipher/hash-common.h [USE_SHA3] (MD_BLOCK_MAX_BLOCKSIZE): Remove. + * cipher/keccak.c (USE_64BIT, USE_32BIT, USE_64BIT_BMI2) + (USE_64BIT_SHLD, USE_32BIT_BMI2, NEED_COMMON64, NEED_COMMON32BI) + (keccak_ops_t): New. + (KECCAK_STATE): Add 'state64' and 'state32bi' members. + (KECCAK_CONTEXT): Remove 'bctx'; add 'blocksize', 'count' and 'ops'. + (rol64, keccak_f1600_state_permute): Remove. + [NEED_COMMON64] (round_consts_64bit, keccak_extract_inplace64): New. + [NEED_COMMON32BI] (round_consts_32bit, keccak_extract_inplace32bi) + (keccak_absorb_lane32bi): New. + [USE_64BIT] (ANDN64, ROL64, keccak_f1600_state_permute64) + (keccak_absorb_lanes64, keccak_generic64_ops): New. + [USE_64BIT_SHLD] (ANDN64, ROL64, keccak_f1600_state_permute64_shld) + (keccak_absorb_lanes64_shld, keccak_shld_64_ops): New. + [USE_64BIT_BMI2] (ANDN64, ROL64, keccak_f1600_state_permute64_bmi2) + (keccak_absorb_lanes64_bmi2, keccak_bmi2_64_ops): New. + [USE_32BIT] (ANDN64, ROL64, keccak_f1600_state_permute32bi) + (keccak_absorb_lanes32bi, keccak_generic32bi_ops): New. + [USE_32BIT_BMI2] (ANDN64, ROL64, keccak_f1600_state_permute32bi_bmi2) + (pext, pdep, keccak_absorb_lane32bi_bmi2, keccak_absorb_lanes32bi_bmi2) + (keccak_extract_inplace32bi_bmi2, keccak_bmi2_32bi_ops): New. + (keccak_write): New. + (keccak_init): Adjust to KECCAK_CONTEXT changes; add implementation + selection based on HWF features. + (keccak_final): Adjust to KECCAK_CONTEXT changes; use selected 'ops' + for state manipulation. + (keccak_read): Adjust to KECCAK_CONTEXT changes. + (_gcry_digest_spec_sha3_224, _gcry_digest_spec_sha3_256) + (_gcry_digest_spec_sha3_348, _gcry_digest_spec_sha3_512): Use + 'keccak_write' instead of '_gcry_md_block_write'. + * cipher/keccak_permute_32.h: New. + * cipher/keccak_permute_64.h: New. + + hwf-x86: add detection for Intel CPUs with fast SHLD instruction. + + commit 909644ef5883927262366c356eed530e55aba478 + * cipher/sha1.c (sha1_init): Use HWF_INTEL_FAST_SHLD instead of + HWF_INTEL_CPU. + * cipher/sha256.c (sha256_init, sha224_init): Ditto. + * cipher/sha512.c (sha512_init, sha384_init): Ditto. + * src/g10lib.h (HWF_INTEL_FAST_SHLD): New. + (HWF_INTEL_BMI2, HWF_INTEL_SSSE3, HWF_INTEL_PCLMUL, HWF_INTEL_AESNI) + (HWF_INTEL_RDRAND, HWF_INTEL_AVX, HWF_INTEL_AVX2) + (HWF_ARM_NEON): Update. + * src/hwf-x86.c (detect_x86_gnuc): Add detection of Intel Core + CPUs with fast SHLD/SHRD instruction. + * src/hwfeatures.c (hwflist): Add "intel-fast-shld". + + Fix OCB amd64 assembly implementations for x32. + + commit 16fd540f4d01eb6dc23d9509ae549353617c7a67 + * cipher/camellia-glue.c (_gcry_camellia_aesni_avx_ocb_enc) + (_gcry_camellia_aesni_avx_ocb_dec, _gcry_camellia_aesni_avx_ocb_auth) + (_gcry_camellia_aesni_avx2_ocb_enc, _gcry_camellia_aesni_avx2_ocb_dec) + (_gcry_camellia_aesni_avx2_ocb_auth, _gcry_camellia_ocb_crypt) + (_gcry_camellia_ocb_auth): Change 'Ls' from pointer array to u64 array. + * cipher/serpent.c (_gcry_serpent_sse2_ocb_enc) + (_gcry_serpent_sse2_ocb_dec, _gcry_serpent_sse2_ocb_auth) + (_gcry_serpent_avx2_ocb_enc, _gcry_serpent_avx2_ocb_dec) + (_gcry_serpent_ocb_crypt, _gcry_serpent_ocb_auth): Ditto. + * cipher/twofish.c (_gcry_twofish_amd64_ocb_enc) + (_gcry_twofish_amd64_ocb_dec, _gcry_twofish_amd64_ocb_auth) + (twofish_amd64_ocb_enc, twofish_amd64_ocb_dec, twofish_amd64_ocb_auth) + (_gcry_twofish_ocb_crypt, _gcry_twofish_ocb_auth): Ditto. + + bench-slope: add KDF/PBKDF2 benchmark. + + commit ae40af427fd2a856b24ec2a41323ec8b80ffc9c0 + * tests/bench-slope.c (bench_kdf_mode, bench_kdf_init, bench_kdf_free) + (bench_kdf_do_bench, kdf_ops, kdf_bench_one, kdf_bench): New. + (print_help): Add 'kdf'. + (main): Add KDF benchmarks. + +2015-10-22 NIIBE Yutaka <gniibe@fsij.org> + + md: keep contexts for HMAC in GcryDigestEntry. + + commit f7505b550dd591e33d3a3fab9277c43c460f1bad + * cipher/md.c (struct gcry_md_context): Add flags.hmac. + Remove macpads and mcpads_Bsize. + (md_open): Initialize flags.hmac. Remove macpads initialization. + (md_enable): Allocate contexts when flags.hmac is enabled. + (md_copy): Remove macpads copying. Add copying contexts. + (_gcry_md_reset): When flags.hmac is enabled, restore precomputed + context with input pad + (md_close): Remove macpads wiping. + (md_final): When flags.hmac is enabled, compute hmac by precomputed + context with output pad. + (prepare_macpads): Prepare precomputed contexts with input pad and + output pad for each registered digest entry. + (_gcry_md_setkey): Just call prepare_macpads. + +2015-10-15 NIIBE Yutaka <gniibe@fsij.org> + + Fix double free on error. + + commit 1c6d2698a84e4bf82735287c1d64954bfc1a1982 + * src/hmac256.c (_gcry_hmac256_finalize): Don't free HD. + +2015-10-14 NIIBE Yutaka <gniibe@fsij.org> + + Fix gpg_error_t and gpg_err_code_t confusion. + + commit 813565a07ca575c87e1252c6ed26018653ecd338 + * src/gcrypt-int.h (_gcry_sexp_extract_param): Revert the change. + * cipher/dsa.c (dsa_check_secret_key): Ditto. + * src/sexp.c (_gcry_sexp_extract_param): Return gpg_err_code_t. + + * src/gcrypt-int.h (_gcry_err_make_from_errno) + (_gcry_error_from_errno): Return gpg_error_t. + * cipher/cipher.c (_gcry_cipher_open_internal) + (_gcry_cipher_ctl, _gcry_cipher_ctl): Don't use gcry_error. + * src/global.c (_gcry_vcontrol): Likewise. + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_genkey): Use + gpg_err_code_from_syserror. + * cipher/mac.c (mac_reset, mac_setkey, mac_setiv, mac_write) + (mac_read, mac_verify): Return gcry_err_code_t. + * cipher/rsa-common.c (mgf1): Use gcry_err_code_t for ERR. + * src/visibility.c (gcry_error_from_errno): Return gpg_error_t. + +2015-10-13 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix compiling AES/AES-NI implementation on linux-i386. + + commit fa94b6111948a614ebdcb67f7942eced8b84c579 + * cipher/rijndael-aesni.c (do_aesni_ctr_4): Split assembly block in + two parts to reduce number of register constraints needed. + +2015-10-13 NIIBE Yutaka <gniibe@fsij.org> + + Fix declaration of return type. + + commit 73374fdd27c7ba28b19f9672c68a6f5b72252fe5 + * src/gcrypt-int.h (_gcry_sexp_extract_param): Return gpg_error_t. + * cipher/dsa.c (dsa_generate): Fix call to _gcry_sexp_extract_param. + * src/g10lib.h (_gcry_vcontrol): Return gcry_err_code_t. + * src/visibility.c (gcry_mpi_snatch): Fix call to _gcry_mpi_snatch. + +2015-09-07 Werner Koch <wk@gnupg.org> + + Improve GCRYCTL_DISABLE_PRIV_DROP by also disabling cap_ calls. + + commit 3a3d5410cc83f7069c7cb1ab384905f382292d32 + * src/secmem.c (lock_pool, secmem_init): Do not call any cap_ + functions if NO_PRIV_DROP is set. + +2015-09-04 Werner Koch <wk@gnupg.org> + + w32: Avoid a few compiler warnings. + + commit e97c62a4a687b56d00a2d0a63e072a977f8eb81c + * cipher/cipher-selftest.c (_gcry_selftest_helper_cbc) + (_gcry_selftest_helper_cfb, _gcry_selftest_helper_ctr): Mark variable + as unused. + * random/rndw32.c (slow_gatherer): Avoid signed pointer mismatch + warning. + * src/secmem.c (init_pool): Avoid unused variable warning. + * tests/random.c (writen, readn): Include on if needed. + + w32: Fix alignment problem with AESNI on Windows >= 8. + + commit e2785a2268702312529521df3bd2f4e6b43cea3a + * cipher/cipher-selftest.c (_gcry_cipher_selftest_alloc_ctx): New. + * cipher/rijndael.c (selftest_basic_128, selftest_basic_192) + (selftest_basic_256): Allocate context on the heap. + +2015-08-31 Werner Koch <wk@gnupg.org> + + rsa: Add verify after sign to avoid Lenstra's CRT attack. + + commit c17f84bd02d7ee93845e92e20f6ddba814961588 + * cipher/rsa.c (rsa_sign): Check the CRT. + + Add pubkey algo id for EdDSA. + + commit dd87639abd38afc91a6f27af33f0ba17402ad02d + * src/gcrypt.h.in (GCRY_PK_EDDSA): New. + +2015-08-25 Werner Koch <wk@gnupg.org> + + Add configure option --enable-build-timestamp. + + commit a785cc3db0c4e8eb8ebbf784b833a40d2c42ec3e + * configure.ac (BUILD_TIMESTAMP): Set to "<none>" by default. + +2015-08-23 Werner Koch <wk@gnupg.org> + + tests: Add missing files for the make distcheck target. + + commit fb3cb47b0a29d3e73150297aa4495c20915e4a75 + * tests/Makefile.am (EXTRA_DIST): Add sha3-x test vector files. + +2015-08-19 Werner Koch <wk@gnupg.org> + + Change SHA-3 algorithm ids. + + commit 65639ecaaeba642e40487446c40d045482001285 + * src/gcrypt.h.in (GCRY_MD_SHA3_224, GCRY_MD_SHA3_256) + (GCRY_MD_SHA3_384, GCRY_MD_SHA3_512): Change values. + +2015-08-12 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Keccak: Fix array indexes in θ step. + + commit 48822ae0b436bcea0fe92dbf0d88475ba3179320 + * cipher/keccak.c (keccak_f1600_state_permute): Fix indexes for D[5]. + + Simplify OCB offset calculation for parallel implementations. + + commit 24ebf53f1e8a8afa27dcd768339bda70a740bb03 + * cipher/camellia-glue.c (_gcry_camellia_ocb_crypt) + (_gcry_camellia_ocb_auth): Precalculate Ls array always, instead of + just if 'blkn % <parallel blocks> == 0'. + * cipher/serpent.c (_gcry_serpent_ocb_crypt) + (_gcry_serpent_ocb_auth): Ditto. + * cipher/rijndael-aesni.c (get_l): Remove low-bit checks. + (aes_ocb_enc, aes_ocb_dec, _gcry_aes_aesni_ocb_auth): Handle leading + blocks until block counter is multiple of 4, so that parallel block + processing loop can use 'c->u_mode.ocb.L' array directly. + * tests/basic.c (check_ocb_cipher_largebuf): Rename to... + (check_ocb_cipher_largebuf_split): ...this and add option to process + large buffer as two split buffers. + (check_ocb_cipher_largebuf): New. + + Add carryless 8-bit addition fast-path for AES-NI CTR mode. + + commit e11895da1f4af9782d89e92ba2e6b1a63235b54b + * cipher/rijndael-aesni.c (do_aesni_ctr_4): Do addition using + CTR in big-endian form, if least-significant byte does not overflow. + +2015-08-10 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add additional SHA3 test-vectors. + + commit 80321eb3a63a20f86734d6eebb3f419c0ec895aa + * tests/basic.c (check_digests): Allow datalen to be specified so that + input data can have byte with value 0x00; Include sha3-*.h header files + to test-vector structure. + * tests/sha3-224.h: New. + * tests/sha3-256.h: New. + * tests/sha3-384.h: New. + * tests/sha3-512.h: New. + + Add generic SHA3 implementation. + + commit 434ba17d1d5ad59c70d721ad3ecb376c2403a7e5 + * cipher/hash-common.h (MD_BLOCK_MAX_BLOCKSIZE): Increase blocksize + USE_SHA3 enabled. + * cipher/keccak.c (SHA3_DELIMITED_SUFFIX, SHAKE_DELIMITED_SUFFIX): New. + (KECCAK_STATE): Add proper state. + (KECCAK_CONTEXT): Add 'outlen'. + (rol64, keccak_f1600_state_permute, transform_blk, transform): New. + (keccak_init): Add proper initialization. + (keccak_final): Add proper finalization. + (selftests_keccak): Add selftests. + (oid_spec_sha3_224, oid_spec_sha3_256, oid_spec_sha3_384) + (oid_spec_sha3_512): Add OID. + (_gcry_digest_spec_sha3_224, _gcry_digest_spec_sha3_256) + (_gcry_digest_spec_sha3_384, _gcry_digest_spec_sha3_512): Fix output + length. + * cipher/mac-hmac.c (map_mac_algo_to_md): Fix mapping for SHA3-512. + (hmac_get_keylen): Return proper blocksizes for SHA3 algorithms. + [USE_SHA3] (_gcry_mac_type_spec_hmac_sha3_224) + (_gcry_mac_type_spec_hmac_sha3_256, _gcry_mac_type_spec_hmac_sha3_384) + (_gcry_mac_type_spec_hmac_sha3_512): New. + * cipher/mac-internal [USE_SHA3] (_gcry_mac_type_spec_hmac_sha3_224) + (_gcry_mac_type_spec_hmac_sha3_256, _gcry_mac_type_spec_hmac_sha3_384) + (_gcry_mac_type_spec_hmac_sha3_512): New. + * cipher/mac.c (mac_list) [USE_SHA3]: Add SHA3 algorithms. + * cipher/md.c (md_open): Use proper SHA-3 blocksizes for HMAC macpads. + * tests/basic.c (check_digests): Add SHA3 test vectors. + + Optimize OCB offset calculation. + + commit 49f52c67fb42c0656c8f9af655087f444562ca82 + * cipher/cipher-internal.h (ocb_get_l): New. + * cipher/cipher-ocb.c (_gcry_cipher_ocb_authenticate) + (ocb_crypt): Use 'ocb_get_l' instead of '_gcry_cipher_ocb_get_l'. + * cipher/camellia-glue.c (get_l): Remove. + (_gcry_camellia_ocb_crypt, _gcry_camellia_ocb_auth): Precalculate + offset array when block count matches parallel operation size; Use + 'ocb_get_l' instead of 'get_l'. + * cipher/rijndael-aesni.c (get_l): Add fast path for 75% most common + offsets. + (aesni_ocb_enc, aesni_ocb_dec, _gcry_aes_aesni_ocb_auth): Precalculate + offset array when block count matches parallel operation size. + * cipher/rijndael-ssse3-amd64.c (get_l): Add fast path for 75% most + common offsets. + * cipher/rijndael.c (_gcry_aes_ocb_crypt, _gcry_aes_ocb_auth): Use + 'ocb_get_l' instead of '_gcry_cipher_ocb_get_l'. + * cipher/serpent.c (get_l): Remove. + (_gcry_serpent_ocb_crypt, _gcry_serpent_ocb_auth): Precalculate + offset array when block count matches parallel operation size; Use + 'ocb_get_l' instead of 'get_l'. + * cipher/twofish.c (get_l): Remove. + (_gcry_twofish_ocb_crypt, _gcry_twofish_ocb_auth): Use 'ocb_get_l' + instead of 'get_l'. + +2015-08-10 NIIBE Yutaka <gniibe@fsij.org> + + ecc: fix Montgomery curve bugs. + + commit ce746936b6c210e602d106cfbf45cf60b408d871 + * cipher/ecc.c (check_secret_key): Y1 should not be NULL when check. + (ecc_check_secret_key): Support Montgomery curve. + * mpi/ec.c (_gcry_mpi_ec_curve_point): Fix condition. + +2015-08-08 Werner Koch <wk@gnupg.org> + + Add framework to eventually support SHA3. + + commit 0e17f7a05bba309a87811992aa47a77af9935b99 + * src/gcrypt.h.in (GCRY_MD_SHA3_224, GCRY_MD_SHA3_256) + (GCRY_MD_SHA3_384, GCRY_MD_SHA3_512): New. + (GCRY_MAC_HMAC_SHA3_224, GCRY_MAC_HMAC_SHA3_256) + (GCRY_MAC_HMAC_SHA3_384, GCRY_MAC_HMAC_SHA3_512): New. + * cipher/keccak.c: New with stub functions. + * cipher/Makefile.am (EXTRA_libcipher_la_SOURCES): Add keccak.c. + * configure.ac (available_digests): Add sha3. + (USE_SHA3): New. + * src/fips.c (run_hmac_selftests): Add SHA3 to the required selftests. + * cipher/md.c (digest_list) [USE_SHA3]: Add standard SHA3 algos. + (md_open): Ditto for hmac processing. + * cipher/mac-hmac.c (map_mac_algo_to_md): Add mapping. + * cipher/hmac-tests.c (run_selftests): Prepare for tests. + * cipher/pubkey-util.c (get_hash_algo): Add "sha3-xxx". + +2015-08-06 Werner Koch <wk@gnupg.org> + + tools: Fix memory leak for functions "I" and "G". + + commit 10789e3cdda7b944acb4b59624c34a2ccfaea6e5 + * src/mpicalc.c (do_inv, do_gcd): Init A after stack check. + +2015-08-06 Ismo Puustinen <ismo.puustinen@intel.com> + + ecc: Free memory also when in error branch. + + commit 1d896371fbc94c605fce35eabcde01e24dd22892 + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_sign): Init DISGEST and goto + leave on error. + +2015-08-06 NIIBE Yutaka <gniibe@fsij.org> + + Add Curve25519 support. + + commit e93f4c21c59756604440ad8cbf27e67d29c99ffd + * cipher/ecc-curves.c (curve_aliases, domain_parms): Add Curve25519. + * tests/curves.c (N_CURVES): It's 22 now. + * src/cipher.h (PUBKEY_FLAG_DJB_TWEAK): New. + * cipher/ecc-common.h (_gcry_ecc_mont_decodepoint): New. + * cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): New. + * cipher/ecc.c (nist_generate_key): Handle the case of + PUBKEY_FLAG_DJB_TWEAK and Montgomery curve. + (test_ecdh_only_keys, check_secret_key): Likewise. + (ecc_generate): Support Curve25519 which is Montgomery curve with flag + PUBKEY_FLAG_DJB_TWEAK and PUBKEY_FLAG_COMP. + (ecc_encrypt_raw): Get flags from KEYPARMS and handle + PUBKEY_FLAG_DJB_TWEAK and Montgomery curve. + (ecc_decrypt_raw): Likewise. + (compute_keygrip): Handle the case of PUBKEY_FLAG_DJB_TWEAK. + * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist): + PUBKEY_FLAG_EDDSA implies PUBKEY_FLAG_DJB_TWEAK. + Parse "djb-tweak" for PUBKEY_FLAG_DJB_TWEAK. + +2015-07-27 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Reduce code size for Twofish key-setup and remove key dependend branch. + + commit b4b1d872ba651bc44761b35d245b1a519a33f515 + * cipher/twofish.c (poly_to_exp): Increase size by one, change type + from byte to u16 and insert '492' to index 0. + (exp_to_poly): Increase size by 256, let new cells have zero value. + (CALC_S): Execute unconditionally with help of modified tables. + (do_twofish_setkey): Change type for 'tmp' to 'unsigned int'; Un-unroll + CALC_K256 and CALC_K phases to reduce generated object size. + + Reduce amount of duplicated code in OCB bulk implementations. + + commit e950052bc6f5ff11a7c23091ff3f6b5cc431e875 + * cipher/cipher-ocb.c (_gcry_cipher_ocb_authenticate) + (ocb_crypt): Change bulk function to return number of unprocessed + blocks. + * src/cipher.h (_gcry_aes_ocb_crypt, _gcry_aes_ocb_auth) + (_gcry_camellia_ocb_crypt, _gcry_camellia_ocb_auth) + (_gcry_serpent_ocb_crypt, _gcry_serpent_ocb_auth) + (_gcry_twofish_ocb_crypt, _gcry_twofish_ocb_auth): Change return type + to 'size_t'. + * cipher/camellia-glue.c (get_l): Only if USE_AESNI_AVX or + USE_AESNI_AVX2 defined. + (_gcry_camellia_ocb_crypt, _gcry_camellia_ocb_auth): Change return type + to 'size_t' and return remaining blocks; Remove unaccelerated common + code path. Enable remaining common code only if USE_AESNI_AVX or + USE_AESNI_AVX2 defined; Remove unaccelerated common code. + * cipher/rijndael.c (_gcry_aes_ocb_crypt, _gcry_aes_ocb_auth): Change + return type to 'size_t' and return zero. + * cipher/serpent.c (get_l): Only if USE_SSE2, USE_AVX2 or USE_NEON + defined. + (_gcry_serpent_ocb_crypt, _gcry_serpent_ocb_auth): Change return type + to 'size_t' and return remaining blocks; Remove unaccelerated common + code path. Enable remaining common code only if USE_SSE2, USE_AVX2 or + USE_NEON defined; Remove unaccelerated common code. + * cipher/twofish.c (get_l): Only if USE_AMD64_ASM defined. + (_gcry_twofish_ocb_crypt, _gcry_twofish_ocb_auth): Change return type + to 'size_t' and return remaining blocks; Remove unaccelerated common + code path. Enable remaining common code only if USE_AMD64_ASM defined; + Remove unaccelerated common code. + + Add bulk OCB for Serpent SSE2, AVX2 and NEON implementations. + + commit adbdca0d58f9c06dc3850b95e3455e179c1e6960 + * cipher/cipher.c (_gcry_cipher_open_internal): Setup OCB bulk + functions for Serpent. + * cipher/serpent-armv7-neon.S: Add OCB assembly functions. + * cipher/serpent-avx2-amd64.S: Add OCB assembly functions. + * cipher/serpent-sse2-amd64.S: Add OCB assembly functions. + * cipher/serpent.c (_gcry_serpent_sse2_ocb_enc) + (_gcry_serpent_sse2_ocb_dec, _gcry_serpent_sse2_ocb_auth) + (_gcry_serpent_neon_ocb_enc, _gcry_serpent_neon_ocb_dec) + (_gcry_serpent_neon_ocb_auth, _gcry_serpent_avx2_ocb_enc) + (_gcry_serpent_avx2_ocb_dec, _gcry_serpent_avx2_ocb_auth): New + prototypes. + (get_l, _gcry_serpent_ocb_crypt, _gcry_serpent_ocb_auth): New. + * src/cipher.h (_gcry_serpent_ocb_crypt) + (_gcry_serpent_ocb_auth): New. + * tests/basic.c (check_ocb_cipher): Add test-vector for serpent. + + Add bulk OCB for Twofish AMD64 implementation. + + commit 7f6804c37c4b41d85fb26aa723b1c41e4a3cf278 + * cipher/cipher.c (_gcry_cipher_open_internal): Setup OCB bulk + functions for Twofish. + * cipher/twofish-amd64.S: Add OCB assembly functions. + * cipher/twofish.c (_gcry_twofish_amd64_ocb_enc) + (_gcry_twofish_amd64_ocb_dec, _gcry_twofish_amd64_ocb_auth): New + prototypes. + (call_sysv_fn5, call_sysv_fn6, twofish_amd64_ocb_enc) + (twofish_amd64_ocb_dec, twofish_amd64_ocb_auth, get_l) + (_gcry_twofish_ocb_crypt, _gcry_twofish_ocb_auth): New. + * src/cipher.h (_gcry_twofish_ocb_crypt) + (_gcry_twofish_ocb_auth): New. + * tests/basic.c (check_ocb_cipher): Add test-vector for Twofish. + + Add bulk OCB for Camellia AES-NI/AVX and AES-NI/AVX2 implementations. + + commit bb088c6b1620504fdc79e89af27c2bf3fb02b4b4 + * cipher/camellia-aesni-avx-amd64.S: Add OCB assembly functions. + * cipher/camellia-aesni-avx2-amd64.S: Add OCB assembly functions. + * cipher/camellia-glue.c (_gcry_camellia_aesni_avx_ocb_enc) + (_gcry_camellia_aesni_avx_ocb_dec, _gcry_camellia_aesni_avx_ocb_auth) + (_gcry_camellia_aesni_avx2_ocb_enc, _gcry_camellia_aesni_avx2_ocb_dec) + (_gcry_camellia_aesni_avx2_ocb_auth): New prototypes. + (get_l, _gcry_camellia_ocb_crypt, _gcry_camellia_ocb_auth): New. + * cipher/cipher.c (_gcry_cipher_open_internal): Setup OCB bulk + functions for Camellia. + * src/cipher.h (_gcry_camellia_ocb_crypt) + (_gcry_camellia_ocb_auth): New. + * tests/basic.c (check_ocb_cipher): Add test-vector for Camellia. + +2015-07-26 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add OCB bulk mode for AES SSSE3 implementation. + + commit 620e1e0300c79943a1846a49563b04386dc60546 + * cipher/rijndael-ssse3-amd64.c (SSSE3_STATE_SIZE): New. + [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS] (vpaes_ssse3_prepare): Use + 'ssse3_state' for storing current SSSE3 state. + [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS] + (vpaes_ssse3_cleanup): Restore SSSE3 state from 'ssse3_state'. + (_gcry_aes_ssse3_do_setkey, _gcry_aes_ssse3_prepare_decryption) + (_gcry_aes_ssse3_encrypt, _gcry_aes_ssse3_cfb_enc) + (_gcry_aes_ssse3_cbc_enc, _gcry_aes_ssse3_ctr_enc) + (_gcry_aes_ssse3_decrypt, _gcry_aes_ssse3_cfb_dec) + (_gcry_aes_ssse3_cbc_dec, _gcry_aes_ssse3_cbc_dec): Add 'ssse3_state' + array. + (get_l, ssse3_ocb_enc, ssse3_ocb_dec, _gcry_aes_ssse3_ocb_crypt) + (_gcry_aes_ssse3_ocb_auth): New. + * cipher/rijndael.c (_gcry_aes_ssse3_ocb_crypt) + (_gcry_aes_ssse3_ocb_auth): New. + (_gcry_aes_ocb_crypt, _gcry_aes_ocb_auth) [USE_SSSE3]: Use SSSE3 + implementation for OCB. + +2015-07-26 Peter Wu <peter@lekensteyn.nl> + + Fix undefined behavior wrt memcpy. + + commit 46c072669eb81ed610cc5b3c0dc0c75a143afbb4 + * cipher/cipher-gcm.c: Do not copy zero bytes from an empty buffer. Let + the function continue to add padding as needed though. + * cipher/mac-poly1305.c: If the caller requested to finish the hash + function without a copy of the result, return immediately. + +2015-07-23 Peter Wu <peter@lekensteyn.nl> + + build: ignore scissor line for the commit-msg hook. + + commit ada0a7d302cca97b327faaacac7a5d0b8043df88 + * build-aux/git-hooks/commit-msg: Stop processing more lines when the + scissor line is encountered. + +2015-07-16 Peter Wu <peter@lekensteyn.nl> + + rsa: Fix error in comments. + + commit 9cd55e8e948f0049cb23495f536decf797d072f7 + * cipher/rsa.c: Fix. + +2015-07-14 Peter Wu <peter@lekensteyn.nl> + + sexp: Fix invalid deallocation in error path. + + commit 0f9532b186c1e0b54d7e7a6d76bce82b6226122b + * src/sexp.c: Fix wrong condition. + +2015-07-10 Peter Wu <peter@lekensteyn.nl> + + ecc: fix memory leak. + + commit 2a7aa3ea4d03a9c808d5888f5509c08cd27aa27c + * cipher/ecc.c (ecc_verify): Release memory which was allocated before + by _gcry_pk_util_preparse_sigval. + (ecc_decrypt_raw): Likewise. + +2015-07-06 NIIBE Yutaka <gniibe@fsij.org> + + ecc: fix memory leaks. + + commit 0a7547e487a8bc4e7ac9599c55579eb2e4a13f06 + cipher/ecc.c (ecc_generate): Fix memory leak on error of + _gcry_pk_util_parse_flaglist and _gcry_ecc_eddsa_encodepoint. + (ecc_check_secret_key): Fix memory leak on error of + _gcry_ecc_update_curve_param. + (ecc_sign, ecc_verify, ecc_encrypt_raw, ecc_decrypt_raw): Remove + unnecessary sexp_release and fix memory leak on error of + _gcry_ecc_fill_in_curve. + (ecc_decrypt_raw): Fix double free of the point kG and memory leak + on error of _gcry_ecc_os2ec. + +2015-06-11 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Support FreeBSD 10 or later. + + commit a36ee7501f68ad7ebcfe31f9659430b9d2c3ddd1 + * mpi/config.links: Include FreeBSD 10 to 29. + +2015-05-21 Werner Koch <wk@gnupg.org> + + ecc: Add key generation flag "no-keytest". + + commit 2bddd947fd1c11b4ec461576db65a5e34fea1b07 + * src/cipher.h (PUBKEY_FLAG_NO_KEYTEST): New. + * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist): Add flag + "no-keytest". Return an error for invalid flags of length 10. + + * cipher/ecc.c (nist_generate_key): Replace arg random_level by flags + set random level depending on flags. + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_genkey): Ditto. + * cipher/ecc.c (ecc_generate): Pass flags to generate fucntion and + remove var random_level. + (nist_generate_key): Implement "no-keytest" flag. + + * tests/keygen.c (check_ecc_keys): Add tests for transient-key and + no-keytest. + + ecc: Avoid double conversion to affine coordinates in keygen. + + commit 102d68b3bd77813a3ff989526855bb1e283bf9d7 + * cipher/ecc.c (nist_generate_key): Add args r_x and r_y. + (ecc_generate): Rename vars. Convert to affine coordinates only if + not returned by the lower level generation function. + + random: Change initial extra seeding from 2400 bits to 128 bits. + + commit 8124e357b732a719696bfd5271def4e528f2a1e1 + * random/random-csprng.c (read_pool): Reduce initial seeding. + +2015-05-14 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Enable AMD64 Twofish implementation on WIN64. + + commit 9b0c6c8141ae9bd056392a3f6b5704b505fc8501 + * cipher/twofish-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/twofish.c (USE_AMD64_ASM): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS] (call_sysv_fn): New. + (twofish_amd64_encrypt_block, twofish_amd64_decrypt_block) + (twofish_amd64_ctr_enc, twofish_amd64_cbc_dec) + (twofish_amd64_cfb_dec): New wrapper functions for AMD64 + assembly functions. + + Enable AMD64 Serpent implementations on WIN64. + + commit eb0ed576893b6c7990dbcb568510f831d246cea6 + * cipher/serpent-avx2-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/serpent-sse2-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/chacha20.c (USE_SSE2, USE_AVX2): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + [USE_SSE2 || USE_AVX2] (ASM_FUNC_ABI): New. + (_gcry_serpent_sse2_ctr_enc, _gcry_serpent_sse2_cbc_dec) + (_gcry_serpent_sse2_cfb_dec, _gcry_serpent_avx2_ctr_enc) + (_gcry_serpent_avx2_cbc_dec, _gcry_serpent_avx2_cfb_dec): Add + ASM_FUNC_ABI. + + Enable AMD64 Salsa20 implementation on WIN64. + + commit 12bc93ca8187b8061c2e705427ef22f5a71d29b0 + * cipher/salsa20-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/salsa20.c (USE_AMD64): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + [USE_AMD64] (ASM_FUNC_ABI, ASM_EXTRA_STACK): New. + (_gcry_salsa20_amd64_keysetup, _gcry_salsa20_amd64_ivsetup) + (_gcry_salsa20_amd64_encrypt_blocks): Add ASM_FUNC_ABI. + [USE_AMD64] (salsa20_core): Add ASM_EXTRA_STACK. + (salsa20_do_encrypt_stream) [USE_AMD64]: Add ASM_EXTRA_STACK. + + Enable AMD64 Poly1305 implementations on WIN64. + + commit 8d7de4dbf7732c6eb9e9853ad7c19c89075ace6f + * cipher/poly1305-avx2-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/poly1305-sse2-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/poly1305-internal.h (POLY1305_SYSV_FUNC_ABI): New. + (POLY1305_USE_SSE2, POLY1305_USE_AVX2): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (OPS_FUNC_ABI): New. + (poly1305_ops_t): Use OPS_FUNC_ABI. + * cipher/poly1305.c (_gcry_poly1305_amd64_sse2_init_ext) + (_gcry_poly1305_amd64_sse2_finish_ext) + (_gcry_poly1305_amd64_sse2_blocks, _gcry_poly1305_amd64_avx2_init_ext) + (_gcry_poly1305_amd64_avx2_finish_ext) + (_gcry_poly1305_amd64_avx2_blocks, _gcry_poly1305_armv7_neon_init_ext) + (_gcry_poly1305_armv7_neon_finish_ext) + (_gcry_poly1305_armv7_neon_blocks, poly1305_init_ext_ref32) + (poly1305_blocks_ref32, poly1305_finish_ext_ref32) + (poly1305_init_ext_ref8, poly1305_blocks_ref8) + (poly1305_finish_ext_ref8): Use OPS_FUNC_ABI. + + Enable AMD64 3DES implementation on WIN64. + + commit b65e9e71d5ee992db5c96793c6af999545daad28 + * cipher/des-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/des.c (USE_AMD64_ASM): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS] (call_sysv_fn): New. + (tripledes_ecb_crypt) [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS]: Call + assembly function through 'call_sysv_fn'. + (tripledes_amd64_ctr_enc, tripledes_amd64_cbc_dec) + (tripledes_amd64_cfb_dec): New wrapper functions for bulk + assembly functions. + + Enable AMD64 ChaCha20 implementations on WIN64. + + commit 9597cfddf03c467825da152be5ca0d12a8c30d88 + * cipher/chacha20-avx2-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/chacha20-sse2-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/chacha20-ssse3-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/chacha20.c (USE_SSE2, USE_SSSE3, USE_AVX2): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ASM_FUNC_ABI, ASM_EXTRA_STACK): New. + (chacha20_blocks_t, _gcry_chacha20_amd64_sse2_blocks) + (_gcry_chacha20_amd64_ssse3_blocks, _gcry_chacha20_amd64_avx2_blocks) + (_gcry_chacha20_armv7_neon_blocks, chacha20_blocks): Add ASM_FUNC_ABI. + (chacha20_core): Add ASM_EXTRA_STACK. + + Enable AMD64 CAST5 implementation on WIN64. + + commit 6a6646df80386204675d8b149ab60e74d7ca124c + * cipher/cast5-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (RIP): Remove. + (GET_EXTERN_POINTER): Use 'leaq' version on WIN64. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/cast5.c (USE_AMD64_ASM): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS] (call_sysv_fn): New. + (do_encrypt_block, do_decrypt_block) + [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS]: Call assembly + function through 'call_sysv_fn'. + (cast5_amd64_ctr_enc, cast5_amd64_cbc_dec) + (cast5_amd64_cfb_dec): New wrapper functions for bulk + assembly functions. + + Enable AMD64 Camellia implementations on WIN64. + + commit 9a4fb3709864bf3e3918800d44ff576590cd4e92 + * cipher/camellia-aesni-avx-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/camellia-aesni-avx2-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/camellia-glue.c (USE_AESNI_AVX, USE_AESNI_AVX2): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + [USE_AESNI_AVX || USE_AESNI_AVX2] (ASM_FUNC_ABI, ASM_EXTRA_STACK): New. + (_gcry_camellia_aesni_avx_ctr_enc, _gcry_camellia_aesni_avx_cbc_dec) + (_gcry_camellia_aesni_avx_cfb_dec, _gcry_camellia_aesni_avx_keygen) + (_gcry_camellia_aesni_avx2_ctr_enc, _gcry_camellia_aesni_avx2_cbc_dec) + (_gcry_camellia_aesni_avx2_cfb_dec): Add ASM_FUNC_ABI. + + Enable AMD64 Blowfish implementation on WIN64. + + commit e05682093ffb003b589a697428d918d755ac631d + * cipher/blowfish-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/blowfish.c (USE_AMD64_ASM): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS] (call_sysv_fn): New. + (do_encrypt, do_encrypt_block, do_decrypt_block) + [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS]: Call assembly + function through 'call_sysv_fn'. + (blowfish_amd64_ctr_enc, blowfish_amd64_cbc_dec) + (blowfish_amd64_cfb_dec): New wrapper functions for bulk + assembly functions. + .. + + Enable AMD64 arcfour implementation on WIN64. + + commit c46b015bedba7ce0db68929bd33a86a54ab3d919 + * cipher/arcfour-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/arcfour.c (USE_AMD64_ASM): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (do_encrypt, do_decrypt) [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS]: Use + assembly block to call AMD64 assembly function. + + Update documentation for Poly1305-ChaCha20 AEAD, RFC-7539. + + commit ee8fc4edcb3466b03246c8720b90731bf274ff1d + * cipher/cipher-poly1305.c: Add RFC-7539 to header. + * doc/gcrypt.texi: Update Poly1305 AEAD documentation with mention of + RFC-7539; Drop Salsa from supported stream ciphers for Poly1305 AEAD. + + hwf-x86: use edi for passing value to ebx for i386 cpuid. + + commit bac42c68b069f17abcca810a21439c7233815747 + * src/hwf-x86.c [__i386__] (get_cpuid): Use '=D' for regs[1] instead + of '=r'. + + hwf-x86: add EDX as output register for xgetbv asm block. + + commit e15beb584a5ebdfc363e1ff15f87102508652d71 + * src/hwf-x86.c (get_xgetbv): Add EDX as output. + +2015-05-04 Werner Koch <wk@gnupg.org> + + build: Update build-aux files. + + commit 5a7d55eed3316f40ca61acbee032bfc285e28803 + + + Fix possible regression on old 32 bit mingw compilers. + + commit 090ca7435156b5f52064357dd59059570d466f46 + * acinclude.m4: Add new pattern for mingw32. + + build: Add new file. + + commit 4af52b2e72ce004b7d8f99e09c4324e3c2a84379 + * mpi/amd64/distfiles: Add func_abi.h. + +2015-05-03 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix WIN64 assembly glue for AES. + + commit 24a769a7c7601dbb85332e550f6fbd121b56df5f + * cipher/rinjdael.c (do_encrypt, do_decrypt) + [!HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS]: Change input operands to + input+output to mark volatile nature of the used registers. + + Add '1 million a characters' test vectors. + + commit 2f4fefdbc62857b6e2da26ce111ee140a068c471 + * tests/basic.c (check_digests): Add "!" test vectors for MD5, SHA-384, + SHA-512, RIPEMD160 and CRC32. + +2015-05-02 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + More optimized CRC implementations. + + commit 06e122baa3321483a47bbf82fd2a4540becfa0c9 + * cipher/crc.c (crc32_table, crc24_table): Replace with new table + contents. + (update_crc32, CRC24_INIT, CRC24_POLY): Remove. + (crc32_next, crc32_next4, crc24_init, crc24_next, crc24_next4) + (crc24_final): New. + (crc24rfc2440_init): Use crc24_init. + (crc32_write): Rewrite to use crc32_next & crc32_next4. + (crc24_write): Rewrite to use crc24_next & crc24_next4. + (crc32_final, crc32rfc1510_final): Use buf_put_be32. + (crc24rfc2440_final): Use crc24_final & buf_put_le32. + * tests/basic.c (check_digests): Add CRC "123456789" tests. + + Enable AMD64 AES implementation for WIN64. + + commit 66129b3334a5aa54ff8a97981507e4704f759571 + * cipher/rijndael-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/rijndael-internal.h (USE_AMD64_ASM): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (do_encrypt, do_decrypt) + [USE_AMD64_ASM && !HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS]: Use + assembly block to call AMD64 assembly encrypt/decrypt function. + + Enable AMD64 Whirlpool implementation for WIN64. + + commit 8422d5d699265b960bd1ca837044ee052fc5b614 + * cipher/whirlpool-sse2-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/whirlpool.c (USE_AMD64_ASM): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + [USE_AMD64_ASM] (ASM_FUNC_ABI, ASM_EXTRA_STACK): New. + [USE_AMD64_ASM] (_gcry_whirlpool_transform_amd64): Add ASM_FUNC_ABI to + prototype. + [USE_AMD64_ASM] (whirlpool_transform): Add ASM_EXTRA_STACK to stack + burn value. + + Enable AMD64 SHA512 implementations for WIN64. + + commit 1089a13073c26a9a456e43ec38d937e6ee7f4077 + * cipher/sha512-avx-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/sha512-avx-bmi2-amd64.S: Ditto. + * cipher/sha512-ssse3-amd64.S: Ditto. + * cipher/sha512.c (USE_SSSE3, USE_AVX, USE_AVX2): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + [USE_SSSE3 || USE_AVX || USE_AVX2] (ASM_FUNC_ABI) + (ASM_EXTRA_STACK): New. + (_gcry_sha512_transform_amd64_ssse3, _gcry_sha512_transform_amd64_avx) + (_gcry_sha512_transform_amd64_avx_bmi2): Add ASM_FUNC_ABI to + prototypes. + (transform): Add ASM_EXTRA_STACK to stack burn value. + + Enable AMD64 SHA256 implementations for WIN64. + + commit 022959099644f64df5f2a83ade21159864f64837 + * cipher/sha256-avx-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/sha256-avx2-bmi2-amd64.S: Ditto. + * cipher/sha256-ssse3-amd64.S: Ditto. + * cipher/sha256.c (USE_SSSE3, USE_AVX, USE_AVX2): Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + [USE_SSSE3 || USE_AVX || USE_AVX2] (ASM_FUNC_ABI) + (ASM_EXTRA_STACK): New. + (_gcry_sha256_transform_amd64_ssse3, _gcry_sha256_transform_amd64_avx) + (_gcry_sha256_transform_amd64_avx2): Add ASM_FUNC_ABI to prototypes. + (transform): Add ASM_EXTRA_STACK to stack burn value. + + Enable AMD64 SHA1 implementations for WIN64. + + commit e433676a899fa0d274d40547166b03c7c8bd8e78 + * cipher/sha1-avx-amd64.S: Enable when + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + (ELF): New macro to mask lines with ELF specific commands. + * cipher/sha1-avx-bmi2-amd64.S: Ditto. + * cipher/sha1-ssse3-amd64.S: Ditto. + * cipher/sha1.c (USE_SSSE3, USE_AVX, USE_BMI2): Enable + when HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS defined. + [USE_SSSE3 || USE_AVX || USE_BMI2] (ASM_FUNC_ABI) + (ASM_EXTRA_STACK): New. + (_gcry_sha1_transform_amd64_ssse3, _gcry_sha1_transform_amd64_avx) + (_gcry_sha1_transform_amd64_avx_bmi2): Add ASM_FUNC_ABI to + prototypes. + (transform): Add ASM_EXTRA_STACK to stack burn value. + +2015-05-01 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Enable AES/AES-NI, AES/SSSE3 and GCM/PCLMUL implementations on WIN64. + + commit 4e09aaa36d151c3312019724a77fc09aa345b82f + * cipher/cipher-gcm-intel-pclmul.c (_gcry_ghash_intel_pclmul) + ( _gcry_ghash_intel_pclmul) [__WIN64__]: Store non-volatile vector + registers before use and restore after. + * cipher/cipher-internal.h (GCM_USE_INTEL_PCLMUL): Remove dependency + on !defined(__WIN64__). + * cipher/rijndael-aesni.c [__WIN64__] (aesni_prepare_2_6_variable, + aesni_prepare, aesni_prepare_2_6, aesni_cleanup) + ( aesni_cleanup_2_6): New. + [!__WIN64__] (aesni_prepare_2_6_variable, aesni_prepare_2_6): New. + (_gcry_aes_aesni_do_setkey, _gcry_aes_aesni_cbc_enc) + (_gcry_aesni_ctr_enc, _gcry_aesni_cfb_dec, _gcry_aesni_cbc_dec) + (_gcry_aesni_ocb_crypt, _gcry_aesni_ocb_auth): Use + 'aesni_prepare_2_6'. + * cipher/rijndael-internal.h (USE_SSSE3): Enable if + HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS or + HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS. + (USE_AESNI): Remove dependency on !defined(__WIN64__) + * cipher/rijndael-ssse3-amd64.c [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS] + (vpaes_ssse3_prepare, vpaes_ssse3_cleanup): New. + [!HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS] (vpaes_ssse3_prepare): New. + (vpaes_ssse3_prepare_enc, vpaes_ssse3_prepare_dec): Use + 'vpaes_ssse3_prepare'. + (_gcry_aes_ssse3_do_setkey, _gcry_aes_ssse3_prepare_decryption): Use + 'vpaes_ssse3_prepare' and 'vpaes_ssse3_cleanup'. + [HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS] (X): Add masking macro to + exclude '.type' and '.size' markers from assembly code, as they are + not support on WIN64/COFF objects. + * configure.ac (gcry_cv_gcc_attribute_ms_abi) + (gcry_cv_gcc_attribute_sysv_abi, gcry_cv_gcc_default_abi_is_ms_abi) + (gcry_cv_gcc_default_abi_is_sysv_abi) + (gcry_cv_gcc_win64_platform_as_ok): New checks. + + Add W64 support for mpi amd64 assembly. + + commit 460355f23e770637d29e3af7b998a957a2b5bc88 + acinclude.m4 (GNUPG_SYS_SYMBOL_UNDERSCORE): Set + 'ac_cv_sys_symbol_underscore=no' on MingW-W64. + mpi/amd64/func_abi.h: New. + mpi/amd64/mpih-add1.S (_gcry_mpih_add_n): Add FUNC_ENTRY and FUNC_EXIT. + mpi/amd64/mpih-lshift.S (_gcry_mpih_lshift): Ditto. + mpi/amd64/mpih-mul1.S (_gcry_mpih_mul_1): Ditto. + mpi/amd64/mpih-mul2.S (_gcry_mpih_addmul_1): Ditto. + mpi/amd64/mpih-mul3.S (_gcry_mpih_submul_1): Ditto. + mpi/amd64/mpih-rshift.S (_gcry_mpih_rshift): Ditto. + mpi/amd64/mpih-sub1.S (_gcry_mpih_sub_n): Ditto. + mpi/config.links [host=x86_64-*mingw*]: Enable assembly modules. + [host=x86_64-*-*]: Append mpi/amd64/func_abi.h to mpi/asm-syntax.h. + + DES: Silence compiler warnings on Windows. + + commit 6c21cf5fed1ad430fa41445eac2350802bc8aaed + * cipher/des.c (working_memcmp): Make pointer arguments 'const void *'. + + Cast pointers to integers using uintptr_t instead of long. + + commit 9cf224322007d90193d4910f0da6e0e29ce01d70 + + + Fix rndhw for 64-bit Windows build. + + commit d5a7e00b6b222566a5650639ef29684b047c1909 + * configure.ac: Add sizeof check for 'void *'. + * random/rndhw.c (poll_padlock): Check for SIZEOF_VOID_P == 8 + instead of defined(__LP64__). + (RDRAND_LONG): Check for SIZEOF_UNSIGNED_LONG == 8 instead of + defined(__LP64__). + + Prepare random/win32.c fast poll for 64-bit Windows. + + commit 0cdd24456b33defc7f8176fa82ab694fbc284385 + * random/win32.c (_gcry_rndw32_gather_random_fast) [ADD]: Rename to + ADDINT. + (_gcry_rndw32_gather_random_fast): Add ADDPTR. + (_gcry_rndw32_gather_random_fast): Disable entropy gathering from + GetQueueStatus(QS_ALLEVENTS). + (_gcry_rndw32_gather_random_fast): Change minimumWorkingSetSize and + maximumWorkingSetSize to SIZE_T from DWORD. + (_gcry_rndw32_gather_random_fast): Only add lower 32-bits of + minimumWorkingSetSize and maximumWorkingSetSize to random poll. + (_gcry_rndw32_gather_random_fast) [__WIN64__]: Read TSC directly + using intrinsic. + + Disable GCM and AES-NI assembly implementations for WIN64. + + commit f701954555340a503f6e52cc18d58b0c515427b7 + * cipher/cipher-internal.h (GCM_USE_INTEL_PCLMUL): Do not enable when + __WIN64__ defined. + * cipher/rijndael-internal.h (USE_AESNI): Ditto. + + Disable building mpi assembly routines on WIN64. + + commit e78560a4b717f7154f910a8ce4128de152f586da + * mpi/config.links: Disable assembly for host 'x86_64-*mingw32*'. + + Fix packed attribute check for Windows targets. + + commit e886e4f5e73fe6a9f9191f5155852ce5d8bb88fe + * configure.ac (gcry_cv_gcc_attribute_packed): Move 'long b' to its + own packed structure. + + Fix tail handling in buf_xor_1. + + commit c2dba93e639639bdac139b3a3a456d10ddc61f79 + * cipher/bufhelp.h (buf_xor_1): Increment source pointer at tail + handling. + + Add --disable-hwf for basic tests. + + commit 839a3bbe2bb045139223b32753d656cc6c3d4669 + * tests/basic.c (main): Add handling for '--disable-hwf'. + + Use more odd chuck sizes for check_one_md. + + commit 9f086ffa43f2507b9d17522a0a2e394cb273baf8 + * tests/basic.c (check_one_md): Make chuck size vary oddly, instead + of using fixed length of 1000 bytes. + + Enable more modes in basic ciphers test. + + commit e40eff94f9f8654c3d29e03bbb7e5ee6a43c1435 + * src/gcrypt.h.in (GCRY_OCB_BLOCK_LEN): New. + * tests/basic.c (check_one_cipher_core_reset): New. + (check_one_cipher_core): Use check_one_cipher_core_reset inplace of + gcry_cipher_reset. + (check_ciphers): Add CCM and OCB modes for block cipher tests. + + Fix reseting cipher in OCB mode. + + commit 88842cbc68beb4f73c87fdbcb74182cba818f789 + * cipher/cipher.c (cipher_reset): Setup default taglen for OCB after + clearing state. + +2015-04-30 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix buggy RC4 AMD64 assembly and add test to notice similar issues. + + commit 124dfce7c5a2d9405fa2b2832e91ac1267943830 + * cipher/arcfour-amd64.S (_gcry_arcfour_amd64): Fix swapped store of + 'x' and 'y'. + * tests/basic.c (get_algo_mode_blklen): New. + (check_one_cipher_core): Add new tests for split buffer input on + encryption and decryption. + +2015-04-26 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Disallow compiler from generating SSE instructions in mixed C+asm source + + commit f88266c0f868d7bf51a215d5531bb9f2b4dad19e + * cipher/cipher-gcm-intel-pclmul.c [gcc-version >= 4.4]: Add GCC target + pragma to disable compiler use of SSE. + * cipher/rijndael-aesni.c [gcc-version >= 4.4]: Ditto. + * cipher/rijndael-ssse3-amd64.c [gcc-version >= 4.4]: Ditto. + +2015-04-18 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add OCB bulk crypt/auth functions for AES/AES-NI. + + commit 305cc878d395475c46b4ef52f4764bd0c85bf8ac + * cipher/cipher-internal.h (gcry_cipher_handle): Add bulk.ocb_crypt + and bulk.ocb_auth. + (_gcry_cipher_ocb_get_l): New prototype. + * cipher/cipher-ocb.c (get_l): Rename to ... + (_gcry_cipher_ocb_get_l): ... this. + (_gcry_cipher_ocb_authenticate, ocb_crypt): Use bulk function when + available. + * cipher/cipher.c (_gcry_cipher_open_internal): Setup OCB bulk + functions for AES. + * cipher/rijndael-aesni.c (get_l, aesni_ocb_enc, aes_ocb_dec) + (_gcry_aes_aesni_ocb_crypt, _gcry_aes_aesni_ocb_auth): New. + * cipher/rijndael.c [USE_AESNI] (_gcry_aes_aesni_ocb_crypt) + (_gcry_aes_aesni_ocb_auth): New prototypes. + (_gcry_aes_ocb_crypt, _gcry_aes_ocb_auth): New. + * src/cipher.h (_gcry_aes_ocb_crypt, _gcry_aes_ocb_auth): New + prototypes. + * tests/basic.c (check_ocb_cipher_largebuf): New. + (check_ocb_cipher): Add large buffer encryption/decryption test. + +2015-04-15 Werner Koch <wk@gnupg.org> + + tests: Add option to time the S2K function. + + commit fe38d3815b4cd203cd529949e244aca80d32897f + * tests/t-kdf.c: Include stopwatch.h. + (dummy_consumer): new. + (bench_s2k): New. + (main): Add option parser and option --s2k. + + tests: Improve stopwatch.h. + + commit 3b03a3b493233a472da531d8d9582d1be6d376b0 + * tests/stopwatch.h (elapsed_time): Add arg divisor. + +2015-04-13 Werner Koch <wk@gnupg.org> + + mpi: Fix gcry_mpi_copy for NULL opaque data. + + commit 9fca46864e1b5a9c788072113589454adb89fa97 + * mpi/mpiutil.c (_gcry_mpi_copy): Copy opaque only if needed. + +2015-03-21 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + wipememory: use one-byte aligned type for unaligned memory accesses. + + commit a06fbc0d1e98eb1218eff55ad2f37d471e4f33b2 + * src/g10lib.h (fast_wipememory2_unaligned_head): Enable unaligned + access only when HAVE_GCC_ATTRIBUTE_PACKED and + HAVE_GCC_ATTRIBUTE_ALIGNED defined. + (fast_wipememory_t): New. + (fast_wipememory2): Use 'fast_wipememory_t'. + + bufhelp: use one-byte aligned type for unaligned memory accesses. + + commit 92fa5f16d69707e302c0f85b2e5e80af8dc037f1 + * cipher/bufhelp.h (BUFHELP_FAST_UNALIGNED_ACCESS): Enable only when + HAVE_GCC_ATTRIBUTE_PACKED and HAVE_GCC_ATTRIBUTE_ALIGNED are defined. + (bufhelp_int_t): New type. + (buf_cpy, buf_xor, buf_xor_1, buf_xor_2dst, buf_xor_n_copy_2): Use + 'bufhelp_int_t'. + [BUFHELP_FAST_UNALIGNED_ACCESS] (bufhelp_u32_t, bufhelp_u64_t): New. + [BUFHELP_FAST_UNALIGNED_ACCESS] (buf_get_be32, buf_get_le32) + (buf_put_be32, buf_put_le32, buf_get_be64, buf_get_le64) + (buf_put_be64, buf_put_le64): Use 'bufhelp_uXX_t'. + * configure.ac (gcry_cv_gcc_attribute_packed): New. + + tests/bench-slope: fix memory-leak and use-after-free bugs. + + commit aa234561d00c3fb15fe501df4bf58f3db7c7c06b + * tests/bench-slope.c (do_slope_benchmark): Free 'measurements' at end. + (bench_mac_init): Move 'key' free at end of function. + +2015-03-19 Werner Koch <wk@gnupg.org> + + Fix two pedantic warnings. + + commit f5832285b0e420d77be1b8da10a1e1d86583b414 + * src/gcrypt.h.in (gcry_mpi_flag, gcry_mac_algos): Remove trailing + comma. + +2015-03-16 Werner Koch <wk@gnupg.org> + + Use well defined type instead of size_t in secmem.c. + + commit db8ae3616987fa288173446398a107e31e2e28aa + * src/secmem.c (ptr_into_pool_p): Replace size_t by uintptr_t. + + Make uintptr_t global available. + + commit f0f60c1a04d664936bcf52e8f46705bdc63e7ad9 + * cipher/bufhelp.h: Move include for uintptr_t to ... + * src/types.h: here. Check that config.h has been included. + + mpi: Remove useless condition. + + commit 0a9cdb8ae092d050ca12a7a4f2f50e25b82154ec + * mpi/mpi-pow.c: Remove condition rp==mp. + + cipher: Remove useless NULL check. + + commit fbb97dcf763e28e81e01092ad4c934b3eaf88cc8 + * cipher/hash-common.c (_gcry_md_block_write): Remove NUL check for + hd->buf. + +2015-02-28 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix in-place encryption for OCB mode. + + commit 5e66a4f8d5a63f58caeee367433dd8dd32346083 + * cipher/cipher-ocb.c (ocb_checksum): New. + (ocb_crypt): Move checksum calculation outside main crypt loop, do + checksum calculation for encryption before inbuf is overwritten. + * tests/basic.c (check_ocb_cipher): Rename to ... + (do_check_ocb_cipher): ... to this and add argument for testing + in-place encryption/decryption. + (check_ocb_cipher): New. + +2015-02-27 NIIBE Yutaka <gniibe@fsij.org> + + tests: fix t-sexp.c. + + commit 505decf5369970219ddc9e78a20f97c623957b78 + * tests/t-sexp.c (bug_1594): Free N and PUBKEY. + + mpi: Avoid data-dependent timing variations in mpi_powm. + + commit 6636c4fd0c6ceab9f79827bf96967d1e112c0b82 + * mpi/mpi-pow.c (mpi_powm): Access all data in the table by + mpi_set_cond. + + mpi: Revise mpi_powm. + + commit 1fa8cdb933505960d4e4b4842b122d4e06953e88 + * mpi/mpi-pow.c (_gcry_mpi_powm): Rename the table to PRECOMP. + +2015-02-23 Werner Koch <wk@gnupg.org> + + cipher: Use ciphertext blinding for Elgamal decryption. + + commit 410d70bad9a650e3837055e36f157894ae49a57d + * cipher/elgamal.c (USE_BLINDING): New. + (decrypt): Rewrite to use ciphertext blinding. + +2015-02-12 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Add mpi_set_cond. + + commit 653a9fa1a3a4c35a4dc1841cb57d7e2a318f3288 + * mpi/mpiutil.c (_gcry_mpi_set_cond): New. + (_gcry_mpi_swap_cond): Fix types. + * src/mpi.h (mpi_set_cond): New. + +2015-01-30 Werner Koch <wk@gnupg.org> + + w32: Use -static-libgcc to avoid linking to libgcc_s_sjlj-1.dll. + + commit 40a7bdf50e19faaf106470897fed72af623adc50 + * src/Makefile.am (extra_ltoptions): New. + (libgcrypt_la_LDFLAGS): Use it. + +2015-01-28 Werner Koch <wk@gnupg.org> + + Fix building of GOST s-boxes when cross-compiling. + + commit 2564d204e408b296425ac0660c6bdc6270575fb6 + * cipher/Makefile.am (gost-s-box): USe CC_FOR_BUILD. + (noinst_PROGRAMS): Remove. + (EXTRA_DIST): New. + (CLEANFILES): New. + +2015-01-20 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael: fix wrong ifdef for SSSE3 setkey. + + commit ceaa97f0d849c07f3a15b642fc3a2b0a477b4a47 + * cipher/rijndael.c (do_setkey): Use USE_SSSE3 instead of USE_AESNI + around SSSE3 setkey selection. + +2015-01-16 Werner Koch <wk@gnupg.org> + + Add OCB cipher mode. + + commit 067d7d8752d4d8a98f8e0e5e9b1a5b13e1b7ff9c + * cipher/cipher-ocb.c: New. + * cipher/Makefile.am (libcipher_la_SOURCES): Add cipher-ocb.c + * cipher/cipher-internal.h (OCB_BLOCK_LEN, OCB_L_TABLE_SIZE): New. + (gcry_cipher_handle): Add fields marks.finalize and u_mode.ocb. + * cipher/cipher.c (_gcry_cipher_open_internal): Add OCB mode. + (_gcry_cipher_open_internal): Setup default taglen of OCB. + (cipher_reset): Clear OCB specific data. + (cipher_encrypt, cipher_decrypt, _gcry_cipher_authenticate) + (_gcry_cipher_gettag, _gcry_cipher_checktag): Call OCB functions. + (_gcry_cipher_setiv): Add OCB specific nonce setting. + (_gcry_cipher_ctl): Add GCRYCTL_FINALIZE and GCRYCTL_SET_TAGLEN + + * src/gcrypt.h.in (GCRYCTL_SET_TAGLEN): New. + (gcry_cipher_final): New. + + * cipher/bufhelp.h (buf_xor_1): New. + + * tests/basic.c (hex2buffer): New. + (check_ocb_cipher): New. + (main): Call it here. Add option --cipher-modes. + * tests/bench-slope.c (bench_aead_encrypt_do_bench): Call + gcry_cipher_final. + (bench_aead_decrypt_do_bench): Ditto. + (bench_aead_authenticate_do_bench): Ditto. Check error code. + (bench_ocb_encrypt_do_bench): New. + (bench_ocb_decrypt_do_bench): New. + (bench_ocb_authenticate_do_bench): New. + (ocb_encrypt_ops): New. + (ocb_decrypt_ops): New. + (ocb_authenticate_ops): New. + (cipher_modes): Add them. + (cipher_bench_one): Skip wrong block length for OCB. + * tests/benchmark.c (cipher_bench): Add field noncelen to MODES. Add + OCB support. + +2015-01-15 Werner Koch <wk@gnupg.org> + + Add functions to count trailing zero bits in a word. + + commit 9d2a22c94ae99f9301321082c4fb8d73f4085fda + * cipher/bithelp.h (_gcry_ctz, _gcry_ctz64): New. + * configure.ac (HAVE_BUILTIN_CTZ): Add new test. + +2015-01-08 Werner Koch <wk@gnupg.org> + + cipher: Prepare for OCB mode. + + commit 9d328962660da72f094dc5424d5ef67abbaffdf6 + * src/gcrypt.h.in (GCRY_CIPHER_MODE_OCB): New. + +2015-01-06 Werner Koch <wk@gnupg.org> + + Make make distcheck work again. + + commit 4f7dcdc25af269b12275126edeef30b262fb891d + * Makefile.am (DISTCHECK_CONFIGURE_FLAGS): Remove --enable-ciphers. + * cipher/Makefile.am (DISTCLEANFILES): Add gost-sb.h. + +2015-01-06 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + stribog: Reduce table size to the needed one. + + commit e4de52378a85cf383994ded8edf0d5cf98dcb10c + * cipher/stribog.c (C16): Avoid allocating superfluous space. + + gostr3411-94: Fix the iteration count for length filling loop. + + commit 05dc5bcd234909ae9c9366b653346076b9a834ed + * cipher/gostr3411-94.c (gost3411_final): Fix loop + +2015-01-05 Werner Koch <wk@gnupg.org> + + random: Silent warning under NetBSD using rndunix. + + commit 817472358a093438e802380caecf7139406400cf + * random/rndunix.c (STDERR_FILENO): Define if needed. + (start_gatherer): Re-open standard descriptors. Fix an + unsigned/signed pointer warning. + + primegen: Fix memory leak for invalid call sequences. + + commit 8c5eee51d9a25b143e41ffb7ff4a6b2a29b82d83 + * cipher/primegen.c (prime_generate_internal): Refactor generator code + to not leak memory for non-implemented feature. + (_gcry_prime_group_generator): Refactor to not leak memory for invalid + args. Also make sure that R_G is set as soon as possible. + + doc: Update yat2m to current upstream version (GnuPG). + + commit dd5df198727ea5d8f6b04288e14fd732051453c8 + + + build: Require automake 1.14. + + commit f65276970a6dcd6d9bca94cecc49b68acdcc9492 + * configure.ac (AM_INIT_AUTOMAKE): Add serial-tests. + + Replace camel case of internal scrypt functions. + + commit 1a6d65ac0aab335541726d02f2046d883a768ec3 + * cipher/scrypt.c (_salsa20_core): Rename to salsa20_core. Change + callers. + (_scryptBlockMix): Rename to scrypt_block_mix. Change callers. + (_scryptROMix): Rename to scrypt_ro_mix. Change callers. + +2015-01-02 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rmd160: restore native-endian store in _gcry_rmd160_mixblock. + + commit d7c7453cf5e6b8f3c6b522a30e680f844a28c9de + * cipher/rmd160.c (_gcry_rmd160_mixblock): Store result to buffer in + native-endianess. + +2014-12-27 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add Intel SSSE3 based vector permutation AES implementation. + + commit 8eabecc883332156adffc1df42d27f614c157e06 + * cipher/Makefile.am: Add 'rijndael-ssse3-amd64.c'. + * cipher/rijndael-internal.h (USE_SSSE3): New. + (RIJNDAEL_context_s) [USE_SSSE3]: Add 'use_ssse3'. + * cipher/rijndael-ssse3-amd64.c: New. + * cipher/rijndael.c [USE_SSSE3] (_gcry_aes_ssse3_do_setkey) + (_gcry_aes_ssse3_prepare_decryption, _gcry_aes_ssse3_encrypt) + (_gcry_aes_ssse3_decrypt, _gcry_aes_ssse3_cfb_enc) + (_gcry_aes_ssse3_cbc_enc, _gcry_aes_ssse3_ctr_enc) + (_gcry_aes_ssse3_cfb_dec, _gcry_aes_ssse3_cbc_dec): New. + (do_setkey): Add HWF check for SSSE3 and setup for SSSE3 + implementation. + (prepare_decryption, _gcry_aes_cfb_enc, _gcry_aes_cbc_enc) + (_gcry_aes_ctr_enc, _gcry_aes_cfb_dec, _gcry_aes_cbc_dec): Add + selection for SSSE3 implementation. + * configure.ac [host=x86_64]: Add 'rijndael-ssse3-amd64.lo'. + +2014-12-25 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + random-csprng: fix compiler warnings on ARM. + + commit c2e1f8fea271f3ef8027809547c4a52e0b1e24a2 + * random/random-csprng.c (_gcry_rngcsprng_update_seed_file) + (read_pool): Cast keypool and rndpool to 'unsigned long *' through + 'void *'. + + scrypt: fix compiler warnings on ARM. + + commit 1dab4c9422bf0f3cdc7a4d3ccf9db090abd90e94 + * cipher/scrypt.c (_scryptBlockMix): Cast X to 'u32 *' through 'void *'. + + secmem: fix compiler warnings on ARM. + + commit 99faf9cb34f872144313403f29f3379798debfc9 + * src/secmem.c (ADDR_TO_BLOCK, mb_get_next, mb_get_new): Cast pointer + from 'char *' to 'memblock_t *' through 'void *'. + (MB_WIPE_OUT): Remove unneeded cast to 'memblock_t *'. + + hash: fix compiler warning on ARM. + + commit 4515315f61fbf79413e150fbd1d5f5a2435f2bc5 + * cipher/md.c (md_open, md_copy): Cast 'char *' to ctx through + 'void *'. + * cipher/md4.c (md4_final): Use buf_put_* helper instead of + converting 'char *' to 'u32 *'. + * cipher/md5.c (md5_final): Ditto. + * cipher/rmd160.c (_gcry_rmd160_mixblock, rmd160_final): Ditto. + * cipher/sha1.c (sha1_final): Ditto. + * cipher/sha256.c (sha256_final): Ditto. + * cipher/sha512.c (sha512_final): Ditto. + * cipher/tiger.c (tiger_final): Ditto. + + rijndael: fix compiler warnings on ARM. + + commit cc26106dbebeb84d481661813edc3e5aea9a7d99 + * cipher/rijndael-internal.h (RIJNDAEL_context_s): Add u32 variants of + keyschedule arrays to unions u1 and u2. + (keyschedenc32, keyscheddec32): New. + * cipher/rijndael.c (u32_a_t): Remove. + (do_setkey): Add and use tkk[].data32, k_u32, tk_u32 and W_u32; Remove + casting byte arrays to u32_a_t. + (prepare_decryption, do_encrypt_fn, do_decrypt_fn): Use keyschedenc32 + and keyscheddec32; Remove casting byte arrays to u32_a_t. + +2014-12-23 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Poly1305-AEAD: updated implementation to match draft-irtf-cfrg-chacha20-poly1305-03 + + commit 520070e02e2e6ee7228945015573a6e1f4895ec3 + * cipher/cipher-internal.h (gcry_cipher_handle): Use separate byte + counters for AAD and data in Poly1305. + * cipher/cipher-poly1305.c (poly1305_fill_bytecount): Remove. + (poly1305_fill_bytecounts, poly1305_do_padding): New. + (poly1305_aad_finish): Fill padding to Poly1305 and do not fill AAD + length. + (_gcry_cipher_poly1305_authenticate, _gcry_cipher_poly1305_encrypt) + (_gcry_cipher_poly1305_decrypt): Update AAD and data length separately. + (_gcry_cipher_poly1305_tag): Fill padding and bytecounts to Poly1305. + (_gcry_cipher_poly1305_setkey, _gcry_cipher_poly1305_setiv): Reset + AAD and data byte counts; only allow 96-bit IV. + * cipher/cipher.c (_gcry_cipher_open_internal): Limit Poly1305-AEAD to + ChaCha20 cipher. + * tests/basic.c (_check_poly1305_cipher): Update test-vectors. + (check_ciphers): Limit Poly1305-AEAD checks to ChaCha20. + * tests/bench-slope.c (cipher_bench_one): Ditto. + + chacha20: allow setting counter for stream random access. + + commit 11b8d2d449a7bc664b4371ae14c57caa6704d272 + * cipher/chacha20.c (CHACHA20_CTR_SIZE): New. + (chacha20_ivsetup): Add setup for full counter. + (chacha20_setiv): Allow ivlen == CHACHA20_CTR_SIZE. + + gcm: do not pass extra key pointer for setupM/fillM. + + commit c964321c8a1328e89d636d899a45d68802f5ac9f + * cipher/cipher-gcm-intel-pclmul.c + (_gcry_ghash_setup_intel_pclmul): Remove 'h' parameter. + * cipher/cipher-gcm.c (_gcry_ghash_setup_intel_pclmul): Ditto. + (fillM): Get 'h' pointer from 'c'. + (setupM): Remome 'h' parameter. + (_gcry_cipher_gcm_setkey): Only pass 'c' to setupM. + + rijndael: use more compact look-up tables and add table prefetching. + + commit 2374753938df64f6fd8015b44613806a326eff1a + * cipher/rijndael-internal.h (rijndael_prefetchfn_t): New. + (RIJNDAEL_context): Add 'prefetch_enc_fn' and 'prefetch_dec_fn'. + * cipher/rijndael-tables.h (S, T1, T2, T3, T4, T5, T6, T7, T8, S5, U1) + (U2, U3, U4): Remove. + (encT, dec_tables, decT, inv_sbox): Add. + * cipher/rijndael.c (_gcry_aes_amd64_encrypt_block) + (_gcry_aes_amd64_decrypt_block, _gcry_aes_arm_encrypt_block) + (_gcry_aes_arm_encrypt_block): Add parameter for passing table pointer + to assembly implementation. + (prefetch_table, prefetch_enc, prefetch_dec): New. + (do_setkey): Setup context prefetch functions depending on selected + rijndael implementation; Use new tables for key setup. + (prepare_decryption): Use new tables for decryption key setup. + (do_encrypt_aligned): Rename to... + (do_encrypt_fn): ... to this, change to use new compact tables, + make handle unaligned input and unroll rounds loop by two. + (do_encrypt): Remove handling of unaligned input/output; pass table + pointer to assembly implementations. + (rijndael_encrypt, _gcry_aes_cfb_enc, _gcry_aes_cbc_enc) + (_gcry_aes_ctr_enc, _gcry_aes_cfb_dec): Prefetch encryption tables + before encryption. + (do_decrypt_aligned): Rename to... + (do_decrypt_fn): ... to this, change to use new compact tables, + make handle unaligned input and unroll rounds loop by two. + (do_decrypt): Remove handling of unaligned input/output; pass table + pointer to assembly implementations. + (rijndael_decrypt, _gcry_aes_cbc_dec): Prefetch decryption tables + before decryption. + * cipher/rijndael-amd64.S: Use 1+1.25 KiB tables for + encryption+decryption; remove tables from assembly file. + * cipher/rijndael-arm.S: Ditto. + +2014-12-15 Werner Koch <wk@gnupg.org> + + build: Add configure option --disable-doc. + + commit ad50e360ef4851e66e51a03fc420175636336b58 + * Makefile.am (AUTOMAKE_OPTIONS): Remove. + (doc) [!BUILD_DOC]: Do not recurse into the dir. + * configure.ac (AM_INIT_AUTOMAKE): Add option formerly in Makefile.am. + (BUILD_DOC): Add new am_conditional. + +2014-12-12 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael: further optimizations for AES-NI accelerated CBC and CFB bulk modes + + commit 4f46374502eb988d701b904f83819e2cf7b1755c + * cipher/rijndael-aesni.c (do_aesni_enc, do_aesni_dec): Pass + input/output through SSE register XMM0. + (do_aesni_cfb): Remove. + (_gcry_aes_aesni_encrypt, _gcry_aes_aesni_decrypt): Add loading/storing + input/output to/from XMM0. + (_gcry_aes_aesni_cfb_enc, _gcry_aes_aesni_cbc_enc) + (_gcry_aes_aesni_cfb_dec): Update to use renewed 'do_aesni_enc' and + move IV loading/storing outside loop. + (_gcry_aes_aesni_cbc_dec): Update to use renewed 'do_aesni_dec'. + + GCM: move Intel PCLMUL accelerated implementation to separate file. + + commit 4a0795af021305f9240f23626a3796157db46bd7 + * cipher/Makefile.am: Add 'cipher-gcm-intel-pclmul.c'. + * cipher/cipher-gcm-intel-pclmul.c: New. + * cipher/cipher-gcm.c [GCM_USE_INTEL_PCLMUL] + (_gcry_ghash_setup_intel_pclmul, _gcry_ghash_intel_pclmul): New + prototypes. + [GCM_USE_INTEL_PCLMUL] (gfmul_pclmul, gfmul_pclmul_aggr4): Move + to 'cipher-gcm-intel-pclmul.c'. + (ghash): Rename to... + (ghash_internal): ...this and move GCM_USE_INTEL_PCLMUL part to new + function in 'cipher-gcm-intel-pclmul.c'. + (setupM): Move GCM_USE_INTEL_PCLMUL part to new function in + 'cipher-gcm-intel-pclmul.c'; Add selection of ghash function based + on available HW acceleration. + (do_ghash_buf): Change use of 'ghash' to 'c->u_mode.gcm.ghash_fn'. + * cipher/internal.h (ghash_fn_t): New. + (gcry_cipher_handle): Remove 'use_intel_pclmul'; Add 'ghash_fn'. + +2014-12-06 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael: split Padlock part to separate file. + + commit cbf4c8cb6bbda15eea61885279f2a6f1d4bcedfd + * cipher/Makefile.am: Add 'rijndael-padlock.c'. + * cipher/rijndael-padlock.c: New. + * cipher/rijndael.c (do_padlock, do_padlock_encrypt) + (do_padlock_decrypt): Move to 'rijndael-padlock.c'. + * configure.ac [mpi_cpu_arch=x86]: Add 'rijndael-padlock.lo'. + +2014-12-01 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael: refactor to reduce number of #ifdefs and branches. + + commit 3d5b51786e2050c461e9791b59142a731462b66d + * cipher/rijndael-aesni.c (_gcry_aes_aesni_encrypt) + (_gcry_aes_aesni_decrypt): Make return stack burn depth. + * cipher/rijndael-amd64.S (_gcry_aes_amd64_encrypt_block) + (_gcry_aes_amd64_decrypt_block): Ditto. + * cipher/rijndael-arm.S (_gcry_aes_arm_encrypt_block) + (_gcry_aes_arm_decrypt_block): Ditto. + * cipher/rijndael-internal.h (RIJNDAEL_context_s) + (rijndael_cryptfn_t): New. + (RIJNDAEL_context): New members 'encrypt_fn' and 'decrypt_fn'. + * cipher/rijndael.c (_gcry_aes_amd64_encrypt_block) + (_gcry_aes_amd64_decrypt_block, _gcry_aes_aesni_encrypt) + (_gcry_aes_aesni_decrypt, _gcry_aes_arm_encrypt_block) + (_gcry_aes_arm_decrypt_block): Change prototypes. + (do_padlock_encrypt, do_padlock_decrypt): New. + (do_setkey): Separate key-length to rounds conversion from + HW features check; Add selection for ctx->encrypt_fn and + ctx->decrypt_fn. + (do_encrypt_aligned, do_decrypt_aligned): Move inside + '[!USE_AMD64_ASM && !USE_ARM_ASM]'; Move USE_AMD64_ASM and + USE_ARM_ASM to... + (do_encrypt, do_decrypt): ...here; Return stack depth; Remove second + temporary buffer from non-aligned input/output case. + (do_padlock): Move decrypt_flag to last argument; Return stack depth. + (rijndael_encrypt): Remove #ifdefs, just call ctx->encrypt_fn. + (_gcry_aes_cfb_enc, _gcry_aes_cbc_enc): Remove USE_PADLOCK; Call + ctx->encrypt_fn in place of do_encrypt/do_encrypt_aligned. + (_gcry_aes_ctr_enc): Call ctx->encrypt_fn in place of + do_encrypt_aligned; Make tmp buffer 16-byte aligned and wipe buffer + after use. + (rijndael_encrypt): Remove #ifdefs, just call ctx->decrypt_fn. + (_gcry_aes_cfb_dec): Remove USE_PADLOCK; Call ctx->decrypt_fn in place + of do_decrypt/do_decrypt_aligned. + (_gcry_aes_cbc_dec): Ditto; Make savebuf buffer 16-byte aligned. + + rijndael: move AES-NI blocks before Padlock. + + commit dbf9e95dd3891f6e6ad370e8ab78fec03595687b + * cipher/rijndael.c (do_setkey, rijndael_encrypt, _gcry_aes_cfb_enc) + (rijndael_decrypt, _gcry_aes_cfb_dec): Move USE_AESNI before + USE_PADLOCK. + (check_decryption_praparation) [USE_PADLOCK]: Move to... + (prepare_decryption) [USE_PADLOCK]: ...here. + + rijndael: split AES-NI functions to separate file. + + commit 67d529630e838daeb8cb9c6d7ef660c01ef34fee + * cipher/Makefile.in: Add 'rijndael-aesni.c'. + * cipher/rijndael-aesni.c: New. + * cipher/rijndael-internal.h: New. + * cipher/rijndael.c (MAXKC, MAXROUNDS, BLOCKSIZE, ATTR_ALIGNED_16) + (USE_AMD64_ASM, USE_ARM_ASM, USE_PADLOCK, USE_AESNI, RIJNDAEL_context) + (keyschenc, keyschdec, padlockkey): Move to 'rijndael-internal.h'. + (u128_s, aesni_prepare, aesni_cleanup, aesni_cleanup_2_6) + (aesni_do_setkey, do_aesni_enc, do_aesni_dec, do_aesni_enc_vec4) + (do_aesni_dec_vec4, do_aesni_cfb, do_aesni_ctr, do_aesni_ctr_4): Move + to 'rijndael-aesni.c'. + (prepare_decryption, rijndael_encrypt, _gcry_aes_cfb_enc) + (_gcry_aes_cbc_enc, _gcry_aes_ctr_enc, rijndael_decrypt) + (_gcry_aes_cfb_dec, _gcry_aes_cbc_dec) [USE_AESNI]: Move to functions + in 'rijdael-aesni.c'. + * configure.ac [mpi_cpu_arch=x86]: Add 'rijndael-aesni.lo'. + +2014-11-24 Werner Koch <wk@gnupg.org> + + Remove duplicated prototypes. + + commit d53ea84bed37b973f7ce59262c50b33700cd8311 + * src/gcrypt-int.h (_gcry_mpi_ec_new, _gcry_mpi_ec_set_mpi) + (gcry_mpi_ec_set_point): Remove. + + tests: Add a prime mode to benchmark. + + commit 1b4210c204a5ef5e631187509e011b8468a134ef + * tests/benchmark.c (progress_cb): Add a single char mode. + (prime_bench): New. + (main): Add a "prime" mode. Factor with_progress out to file scope. + +2014-11-19 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Improve Montgomery curve implementation. + + commit e6130034506013d6153465a2bedb6fb08a43f74d + * cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Support + MPI_EC_MONTGOMERY. + * cipher/ecc.c (test_ecdh_only_keys): New. + (nist_generate_key): Call test_ecdh_only_keys for MPI_EC_MONTGOMERY. + (check_secret_key): Handle Montgomery curve of x-coordinate only. + * mpi/ec.c (_gcry_mpi_ec_mul_point): Resize points before the loop. + Simplify, using pointers of Q1, Q2, PRD, and SUM. + +2014-11-02 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Disable NEON for CPUs that are known to have broken NEON implementation. + + commit 95eef21583d8e998efc48f22898c1ae31b77cb48 + * src/hwf-arm.c (detect_arm_proc_cpuinfo): Add parsing for CPU version + information and check if CPU is known to have broken NEON + implementation. + (_gcry_hwf_detect_arm): Filter out broken HW features. + + Add ARM/NEON implementation of Poly1305. + + commit 0b520128551054d83fb0bb2db8873394f38de498 + * cipher/Makefile.am: Add 'poly1305-armv7-neon.S'. + * cipher/poly1305-armv7-neon.S: New. + * cipher/poly1305-internal.h (POLY1305_USE_NEON) + (POLY1305_NEON_BLOCKSIZE, POLY1305_NEON_STATESIZE) + (POLY1305_NEON_ALIGNMENT): New. + * cipher/poly1305.c [POLY1305_USE_NEON] + (_gcry_poly1305_armv7_neon_init_ext) + (_gcry_poly1305_armv7_neon_finish_ext) + (_gcry_poly1305_armv7_neon_blocks, poly1305_armv7_neon_ops): New. + (_gcry_poly1305_init) [POLY1305_USE_NEON]: Select NEON implementation + if HWF_ARM_NEON set. + * configure.ac [neonsupport=yes]: Add 'poly1305-armv7-neon.lo'. + + chacha20: add ARMv7/NEON implementation. + + commit c584f44543883346d5a565581ff99a0afce9c5e1 + * cipher/Makefile.am: Add 'chacha20-armv7-neon.S'. + * cipher/chacha20-armv7-neon.S: New. + * cipher/chacha20.c (USE_NEON): New. + [USE_NEON] (_gcry_chacha20_armv7_neon_blocks): New. + (chacha20_do_setkey) [USE_NEON]: Use Neon implementation if + HWF_ARM_NEON flag set. + (selftest): Self-test encrypting buffer byte by byte. + * configure.ac [neonsupport=yes]: Add 'chacha20-armv7-neon.lo'. + +2014-10-08 Markus Teich <markus.teich@stusta.mhn.de> + + mpi: Add gcry_mpi_ec_sub. + + commit 23ecadf309f8056c35cc092e58df801ac0eab862 + * NEWS (gcry_mpi_ec_sub): New. + * doc/gcrypt.texi (gcry_mpi_ec_sub): New. + * mpi/ec.c (_gcry_mpi_ec_sub, sub_points_edwards): New. + (sub_points_montgomery, sub_points_weierstrass): New stubs. + * src/gcrypt-int.h (_gcry_mpi_ec_sub): New. + * src/gcrypt.h.in (gcry_mpi_ec_sub): New. + * src/libgcrypt.def (gcry_mpi_ec_sub): New. + * src/libgcrypt.vers (gcry_mpi_ec_sub): New. + * src/mpi.h (_gcry_mpi_ec_sub_points): New. + * src/visibility.c (gcry_mpi_ec_sub): New. + * src/visibility.h (gcry_mpi_ec_sub): New. + +2014-10-08 Werner Koch <wk@gnupg.org> + + Fix prime test for 2 and lower and add check command to mpicalc. + + commit 5c906e2cdb14e93fb4915fdc69c7353a5fa35709 + * cipher/primegen.c (check_prime): Return true for the small primes. + (_gcry_prime_check): Return correct values for 2 and lower numbers. + + * src/mpicalc.c (do_primecheck): New. + (main): Add command 'P'. + (main): Allow for larger input data. + +2014-10-04 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add Whirlpool AMD64/SSE2 assembly implementation. + + commit de0ccd4dce7ec185a678d78878d4538dd609ca0f + * cipher/Makefile.am: Add 'whirlpool-sse2-amd64.S'. + * cipher/whirlpool-sse2-amd64.S: New. + * cipher/whirlpool.c (USE_AMD64_ASM): New. + (whirlpool_tables_s): New. + (rc, C0, C1, C2, C3, C4, C5, C6, C7): Combine these tables into single + structure and replace old tables with macros of same name. + (tab): New structure containing above tables. + [USE_AMD64_ASM] (_gcry_whirlpool_transform_amd64) + (whirlpool_transform): New. + * configure.ac [host=x86_64]: Add 'whirlpool-sse2-amd64.lo'. + +2014-10-04 Andrei Scherer <andsch@inbox.com> + + Improved ripemd160 performance. + + commit 30bd759f398f45b04d0a783b875f59ce9bd1e51d + * cipher/rmd160.c (transform): Interleave the left and right lane + rounds to introduce more instruction level parallelism. + +2014-10-02 Werner Koch <wk@gnupg.org> + + build: Document SYSROOT. + + commit 0ecd136a6ca02252f63ad229fa5240897bfe6544 + * configure.ac: Mark SYSROOT as arg var. + + build: Support SYSROOT based config script finding. + + commit 1e8b86494cf8fa045696bd447b16267ffd1797f0 + * src/libgcrypt.m4: Add support for SYSROOT and set + gpg_config_script_warn. Use AC_PATH_PROG instead of AC_PATH_TOOL + because the config script is not expected to be installed with a + prefix for its name + * configure.ac: Print a library mismatch warning. + * m4/gpg-error.m4: Update from git master. + +2014-09-30 Werner Koch <wk@gnupg.org> + + mac: Fix gcry_mac_close to allow for a NULL handle. + + commit 51dae8c8c4b63bb5e1685cbd8722e35342524737 + * cipher/mac.c (_gcry_mac_close): Check for NULL. + +2014-09-03 Werner Koch <wk@gnupg.org> + + Add a constant for a forthcoming new RNG. + + commit 8b960a807d168000d2690897a7634bd384ac1346 + * src/gcrypt.h.in (GCRYCTL_DRBG_REINIT): New constant. + +2014-09-02 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add new Poly1305 MAC test vectors. + + commit 8a2a328742012a7c528dd007437185e4584c1e48 + * tests/basic.c (check_mac): Add new test vectors for Poly1305 MAC. + +2014-09-02 Werner Koch <wk@gnupg.org> + + asm: Allow building x86 and amd64 using old compilers. + + commit 5eec04a43e6c562e956353449be931dd43dfe1cc + * src/hwf-x86.c (get_xgetbv): Build only if AVX support is enabled. + +2014-08-21 Werner Koch <wk@gnupg.org> + + sexp: Check args of gcry_sexp_build. + + commit e606d5f1bada1f2d21faeedd3fa2cf2dca7b274c + * src/sexp.c (do_vsexp_sscan): Return error for invalid args. + + cipher: Fix a segv in case of calling with wrong parameters. + + commit f850add813d783f31ca6a60459dea25ef71bce7e + * cipher/md.c (_gcry_md_info): Fix arg testing. + + cipher: Fix possible NULL deref in call to prime generator. + + commit 18056ace7f466cb8c1eaf08e5dc0400516d83b4c + * cipher/primegen.c (_gcry_generate_elg_prime): Change to return an + error code. + * cipher/dsa.c (generate): Take care of new return code. + * cipher/elgamal.c (generate): Change to return an error code. Take + care of _gcry_generate_elg_prime return code. + (generate_using_x): Take care of _gcry_generate_elg_prime return code. + (elg_generate): Propagate return code from generate. + +2014-08-12 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Support Montgomery curve for gcry_mpi_ec_mul_point. + + commit 34bb55ee36df3aca3ebca88f8b61c786cd0c0701 + * mpi/ec.c (_gcry_mpi_ec_get_affine): Support Montgomery curve. + (montgomery_ladder): New. + (_gcry_mpi_ec_mul_point): Implemention using montgomery_ladder. + (_gcry_mpi_ec_curve_point): Check x-coordinate is valid. + +2014-08-09 Werner Koch <wk@gnupg.org> + + tests: Add a benchmark for Elgamal. + + commit e6d354865bf8f3d4c1bb5e8157a76fdd442cff41 + * tests/benchmark.c (sample_public_elg_key_1024): New. + (sample_private_elg_key_1024): New. + (sample_public_elg_key_2048, sample_private_elg_key_2048): New. + (sample_public_elg_key_3072, sample_private_elg_key_3072): New. + (elg_bench): New. + (main): Add elg_bench. Add commands "elg" and "public". + +2014-08-08 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Add cofactor to domain parameters. + + commit 9933b9e5e1a3f5b1019c75f93bd265d4a1ecc270 + * src/ec-context.h (mpi_ec_ctx_s): Add cofactor 'h'. + * cipher/ecc-common.h (elliptic_curve_t): Add cofactor 'h'. + (_gcry_ecc_update_curve_param): New API adding cofactor. + + * cipher/ecc-curves.c (ecc_domain_parms_t): Add cofactor 'h'. + (ecc_domain_parms_t domain_parms): Add cofactors. + (_gcry_ecc_fill_in_curve, _gcry_ecc_update_curve_param) + (_gcry_ecc_get_curve, _gcry_mpi_ec_new, _gcry_ecc_get_param_sexp) + (_gcry_ecc_get_mpi): Handle cofactor. + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_genkey): Likewise. + * cipher/ecc-misc.c (_gcry_ecc_curve_free) + (_gcry_ecc_curve_copy): Likewise. + * cipher/ecc.c (nist_generate_key, ecc_generate) + (ecc_check_secret_key, ecc_sign, ecc_verify, ecc_encrypt_raw) + (ecc_decrypt_raw, _gcry_pk_ecc_get_sexp, _gcry_pubkey_spec_ecc): + Likewise. + (compute_keygrip): Handle cofactor, but skip it for its computation. + * mpi/ec.c (ec_deinit): Likewise. + * tests/t-mpi-point.c (context_param): Likewise. + (test_curve): Add cofactors. + * tests/curves.c (sample_key_1, sample_key_2): Add cofactors. + * tests/keygrip.c (key_grips): Add cofactors. + +2014-08-05 Werner Koch <wk@gnupg.org> + + mpi: Fix regression for powerpc-apple-darwin detection. + + commit 4ce77b0a810d3c889c07dfb385127d90fa1ae36a + * mpi/config.links: Add separate entry for powerpc-apple-darwin. + + Fix bug inhibiting the use of the sentinel attribute. + + commit d2d28298ccc0d0f3c0b03fd323deb1e8808ef74f + * src/gcrypt.h.in: Fix typo in macro. + + mpi: Use BSD syntax for x86_64-apple-darwin. + + commit 71939faa7c54e7b4b28d115e748a85f134876a02 + * mpi/config.links: Add case for x86_64-apple-darwin. + +2014-08-05 Kristian Fiskerstrand <kf@sumptuouscapital.com> + + Fix building for the x32 target without asm modules. + + commit a17c29844b63e9e869f7855d901bc9d859234ead + * mpi/generic/mpi-asm-defs.h: Use a fixed value for the x32 ABI. + +2014-07-25 Werner Koch <wk@gnupg.org> + + ecc: Support the non-standard 0x40 compression flag for EdDSA. + + commit 4556f9b19c024f16bdf542da7173395c0741b91d + * cipher/ecc.c (ecc_generate): Check the "comp" flag for EdDSA. + * cipher/ecc-eddsa.c (eddsa_encode_x_y): Add arg WITH_PREFIX. + (_gcry_ecc_eddsa_encodepoint): Ditto. + (_gcry_ecc_eddsa_ensure_compact): Handle the 0x40 compression prefix. + (_gcry_ecc_eddsa_decodepoint): Ditto. + * tests/keygrip.c: Check an compresssed with prefix Ed25519 key. + * tests/t-ed25519.inp: Ditto. + + mpi: Extend the internal mpi_get_buffer. + + commit 0e10902ad7584277ac966367efc712b183784532 + * mpi/mpicoder.c (do_get_buffer): Add arg EXTRAALLOC. + (_gcry_mpi_get_buffer_extra): New. + + cipher: Fix compiler warning for chacha20. + + commit 4e0bf1b9190ce08fb23eb3ae0c3be58954ff36ab + * cipher/chacha20.c (chacha20_blocks) [!USE_SSE2]: Do not build. + +2014-07-16 NIIBE Yutaka <gniibe@fsij.org> + + mpi: Add mpi_swap_cond. + + commit 4846e52728970e3117f3a046ef9010be089a3ae4 + * mpi/mpiutil.c (_gcry_mpi_swap_cond): New. + * src/mpi.h (mpi_swap_cond): New. + +2014-06-29 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Speed-up SHA-1 NEON assembly implementation. + + commit 1b9b00bbe41bbed32563f1102049521e703e72bd + * cipher/sha1-armv7-neon.S: Tweak implementation for speed-up. + +2014-06-28 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + gostr3411_94: rewrite to use u32 mathematic. + + commit 066f068bd0bc4d8e01f1f18b6153cdc8d2c245d7 + * cipher/gost28147.c (_gcry_gost_enc_data): New. + * cipher/gostr3411-94.c: Rewrite implementation to use u32 mathematic + internally. + * cipher/gost28147.c (_gcry_gost_enc_one): Remove. + + gost28147: use bufhelp helpers. + + commit 7aeba6c449169926076df83b01ddbfa6b41fe411 + * cipher/gost28147.c (gost_setkey, gost_encrypt_block, gost_decrypt_block): + use buf_get_le32/buf_put_le32 helpers. + + Fixup curve name in the GOST2012 test case. + + commit b78d504fa8745b8b04589acbbcf7dd5fe9279d13 + * tests/basic.c (check_pubkey): fixup curve name in public key. + + Update PBKDF2 tests with GOST R 34.11-94 test cases. + + commit 7533b2ad46f42e98d9dba52e88e79c0311d2d3b7 + * tests/t-kdf.c (check_pbkdf2): Add MD_GOSTR3411_CP test cases. + + Add GOST R 34.11-94 variant using id-GostR3411-94-CryptoProParamSet. + + commit 25d6af77e2336b5979ddbe8b90978fe5b61dfaf9 + * src/gcrypt.h.in (GCRY_MD_GOSTR3411_CP): New. + * src/cipher.h (_gcry_digest_spec_gost3411_cp): New. + * cipher/gost28147.c (_gcry_gost_enc_one): Differentiate between + CryptoPro and Test S-Boxes. + * cipher/gostr3411-94.c (_gcry_digest_spec_gost3411_cp, + gost3411_cp_init): New. + * cipher/md.c (md_open): GCRY_MD_GOSTR3411_CP also uses B=32. + + gost28147: support GCRYCTL_SET_SBOX. + + commit 5ee35a04362c94e680ef3633fa83b72e0aee8626 + cipher/gost28147.c (gost_set_extra_info, gost_set_sbox): New. + + Support setting s-box for the ciphers that require it. + + commit fb074d113fcbf66a5c20592625cb19051f3430f5 + * src/gcrypt.h.in (GCRYCTL_SET_SBOX, gcry_cipher_set_sbox): New. + * cipher/cipher.c (_gcry_cipher_ctl): pass GCRYCTL_SET_SBOX to + set_extra_info callback. + + cipher/gost28147: generate optimized s-boxes from compact ones. + + commit 164738a0292b3f32c7747099ad9cadace58e5eda + * cipher/gost-s-box.c: New. Outputs optimized expanded representation of + s-boxes (4x256) from compact 16x8 representation. + * cipher/Makefile.am: Add gost-sb.h dependency to gost28147.lo + * cipher/gost.h: Add sbox to the GOST28147_context structure. + * cipher/gost28147.c (gost_setkey): Set default s-box to test s-box from + GOST R 34.11 (this was the only one S-box before). + * cipher/gost28147.c (gost_val): Use sbox from the context. + + gost28147: add OIDs used to define cipher mode. + + commit 34a58010000288515636706811c3837f32957b2e + * cipher/gost28147 (oids_gost28147): Add OID from RFC4357. + + GOST R 34.11-94 add OIDs. + + commit 8b221cf5ce233c8c49a4e4ecebb70d523fc37837 + * cipher/gostr3411-94.c: Add OIDs for GOST R 34.11-94 from RFC 4357. + +2014-05-21 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + tests: add larger test-vectors for hash algorithms. + + commit f14fb5b427b5159fcd9603d2b3cde936889cf430 + * tests/basic.c (check_digests): Add large test-vectors for MD5, SHA1, + SHA224, SHA256, SHA384, RMD160, CRC32, TIGER1, WHIRLPOOL and + GOSTR3411_94. + + sha512: fix ARM/NEON implementation. + + commit beb901575f0d6cd6a0a27506ebea9a725754d0cc + * cipher/sha512-armv7-neon.S + (_gcry_sha512_transform_armv7_neon): Byte-swap RW67q and RW1011q + correctly in multi-block loop. + * tests/basic.c (check_digests): Add large test vector for SHA512. + +2014-05-20 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix ARM assembly when building __PIC__ + + commit 994c758d8f5471c7e9c38c2834742cca2502d35f + * cipher/camellia-arm.S (GET_DATA_POINTER): New. + (_gcry_camellia_arm_encrypt_block): Use GET_DATA_POINTER. + (_gcry_camellia_arm_decrypt_block): Ditto. + * cipher/cast5-arm.S (GET_DATA_POINTER): New. + (_gcry_cast5_arm_encrypt_block, _gcry_cast5_arm_decrypt_block) + (_gcry_cast5_arm_enc_blk2, _gcry_cast5_arm_dec_blk2): Use + GET_DATA_POINTER. + * cipher/rijndael-arm.S (GET_DATA_POINTER): New. + (_gcry_aes_arm_encrypt_block, _gcry_aes_arm_decrypt_block): Use + GET_DATA_POINTER. + * cipher/sha1-armv7-neon.S (GET_DATA_POINTER): New. + (.LK_VEC): Move from .text to .data section. + (_gcry_sha1_transform_armv7_neon): Use GET_DATA_POINTER. + +2014-05-17 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add Poly1305 to documentation. + + commit bf4943932dae95a0573b63bf32a9b9acd5a6ddf3 + * doc/gcrypt.texi: Add documentation for Poly1305 MACs and AEAD mode. + +2014-05-16 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + chacha20: add SSE2/AMD64 optimized implementation. + + commit 323b1eb80ff3396d83fedbe5bba9a4e6c412d192 + * cipher/Makefile.am: Add 'chacha20-sse2-amd64.S'. + * cipher/chacha20-sse2-amd64.S: New. + * cipher/chacha20.c (USE_SSE2): New. + [USE_SSE2] (_gcry_chacha20_amd64_sse2_blocks): New. + (chacha20_do_setkey) [USE_SSE2]: Use SSE2 implementation for blocks + function. + * configure.ac [host=x86-64]: Add 'chacha20-sse2-amd64.lo'. + + poly1305: add AMD64/AVX2 optimized implementation. + + commit 98f021961ee65669037bc8bb552a69fd78f610fc + * cipher/Makefile.am: Add 'poly1305-avx2-amd64.S'. + * cipher/poly1305-avx2-amd64.S: New. + * cipher/poly1305-internal.h (POLY1305_USE_AVX2) + (POLY1305_AVX2_BLOCKSIZE, POLY1305_AVX2_STATESIZE) + (POLY1305_AVX2_ALIGNMENT): New. + (POLY1305_LARGEST_BLOCKSIZE, POLY1305_LARGEST_STATESIZE) + (POLY1305_STATE_ALIGNMENT): Use AVX2 versions when needed. + * cipher/poly1305.c [POLY1305_USE_AVX2] + (_gcry_poly1305_amd64_avx2_init_ext) + (_gcry_poly1305_amd64_avx2_finish_ext) + (_gcry_poly1305_amd64_avx2_blocks, poly1305_amd64_avx2_ops): New. + (_gcry_poly1305_init) [POLY1305_USE_AVX2]: Use AVX2 implementation if + AVX2 supported by CPU. + * configure.ac [host=x86_64]: Add 'poly1305-avx2-amd64.lo'. + +2014-05-12 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + poly1305: add AMD64/SSE2 optimized implementation. + + commit 297532602ed2d881d8fdc393d1961068a143a891 + * cipher/Makefile.am: Add 'poly1305-sse2-amd64.S'. + * cipher/poly1305-internal.h (POLY1305_USE_SSE2) + (POLY1305_SSE2_BLOCKSIZE, POLY1305_SSE2_STATESIZE) + (POLY1305_SSE2_ALIGNMENT): New. + (POLY1305_LARGEST_BLOCKSIZE, POLY1305_LARGEST_STATESIZE) + (POLY1305_STATE_ALIGNMENT): Use SSE2 versions when needed. + * cipher/poly1305-sse2-amd64.S: New. + * cipher/poly1305.c [POLY1305_USE_SSE2] + (_gcry_poly1305_amd64_sse2_init_ext) + (_gcry_poly1305_amd64_sse2_finish_ext) + (_gcry_poly1305_amd64_sse2_blocks, poly1305_amd64_sse2_ops): New. + (_gcry_polu1305_init) [POLY1305_USE_SSE2]: Use SSE2 version. + * configure.ac [host=x86_64]: Add 'poly1305-sse2-amd64.lo'. + + Add Poly1305 based cipher AEAD mode. + + commit e813958419b0ec4439e6caf07d3b2234cffa2bfa + * cipher/Makefile.am: Add 'cipher-poly1305.c'. + * cipher/cipher-internal.h (gcry_cipher_handle): Add 'u_mode.poly1305'. + (_gcry_cipher_poly1305_encrypt, _gcry_cipher_poly1305_decrypt) + (_gcry_cipher_poly1305_setiv, _gcry_cipher_poly1305_authenticate) + (_gcry_cipher_poly1305_get_tag, _gcry_cipher_poly1305_check_tag): New. + * cipher/cipher-poly1305.c: New. + * cipher/cipher.c (_gcry_cipher_open_internal, cipher_setkey) + (cipher_reset, cipher_encrypt, cipher_decrypt, _gcry_cipher_setiv) + (_gcry_cipher_authenticate, _gcry_cipher_gettag) + (_gcry_cipher_checktag): Handle 'GCRY_CIPHER_MODE_POLY1305'. + (cipher_setiv): Move handling of 'GCRY_CIPHER_MODE_GCM' to ... + (_gcry_cipher_setiv): ... here, as with other modes. + * src/gcrypt.h.in: Add 'GCRY_CIPHER_MODE_POLY1305'. + * tests/basic.c (_check_poly1305_cipher, check_poly1305_cipher): New. + (check_ciphers): Add Poly1305 check. + (check_cipher_modes): Call 'check_poly1305_cipher'. + * tests/bench-slope.c (bench_gcm_encrypt_do_bench): Rename to + bench_aead_... and take nonce as argument. + (bench_gcm_decrypt_do_bench, bench_gcm_authenticate_do_bench): Ditto. + (bench_gcm_encrypt_do_bench, bench_gcm_decrypt_do_bench) + (bench_gcm_authenticate_do_bench, bench_poly1305_encrypt_do_bench) + (bench_poly1305_decrypt_do_bench) + (bench_poly1305_authenticate_do_bench, poly1305_encrypt_ops) + (poly1305_decrypt_ops, poly1305_authenticate_ops): New. + (cipher_modes): Add Poly1305. + (cipher_bench_one): Add special handling for Poly1305. + + Add Poly1305-AES (-Camellia, etc) MACs. + + commit 73b3b75c2221a6e3bed4117e0a206a1193acd2ed + * cipher/mac-internal.h (_gcry_mac_type_spec_poly1305_aes) + (_gcry_mac_type_spec_poly1305_camellia) + (_gcry_mac_type_spec_poly1305_twofish) + (_gcry_mac_type_spec_poly1305_serpent) + (_gcry_mac_type_spec_poly1305_seed): New. + * cipher/mac-poly1305.c (poly1305mac_context_s): Add 'hd' and + 'nonce_set'. + (poly1305mac_open, poly1305mac_close, poly1305mac_setkey): Add handling + for Poly1305-*** MACs. + (poly1305mac_prepare_key, poly1305mac_setiv): New. + (poly1305mac_reset, poly1305mac_write, poly1305mac_read): Add handling + for 'nonce_set'. + (poly1305mac_ops): Add 'poly1305mac_setiv'. + (_gcry_mac_type_spec_poly1305_aes) + (_gcry_mac_type_spec_poly1305_camellia) + (_gcry_mac_type_spec_poly1305_twofish) + (_gcry_mac_type_spec_poly1305_serpent) + (_gcry_mac_type_spec_poly1305_seed): New. + * cipher/mac.c (mac_list): Add Poly1305-AES, Poly1305-Twofish, + Poly1305-Serpent, Poly1305-SEED and Poly1305-Camellia. + * src/gcrypt.h.in: Add 'GCRY_MAC_POLY1305_AES', + 'GCRY_MAC_POLY1305_CAMELLIA', 'GCRY_MAC_POLY1305_TWOFISH', + 'GCRY_MAC_POLY1305_SERPENT' and 'GCRY_MAC_POLY1305_SEED'. + * tests/basic.c (check_mac): Add Poly1305-AES test vectors. + * tests/bench-slope.c (bench_mac_init): Set IV for Poly1305-*** MACs. + * tests/bench-slope.c (mac_bench): Set IV for Poly1305-*** MACs. + + Add Poly1305 MAC. + + commit b8794fed68ebe7567f4617141f0996ad290d9120 + * cipher/Makefile.am: Add 'mac-poly1305.c', 'poly1305.c' and + 'poly1305-internal.h'. + * cipher/mac-internal.h (poly1305mac_context_s): New. + (gcry_mac_handle): Add 'u.poly1305mac'. + (_gcry_mac_type_spec_poly1305mac): New. + * cipher/mac-poly1305.c: New. + * cipher/mac.c (mac_list): Add Poly1305. + * cipher/poly1305-internal.h: New. + * cipher/poly1305.c: New. + * src/gcrypt.h.in: Add 'GCRY_MAC_POLY1305'. + * tests/basic.c (check_mac): Add Poly1035 test vectors; Allow + overriding lengths of data and key buffers. + * tests/bench-slope.c (mac_bench): Increase max algo number from 500 to + 600. + * tests/benchmark.c (mac_bench): Ditto. + + chacha20/AVX2: clear upper-halfs of YMM registers on entry. + + commit c20daeeb05329bfc6cc2c562cbd4b965291fe0e1 + * cipher/chacha20-avx2-amd64.S (_gcry_chacha20_amd64_avx2_blocks): Add + 'vzeroupper' at beginning. + + chacha20/AVX2: check for ENABLE_AVX2_SUPPORT instead of HAVE_GCC_INLINE_ASM_AVX2 + + commit a3062db748f272e0f7346e1ed9e0bf7ed61a4eae + * cipher/chacha20.c (USE_AVX2): Enable depending on + ENABLE_AVX2_SUPPORT, not HAVE_GCC_INLINE_ASM_AVX2. + * cipher/chacha20-avx2-amd64.S: Ditto. + + chacha20/SSSE3: clear XMM registers after use. + + commit a7d9eeeba632b7eb4a5b15ff17f6565181642f3c + * cipher/chacha20-ssse3-amd64.S (_gcry_chacha20_amd64_ssse3_blocks): On + return, clear XMM registers. + +2014-05-11 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + chacha20: add AVX2/AMD64 assembly implementation. + + commit a39ee7555691d18cae97560f130aaf952bfbd278 + * cipher/Makefile.am: Add 'chacha20-avx2-amd64.S'. + * cipher/chacha20-avx2-amd64.S: New. + * cipher/chacha20.c (USE_AVX2): New macro. + [USE_AVX2] (_gcry_chacha20_amd64_avx2_blocks): New. + (chacha20_do_setkey): Select AVX2 implementation if there is HW + support. + (selftest): Increase size of buf by 256. + * configure.ac [host=x86-64]: Add 'chacha20-avx2-amd64.lo'. + + chacha20: add SSSE3 assembly implementation. + + commit def7d4cad386271c6d4e2f10aabe0cb4abd871e4 + * cipher/Makefile.am: Add 'chacha20-ssse3-amd64.S'. + * cipher/chacha20-ssse3-amd64.S: New. + * cipher/chacha20.c (USE_SSSE3): New macro. + [USE_SSSE3] (_gcry_chacha20_amd64_ssse3_blocks): New. + (chacha20_do_setkey): Select SSSE3 implementation if there is HW + support. + * configure.ac [host=x86-64]: Add 'chacha20-ssse3-amd64.lo'. + + Add ChaCha20 stream cipher. + + commit 23f33d57c9b6f2295a8ddfc9a8eee5a2c30cf406 + * cipher/Makefile.am: Add 'chacha20.c'. + * cipher/chacha20.c: New. + * cipher/cipher.c (cipher_list): Add ChaCha20. + * configure.ac: Add ChaCha20. + * doc/gcrypt.texi: Add ChaCha20. + * src/cipher.h (_gcry_cipher_spec_chacha20): New. + * src/gcrypt.h.in (GCRY_CIPHER_CHACHA20): Add new algo. + * tests/basic.c (MAX_DATA_LEN): Increase to 128 from 100. + (check_stream_cipher): Add ChaCha20 test-vectors. + (check_ciphers): Add ChaCha20. + +2014-05-09 Werner Koch <wk@gnupg.org> + + mpi: Fix a subtle bug setting spurious bits with in mpi_set_bit. + + commit 246b7aaae1ee459f440260bbc4ec2c01c5dc3362 + * mpi/mpi-bit.c (_gcry_mpi_set_bit, _gcry_mpi_set_highbit): Clear + allocated but not used bits before resizing. + * tests/t-mpi-bits.c (set_bit_with_resize): New. + +2014-05-07 Werner Koch <wk@gnupg.org> + + Bump LT version. + + commit fc6ff6f73a51bcbbbb3757dc1386da40aa3ae75d + * configure.ac: Bumb LT version to C21/A1/R0. + +2014-04-22 Werner Koch <wk@gnupg.org> + + random: Small patch for consistency and really burn the stack. + + commit a79c4ad7c56ee4410f17beb73eeb58b0dd36bfc6 + * random/rndlinux.c (_gcry_rndlinux_gather_random): s/int/size_t/. + (_gcry_rndlinux_gather_random): Replace memset by wipememory. + +2014-04-16 Werner Koch <wk@gnupg.org> + + pubkey: Re-map all depreccated RSA algo numbers. + + commit 773e23698218755e9172d2507031a8263c47cc0b + * cipher/pubkey.c (map_algo): Mape RSA_E and RSA_S. + +2014-04-15 Werner Koch <wk@gnupg.org> + + cipher: Fix possible NULL dereference. + + commit ae1fbce6dacf14747af0126e640bd4e54cb8c680 + * cipher/md.c (_gcry_md_selftest): Check for spec being NULL. + +2014-03-30 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + 3des: add amd64 assembly implementation for 3DES. + + commit b76b632a453b8d100d024e2439b4358454dc286e + * cipher/Makefile.am: Add 'des-amd64.S'. + * cipher/cipher-selftests.c (_gcry_selftest_helper_cbc) + (_gcry_selftest_helper_cfb, _gcry_selftest_helper_ctr): Handle failures + from 'setkey' function. + * cipher/cipher.c (_gcry_cipher_open_internal) [USE_DES]: Setup bulk + functions for 3DES. + * cipher/des-amd64.S: New file. + * cipher/des.c (USE_AMD64_ASM, ATTR_ALIGNED_16): New macros. + [USE_AMD64_ASM] (_gcry_3des_amd64_crypt_block) + (_gcry_3des_amd64_ctr_enc), _gcry_3des_amd64_cbc_dec) + (_gcry_3des_amd64_cfb_dec): New prototypes. + [USE_AMD64_ASM] (tripledes_ecb_crypt): New function. + (TRIPLEDES_ECB_BURN_STACK): New macro. + (_gcry_3des_ctr_enc, _gcry_3des_cbc_dec, _gcry_3des_cfb_dec) + (bulk_selftest_setkey, selftest_ctr, selftest_cbc, selftest_cfb): New + functions. + (selftest): Add call to CTR, CBC and CFB selftest functions. + (do_tripledes_encrypt, do_tripledes_decrypt): Use + TRIPLEDES_ECB_BURN_STACK. + * configure.ac [host=x86-64]: Add 'des-amd64.lo'. + * src/cipher.h (_gcry_3des_ctr_enc, _gcry_3des_cbc_dec) + (_gcry_3des_cfb_dec): New prototypes. + +2014-03-13 Werner Koch <wk@gnupg.org> + + tests: Print diagnostics for skipped tests. + + commit 50aeee51a0b1a09dd9fff2bb71749a816fe7a791 + * tests/basic.c (show_note): New. + (show_md_not_available): + (show_old_hmac_not_available): + (show_mac_not_available): + (check_digests): Remove USE_foo cpp tests from the test table. Call + show_md_not_available if algo is not available. + (check_hmac): Likewise. + (check_mac): Likewise. + +2014-03-11 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Add MD2 message digest implementation. + + commit 5a8e1504bf8a2ffbc018be576dea77b685200444 + * cipher/md2.c: New. + * cipher/md.c (digest_list): add _gcry_digest_spec_md2. + * tests/basic.c (check_digests): add MD2 test vectors. + * configure.ac (default_digests): disable md2 by default. + +2014-03-04 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Add an utility to calculate hashes over a set of files. + + commit 2b5403c408dfbd71be24c7635f5fa0b61ab4c9bb + * tests/gchash.c: New. + + Add a simple (raw) PKCS#1 padding mode. + + commit ea8d597726305274214224757b32730644e12bd8 + * src/cipher.h (PUBKEY_ENC_PKCS1_RAW): New. + * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist): Handle pkcs1-raw + flag. + * cipher/pubkey-util.c (_gcry_pk_util_data_to_mpi): + Handle s-exp like (data (flags pkcs1-raw) (value xxxxx)) + * cipher/rsa-common.c (_gcry_rsa_pkcs1_encode_raw_for_sig): + PKCS#1-encode data with embedded hash OID for signature verification. + * tests/basic.c (check_pubkey_sign): Add tests for s-exps with pkcs1-raw + flag. + +2014-02-04 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix ARMv6 detection when CFLAGS modify target CPU architecture. + + commit 6be3032048ee2466511d2384fcf2d28b856219b2 + * configure.ac (gcry_cv_cc_arm_arch_is_v6): Use compiler test instead + of preprocessor test. + +2014-01-29 Werner Koch <wk@gnupg.org> + + Reserve control code for FIPS extensions. + + commit aea96a64fbc58a0b6f9f435e97e93294c6eb1052 + * src/gcrypt.h.in (GCRYCTL_INACTIVATE_FIPS_FLAG): New. + (GCRYCTL_REACTIVATE_FIPS_FLAG): New. + * src/global.c (_gcry_vcontrol): Add them but return not_implemented. + +2014-01-29 NIIBE Yutaka <gniibe@fsij.org> + + Fix RSA Blinding. + + commit 121a90d8931944974054f7d94f63b7f89df87fa5 + * cipher/rsa.c (rsa_decrypt): Loop to get multiplicative inverse. + +2014-01-28 Werner Koch <wk@gnupg.org> + + cipher: Take care of ENABLE_NEON_SUPPORT. + + commit 52f7c48c901a3de51bd690a218f3de2f71e8d790 + * cipher/salsa20.c (USE_ARM_NEON_ASM): Define only if + ENABLE_NEON_SUPPORT is defined. + * cipher/serpent.c (USE_NEON): Ditto. + * cipher/sha1.c (USE_NEON): Ditto. + * cipher/sha512.c (USE_ARM_NEON_ASM): Ditto. + + sexp: Fix broken gcry_sexp_nth. + + commit cbdc355415f83ed62da4f3618767eba54d7e6d37 + * src/sexp.c (_gcry_sexp_nth): Return a valid S-expression for a data + element. + (NODE): Remove unused typedef. + (ST_HINT): Comment unused macro. + + * tests/t-sexp.c (bug_1594): New. + (main): Run new test. + +2014-01-27 Werner Koch <wk@gnupg.org> + + tests: Improve t-common.h. + + commit 7460e9243b3cc050631c37ed4f2713ae7bcb6762 + * tests/t-common.h: Add couple of macros. Check that config.h has + been included. + (show): Rename to info. + * tests/t-lock.c, tests/t-sexp.c: Adjust for changes. + + mpi: Minor fix for Atari-mint. + + commit 3caa0f1319dc4779e0d6eee4460c1af2a12b2c3c + * mpi/config.links [m68k-atari-mint]: Do not assume 68020. Suggested + by Alan Hourihane. + + (cherry picked from commit 420f42a5752e90a8b27d58ffa1ddfe6e4ab341e8) + +2014-01-27 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Fix most of memory leaks in tests code. + + commit 5c150ece094bf0a504a111ce6c7b72e8d0b0457a + * tests/basic.c (check_ccm_cipher): Close cipher after use. + * tests/basic.c (check_one_cipher): Correct length of used buffer. + * tests/benchmark.c (cipher_bench): Use xcalloc to make buffer + initialized. + * tests/keygen.c (check_ecc_keys): Release generated key. + * tests/t-mpi-point.c (context_param): Release mpi Q. + * tests/t-sexp.c (check_extract_param): Release extracted number. + + Fix memory leaks in ecc code. + + commit 6d87e6abdfb7552323a95401f14e6367398a3e5a + * cipher/ecc-curves.c (_gcry_ecc_update_curve_param): Release passed mpi + values. + * cipher/ecc.c (compute_keygrip): Fix potential memory leak in error + path. + * cipher/ecc.c (_gcry_ecc_get_curve): Release temporary mpi. + + Fix number of blocks passed used in _gcry_rmd160_mixblock. + + commit 5d23e7b9a77421f3ebfda4a84c459a8729f3bb41 + * cipher/rmd160.c (_gcry_rmd160_mixblock): pass 1 to transform + +2014-01-27 Werner Koch <wk@gnupg.org> + + Small Windows build tweaks. + + commit f7df906171854b6b6506b82d4fee2c2ebb0327ea + * configure.ac (HAVE_PTHREAD): Do test when building for Windows. + + * tests/basic.c: Replace "%zi" by "%z" and a cast to make it work + under Windows. + + Update gpg-error autoconf macros to fix threading problems. + + commit 79da0358fd555361e1ce4202f55494a8918eb8ae + * m4/gpg-error.m4: Update to version 2014-01-24. + * tests/Makefile.am (t_lock_LDADD): Use MT Libs. + +2014-01-24 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + tests: Pass -no-install to libtool. + + commit bf34bfa5c458ee5ece91f25e3b4194d768498ab6 + * tests/Makefile.am: add AM_LDFLAGS = -no-install + +2014-01-24 Werner Koch <wk@gnupg.org> + + tests: Add a test for the internal locking. + + commit ff91ec934ed52294cddcd7dcfacc04721a0487bf + * src/global.c (external_lock_test): New. + (_gcry_vcontrol): Call new function with formerly reserved code 61. + + * tests/t-common.h: New. Taken from current libgpg-error. + * tests/t-lock.c: New. Based on t-lock.c from libgpg-error. + * configure.ac (HAVE_PTHREAD): Set macro to 1 if defined. + (AC_CHECK_FUNCS): Check for flockfile. + * tests/Makefile.am (tests_bin): Add t-lock. + (noinst_HEADERS): Add t-common.h + (LDADD): Move value to ... + (default_ldadd): new. + (t_lock_LDADD): New. + + Check compiler features only for the relevant platform. + + commit 24e65d715812cea28732397870cb1585b8435521 + * mpi/config.links (mpi_cpu_arch): Always set for ARM. Set for HPPA. + Set to "undefined" for unknown platforms. + (try_asm_modules): Act upon only after having detected the CPU. + * configure.ac: Move the call to config.links before the platform + specific compiler checks. Check platform specific features only if + the platform is targeted. + +2014-01-23 Werner Koch <wk@gnupg.org> + + Support building using the latest mingw-w64 toolchain. + + commit 4ad3417acab5021db1f722c314314ce4b781833a + * acinclude.m4 (GNUPG_SYS_SYMBOL_UNDERSCORE): Change mingw detection. + +2014-01-20 Werner Koch <wk@gnupg.org> + + cipher: Fix commit 94030e44. + + commit dad06e4d1b835bac778b87090b1d3894b7535b14 + * cipher/tiger.c (tiger_init): Add arg FLAGS. + (tiger1_init, tiger2_init): Ditto. + + tests: Rename tsexp.c. + + commit 192e77d123fdb04c459c998b9eb1731618a833fa + * tests/tsexp.c: Rename to t-sexp.c + +2014-01-19 Werner Koch <wk@gnupg.org> + + md: Add Whirlpool bug emulation feature. + + commit 94030e44aaff805d754e368507f16dd51a531b72 + * src/gcrypt.h.in (GCRY_MD_FLAG_BUGEMU1): New. + * src/cipher-proto.h (gcry_md_init_t): Add arg FLAGS. Change all code + to implement that flag. + * cipher/md.c (gcry_md_context): Replace SECURE and FINALIZED by bit + field FLAGS. Add flag BUGEMU1. Change all users. + (md_open): Replace args SECURE and HMAC by FLAGS. Init flags.bugemu1. + (_gcry_md_open): Add for GCRY_MD_FLAG_BUGEMU1. + (md_enable): Pass bugemu1 flag to the hash init function. + (_gcry_md_reset): Ditto. + +2014-01-17 Werner Koch <wk@gnupg.org> + + Actually check for uint64_t. + + commit c3b30bae7d1e157f8b65e32ba1b3a516f2bbf58b + * configure.ac: Check size of uint64_t and the UINT64_C macro. + +2014-01-16 Werner Koch <wk@gnupg.org> + + Replace ath based mutexes by gpgrt based locks. + + commit cfc151ba637200e4fc05d9481a8df2071b2f9a47 + * configure.ac (NEED_GPG_ERROR_VERSION): Require 1.13. + (gl_LOCK): Remove. + * src/ath.c, src/ath.h: Remove. Remove from all files. Replace all + mutexes by gpgrt based statically initialized locks. + * src/global.c (global_init): Remove ath_init. + (_gcry_vcontrol): Make ath install a dummy function. + (print_config): Remove threads info line. + + * doc/gcrypt.texi: Simplify the multi-thread related documentation. + +2014-01-15 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Fix _gcry_mpi_ec_p_new to allow secp256k1. + + commit 49edeebb43174865cf4fa2c170a42a8e4274c4f0 + * mpi/ec.c (_gcry_mpi_ec_p_new): Remove checking a!=0. + * tests/t-mpi-point.c (context_alloc): Remove two spurious tests. + +2014-01-14 Milan Broz <gmazyland@gmail.com> + + PBKDF2: Use gcry_md_reset to speed up calculation. + + commit 04cda6b7cc16f3f52c12d9d3e46c56701003496e + * cipher/kdf.c (_gcry_kdf_pkdf2): Use gcry_md_reset + to speed up calculation. + +2014-01-13 Werner Koch <wk@gnupg.org> + + Fix macro conflict in NetBSD. + + commit 5f2af6c26bc04975c0b518881532871d7387d7ce + * cipher/bithelp.h (bswap32): Rename to _gcry_bswap32. + (bswap64): Rename to _gcry_bswap64. + + Use internal malloc function in fips.c. + + commit 518ae274a1845ce626b2b4223a9b3805cbbab1a7 + * src/fips.c (check_binary_integrity): s/gcry_malloc/xtrymalloc/. + +2014-01-13 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Truncate hash values for ECDSA signature scheme. + + commit 9edcf1090e0485f9f383b6c54b18ea8ca3d4a225 + * cipher/dsa-common (_gcry_dsa_normalize_hash): New. Truncate opaque + mpis as required for DSA and ECDSA signature schemas. + * cipher/dsa.c (verify): Return gpg_err_code_t value from verify() to + behave like the rest of internal sign/verify functions. + * cipher/dsa.c (sign, verify, dsa_verify): Factor out hash truncation. + * cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_sign): Factor out hash truncation. + * cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_verify): + as required by ECDSA scheme, truncate hash values to bitlength of + used curve. + * tests/pubkey.c (check_ecc_sample_key): add a testcase for hash + truncation. + + Add GOST R 34.10-2012 curves proposed by TC26. + + commit 2c5ec803100ed8261e51442fb93b75367b7725ea + * cipher/ecc-curves.c (domain_parmss): Add two GOST R 34.10-2012 curves + proposed/pending to standardization by TC26 (Russian cryptography + technical comitee). + * cipher/ecc-curves.c (curve_alias): Add OID aliases. + * tests/curves.c: Increase N_CURVES. + + Add GOST R 34.10-2001 curves per RFC4357. + + commit 9bedc5c3b646dfe481678ca58f5466ac46decaf7 + * cipher/ecc-curves.c (domain_parms): Add 3 curves defined in rfc4357. + * cipher/ecc-curves.c (curve_aliases): Add OID and Xch aliases for GOST + curves. + * tests/curves.c (N_CURVES): Update value. + + Fix typo in search_oid. + + commit 7edcb574d8d6dffb6e234c2ba1996a9a04923859 + * cipher/md.c (search_oid): Invert condition on oid comparison. + + Add MD2-HMAC calculation support. + + commit 653b58cb5e85511b6c04c3f85ef3e372c2e9f74f + * src/gcrypt.h.in (GCRY_MAC_HMAC_MD2): New. + * cipher/mac-hmac.c: Support GCRY_MAC_HMAC_MD2. + + Add a function to retrieve algorithm used by MAC handler. + + commit 8439a379c86ef1088465ea70ac10840759a1638e + * cipher/mac.c (_gcry_mac_get_algo): New function, returns used algo. + * src/visibility.c (gcry_mac_get_algo): New wrapper. + * src/visibility.h: Hanlde gcry_mac_get_algo. + * src/gcrypt-int.h (_gcry_mac_get_algo): New. + * src/gcrypt.h.in (gcry_mac_get_algo): New. + * src/libgcrypt.def (gcry_mac_get_algo): New. + * src/libgcrypt.vers (gcry_mac_get_algo): New. + * doc/gcrypt.texi: Document gcry_mac_get_algo. + * tests/basic.c (check_one_mac): Verify gcry_mac_get_algo. + + Correct formatting of gcry_mac_get_algo_keylen documentation. + + commit 36c9e0e4eb4f935da90df1c8df484d1940bda5eb + * doc/gcrypt.texi: add braces near gcry_mac_get_algo_keylen + documentation. + + Use braces around unsigned int in gcry_mac_get_algo_keylen + documentation, otherwise texinfo breaks that and uses 'int' as a + function definition. + +2014-01-13 Werner Koch <wk@gnupg.org> + + ecc: Make a macro shorter. + + commit 2ef48ba59c32bfa1a9265d5eea8ab225a658903a + * src/mpi.h (MPI_EC_TWISTEDEDWARDS): Rename to MPI_EC_EDWARDS. CHnage + all users. + * cipher/ecc-curves.c (domain_parms): Add parameters for Curve3617 as + comment. + * mpi/ec.c (dup_point_twistededwards): Rename to dup_point_edwards. + (add_points_twistededwards): Rename to add_points_edwards. + +2014-01-12 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix assembly division check. + + commit ef3e66e168c4b9b86bfc4903001631e53a7125d8 + * configure.ac (gcry_cv_gcc_as_const_division_ok): Correct variable + name mismatch at '--Wa,--divide' workaround check. + +2014-01-12 NIIBE Yutaka <gniibe@fsij.org> + + Add secp256k1 curve. + + commit 019e0e9e8c77a2edf283745e05e9301673ea6a0a + * cipher/ecc-curves.c (curve_aliases): Add secp256k1 and its OID. + (domain_parms): Add secp256k1's domain paramerter. + + * tests/basic.c (check_pubkey): Add a key of secp256k1. + + * tests/curves.c (N_CURVES): Updated. + +2014-01-12 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix constant division for AMD64 assembly on Solaris/x86. + + commit 43376891c01f4aff1fbfb23beafebb5adfd0868c + * configure.ac (gcry_cv_gcc_as_const_division_ok): Add new check for + constant division in assembly and test for "-Wa,--divide" workaround. + (gcry_cv_gcc_amd64_platform_as_ok): Check for also constant division. + +2014-01-10 Werner Koch <wk@gnupg.org> + + Use the generic autogen.sh script. + + commit b0ac1f9b143aa15855914ba93fef900288d45c9c + * autogen.rc: New. + * Makefile.am (EXTRA_DIST): Add it. + * autogen.sh: Update from current GnuPG. + + Move all helper scripts to build-aux/ + + commit df9b4eabf52faee6f289a4bc62219684442ae383 + * scripts/: Rename to build-aux/. + * compile, config.guess, config.rpath, config.sub + * depcomp, doc/mdate-sh, doc/texinfo.tex + * install-sh, ltmain.sh, missing: Move to build-aux/. + * Makefile.am (EXTRA_DIST): Adjust. + * configure.ac (AC_CONFIG_AUX_DIR): New. + (AM_SILENT_RULES): New. + +2013-12-30 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add blowfish/serpent ARM assembly files to Makefile.am. + + commit 7fef7f481c0a1542be34d1dc831f58d41846ac29 + * cipher/Makefile.am: Add 'blowfish-arm.S' and 'serpent-armv7-neon.S'. + + Add AMD64 assembly implementation for arcfour. + + commit 7547898109c72a97e3102b2a045ee4fdb2aa40bf + * cipher/Makefile.am: Add 'arcfour-amd64.S'. + * cipher/arcfour-amd64.S: New. + * cipher/arcfour.c (USE_AMD64_ASM): New. + [USE_AMD64_ASM] (ARCFOUR_context, _gcry_arcfour_amd64) + (encrypt_stream): New. + * configure.ac [host=x86_64]: Add 'arcfour-amd64.lo'. + + Parse /proc/cpuinfo for ARM HW features. + + commit a05be441d8cd89b90d8d58e3a343a436dae377d0 + * src/hwf-arm.c [__linux__] (HAS_PROC_CPUINFO) + (detect_arm_proc_cpuinfo): New. + (_gcry_hwf_detect_arm) [HAS_PROC_CPUINFO]: Check '/proc/cpuinfo' for + HW features. + + Fix buggy/incomplete detection of AVX/AVX2 support. + + commit bbcb12187afb1756cb27296166b57fa19ee45d4d + * configure.ac: Also check for 'xgetbv' instruction in AVX and AVX2 + inline assembly checks. + * src/hwf-x86.c [__i386__] (get_xgetbv): New function. + [__x86_64__] (get_xgetbv): New function. + [HAS_X86_CPUID] (detect_x86_gnuc): Check for OSXSAVE and OS support for + XMM&YMM registers and enable AVX/AVX2 only if XMM&YMM registers are + supported by OS. + +2013-12-18 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Change utf-8 copyright characters to '(C)' + + commit b7e814f93ee40fcfe17a187a8989c07fde2ba0cd + cipher/blowfish-amd64.S: Change utf-8 encoded copyright character to + '(C)'. + cipher/blowfish-arm.S: Ditto. + cipher/bufhelp.h: Ditto. + cipher/camellia-aesni-avx-amd64.S: Ditto. + cipher/camellia-aesni-avx2-amd64.S: Ditto. + cipher/camellia-arm.S: Ditto. + cipher/cast5-amd64.S: Ditto. + cipher/cast5-arm.S: Ditto. + cipher/cipher-ccm.c: Ditto. + cipher/cipher-cmac.c: Ditto. + cipher/cipher-gcm.c: Ditto. + cipher/cipher-selftest.c: Ditto. + cipher/cipher-selftest.h: Ditto. + cipher/mac-cmac.c: Ditto. + cipher/mac-gmac.c: Ditto. + cipher/mac-hmac.c: Ditto. + cipher/mac-internal.h: Ditto. + cipher/mac.c: Ditto. + cipher/rijndael-amd64.S: Ditto. + cipher/rijndael-arm.S: Ditto. + cipher/salsa20-amd64.S: Ditto. + cipher/salsa20-armv7-neon.S: Ditto. + cipher/serpent-armv7-neon.S: Ditto. + cipher/serpent-avx2-amd64.S: Ditto. + cipher/serpent-sse2-amd64.S: Ditto. + + Add ARM/NEON implementation for SHA-1. + + commit fc7dcf616937afaf73cfda1bf7bd79566a96b130 + * cipher/Makefile.am: Add 'sha1-armv7-neon.S'. + * cipher/sha1-armv7-neon.S: New. + * cipher/sha1.c (USE_NEON): New. + (SHA1_CONTEXT, sha1_init) [USE_NEON]: Add and initialize 'use_neon'. + [USE_NEON] (_gcry_sha1_transform_armv7_neon): New. + (transform) [USE_NEON]: Use ARM/NEON assembly if enabled. + * configure.ac: Add 'sha1-armv7-neon.lo'. + + Improve performance of SHA-512/ARM/NEON implementation. + + commit df629ba53a662427ebd3ddca90c3fe9ddd6511d3 + * cipher/sha512-armv7-neon.S (RT01q, RT23q, RT45q, RT67q): New. + (round_0_63, round_64_79): Remove. + (rounds2_0_63, rounds2_64_79): New. + (_gcry_sha512_transform_armv7_neon): Add 'nblks' input; Handle multiple + input blocks; Use new round macros. + * cipher/sha512.c [USE_ARM_NEON_ASM] + (_gcry_sha512_transform_armv7_neon): Add 'num_blks'. + (transform) [USE_ARM_NEON_ASM]: Pass nblks to assembly. + + Add AVX and AVX2/BMI implementations for SHA-256. + + commit a5c2bbfe0db515d739ab683297903c77b1eec124 + * LICENSES: Add 'cipher/sha256-avx-amd64.S' and + 'cipher/sha256-avx2-bmi2-amd64.S'. + * cipher/Makefile.am: Add 'sha256-avx-amd64.S' and + 'sha256-avx2-bmi2-amd64.S'. + * cipher/sha256-avx-amd64.S: New. + * cipher/sha256-avx2-bmi2-amd64.S: New. + * cipher/sha256-ssse3-amd64.S: Use 'lea' instead of 'add' in few + places for tiny speed improvement. + * cipher/sha256.c (USE_AVX, USE_AVX2): New. + (SHA256_CONTEXT) [USE_AVX, USE_AVX2]: Add 'use_avx' and 'use_avx2'. + (sha256_init, sha224_init) [USE_AVX, USE_AVX2]: Initialize above + new context members. + [USE_AVX] (_gcry_sha256_transform_amd64_avx): New. + [USE_AVX2] (_gcry_sha256_transform_amd64_avx2): New. + (transform) [USE_AVX2]: Use AVX2 assembly if enabled. + (transform) [USE_AVX]: Use AVX assembly if enabled. + * configure.ac: Add 'sha256-avx-amd64.lo' and + 'sha256-avx2-bmi2-amd64.lo'. + +2013-12-17 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add AVX and AVX/BMI2 implementations for SHA-1. + + commit e4e458465b124e25b6aec7a60174bf1ca32dc5fd + * cipher/Makefile.am: Add 'sha1-avx-amd64.S' and + 'sha1-avx-bmi2-amd64.S'. + * cipher/sha1-avx-amd64.S: New. + * cipher/sha1-avx-bmi2-amd64.S: New. + * cipher/sha1.c (USE_AVX, USE_BMI2): New. + (SHA1_CONTEXT) [USE_AVX]: Add 'use_avx'. + (SHA1_CONTEXT) [USE_BMI2]: Add 'use_bmi2'. + (sha1_init): Initialize 'use_avx' and 'use_bmi2'. + [USE_AVX] (_gcry_sha1_transform_amd64_avx): New. + [USE_BMI2] (_gcry_sha1_transform_amd64_bmi2): New. + (transform) [USE_BMI2]: Use BMI2 assembly if enabled. + (transform) [USE_AVX]: Use AVX assembly if enabled. + * configure.ac: Add 'sha1-avx-amd64.lo' and 'sha1-avx-bmi2-amd64.lo'. + + SHA-1/SSSE3: Improve performance on large buffers. + + commit 6fd0dd2a5f1362f91e2861cd9d300341a43842a5 + * cipher/sha1-ssse3-amd64.S (RNBLKS): New. + (_gcry_sha1_transform_amd64_ssse3): Handle multiple input blocks, with + software pipelining of next data block processing. + * cipher/sha1.c [USE_SSSE3] (_gcry_sha1_transform_amd64_ssse3): Add + 'nblks'. + (transform) [USE_SSSE3]: Pass nblks to assembly function. + + Add bulk processing for hash transform functions. + + commit 50b8c8342d023038a4b528af83153293dd2756ea + * cipher/hash-common.c (_gcry_md_block_write): Preload 'hd->blocksize' + to stack, pass number of blocks to 'hd->bwrite'. + * cipher/hash-common.c (_gcry_md_block_write_t): Add 'nblks'. + * cipher/gostr3411-94.c: Rename 'transform' function to + 'transform_blk', add new 'transform' function with 'nblks' as + additional input. + * cipher/md4.c: Ditto. + * cipher/md5.c: Ditto. + * cipher/md4.c: Ditto. + * cipher/rmd160.c: Ditto. + * cipher/sha1.c: Ditto. + * cipher/sha256.c: Ditto. + * cipher/sha512.c: Ditto. + * cipher/stribog.c: Ditto. + * cipher/tiger.c: Ditto. + * cipher/whirlpool.c: Ditto. + +2013-12-16 Werner Koch <wk@gnupg.org> + + Release 1.6.0. + + commit 0ea9731e1c93a962f6266004ab0e7418c19d6277 + + + doc: Change yat2m to allow arbitrary condition names. + + commit 9a912f8c4f366c53f1cdb94513b67b937e87178b + * doc/yat2m.c (MAX_CONDITION_NESTING): New. + (gpgone_defined): Remove. + (condition_s, condition_stack, condition_stack_idx): New. + (cond_is_active, cond_in_verbatim): New. + (add_predefined_macro, set_macro, macro_set_p): New. + (evaluate_conditions, push_condition, pop_condition): New. + (parse_file): Rewrite to use the condition stack. + (top_parse_file): Set prefined macros. + (main): Change -D to define arbitrary macros. + + tests: Add SHA-512 to the long hash test. + + commit 0d3bd23d7f730b9bbc81fc8da8d99f4853c36020 + * tests/hashtest.c (testvectors): Add vectors for 256GiB SHA-512. + * tests/hashtest-256g.in (algos): Add test for SHA-512. + + Add configure option --enable-large-data-tests. + + commit a6b9304a889397ac98e1c2c4ac3e178669d94492 + * configure.ac: Add option --enable-large-data-tests. + * tests/hashtest-256g.in: New. + * tests/Makefile.am (EXTRA_DIST): Add hashtest-256g.in. + (TESTS): Split up into tests_bin, tests_bin_last, tests_sh, and + tests_sh_last. + (tests_sh_last): Add hashtest-256g + (noinst_PROGRAMS): Add only tests_bin and tests_bin_last. + (bench-slope.log, hashtest-256g.log): New rules to enforce serial run. + + random: Call random progress handler more often. + + commit 5a7ce59396fe56f0d681df314bfbdb5f7732d4b1 + * random/rndlinux.c (_gcry_rndlinux_gather_random): Update progress + indicator earlier. + + cipher: Normalize the MPIs used as input to secret key functions. + + commit dec048b2ec79271a2f4405be5b87b1e768b3f1a9 + * cipher/dsa.c (sign): Normalize INPUT. + * cipher/elgamal.c (decrypt): Normalize A and B. + * cipher/rsa.c (secret): Normalize the INPUT. + (rsa_decrypt): Reduce DATA before passing to secret. + +2013-12-16 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Change dummy variable in mpih-div.c to mpi_limb_t type. + + commit 953535a7de68cf62b5b1ad6f96ea3a9edd83762c + * mpi/mpih-div.c (_gcry_mpih_mod_1, _gcry_mpih_divmod_1): Change dummy + variable to 'mpi_limb_t' type from 'int'. + + Remove duplicate gcry_mac_hd_t typedef. + + commit 5c31990214b58c4e17edb01fbbe6d9f573975a22 + * cipher/mac-internal.h (gcry_mac_hd_t): Remove. + +2013-12-15 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Use u64 for CCM data lengths. + + commit 110fed2d6b0bbc97cb5cc0a3a564e05fc42afa2d + * cipher/cipher-ccm.c: Move code inside [HAVE_U64_TYPEDEF]. + [HAVE_U64_TYPEDEF] (_gcry_cipher_ccm_set_lengths): Use 'u64' for + data lengths. + [!HAVE_U64_TYPEDEF] (_gcry_cipher_ccm_encrypt) + (_gcry_cipher_ccm_decrypt, _gcry_cipher_ccm_set_nonce) + (_gcry_cipher_ccm_authenticate, _gcry_cipher_ccm_get_tag) + (_gcry_cipher_ccm_check_tag): Dummy functions returning + GPG_ERROR_NOT_SUPPORTED. + * cipher/cipher-internal.h (gcry_cipher_handle.u_mode.ccm) + (_gcry_cipher_ccm_set_lengths): Move inside [HAVE_U64_TYPEDEF] and use + u64 instead of size_t for CCM data lengths. + * cipher/cipher.c (_gcry_cipher_open_internal, cipher_reset) + (_gcry_cipher_ctl) [!HAVE_U64_TYPEDEF]: Return GPG_ERR_NOT_SUPPORTED + for CCM. + (_gcry_cipher_ctl) [HAVE_U64_TYPEDEF]: Use u64 for + GCRYCTL_SET_CCM_LENGTHS length parameters. + * tests/basic.c: Do not use CCM if !HAVE_U64_TYPEDEF. + * tests/bench-slope.c: Ditto. + * tests/benchmark.c: Ditto. + +2013-12-14 Werner Koch <wk@gnupg.org> + + tests: Prevent rare failure of gcry_pk_decrypt test. + + commit bfb43a17d8db571fca4ed433ee8be5c366745844 + * tests/basic.c (check_pubkey_crypt): Add special mode 1. + (main): Add option --loop. + +2013-12-14 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Minor fixes to SHA assembly implementations. + + commit ffd9b2aa5abda7f4d7790ed48116ed5d71ab9995 + * cipher/Makefile.am: Correct 'sha256-avx*.S' to 'sha512-avx*.S'. + * cipher/sha1-ssse3-amd64.S: First line, correct filename. + * cipher/sha256-ssse3-amd64.S: Return correct stack burn depth. + * cipher/sha512-avx-amd64.S: Use 'vzeroall' to clear registers. + * cipher/sha512-avx2-bmi2-amd64.S: Ditto and return correct stack burn + depth. + + SHA-1/SSSE3: Do not check for Intel syntax assembly support. + + commit c86c35534a153b13e880d0bb0ea3e48e1c0ecaf9 + * cipher/sha1-ssse3-amd64.S: Remove check for + HAVE_INTEL_SYNTAX_PLATFORM_AS. + * cipher/sha1.c [USE_SSSE3]: Ditto. + +2013-12-13 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Convert SHA-1 SSSE3 implementation from mixed asm&C to pure asm. + + commit d2b853246c2ed056a92096d89c3ca057e45c9c92 + * cipher/Makefile.am: Change 'sha1-ssse3-amd64.c' to + 'sha1-ssse3-amd64.S'. + * cipher/sha1-ssse3-amd64.c: Remove. + * cipher/sha1-ssse3-amd64.S: New. + + SHA-1: Add SSSE3 implementation. + + commit be2238f68abcc6f2b4e8c38ad9141376ce622a22 + * cipher/Makefile.am: Add 'sha1-ssse3-amd64.c'. + * cipher/sha1-ssse3-amd64.c: New. + * cipher/sha1.c (USE_SSSE3): New. + (SHA1_CONTEXT) [USE_SSSE3]: Add 'use_ssse3'. + (sha1_init) [USE_SSSE3]: Initialize 'use_ssse3'. + (transform): Rename to... + (_transform): this. + (transform): New. + * configure.ac [host=x86_64]: Add 'sha1-ssse3-amd64.lo'. + + Add missing register clearing in to SHA-256 and SHA-512 assembly. + + commit 04615cc6803cdede25fa92e3ff697e252a23cd7a + * cipher/sha256-ssse3-amd64.S: Clear used XMM/YMM registers at return. + * cipher/sha512-avx-amd64.S: Ditto. + * cipher/sha512-avx2-bmi2-amd64.S: Ditto. + * cipher/sha512-ssse3-amd64.S: Ditto. + +2013-12-13 Werner Koch <wk@gnupg.org> + + Update license information. + + commit 764643a3d5634bcbc47790bd8505f6a1a5280d9c + * LICENSES: New. + * Makefile.am (EXTRA_DIST): Add LICENSES. + * AUTHORS: Add list of copyright holders. + * README: Reference AUTHORS. + +2013-12-13 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix empty clobber in AVX2 assembly check. + + commit e41d605ee41469e8a33cdc4d38f742cfb931f835 + * configure.ac (gcry_cv_gcc_inline_asm_avx2): Add "cc" as assembly + globber. + + Fix W32 build. + + commit a71b810ddd67ca3a1773d8f929d162551abb58eb + * random/rndw32.c (register_poll, slow_gatherer): Change gcry_xmalloc to + xmalloc, and gcry_xrealloc to xrealloc. + +2013-12-12 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + SHA-512: Add AVX and AVX2 implementations for x86-64. + + commit 2e4253dc8eb512cd0e807360926dc6ba912c95b4 + * cipher/Makefile.am: Add 'sha512-avx-amd64.S' and + 'sha512-avx2-bmi2-amd64.S'. + * cipher/sha512-avx-amd64.S: New. + * cipher/sha512-avx2-bmi2-amd64.S: New. + * cipher/sha512.c (USE_AVX, USE_AVX2): New. + (SHA512_CONTEXT) [USE_AVX]: Add 'use_avx'. + (SHA512_CONTEXT) [USE_AVX2]: Add 'use_avx2'. + (sha512_init, sha384_init) [USE_AVX]: Initialize 'use_avx'. + (sha512_init, sha384_init) [USE_AVX2]: Initialize 'use_avx2'. + [USE_AVX] (_gcry_sha512_transform_amd64_avx): New. + [USE_AVX2] (_gcry_sha512_transform_amd64_avx2): New. + (transform) [USE_AVX2]: Add call for AVX2 implementation. + (transform) [USE_AVX]: Add call for AVX implementation. + * configure.ac (HAVE_GCC_INLINE_ASM_BMI2): New check. + (sha512): Add 'sha512-avx-amd64.lo' and 'sha512-avx2-bmi2-amd64.lo'. + * doc/gcrypt.texi: Document 'intel-cpu' and 'intel-bmi2'. + * src/g10lib.h (HWF_INTEL_CPU, HWF_INTEL_BMI2): New. + * src/hwfeatures.c (hwflist): Add "intel-cpu" and "intel-bmi2". + * src/hwf-x86.c (detect_x86_gnuc): Check for HWF_INTEL_CPU and + HWF_INTEL_BMI2. + + SHA-512: Add SSSE3 implementation for x86-64. + + commit 69a6d0f9562fcd26112a589318c13de66ce1700e + * cipher/Makefile.am: Add 'sha512-ssse3-amd64.S'. + * cipher/sha512-ssse3-amd64.S: New. + * cipher/sha512.c (USE_SSSE3): New. + (SHA512_CONTEXT) [USE_SSSE3]: Add 'use_ssse3'. + (sha512_init, sha384_init) [USE_SSSE3]: Initialize 'use_ssse3'. + [USE_SSSE3] (_gcry_sha512_transform_amd64_ssse3): New. + (transform) [USE_SSSE3]: Call SSSE3 implementation. + * configure.ac (sha512): Add 'sha512-ssse3-amd64.lo'. + + SHA-256: Add SSSE3 implementation for x86-64. + + commit e1a3931263e67aacec3c0bfcaa86c7d1441d5c6a + * cipher/Makefile.am: Add 'sha256-ssse3-amd64.S'. + * cipher/sha256-ssse3-amd64.S: New. + * cipher/sha256.c (USE_SSSE3): New. + (SHA256_CONTEXT) [USE_SSSE3]: Add 'use_ssse3'. + (sha256_init, sha224_init) [USE_SSSE3]: Initialize 'use_ssse3'. + (transform): Rename to... + (_transform): This. + [USE_SSSE3] (_gcry_sha256_transform_amd64_ssse3): New. + (transform): New. + * configure.ac (HAVE_INTEL_SYNTAX_PLATFORM_AS): New check. + (sha256): Add 'sha256-ssse3-amd64.lo'. + * doc/gcrypt.texi: Document 'intel-ssse3'. + * src/g10lib.h (HWF_INTEL_SSSE3): New. + * src/hwfeatures.c (hwflist): Add "intel-ssse3". + * src/hwf-x86.c (detect_x86_gnuc): Test for SSSE3. + +2013-12-12 Werner Koch <wk@gnupg.org> + + Add a configuration file to disable hardware features. + + commit 5e1239b1e2948211ff2675f45cce2b28c3379cfb + * src/hwfeatures.c: Inclyde syslog.h and ctype.h. + (HWF_DENY_FILE): New. + (my_isascii): New. + (parse_hwf_deny_file): New. + (_gcry_detect_hw_features): Call it. + + * src/mpicalc.c (main): Correctly initialize Libgcrypt. Add options + "--print-config" and "--disable-hwf". + + Move list of hardware features to hwfeatures.c. + + commit 4ae77322b681a13da62d01274bcab25be2af12d0 + * src/global.c (hwflist, disabled_hw_features): Move to .. + * src/hwfeatures.c: here. + (_gcry_disable_hw_feature): New. + (_gcry_enum_hw_features): New. + (_gcry_detect_hw_features): Remove arg DISABLED_FEATURES. + * src/global.c (print_config, _gcry_vcontrol, global_init): Adjust + accordingly. + + Remove macro hacks for internal vs. external functions. Part 2 and last. + + commit 3b30e9840d4b351c4de73b126e561154cb7df4cc + * src/visibility.h: Remove remaining define/undef hacks for symbol + visibility. Add macros to detect the use of the public functions. + Change all affected functions by replacing them by the x-macros. + * src/g10lib.h: Add internal prototypes. + (xtrymalloc, xtrycalloc, xtrymalloc_secure, xtrycalloc_secure) + (xtryrealloc, xtrystrdup, xmalloc, xcalloc, xmalloc_secure) + (xcalloc_secure, xrealloc, xstrdup, xfree): New macros. + +2013-12-11 Werner Koch <wk@gnupg.org> + + random: Add a feature to close device file descriptors. + + commit cd548ba2dc777b8b27d8d33182ba733c20222120 + * src/gcrypt.h.in (GCRYCTL_CLOSE_RANDOM_DEVICE): New. + * src/global.c (_gcry_vcontrol): Call _gcry_random_close_fds. + * random/random.c (_gcry_random_close_fds): New. + * random/random-csprng.c (_gcry_rngcsprng_close_fds): New. + * random/random-fips.c (_gcry_rngfips_close_fds): New. + * random/random-system.c (_gcry_rngsystem_close_fds): New. + * random/rndlinux.c (open_device): Add arg retry. + (_gcry_rndlinux_gather_random): Add mode to close open fds. + + * tests/random.c (check_close_random_device): New. + (main): Call new test. + +2013-12-10 Werner Koch <wk@gnupg.org> + + Fix last commit (9a37470c) + + commit eae1e7712e1b687bd77eb37d0eb505fc9d46d93c + * src/secmem.c (lock_pool): Remove remaining line. Reported by Ian + Goldberg. + +2013-12-09 Werner Koch <wk@gnupg.org> + + Fix one-off memory leak when build with Linux capability support. + + commit 9a37470c50ee9966cb2652617a404ddd54a9c096 + * src/secmem.c (lock_pool, secmem_init): Use cap_free. Reported by + Mike Crowe <mac@mcrowe.com>. + +2013-12-09 David 'Digit' Turner <digit@google.com> + + Update libtool to support Android. + + commit 2516f0b660b1a7181ad38c44310c627f4f498595 + * m4/libtool.m4: Add "linux*android*" case. Taken from the libtool + repository. + +2013-12-09 Werner Koch <wk@gnupg.org> + + tests: Speed up benchmarks in regression test mode. + + commit 2e5354fe8db5288939733d0fb63ad4c87bc20105 + * tests/tsexp.c (check_extract_param): Fix compiler warning. + * tests/Makefile.am (TESTS_ENVIRONMENT): Set GCRYPT_IN_REGRESSION_TEST. + * tests/bench-slope.c (main): Speed up if in regression test mode. + * tests/benchmark.c (main): Ditto. + + tests: Add --csv option to bench-slope. + + commit 8072e9fa4b42ae8e65e266aa158fd903f1bb0927 + * tests/bench-slope.c (STR, STR2): New. + (cvs_mode): New. + (num_measurement_repetitions): New. Replace use of + NUM_MEASUREMENT_REPETITIONS by this. + (current_section_name, current_algo_name, current_mode_name): New. + (bench_print_result_csv): New. + (bench_print_result_std): Rename from bench_print_result. + (bench_print_result): New. Divert depending on CSV_MODE. + (bench_print_header, bench_print_footer): take care of CSV_MODE. + (bench_print_algo, bench_print_mode): New. Use them instead of + explicit printfs. + (main): Add options --csv and --repetitions. + +2013-12-07 Werner Koch <wk@gnupg.org> + + sexp: Allow long names and white space in gcry_sexp_extract_param. + + commit d4555433b6e422fa69a85cae99961f513e55d82b + * src/sexp.c (_gcry_sexp_vextract_param): Skip white space. Support + long parameter names. + * tests/tsexp.c (check_extract_param): Add test cases for long parameter + names and white space. + +2013-12-06 Werner Koch <wk@gnupg.org> + + ecc: Merge partly duplicated code. + + commit 405021cb6d4e470337302c65dec5bc91491a89c1 + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_sign): Factor A hashing out to ... + (_gcry_ecc_eddsa_compute_h_d): new function. + * cipher/ecc-misc.c (_gcry_ecc_compute_public): Use new function. + (reverse_buffer): Remove. + + ecc: Remove unused internal function. + + commit 4cf2c65fe15173c8d68a141a01b34fc1fb9080b7 + * src/cipher-proto.h (gcry_pk_spec): Remove get_param. + * cipher/ecc-curves.c (_gcry_ecc_get_param_sexp): Merge in code from + _gcry_ecc_get_param. + (_gcry_ecc_get_param): Remove. + * cipher/ecc.c (_gcry_pubkey_spec_ecc): Remove _gcry_ecc_get_param. + +2013-12-06 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix building on mingw32. + + commit 5917ce34e3b3eac4c15f62577e4723974024f818 + * src/gcrypt-int.h: Include <types.h>. + +2013-12-05 Werner Koch <wk@gnupg.org> + + ecc: Change OID for Ed25519. + + commit 7ef43d1eebb4f8226e860982dfe5fa2e2c82ad0f + * cipher/ecc-curves.c (curve_aliased): Add more suitable OID for + Ed25519. + + Remove macro hacks for internal vs. external functions. Part 1. + + commit 7bacf1812b55fa78db63abaa1f5a9220e9c6cccc + * src/visibility.h: Remove almost all define/undef hacks for symbol + visibility. Add macros to detect the use of the public functions. + Change all affected functions by prefixing them explicitly with an + underscore and change all internal callers to call the underscore + prefixed versions. Provide convenience macros from sexp and mpi + functions. + * src/visibility.c: Change all functions to use only gpg_err_code_t + and translate to gpg_error_t only in visibility.c. + +2013-12-04 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + mpi: add inline assembly for x86-64. + + commit 85bb0a98ea5add0296cbcc415d557eaa1f6bd294 + * mpi/longlong.h [__x86_64] (add_ssaaaa, sub_ddmmss, umul_ppmm) + (udiv_qrnnd, count_leading_zeros, count_trailing_zeros): New. + +2013-12-04 NIIBE Yutaka <gniibe@fsij.org> + + mpi: fix gcry_mpi_powm for negative base. + + commit c56080c26186d25dec05f01831494c77d8d07e13 + * mpi/mpi-pow.c (gcry_mpi_powm) [USE_ALGORITHM_SIMPLE_EXPONENTIATION]: + Fix for the case where BASE is negative. + * tests/mpitests.c (test_powm): Add a test case of (-17)^6 mod 19. + +2013-12-03 Werner Koch <wk@gnupg.org> + + Add build support for ppc64le. + + commit 2ff86db2e1b0f6cc22a1ca86037b526c5fa3be51 + * config.guess, config.sub: Update to latest version (2013-11-29). + * m4/libtool.m4: Add patches for ppc64le. + +2013-12-03 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael: fix compiler warning on aarch64. + + commit 59b1a1b7ee2923e1bf091071ae716d180c6c6006 + * cipher/rijndael.c (do_setkey): Use braces for empty if statement + instead of semicolon. + + Add aarch64 (arm64) mpi assembly. + + commit 80896bc8f5e6ed9a627374e34f040ad5f3617584 + * mpi/aarch64/mpi-asm-defs.h: New. + * mpi/aarch64/mpih-add1.S: New. + * mpi/aarch64/mpih-mul1.S: New. + * mpi/aarch64/mpih-mul2.S: New. + * mpi/aarch64/mpih-mul3.S: New. + * mpi/aarch64/mpih-sub1.S: New. + * mpi/config.links [host=aarch64-*-*]: Add configguration for aarch64 + assembly. + * mpi/longlong.h [__aarch64__] (add_ssaaaa, sub_ddmmss, umul_ppmm) + (count_leading_zeros): New. + +2013-12-02 Werner Koch <wk@gnupg.org> + + ecc: Use constant time point operation for Twisted Edwards. + + commit d4ce0cfe0d35d7ec69c115456848b5b735c928ea + * mpi/ec.c (_gcry_mpi_ec_mul_point): Try to do a constant time + operation if needed. + * tests/benchmark.c (main): Add option --use-secmem. + + ecc: Make gcry_pk_testkey work for Ed25519. + + commit 14ae6224b1b17abbfc80c26ad0f4c60f1e8635e2 + * cipher/ecc-misc.c (_gcry_ecc_compute_public): Add optional args G + and d. Change all callers. + * cipher/ecc.c (gen_y_2): Remove. + (check_secret_key): Use generic public key compute function. Adjust + for use with Ed25519 and EdDSA. + (nist_generate_key): Do not use the compliant key thingy for Ed25519. + (ecc_check_secret_key): Make parameter parsing similar to the other + functions. + * cipher/ecc-curves.c (domain_parms): Zero prefix some parameters so + that _gcry_ecc_update_curve_param works correctly. + * tests/keygen.c (check_ecc_keys): Add "param" flag. Check all + Ed25519 keys. + + ecc: Fix eddsa point decompression. + + commit 485f35124b1a74af0bad321ed70be3a79d8d11d7 + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_recover_x): Fix the negative + case. + + ecc: Fix gcry_mpi_ec_curve_point for Weierstrass. + + commit ecb90f8e7c6f2516080d27ed7da6a25f2314da3c + * mpi/ec.c (_gcry_mpi_ec_curve_point): Use correct equation. + (ec_pow3): New. + (ec_p_init): Always copy B. + + mpi: Introduce 4 user flags for gcry_mpi_t. + + commit 29eddc2558d4cf39995f66d5fccd62f584d5b203 + * src/gcrypt.h.in (GCRYMPI_FLAG_USER1, GCRYMPI_FLAG_USER2) + (GCRYMPI_FLAG_USER3, GCRYMPI_FLAG_USER4): New. + * mpi/mpiutil.c (gcry_mpi_set_flag, gcry_mpi_clear_flag) + (gcry_mpi_get_flag, _gcry_mpi_free): Implement them. + (gcry_mpi_set_opaque): Keep user flags. + +2013-11-29 Vladimir 'φ-coder/phcoder' Serbinenko <phcoder@gmail.com> + + Fix armv3 compile error. + + commit 3b1cc9e6c357574f54160298d731c18f3d717b6c + * mpi/longlong.h [__arm__ && __ARM_ARCH < 4] (umul_ppmm): Use + __AND_CLOBBER_CC instead of __CLOBBER_CC. + + longlong.h on mips with clang. + + commit 1ecbd0bca31d462719a2a6590c1d03244e76ef89 + * mpi/longlong.h [__mips__]: Use C-language version with clang. + +2013-11-24 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Camellia: Tweaks for AES-NI implementations. + + commit 3ef21e7e1b8003db9792155044db95f9d9ced184 + * cipher/camellia-aesni-avx-amd64.S: Align stack to 16 bytes; tweak + key-setup for small speed up. + * cipher/camellia-aesni-avx2-amd64.S: Use vmovdqu even with aligned + stack; reorder vinsert128 instructions; use rbp for stack frame. + +2013-11-21 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add GMAC to MAC API. + + commit a34448c929b13bfb7b66d69169c89e7319a18b31 + * cipher/Makefile.am: Add 'mac-gmac.c'. + * cipher/mac-gmac.c: New. + * cipher/mac-internal.h (gcry_mac_handle): Add 'u.gcm'. + (_gcry_mac_type_spec_gmac_aes, _gcry_mac_type_spec_gmac_twofish) + (_gcry_mac_type_spec_gmac_serpent, _gcry_mac_type_spec_gmac_seed) + (_gcry_mac_type_spec_gmac_camellia): New externs. + * cipher/mac.c (mac_list): Add GMAC specifications. + * doc/gcrypt.texi: Add mention of GMAC. + * src/gcrypt.h.in (gcry_mac_algos): Add GCM algorithms. + * tests/basic.c (check_one_mac): Add support for MAC IVs. + (check_mac): Add support for MAC IVs and add GMAC test vectors. + * tests/bench-slope.c (mac_bench): Iterate algorithm numbers to 499. + * tests/benchmark.c (mac_bench): Iterate algorithm numbers to 499. + + GCM: Move gcm_table initialization to setkey. + + commit dbfa651618693da7ea73b4d2d00d4efd411bfb46 + * cipher/cipher-gcm.c: Change all 'c->u_iv.iv' to + 'c->u_mode.gcm.u_ghash_key.key'. + (_gcry_cipher_gcm_setkey): New. + (_gcry_cipher_gcm_initiv): Move ghash initialization to function above. + * cipher/cipher-internal.h (gcry_cipher_handle): Add + 'u_mode.gcm.u_ghash_key'; Reorder 'u_mode.gcm' members for partial + clearing in gcry_cipher_reset. + (_gcry_cipher_gcm_setkey): New prototype. + * cipher/cipher.c (cipher_setkey): Add GCM setkey. + (cipher_reset): Clear 'u_mode' only partially for GCM. + +2013-11-20 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + GCM: Add support for split data buffers and online operation. + + commit fb1e52e3fe231671de546eacd6becd31c26c4f7b + * cipher/cipher-gcm.c (do_ghash_buf): Add buffering for less than + blocksize length input and padding handling. + (_gcry_cipher_gcm_encrypt, _gcry_cipher_gcm_decrypt): Add handling + for AAD padding and check if data has already being padded. + (_gcry_cipher_gcm_authenticate): Check that AAD or data has not being + padded yet. + (_gcry_cipher_gcm_initiv): Clear padding marks. + (_gcry_cipher_gcm_tag): Add finalization and padding; Clear sensitive + data from cipher handle, since they are not used after generating tag. + * cipher/cipher-internal.h (gcry_cipher_handle): Add 'u_mode.gcm.macbuf', + 'u_mode.gcm.mac_unused', 'u_mode.gcm.ghash_data_finalized' and + 'u_mode.gcm.ghash_aad_finalized'. + * tests/basic.c (check_gcm_cipher): Rename to... + (_check_gcm_cipher): ...this and add handling for different buffer step + lengths; Enable per byte buffer testing. + (check_gcm_cipher): Call _check_gcm_cipher with different buffer step + sizes. + + GCM: Use size_t for buffer sizes. + + commit 2d870a9142e8c8b3f008e1ad8e83e4bdf7a8e4e7 + * cipher/cipher-gcm.c (ghash, gcm_bytecounter_add, do_ghash_buf) + (_gcry_cipher_gcm_encrypt, _gcry_cipher_gcm_decrypt) + (_gcry_cipher_gcm_authenticate, _gcry_cipher_gcm_geniv) + (_gcry_cipher_gcm_tag): Use size_t for buffer lengths. + * cipher/cipher-internal.h (_gcry_cipher_gcm_encrypt) + (_gcry_cipher_gcm_decrypt, _gcry_cipher_gcm_authenticate): Use size_t + for buffer lengths. + + GCM: add FIPS mode restrictions. + + commit 56d352d6bdcf7abaa33c3399741f5063e2ddc32a + * cipher/cipher-gcm.c (_gcry_cipher_gcm_encrypt) + (_gcry_cipher_gcm_get_tag): Do not allow using in FIPS mode is setiv + was invocated directly. + (_gcry_cipher_gcm_setiv): Rename to... + (_gcry_cipher_gcm_initiv): ...this. + (_gcry_cipher_gcm_setiv): New setiv function with check for FIPS mode. + [TODO] (_gcry_cipher_gcm_getiv): New. + * cipher/cipher-internal.h (gcry_cipher_handle): Add + 'u_mode.gcm.disallow_encryption_because_of_setiv_in_fips_mode'. + + GCM: Add clearing and checking of marks.tag. + + commit 32a2da9abc91394b23cf565c1c833fa964394083 + * cipher/cipher-gcm.c (_gcry_cipher_gcm_encrypt) + (_gcry_cipher_gcm_decrypt, _gcry_cipher_gcm_authenticate): Make sure + that tag has not been finalized yet. + (_gcry_cipher_gcm_setiv): Clear 'marks.tag'. + + GCM: Add stack burning. + + commit 018f08354b1b116672e82f9ce942884b288aaf9e + * cipher/cipher-gcm.c (do_ghash, ghash): Return stack burn depth. + (setupM): Wipe 'tmp' buffer. + (do_ghash_buf): Wipe 'tmp' buffer and add stack burning. + + Add aggregated bulk processing for GCM on x86-64. + + commit c9537fbf8ff0af919cff2bebadc4c6e7caea8076 + * cipher/cipher-gcm.c [__x86_64__] (gfmul_pclmul_aggr4): New. + (ghash) [GCM_USE_INTEL_PCLMUL]: Add aggregated bulk processing + for __x86_64__. + (setupM) [__x86_64__]: Add initialization for aggregated bulk + processing. + + GCM: Tweak Intel PCLMUL ghash loop for small speed-up. + + commit 9b6764944284fed733c2f88619b3d9eb5d5c259a + * cipher/cipher-gcm.c (do_ghash): Mark 'inline'. + [GCM_USE_INTEL_PCLMUL] (do_ghash_pclmul): Rename to... + [GCM_USE_INTEL_PCLMUL] (gfmul_pclmul): ..this and make inline function. + (ghash) [GCM_USE_INTEL_PCLMUL]: Preload data before ghash-pclmul loop. + + GCM: Use counter mode code for speed-up. + + commit bd4bd23a2511a4bce63c3217cca0d4ecf0c79532 + * cipher/cipher-gcm.c (ghash): Add process for multiple blocks. + (gcm_bytecounter_add, gcm_add32_be128, gcm_check_datalen) + (gcm_check_aadlen_or_ivlen, do_ghash_buf): New functions. + (_gcry_cipher_gcm_encrypt, _gcry_cipher_gcm_decrypt) + (_gcry_cipher_gcm_authenticate, _gcry_cipher_gcm_set_iv) + (_gcry_cipher_gcm_tag): Adjust to use above new functions and + counter mode functions for encryption/decryption. + * cipher/cipher-internal.h (gcry_cipher_handle): Remove 'length'; Add + 'u_mode.gcm.(addlen|datalen|tagiv|datalen_over_limits)'. + (_gcry_cipher_gcm_setiv): Return gcry_err_code_t. + * cipher/cipher.c (cipher_setiv): Return error code. + (_gcry_cipher_setiv): Handle error code from 'cipher_setiv'. + + Add Intel PCLMUL acceleration for GCM. + + commit 5a65ffabadd50f174ab7375faad7a726cce49e61 + * cipher/cipher-gcm.c (fillM): Rename... + (do_fillM): ...to this. + (ghash): Remove. + (fillM): New macro. + (GHASH): Use 'do_ghash' instead of 'ghash'. + [GCM_USE_INTEL_PCLMUL] (do_ghash_pclmul): New. + (ghash): New. + (setupM): New. + (_gcry_cipher_gcm_encrypt, _gcry_cipher_gcm_decrypt) + (_gcry_cipher_gcm_authenticate, _gcry_cipher_gcm_setiv) + (_gcry_cipher_gcm_tag): Use 'ghash' instead of 'GHASH' and + 'c->u_mode.gcm.u_tag.tag' instead of 'c->u_tag.tag'. + * cipher/cipher-internal.h (GCM_USE_INTEL_PCLMUL): New. + (gcry_cipher_handle): Move 'u_tag' and 'gcm_table' under + 'u_mode.gcm'. + * configure.ac (pclmulsupport, gcry_cv_gcc_inline_asm_pclmul): New. + * src/g10lib.h (HWF_INTEL_PCLMUL): New. + * src/global.c: Add "intel-pclmul". + * src/hwf-x86.c (detect_x86_gnuc): Add check for Intel PCLMUL. + + GCM: GHASH optimizations. + + commit 0e9e7d72f3c9eb7ac832746c3034855faaf8d02c + * cipher/cipher-gcm.c [GCM_USE_TABLES] (gcmR, ghash): Replace with new. + [GCM_USE_TABLES] [GCM_TABLES_USE_U64] (bshift, fillM, do_ghash): New. + [GCM_USE_TABLES] [!GCM_TABLES_USE_U64] (bshift, fillM): Replace with + new. + [GCM_USE_TABLES] [!GCM_TABLES_USE_U64] (do_ghash): New. + (_gcry_cipher_gcm_tag): Remove extra memcpy to outbuf and use + buf_eq_const for comparing authentication tag. + * cipher/cipher-internal.h (gcry_cipher_handle): Different 'gcm_table' + for 32-bit and 64-bit platforms. + + Add some documentation for GCM mode. + + commit 332da0ed7c8fab6c2bee841c94d8364c2ab4e30d + * doc/gcrypt.texi: Add mention of GCM mode. + +2013-11-19 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Initial implementation of GCM. + + commit 90cce18b9eced4f412ceeec5bcae18c4493322df + * cipher/Makefile.am: Add 'cipher-gcm.c'. + * cipher/cipher-ccm.c (_gcry_ciphert_ccm_set_lengths) + (_gcry_cipher_ccm_authenticate, _gcry_cipher_ccm_tag) + (_gcry_cipher_ccm_encrypt, _gcry_cipher_ccm_decrypt): Change + 'c->u_mode.ccm.tag' to 'c->marks.tag'. + * cipher/cipher-gcm.c: New. + * cipher/cipher-internal.h (GCM_USE_TABLES): New. + (gcry_cipher_handle): Add 'marks.tag', 'u_tag', 'length' and + 'gcm_table'; Remove 'u_mode.ccm.tag'. + (_gcry_cipher_gcm_encrypt, _gcry_cipher_gcm_decrypt) + (_gcry_cipher_gcm_setiv, _gcry_cipher_gcm_authenticate) + (_gcry_cipher_gcm_get_tag, _gcry_cipher_gcm_check_tag): New. + * cipher/cipher.c (_gcry_cipher_open_internal, cipher_setkey) + (cipher_encrypt, cipher_decrypt, _gcry_cipher_authenticate) + (_gcry_cipher_gettag, _gcry_cipher_checktag): Add GCM mode handling. + * src/gcrypt.h.in (gcry_cipher_modes): Add GCRY_CIPHER_MODE_GCM. + (GCRY_GCM_BLOCK_LEN): New. + * tests/basic.c (check_gcm_cipher): New. + (check_ciphers): Add GCM check. + (check_cipher_modes): Call 'check_gcm_cipher'. + * tests/bench-slope.c (bench_gcm_encrypt_do_bench) + (bench_gcm_decrypt_do_bench, bench_gcm_authenticate_do_bench) + (gcm_encrypt_ops, gcm_decrypt_ops, gcm_authenticate_ops): New. + (cipher_modes): Add GCM enc/dec/auth. + (cipher_bench_one): Limit GCM to block ciphers with 16 byte block-size. + * tests/benchmark.c (cipher_bench): Add GCM. + +2013-11-19 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Camellia: fix compiler warning. + + commit 9816ae9d9931b75e4fdc9a5be10e6af447132313 + * cipher/camellia-glue.c (camellia_setkey): Use braces around empty if + statement. + + Tweak Camellia-AVX key-setup for small speed-up. + + commit 77922a82c3f2e30eca04511fa5a355208349c657 + * cipher/camellia-aesni-avx-amd64.S (camellia_f): Merge S-function output + rotation with P-function. + + Add CMAC (Cipher-based MAC) to MAC API. + + commit b49cd64aaaff2e5488a84665362ef7150683226c + * cipher/Makefile.am: Add 'cipher-cmac.c' and 'mac-cmac.c'. + * cipher/cipher-cmac.c: New. + * cipher/cipher-internal.h (gcry_cipher_handle.u_mode): Add 'cmac'. + * cipher/cipher.c (gcry_cipher_open): Rename to... + (_gcry_cipher_open_internal): ...this and add CMAC. + (gcry_cipher_open): New wrapper that disallows use of internal + modes (CMAC) from outside. + (cipher_setkey, cipher_encrypt, cipher_decrypt) + (_gcry_cipher_authenticate, _gcry_cipher_gettag) + (_gcry_cipher_checktag): Add handling for CMAC mode. + (cipher_reset): Do not reset 'marks.key' and do not clear subkeys in + 'u_mode' in CMAC mode. + * cipher/mac-cmac.c: New. + * cipher/mac-internal.h: Add CMAC support and algorithms. + * cipher/mac.c: Add CMAC algorithms. + * doc/gcrypt.texi: Add documentation for CMAC. + * src/cipher.h (gcry_cipher_internal_modes): New. + (_gcry_cipher_open_internal, _gcry_cipher_cmac_authenticate) + (_gcry_cipher_cmac_get_tag, _gcry_cipher_cmac_check_tag) + (_gcry_cipher_cmac_set_subkeys): New prototypes. + * src/gcrypt.h.in (gcry_mac_algos): Add CMAC algorithms. + * tests/basic.c (check_mac): Add CMAC test vectors. + +2013-11-16 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add new MAC API, initially with HMAC. + + commit fcd6da37d55f248d3558ee0ff385b41b866e7ded + * cipher/Makefile.am: Add 'mac.c', 'mac-internal.h' and 'mac-hmac.c'. + * cipher/bufhelp.h (buf_eq_const): New. + * cipher/cipher-ccm.c (_gcry_cipher_ccm_tag): Use 'buf_eq_const' for + constant-time compare. + * cipher/mac-hmac.c: New. + * cipher/mac-internal.h: New. + * cipher/mac.c: New. + * doc/gcrypt.texi: Add documentation for MAC API. + * src/gcrypt-int.h [GPG_ERROR_VERSION_NUMBER < 1.13] + (GPG_ERR_MAC_ALGO): New. + * src/gcrypt.h.in (gcry_mac_handle, gcry_mac_hd_t, gcry_mac_algos) + (gcry_mac_flags, gcry_mac_open, gcry_mac_close, gcry_mac_ctl) + (gcry_mac_algo_info, gcry_mac_setkey, gcry_mac_setiv, gcry_mac_write) + (gcry_mac_read, gcry_mac_verify, gcry_mac_get_algo_maclen) + (gcry_mac_get_algo_keylen, gcry_mac_algo_name, gcry_mac_map_name) + (gcry_mac_reset, gcry_mac_test_algo): New. + * src/libgcrypt.def (gcry_mac_open, gcry_mac_close, gcry_mac_ctl) + (gcry_mac_algo_info, gcry_mac_setkey, gcry_mac_setiv, gcry_mac_write) + (gcry_mac_read, gcry_mac_verify, gcry_mac_get_algo_maclen) + (gcry_mac_get_algo_keylen, gcry_mac_algo_name, gcry_mac_map_name): New. + * src/libgcrypt.vers (gcry_mac_open, gcry_mac_close, gcry_mac_ctl) + (gcry_mac_algo_info, gcry_mac_setkey, gcry_mac_setiv, gcry_mac_write) + (gcry_mac_read, gcry_mac_verify, gcry_mac_get_algo_maclen) + (gcry_mac_get_algo_keylen, gcry_mac_algo_name, gcry_mac_map_name): New. + * src/visibility.c (gcry_mac_open, gcry_mac_close, gcry_mac_ctl) + (gcry_mac_algo_info, gcry_mac_setkey, gcry_mac_setiv, gcry_mac_write) + (gcry_mac_read, gcry_mac_verify, gcry_mac_get_algo_maclen) + (gcry_mac_get_algo_keylen, gcry_mac_algo_name, gcry_mac_map_name): New. + * src/visibility.h (gcry_mac_open, gcry_mac_close, gcry_mac_ctl) + (gcry_mac_algo_info, gcry_mac_setkey, gcry_mac_setiv, gcry_mac_write) + (gcry_mac_read, gcry_mac_verify, gcry_mac_get_algo_maclen) + (gcry_mac_get_algo_keylen, gcry_mac_algo_name, gcry_mac_map_name): New. + * tests/basic.c (check_one_mac, check_mac): New. + (main): Call 'check_mac'. + * tests/bench-slope.c (bench_print_header, bench_print_footer): Allow + variable algorithm name width. + (_cipher_bench, hash_bench): Update to above change. + (bench_hash_do_bench): Add 'gcry_md_reset'. + (bench_mac_mode, bench_mac_init, bench_mac_free, bench_mac_do_bench) + (mac_ops, mac_modes, mac_bench_one, _mac_bench, mac_bench): New. + (main): Add 'mac' benchmark options. + * tests/benchmark.c (mac_repetitions, mac_bench): New. + (main): Add 'mac' benchmark options. + + Use correct blocksize of 32 bytes for GOSTR3411-94 HMAC. + + commit b95a557a43aeed68ea5e5ce02aca42ee97bfdb3b + * cipher/md.c (md_open): Set macpads_Bsize to 32 for + GCRY_MD_GOST24311_94. + +2013-11-15 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + cipher: use size_t for internal buffer lengths. + + commit b787657a9d2c1d8e19f9fcb0b21e31cb062630cf + * cipher/arcfour.c (do_encrypt_stream, encrypt_stream): Use 'size_t' + for buffer lengths. + * cipher/blowfish.c (_gcry_blowfish_ctr_enc, _gcry_blowfish_cbc_dec) + (_gcry_blowfish_cfb_dec): Ditto. + * cipher/camellia-glue.c (_gcry_camellia_ctr_enc) + (_gcry_camellia_cbc_dec, _gcry_blowfish_cfb_dec): Ditto. + * cipher/cast5.c (_gcry_cast5_ctr_enc, _gcry_cast5_cbc_dec) + (_gcry_cast5_cfb_dec): Ditto. + * cipher/cipher-aeswrap.c (_gcry_cipher_aeswrap_encrypt) + (_gcry_cipher_aeswrap_decrypt): Ditto. + * cipher/cipher-cbc.c (_gcry_cipher_cbc_encrypt) + (_gcry_cipher_cbc_decrypt): Ditto. + * cipher/cipher-ccm.c (_gcry_cipher_ccm_encrypt) + (_gcry_cipher_ccm_decrypt): Ditto. + * cipher/cipher-cfb.c (_gcry_cipher_cfb_encrypt) + (_gcry_cipher_cfb_decrypt): Ditto. + * cipher/cipher-ctr.c (_gcry_cipher_ctr_encrypt): Ditto. + * cipher/cipher-internal.h (gcry_cipher_handle->bulk) + (_gcry_cipher_cbc_encrypt, _gcry_cipher_cbc_decrypt) + (_gcry_cipher_cfb_encrypt, _gcry_cipher_cfb_decrypt) + (_gcry_cipher_ofb_encrypt, _gcry_cipher_ctr_encrypt) + (_gcry_cipher_aeswrap_encrypt, _gcry_cipher_aeswrap_decrypt) + (_gcry_cipher_ccm_encrypt, _gcry_cipher_ccm_decrypt): Ditto. + * cipher/cipher-ofb.c (_gcry_cipher_cbc_encrypt): Ditto. + * cipher/cipher-selftest.h (gcry_cipher_bulk_cbc_dec_t) + (gcry_cipher_bulk_cfb_dec_t, gcry_cipher_bulk_ctr_enc_t): Ditto. + * cipher/cipher.c (cipher_setkey, cipher_setiv, do_ecb_crypt) + (do_ecb_encrypt, do_ecb_decrypt, cipher_encrypt) + (cipher_decrypt): Ditto. + * cipher/rijndael.c (_gcry_aes_ctr_enc, _gcry_aes_cbc_dec) + (_gcry_aes_cfb_dec, _gcry_aes_cbc_enc, _gcry_aes_cfb_enc): Ditto. + * cipher/salsa20.c (salsa20_setiv, salsa20_do_encrypt_stream) + (salsa20_encrypt_stream, salsa20r12_encrypt_stream): Ditto. + * cipher/serpent.c (_gcry_serpent_ctr_enc, _gcry_serpent_cbc_dec) + (_gcry_serpent_cfb_dec): Ditto. + * cipher/twofish.c (_gcry_twofish_ctr_enc, _gcry_twofish_cbc_dec) + (_gcry_twofish_cfb_dec): Ditto. + * src/cipher-proto.h (gcry_cipher_stencrypt_t) + (gcry_cipher_stdecrypt_t, cipher_setiv_fuct_t): Ditto. + * src/cipher.h (_gcry_aes_cfb_enc, _gcry_aes_cfb_dec) + (_gcry_aes_cbc_enc, _gcry_aes_cbc_dec, _gcry_aes_ctr_enc) + (_gcry_blowfish_cfb_dec, _gcry_blowfish_cbc_dec) + (_gcry_blowfish_ctr_enc, _gcry_cast5_cfb_dec, _gcry_cast5_cbc_dec) + (_gcry_cast5_ctr_enc, _gcry_camellia_cfb_dec, _gcry_camellia_cbc_dec) + (_gcry_camellia_ctr_enc, _gcry_serpent_cfb_dec, _gcry_serpent_cbc_dec) + (_gcry_serpent_ctr_enc, _gcry_twofish_cfb_dec, _gcry_twofish_cbc_dec) + (_gcry_twofish_ctr_enc): Ditto. + + Camellia: Add AVX/AES-NI key setup. + + commit ef9f52cbb39e46918c96200b09c21e931eff174f + * cipher/camellia-aesni-avx-amd64.S (key_bitlength, key_table): New + order of fields in ctx. + (camellia_f, vec_rol128, vec_ror128): New macros. + (__camellia_avx_setup128, __camellia_avx_setup256) + (_gcry_camellia_aesni_avx_keygen): New functions. + * cipher/camellia-aesni-avx2-amd64.S (key_bitlength, key_table): New + order of fields in ctx. + * cipher/camellia-arm.S (CAMELLIA_TABLE_BYTE_LEN, key_length): Remove + unused macros. + * cipher/camellia-glue.c (CAMELLIA_context): Move keytable to head for + better alignment; Make 'use_aesni_avx' and 'use_aesni_avx2' bitfield + members. + [USE_AESNI_AVX] (_gcry_camellia_aesni_avx_keygen): New prototype. + (camellia_setkey) [USE_AESNI_AVX || USE_AESNI_AVX2]: Read hw features + to variable 'hwf' and match features from it. + (camellia_setkey) [USE_AESNI_AVX]: Use AES-NI/AVX key setup if + available. + + Avoid unneeded stack burning with AES-NI and reduce number of 'decryption_prepared' checks + + commit c8ad83fb605fdbf6dc0b0dbcc8aedfbd477640da + * cipher/rijndael.c (RIJNDAEL_context): Make 'decryption_prepared', + 'use_padlock' and 'use_aesni' 1-bit members in bitfield. + (do_setkey): Move 'hwfeatures' inside [USE_AESNI || USE_PADLOCK]. + (do_aesni_enc_aligned): Rename to... + (do_aesni_enc): ...this, as function does not require aligned input. + (do_aesni_dec_aligned): Rename to... + (do_aesni_dec): ...this, as function does not require aligned input. + (do_aesni): Remove. + (rijndael_encrypt): Call 'do_aesni_enc' instead of 'do_aesni'. + (rijndael_decrypt): Call 'do_aesni_dec' instead of 'do_aesni'. + (check_decryption_preparation): New. + (do_decrypt): Remove 'decryption_prepared' check. + (rijndael_decrypt): Ditto and call 'check_decryption_preparation'. + (_gcry_aes_cbc_dec): Ditto. + (_gcry_aes_cfb_enc): Add 'burn_depth' and burn stack only when needed. + (_gcry_aes_cbc_enc): Ditto. + (_gcry_aes_ctr_enc): Ditto. + (_gcry_aes_cfb_dec): Ditto. + (_gcry_aes_cbc_dec): Ditto and correct clearing of 'savebuf'. + +2013-11-14 Werner Koch <wk@gnupg.org> + + md: Fix hashing for data >= 256 GB. + + commit c43a8c0d81a711161f7a81b24ef7c33a1353eee0 + * cipher/hash-common.h (gcry_md_block_ctx): Add "nblocks_high". + * cipher/hash-common.c (_gcry_md_block_write): Bump NBLOCKS_HIGH. + * cipher/md4.c (md4_init, md4_final): Take care of NBLOCKS_HIGH. + * cipher/md5.c (md5_init, md5_final): Ditto. + * cipher/rmd160.c (_gcry_rmd160_init, rmd160_final): Ditto. + * cipher/sha1.c (sha1_init, sha1_final): Ditto. + * cipher/sha256.c (sha256_init, sha224_init, sha256_final): Ditto. + * cipher/sha512.c (sha512_init, sha384_init, sha512_final): Ditto. + * cipher/tiger.c (do_init, tiger_final): Ditto. + * cipher/whirlpool.c (whirlpool_final): Ditto. + + * cipher/md.c (gcry_md_algo_info): Add GCRYCTL_SELFTEST. + (_gcry_md_selftest): Return "not implemented" as required. + * tests/hashtest.c: New. + * tests/genhashdata.c: New. + * tests/Makefile.am (TESTS): Add hashtest. + (noinst_PROGRAMS): Add genhashdata + +2013-11-13 Christian Grothoff <christian@grothoff.org> + + ecc: Fix key generation for a plain Ed25519 key. + + commit 7d91e99bcd30a463dd4faed014b8521a663d8316 + * cipher/ecc.c (nist_generate_key): Use custom code for ED25519. + + ecc: Fix some memory leaks. + + commit c4f9af49f228df59c218381a25fa3c0f93ccbeae + * cipher/ecc-curves.c (_gcry_mpi_ec_new): Free ec->b before assigning. + * cipher/ecc.c (nist_generate_key): Release Q. + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_genkey): Ditto. + +2013-11-11 Werner Koch <wk@gnupg.org> + + ecc: Change keygrip computation for Ed25519+EdDSA. + + commit 4fb3c8e5a7fc6a1568f54bcc0be17fecf75e0742 + * cipher/ecc.c (compute_keygrip): Rework. + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_ensure_compact): New. + * cipher/ecc-curves.c (_gcry_ecc_update_curve_param): New. + * tests/keygrip.c (key_grips): Add flag param and test cases for + Ed25519. + + mpi: Add special format GCRYMPI_FMT_OPAQUE. + + commit 8b3eecee2d89179297e43de7d650f74759c61a58 + * src/gcrypt.h.in (GCRYMPI_FMT_OPAQUE): New. + (_gcry_sexp_nth_opaque_mpi): Remove. + * src/sexp.c (gcry_sexp_nth_mpi): Add support for GCRYMPI_FMT_OPAQUE. + (_gcry_sexp_vextract_param): Replace removed function by + GCRYMPI_FMT_OPAQUE. + +2013-11-10 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix error output in CTR selftest. + + commit 7b26586e35a6d407ca31b41528b0810b1408fd4b + * cipher/cipher-selftest.c (_gcry_selftest_helper_ctr): Change + fprintf(stderr,...) to syslog(); Correct error output for bulk + IV check, plaintext mismatch => ciphertext mismatch. + +2013-11-09 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix Serpent-AVX2 and Camellia-AVX2 counter modes. + + commit df29831d008e32faf74091d080a415731418d158 + * cipher/camellia-aesni-avx2-amd64.S + (_gcry_camellia_aesni_avx2_ctr_enc): Byte-swap before checking for + overflow handling. + * cipher/camellia-glue.c (selftest_ctr_128, selftest_cfb_128) + (selftest_cbc_128): Add 16 to nblocks. + * cipher/cipher-selftest.c (_gcry_selftest_helper_ctr): Add test with + non-overflowing IV and modify overflow IV to detect broken endianness + handling. + * cipher/serpent-avx2-amd64.S (_gcry_serpent_avx2_ctr_enc): Byte-swap + before checking for overflow handling; Fix crazy-mixed-endian IV + construction to big-endian. + * cipher/serpent.c (selftest_ctr_128, selftest_cfb_128) + (selftest_cbc_128): Add 8 to nblocks. + +2013-11-09 Sergey V <sftp.mtuci@gmail.com> + + cipher/gost28147: optimization: use precomputed S-box tables. + + commit 51501b638546665163bbb85a14308fdb99211a28 + * cipher/gost.h (GOST28147_context): Remove unneeded subst and + subst_set members. + * cipher/gost28147.c (max): Remove unneeded macro. + (test_sbox): Replace with new precomputed tables. + (gost_set_subst): Remove function. + (gost_val): Use new S-box tables. + (gost_encrypt_block, gost_decrypt_block): Tweak to use new ctx and + S-box tables. + +2013-11-09 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix tail handling for AES-NI counter mode. + + commit 60ed0abbbc7cb15812f1e713143c72555acea69e + * cipher/rijndael.c (do_aesni_ctr): Fix outputting of updated + counter-IV. + +2013-11-08 Werner Koch <wk@gnupg.org> + + ecc: Improve gcry_pk_get_curve. + + commit 03aed1acec611362285db5156a6b92c91604fba4 + * cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Factor some code out + to .. + (find_domain_parms_idx): new. + (_gcry_ecc_get_curve): Find by curve name on error. + + cipher: Avoid signed divisions in idea.c. + + commit e241dde1420475459e32608137829e52748d0212 + * cipher/idea.c (mul_inv): Use unsigned division. + + ecc: Implement the "nocomp" flag for key generation. + + commit 9f63c0f7a3b2c15c7e258cd17395cabd0a8f00cc + * cipher/ecc.c (ecc_generate): Support the "nocomp" flag. + * tests/keygen.c (check_ecc_keys): Add a test for it. + + ecc: Make "noparam" the default and replace by "param". + + commit ed45fd2e60c88e2f005282e6eadd018b59dcf65b + * src/cipher.h (PUBKEY_FLAG_NOCOMP): New. + (PUBKEY_FLAG_NOPARAM): Remove. + (PUBKEY_FLAG_PARAM): New. + * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist): Support the new + flags and ignore the obsolete "noparam" flag. + * cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Return the curve name + also for curves selected by NBITS. + (_gcry_mpi_ec_new): Support the "param" flag. + * cipher/ecc.c (ecc_generate, ecc_sign, ecc_verify): Ditto. + * tests/keygen.c (check_ecc_keys): Remove the "noparam" flag. + +2013-11-07 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix decryption function size in AES AMD64 assembly. + + commit bfe4f6523b80bae0040328ef324b9000ee5b38a4 + * cipher/rijndael-amd64.S (_gcry_aes_amd64_decrypt_block): Set '.size' + for '_gcry_aes_amd64_decrypt_block', not '..._encrypt_block'. + + Change 64-bit shift to 32-bit in AES AMD64 assembly. + + commit 57b296ea3a5204cd3711b7bf57c8fb14d8542402 + * cipher/rijndael-amd64.S (do16bit_shr): Change 'shrq' to 'shrl'. + +2013-11-06 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Speed-up AES-NI key setup. + + commit f702d62d888b30e24c19f203566a1473098b2b31 + * cipher/rijndael.c [USE_AESNI] (m128i_t): Remove. + [USE_AESNI] (u128_t): New. + [USE_AESNI] (aesni_do_setkey): New. + (do_setkey) [USE_AESNI]: Move AES-NI accelerated key setup to + 'aesni_do_setkey'. + (do_setkey): Call _gcry_get_hw_features only once. Clear stack after + use in generic key setup part. + (rijndael_setkey): Remove stack burning. + (prepare_decryption) [USE_AESNI]: Use 'u128_t' instead of 'm128i_t' to + avoid compiler generated SSE2 instructions and XMM register usage, + unroll 'aesimc' setup loop + (prepare_decryption): Clear stack after use. + [USE_AESNI] (do_aesni_enc_aligned): Update comment about alignment. + (do_decrypt): Do not burning stack after prepare_decryption. + + Avoid burn stack in Arcfour setkey. + + commit a50a6ba3540f49fc7dcdb32e691327d5942e3509 + * cipher/arcfour.c (arcfour_setkey): Remove stack burning. + + Avoid burn_stack in CAST5 setkey. + + commit 5797ebc268b4e953cedd0c729c5cdb1f8fd764e4 + * cipher/cast5.c (do_cast_setkey): Use wipememory instead of memset. + (cast_setkey): Remove stack burning. + + Improve Serpent key setup speed. + + commit 9897ccb381503455edc490679b2e9251a09ac5cb + * cipher/serpent.c (SBOX, SBOX_INVERSE): Remove index argument. + (serpent_subkeys_generate): Use smaller temporary arrays for subkey + generation and perform stack clearing locally. + (serpent_setkey_internal): Use wipememory to clear stack and remove + _gcry_burn_stack. + (serpent_setkey): Remove unneeded _gcry_burn_stack. + + Modify encrypt/decrypt arguments for in-place. + + commit b8515aa70b00baba3fba8121ed305edcd029c8c7 + * cipher/cipher.c (gcry_cipher_encrypt, gcry_cipher_decrypt): Modify + local arguments if in-place operation. + + Speed up Stribog. + + commit a48d07ccadee4cb8b666a9a4ba2f00129bad5b2f + * cipher/stribog.c (STRIBOG_TABLES): Remove. + (Pi): Remove. + [!STRIBOG_TABLES] (A, strido): Remove. + (stribog_table): New table pre-reordered with Pi values. + (strido): Rewrite for new table. + (LPSX): Rewrite for new table. + (xor): Remove. + (g): Small tweaks. + + Tweak AES-NI bulk CTR mode slightly. + + commit 3b5058b58a183fa23ecf3ef819e2ae6ac64c0216 + * cipher/rijndael.c [USE_AESNI] (aesni_cleanup_2_5): Rename to... + (aesni_cleanup_2_6): ...this and clear also 'xmm6'. + [USE_AESNI && __i386__] (do_aesni_ctr, do_aesni_ctr_4): Prevent + inlining only on i386, allow on AMD64. + [USE_AESNI] (do_aesni_ctr, do_aesni_ctr_4): Use counter block from + 'xmm5' and byte-swap mask from 'xmm6'. + (_gcry_aes_ctr_enc) [USE_AESNI]: Preload counter block to 'xmm5' and + byte-swap mask to 'xmm6'. + (_gcry_aes_ctr_enc, _gcry_aes_cfb_dec, _gcry_aes_cbc_dec): Use + 'aesni_cleanup_2_6'. + + Tweak bench-slope parameters. + + commit 7e98eecc1a955bc253765f92a166b6560f085b8c + * tests/bench-slope.c (BUF_STEP_SIZE): Half step size to 64. + (NUM_MEASUREMENT_REPETITIONS): Double repetitions to 64. + + Optimize Blowfish weak key check. + + commit 8e1c0f9b894c39b6554c544208dc000682f520c7 + * cipher/blowfish.c (hashset_elem, val_to_hidx, add_val): New. + (do_bf_setkey): Use faster algorithm for detecting weak keys. + (bf_setkey): Move stack burning to do_bf_setkey. + + Fix __builtin_bswap32/64 checks. + + commit 2590a5df6f5fc884614c8c379324027d2d61b9b5 + * configure.ac (gcry_cv_have_builtin_bswap32) + (gcry_cv_have_builtin_bswap64): Change compile checks to link checks. + + Fix 'u32' build error with Camellia. + + commit 84bcb400e7db7268abfc29b5ab1513b0c063b293 + * cipher/camellia.c: Add include for <config.h> and "types.h". + (u32): Remove. + (u8): Typedef as 'byte'. + +2013-11-06 Werner Koch <wk@gnupg.org> + + pubkey: Add forward compatibility feature. + + commit 6d169b654c7ff04c10f73afe80b2c70cefa410c1 + * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist): Add + "igninvflag". + +2013-11-05 Werner Koch <wk@gnupg.org> + + ecc: Require "eddsa" flag for curve Ed25519. + + commit b9fd3988b54b50109f4e7179e7fe0739bb1d97c5 + * src/cipher.h (PUBKEY_FLAG_ECDSA): Remove. + * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist): Remove "ecdsa". + * cipher/ecc.c (ecc_generate, ecc_sign, ecc_verify): Require "eddsa" flag. + * cipher/ecc-misc.c (_gcry_ecc_compute_public): Depend "eddsa" flag. + * tests/benchmark.c, tests/keygen.c, tests/pubkey.c + * tests/t-ed25519.c, tests/t-mpi-point.c: Adjust for changed flags. + + ecc: Fully implement Ed25519 compression in ECDSA mode. + + commit f09ffe8a4802af65a116e79eceeb1cb4ed4fa2f4 + * src/ec-context.h (mpi_ec_ctx_s): Add field FLAGS. + * mpi/ec.c (ec_p_init): Add arg FLAGS. Change all callers to pass it. + * cipher/ecc-curves.c (point_from_keyparam): Add arg EC, parse as + opaque mpi and use eddsa decoding depending on the flag. + (_gcry_mpi_ec_new): Rearrange to parse Q and D after knowing the + curve. + + mpi: Add function gcry_mpi_set_opaque_copy. + + commit 630aca794ddf057fb7265b7dc346374743036af4 + * src/gcrypt.h.in (gcry_mpi_set_opaque_copy): New. + * src/visibility.c (gcry_mpi_set_opaque_copy): New. + * src/visibility.h (gcry_mpi_set_opaque_copy): Mark visible. + * src/libgcrypt.def, src/libgcrypt.vers: Add new API. + * tests/mpitests.c (test_opaque): Add test. + +2013-11-04 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Make test vectors 'static const' + + commit d50a88d1e29124d038196fec6082fd093e922604 + * cipher/arcfour.c (selftest): Change test vectors to 'static const'. + * cipher/blowfish.c (selftest): Ditto. + * cipher/camellia-glue.c (selftest): Ditto. + * cipher/cast5.c (selftest): Ditto. + * cipher/des.c (selftest): Ditto. + * cipher/rijndael.c (selftest): Ditto. + * tests/basic.c (cipher_cbc_mac_cipher, check_aes128_cbc_cts_cipher) + (check_ctr_cipher, check_cfb_cipher, check_ofb_cipher) + (check_ccm_cipher, check_stream_cipher) + (check_stream_cipher_large_block, check_bulk_cipher_modes) + (check_ciphers, check_digests, check_hmac, check_pubkey_sign) + (check_pubkey_sign_ecdsa, check_pubkey_crypt, check_pubkey): Ditto. + +2013-11-03 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Make jump labels local in Salsa20 assembly. + + commit d4697862266f3c96b6946dc92139dd8f3e81e5f6 + * cipher/salsa20-amd64.S: Rename '._labels' to '.L_labels'. + * cipher/salsa20-armv7-neon.S: Ditto. + +2013-10-30 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + bithelp: fix undefined behaviour with rol and ror. + + commit d1cadd145199040299538891ab2ccd1208f7776e + * cipher/bithelp.h (rol, ror): Mask shift with 31. + +2013-10-29 Werner Koch <wk@gnupg.org> + + tests: Add feature to skip benchmarks. + + commit ba6bffafd17bea11985afc500022d66da261d59a + * tests/benchmark.c (main): Add feature to skip the test. + * tests/bench-slope.c (main): Ditto. + (get_slope): Repace C++ style comment. + (double_cmp, cipher_bench, _hash_bench): Repalce system reserved + symbols. + + ecc: Finish Ed25519/ECDSA hack. + + commit c284f15db99e9cb135612de710199abb23baafd3 + * cipher/ecc.c (ecc_generate): Fix Ed25519/ECDSA case. + (ecc_verify): Implement ED25519/ECDSA uncompression. + + ecc: Add flags "noparam" and "comp". + + commit ba892a0a874c8b2a83dbf0940608cd7e2911ce01 + * src/cipher.h (PUBKEY_FLAG_NOPARAM, PUBKEY_FLAG_COMP): New. + * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist): Parse new flags + and change code for possible faster parsing. + * cipher/ecc.c (ecc_generate): Implement the "noparam" flag. + (ecc_sign): Ditto. + (ecc_verify): Ditto. + * tests/keygen.c (check_ecc_keys): Use the "noparam" flag. + + * cipher/ecc.c (ecc_generate): Fix parsing of the deprecated + transient-flag parameter. + (ecc_verify): Do not make Q optional in the extract-param call. + +2013-10-28 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix typos in documentation. + + commit 1faa61845f180bd47e037e400dde2d864ee83c89 + * doc/gcrypt.texi: Fix some typos. + + Add ARM NEON assembly implementation of Serpent. + + commit 2cb6e1f323d24359b1c5b113be5c2f79a2a4cded + * cipher/Makefile.am: Add 'serpent-armv7-neon.S'. + * cipher/serpent-armv7-neon.S: New. + * cipher/serpent.c (USE_NEON): New macro. + (serpent_context_t) [USE_NEON]: Add 'use_neon'. + [USE_NEON] (_gcry_serpent_neon_ctr_enc, _gcry_serpent_neon_cfb_dec) + (_gcry_serpent_neon_cbc_dec): New prototypes. + (serpent_setkey_internal) [USE_NEON]: Detect NEON support. + (_gcry_serpent_neon_ctr_enc, _gcry_serpent_neon_cfb_dec) + (_gcry_serpent_neon_cbc_dec) [USE_NEON]: Use NEON implementations + to process eight blocks in parallel. + * configure.ac [neonsupport]: Add 'serpent-armv7-neon.lo'. + + Add ARM NEON assembly implementation of Salsa20. + + commit 3ff9d2571c18cd7a34359f9c60a10d3b0f932b23 + * cipher/Makefile.am: Add 'salsa20-armv7-neon.S'. + * cipher/salsa20-armv7-neon.S: New. + * cipher/salsa20.c [USE_ARM_NEON_ASM]: New macro. + (struct SALSA20_context_s, salsa20_core_t, salsa20_keysetup_t) + (salsa20_ivsetup_t): New. + (SALSA20_context_t) [USE_ARM_NEON_ASM]: Add 'use_neon'. + (SALSA20_context_t): Add 'keysetup', 'ivsetup' and 'core'. + (salsa20_core): Change 'src' argument to 'ctx'. + [USE_ARM_NEON_ASM] (_gcry_arm_neon_salsa20_encrypt): New prototype. + [USE_ARM_NEON_ASM] (salsa20_core_neon, salsa20_keysetup_neon) + (salsa20_ivsetup_neon): New. + (salsa20_do_setkey): Setup keysetup, ivsetup and core with default + functions. + (salsa20_do_setkey) [USE_ARM_NEON_ASM]: When NEON support detect, + set keysetup, ivsetup and core with ARM NEON functions. + (salsa20_do_setkey): Call 'ctx->keysetup'. + (salsa20_setiv): Call 'ctx->ivsetup'. + (salsa20_do_encrypt_stream) [USE_ARM_NEON_ASM]: Process large buffers + in ARM NEON implementation. + (salsa20_do_encrypt_stream): Call 'ctx->core' instead of directly + calling 'salsa20_core'. + (selftest): Add test to check large buffer processing and block counter + updating. + * configure.ac [neonsupport]: 'Add salsa20-armv7-neon.lo'. + + Add AMD64 assembly implementation of Salsa20. + + commit 5a3d43485efdc09912be0967ee0a3ce345b3b15a + * cipher/Makefile.am: Add 'salsa20-amd64.S'. + * cipher/salsa20-amd64.S: New. + * cipher/salsa20.c (USE_AMD64): New macro. + [USE_AMD64] (_gcry_salsa20_amd64_keysetup, _gcry_salsa20_amd64_ivsetup) + (_gcry_salsa20_amd64_encrypt_blocks): New prototypes. + [USE_AMD64] (salsa20_keysetup, salsa20_ivsetup, salsa20_core): New. + [!USE_AMD64] (salsa20_core): Change 'src' to non-constant, update block + counter in 'salsa20_core' and return burn stack depth. + [!USE_AMD64] (salsa20_keysetup, salsa20_ivsetup): New. + (salsa20_do_setkey): Move generic key setup to 'salsa20_keysetup'. + (salsa20_setkey): Fix burn stack depth. + (salsa20_setiv): Move generic IV setup to 'salsa20_ivsetup'. + (salsa20_do_encrypt_stream) [USE_AMD64]: Process large buffers in AMD64 + implementation. + (salsa20_do_encrypt_stream): Move stack burning to this function... + (salsa20_encrypt_stream, salsa20r12_encrypt_stream): ...from these + functions. + * configure.ac [x86-64]: Add 'salsa20-amd64.lo'. + + Add new benchmarking utility, bench-slope. + + commit e214e8392671dd30e9c33260717b5e756debf3bf + * tests/Makefile.am (TESTS): Add 'bench-slope'. + * tests/bench-slope.c: New. + + Change .global to .globl in assembly files. + + commit ebc8abfcb09d6106fcfce40f240a513e276f46e9 + * cipher/blowfish-arm.S: Change '.global' to '.globl'. + * cipher/camellia-aesni-avx-amd64.S: Ditto. + * cipher/camellia-aesni-avx2-amd64.S: Ditto. + * cipher/camellia-arm.S: Ditto. + * cipher/cast5-amd64.S: Ditto. + * cipher/rijndael-amd64.S: Ditto. + * cipher/rijndael-arm.S: Ditto. + * cipher/serpent-avx2-amd64.S: Ditto. + * cipher/serpent-sse2-amd64.S: Ditto. + * cipher/twofish-amd64.S: Ditto. + * cipher/twofish-arm.S: Ditto. + +2013-10-26 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Deduplicate code for ECB encryption and decryption. + + commit 51f1beab3d1e879942a95f58b08de7dbcce75dce + * cipher/cipher.c (do_ecb_crypt): New, based on old 'do_ecb_encrypt'. + (do_ecb_encrypt): Use 'do_ecb_crypt', pass encryption function. + (do_ecb_decrypt): Use 'do_ecb_crypt', pass decryption function. + +2013-10-26 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Drop _gcry_cipher_ofb_decrypt as it duplicates _gcry_cipher_ofb_encrypt. + + commit d9431725952e40f201c7eda000d3c8511ebd5b33 + * cipher/cipher.c (cipher_decrypt): Use _gcry_cipher_ofb_encrypt for OFB + decryption. + * cipher/cipher-internal.h: Remove _gcry_cipher_ofb_decrypt declaration. + * cipher/cipher-ofb.c (_gcry_cipher_ofb_decrypt): Remove. + (_gcry_cipher_ofb_encrypt): remove copying of IV to lastiv, it's + unused there. + +2013-10-25 Werner Koch <wk@gnupg.org> + + tests: Add tests for mpi_cmp. + + commit 6c6d4810927de7310ae7bac61b4ff5467d7cb485 + * tests/mpitests.c (die): Modernize. + (fail): New. + (test_opaque, test_add, test_sub, test_mul): Use gcry_log_xx + (main): Return error count. + (test_cmp): New. + +2013-10-24 Werner Koch <wk@gnupg.org> + + ecc: Change algorithm for Ed25519 x recovery. + + commit c630fd71b336eb9209e914d24dc1e26a34521882 + * cipher/ecc-eddsa.c (scanval): Add as temporary hack. + (_gcry_ecc_eddsa_recover_x): Use the algorithm from page 15 of the + paper. Return an error code. + (_gcry_ecc_eddsa_decodepoint): Take care of the error code. + * mpi/mpi-mul.c (gcry_mpi_mulm): Use truncated division. + + ecc: Refactor _gcry_ecc_eddsa_decodepoint. + + commit 1cf5699b6febab1ef9d300531acc2ee33a7df739 + * cipher/ecc-eddsa.c (_gcry_ecc_eddsa_decodepoint): Factor some code + out to .. + (_gcry_ecc_eddsa_recover_x): new. + +2013-10-24 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + ecc-gost: Add missing include. + + commit 9ce54e5b512418ddf45ce18f2cbd48cdced779f5 + * ecc-gost.c: Include "pubkey-internal.h". + +2013-10-23 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Replace architecture specific fast_wipememory2 with generic. + + commit 54df6fcd806f8c150cffe6cc09925bb8b638bb5b + * src/g10lib.h (fast_wipememory2): Remove architecture specific + implementations and add generic implementation. + + Improve the speed of the cipher mode code. + + commit 293e93672fdabc829e35cc624c397276342bafe4 + * cipher/bufhelp.h (buf_cpy): New. + (buf_xor, buf_xor_2dst): If buffers unaligned, always jump to per-byte + processing. + (buf_xor_n_copy_2): New. + (buf_xor_n_copy): Use 'buf_xor_n_copy_2'. + * cipher/blowfish.c (_gcry_blowfish_cbc_dec): Avoid extra memory copy + and use new 'buf_xor_n_copy_2'. + * cipher/camellia-glue.c (_gcry_camellia_cbc_dec): Ditto. + * cipher/cast5.c (_gcry_cast_cbc_dec): Ditto. + * cipher/serpent.c (_gcry_serpent_cbc_dec): Ditto. + * cipher/twofish.c (_gcry_twofish_cbc_dec): Ditto. + * cipher/rijndael.c (_gcry_aes_cbc_dec): Ditto. + (do_encrypt, do_decrypt): Use 'buf_cpy' instead of 'memcpy'. + (_gcry_aes_cbc_enc): Avoid copying IV, use 'last_iv' pointer instead. + * cipher/cipher-cbc.c (_gcry_cipher_cbc_encrypt): Avoid copying IV, + update pointer to IV instead. + (_gcry_cipher_cbc_decrypt): Avoid extra memory copy and use new + 'buf_xor_n_copy_2'. + (_gcry_cipher_cbc_encrypt, _gcry_cipher_cbc_decrypt): Avoid extra + accesses to c->spec, use 'buf_cpy' instead of memcpy. + * cipher/cipher-ccm.c (do_cbc_mac): Ditto. + * cipher/cipher-cfb.c (_gcry_cipher_cfb_encrypt) + (_gcry_cipher_cfb_decrypt): Ditto. + * cipher/cipher-ctr.c (_gcry_cipher_ctr_encrypt): Ditto. + * cipher/cipher-ofb.c (_gcry_cipher_ofb_encrypt) + (_gcry_cipher_ofb_decrypt): Ditto. + * cipher/cipher.c (do_ecb_encrypt, do_ecb_decrypt): Ditto. + + bufhelp: enable unaligned memory accesses for AArch64 (64-bit ARM) + + commit 2901a10dbf1264707debc8402546c07eeac60932 + * cipher/bufhelp.h [__aarch64__] (BUFHELP_FAST_UNALIGNED_ACCESS): Set + macro on AArch64. + +2013-10-23 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Enable assembler optimizations on earlier ARM cores. + + commit 2fd83faa876d0be91ab7884b1a9eaa7793559eb9 + * cipher/blowfish-armv6.S => cipher/blowfish-arm.S: adapt to pre-armv6 CPUs. + * cipher/blowfish.c: enable assembly on armv4/armv5 little-endian CPUs. + * cipher/camellia-armv6.S => cipher/camellia-arm.S: adapt to pre-armv6 CPUs. + * cipher/camellia.c, cipher-camellia-glue.c: enable assembly on armv4/armv5 + little-endian CPUs. + * cipher/cast5-armv6.S => cipher/cast5-arm.S: adapt to pre-armv6 CPUs. + * cipher/cast5.c: enable assembly on armv4/armv5 little-endian CPUs. + * cipher/rijndael-armv6.S => cipher/rijndael-arm.S: adapt to pre-armv6 CPUs. + * cipher/rijndael.c: enable assembly on armv4/armv5 little-endian CPUs. + * cipher/twofish-armv6.S => cipher/twofish-arm.S: adapt to pre-armv6 CPUs. + * cipher/twofish.c: enable assembly on armv4/armv5 little-endian CPUs. + + mpi: enable assembler on all arm architectures. + + commit 0b39fce7e3ce6761d6bd5195d093ec6857edb7c2 + * mpi/config.links: remove check for arm >= v6 + * mpi/armv6 => mpi/arm: rename directory to reflect that is is generic + enough + + Correct ASM assembly test in configure.ac. + + commit 10bf6a7e16ed193f90d2749970a420f00d1d3320 + * configure.ac: correct HAVE_COMPATIBLE_GCC_ARM_PLATFORM_AS test to + require neither ARMv6, nor thumb mode. Our assembly code works + perfectly even on ARMv4 now. + +2013-10-23 Werner Koch <wk@gnupg.org> + + ecc: Refactor ecc.c. + + commit 164eb8c85d773ef4f0939115ec45f5e4b47c1700 + * cipher/ecc-ecdsa.c, cipher/ecc-eddsa.c, cipher/ecc-gost.c: New. + * cipher/Makefile.am (EXTRA_libcipher_la_SOURCES): Add new files. + * configure.ac (GCRYPT_PUBKEY_CIPHERS): Add new files. + * cipher/ecc.c (point_init, point_free): Move to ecc-common.h. + (sign_ecdsa): Move to ecc-ecdsa.c as _gcry_ecc_ecdsa_sign. + (verify_ecdsa): Move to ecc-ecdsa.c as _gcry_ecc_ecdsa_verify. + (sign_gost): Move to ecc-gots.c as _gcry_ecc_gost_sign. + (verify_gost): Move to ecc-gost.c as _gcry_ecc_gost_verify. + (sign_eddsa): Move to ecc-eddsa.c as _gcry_ecc_eddsa_sign. + (verify_eddsa): Move to ecc-eddsa.c as _gcry_ecc_eddsa_verify. + (eddsa_generate_key): Move to ecc-eddsa.c as _gcry_ecc_eddsa_genkey. + (reverse_buffer): Move to ecc-eddsa.c. + (eddsa_encodempi, eddsa_encode_x_y): Ditto. + (_gcry_ecc_eddsa_encodepoint, _gcry_ecc_eddsa_decodepoint): Ditto. + + mpi: Fix scanning of negative SSH formats and add more tests. + + commit 45f6e6268bfdc4b608beaba6b7086b2286e33c71 + * mpi/mpicoder.c (gcry_mpi_scan): Fix sign setting for SSH format. + * tests/t-convert.c (negative_zero): Test all formats. + (check_formats): Add tests for PGP and scan tests for SSH and USG. + + * src/gcrypt.h.in (mpi_is_neg): Fix macro. + + * mpi/mpi-scan.c (_gcry_mpi_getbyte, _gcry_mpi_putbyte): Comment out + these unused functions. + +2013-10-22 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + twofish: add ARMv6 assembly implementation. + + commit 98674fdaa30ab22a3ac86ca05d688b5b6112895d + * cipher/Makefile.am: Add 'twofish-armv6.S'. + * cipher/twofish-armv6.S: New. + * cipher/twofish.c (USE_ARMV6_ASM): New macro. + [USE_ARMV6_ASM] (_gcry_twofish_armv6_encrypt_block) + (_gcry_twofish_armv6_decrypt_block): New prototypes. + [USE_AMDV6_ASM] (twofish_encrypt, twofish_decrypt): Add. + [USE_AMD64_ASM] (do_twofish_encrypt, do_twofish_decrypt): Remove. + (_gcry_twofish_ctr_enc, _gcry_twofish_cfb_dec): Use 'twofish_encrypt' + instead of 'do_twofish_encrypt'. + (_gcry_twofish_cbc_dec): Use 'twofish_decrypt' instead of + 'do_twofish_decrypt'. + * configure.ac [arm]: Add 'twofish-armv6.lo'. + + mpi: allow building with clang on ARM. + + commit e67c67321ce240c93dd0fa2b21c649c0a8e233f7 + * mpi/longlong.h [__arm__] (add_ssaaaa, sub_ddmmss, umul_ppmm) + (count_leading_zeros): Do not cast assembly output arguments. + [__arm__] (umul_ppmm): Remove the extra '%' ahead of assembly comment. + [_ARM_ARCH >= 4] (umul_ppmm): Use correct inputs and outputs instead of + registers. + + serpent-amd64: do not use GAS macros. + + commit c7efaa5fe0ee92e321a7b49d56752cc12eb75fe0 + * cipher/serpent-avx2-amd64.S: Remove use of GAS macros. + * cipher/serpent-sse2-amd64.S: Ditto. + * configure.ac [HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS]: Do not check + for GAS macros. + + Add Counter with CBC-MAC mode (CCM) + + commit 335d9bf7b035815750b63a3a8334d6ce44dc4449 + * cipher/Makefile.am: Add 'cipher-ccm.c'. + * cipher/cipher-ccm.c: New. + * cipher/cipher-internal.h (gcry_cipher_handle): Add 'u_mode'. + (_gcry_cipher_ccm_encrypt, _gcry_cipher_ccm_decrypt) + (_gcry_cipher_ccm_set_nonce, _gcry_cipher_ccm_authenticate) + (_gcry_cipher_ccm_get_tag, _gcry_cipher_ccm_check_tag) + (_gcry_cipher_ccm_set_lengths): New prototypes. + * cipher/cipher.c (gcry_cipher_open, cipher_encrypt, cipher_decrypt) + (_gcry_cipher_setiv, _gcry_cipher_authenticate, _gcry_cipher_gettag) + (_gcry_cipher_checktag, gry_cipher_ctl): Add handling for CCM mode. + * doc/gcrypt.texi: Add documentation for GCRY_CIPHER_MODE_CCM. + * src/gcrypt.h.in (gcry_cipher_modes): Add 'GCRY_CIPHER_MODE_CCM'. + (gcry_ctl_cmds): Add 'GCRYCTL_SET_CCM_LENGTHS'. + (GCRY_CCM_BLOCK_LEN): New. + * tests/basic.c (check_ccm_cipher): New. + (check_cipher_modes): Call 'check_ccm_cipher'. + * tests/benchmark.c (ccm_aead_init): New. + (cipher_bench): Add handling for AEAD modes and add CCM benchmarking. + + Add API to support AEAD cipher modes. + + commit 95654041f2aa62f71aac4d8614dafe8433d10f95 + * cipher/cipher.c (_gcry_cipher_authenticate, _gcry_cipher_checktag) + (_gcry_cipher_gettag): New. + * doc/gcrypt.texi: Add documentation for new API functions. + * src/visibility.c (gcry_cipher_authenticate, gcry_cipher_checktag) + (gcry_cipher_gettag): New. + * src/gcrypt.h.in, src/visibility.h: add declarations of these + functions. + * src/libgcrypt.defs, src/libgcrypt.vers: export functions. + +2013-10-22 NIIBE Yutaka <gniibe@fsij.org> + + ecc: Correct compliant key generation for Edwards curves. + + commit a5a277a9016ccb34f1858a65e0ed1791b2fc3db3 + * cipher/ecc.c: Add case for Edwards curves. + +2013-10-17 Werner Koch <wk@gnupg.org> + + tests: Add test options to keygen. + + commit f7711e6eb5f02d03c74911f6f037ab28075e7c0d + * tests/keygen.c (usage): New. + (main): Print usage info. Allow running just one algo. + + mpi: Do not clear the sign of the mpi_mod result. + + commit 91e007606f1f6f8e1416c403fe809d47fddf9b1f + * mpi/mpi-mod.c (_gcry_mpi_mod): Remove sign setting. + + ecc: Put the curve name again into the output of gcry_pk_genkey. + + commit 4776dcd394ce59fa50d959921857b3427c5a63c8 + * cipher/ecc.c (ecc_generate): Use the correct var. Release + CURVE_FLAGS. + + ecc: Support Weierstrass curves in gcry_mpi_ec_curve_point. + + commit b22417158c50ec3a0b2ff55b4ade063b42a87e8f + * mpi/ec.c (_gcry_mpi_ec_curve_point): Support MPI_EC_WEIERSTRASS. + +2013-10-16 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + arcfour: more optimized version for non-i386 architectures. + + commit f9371c026aad09ff48746d22c8333746c886e773 + * cipher/arcfour.c (ARCFOUR_context): Reorder members. + (do_encrypt_stream) [!__i386__]: Faster implementation for non-i386. + (do_arcfour_setkey): Avoid modulo operations. + + Avoid void* pointer arithmetic. + + commit c89ab921ccfaefe6c4f6a724d01e0df41a1a381f + * tests/tsexp.c (check_extract_param): Cast void* pointers to char* + before doing arithmetics. + +2013-10-16 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + ecc: Add support for GOST R 34.10-2001/-2012 signatures. + + commit 83902f1f1dbc8263a0c3f61be59cd2eb95293c97 + * src/cipher.h: define PUBKEY_FLAG_GOST + * cipher/ecc-curves.c: Add GOST2001-test and GOST2012-test curves + defined in standards. Typical applications would use either those + curves, or curves defined in RFC 4357 (will be added later). + * cipher/ecc.c (sign_gost, verify_gost): New. + (ecc_sign, ecc_verify): use sign_gost/verify_gost if PUBKEY_FLAG_GOST + is set. + (ecc_names): add "gost" for gost signatures. + * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist, + _gcry_pk_util_preparse_sigval): set PUBKEY_FLAG_GOST if gost flag + is present in s-exp. + * tests/benchmark.c (ecc_bench): also benchmark GOST signatures. + * tests/basic.c (check_pubkey): add two public keys from + GOST R 34.10-2012 standard. + (check_pubkey_sign_ecdsa): add two data sets to check gost signatures. + * tests/curves.c: correct N_CURVES as we now have 2 more curves. + + + Removed some comments from the new curve definitions in ecc-curves.c + to avoid line wrapping. Eventually we will develop a precompiler to + avoid parsing those hex strings. -wk + + Fix 256-bit ecdsa test key definition. + + commit 187b2bb541b985255aee262d181434a7cb4ae2e7 + * tests/basic.c (check_pubkey): fix nistp256 testing key declaration - + add missing comma. + +2013-10-16 Werner Koch <wk@gnupg.org> + + sexp: Add function gcry_sexp_extract_param. + + commit a329b6abf00c990faf1986f9fbad7b4d71c13bcb + * src/gcrypt.h.in (_GCRY_GCC_ATTR_SENTINEL): New. + (gcry_sexp_extract_param): New. + * src/visibility.c (gcry_sexp_extract_param): New. + * src/visibility.h (gcry_sexp_extract_param): Add hack to detect + internal use. + * cipher/pubkey-util.c (_gcry_pk_util_extract_mpis): Move and split + into ... + * src/sexp.c (_gcry_sexp_vextract_param) + (_gcry_sexp_extract_param): this. Change all callers. Add support for buffer + descriptors and a path option/ + + * tests/tsexp.c (die, hex2buffer, hex2mpi, hex2mpiopa): New. + (cmp_mpihex, cmp_bufhex): New. + (check_extract_param): New. + +2013-10-16 NIIBE Yutaka <gniibe@fsij.org> + + mpi: mpi-pow improvement. + + commit 45aa6131e93fac89d46733b3436d960f35fb99b2 + * mpi/mpi-pow.c (gcry_mpi_powm): New implementation of left-to-right + k-ary exponentiation. + +2013-10-15 Werner Koch <wk@gnupg.org> + + ecc: Support use of Ed25519 with ECDSA. + + commit 537969fbbb1104b8305a7edb331b7666d54eff2c + * src/cipher.h (PUBKEY_FLAG_ECDSA): New. + * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist): Add flag "ecdsa". + * cipher/ecc.c (verify_ecdsa, verify_eddsa): Remove some debug output. + (ecc_generate, ecc_sign, ecc_verify): Support Ed25519 with ECDSA. + * tests/keygen.c (check_ecc_keys): Create such a test key. + * tests/pubkey.c (fail, info, data_from_hex, extract_cmp_data): New. + Take from dsa-6979.c + (check_ed25519ecdsa_sample_key): new. + (main): Call new test. + +2013-10-14 Werner Koch <wk@gnupg.org> + + pubkey: Support flags list in gcry_pk_genkey. + + commit d3a605d7827b8a73ef844e9e5183590bd6b1389a + * src/cipher.h (PUBKEY_FLAG_TRANSIENT_KEY): New. + (PUBKEY_FLAG_USE_X931): New. + (PUBKEY_FLAG_USE_FIPS186): New. + (PUBKEY_FLAG_USE_FIPS186_2): New. + * cipher/pubkey-util.c (_gcry_pk_util_parse_flaglist): Rename from + parse_flags_list. Parse new flags. + * cipher/dsa.c (dsa_generate): Support flag list. + * cipher/ecc.c (ecc_generate): Ditto. + * cipher/rsa.c (rsa_generate): Ditto. + + pubkey: Remove duplicated flag parsing code. + + commit 5be2345ddec4147e535d5b039ee74f84bcacf9e4 + * cipher/pubkey-util.c (_gcry_pk_util_preparse_encval) + (_gcry_pk_util_data_to_mpi): Factor flag parsing code out to .. + (parse_flag_list): New. + * src/cipher.h (PUBKEY_FLAG_RAW_FLAG): New. + + mpicalc: Accept lowercase hex digits. + + commit 0cd551faa775ad5309a40629ae30bf86b75fca09 + * src/mpicalc.c (main): Test for lowercase hex digits. + +2013-10-11 Werner Koch <wk@gnupg.org> + + pubkey: Move sexp parsing of remaining fucntions to the modules. + + commit a951c061523e1c13f1358c9760fc3a9d787ab2d4 + * cipher/pubkey.c (release_mpi_array): Remove. + (pubkey_check_secret_key): Remove. + (sexp_elements_extract): Remove. + (sexp_elements_extract_ecc): Remove. + (sexp_to_key): Remove. + (get_hash_algo): Remove. + (gcry_pk_testkey): Revamp. + (gcry_pk_get_curve): Revamp. + * cipher/rsa.c (rsa_check_secret_key): Revamp. + * cipher/elgamal.c (elg_check_secret_key): Revamp. + * cipher/dsa.c (dsa_check_secret_key): Revamp. + * cipher/ecc.c (ecc_check_secret_key): Revamp. + * cipher/ecc-curves.c: Include cipher.h and pubkey-internal.h + (_gcry_ecc_get_curve): Revamp. + + * cipher/pubkey-util.c (_gcry_pk_util_extract_mpis): Set passed and + used parameters on error to NULL. + + pubkey: Move sexp parsing for gcry_pk_decrypt to the modules. + + commit 07950c865a901afc48acb46f0695040cadfd5068 + * cipher/rsa.c (rsa_decrypt): Revamp. + * cipher/elgamal.c (elg_decrypt): Revamp. + * cipher/ecc.c (ecc_decrypt_raw): Revamp. + * cipher/pubkey.c (gcry_pk_decrypt): Simplify. + (sexp_to_enc): Remove. + * cipher/pubkey-util.c (_gcry_pk_util_preparse_encval): New. + + pubkey: Move sexp parsing for gcry_pk_encrypt to the modules. + + commit 6bd5d18c45a4a3ce8f0f66f56c83b80594877f53 + * cipher/rsa.c (rsa_encrypt): Revamp. + * cipher/elgamal.c (elg_encrypt): Revamp. + * cipher/ecc.c (ecc_encrypt_raw): Revamp. + * cipher/pubkey.c (gcry_pk_encrypt): Simplify. + + * tests/basic.c (check_pubkey_crypt): Init plain, ciph, and data so + that they are initialized even after an encrypt failure. + + pubkey: Move sexp parsing for gcry_pk_sign to the modules. + + commit d0ae6635e4e6ae273c3a137c513d518f28f6eab3 + * cipher/rsa.c (rsa_sign): Revamp. + * cipher/dsa.c (dsa_sign): Revamp. + * cipher/elgamal.c (elg_sign): Revamp. + * cipher/ecc.c (ecc_sign): Revamp. + * cipher/pubkey.c (gcry_pk_sign): Simplify. + +2013-10-10 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Prevent tail call optimization with _gcry_burn_stack. + + commit 150c0313f971bcea62d2802f0389c883e11ebb31 + * configure.ac: New check, HAVE_GCC_ASM_VOLATILE_MEMORY. + * src/g10lib.h (_gcry_burn_stack): Rename to __gcry_burn_stack. + (__gcry_burn_stack_dummy): New. + (_gcry_burn_stack): New macro. + * src/misc.c (_gcry_burn_stack): Rename to __gcry_burn_stack. + (__gcry_burn_stack_dummy): New. + +2013-10-09 Werner Koch <wk@gnupg.org> + + pubkey: Move sexp parsing for gcry_pk_verify to the modules. + + commit 94b652ecb006c29fa2ffb1badc9f02b758581737 + * cipher/rsa.c (rsa_verify): Revamp. + * cipher/dsa.c (dsa_verify): Revamp. + * cipher/elgamal.c (elg_verify): Revamp. + * cipher/ecc.c (ecc_verify): Revamp. + * cipher/pubkey.c (sexp_to_sig): Remove. + (pss_verify_cmp): Move to pubkey-util.c + (sexp_data_to_mpi): Ditto. + (init_encoding_ctx): Ditto. + (gcry_pk_verify): Simplify. + * cipher/pubkey-util.c (_gcry_pk_util_init_encoding_ctx): Add. Take + from pubkey.c + (get_hash_algo): Ditto. + (_gcry_pk_util_data_to_mpi): Ditto. + (pss_verify_cmp): Ditto. + (_gcry_pk_util_extract_mpis): New. + (_gcry_pk_util_preparse_sigval): New. + (_gcry_pk_util_free_encoding_ctx): New. + * cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Make curve init + optional. + + * src/g10lib.h (GCC_ATTR_SENTINEL): New. + + * tests/basic.c (check_pubkey_sign): Print the algo name. + (main): Add option --pubkey. + +2013-10-08 Werner Koch <wk@gnupg.org> + + pubkey: Move sexp parsing for gcry_pk_get_nbits to the modules. + + commit 4645f3728bb0900591b0aef85831fdee52c59e3c + * cipher/pubkey.c (spec_from_sexp): New. + (gcry_pk_get_nbits): Simplify. + * cipher/rsa.c (rsa_get_nbits): Take only PARMS as args and do sexp + parsing here. + * cipher/dsa.c (dsa_get_nbits): Ditto. + * cipher/elgamal.c (elg_get_nbits): Ditto. + * cipher/ecc.c (ecc_get_nbits): Ditto. + * cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Allow NULL for arg + CURVE. + + pubkey: Move sexp parsing for gcry_pk_getkey to the modules. + + commit 3816e46ce211e63adf46dbc775510aa137572248 + * cipher/pubkey-util.c: New. + (_gcry_pk_util_get_nbits): New. Based on code from gcry_pk_genkey. + (_gcry_pk_util_get_rsa_use_e): Ditto. + * cipher/pubkey.c (gcry_pk_genkey): Strip most code and pass. + * cipher/rsa.c (rsa_generate): Remove args ALGO, NBITS and EVALUE. + Call new fucntions to get these values. + * cipher/dsa.c (dsa_generate): Remove args ALGO, NBITS and EVALUE. + Call _gcry_pk_util_get_nbits to get nbits. Always parse genparms. + * cipher/elgamal.c (elg_generate): Ditto. + * cipher/ecc.c (ecc_generate): Ditto. + + cipher: Deprecate GCRY_PK_ELG_E. + + commit f79d3e13d3229115c47cbe5007647cb44105fe3f + * cipher/elgamal.c (_gcry_pubkey_spec_elg_e): Remove. + * cipher/pubkey.c (pubkey_list): Remove double included + _gcry_pubkey_spec_elg. + (map_algo): MAke ELG_E to ELG. + +2013-10-02 Werner Koch <wk@gnupg.org> + + Provide Pth compatiblity for use with GnuPG 2.0. + + commit 2f767f6a17f7e99da4075882f7fe3ca597b31bdb + * src/ath.c (ath_install): Call ath_init and declare Pth as + compatible. + +2013-10-02 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + sha512: fix building on ARM. + + commit 6410152338a2b2ac1216e70c153cd16f9199c94e + * cipher/sha512.c (transform) [USE_ARM_NEON_ASM]: Fix 'hd' to 'ctx'. + +2013-10-02 Werner Koch <wk@gnupg.org> + + Remove deprecated control codes. + + commit f04a1db22d982627ba87da4e5df52df9b994c779 + * src/gcrypt.h.in (GCRYCTL_SET_KEY): Remove. + (GCRYCTL_SET_IV): Remove. + (GCRYCTL_SET_CTR): Remove. + * cipher/md.c (gcry_md_ctl): Remove deprecated GCRYCTL_SET_KEY. + * cipher/cipher.c (gcry_cipher_ctl): Remove deprecated + GCRYCTL_SET_KEY, GCRYCTL_SET_IV, GCRYCTL_SET_CTR. + +2013-10-02 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Fix errors when building with Clang on PPC. + + commit 33757c1e03f1d885920633edf543cd1c77999455 + * mpi/longlong.h (add_ssaaaa, sub_ddmmss, count_leading_zeros, + umul_ppmm): Do not cast asm output to USItype. + +2013-10-02 Werner Koch <wk@gnupg.org> + + Remove last remains of the former module system. + + commit 628ed5ba0ef4b1f04b5a77e29e4bc49a1fe13c07 + * src/gcrypt-module.h, src/module.c: Remove. + * src/visibility.h: Do not include gcrypt-module.h. + * src/g10lib.h: Remove all prototypes from module.c + (gcry_module): Remove. + * cipher/cipher-internal.h (gcry_cipher_handle): Remove unused field. + + Fix missing prototype warning in visibility.c. + + commit 52783d483293d48cd468143ae6ae2cccbfe17200 + * src/ec-context.h (_gcry_mpi_ec_new): Move prototype to mpi.h. + + md: Simplify the message digest dispatcher md.c. + + commit 0d39997932617ba20656f8bcc230ba744b76c87e + * src/gcrypt-module.h (gcry_md_spec_t): Move to ... + * src/cipher-proto.h: here. Merge with md_extra_spec_t. Add fields + ALGO and FLAGS. Set these fields in all digest modules. + * cipher/md.c: Change most code to replace the former module + system by a simpler system to gain information about the algorithms. + +2013-10-01 Werner Koch <wk@gnupg.org> + + cipher: Simplify the cipher dispatcher cipher.c. + + commit 3ca180b25e8df252fc16f802cfdc27496e307830 + * src/gcrypt-module.h (gcry_cipher_spec_t): Move to ... + * src/cipher-proto.h (gcry_cipher_spec_t): here. Merge with + cipher_extra_spec_t. Add fields ALGO and FLAGS. Set these fields in + all cipher modules. + * cipher/cipher.c: Change most code to replace the former module + system by a simpler system to gain information about the algorithms. + (disable_pubkey_algo): Simplified. Not anymore thread-safe, though. + + * cipher/md.c (_gcry_md_selftest): Use correct structure. Not a real + problem because both define the same function as their first field. + + * cipher/pubkey.c (_gcry_pk_selftest): Take care of the disabled flag. + + mpi: Fix gcry_mpi_neg. + + commit 4153fa859816e799e506055321a22e6450aacdcc + * mpi/mpiutil.c (_gcry_mpi_neg): Copy U to W. + +2013-10-01 Peter Wu <lekensteyn@gmail.com> + + cipher: Add support for 128-bit keys in RC2. + + commit 738177ec0eae05069ec61bc4f724a69d4e052e42 + * cipher/rfc2268.c (oids_rfc2268_128): New + (_gcry_cipher_spec_rfc2268_128): New. + * cipher/cipher.c (cipher_table_entry): Add GCRY_CIPHER_RFC2268_128. + +2013-09-30 Werner Koch <wk@gnupg.org> + + ecc: Use faster b parameter for Ed25519. + + commit 1d85452412b65e7976bc94969fc513ff6b880ed8 + * cipher/ecc-curves.c (domain_parms): Replace b. + * tests/t-mpi-point.c (test_curve): Ditto. + + ecc: Prepare for future Ed25519 optimization. + + commit a2618c822e666d4121cba29bee3fd50bf70c9743 + * mpi/ec-ed25519.c: New but empty file. + * mpi/ec-internal.h: New. + * mpi/ec.c: Include ec-internal.h. + (ec_mod): New. + (ec_addm): Use ec_mod. + (ec_mulm): Remove commented code. Use ec_mod. + (ec_subm): Call simple sub. + (ec_pow2): Use ec_mulm. + (ec_mul2): New. + (dup_point_weierstrass): Use ec_mul2. + (dup_point_twistededwards): Add special case for a == -1. Use + ec_mul2. + (add_points_weierstrass): Use ec_mul2. + (add_points_twistededwards): Add special case for a == -1. + (_gcry_mpi_ec_curve_point): Ditto. + (ec_p_init): Add hack to test Barrett functions. + * src/ec-context.h (mpi_ec_ctx_s): Add P_BARRETT. + + * mpi/mpi-mod.c (_gcry_mpi_mod_barrett): Fix sign problem. + + ecc: Fix recomputing of Q for Ed25519. + + commit c325adb8f5092b80a626bd3bb5e49cf7f3a29fc8 + * cipher/ecc-misc.c (reverse_buffer): New. + (_gcry_ecc_compute_public): Add ED255519 specific code. + * cipher/ecc.c (sign_eddsa): Allocate DIGEST in secure memory. Get + rid of HASH_D. + * tests/t-mpi-point.c (context_param): Test recomputing of Q for + Ed25519. + + log: Try to print s-expressions in a more compact format. + + commit d69a13d3d1c14ad6a6aa7cd349d6d2dfb152d422 + * src/misc.c (count_closing_parens): New. + (_gcry_log_printsxp): Use new function. + * mpi/ec.c (_gcry_mpi_point_log): Take care of a NULL point. + +2013-09-30 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Make Whirlpool use the _gcry_md_block_write helper. + + commit 68cefd0f1d60ac33b58031df9b1d165cb1bf0f14 + * cipher/whirlpool.c (whirlpool_context_t): Add 'bctx', remove + 'buffer', 'count' and 'nblocks'. + (whirlpool_init): Initialize 'bctx'. + (whirlpool_transform): Adjust context argument type and burn stack + depth. + (whirlpool_add): Remove. + (whirlpool_write): Use _gcry_md_block_write. + (whirlpool_final, whirlpool_read): Adjust for 'bctx' usage. + + whirlpool: add stack burning after transform. + + commit a96d622e1a36d40d1504b7ada567e90ec9957443 + * cipher/whirlpool.c (whirlpool_transform): Return burn stack depth. + (whirlpool_add): Do burn_stack. + + whirlpool: do bitcount calculation in finalization part. + + commit 10d7351411f19bb2c03d2e24ca5a38dabe45023b + * cipher/whirlpool.c (whirlpool_context_t): Remove 'length', add + 'nblocks'. + (whirlpool_add): Update 'nblocks' instead of 'length', and add early + return at one spot. + (whirlpool_write): Check for 'nblocks' overflow. + (whirlpool_final): Convert 'nblocks' to bit-counter, and use + whirlpool_write instead of whirlpool_add. + +2013-09-30 Werner Koch <wk@gnupg.org> + + Add logging functions to the API. + + commit d2076f27bb7c5d505abf25fc622d21794c4a5df3 + * src/gcrypt.h.in (_GCRY_GCC_ATTR_PRINTF): New. + (gcry_log_debug, gcry_log_debughex, gcry_log_debugmpi): New. + (gcry_log_debugpnt, gcry_log_debugsxp): New. + * src/visibility.c (gcry_log_debug): New. + (gcry_log_debughex, gcry_log_debugmpi, gcry_log_debugpnt): New. + (gcry_log_debugsxp): New. + * src/libgcrypt.def, src/libgcrypt.vers: Add new functions. + * src/misc.c (_gcry_logv): Make public. + (_gcry_log_printsxp): New. + * src/g10lib.h (log_printsxp): New macro. + +2013-09-26 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Make libgcrypt build with Clang on i386. + + commit db60d828137c4f3682ca4ca2a54fe3d96d3db5f9 + * cipher/longlong.h [__i386__] (add_ssaaaa, sub_ddmmss) + (umul_ppmm, udiv_qrnnd): Do not cast asm output to USItype. + +2013-09-25 Werner Koch <wk@gnupg.org> + + mpi: Change not yet used _gcry_mpi_set_opaque_copy. + + commit 1c6660debdbf1e4c3e80074c846a3e3097f214bb + * mpi/mpiutil.c (_gcry_mpi_set_opaque_copy): Change prototype. + (_gcry_mpi_get_opaque_copy): Take care of gcry_malloc failure. + + sexp: Improve printing of data with a leading zero. + + commit 9b7c49971588edf6acfc74bfb797eb79d19cb350 + * src/sexp.c (suitable_encoding): Detect leading zero byte. + + ecc: Allow the name "q@eddsa" to get/set the public key. + + commit d6683d2a6065986a9198d2d2eaa02c005b68cea4 + * cipher/ecc-curves.c (_gcry_ecc_get_mpi): Support "q@eddsa". + (_gcry_ecc_set_mpi): Support "q". + * cipher/ecc.c (eddsa_encodepoint): Rename to ... + (_gcry_ecc_eddsa_encodepoint): this and make global. Remove arg + MINLEN and take from context. + (eddsa_decodepoint): Rename to + (_gcry_ecc_eddsa_decodepoint): this and make global. Remove arg LEN + and take from context. + (sign_eddsa, verify_eddsa): Take B from context. + (ecc_sign, ecc_verify): Add hack to set DIALECT. + (_gcry_pk_ecc_get_sexp): Use _gcry_ecc_compute_public. Handle EdDSA. + * src/ec-context.h (mpi_ec_ctx_s): Add field NBITS. + * mpi/ec.c (ec_p_init): Init NBITS. + * tests/t-mpi-point.c (test_curve): Add Ed25519. + (sample_ed25519_q): New. + (context_param): Check new sample key. + (hex2buffer, hex2mpiopa): New. + (cmp_mpihex): Take care of opaque MPIs. + + mpicalc: Add statement to compute the number of bits. + + commit 9a4447ccd1b90bcd701941e80a7f484a1825fcea + * src/mpicalc.c (do_nbits): New. + (main): Add statement 'b'. + + ecc: Refactor low-level access functions. + + commit 64a7d347847d606eb5f4c156e24ba060271b8f6b + * mpi/ec.c (point_copy): Move to cipher/ecc-curves.c. + (ec_get_reset): Rename to _gcry_mpi_ec_get_reset and make global. + (_gcry_mpi_ec_get_mpi): Factor most code out to _gcry_ecc_get_mpi. + (_gcry_mpi_ec_get_point): Factor most code out to _gcry_ecc_get_point. + (_gcry_mpi_ec_set_mpi): Factor most code out to _gcry_ecc_set_mpi. + (_gcry_mpi_ec_set_point): Factor most code out to _gcry_ecc_set_point. + * cipher/ecc-curves.c (_gcry_ecc_get_mpi): New. + (_gcry_ecc_get_point, _gcry_ecc_set_mpi, _gcry_ecc_set_point): New. + * cipher/ecc-misc.c (_gcry_ecc_compute_public): New. + + ecc: Fix highly unlikely endless loop in sign_ecdsa. + + commit 1f5f4452e5bca105ec2197a4facbf9778e7dc31e + * cipher/ecc.c (sign_ecdsa): Turn while-do into do-while loops. + +2013-09-24 Werner Koch <wk@gnupg.org> + + ecc: Allow the use of an uncompressed public key. + + commit df013c9820709421ef9550158ac5df0060d73379 + * cipher/ecc.c (eddsa_encodepoint): Factor most code out to ... + (eddsa_encode_x_y): new fucntion. + (eddsa_decodepoint): Allow use of an uncompressed public key. + * tests/t-ed25519.c (N_TESTS): Adjust. + * tests/t-ed25519.inp: Add test 1025. + +2013-09-23 Werner Koch <wk@gnupg.org> + + pk: Add algo id GCRY_PK_ECC and deprecate ECDSA and ECDH. + + commit d5f91466695c5736f441c9bf1998436184a4bf61 + * src/gcrypt.h.in (GCRY_PK_ECC): New. + * cipher/pubkey.c (map_algo): New. + (spec_from_algo, gcry_pk_get_param, _gcry_pk_selftest): Use it. + * cipher/ecc.c (selftests_ecdsa): Report using GCRY_PK_ECC. + (run_selftests): Simplify. + (ecdh_names, ecdsa_names): Merge into a new ecc_names. + (_gcry_pubkey_spec_ecdh, _gcry_pubkey_spec_ecdsa): Merge into new + _gcry_pubkey_spec_ecc. + + ec: Use mpi_mulm instead of mpi_powm. + + commit 4552437bb3c5ff96a889fd31e4bc504b2a12fac7 + * mpi/ec.c (ec_pow2): New. + (ec_powm): Remove call to mpi_abs. + (dup_point_weierstrass, dup_point_twistededwards) + (add_points_weierstrass, add_points_twistededwards) + (_gcry_mpi_ec_curve_point): Use ec_pow2. + +2013-09-21 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + bufhelp: enable fast unaligned memory accesses on powerpc. + + commit 925d4fb3e8f2df3c5566ec6b5df7620a3d3504e5 + * cipher/bufhelp.h [__powerpc__] (BUFHELP_FAST_UNALIGNED_ACCESS): Set + macro enabled. + [__powerpc64__] (BUFHELP_FAST_UNALIGNED_ACCESS): Ditto. + + Remove i386 inline assembly version of rotation functions. + + commit cfea5c28a3822e1e7e401e5107ebe07ba7fdcf37 + * cipher/bithelp.h (rol, ror): Remove i386 version, change + macros to inline functions. + * src/hmac256.c (ror): Ditto. + + Optimize and cleanup 32-bit and 64-bit endianess transforms. + + commit 9337e03824a5bdd3bbbcb8382cabefe6d6c32e1e + * cipher/bithelp.h (bswap32, bswap64, le_bswap32, be_bswap32) + (le_bswap64, be_bswap64): New. + * cipher/bufhelp.h (buf_get_be32, buf_get_le32, buf_put_le32) + (buf_put_be32, buf_get_be64, buf_get_le64, buf_put_be64) + (buf_put_le64): New. + * cipher/blowfish.c (do_encrypt_block, do_decrypt_block): Use new + endian conversion helpers. + (do_bf_setkey): Turn endian specific code to generic. + * cipher/camellia.c (GETU32, PUTU32): Use new endian conversion + helpers. + * cipher/cast5.c (rol): Remove, use rol from bithelp. + (F1, F2, F3): Fix to use rol from bithelp. + (do_encrypt_block, do_decrypt_block, do_cast_setkey): Use new endian + conversion helpers. + * cipher/des.c (READ_64BIT_DATA, WRITE_64BIT_DATA): Ditto. + * cipher/md4.c (transform, md4_final): Ditto. + * cipher/md5.c (transform, md5_final): Ditto. + * cipher/rmd160.c (transform, rmd160_final): Ditto. + * cipher/salsa20.c (LE_SWAP32, LE_READ_UINT32): Ditto. + * cipher/scrypt.c (READ_UINT64, LE_READ_UINT64, LE_SWAP32): Ditto. + * cipher/seed.c (GETU32, PUTU32): Ditto. + * cipher/serpent.c (byte_swap_32): Remove. + (serpent_key_prepare, serpent_encrypt_internal) + (serpent_decrypt_internal): Use new endian conversion helpers. + * cipher/sha1.c (transform, sha1_final): Ditto. + * cipher/sha256.c (transform, sha256_final): Ditto. + * cipher/sha512.c (__transform, sha512_final): Ditto. + * cipher/stribog.c (transform, stribog_final): Ditto. + * cipher/tiger.c (transform, tiger_final): Ditto. + * cipher/twofish.c (INPACK, OUTUNPACK): Ditto. + * cipher/whirlpool.c (buffer_to_block, block_to_buffer): Ditto. + * configure.ac (gcry_cv_have_builtin_bswap32): Check for compiler + provided __builtin_bswap32. + (gcry_cv_have_builtin_bswap64): Check for compiler provided + __builtin_bswap64. + + gostr3411_94: set better burn stack depth estimate. + + commit 7409de7bc28ff8847c9d71d8c3e35e1968d59d60 + * cipher/gost28147.c (_gcry_gost_enc_one): Account function stack to + burn stack depth. + * cipher/gostr3411-94.c (max): New macro. + (do_hash_step, transform): Return stack burn depth. + + Use hash transform function return type for passing burn stack depth. + + commit 592c2ab3deeeccbb6d3b078ed7bf0e6627c8e1fb + * cipher/gostr4311-94.c (transform): Return stack burn depth. + * cipher/hash-common.c (_gcry_md_block_write): Use stack burn depth + returned by 'hd->bwrite'. + * cipher/hash-common.h (_gcry_md_block_write_t): Change return type to + 'unsigned int'. + (gry_md_block_ctx_t): Remove 'stack_burn'. + * cipher/md4.c (transform): Return stack burn depth. + (md4_final): Use stack burn depth from transform. + * cipher/md5.c (transform): Return stack burn depth. + (md5_final): Use stack burn depth from transform. + * cipher/rmd160.c (transform): Return stack burn depth. + (rmd160_final): Use stack burn depth from transform. + * cipher/sha1.c (transform): Return stack burn depth. + (sha1_final): Use stack burn depth from transform. + * cipher/sha256.c (transform): Return stack burn depth. + (sha256_final): Use stack burn depth from transform. + * cipher/sha512.c (__transform, transform): Return stack burn depth. + (sha512_final): Use stack burn depth from transform. + * cipher/stribog.c (transform64): Return stack burn depth. + * cipher/tiger.c (transform): Return stack burn depth. + (tiger_final): Use stack burn depth from transform. + + Make STRIBOG use the new _gcry_md_block_write helper. + + commit 902ea6052c11108bd19333c31b03e084bed1fb86 + * cipher/stribog.c (STRIBOG_STRUCT): Add 'bctx' and remove 'buf' and + 'count'. + (stribog_init_512): Initialize 'bctx'. + (transform64): New function. + (stribog_write): Remove. + (stribog_final): Use _gcry_md_block_write and bctx. + (_gcry_digest_spec_stribog_256, _gcry_digest_spec_stribog_512): Use + _gcry_md_block_write. + + Make SHA-512 use the new _gcry_md_block_write helper. + + commit cce7449efe471b076c5a97929ac8907162011394 + * cipher/hash-common.c (_gcry_md_block_write): Check that hd->buf is + large enough. + * cipher/hash-common.h (MD_BLOCK_MAX_BLOCKSIZE, MD_NBLOCKS_TYPE): New + macros. + (gcry_md_block_ctx_t): Use above macros for 'nblocks' and 'buf'. + * cipher/sha512.c (SHA512_STATE): New struct. + (SHA512_CONTEXT): Add 'bctx' and 'state'. + (sha512_init, sha384_init): Initialize 'bctx'. + (__transform, _gcry_sha512_transform_armv7_neon): Use SHA512_STATE for + 'hd'. + (transform): For now, do not return burn stack. + (sha512_write): Remove. + (sha512_final): Use _gcry_md_block_write and bctx. + (_gcry_digest_spec_sha512, _gcry_digest_spec_sha384): Use + _gcry_md_block_write. + +2013-09-20 Werner Koch <wk@gnupg.org> + + sexp: Change internal versions to always use gpg_err_code_t. + + commit 3e5cfa20acfeccb9df2c3fae2730344b40b36104 + * src/sexp.c (gcry_sexp_new, gcry_sexp_create, gcry_sexp_build) + (gcry_sexp_build_array, gcry_sexp_canon_len): Change error return type + from gpg_error_t to gpg_err_code_t. Remove all calls to gpg_error. + * src/visibility.c (gcry_sexp_new, gcry_sexp_create, gcry_sexp_sscan) + (gcry_sexp_build, gcry_sexp_build_array, gcry_sexp_canon_len): Map + error codes via gpg_error. + * cipher/dsa.c, cipher/ecc.c, cipher/elgamal.c, cipher/rsa.c: Remove + use gpg_err_code wrappers. + + pk: Move s-exp creation for gcry_pk_decrypt to the modules. + + commit 722bfc1e5f2268453db62f38cc46b5ec6ef3adee + * cipher/pubkey.c (sexp_to_enc): Remove RET_MODERN arg and merge it + into FLAGS. + (gcry_pk_decrypt): Move result s-exp building into the modules. + * src/cipher-proto.h (gcry_pk_decrypt_t): Add some args. + * cipher/ecc.c (ecc_decrypt_raw): Change to return an s-exp. + * cipher/elgamal.c (elg_decrypt): Ditto. + * cipher/rsa.c (rsa_decrypt): Ditto. + (rsa_blind, rsa_unblind): Merge into rsa_decrypt. This saves several + extra MPI allocations. + + pk: Remove unused function. + + commit 64cd7ab93da7c95cc8aa320c61c6e29f9e2399c4 + * cipher/pubkey.c (_gcry_pk_aliased_algo_name): Remove + +2013-09-19 Werner Koch <wk@gnupg.org> + + Beautify debug output of the prime generator. + + commit 6576f0a7684292cb5691bfcabad0acca4c06c014 + * cipher/primegen.c: Adjust output of log_mpidump to recently changed + log_mpidump code changes. + + pk: Move s-expr creation for genkey to the modules. + + commit 1bf08850bf9343146c938bc03917417e16393e9a + * cipher/pubkey.c (pubkey_generate): Fold into gcry_pk_genkey + (gcry_pk_genkey): Move result s-exp creation into the modules. + * cipher/dsa.c (dsa_generate): Create result as s-exp. + * cipher/elgamal.c (elg_generate): Ditto. + * cipher/rsa.c (rsa_generate): Ditto. + * cipher/ecc.c (ecc_generate): Ditto. + * src/cipher-proto.h (pk_ext_generate_t): Remove type + (gcry_pk_spec): and remove from struct. + + tests: Beautify some diagnostics. + + commit 2fe084873333c4d67bcfba0b527d63cd3cff6c47 + * tests/benchmark.c (ecc_bench): Print the key sexp in very verbose + mode. + (main): Add option --pk-count. + * tests/keygen.c: Add Elgamal generation and improved diagnostics. + * tests/t-ed25519.c (check_ed25519): Print running number of tests + done. + + sexp: Improve printing data representing a negative number. + + commit b3f3d47d347c14ed41d755cee580f000309b9c03 + * src/sexp.c (suitable_encoding): Detect a negative number. + + pk: Move RSA encoding functions to a new file. + + commit 071f70b9a766187fc70f6abc6a69d50752449285 + * cipher/rsa-common: New. + * cipher/pubkey.c (pkcs1_encode_for_encryption): Move to rsa-common.c + and rename to _gcry_rsa_pkcs1_encode_for_enc. + (pkcs1_decode_for_encryption): Move to rsa-common.c and rename to + _gcry_rsa_pkcs1_decode_for_enc. + (pkcs1_encode_for_signature): Move to rsa-common.c and rename to + _gcry_rsa_pkcs1_encode_for_sig. + (oaep_encode): Move to rsa-common.c and rename to + _gcry_rsa_oaep_encode. + (oaep_decode): Move to rsa-common.c and rename to + _gcry_rsa_oaep_decode. + (pss_encode): Move to rsa-common.c and rename to _gcry_rsa_pss_encode. + (pss_verify): Move to rsa-common.c and rename to _gcry_rsa_pss_decode. + (octet_string_from_mpi, mgf1): Move to rsa-common.c. + + pk: Move s-expr creation for sign and encrypt to the modules. + + commit eca9e2e50ddd4c9020fe1d4a9a3c77d20ebb90f6 + * cipher/pubkey.c (pubkey_encrypt): Fold into gcry_pk_encrypt. + (pubkey_decrypt): Fold into gcry_pk_decrypt. + (pubkey_sign): Fold into gcry_pk_sign. + (pubkey_verify): Fold into gcry_pk_verify. + (octet_string_from_mpi): Make it a wrapper and factor code out to ... + * mpi/mpicoder.c (_gcry_mpi_to_octet_string): New function. + + * src/cipher.h (PUBKEY_FLAG_FIXEDLEN): New. + * cipher/pubkey.c (sexp_data_to_mpi): Set flag for some encodings. + (gcry_pk_encrypt): Simply by moving the s-expr generation to the modules. + (gcry_pk_sign): Ditto. + * cipher/dsa.c (dsa_sign): Create s-expr. + * cipher/elgamal.c (elg_encrypt, elg_sign): Ditto. + * cipher/rsa.c (rsa_encrypt, rsa_sign): Ditto. + * cipher/ecc.c (ecc_sign, ecc_encrypt_raw): Ditto. + (ecdsa_names): Add "eddsa". + * tests/t-ed25519.c (one_test): Expect "eddsa" token. + +2013-09-19 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Fix Stribog digest on bigendian platforms. + + commit d399faf5db71d429bfd6fa4a9cfc82e2a55055f0 + * cipher/stribog.c (stribog_final): swap bytes in the result of digest + calculations. + +2013-09-18 Werner Koch <wk@gnupg.org> + + pk: Simplify the public key dispatcher pubkey.c. + + commit 85722afb379f7a392a8117b895de273fd88c4ebc + * src/cipher-proto.h (gcry_pk_spec_t): Add fields ALGO and FLAGS. + * cipher/dsa.c (_gcry_pubkey_spec_dsa): Set these fields. + * cipher/ecc.c (_gcry_pubkey_spec_ecdsa): Ditto. + (_gcry_pubkey_spec_ecdh): Ditto. + * cipher/rsa.c (_gcry_pubkey_spec_rsa): Ditto. + * cipher/elgamal.c (_gcry_pubkey_spec_elg): Ditto + (_gcry_pubkey_spec_elg_e): New. + * cipher/pubkey.c: Change most code to replace the former module + system by a simpler system to gain information about the algorithms. + (disable_pubkey_algo): SImplified. Not anymore thread-safe, though. + + pk: Merge extraspecs struct with standard specs struct. + + commit 89103ce00e862cc709e80fa41f2ee13d54093ec5 + * src/gcrypt-module.h (gcry_pk_spec_t): Move this typedef and the + corresponding function typedefs to ... + * src/cipher-proto.h: here. + (pk_extra_spec_t): Remove typedef and merge fields into + gcry_pk_spec_t. + * cipher/rsa.c, cipher/dsa.c, cipher/elg.c, cipher/ecc.c: Ditto. + * cipher/pubkey.c: Change accordingly. + * src/cipher.h (_gcry_pubkey_extraspec_rsa): Remove. + (_gcry_pubkey_extraspec_dsa): Remove. + (_gcry_pubkey_extraspec_elg): Remove. + (_gcry_pubkey_extraspec_ecdsa): Remove. + +2013-09-18 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix encryption/decryption return type for GOST28147. + + commit 2ad7ea9cb388fd31e4b0852b68d77f599ef4adce + * cipher/gost.h (_gcry_gost_enc_one): Change return type to + 'unsigned int'. + * cipher/gost28147.c (max): New macro. + (gost_encrypt_block, gost_decrypt_block): Return burn stack depth. + (_gcry_gost_enc_one): Return burn stack depth from gost_encrypt_block. + +2013-09-18 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + doc: fix building of ps and pdf documentation. + + commit bd33fa21c9afc6c81e0da24016fc13001e9c7390 + * doc/gcrypt.texi, doc/gpl.texi, doc/lgpl.texi: fix texinfo errors. + + Add GOST R 34.11-2012 implementation (Stribog) + + commit c22064bdd773a807801e300aa9214b2fdcafcf20 + * src/gcrypt.h.in (GCRY_MD_GOSTR3411_12_256) + (GCRY_MD_GOSTR3411_12_512): New. + * cipher/stribog.c: New. + * configure.ac (available_digests_64): Add stribog. + * src/cipher.h: Declare Stribog declarations. + * cipher/md.c: Register Stribog digest. + * tests/basic.c (check_digests) Add 4 testcases for Stribog from + standard. + * doc/gcrypt.texi: Document new constants. + + Add basic implementation of GOST R 34.11-94 message digest. + + commit b0579baaa04fb91eabbbdc295bcabea04cf84056 + * src/gcrypt.h.in (GCRY_MD_GOSTR3411_94): New. + * cipher/gostr3411-94.c: New. + * configure.ac (available_digests): Add gostr3411-94. + * src/cipher.h: Add gostr3411-94 definitions. + * cipher/md.c: Register GOST R 34.11-94. + * tests/basic.c (check_digests): Add 4 tests for GOST R 34.11-94 + hash algo. Two are defined in the standard itself, two other are + more or less common tests - an empty string an exclamation mark. + * doc/gcrypt.texi: Add an entry describing GOST R 34.11-94 to the MD + algorithms table. + + Separate common md block code. + + commit ecde77ad98690540abb21db08e5531297ed72bd0 + * cipher/hash-common.c (_gcry_md_block_write): New function to handle + block md operations. The current implementation is limited to 64 byte + buffer and u32 block counter. + + * cipher/md4.c, cipher/md5.c, cipher/rmd.h, cipher/rmd160.c + *cipher/sha1.c, cipher/sha256.c, cipher/tiger.c: Convert to use + _gcry_md_block_write. + + Add limited implementation of GOST 28147-89 cipher. + + commit 56b5949f71f501744998f5ebc12488ebf6f1c0b5 + * src/gcrypt.h.in (GCRY_CIPHER_GOST28147): New. + * cipher/gost.h, cipher/gost28147.c: New. + * configure.ac (available_ciphers): Add gost28147. + * src/cipher.h: Add gost28147 definitions. + * cipher/cipher.c: Register gost28147. + * tests/basic.c (check_ciphers): Enable simple test for gost28147. + * doc/gcrypt.texi: document GCRY_CIPHER_GOST28147. + +2013-09-18 Werner Koch <wk@gnupg.org> + + ecc: Add Ed25519 key generation and prepare for optimizations. + + commit 63cd3474425cb5a7ec4d1a56be15b248ecda4680 + * src/mpi.h (enum ecc_dialects): New. + * src/ec-context.h (mpi_ec_ctx_s): Add field DIALECT. + * cipher/ecc-common.h (elliptic_curve_t): Ditto. + * cipher/ecc-curves.c (ecc_domain_parms_t): Ditto. + (domain_parms): Add dialect values. + (_gcry_ecc_fill_in_curve): Set dialect. + (_gcry_ecc_get_curve): Ditto. + (_gcry_mpi_ec_new): Ditto. + (_gcry_ecc_get_param): Use ECC_DIALECT_STANDARD for now. + * cipher/ecc-misc.c (_gcry_ecc_curve_copy): Copy dialect. + (_gcry_ecc_dialect2str): New. + * mpi/ec.c (ec_p_init): Add arg DIALECT. + (_gcry_mpi_ec_p_internal_new): Ditto. + (_gcry_mpi_ec_p_new): Ditto. + + * mpi/mpiutil.c (gcry_mpi_set_opaque): Set the secure flag. + (_gcry_mpi_set_opaque_copy): New. + + * cipher/ecc-misc.c (_gcry_ecc_os2ec): Take care of an opaque MPI. + * cipher/ecc.c (eddsa_generate_key): New. + (generate_key): Rename to nist_generate_key and factor some code out + to ... + (ecc_generate_ext): here. Divert to eddsa_generate_key if desired. + (eddsa_decodepoint): Take care of an opaque MPI. + (ecc_check_secret_key): Ditto. + (ecc_sign): Ditto. + * cipher/pubkey.c (sexp_elements_extract_ecc): Store public and secret + key as opaque MPIs. + (gcry_pk_genkey): Add the curve_name also to the private key part of + the result. + + * tests/benchmark.c (ecc_bench): Support Ed25519. + (main): Add option --debug. + * tests/curves.c (sample_key_2): Make sure that P and N are positive. + * tests/keygen.c (show): New. + (check_ecc_keys): Support Ed25519. + +2013-09-17 Werner Koch <wk@gnupg.org> + + mpi: Support printing of negative numbers. + + commit 89fe2173649a72019d75e059e6c6938efd10421f + * mpi/mpicoder.c (twocompl, onecompl): New. + (gcry_mpi_print): Use it for STD and SSH. + (gcry_mpi_scan): Use it for STD and SSH. Always set NSCANNED. + (gcry_mpi_aprint): Clear the extra allocated byte. + * tests/t-convert.c (showhex, showmpi): New. + (mpi2bitstr_nlz): New. + (check_formats): New. + (main): Call new test. + +2013-09-16 Werner Koch <wk@gnupg.org> + + Fix bug in _gcry_mpi_tdiv_q_2exp. + + commit a7a9cdcaaf3979baa18dad51e722882581349f45 + * mpi/mpi-internal.h (MPN_COPY_INCR): Make it work. + + ecc: Implement Curve Ed25519 signing and verification. + + commit bc5199a02abe428ad377443280b3eda60141a1d6 + * cipher/ecc-curves.c (domain_parms): Add curve "Ed25519". + * cipher/ecc.c (reverse_buffer): New. + (eddsa_encodempi): New. + (eddsa_encodepoint): New. + (eddsa_decodepoint): New. + (sign_eddsa): Implement. + (verify_eddsa): Implement. + (ecc_sign): Init unused Q. Pass public key to sign_eddsa. + (ecc_verify): Init pk.Q if not used. Pass public key verbatim to + verify_eddsa. + * cipher/pubkey.c (sexp_elements_extract): Add arg OPAQUE. Change all + callers to pass 0. + (sexp_to_sig): Add arg OPAQUE and pass it to sexp_elements_extract. + (sexp_data_to_mpi): Allow for a zero length "value". + (gcry_pk_verify): Reorder parameter processing. Pass OPAQUE flag as + required. + * mpi/ec.c (ec_invm): Print a warning if the inverse does not exist. + (_gcry_mpi_ec_get_affine): Implement for our Twisted Edwards curve + model. + (dup_point_twistededwards): Implement. + (add_points_twistededwards): Implement. + (_gcry_mpi_ec_mul_point): Support Twisted Edwards. + + * mpi/mpicoder.c (do_get_buffer): Add arg FILL_LE. + (_gcry_mpi_get_buffer): Ditto. Change all callers. + (_gcry_mpi_get_secure_buffer): Ditto. + + * src/sexp.c (_gcry_sexp_nth_opaque_mpi): New. + + * tests/t-ed25519.c: New. + * tests/t-ed25519.inp: New. + * tests/t-mpi-point.c (basic_ec_math_simplified): Print some output + only in debug mode. + (twistededwards_math): New test. + (main): Call new test. + + mpi: Add internal convenience function. + + commit 44a2c34e90ed7de149952398787906d8823b636b + * mpi/mpiutil.c (_gcry_mpi_get_opaque_copy): New. + + mpi: Add debug function to print a point. + + commit 8ebc94d11a1eb93f2365c93f555e958700fdfbd4 + * mpi/ec.c (_gcry_mpi_point_log): New. + * src/mpi.h (log_printpnt): new macro. + + tests: Factor time measurement code out. + + commit 58eaf0c4332ac2f645ede28c4d18337389dfa753 + * tests/benchmark.c (started_at, stopped_at, start_timer, stop_timer) + (elapsed time): Factor out to .. + * tests/stopwatch.h: new file. + +2013-09-12 Werner Koch <wk@gnupg.org> + + Fix _gcry_log_printmpi to print 00 instead of a sole sign. + + commit 1c76349c69c70a62b516a4f837c6287def640807 + * src/misc.c: Special case an mpi length of 0. + +2013-09-11 Werner Koch <wk@gnupg.org> + + Streamline the use of the internal mpi and hex debug functions. + + commit e35ed615acc624a8b6c07576ea0650aac2bdb0db + * mpi/mpicoder.c (gcry_mpi_dump): Remove. + (_gcry_log_mpidump): Remove. + * src/misc.c (_gcry_log_printhex): Factor all code out to ... + (do_printhex): new. Add line wrapping a and compact printing. + (_gcry_log_printmpi): New. + * src/mpi.h (log_mpidump): Remove macro. + * src/g10lib.h (log_mpidump): Add compatibility macro. + (log_printmpi): New macro + * src/visibility.c (gcry_mpi_dump): Call _gcry_log_printmpi. + * cipher/primegen.c (prime_generate_internal): Replace gcry_mpi_dump + by log_printmpi. + (gcry_prime_group_generator): Ditto. + * cipher/pubkey.c: Remove extra colons from log_mpidump call. + * cipher/rsa.c (stronger_key_check): Use log_printmpi. + +2013-09-10 Werner Koch <wk@gnupg.org> + + md: Add function gcry_md_hash_buffers. + + commit f3bca0c77c4979504f95fdbc618f7458e61e3e45 + * src/gcrypt.h.in (gcry_buffer_t): new. + (gcry_md_hash_buffers): New. + * src/visibility.c, src/visibility.h: Add wrapper for new function. + * src/libgcrypt.def, src/libgcrypt.vers: Export new function. + * cipher/md.c (gcry_md_hash_buffers): New. + * cipher/sha1.c (_gcry_sha1_hash_buffers): New. + * tests/basic.c (check_one_md_multi): New. + (check_digests): Run that test. + * tests/hmac.c (check_hmac_multi): New. + (main): Run that test. + + md: Fix Whirlpool flaw. + + commit 0a28b2d2c9181a536fc894e24626714832619923 + * cipher/whirlpool.c (whirlpool_add): Remove shortcut return so that + byte counter is always properly updated. + +2013-09-07 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix static build on AMD64. + + commit 90fdf25f0dcc5feac7195ede55bd15948a11363e + * cipher/rijndael-amd64.S: Correct 'RIP' macro for non-PIC build. + + scrypt: fix for big-endian systems. + + commit 38a038a135d82231eff9d84f1ae3c4a25c6a5e75 + * cipher/scrypt.c (_salsa20_core): Fix endianess issues. + +2013-09-07 Werner Koch <wk@gnupg.org> + + Use gcc "unused" attribute only with gcc >= 3.5. + + commit f7135e299e659d78906aac3dfdf30f380b5cf9c6 + * src/g10lib.h (GCC_ATTR_UNUSED): Fix gcc version detection. + +2013-09-07 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Add support for Salsa20/12 - 12 round version of Salsa20. + + commit ae6f6c47d2e0c536f3eab0823b5f23d26956cda2 + * src/gcrypt.h.in (GCRY_CIPHER_SALSA20R12): New. + * src/salsa20.c (salsa20_core, salsa20_do_encrypt_stream): Add support + for reduced round versions. + (salsa20r12_encrypt_stream, _gcry_cipher_spec_salsa20r12): Implement + Salsa20/12 - a 12 round version of Salsa20 selected by eStream. + * src/cipher.h: Declsare Salsa20/12 definition. + * cipher/cipher.c: Register Salsa20/12 + * tests/basic.c: (check_stream_cipher, check_stream_cipher_large_block): + Populate Salsa20/12 tests with test vectors from ecrypt + (check_ciphers): Add simple test for Salsa20/12 + +2013-09-07 Werner Koch <wk@gnupg.org> + + Add configure option --disable-amd64-as-feature-detection. + + commit 49d5b9dcd622cdc87fb02a211bd51e3d46345bf2 + * configure.ac: Implement new disable flag. + + mpi: Improve support for non-Weierstrass support. + + commit 4d8c8c7aa88cddb1624301957e6245405f46d027 + * mpi/ec.c (ec_p_init): Add args MODEL and P. Change all callers. + (_gcry_mpi_ec_p_internal_new): Ditto. + (_gcry_mpi_ec_p_new): Ditto. + * cipher/ecc-curves.c (_gcry_ecc_fill_in_curve): Return + GPG_ERR_UNKNOWN_CURVE instead of invalid value. Init curve model. + * cipher/ecc.c (ecc_verify, ecc_encrypt_raw): Ditto. + * cipher/pubkey.c (sexp_data_to_mpi): Fix EDDSA flag error checking. + + mpi: Add gcry_mpi_ec_curve_point. + + commit ddfefe429660cc5d798f3517208936449247ae5c + * mpi/ec.c (_gcry_mpi_ec_curve_point): New. + (ec_powm): Return the absolute value. + * src/visibility.c, src/visibility.c: Add wrappers. + * src/libgcrypt.def, src/libgcrypt.vers: Export them. + + mpi: Add functions to manipulate the sign. + + commit 1bd2c67aa55b40589654d3fa5dea05cf1ed7dc5f + * src/gcrypt.h.in (gcry_mpi_is_neg): New. + (gcry_mpi_neg, gcry_mpi_abs): New. + * mpi/mpiutil.c (_gcry_mpi_is_neg): New. + (_gcry_mpi_neg, _gcry_mpi_abs): New. + * src/visibility.c, src/visibility.h: Add wrappers. + * src/libgcrypt.def, src/libgcrypt.vers: Export them. + * src/mpi.h (mpi_is_neg): New. Rename old macro to mpi_has_sign. + * mpi/mpi-mod.c (_gcry_mpi_mod_barrett): Use mpi_has_sign. + * mpi/mpi-mpow.c (calc_barrett): Ditto. + * cipher/primegen.c (_gcry_derive_x931_prime): Ditto + * cipher/rsa.c (secret): Ditto. + +2013-09-06 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Tune armv6 mpi assembly. + + commit 4e4440153258e2f0dfdcaa8443820af06984ecb1 + * mpi/armv6/mpih-mul1.S: Tune assembly for Cortex-A8. + * mpi/armv6/mpih-mul2.S: Ditto. + * mpi/armv6/mpih-mul3.S: Ditto. + +2013-09-05 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Change _gcry_burn_stack take burn depth as unsigned integer. + + commit e0ae31fcce3bd57b24751ff3c82cba820e493c3a + * src/misc.c (_gcry_burn_stack): Change to handle 'unsigned int' bytes. + + mpicalc: fix building on linux and win32. + + commit 50ec983666f0ca9d50c84aa1afad0d7bd5810779 + * src/Makefile.am (mpicalc): Adjust CFLAGS and LDADD. + +2013-09-04 Werner Koch <wk@gnupg.org> + + Change mpicalc to use Libgcrypt and install it. + + commit 1d23040b659661b4086c079cb9fd5f37189a7020 + * src/mpicalc.c: Make use of gcry_ functions. + (MPICALC_VERSION): New. Set to 2.0. + (strusage): Remove. + (scan_mpi): New. Replaces mpi_fromstr. + (print_mpi): New. Replaces mpi_print. + (my_getc): New. + (print_help): New. + (main): Use simple option parser and print version info. + * src/Makefile.am (bin_PROGRAMS): Add mpicalc. + (mpicalc_SOURCES, mpicalc_CFLAGS, mpicalc_LDADD): New. + + Add mpicalc.c to help with testing. + + commit a70c46e29c480fa0f56ab4814666a5b115f84fd7 + * src/mpicalc.c: Take from GnuPG 1.4 + + Prepare support for EdDSA. + + commit c47d4001033f68212d2847b3074a0bdda990342e + * src/cipher.h (PUBKEY_FLAG_EDDSA): New. + * cipher/pubkey.c (pubkey_verify): Repalce args CMP and OPAQUEV by + CTX. Pass flags and hash algo to the verify function. Change all + verify functions to accept these args. + (sexp_data_to_mpi): Implement new flag "eddsa". + (gcry_pk_verify): Pass CTX instead of the compare function to + pubkey_verify. + * cipher/ecc.c (sign): Rename to sign_ecdsa. Change all callers. + (verify): Rename to verify_ecdsa. Change all callers. + (sign_eddsa, verify_eddsa): New stub functions. + (ecc_sign): Divert to sign_ecdsa or sign_eddsa. + (ecc_verify): Divert to verify_ecdsa or verify_eddsa. + + Prepare support for non-Weierstrass EC equations. + + commit c26be7a337d0bf98193bc58e043209e46d0769bb + * src/mpi.h (gcry_mpi_ec_models): New. + * src/ec-context.h (mpi_ec_ctx_s): Add MODEL. + * cipher/ecc-common.h (elliptic_curve_t): Ditto. + * cipher/ecc-curves.c (ecc_domain_parms_t): Ditto. + (domain_parms): Mark als as Weierstrass. + (_gcry_ecc_fill_in_curve): Check model. + (_gcry_ecc_get_curve): Set model to Weierstrass. + * cipher/ecc-misc.c (_gcry_ecc_model2str): New. + * cipher/ecc.c (generate_key, ecc_generate_ext): Print model in the + debug output. + + * mpi/ec.c (_gcry_mpi_ec_dup_point): Switch depending on model. + Factor code out to ... + (dup_point_weierstrass): new. + (dup_point_montgomery, dup_point_twistededwards): New stub functions. + (_gcry_mpi_ec_add_points): Switch depending on model. Factor code out + to ... + (add_points_weierstrass): new. + (add_points_montgomery, add_points_twistededwards): New stub + functions. + + * tests/Makefile.am (TESTS): Reorder tests. + + mpi: Suppress newer gcc warnings. + + commit 8698530b2f9ef95542f1dd550961de7af86cc256 + * src/g10lib.h (GCC_ATTR_UNUSED): Define for gcc >= 3.5. + * mpi/mpih-div.c (_gcry_mpih_mod_1, _gcry_mpih_divmod_1): Mark dummy + as unused. + * mpi/mpi-internal.h (UDIV_QRNND_PREINV): Mark _ql as unused. + + Do not check with cpp for typedefed constants. + + commit b28b1f732e1b4f9c62a9de87c22c6bb0d3f8fdb8 + * src/gcrypt-int.h: Include error code replacements depeding on the + version of libgpg-error. + +2013-09-04 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Make _gcry_burn_stack use variable length array. + + commit 4b0edf53440239d3bcc95941980c062a0801a149 + * configure.ac (HAVE_VLA): Add check. + * src/misc.c (_gcry_burn_stack) [HAVE_VLA]: Add VLA code. + + Move stack burning from block ciphers to cipher modes. + + commit a3aaa6ad03388ea3eaa24304b604cb864633332f + * src/gcrypt-module.h (gcry_cipher_encrypt_t) + (gcry_cipher_decrypt_t): Return 'unsigned int'. + * cipher/cipher.c (dummy_encrypt_block, dummy_decrypt_block): Return + zero. + (do_ecb_encrypt, do_ecb_decrypt): Get largest stack burn depth from + block cipher crypt function and burn stack at end. + * cipher/cipher-aeswrap.c (_gcry_cipher_aeswrap_encrypt) + (_gcry_cipher_aeswrap_decrypt): Ditto. + * cipher/cipher-cbc.c (_gcry_cipher_cbc_encrypt) + (_gcry_cipher_cbc_decrypt): Ditto. + * cipher/cipher-cfb.c (_gcry_cipher_cfb_encrypt) + (_gcry_cipher_cfb_decrypt): Ditto. + * cipher/cipher-ctr.c (_gcry_cipher_cbc_encrypt): Ditto. + * cipher/cipher-ofb.c (_gcry_cipher_ofb_encrypt) + (_gcry_cipher_ofb_decrypt): Ditto. + * cipher/blowfish.c (encrypt_block, decrypt_block): Return burn stack + depth. + * cipher/camellia-glue.c (camellia_encrypt, camellia_decrypt): Ditto. + * cipher/cast5.c (encrypt_block, decrypt_block): Ditto. + * cipher/des.c (do_tripledes_encrypt, do_tripledes_decrypt) + (do_des_encrypt, do_des_decrypt): Ditto. + * cipher/idea.c (idea_encrypt, idea_decrypt): Ditto. + * cipher/rijndael.c (rijndael_encrypt, rijndael_decrypt): Ditto. + * cipher/seed.c (seed_encrypt, seed_decrypt): Ditto. + * cipher/serpent.c (serpent_encrypt, serpent_decrypt): Ditto. + * cipher/twofish.c (twofish_encrypt, twofish_decrypt): Ditto. + * cipher/rfc2268.c (encrypt_block, decrypt_block): New. + (_gcry_cipher_spec_rfc2268_40): Use encrypt_block and decrypt_block. + +2013-09-01 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + camellia-aesni-avx2-amd64: Move register clearing to assembly functions. + + commit f3515240de9513ead975985c9f8ab714022cac8e + * cipher/camellia-aesni-avx2-amd64.S + (_gcry_camellia_aesni_avx2_ctr_enc): Add 'vzeroall'. + (_gcry_camellia_aesni_avx2_cbc_dec) + (_gcry_camellia_aesni_avx2_cfb_dec): Add 'vzeroupper' at head and + 'vzeroall' at tail. + * cipher/camellia-glue.c (_gcry_serpent_ctr_enc, _gcry_serpent_cbc_dec) + (_gcry_serpent_avx2_cfb_dec) [USE_AESNI_AVX2]: Remove register + clearing. + + camellia-aesni-avx-amd64: Move register clearing to assembly functions. + + commit 8b735cb563dff7aafbf8a970972522b5621e665c + * cipher/camellia-aesni-avx-amd64.S (_gcry_camellia_aesni_avx_ctr_enc) + (_gcry_camellia_aesni_avx_cbc_dec) + (_gcry_camellia_aesni_avx_cfb_dec): Add 'vzeroupper' at head and + 'vzeroall' at tail. + * cipher/camellia-glue.c (_gcry_serpent_ctr_enc, _gcry_serpent_cbc_dec) + (_gcry_serpent_avx2_cfb_dec) [USE_AESNI_AVX]: Remove register clearing. + + serpent-avx2-amd64: Move register clearing to assembly. + + commit d12828cd821a4b4428eae19de5aee02cf536e536 + * cipher/serpent-avx2-amd64.S (_gcry_serpent_avx2_ctr_enc) + (_gcry_serpent_avx2_cbc_dec, _gcry_serpent_avx2_cfb_dec): Change last + 'vzeroupper' to 'vzeroall'. + * cipher/serpent.c (_gcry_serpent_ctr_enc, _gcry_serpent_cbc_dec) + (_gcry_serpent_avx2_cfb_dec) [USE_AVX2]: Remove register clearing with + 'vzeroall'. + + Fix building for x32 target. + + commit fd6721c235a5bdcb332c8eb708fbd4f96e52e824 + * mpi/amd64/mpi-asm-defs.h: New file. + * random/rndhw.c (poll_padlock) [__x86_64__]: Also check if __LP64__ is + defined. + [USE_DRNG, __x86_64__]: Also check if __LP64__ is defined. + +2013-08-31 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + sha512: add ARM/NEON assembly version of transform function. + + commit 99d15543b8d94a8f1ef66c6ccb862b0ce82c514d + * cipher/Makefile.am: Add 'sha512-armv7-neon.S'. + * cipher/sha512-armv7-neon.S: New file. + * cipher/sha512.c (USE_ARM_NEON_ASM): New macro. + (SHA512_CONTEXT) [USE_ARM_NEON_ASM]: Add 'use_neon'. + (sha512_init, sha384_init) [USE_ARM_NEON_ASM]: Enable 'use_neon' if + CPU support NEON instructions. + (k): Round constant array moved outside of 'transform' function. + (__transform): Renamed from 'tranform' function. + [USE_ARM_NEON_ASM] (_gcry_sha512_transform_armv7_neon): New prototype. + (transform): New wrapper function for different transform versions. + (sha512_write, sha512_final): Burn stack by the amount returned by + transform function. + * configure.ac (sha512) [neonsupport]: Add 'sha512-armv7-neon.lo'. + + sha512: reduce stack use in transform function by 512 bytes. + + commit 03da7f8ba3ec24d4639a2bcebbc0d9d831734c08 + * cipher/sha512.c (transform): Change 'u64 w[80]' to 'u64 w[16]' and + inline input expansion to first 64 rounds. + (sha512_write, sha512_final): Reduce burn_stack depth by 512 bytes. + + Add ARM HW feature detection module and add NEON detection. + + commit 9c95be105f518d18407115c2c06893857c24b116 + * configure.ac: Add option --disable-neon-support. + (HAVE_GCC_INLINE_ASM_NEON): New. + (ENABLE_NEON_SUPPORT): New. + [arm]: Add 'hwf-arm.lo' as HW feature module. + * src/Makefile.am: Add 'hwf-arm.c'. + * src/g10lib.h (HWF_ARM_NEON): New macro. + * src/global.c (hwflist): Add HWF_ARM_NEON entry. + * src/hwf-arm.c: New file. + * src/hwf-common.h (_gcry_hwf_detect_arm): New prototype. + * src/hwfeatures.c (_gcry_detect_hw_features) [HAVE_CPU_ARCH_ARM]: Add + call to _gcry_hwf_detect_arm. + + Correct mpi_cpu_arch for ARMv6. + + commit 7b0ebe69fe35f2ee13e1e1beb2766a1eaadb7f0c + * mpi/config.links [armv6]: Set mpi_cpu_arch to "arm", instead of + "armv6". + +2013-08-30 Werner Koch <wk@gnupg.org> + + mpi: Make gcry_mpi_print work with negative zeroes. + + commit e9b711e6ddb480a71d2996465074e436c752c005 + * mpi/mpicoder.c (gcry_mpi_print): Take care of negative zero. + (gcry_mpi_aprint): Allocate at least 1 byte. + * tests/t-convert.c: New. + * tests/Makefile.am (TESTS): Add t-convert. + + Refactor the ECC code into 3 files. + + commit 800d4e01376d52a94a157b53978c7c3f957fc476 + * cipher/ecc-common.h, cipher/ecc-curves.c, cipher/ecc-misc.c: New. + * cipher/Makefile.am (EXTRA_libcipher_la_SOURCES): Add new files. + * configure.ac (GCRYPT_PUBKEY_CIPHERS): Add new .c files. + * cipher/ecc.c (curve_aliases, ecc_domain_parms_t, domain_parms) + (scanval): Move to ecc-curves.c. + (fill_in_curve): Move to ecc-curve.c as _gcry_ecc_fill_in_curve. + (ecc_get_curve): Move to ecc-curve.c as _gcry_ecc_get_curve. + (_gcry_mpi_ec_ec2os): Move to ecc-misc.c. + (ec2os): Move to ecc-misc.c as _gcry_ecc_ec2os. + (os2ec): Move to ecc-misc.c as _gcry_ecc_os2ec. + (point_set): Move as inline function to ecc-common.h. + (_gcry_ecc_curve_free): Move to ecc-misc.c as _gcry_ecc_curve_free. + (_gcry_ecc_curve_copy): Move to ecc-misc.c as _gcry_ecc_curve_copy. + (mpi_from_keyparam, point_from_keyparam): Move to ecc-curves.c. + (_gcry_mpi_ec_new): Move to ecc-curves.c. + (ecc_get_param): Move to ecc-curves.c as _gcry_ecc_get_param. + (ecc_get_param_sexp): Move to ecc-curves.c as _gcry_ecc_get_param_sexp. + +2013-08-22 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + serpent-sse2-amd64: Move register clearing to assembly functions. + + commit 040aa7688296e93659cb32ca31e9a001a6ab1edd + cipher/serpent-sse2-amd64.S (_gcry_serpent_sse2_ctr_enc) + (_gcry_serpent_sse2_cbc_dec, _gcry_serpent_sse2_cfb_dec): Clear used + XMM registers. + cipher/serpent.c (_gcry_serpent_ctr_enc, _gcry_serpent_cbc_dec) + ( _gcry_serpent_cfb_dec) [USE_SSE2]: Remove XMM register clearing from + bulk functions. + + twofish-amd64: do not make __twofish_dec_blk3 global. + + commit 82db04a6a0058cf870485459abe7c1659b138ec5 + * cipher/twofish-amd64.S (__twofish_dec_blk3): Do not export symbol as + global. + (__twofish_dec_blk3): Mark symbol as function. + +2013-08-20 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + mpi: add ARMv6 assembly. + + commit da327aef3fe24fdf98fffbc8aea69de42ed12456 + * mpi/armv6/mpi-asm-defs.h: New. + * mpi/armv6/mpih-add1.S: New. + * mpi/armv6/mpih-mul1.S: New. + * mpi/armv6/mpih-mul2.S: New. + * mpi/armv6/mpih-mul3.S: New. + * mpi/armv6/mpih-sub1.S: New. + * mpi/config.links [arm]: Enable ARMv6 assembly. + + Move ARMv6 detection to configure.ac. + + commit 151f1e518be2d16bed748ba832384b0472ddcf9b + * cipher/blowfish-armv6.S: Replace __ARM_ARCH >= 6 checks with + HAVE_ARM_ARCH_V6. + * cipher/blowfish.c: Ditto. + * cipher/camellia-armv6.S: Ditto. + * cipher/camellia.h: Ditto. + * cipher/cast5-armv6.S: Ditto. + * cipher/cast5.c: Ditto. + * cipher/rijndael-armv6.S: Ditto. + * cipher/rijndael.c: Ditto. + * configure.ac: Add HAVE_ARM_ARCH_V6 check. + +2013-08-19 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add optimized wipememory for ARM. + + commit c030e33533fb819afe195eff5f89ec39863b1fbc + src/g10lib.h [__arm__] (fast_wipememory2_unaligned_head) + (fast_wipememory2): New macros. + + cipher: bufhelp: allow unaligned memory accesses on ARM. + + commit 796dda37b957b20dba391343937c6325a8c8b288 + * cipher/bufhelp.h [__arm__ && __ARM_FEATURE_UNALIGNED]: Enable + BUFHELP_FAST_UNALIGNED_ACCESS. + +2013-08-17 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Remove burn_stack optimization. + + commit 79895b9459b9bf8c60cb7abf09d5bf16ed0cf6e3 + * src/misc.c (_gcry_burn_stack): Remove SIZEOF_UNSIGNED_LONG == 4 or 8 + optimization. + +2013-08-16 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + camellia: add ARMv6 assembly implementation. + + commit cafadc1e4fb97581262b0081ba251e05613d4394 + * cipher/Makefile.am: Add 'camellia-armv6.S'. + * cipher/camellia-armv6.S: New file. + * cipher/camellia-glue.c [USE_ARMV6_ASM] + (_gcry_camellia_armv6_encrypt_block) + (_gcry_camellia_armv6_decrypt_block): New prototypes. + [USE_ARMV6_ASM] (Camellia_EncryptBlock, Camellia_DecryptBlock) + (camellia_encrypt, camellia_decrypt): New functions. + * cipher/camellia.c [!USE_ARMV6_ASM]: Compile encryption and decryption + routines if USE_ARMV6_ASM macro is _not_ defined. + * cipher/camellia.h (USE_ARMV6_ASM): New macro. + [!USE_ARMV6_ASM] (Camellia_EncryptBlock, Camellia_DecryptBlock): If + USE_ARMV6_ASM is defined, disable these function prototypes. + (camellia) [arm]: Add 'camellia-armv6.lo'. + + blowfish: add ARMv6 assembly implementation. + + commit 31e4b1a96a07e9a3698fcb7be0643a136ebb8e5c + * cipher/Makefile.am: Add 'blowfish-armv6.S'. + * cipher/blowfish-armv6.S: New file. + * cipher/blowfish.c (USE_ARMV6_ASM): New macro. + [USE_ARMV6_ASM] (_gcry_blowfish_armv6_do_encrypt) + (_gcry_blowfish_armv6_encrypt_block) + (_gcry_blowfish_armv6_decrypt_block, _gcry_blowfish_armv6_ctr_enc) + (_gcry_blowfish_armv6_cbc_dec, _gcry_blowfish_armv6_cfb_dec): New + prototypes. + [USE_ARMV6_ASM] (do_encrypt, do_encrypt_block, do_decrypt_block) + (encrypt_block, decrypt_block): New functions. + (_gcry_blowfish_ctr_enc) [USE_ARMV6_ASM]: Use ARMv6 assembly function. + (_gcry_blowfish_cbc_dec) [USE_ARMV6_ASM]: Use ARMv6 assembly function. + (_gcry_blowfish_cfb_dec) [USE_ARMV6_ASM]: Use ARMv6 assembly function. + * configure.ac (blowfish) [arm]: Add 'blowfish-armv6.lo'. + + cast5: add ARMv6 assembly implementation. + + commit 8d1faf56714598301580ce370e0bfa6d65e73644 + * cipher/Makefile.am: Add 'cast5-armv6.S'. + * cipher/cast5-armv6.S: New file. + * cipher/cast5.c (USE_ARMV6_ASM): New macro. + (CAST5_context) [USE_ARMV6_ASM]: New members 'Kr_arm_enc' and + 'Kr_arm_dec'. + [USE_ARMV6_ASM] (_gcry_cast5_armv6_encrypt_block) + (_gcry_cast5_armv6_decrypt_block, _gcry_cast5_armv6_ctr_enc) + (_gcry_cast5_armv6_cbc_dec, _gcry_cast5_armv6_cfb_dec): New prototypes. + [USE_ARMV6_ASM] (do_encrypt_block, do_decrypt_block, encrypt_block) + (decrypt_block): New functions. + (_gcry_cast5_ctr_enc) [USE_ARMV6_ASM]: Use ARMv6 assembly function. + (_gcry_cast5_cbc_dec) [USE_ARMV6_ASM]: Use ARMv6 assembly function. + (_gcry_cast5_cfb_dec) [USE_ARMV6_ASM]: Use ARMv6 assembly function. + (do_cast_setkey) [USE_ARMV6_ASM]: Initialize 'Kr_arm_enc' and + 'Kr_arm_dec'. + * configure.ac (cast5) [arm]: Add 'cast5-armv6.lo'. + +2013-08-14 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rijndael: add ARMv6 assembly implementation. + + commit f365961422f1c8b3d89b8bcd9c99828f38c1f158 + * cipher/Makefile.am: Add 'rijndael-armv6.S'. + * cipher/rijndael-armv6.S: New file. + * cipher/rijndael.c (USE_ARMV6_ASM): New macro. + [USE_ARMV6_ASM] (_gcry_aes_armv6_encrypt_block) + (_gcry_aes_armv6_decrypt_block): New prototypes. + (do_encrypt_aligned) [USE_ARMV6_ASM]: Use ARMv6 assembly function. + (do_encrypt): Disable input/output alignment when USE_ARMV6_ASM. + (do_decrypt_aligned) [USE_ARMV6_ASM]: Use ARMv6 assembly function. + (do_decrypt): Disable input/output alignment when USE_ARMV6_ASM. + * configure.ac (HAVE_COMPATIBLE_GCC_ARM_PLATFORM_AS): New check for + gcc/as compatibility with ARM assembly implementations. + (aes) [arm]: Add 'rijndael-armv6.lo'. + +2013-08-09 NIIBE Yutaka <gniibe@fsij.org> + + cipher: fix memory leak. + + commit 2b5bbe264fcd61e5e458e5f71a6507ba0271c729 + * cipher/pubkey.c (gcry_pk_sign): Handle the specific case of ECC, + where there is NULL whichi is not the sentinel. + +2013-08-08 Werner Koch <wk@gnupg.org> + + mpi: Clear immutable flag on the result of gcry_mpi_set. + + commit 426cbc9feca0c8f46208fb3670adab95f9e46087 + * mpi/mpiutil.c (gcry_mpi_set): Reset immutable and const flags. + * tests/mpitests.c (test_const_and_immutable): Add a test for this. + +2013-08-07 NIIBE Yutaka <gniibe@fsij.org> + + tests: fix memory leaks. + + commit cc082642c1b0f2a3e9ca78e1ffd3f64417c204bd + * tests/benchmark.c (dsa_bench): Release SIG. + + * tests/mpitests.c (test_powm): Release BASE, EXP, MOD, and RES. + + * tests/prime.c (check_primes): Release PRIME. + + * tests/tsexp.c (basic): Use intermediate variable M for constant. + Release S1, S2 and A. + +2013-08-07 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix building on W32 (cannot export symbol 'gcry_sexp_get_buffer') + + commit 065d446478bf68553339fc77a89b8369bd110a18 + * src/libgcrypt.def: Change 'gcry_sexp_get_buffer' to + 'gcry_sexp_nth_buffer'. + +2013-08-06 NIIBE Yutaka <gniibe@fsij.org> + + cipher: fix another memory leak. + + commit 9a421813123a2f5db0a91eaee4a45138efc9ad34 + * cipher/ecc.c (ecc_get_curve): Free TMP. + + tests: fix memory leaks. + + commit 87eddc31ccba6decbddd1761dd42a208666cd311 + * tests/pubkey.c (check_keys_crypt): Release L, X0, and X1. + (check_keys): Release X. + + cipher: fix memory leaks. + + commit ae6ffd9af38cbcac57c220960f683aab91db85cb + * cipher/elgamal.c (elg_generate_ext): Free XVALUE. + + * cipher/pubkey.c (sexp_elements_extract): Don't use IDX for loop. + Call mpi_free. + (sexp_elements_extract_ecc): Call mpi_free. + +2013-08-05 Werner Koch <wk@gnupg.org> + + mpi: Improve gcry_mpi_invm to detect bad input. + + commit d8e99a04dba6a606e879464cd11deee760d1e000 + * mpi/mpi-inv.c (gcry_mpi_invm): Return 0 for bad input. + +2013-07-31 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Correct checks for ecc secret key. + + commit 10dfa41b43a906031bc674ea41cd3073701011f3 + * cipher/ecc.c (check_secret_key): replace wrong comparison of Q and + sk->Q points with correct one. + +2013-07-29 Werner Koch <wk@gnupg.org> + + sexp: Allow white space anywhere in a hex format. + + commit 43320961a8751ee28dc95cdb0ae01ea8a7ff7f91 + * src/sexp.c (hextobyte): Remove. + (hextonibble): New. + (vsexp_sscan): Skip whtespace between hex nibbles. + + Implement deterministic ECDSA as specified by rfc-6979. + + commit 6e0a9786637d649b48aae0e611a12e12beef9b3b + * cipher/ecc.c (sign): Add args FLAGS and HASHALGO. Convert an opaque + MPI as INPUT. Implement rfc-6979. + (ecc_sign): Remove the opaque MPI code and pass FLAGS to sign. + (verify): Do not allocate and compute Y; it is not used. + (ecc_verify): Truncate the hash value if needed. + * tests/dsa-rfc6979.c (check_dsa_rfc6979): Add ECDSA test cases. + +2013-07-26 Werner Koch <wk@gnupg.org> + + Implement deterministic DSA as specified by rfc-6979. + + commit 1cfa79aabc5d0fd8d124901054475e90ab7d9cde + * cipher/dsa.c (dsa_sign): Move opaque mpi extraction to sign. + (sign): Add args FLAGS and HASHALGO. Implement deterministic DSA. + Add code path for R==0 to comply with the standard. + (dsa_verify): Left fill opaque mpi based hash values. + * cipher/dsa-common.c (int2octets, bits2octets): New. + (_gcry_dsa_gen_rfc6979_k): New. + * tests/dsa-rfc6979.c: New. + * tests/Makefile.am (TESTS): Add dsa-rfc6979. + + Allow the use of a private-key s-expression with gcry_pk_verify. + + commit b72d312ad11887fc416aa821786f6bdb663c0f4a + * cipher/pubkey.c (sexp_to_key): Fallback to private key. + +2013-07-25 Werner Koch <wk@gnupg.org> + + Mitigate a flush+reload cache attack on RSA secret exponents. + + commit 287bf0e543f244d784cf8b58340bf0ab3c6aba97 + * mpi/mpi-pow.c (gcry_mpi_powm): Always perfrom the mpi_mul for + exponents in secure memory. + +2013-07-19 Werner Koch <wk@gnupg.org> + + pk: Allow the use of a hash element for DSA sign and verify. + + commit 37d0a1ebdc2dc74df4fb6bf0621045018122a68f + * cipher/pubkey.c (pubkey_sign): Add arg ctx and pass it to the sign + module. + (gcry_pk_sign): Pass CTX to pubkey_sign. + (sexp_data_to_mpi): Add flag rfc6979 and code to alls hash with *DSA + * cipher/rsa.c (rsa_sign, rsa_verify): Return an error if an opaque + MPI is given for DATA/HASH. + * cipher/elgamal.c (elg_sign, elg_verify): Ditto. + * cipher/dsa.c (dsa_sign, dsa_verify): Convert a given opaque MPI. + * cipher/ecc.c (ecc_sign, ecc_verify): Ditto. + * tests/basic.c (check_pubkey_sign_ecdsa): Add a test for using a hash + element with DSA. + + sexp: Add function gcry_sexp_nth_buffer. + + commit 2d3e8d4d9562d666420aadd9ffa8ac0456a1cd91 + * src/sexp.c (gcry_sexp_nth_buffer): New. + * src/visibility.c, src/visibility.h: Add function wrapper. + * src/libgcrypt.vers, src/libgcrypt.def: Add to API. + * src/gcrypt.h.in: Add prototype. + +2013-07-18 Werner Koch <wk@gnupg.org> + + Add support for Salsa20. + + commit c4885092088431e7928e4459fda20cc0e8ceb201 + * src/gcrypt.h.in (GCRY_CIPHER_SALSA20): New. + * cipher/salsa20.c: New. + * configure.ac (available_ciphers): Add Salsa20. + * cipher/cipher.c: Register Salsa20. + (cipher_setiv): Allow to divert an IV to a cipher module. + * src/cipher-proto.h (cipher_setiv_func_t): New. + (cipher_extra_spec): Add field setiv. + * src/cipher.h: Declare Salsa20 definitions. + * tests/basic.c (check_stream_cipher): New. + (check_stream_cipher_large_block): New. + (check_cipher_modes): Run new test functions. + (check_ciphers): Add simple test for Salsa20. + +2013-07-17 Werner Koch <wk@gnupg.org> + + Allow gcry_mpi_dump to print opaque MPIs. + + commit 364d019e3ffedfcb434576702f73e767cb9389ef + * mpi/mpicoder.c (gcry_mpi_dump): Detect abd print opaque MPIs. + * tests/mpitests.c (test_opaque): New. + (main): Call new test. + + cipher: Prepare to pass extra info to the sign functions. + + commit 5940e66cbefea3de5924f494f18aed69bb694bff + * src/gcrypt-module.h (gcry_pk_sign_t): Add parms flags and hashalgo. + * cipher/rsa.c (rsa_sign): Add parms and mark them as unused. + * cipher/dsa.c (dsa_sign): Ditto. + * cipher/elgamal.c (elg_sign): Ditto. + * cipher/pubkey.c (dummy_sign): Ditto. + (pubkey_sign): Pass 0 for the new args. + + Fix a special case bug in mpi_powm for e==0. + + commit 6e1adb05d290aeeb1c230c763970695f4a538526 + * mpi/mpi-pow.c (gcry_mpi_powm): For a zero exponent, make sure that + the result has been allocated. + +2013-07-15 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> + + Fix memory leak in t-mpi-point test. + + commit a7b80e9fba6b1b095f7c53469747967b40ebfbfd + * tests/t-mpi-point.c (basic_ec_math, basic_ec_math_simplified): add + calls to gcry_ctx_release() to free contexts after they become unused. + +2013-07-10 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Fix 'Please include winsock2.h before windows.h' warnings with mingw32. + + commit d6c9c86cb7f571ae0bd9aee4efa01a0f9c4c3104 + * random/rndw32.c: include winsock2.h before windows.h. + * src/ath.h [_WIN32]: Ditto. + * tests/benchmark.c [_WIN32]: Ditto. + + Remove duplicate header from mpi/amd64/mpih-mul2.S. + + commit c64a0dcbefc5b0055954e37a3c86b32ff7a1b1da + * mpi/amd64/mpih-mul2.S: remove duplicated header. + + Fix i386/amd64 inline assembly "cc" clobbers. + + commit ed0a598172208ec67234a4edd73189bf6808fd04 + * cipher/bithelp.h [__GNUC__, __i386__] (rol, ror): add "cc" globber + for inline assembly. + * cipher/cast5.c [__GNUC__, __i386__] (rol): Ditto. + * random/rndhw.c [USE_DRNG] (rdrand_long): Ditto. + * src/hmac256.c [__GNUC__, __i386__] (ror): Ditto. + * mpi/longlong.c [__i386__] (add_ssaaaa, sub_ddmmss, umul_ppmm) + (udiv_qrnnd, count_leading_zeros, count_trailing_zeros): Ditto. + + bufhelp: Suppress 'cast increases required alignment' warning. + + commit c3902a6b5cea9acef2e15fbee24eb601eeb25168 + * cipher/bufhelp.h (buf_xor, buf_xor_2dst, buf_xor_n_copy): Cast + to larger element pointer through (void *) to suppress -Wcast-error. + + mpi: Add __ARM_ARCH for older GCC. + + commit 97f392f43cf2e4da1297cbecacbfbff33a869478 + * mpi/longlong.h [__arm__]: Construct __ARM_ARCH if not provided by + compiler. + + mpi: add missing "cc" clobber for ARM assembly. + + commit 8aa4f2161cf643ce36d87d2e2786b546736f8232 + * mpi/longlong.h [__arm__] (add_ssaaaa, sub_ddmmss): Add __CLOBBER_CC. + [__arm__][__ARM_ARCH <= 3] (umul_ppmm): Ditto. + + Tweak ARM inline assembly for mpi. + + commit 71dda4507053379433dc8b0fc6462c15de7299df + mpi/longlong.h [__arm__]: Enable inline assembly if __thumb2__ is + defined. + [__arm__]: Use __ARCH_ARM when defined. + [__arm__] [__ARM_ARCH >= 5] (count_leading_zeros): New. + +2013-06-26 Werner Koch <wk@gnupg.org> + + Make gpg-error replacement defines more robust. + + commit 6540b84a6e9113813e7e49e3ad2024d4a0073300 + * configure.ac (AH_BOTTOM): Move GPG_ERR_ replacement defines to ... + * src/gcrypt-int.h: new file. + * src/visibility.h, src/cipher.h: Replace gcrypt.h by gcrypt-int.h. + * tests/: Ditto for all test files. + +2013-06-20 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Check if assembler is compatible with AMD64 assembly implementations. + + commit 3544fa8aa63bef9a35abf236e9376191b5ec206b + * cipher/blowfish-amd64.S: Enable only if + HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS is defined. + * cipher/camellia-aesni-avx-amd64.S: Ditto. + * cipher/camellia-aesni-avx2-amd64.S: Ditto. + * cipher/cast5-amd64.S: Ditto. + * cipher/rinjdael-amd64.S: Ditto. + * cipher/serpent-avx2-amd64.S: Ditto. + * cipher/serpent-sse2-amd64.S: Ditto. + * cipher/twofish-amd64.S: Ditto. + * cipher/blowfish.c: Use AMD64 assembly implementation only if + HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS is defined + * cipher/camellia-glue.c: Ditto. + * cipher/cast5.c: Ditto. + * cipher/rijndael.c: Ditto. + * cipher/serpent.c: Ditto. + * cipher/twofish.c: Ditto. + * configure.ac: Check gcc/as compatibility with AMD64 assembly + implementations. + +2013-06-09 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Optimize _gcry_burn_stack for 32-bit and 64-bit architectures. + + commit ec2f8de409a93c80efa658134df22074a9bca5a4 + * src/misc.c (_gcry_burn_stack): Add optimization for 32-bit and 64-bit + architectures. + + Add Camellia AES-NI/AVX2 implementation. + + commit d94ec5f5f8a5d40a7d344025aa466f276f9718df + * cipher/Makefile.am: Add 'camellia-aesni-avx2-amd64.S'. + * cipher/camellia-aesni-avx2-amd64.S: New file. + * cipher/camellia-glue.c (USE_AESNI_AVX2): New macro. + (CAMELLIA_context) [USE_AESNI_AVX2]: Add 'use_aesni_avx2'. + [USE_AESNI_AVX2] (_gcry_camellia_aesni_avx2_ctr_enc) + (_gcry_camellia_aesni_avx2_cbc_dec) + (_gcry_camellia_aesni_avx2_cfb_dec): New prototypes. + (camellia_setkey) [USE_AESNI_AVX2]: Check AVX2+AES-NI capable hardware + and set 'ctx->use_aesni_avx2'. + (_gcry_camellia_ctr_enc) [USE_AESNI_AVX2]: Add AVX2 accelerated code. + (_gcry_camellia_cbc_dec) [USE_AESNI_AVX2]: Add AVX2 accelerated code. + (_gcry_camellia_cfb_dec) [USE_AESNI_AVX2]: Add AVX2 accelerated code. + (selftest_ctr_128, selftest_cbc_128, selftest_cfb_128): Grow 'nblocks' + so that AVX2 codepaths get tested. + * configure.ac (camellia) [avx2support, aesnisupport]: Add + 'camellia-aesni-avx2-amd64.lo'. + + Add Serpent AVX2 implementation. + + commit e7ab4e1a7396f4609b9033207015b239ab4a5140 + * cipher/Makefile.am: Add 'serpent-avx2-amd64.S'. + * cipher/serpent-avx2-amd64.S: New file. + * cipher/serpent.c (USE_AVX2): New macro. + (serpent_context_t) [USE_AVX2]: Add 'use_avx2'. + [USE_AVX2] (_gcry_serpent_avx2_ctr_enc, _gcry_serpent_avx2_cbc_dec) + (_gcry_serpent_avx2_cfb_dec): New prototypes. + (serpent_setkey_internal) [USE_AVX2]: Check for AVX2 capable hardware + and set 'use_avx2'. + (_gcry_serpent_ctr_enc) [USE_AVX2]: Use AVX2 accelerated functions. + (_gcry_serpent_cbc_dec) [USE_AVX2]: Use AVX2 accelerated functions. + (_gcry_serpent_cfb_dec) [USE_AVX2]: Use AVX2 accelerated functions. + (selftest_ctr_128, selftest_cbc_128, selftest_cfb_128): Grow 'nblocks' + so that AVX2 codepaths are tested. + * configure.ac (serpent) [avx2support]: Add 'serpent-avx2-amd64.lo'. + + Add detection for Intel AVX2 instruction set. + + commit 3289bca708bdd02c69a331095ac6ca9a1efd74cc + * configure.ac: Add option --disable-avx2-support. + (HAVE_GCC_INLINE_ASM_AVX2): New. + (ENABLE_AVX2_SUPPORT): New. + * src/g10lib.h (HWF_INTEL_AVX2): New. + * src/global.c (hwflist): Add HWF_INTEL_AVX2. + * src/hwf-x86.c [__i386__] (get_cpuid): Initialize registers to zero + before cpuid. + [__x86_64__] (get_cpuid): Initialize registers to zero before cpuid. + (detect_x86_gnuc): Store maximum cpuid level. + (detect_x86_gnuc) [ENABLE_AVX2_SUPPORT]: Add detection for AVX2. + + twofish: add amd64 assembly implementation. + + commit d325ab5d86e6107a46007a4d0131122bbd719f8c + * cipher/Makefile.am: Add 'twofish-amd64.S'. + * cipher/twofish-amd64.S: New file. + * cipher/twofish.c (USE_AMD64_ASM): New macro. + [USE_AMD64_ASM] (_gcry_twofish_amd64_encrypt_block) + (_gcry_twofish_amd64_decrypt_block, _gcry_twofish_amd64_ctr_enc) + (_gcry_twofish_amd64_cbc_dec, _gcry_twofish_amd64_cfb_dec): New + prototypes. + [USE_AMD64_ASM] (do_twofish_encrypt, do_twofish_decrypt) + (twofish_encrypt, twofish_decrypt): New functions. + (_gcry_twofish_ctr_enc, _gcry_twofish_cbc_dec, _gcry_twofish_cfb_dec) + (selftest_ctr, selftest_cbc, selftest_cfb): New functions. + (selftest): Call new bulk selftests. + * cipher/cipher.c (gcry_cipher_open) [USE_TWOFISH]: Register Twofish + bulk functions for ctr-enc, cbc-dec and cfb-dec. + * configure.ac (twofish) [x86_64]: Add 'twofish-amd64.lo'. + * src/cipher.h (_gcry_twofish_ctr_enc, _gcry_twofish_cbc_dec) + (gcry_twofish_cfb_dec): New prototypes. + +2013-05-29 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + rinjdael: add amd64 assembly implementation. + + commit 7317fcfadf00789df140e51c0d16b60f6b144b59 + * cipher/Makefile.am: Add 'rijndael-amd64.S'. + * cipher/rijndael-amd64.S: New file. + * cipher/rijndael.c (USE_AMD64_ASM): New macro. + [USE_AMD64_ASM] (_gcry_aes_amd64_encrypt_block) + (_gcry_aes_amd64_decrypt_block): New prototypes. + (do_encrypt_aligned) [USE_AMD64_ASM]: Use amd64 assembly function. + (do_encrypt): Disable input/output alignment when USE_AMD64_ASM is set. + (do_decrypt_aligned) [USE_AMD64_ASM]: Use amd64 assembly function. + (do_decrypt): Disable input/output alignment when USE_AMD64_AES is set. + * configure.ac (aes) [x86-64]: Add 'rijndael-amd64.lo'. + + blowfish: add amd64 assembly implementation. + + commit 9a61edd1f00cefe8ffa3ad54a53eed163883053c + * cipher/Makefile.am: Add 'blowfish-amd64.S'. + * cipher/blowfish-amd64.S: New file. + * cipher/blowfish.c (USE_AMD64_ASM): New macro. + [USE_AMD64_ASM] (_gcry_blowfish_amd64_do_encrypt) + (_gcry_blowfish_amd64_encrypt_block) + (_gcry_blowfish_amd64_decrypt_block, _gcry_blowfish_amd64_ctr_enc) + (_gcry_blowfish_amd64_cbc_dec, _gcry_blowfish_amd64_cfb_dec): New + prototypes. + [USE_AMD64_ASM] (do_encrypt, do_encrypt_block, do_decrypt_block) + (encrypt_block, decrypt_block): New functions. + (_gcry_blowfish_ctr_enc, _gcry_blowfish_cbc_dec) + (_gcry_blowfish_cfb_dec, selftest_ctr, selftest_cbc, selftest_cfb): New + functions. + (selftest): Call new bulk selftests. + * cipher/cipher.c (gcry_cipher_open) [USE_BLOWFISH]: Register Blowfish + bulk functions for ctr-enc, cbc-dec and cfb-dec. + * configure.ac (blowfish) [x86_64]: Add 'blowfish-amd64.lo'. + * src/cipher.h (_gcry_blowfish_ctr_enc, _gcry_blowfish_cbc_dec) + (gcry_blowfish_cfb_dec): New prototypes. + +2013-05-24 Werner Koch <wk@gnupg.org> + + ecc: Simplify the compliant point generation. + + commit 99b18aa536703ef90c9a1f5c8f40bc68b2064593 + * cipher/ecc.c (generate_key): Use point_snatch_set, replaces unneeded + variable copies, etc. + + ecc: Fix a minor flaw in the generation of K. + + commit 9711384f75564a71979e3fb971b5f4cadcf1afef + * cipher/dsa.c (gen_k): Factor code out to .. + * cipher/dsa-common.c (_gcry_dsa_gen_k): new file and function. Add + arg security_level and re-indent a bit. + * cipher/ecc.c (gen_k): Remove and change callers to _gcry_dsa_gen_k. + * cipher/dsa.c: Include pubkey-internal. + * cipher/Makefile.am (libcipher_la_SOURCES): Add dsa-common.c + +2013-05-24 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + cast5: add amd64 assembly implementation. + + commit 0bdf26eea8cdbffefe7e37578f8f896c4f5f5275 + * cipher/Makefile.am: Add 'cast5-amd64.S'. + * cipher/cast5-amd64.S: New file. + * cipher/cast5.c (USE_AMD64_ASM): New macro. + (_gcry_cast5_s1tos4): Merge arrays s1, s2, s3, s4 to single array to + simplify access from assembly implementation. + (s1, s2, s3, s4): New macros pointing to subarrays in + _gcry_cast5_s1tos4. + [USE_AMD64_ASM] (_gcry_cast5_amd64_encrypt_block) + (_gcry_cast5_amd64_decrypt_block, _gcry_cast5_amd64_ctr_enc) + (_gcry_cast5_amd64_cbc_dec, _gcry_cast5_amd64_cfb_dec): New prototypes. + [USE_AMD64_ASM] (do_encrypt_block, do_decrypt_block, encrypt_block) + (decrypt_block): New functions. + (_gcry_cast5_ctr_enc, _gcry_cast5_cbc_dec, _gcry_cast5_cfb_dec) + (selftest_ctr, selftest_cbc, selftest_cfb): New functions. + (selftest): Call new bulk selftests. + * cipher/cipher.c (gcry_cipher_open) [USE_CAST5]: Register CAST5 bulk + functions for ctr-enc, cbc-dec and cfb-dec. + * configure.ac (cast5) [x86_64]: Add 'cast5-amd64.lo'. + * src/cipher.h (_gcry_cast5_ctr_enc, _gcry_cast5_cbc_dec) + (gcry_cast5_cfb_dec): New prototypes. + + cipher-selftest: make selftest work with any block-size. + + commit ab8fc70b5f0c396a5bc941267f59166e860b8c5d + * cipher/cipher-selftest.c (_gcry_selftest_helper_cbc_128) + (_gcry_selftest_helper_cfb_128, _gcry_selftest_helper_ctr_128): Renamed + functions from '<name>_128' to '<name>'. + (_gcry_selftest_helper_cbc, _gcry_selftest_helper_cfb) + (_gcry_selftest_helper_ctr): Make work with different block sizes. + * cipher/cipher-selftest.h (_gcry_selftest_helper_cbc_128) + (_gcry_selftest_helper_cfb_128, _gcry_selftest_helper_ctr_128): Renamed + prototypes from '<name>_128' to '<name>'. + * cipher/camellia-glue.c (selftest_ctr_128, selftest_cfb_128) + (selftest_ctr_128): Change to use new function names. + * cipher/rijndael.c (selftest_ctr_128, selftest_cfb_128) + (selftest_ctr_128): Change to use new function names. + * cipher/serpent.c (selftest_ctr_128, selftest_cfb_128) + (selftest_ctr_128): Change to use new function names. + +2013-05-23 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + serpent: add parallel processing for CFB decryption. + + commit 6deb0ccdf718a0670f80e6762a3842caf76437d6 + * cipher/cipher.c (gcry_cipher_open): Add bulf CFB decryption function + for Serpent. + * cipher/serpent-sse2-amd64.S (_gcry_serpent_sse2_cfb_dec): New + function. + * cipher/serpent.c (_gcry_serpent_sse2_cfb_dec): New prototype. + (_gcry_serpent_cfb_dec) New function. + (selftest_cfb_128) New function. + (selftest) Call selftest_cfb_128. + * src/cipher.h (_gcry_serpent_cfb_dec): New prototype. + + camellia: add parallel processing for CFB decryption. + + commit b60f06f70227c1e69e1010da8b47ea51ade48145 + * cipher/camellia-aesni-avx-amd64.S + (_gcry_camellia_aesni_avx_cfb_dec): New function. + * cipher/camellia-glue.c (_gcry_camellia_aesni_avx_cfb_dec): New + prototype. + (_gcry_camellia_cfb_dec): New function. + (selftest_cfb_128): New function. + (selftest): Call selftest_cfb_128. + * cipher/cipher.c (gry_cipher_open): Add bulk CFB decryption function + for Camellia. + * src/cipher.h (_gcry_camellia_cfb_dec): New prototype. + + rinjdael: add parallel processing for CFB decryption with AES-NI. + + commit 319ee14f2aab8db56a830fd7ac8926f91b4f738a + * cipher/cipher-selftest.c (_gcry_selftest_helper_cfb_128): New + function for CFB selftests. + * cipher/cipher-selftest.h (_gcry_selftest_helper_cfb_128): New + prototype. + * cipher/rijndael.c [USE_AESNI] (do_aesni_enc_vec4): New function. + (_gcry_aes_cfb_dec) [USE_AESNI]: Add parallelized CFB decryption. + (selftest_cfb_128): New function. + (selftest): Call selftest_cfb_128. + +2013-05-23 Werner Koch <wk@gnupg.org> + + Avoid compiler warning due to the global symbol setkey. + + commit b402de8b9c4a9f269faf03ca952b1eb68a1f33c8 + * cipher/cipher-selftest.c (_gcry_selftest_helper_cbc_128) + (_gcry_selftest_helper_ctr_128): Rename setkey to setkey_func. + +2013-05-23 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + serpent: add SSE2 accelerated amd64 implementation. + + commit 2fd06e207dcea1d8a7f0e7e92f3359615a99421b + * configure.ac (serpent): Add 'serpent-sse2-amd64.lo'. + * cipher/Makefile.am (EXTRA_libcipher_la_SOURCES): Add + 'serpent-sse2-amd64.S'. + * cipher/cipher.c (gcry_cipher_open) [USE_SERPENT]: Register bulk + functions for CBC-decryption and CTR-mode. + * cipher/serpent.c (USE_SSE2): New macro. + [USE_SSE2] (_gcry_serpent_sse2_ctr_enc, _gcry_serpent_sse2_cbc_dec): + New prototypes to assembler functions. + (serpent_setkey): Set 'serpent_init_done' before calling serpent_test. + (_gcry_serpent_ctr_enc): New function. + (_gcry_serpent_cbc_dec): New function. + (selftest_ctr_128): New function. + (selftest_cbc_128): New function. + (selftest): Call selftest_ctr_128 and selftest_cbc_128. + * cipher/serpent-sse2-amd64.S: New file. + * src/cipher.h (_gcry_serpent_ctr_enc): New prototype. + (_gcry_serpent_cbc_dec): New prototype. + + Serpent: faster S-box implementation. + + commit c85501af8222913f0a1e20e77fceb88e93417925 + * cipher/serpent.c (SBOX0, SBOX1, SBOX2, SBOX3, SBOX4, SBOX5, SBOX6) + (SBOX7, SBOX0_INVERSE, SBOX1_INVERSE, SBOX2_INVERSE, SBOX3_INVERSE) + (SBOX4_INVERSE, SBOX5_INVERSE, SBOX6_INVERSE, SBOX7_INVERSE): Replace + with new definitions. + +2013-05-22 Werner Koch <wk@gnupg.org> + + w32: Fix installing of .def file. + + commit 4e46d8bc78008ba06f106b368cefb0dddf15fe38 + * src/Makefile.am (install-def-file): Create libdir first. + + Add control commands to disable mlock and setuid dropping. + + commit 2b8014af202c9e0f7619f7a4377f5eb752235220 + * src/gcrypt.h.in (GCRYCTL_DISABLE_LOCKED_SECMEM): New. + (GCRYCTL_DISABLE_PRIV_DROP): New. + * src/global.c (_gcry_vcontrol): Implement them. + * src/secmem.h (GCRY_SECMEM_FLAG_NO_MLOCK): New. + (GCRY_SECMEM_FLAG_NO_PRIV_DROP): New. + * src/secmem.c (no_mlock, no_priv_drop): New. + (_gcry_secmem_set_flags, _gcry_secmem_get_flags): Set and get them. + (lock_pool): Handle no_mlock and no_priv_drop. + + Fix libtool 2.4.2 to correctly detect .def files. + + commit 05b3e2dda61d3d532a7f1ffd2487a85ed1c4f3ab + * ltmain.sh (sed_uncomment_deffile): New. + (orig_export_symbols): Uncomment def file before testing for EXPORTS. + * m4/libtool.m4: Do the same for the generated code. + +2013-05-22 Jussi Kivilinna <jussi.kivilinna@iki.fi> + + Add AES bulk CBC decryption selftest. + + commit b65281a1b76d7898eb7607932246b78277d8570b + * cipher/rinjdael.c (selftest_cbc_128): New. + (selftest): Call selftest_cbc_128. + + Change AES bulk CTR encryption selftest use new selftest helper function + + commit 3637bdbb5f30a5e06745d448a6a8ad00e5cdd740 + * cipher/rinjdael.c: (selftest_ctr_128): Change to use new selftest + helper function. + + Convert bulk CTR and CBC selftest functions in Camellia to generic selftest helper functions + + commit eed4042fa028b3f73bad6a768f5b0a82f642e545 + * cipher/Makefile.am (libcipher_la_SOURCES): Add cipher-selftest files. + * cipher/camellia-glue.c (selftest_ctr_128, selftest_cbc_128): Change + to use the new selftest helper functions. + * cipher/cipher-selftest.c: New. + * cipher/cipher-selftest.h: New. + + camellia: add bulk CBC decryption selftest. + + commit f2986f03d1ae59f973bae56ce4333e5457003de5 + * cipher/camellia-glue.c: (selftest_cbc_128): New selftest function for + bulk CBC decryption. + (selftest): Add call to selftest_cbc_128. + + camellia: Rename camellia_aesni_avx_x86-64.S to camellia-aesni-avx-amd64.S + + commit 194ae35da7830a76b96e9b21121a2e1248762d3f + * cipher/camellia_aesni_avx_x86-64.S: Remove. + * cipher/camellia-aesni-avx-amd64.S: New. + * cipher/Makefile.am: Use the new filename. + * configure.ac: Use the new filename. + +2013-05-21 Werner Koch <wk@gnupg.org> + + Fix indentation and save on string space. + + commit 2ac3a7c2b7154379738d17cfde8cd9017dc142f0 + * cipher/ecc.c (generate_key): Use the same string for both fatal + messages. + +2013-05-20 Andrey <andrey@brainhub.org> + + cipher: Fix segv in last ECC change. + + commit eb4937914db3fb7317502e97e4f0e40c1857f59d + * cipher/ecc.c (generate_key): Make sure R is initialized. + +2013-05-09 Andrey <andrey@brainhub.org> + + cipher: Generate compliant ECC keys. + + commit 296f38a2bd2e25788643a42e4881faed00884a40 + * cipher/ecc.c (generate_key): Make sure a key is compliant for + using the compact representation. + +2013-04-18 Werner Koch <wk@gnupg.org> + + cipher: Fix regression in Padlock support. + + commit 6c942ec4d63032539f1fc56c3b970cfec2369e2b + * cipher/rijndael.c (do_setkey): Remove dummy padlock key generation case + and use the standard one. + + mpi: Yet another fix to get option flag munging right. + + commit 03557687a09b9c8878c77cbfdd0f5049940c72da + * cipher/Makefile.am (o_flag_munging): Yet another fix. + + mpi: Make using gcc's -Ofast easier. + + commit 1ab26bc304c559b0a8d29823d656f7ad8d10a59d + * cipher/Makefile.am (o_flag_munging): Take -Ofast in account. + + Fix alignment problem in idea.c. + + commit 3271b0dfda67e26c381d7ed667737f08f865ee40 + * cipher/idea.c (cipher): Rework parameter use to fix alignment + problems. + + * cipher/idea.c (FNCCAST_SETKEY, FNCCAST_CRYPT): Remove unused macros. + + Fix alignment problem in idea.c. + + * cipher/idea.c (cipher): Rework parameter use to fix alignment + problems. + + * cipher/idea.c (FNCCAST_SETKEY, FNCCAST_CRYPT): Remove unused macros. + + + (cherry picked from 4cd279556777e02eda79973f68efaa4b741f9175) + +2013-04-18 Vladimir Serbinenko <phcoder@gmail.com> + + Add some const attributes. + + commit ff0b94c22b36600fff1db9f1d48f9de61f9038f7 + * cipher/md4.c (transform): Add const attribute. + * cipher/md5.c (transform): Ditto. + * cipher/rmd160.c (transform): Ditto. + + Fix alignment problem in serpent.c. + + commit 86e72b490a5790a9c23341067c7e4d3e38be1634 + * cipher/serpent.c (serpent_key_prepare): Fix misaligned access. + (serpent_setkey): Likewise. + (serpent_encrypt_internal): Likewise. + (serpent_decrypt_internal): Likewise. + (serpent_encrypt): Don't put an alignment-increasing cast. + (serpent_decrypt): Likewise. + (serpent_test): Likewise. + +2013-04-16 Werner Koch <wk@wheatstone.g10code.de> + + Fix multiply by zero in gcry_mpi_ec_mul. + + commit 78cd0ba8a8eceee9d0b3397a2ab3bda6ba37c8a4 + * mpi/ec.c (_gcry_mpi_ec_mul_point): Handle case of SCALAR == 0. + * tests/t-mpi-point.c (basic_ec_math): Add a test case for this. + +2013-04-15 Werner Koch <wk@gnupg.org> + + Add macros to return pre-defined MPIs. + + commit bd3afc27459a44df8cf501a7e1ae37bb849a8b0e + * src/gcrypt.h.in (GCRYMPI_CONST_ONE, GCRYMPI_CONST_TWO) + (GCRYMPI_CONST_THREE, GCRYMPI_CONST_FOUR, GCRYMPI_CONST_EIGHT): New. + (_gcry_mpi_get_const): New private function. + * src/visibility.c (_gcry_mpi_get_const): New. + * src/visibility.h: Mark it visible. + + Fix addition of EC points. + + commit 71b25a5562f68aad81eae52cc1bab9ca7731a7e9 + * mpi/ec.c (_gcry_mpi_ec_add_points): Fix case of P1 given in affine + coordinates. + +2013-04-12 Werner Koch <wk@gnupg.org> + + Add hack to allow using an "ecc" key for "ecdsa" or "ecdh". + + commit af8a79aea80217a0c85a592db1fa001792a6bf0f + * cipher/pubkey.c (sexp_to_key): Add optional arg USE. + (gcry_pk_encrypt, gcry_pk_decrypt): Call sexp_to_key with usage sign. + (gcry_pk_sign, gcry_pk_verify): Call sexp_to_key with usage encrypt. + * tests/basic.c (show_sexp): New. + (check_pubkey_sign): Print test number and add cases for ecc. + (check_pubkey_sign_ecdsa): New. + (do_check_one_pubkey): Divert to new function. + +2013-04-11 Werner Koch <wk@gnupg.org> + + Add gcry_pubkey_get_sexp. + + commit 1f3cfad66456dd6f2e48f20b8eb0c51343449a1c + * src/gcrypt.h.in (GCRY_PK_GET_PUBKEY): New. + (GCRY_PK_GET_SECKEY): New. + (gcry_pubkey_get_sexp): New. + * src/visibility.c (gcry_pubkey_get_sexp): New. + * src/visibility.h (gcry_pubkey_get_sexp): Mark visible. + * src/libgcrypt.def, src/libgcrypt.vers: Add new function. + * cipher/pubkey-internal.h: New. + * cipher/Makefile.am (libcipher_la_SOURCES): Add new file. + * cipher/ecc.c: Include pubkey-internal.h + (_gcry_pk_ecc_get_sexp): New. + * cipher/pubkey.c: Include pubkey-internal.h and context.h. + (_gcry_pubkey_get_sexp): New. + * src/context.c (_gcry_ctx_find_pointer): New. + * src/cipher-proto.h: Add _gcry_pubkey_get_sexp. + * tests/t-mpi-point.c (print_sexp): New. + (context_param, basic_ec_math_simplified): Add tests for the new + function. + + * configure.ac (NEED_GPG_ERROR_VERSION): Set to 1.11. + (AH_BOTTOM) Add error codes from gpg-error 1.12 + * src/g10lib.h (fips_not_operational): Use GPG_ERR_NOT_OPERATIONAL. + + * mpi/ec.c (_gcry_mpi_ec_get_mpi): Fix computation of Q. + (_gcry_mpi_ec_get_point): Ditto. + + Remove unused code. + + commit 7524da2ba83d83a766c22d704006380c893e1c49 + * cipher/pubkey.c (_gcry_pk_module_lookup, _gcry_pk_module_release) + (_gcry_pk_get_elements): Remove. + +2013-04-05 Werner Koch <wk@gnupg.org> + + Make the Q parameter optional for ECC signing. + + commit fe91a642c7c257aca095b96406fbcace88fa3df4 + * cipher/ecc.c (ecc_sign): Remove the need for Q. + * cipher/pubkey.c (sexp_elements_extract_ecc): Make Q optional for a + private key. + (sexp_to_key): Add optional arg R_IS_ECC. + (gcry_pk_sign): Do not call gcry_pk_get_nbits for ECC keys. + * tests/pubkey.c (die): Make sure to print a LF. + (check_ecc_sample_key): New. + (main): Call new test. + + Add test case for SCRYPT and rework the code. + + commit f23a068bcb6ec9788710698578d8be0a2a006dbc + * tests/t-kdf.c (check_scrypt): New. + (main): Call new test. + + * configure.ac: Support disabling of the scrypt algorithm. Make KDF + enabling similar to the other algorithm classes. Disable scrypt if we + don't have a 64 bit type. + * cipher/memxor.c, cipher/memxor.h: Remove. + * cipher/scrypt.h: Remove. + * cipher/kdf-internal.h: New. + * cipher/Makefile.am: Remove files. Add new file. Move scrypt.c to + EXTRA_libcipher_la_SOURCES. + (GCRYPT_MODULES): Add GCRYPT_KDFS. + * src/gcrypt.h.in (GCRY_KDF_SCRYPT): Change value. + * cipher/kdf.c (pkdf2): Rename to _gcry_kdf_pkdf2. + (_gcry_kdf_pkdf2): Don't bail out for SALTLEN==0. + (gcry_kdf_derive): Allow for a passwordlen of zero for scrypt. Check + for SALTLEN > 0 for GCRY_KDF_PBKDF2. Pass algo to _gcry_kdf_scrypt. + (gcry_kdf_derive) [!USE_SCRYPT]: Return an error. + * cipher/scrypt.c: Replace memxor.h by bufhelp.h. Replace scrypt.h by + kdf-internal.h. Enable code only if HAVE_U64_TYPEDEF is defined. + Replace C99 types uint64_t, uint32_t, and uint8_t by libgcrypt types. + (_SALSA20_INPUT_LENGTH): Remove underscore from identifier. + (_scryptBlockMix): Replace memxor by buf_xor. + (_gcry_kdf_scrypt): Use gcry_malloc and gcry_free. Check for integer + overflow. Add hack to support blocksize of 1 for tests. Return + errors from calls to _gcry_kdf_pkdf2. + + * cipher/kdf.c (openpgp_s2k): Make static. + +2013-04-04 Christian Grothoff <christian@grothoff.org> + + Add the SCRYPT KDF function. + + commit 855b1a8f81b5a3b5b31d0c3c303675425f58a5af + * scrypt.c, scrypt.h: New files. + * memxor.c, memxor.h: New files. + * cipher/Makefile.am: Add new files. + * cipher/kdf.c (gcry_kdf_derive): Support GCRY_KDF_SCRYPT. + * src/gcrypt.h.in (GCRY_KDF_SCRYPT): New. + +2013-03-22 Werner Koch <wk@gnupg.org> + + Replace deprecated AM_CONFIG_HEADER macro. + + commit d0c8fda5af45354ac32928c9a01e688d6893599d + * configure.ac: s/AM_CONFIG_HEADER/AC_CONFIG_HEADER/ + + Disable AES-NI support if as does not support SSSE3. + + commit 9f4df1612ae21a5ce70d98930cb194e5193f5e2d + * configure.ac (HAVE_GCC_INLINE_ASM_SSSE3): New test. + (ENABLE_AESNI_SUPPORT): Do not define without SSSE3 support. + (HAVE_GCC_INLINE_ASM_SSSE3, ENABLE_AVX_SUPPORT): Split up detection + and definition. + +2013-03-21 Werner Koch <wk@gnupg.org> + + Fix make dependency regression. + + commit 2a1e03c5a481689c43d197dd8034a1d73de0a1a4 + * src/Makefile.am (libgcrypt_la_DEPENDENCIES): Add missing backslash. + Reported by LRN. + +2013-03-20 Werner Koch <wk@gnupg.org> + + Use finer grained on-the-fly helper computations for EC. + + commit 5fb3501aa0cf5f2b2a9012706bb9ad2b1c4bfd7d + * src/ec-context.h (mpi_ec_ctx_s): Replace NEED_SYNC by a bitfield. + * mpi/ec.c (ec_p_sync): Remove. + (ec_get_reset, ec_get_a_is_pminus3, ec_get_two_inv_p): New. + (ec_p_init): Use ec_get_reset. + (_gcry_mpi_ec_set_mpi, _gcry_mpi_ec_dup_point) + (_gcry_mpi_ec_add_points): Replace ec_p_sync by the ec_get_ accessors. + + Allow building with w64-mingw32. + + commit b402e550041782b770a6ae267c7c28ca8324a12e + * autogen.sh <--build-w32>: Support the w64-mingw32 toolchain. Also + prepare for 64 bit building. + + Provide GCRYPT_VERSION_NUMBER macro, add build info to the binary. + + commit 1eaad0a8c4cab227685a6a8768e539df2f1f4dac + * src/gcrypt.h.in (GCRYPT_VERSION_NUMBER): New. + * configure.ac (VERSION_NUMBER): New ac_subst. + * src/global.c (_gcry_vcontrol): Move call to above function ... + (gcry_check_version): .. here. + + * configure.ac (BUILD_REVISION, BUILD_FILEVERSION) + (BUILD_TIMESTAMP): Define on all platforms. + * compat/compat.c (_gcry_compat_identification): Include revision and + timestamp. + + Fix a memory leak in the new EC code. + + commit de07974d807b703a2554d6ba885ea249e648bd44 + * cipher/ecc.c (point_from_keyparam): Always call mpi_free on A. + +2013-03-19 Werner Koch <wk@gnupg.org> + + Extend the new EC interface and fix two bugs. + + commit 931e409e877d1e444edd53dead327ec8e64daf9a + * src/ec-context.h (mpi_ec_ctx_s): Add field NEED_SYNC. + * mpi/ec.c (ec_p_sync): New. + (ec_p_init): Only set NEED_SYNC. + (_gcry_mpi_ec_set_mpi): Set NEED_SYNC for 'p' and 'a'. + (_gcry_mpi_ec_dup_point, _gcry_mpi_ec_add_points) + (_gcry_mpi_ec_mul_point): Call ec_p_sync. + (_gcry_mpi_ec_get_point): Recompute 'q' is needed. + (_gcry_mpi_ec_get_mpi): Ditto. Also allow for names 'q', 'q.x', + 'q.y', and 'g'. + * cipher/ecc.c (_gcry_mpi_ec_ec2os): New. + + * cipher/ecc.c (_gcry_mpi_ec_new): Fix init from parameters 'Q'->'q', + 'G'->'q'. + +2013-03-15 Werner Koch <wk@gnupg.org> + + mpi: Add functions to manipulate an EC context. + + commit 229f3219f80c9369ed9624242c0436ae6d293201 + * src/gcrypt.h.in (gcry_mpi_ec_p_new): Remove. + (gcry_mpi_ec_new): New. + (gcry_mpi_ec_get_mpi): New. + (gcry_mpi_ec_get_point): New. + (gcry_mpi_ec_set_mpi): New. + (gcry_mpi_ec_set_point): New. + * src/visibility.c (gcry_mpi_ec_p_new): Remove. + * mpi/ec.c (_gcry_mpi_ec_p_new): Make it an internal function and + change to return an error code. + (_gcry_mpi_ec_get_mpi): New. + (_gcry_mpi_ec_get_point): New. + (_gcry_mpi_ec_set_mpi): New. + (_gcry_mpi_ec_set_point): New. + * src/mpi.h: Add new prototypes. + * src/ec-context.h: New. + * mpi/ec.c: Include that header. + (mpi_ec_ctx_s): Move to ec-context.h, add new fields, and put some + fields into an inner struct. + (point_copy): New. + * cipher/ecc.c (fill_in_curve): Allow passing NULL for R_NBITS. + (mpi_from_keyparam, point_from_keyparam): New. + (_gcry_mpi_ec_new): New. + + * tests/t-mpi-point.c (test-curve): New. + (ec_p_new): New. Use it instead of the removed gcry_mpi_ec_p_new. + (get_and_cmp_mpi, get_and_cmp_point): New. + (context_param): New test. + (basic_ec_math_simplified): New test. + (main): Call new tests. + + * src/context.c (_gcry_ctx_get_pointer): Check for a NULL CTX. + +2013-03-13 Werner Koch <wk@gnupg.org> + + Add GCRYMPI_FLAG_CONST and make use constants. + + commit e005629bd7bebb3e13945645c6e1230b44ab16a2 + * src/gcrypt.h.in (GCRYMPI_FLAG_CONST): New. + * src/mpi.h (mpi_is_const, mpi_const): New. + (enum gcry_mpi_constants, MPI_NUMBER_OF_CONSTANTS): New. + * mpi/mpiutil.c (_gcry_mpi_init): New. + (constants): New. + (_gcry_mpi_free): Do not release a constant flagged MPI. + (gcry_mpi_copy): Clear the const and immutable flags. + (gcry_mpi_set_flag, gcry_mpi_clear_flag, gcry_mpi_get_flag): Support + GCRYMPI_FLAG_CONST. + (_gcry_mpi_const): New. + * src/global.c (global_init): Call _gcry_mpi_init. + * mpi/ec.c (mpi_ec_ctx_s): Remove fields one, two, three, four, and + eight. Change all users to call mpi_const() instead. + + * src/mpiutils.c (gcry_mpi_set_opaque): Check the immutable flag. + + Add GCRYMPI_FLAG_IMMUTABLE to help debugging. + + commit 1fecae98ee7e0fa49b29f98efa6817ca121ed98a + * src/gcrypt.h.in (GCRYMPI_FLAG_IMMUTABLE): New. + * src/mpi.h (mpi_is_immutable): New macro. + * mpi/mpiutil.c (gcry_mpi_set_flag, gcry_mpi_clear_flag) + (gcry_mpi_get_flag): Implement new flag + (_gcry_mpi_immutable_failed): New. + + * mpi/mpiutil.c (_gcry_mpi_clear, _gcry_mpi_free, gcry_mpi_snatch) + (gcry_mpi_set, gcry_mpi_randomize): Act upon the immutable flag. + * mpi/mpi-bit.c (gcry_mpi_set_bit, gcry_mpi_set_highbit) + (gcry_mpi_clear_highbit, gcry_mpi_clear_bit) + (_gcry_mpi_rshift_limbs, gcry_mpi_lshift): Ditto. + * mpi/mpicoder.c (_gcry_mpi_set_buffer): Ditto. + +2013-03-08 Werner Koch <wk@gnupg.org> + + mpi: Add an API for EC math. + + commit 8ac9e756d3ca545a9b97e61ad3d42fc2e877d788 + * src/context.c, src/context.h: New. + * src/Makefile.am (libgcrypt_la_SOURCES): Add new files. + * src/gcrypt.h.in (struct gcry_context, gcry_ctx_t): New types. + (gcry_ctx_release): New prototype. + (gcry_mpi_ec_p_new, gcry_mpi_ec_get_affine, gcry_mpi_ec_dup) + (gcry_mpi_ec_add, gcry_mpi_ec_mul): New prototypes. + * mpi/ec.c: Include errno.h and context.h. + (_gcry_mpi_ec_init): Rename to .. + (ec_p_init): this, make static, remove allocation and add arg CTX. + (_gcry_mpi_ec_p_internal_new): New; to replace _gcry_mpi_ec_init. + Change all callers to use this func. + (_gcry_mpi_ec_free): Factor code out to .. + (ec_deinit): New func. + (gcry_mpi_ec_p_new): New. + * src/visibility.c: Include context.h and mpi.h. + (gcry_mpi_ec_p_new, gcry_mpi_ec_get_affine, gcry_mpi_ec_dup) + (gcry_mpi_ec_add, gcry_mpi_ec_mul) + (gcry_ctx_release): New wrapper functions. + * src/visibility.h: Mark new wrapper functions visible. + * src/libgcrypt.def, src/libgcrypt.vers: Add new symbols. + * tests/t-mpi-point.c (print_mpi, hex2mpi, cmp_mpihex): New. + (context_alloc): New. + (make_point, basic_ec_math): New. + + mpi: Add an API for EC point operations. + + commit 7cce620acddac2df024ca421ed3abc32a88f3738 + * mpi/ec.c (gcry_mpi_point_new, gcry_mpi_point_release): New. + (gcry_mpi_point_get, gcry_mpi_point_snatch_get): New. + (gcry_mpi_point_set, gcry_mpi_point_snatch_set): New. + * src/visibility.h, src/visibility.c: Add corresponding macros and + wrappers. + * src/gcrypt.h.in (struct gcry_mpi_point, gcry_mpi_point_t): New. + (gcry_mpi_point_new, gcry_mpi_point_release, gcry_mpi_point_get) + (gcry_mpi_point_snatch_get, gcry_mpi_point_set) + (gcry_mpi_point_snatch_set): New prototypes. + (mpi_point_new, mpi_point_release, mpi_point_get, mpi_point_snatch_get) + (mpi_point_set, mpi_point_snatch_set): New macros. + * src/libgcrypt.vers (gcry_mpi_point_new, gcry_mpi_point_release) + (gcry_mpi_point_get, gcry_mpi_point_snatch_get, gcry_mpi_point_set) + (gcry_mpi_point_snatch_set): New symbols. + * src/libgcrypt.def: Ditto. + * tests/t-mpi-point.c: New. + * tests/Makefile.am (TESTS): Add t-mpi-point + +2013-03-07 Werner Koch <wk@gnupg.org> + + mpi: Add mpi_snatch and change an internal typedef. + + commit 6c4767637c512127a4362732b3ec51068554d328 + * src/mpi.h (struct mpi_point_s): Rename to struct gcry_mpi_point. + (mpi_point_struct): New typedef. + (mpi_point_t): Change typedef to a pointer. Replace all occurrences + to use mpi_point_struct. + * mpi/ec.c (_gcry_mpi_ec_point_init): Rename to .. + (_gcry_mpi_point_init): this. Change all callers. + (_gcry_mpi_ec_point_free): Rename to .. + (_gcry_mpi_point_free_parts): this. Change all callers. + + * mpi/mpiutil.c (gcry_mpi_snatch): New function. + * src/gcrypt.h.in (gcry_mpi_snatch, mpi_snatch): Add protoype and + macro. + * src/visibility.c (gcry_mpi_snatch): Add wrapper. + * src/visibility.h (gcry_mpi_snatch): Add macro magic. + * src/libgcrypt.def, src/libgcrypt.vers: Add new function. + + Pretty print the configure feedback. + + commit c620099e4ab2f35e0196b395a805bb655c984ac2 + * acinclude.m4 (GNUPG_MSG_PRINT): Remove. + (GCRY_MSG_SHOW, GCRY_MSG_WRAP): New. + * configure.ac: Use new macros for the feedback. + +2013-02-20 Werner Koch <wk@gnupg.org> + + Fix building of hwf-x86.c. + + commit 70dcac663de06b012417015c175973d64e6980df + * src/Makefile.am (AM_CFLAGS): Set to GPG_ERROR_CFLAGS + (AM_CCASFLAGS): Set NOEXECSTACK_FLAGS. + + Remove build hacks for FreeBSD. + + commit fb48ebf7081400a24ee48f8a9894a361e8834b6e + * configure.ac [freebsd]: Do not add /usr/local to CPPFLAGS and + LDFLAGS. + +2013-02-19 Jussi Kivilinna <jussi.kivilinna@mbnet.fi> + + Rinjdael: Fix use of SSE2 outside USE_AESNI/ctx->use_aesni. + + commit 0da77955a097bfd2469ad084b3e9fcac4fb1e3fa + * cipher/rijndael.c (_gcry_aes_cbc_enc): Check if AES-NI is enabled before + calling aesni_prepare() and aesni_cleanup(). + + Add AES-NI/AVX accelerated Camellia implementation. + + commit 63ac3ba07dba82fde040d31b90b4eff627bd92b9 + * configure.ac: Add option --disable-avx-support. + (HAVE_GCC_INLINE_ASM_AVX): New. + (ENABLE_AVX_SUPPORT): New. + (camellia) [ENABLE_AVX_SUPPORT, ENABLE_AESNI_SUPPORT]: Add + camellia_aesni_avx_x86-64.lo. + * cipher/Makefile.am (AM_CCASFLAGS): Add. + (EXTRA_libcipher_la_SOURCES): Add camellia_aesni_avx_x86-64.S + * cipher/camellia-glue.c [ENABLE_AESNI_SUPPORT, ENABLE_AVX_SUPPORT] + [__x86_64__] (USE_AESNI_AVX): Add macro. + (struct Camellia_context) [USE_AESNI_AVX]: Add use_aesni_avx. + [USE_AESNI_AVX] (_gcry_camellia_aesni_avx_ctr_enc) + (_gcry_camellia_aesni_avx_cbc_dec): New prototypes to assembly + functions. + (camellia_setkey) [USE_AESNI_AVX]: Enable AES-NI/AVX if hardware + support both. + (_gcry_camellia_ctr_enc) [USE_AESNI_AVX]: Add AES-NI/AVX code. + (_gcry_camellia_cbc_dec) [USE_AESNI_AVX]: Add AES-NI/AVX code. + * cipher/camellia_aesni_avx_x86-64.S: New. + * src/g10lib.h (HWF_INTEL_AVX): New. + * src/global.c (hwflist): Add HWF_INTEL_AVX. + * src/hwf-x86.c (detect_x86_gnuc) [ENABLE_AVX_SUPPORT]: Add detection + for AVX. + + camellia.c: Prepare for AES-NI/AVX implementation. + + commit 4de62d80644228fc5db2a9f9c94a7eb633d8de2e + * cipher/camellia-glue.c (CAMELLIA_encrypt_stack_burn_size) + (CAMELLIA_decrypt_stack_burn_size): Increase stack burn size. + * cipher/camellia.c (CAMELLIA_ROUNDSM): Move key-material mixing in + the front. + (camellia_setup128, camellia_setup256): Remove now unneeded + key-material mangling. + (camellia_encrypt128, camellia_decrypt128, amellia_encrypt256) + (camellia_decrypt256): Copy block to stack, so that compiler can + optimize it for register usage. + + Camellia, prepare glue code for AES-NI/AVX implementation. + + commit 537f12ce072d568f9fa344c447d32b2e0efffbe8 + * cipher/camellia-glue.c (ATTR_ALIGNED_16): Add macro. + (CAMELLIA_encrypt_stack_burn_size): Add macro. + (camellia_encrypt): Use macro above for stack burn size. + (CAMELLIA_decrypt_stack_burn_size): Add macro. + (camellia_decrypt): Use macro above for stack burn size. + (_gcry_camellia_ctr_enc): New function. + (_gcry_camellia_cbc_dec): New function. + (selftest_ctr_128): New function. + (selftest): Call function above. + * cipher/cipher.c (gcry_cipher_open) [USE_CAMELLIA]: Register bulk + functions for CBC-decryption and CTR-mode. + * src/cipher.h (_gcry_camellia_ctr_enc): New prototype. + (_gcry_camellia_cbc_dec): New prototype. + +2012-12-21 Werner Koch <wk@gnupg.org> + + Prepare for hardware feature detection on other platforms. + + commit 09ac5d87d11aa0b1fa0e0a4184ab03b3671a73e2 + * configure.ac (GCRYPT_HWF_MODULES): New. + (HAVE_CPU_ARCH_X86, HAVE_CPU_ARCH_ALPHA, HAVE_CPU_ARCH_SPARC) + (HAVE_CPU_ARCH_MIPS, HAVE_CPU_ARCH_M68K, HAVE_CPU_ARCH_PPC) + (HAVE_CPU_ARCH_ARM): New AC_DEFINEs. + * mpi/config.links (mpi_cpu_arch): New. + * src/global.c (print_config): Print new tag "cpu-arch". + * src/Makefile.am (libgcrypt_la_SOURCES): Add hwf-common.h + (EXTRA_libgcrypt_la_SOURCES): New. + (gcrypt_hwf_modules): New. + (libgcrypt_la_DEPENDENCIES, libgcrypt_la_LIBADD): Add that one. + * src/hwfeatures.c: Factor most code out to ... + * src/hwf-x86.c: New file. + (detect_x86_gnuc): Return the feature vector. + (_gcry_hwf_detect_x86): New. + * src/hwf-common.h: New. + * src/hwfeatures.c (_gcry_detect_hw_features): Dispatch using + HAVE_CPU_ARCH_ macros. + +2012-12-21 Jussi Kivilinna <jussi.kivilinna@mbnet.fi> + + Clean up i386/x86-64 cpuid usage in hwfeatures.c. + + commit d842eea55e22c05da3959a7a4422b5fcd7884f60 + * src/hwfeatures.c [__i386__ && __GNUC__] (detect_ia32_gnuc): Remove. + [__x86_64__ && __GNUC__] (detect_x86_64_gnuc): Remove. + [__i386__ && __GNUC__] (is_cpuid_available, get_cpuid) + (HAS_X86_CPUID): New. + [__x86_64__ && __GNUC__] (is_cpuid_available, get_cpuid) + (HAS_X86_CPUID): New. + [HAS_X86_CPUID] (detect_x86_gnuc): New. + (_gcry_detect_hw_features) [__i386__ && GNUC]: Remove detect_ia32_gnuc + call. + (_gcry_detect_hw_features) [__x86_64__ && GNUC]: Remove + detect_x86_64_gnuc call. + (_gcry_detect_hw_features) [HAS_X86_CPUID]: Add detect_x86_gnuc call. + +2012-12-18 Dmitry Kasatkin <dmitry.kasatkin@intel.com> + + Add support for using DRNG random number generator. + + commit efd7002188e6d50013e4d9a920a8b9afa9d210e5 + * configure.ac: Add option --disable-drng-support. + (ENABLE_DRNG_SUPPORT): New. + * random/rndhw.c (USE_DRNG): New. + (rdrand_long, rdrand_nlong, poll_drng): New. + (_gcry_rndhw_poll_fast, _gcry_rndhw_poll_slow): Call poll function. + * src/g10lib.h (HWF_INTEL_RDRAND): New. + * src/global.c (hwflist): Add "intel-rdrand". + * src/hwfeatures.c (detect_x86_64_gnuc) [ENABLE_DRNG_SUPPORT]: Detect + RDRAND. + (detect_ia32_gnuc) [ENABLE_DRNG_SUPPORT]: Detect RDRAND. + +2012-12-03 Werner Koch <wk@gnupg.org> + + random: Add a RNG selection interface and system RNG wrapper. + + commit 7607ab81504ce44060ed0b331d309606f5da1e75 + * random/random-system.c: New. + * random/Makefile.am (librandom_la_SOURCES): Add new module. + * random/random.c (struct rng_types): New. + (_gcry_set_preferred_rng_type, _gcry_get_rng_type): New. + (_gcry_random_initialize, gcry_random_add_bytes, do_randomize) + (_gcry_set_random_seed_file, _gcry_update_random_seed_file) + (_gcry_fast_random_poll): Dispatch to the actual RNG. + * src/gcrypt.h.in (GCRYCTL_SET_PREFERRED_RNG_TYPE): New. + GCRYCTL_GET_CURRENT_RNG_TYPE): New. + (gcry_rng_types): New. + * src/global.c (print_config): Print the TNG type. + (global_init, _gcry_vcontrol): Implement the new control codes. + * doc/gcrypt.texi (Controlling the library): Document the new control + codes. + + * tests/benchmark.c (main): Add options to test the RNG types. + * tests/random.c (main): Add new options. + (print_hex): Print to stderr. + (progress_cb, rng_type): New. + (check_rng_type_switching, check_early_rng_type_switching): New. + (run_all_rng_tests): New. + + tests: Allow use of random.c under Windows. + + commit 76c622e24a07f7c826812be173aa173b4334776b + * tests/Makefile.am (TESTS): Always include random.c + * tests/random.c [!W32]: Include sys/wait.h. + (inf): New. + (check_forking, check_nonce_forking): Print a notice what will be done. + (main) [W32]: Do not call signal. + + Make random-fips.c work multi-threaded. + + commit 75760021b511ba438606af746431223357e7a155 + * random/random-fips.c (basic_initialization): Fix reversed logic. + + Move nonce creation from csprng backend to random main module. + + commit c324644aa14e54fc7051983b38222db32b8ab227 + * random/random-csprng.c (_gcry_rngcsprng_create_nonce): Remove. + (nonce_buffer_lock): Remove. + (initialize_basics): Remove init of nonce_buffer_lock. + * random/random.c: Add a few header files. + (nonce_buffer_lock): New. + (_gcry_random_initialize): Init nonce_buffer_lock. + (gcry_create_nonce): Add code from _gcry_rngcsprng_create_nonce. + + * random/random-daemon.c (_gcry_daemon_create_nonce): Remove. + +2012-12-03 Jussi Kivilinna <jussi.kivilinna@mbnet.fi> + + Fix building with CC="gcc -std=c90". + + commit f851b9a932ee64fa5a06000d1ac763ba4349f07d + * configure.ac: Add check for missing 'asm' keyword in C90 mode and + replacement with '__asm__'. + +2012-12-03 Werner Koch <wk@gnupg.org> + + Try to use inttypes.h if stdint.h is not available. + + commit d9ec7aec1301b13a89e5c9c54d7ad52e1a29b846 + * cipher/bufhelp.h [HAVE_INTTYPES_H]: Include inttypes.h + +2012-12-03 Jussi Kivilinna <jussi.kivilinna@mbnet.fi> + + Optimize buffer xoring. + + commit 162791bc08f4fc9b3882671e68ecdfd9e130ae59 + * cipher/Makefile.am (libcipher_la_SOURCES): Add 'bufhelp.h'. + * cipher/bufhelp.h: New. + * cipher/cipher-aeswrap.c (_gcry_cipher_aeswrap_encrypt) + (_gcry_cipher_aeswrap_decrypt): Use 'buf_xor' for buffer xoring. + * cipher/cipher-cbc.c (_gcry_cipher_cbc_encrypt) + (_gcry_cipher_cbc_decrypt): Use 'buf_xor' for buffer xoring and remove + resulting unused variables. + * cipher/cipher-cfb.c (_gcry_cipher_cfb_encrypt) Use 'buf_xor_2dst' + for buffer xoring and remove resulting unused variables. + (_gcry_cipher_cfb_decrypt): Use 'buf_xor_n_copy' for buffer xoring and + remove resulting unused variables. + * cipher/cipher-ctr.c (_gcry_cipher_ctr_encrypt): Use 'buf_xor' for + buffer xoring and remove resulting unused variables. + * cipher/cipher-ofb.c (_gcry_cipher_ofb_encrypt) + (_gcry_cipher_ofb_decrypt): Use 'buf_xor' for buffer xoring and remove + resulting used variables. + * cipher/rijndael.c (_gry_aes_cfb_enc): Use 'buf_xor_2dst' for buffer + xoring and remove resulting unused variables. + (_gry_aes_cfb_dev): Use 'buf_xor_n_copy' for buffer xoring and remove + resulting unused variables. + (_gry_aes_cbc_enc, _gry_aes_ctr_enc, _gry_aes_cbc_dec): Use 'buf_xor' + for buffer xoring and remove resulting unused variables. + +2012-11-29 Jussi Kivilinna <jussi.kivilinna@mbnet.fi> + + Optimize AES-NI CTR mode. + + commit 9ee9e25f519696d509b1a5c1cc04ab0121e98a51 + * cipher/rijndael.c [USE_AESNI] (do_aesni_ctr, do_aesni_ctr_4): Make + handling of 64-bit overflow and carry conditional. Avoid generic to + vector register passing of value '1'. Generate and use '-1' instead. + +2012-11-28 Werner Koch <wk@gnupg.org> + + Make a cpp conditional in rijndael.c better readable. + + commit 6765e0a8618000d3dc7bda035163e0708c43791b + * cipher/rijndael.c (USE_AESNI): Modify cpp conditionals for better + readability. + +2012-11-28 Jussi Kivilinna <jussi.kivilinna@mbnet.fi> + + Fix building with Clang on x86-64 and i386. + + commit 99e272d938fe23efec25af409bdb91dae0e659e5 + * cipher/rijndael.c [USE_AESNI] (do_aesni_enc_aligned) + (do_aesni_dec_vec4, do_aesni_cfb, do_aesni_ctr, do_aesni_ctr_4): Add + explicit suffix to 'cmp' instructions. + +2012-11-26 Jussi Kivilinna <jussi.kivilinna@mbnet.fi> + + Optimize wipememory2 for i386 and x86-64. + + commit faec12e23f03c7cd1614594bfdd51f1302cadb42 + * src/g10lib.h (wipememory2): Add call to fast_wipememory2. + (fast_wipememory2): New macros for i386 and x86-64 architectures. + Empty macro provided for other architectures. + + Fix missing 64bit carry handling in AES-NI CTR mode. + + commit fc37e805c6394c2e635d1a033670be961f36a6d2 + * cipher/rijndael.c [USE_AESNI] (do_aesni_ctr, do_aesni_ctr_4): Add + carry handling to 64-bit addition. + (selftest_ctr_128): New function for testing IV handling in bulk CTR + function. + (selftest): Add call to selftest_ctr_128. + + Add parallelized AES-NI CBC decryption. + + commit 35aff0cd43885b5f5c076432ec614698abeb63d8 + * cipher/rijndael.c [USE_AESNI] (aesni_cleanup_5): New macro. + [USE_AESNI] (do_aesni_dec_vec4): New function. + (_gcry_aes_cbc_dec) [USE_AESNI]: Add parallelized CBC loop. + (_gcry_aes_cbc_dec) [USE_AESNI]: Change IV storage register from xmm3 + to xmm5. + + Clear xmm5 after use in AES-NI CTR mode. + + commit 5acd0e5ae2a58dda51c2b56c879b80a1a6d2c42f + * cipher/rijndael.c [USE_AESNI]: Rename aesni_cleanup_2_4 to + aesni_cleanup_2_5. + [USE_AESNI] (aesni_cleanup_2_5): Clear xmm5 register. + (_gcry_aes_ctr_enc, _gcry_aes_cbc_dec) [USE_AESNI]: Use + aesni_cleanup_2_5 instead of aesni_cleanup_2_4. + + Optimize AES-NI CBC encryption. + + commit be3768994ad362dfc849a8cd0146b4c9bb287d20 + * cipher/rijndeal.c (_gcry_aes_cbc_enc) [USE_AESNI]: Add AES-NI + spesific loop and use SSE2 assembler for xoring and copying of + blocks. + + Improve parallelizability of CBC decryption for AES-NI. + + commit 3369d960158ab4231b83926a0f982e2a8819f173 + * cipher/rijndael.c (_gcry_aes_cbc_dec) [USE_AESNI]: Add AES-NI + specific CBC mode loop with temporary block and IV stored in free SSE + registers. + + Extend test of chained modes for 128bit ciphers. + + commit 55b96be08531664ed3f4230acebe0f45954bbc33 + * tests/basic.c (check_one_cipher_core, check_one_cipher): Increase + input and output buffer sizes from 16 bytes to 1024+16=1040 bytes. + (check_one_cipher_core): Add asserts to verify sizes of temporary + buffers. + +2012-11-21 Werner Koch <wk@gnupg.org> + + Fix for strict aliasing rules. + + commit dfb4673da8ee52d95e0a62c9f49ca8599943f22e + * cipher/rijndael.c (do_setkey, prepare_decryption): Use u32_a_t for + casting. + + Do not detect AES-NI support if disabled by configure. + + commit 3047795794eb238aa684bd0729acf64c82a19e09 + * src/hwfeatures.c (detect_ia32_gnuc): Detect AESNI support only if + that support has been enabled. + +2012-11-21 Jussi Kivilinna <jussi.kivilinna@mbnet.fi> + + Fix too large burn_stack in camellia-glue.c. + + commit 8afabc2813948778a3db52d9dee9a041a3dd50d4 + * cipher/camellia-glue.c (camellia_encrypt, camellia_decrypt): Do not + take full array size of KEY_TABLE_TYPE, but argument size instead. + + Add x86_64 support for AES-NI. + + commit d8bdfa42ed582655c180e7db9b16d4e756a12a6e + * cipher/rijndael.c [ENABLE_AESNI_SUPPORT]: Enable USE_AESNI on x86-64. + (do_setkey) [USE_AESNI_is_disabled_here]: Use %[key] and %[ksch] + directly as registers instead of using temporary register %%esi. + [USE_AESNI] (do_aesni_enc_aligned, do_aesni_dec_aligned, do_aesni_cfb, + do_aesni_ctr, do_aesni_ctr_4): Use %[key] directly as register instead + of using temporary register %%esi. + [USE_AESNI] (do_aesni_cfb, do_aesni_ctr, do_aesni_ctr_4): Change %[key] + from generic "g" type to register "r". + * src/hwfeatures.c (_gcry_detect_hw_features) [__x86_64__]: Do not + clear AES-NI feature flag. + + Fix cpuid vendor-id check for i386 and x86-64. + + commit 9e1552517f68459a165ddebbba85e7cf37ff4f0c + * src/hwfeatures.c (detect_x86_64_gnuc, detect_ia32_gnuc): Allow + Intel features be detect from CPU by other vendors too. + + Fix hwdetect assembler clobbers. + + commit 19b9efd1f47a5de9c450ce8212dfa3174a029c7a + * src/hwfeatures.c (detect_x86_64_gnuc): Add missing %ebx assembler + clobbers. + (detect_x86_64_gnuc, detect_ia32_gnuc) [ENABLE_PADLOCK_SUPPORT]: Add + missing %ecx assembler clobbers. + +2012-11-21 Werner Koch <wk@gnupg.org> + + Use configure test for aligned attribute. + + commit 6368ed542150956ff4ba8170a15bbc534143675c + * configure.ac (HAVE_GCC_ATTRIBUTE_ALIGNED): New test and ac_define. + * cipher/cipher-internal.h, cipher/rijndael.c, random/rndhw.c: Use new + macro instead of a fixed test for __GNUC__. + + Fix segv with AES-NI on some platforms. + + commit a96974de734beb51a733a89b3283bcf7b433b54c + * cipher/rijndael.c (RIJNDAEL_context): Align on 16 bytes. + +2012-11-16 Werner Koch <wk@gnupg.org> + + Improve parsing of the GIT revision number. + + commit 4b18e530f417d4af401a3fd721ad2a07e5310e3e + * configure.ac (mmm4_revision): Use git rev-parse. + +2012-11-08 Werner Koch <wk@gnupg.org> + + Fix extern inline use for gcc > 4.3 in c99 mode. + + commit 5abc06114e91beca0177331e1c79815f5fb6d7be + * mpi/mpi-inline.h [!G10_MPI_INLINE_DECL]: Take care of changed extern + inline semantics in gcc. + +2012-11-07 Werner Koch <wk@gnupg.org> + + Fix memory leak in gcry_pk_testkey for ECC. + + commit 8cbbad5f94f6e0429fffe66d689aea20f7e35957 + * cipher/ecc.c (check_secret_key): Restructure for easier allocation + tracking. Fix memory leak. + +2012-11-05 Werner Koch <wk@gnupg.org> + + Prepare for a backported interface in 1.5.1. + + commit 7af98ef78d45e813f47ae4e180a02757a379953f + * configure.ac: Bump LT version at C20/A0/R0 to adjust for a planned + API update in 1.5.1. + + Adjust for stricter autoconf requirements. + + commit 1241fbbc896e9bbad68f1007a17b20493f6cd1af + * configure.ac: Fix usage of AC_LANG_PROGRAM. + + Update build helper scripts. + + commit a5c4d45e8d12737cd21b095c81da5c18e2afc39e + * config.guess, config.sub: Update to version 2012-07-31. + * ltmain.sh: Update to version 2.4.2. + * install-sh, m4/libtool.m4, m4/ltoptions.m4, m4/ltversion.m4 + * m4/lt~obsolete.m4: Update to autoconf 2.69 versions. + + Do not distribute a copy of gitlog-to-changelog. + + commit 40976d7da5420453bf93a9c99f0cc4c7044d0774 + * Makefile.am (GITLOG_TO_CHANGELOG): New. + (gen-ChangeLog): Require an installed gitlog-to-changelog. + * scripts/gitlog-to-changelog: Remove. + + * README.SVN: Remove. + * REMOVE.GIT: New. + + Allow building with w64-mingw32. + + commit 4f6fb150558d0ed250bfbd50352c258a4456ba50 + * autogen.sh <--build-w32>: Support the w64-mingw32 toolchain. Also + prepare for 64 bit building. + <git-setup>: Remove option -c from chmod. + + Switch to the new automagic beta numbering scheme. + + commit 7d5195be76d9dd4adc28976ad153e8f7761c5855 + * configure.ac: Add all the required m4 magic. + + Avoid dereferencing pointer right after the end. + + commit 79502e2c1982047dcf2b776f52826f38bbd9b1fe + * mpi/mpicoder.c (do_get_buffer): Check the length before derefing P. + +2012-10-30 Werner Koch <wk@gnupg.org> + + Make ancient test program useful again. + + commit 66adf76e634423bb72ce1f0b5ed78f4e4798f190 + * tests/testapi.c (test_sexp): Adjust to current API. Print the + return code. Mark unused args. + (test_genkey): Mark unused args. + (main): Do not pass NULL to printf. + + tests: Add ECC key generation tests. + + commit c13164884ade6b1e945cddacce2d244fd881de6b + * tests/keygen.c (check_generated_ecc_key): New. + (check_ecc_keys): New. + (main): Call simple ECC checks. + +2012-10-30 Milan Broz <mbroz@redhat.com> + + PBKDF2: Allow empty passphrase. + + commit 8528f1ba40e587dc17e02822e529fbd7ac69a189 + * cipher/kdf.c (gcry_kdf_derive): Allow empty passphrase for PBKDF2. + * tests/t-kdf.c (check_pbkdf2): Add test case for above. + +2012-08-16 Xi Wang <xi.wang@gmail.com> + + Replace deliberate division by zero with _gcry_divide_by_zero. + + commit 2c54c4da19d3a79e9f749740828026dd41f0521a + * mpi/mpi-pow.c: Replace 1 / msize. + * mpi/mpih-div.c: Replace 1 / dsize. + * src/misc.c: Add _gcry_divide_by_zero. + +2012-06-21 Werner Koch <wk@gnupg.org> + + Clear AESNI feature flag for x86_64. + + commit 2196728e2252917849c1be94417258076767021b + * src/hwfeatures.c (_gcry_detect_hw_features) [__x86_64__]: Clear + AESNI feature flag. + + Beautify last change. + + commit 20e423212c9710ee663e12dd0f62580ceb245a6f + * cipher/rijndael.c: Replace C99 feature from last patch. Keep cpp + lines short. + * random/rndhw.c: Keep cpp lines short. + * src/hwfeatures.c (_gcry_detect_hw_features): Make cpp def chain + better readable. + +2012-06-21 Rafaël Carré <funman@videolan.org> + + Enable VIA Padlock on x86_64 platforms. + + commit baf0dc7e9c26167ab43ba2adebcf2f1abc9d9b3b + * cipher/rijndael.c: Duplicate x86 assembly and convert to x86_64. + * random/rndhw.c: Likewise. + * src/hwfeatures.c: Likewise. + +2012-05-14 Werner Koch <wk@gnupg.org> + + Add curve aliases from RFC-5656. + + commit 39c123b729a472ace039f8536d07f8b9a5f4675a + * cipher/ecc.c (curve_aliases): Add "nistp???" entries. + +2012-04-16 Werner Koch <wk@gnupg.org> + + State new contribution rules. + + commit 3bb858551cd5d84e43b800edfa2b07d1529718a9 + * doc/DCO: New. + * doc/HACKING: Document new rules. + +2012-04-04 Tomas Mraz <tmraz@fedoraproject.org> + + Add GCRYCTL_SET_ENFORCED_FIPS_FLAG command. + + commit 90e49a11733bfba9c3c505ac487282d35757f682 + * doc/gcrypt.texi: Add documentation of the new command. + * src/fips.c (_gcry_enforced_fips_mode): Report the enforced fips mode + only when fips mode is enabled. + (_gcry_set_enforced_fips_mode): New function. + * src/g10lib.h: Add the _gcry_set_enforced_fips_mode prototype. + * src/gcrypt.h.in: Add the GCRYCTL_SET_ENFORCED_FIPS_FLAG. + * src/global.c (_gcry_vcontrol): Handle the new command. + +2012-02-17 Ulrich Müller <ulm@gentoo.org> + + Rework selftest in idea.c. + + commit 70cca617ed75ea292e1fed769114dda5cc1d76f1 + * cipher/idea.c (do_setkey): Execute selftest when first called. + (decrypt_block): Remove commented-out code. + (selftest): Execute all selftests. Return NULL on success, or + string in case of error. + +2012-02-16 Werner Koch <wk@gnupg.org> + + Fix missing prototype. + + commit 46035d28c9b413851d43a4008fdc8e4cdf5d686b + * src/g10lib.h (_gcry_secmem_module_init): Make it a real prototype. + +2012-02-16 Ulrich Müller <ulm@gentoo.org> + + Add support for the IDEA cipher. + + commit 318fd85f377c060908d371f792d41e599b3b7483 + Adapt idea.c to the Libgcrypt framework. + Add IDEA to cipher_table and to the build system. + + Patents on IDEA have expired: + Europe: EP0482154 on 2011-05-16, + Japan: JP3225440 on 2011-05-16, + U.S.: 5,214,703 on 2012-01-07. + + * configure.ac: Add idea to the list of available ciphers. + Define USE_IDEA if idea is enabled. + * cipher/cipher.c (cipher_table): Add entry for IDEA. + * cipher/idea.c: Update comment about patents. + Include proper header files and remove redundant declarations. + (expand_key, cipher, do_setkey, encrypt_block, decrypt_block): + Define function arguments as const where appropriate. + (cipher): Test for !WORDS_BIGENDIAN instead of LITTLE_ENDIAN_HOST. + (do_setkey, decrypt_block): Don't call selftest. + (idea_setkey): New function, wrapper for do_setkey. + (idea_encrypt): New function, wrapper for encrypt_block. + (_gcry_cipher_spec_idea): Define. + * cipher/Makefile.am (EXTRA_libcipher_la_SOURCES): Add idea.c. + * src/cipher.h (_gcry_cipher_spec_idea): Declare. + * tests/basic.c (check_ciphers): Add GCRY_CIPHER_IDEA. + +2012-01-09 Werner Koch <wk@gnupg.org> + + Include an IDEA implementation. + + commit 6078b05f5340d886e0b9e6cee1d9b5043e0cb210 + The code is the old IDEA test code, written by me back in 1997 and + distributed on a Danish FTP server. This commit is only for + reference. To use the code it has to be adjusted to the Libgcrypt + framework. + +2012-01-03 Marcus Brinkmann <marcus.brinkmann@ruhr-uni-bochum.de> + + Fix pthread locking and remove defunctional support for static lock init. + + commit 38fcd59ce774eaa3d65f2f7534c989afd860eb56 + * src/ath.c: Include assert.h. + (ath_mutex_destroy, ath_mutex_lock, ath_mutex_unlock): Dereference LOCK. + * src/g10lib.h (_gcry_secmem_module_init): New declaration. + * src/global.c (global_init): Call _gcry_secmem_module_init. + * src/secmem.c (_gcry_secmem_module_init): New function. + +2011-12-16 Werner Koch <wk@gnupg.org> + + Add alignment tests for the cipher tests. + + commit 14cf1f7e338fedb8edaff5631441746605152bd6 + * tests/basic.c (check_one_cipher): Factor most code out to + check_one_cipher_core. Call that core function several times using + different alignment settings. + (check_one_cipher_core): New. Add extra args to allow alignment + testing. + +2011-12-07 Werner Koch <wk@gnupg.org> + + tests/prime: Add option to create a well known private key. + + commit 16f5654643d584e3bc739b636752d779176b2191 + * tests/prime.c (print_mpi, create_42prime): New. + (main): Add option --42. + +2011-12-01 Werner Koch <wk@gnupg.org> + + Do not build the random-daemon by make distcheck. + + commit ea1fb538d99f1ec093f2fef86f4f29176ec27826 + * Makefile.am (DISTCHECK_CONFIGURE_FLAGS): Disable building of the + random daemon + + Generate the ChangeLog from commit logs. + + commit 137d73191c904926ba529376144ee8239af4ca02 + * scripts/gitlog-to-changelog: New script. Taken from gnulib. + * scripts/git-log-fix: New file. + * scripts/git-log-footer: New file. + * doc/HACKING: Describe the ChangeLog policy + * ChangeLog: New file. + * Makefile.am (EXTRA_DIST): Add new files. + (gen-ChangeLog): New. + (dist-hook): Run gen-ChangeLog. + + Rename all ChangeLog files to ChangeLog-2011. + +2011-12-01 Werner Koch <wk@gnupg.org> + + NB: Changes done before December 1st, 2011 are described in + per directory files named ChangeLog-2011. See doc/HACKING for + details. + + ----- + Copyright (C) 2011 Free Software Foundation, Inc. + + Copying and distribution of this file and/or the original GIT + commit log messages, with or without modification, are + permitted provided the copyright notice and this notice are + preserved. |