rpms
/
nettle
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

merge into: rpms:c8
Branches Tags
rpms:c8
rpms:c9-beta
rpms:c9s
rpms:c9
rpms:c8-beta
rpms:c8s
rpms:imports/c9/nettle-3.8-3.el9_0
rpms:imports/c9-beta/nettle-3.8-3.el9_0
rpms:imports/c9/nettle-3.7.3-2.el9
rpms:imports/c9-beta/nettle-3.7.3-2.el9
rpms:imports/c8/nettle-3.4.1-7.el8
rpms:imports/c8-beta/nettle-3.4.1-7.el8
rpms:imports/c8-beta/nettle-3.4.1-2.el8
rpms:imports/c8-beta/nettle-3.4.1-1.el8
rpms:imports/c8s/nettle-3.4.1-7.el8
rpms:imports/c8s/nettle-3.4.1-5.el8
rpms:imports/c8s/nettle-3.4.1-2.el8
rpms:imports/c8/nettle-3.4.1-4.el8_3
rpms:imports/c8/nettle-3.4.1-2.el8
rpms:imports/c8/nettle-3.4.1-1.el8
...
pull from: rpms:c9
Branches Tags
rpms:c9-beta
rpms:c9s
rpms:c9
rpms:c8
rpms:c8-beta
rpms:c8s
rpms:imports/c9/nettle-3.8-3.el9_0
rpms:imports/c9-beta/nettle-3.8-3.el9_0
rpms:imports/c9/nettle-3.7.3-2.el9
rpms:imports/c9-beta/nettle-3.7.3-2.el9
rpms:imports/c8/nettle-3.4.1-7.el8
rpms:imports/c8-beta/nettle-3.4.1-7.el8
rpms:imports/c8-beta/nettle-3.4.1-2.el8
rpms:imports/c8-beta/nettle-3.4.1-1.el8
rpms:imports/c8s/nettle-3.4.1-7.el8
rpms:imports/c8s/nettle-3.4.1-5.el8
rpms:imports/c8s/nettle-3.4.1-2.el8
rpms:imports/c8/nettle-3.4.1-4.el8_3
rpms:imports/c8/nettle-3.4.1-2.el8
rpms:imports/c8/nettle-3.4.1-1.el8

No commits in common. "c8" and "c9" have entirely different histories.
c8 ... c9

13 changed files with 4112 additions and 3848 deletions
Show Stats Expand all files Collapse all files

3
.gitignore vendored
View File

@ -1 +1,2 @@
SOURCES/nettle-3.4.1-hobbled.tar.xz
SOURCES/gmp-6.2.1.tar.xz
SOURCES/nettle-3.8-hobbled.tar.xz

3
.nettle.metadata
View File

@ -1 +1,2 @@
be5faff0092a6d78186484374c0ea20465eb218c SOURCES/nettle-3.4.1-hobbled.tar.xz
0578d48607ec0e272177d175fd1807c30b00fdf2 SOURCES/gmp-6.2.1.tar.xz
c809f048a71b322453c18e30986a18e600306d77 SOURCES/nettle-3.8-hobbled.tar.xz

3515
SOURCES/gmp-6.2.1-intel-cet.patch Normal file
View File

File diff suppressed because it is too large Load Diff

53
SOURCES/gmp-6.2.1-zeroize-allocator.patch Normal file
View File

@ -0,0 +1,53 @@
diff -r e3123b88d012 memory.c
--- a/memory.c Tue Aug 16 22:02:45 2022 +0200
+++ b/memory.c Fri Aug 19 06:25:37 2022 +0900
@@ -29,7 +29,8 @@
see https://www.gnu.org/licenses/. */
#include <stdio.h>
-#include <stdlib.h> /* for malloc, realloc, free */
+#include <stdlib.h> /* for malloc, free */
+#include <string.h> /* for memcpy, explicit_bzero */
#include "gmp-impl.h"
@@ -98,11 +99,28 @@
new_size += 2 * GMP_LIMB_BYTES;
#endif
- ret = realloc (oldptr, new_size);
- if (ret == 0)
+ if (new_size == 0)
+ {
+ explicit_bzero (oldptr, old_size);
+ free (oldptr);
+ return NULL;
+ }
+ else if (old_size == new_size)
+ return oldptr;
+ else
{
- fprintf (stderr, "GNU MP: Cannot reallocate memory (old_size=%lu new_size=%lu)\n", (long) old_size, (long) new_size);
- abort ();
+ /* We can't simply call realloc, as it may allocate memory from
+ a different arena. */
+ ret = malloc (new_size);
+ if (ret == NULL)
+ {
+ fprintf (stderr, "GNU MP: Cannot reallocate memory (old_size=%lu new_size=%lu)\n", (long) old_size, (long) new_size);
+ explicit_bzero(oldptr, old_size);
+ abort();
+ }
+ memcpy (ret, oldptr, MIN(old_size, new_size));
+ explicit_bzero (oldptr, old_size);
+ free (oldptr);
}
#ifdef DEBUG
@@ -141,5 +159,6 @@
blk_ptr = p - 1;
}
#endif
+ explicit_bzero (blk_ptr, blk_size);
free (blk_ptr);
}

181
SOURCES/nettle-3.3-remove-ecc-testsuite.patch
View File

@ -1,181 +0,0 @@
diff --git a/examples/ecc-benchmark.c b/examples/ecc-benchmark.c
index 8e5e095..720d483 100644
--- a/examples/ecc-benchmark.c
+++ b/examples/ecc-benchmark.c
@@ -330,8 +330,6 @@ bench_curve (const struct ecc_curve *ecc)
}
const struct ecc_curve * const curves[] = {
- &nettle_secp_192r1,
- &nettle_secp_224r1,
&_nettle_curve25519,
&nettle_secp_256r1,
&nettle_secp_384r1,
diff --git a/examples/hogweed-benchmark.c b/examples/hogweed-benchmark.c
index 3fabe20..0223fe7 100644
--- a/examples/hogweed-benchmark.c
+++ b/examples/hogweed-benchmark.c
@@ -393,24 +393,6 @@ bench_ecdsa_init (unsigned size)
switch (size)
{
- case 192:
- ecc = &nettle_secp_192r1;
- xs = "8e8e07360350fb6b7ad8370cfd32fa8c6bba785e6e200599";
- ys = "7f82ddb58a43d59ff8dc66053002b918b99bd01bd68d6736";
- zs = "f2e620e086d658b4b507996988480917640e4dc107808bdd";
- ctx->digest = hash_string (&nettle_sha1, "abc");
- ctx->digest_size = 20;
- break;
- case 224:
- ecc = &nettle_secp_224r1;
- xs = "993bf363f4f2bc0f255f22563980449164e9c894d9efd088d7b77334";
- ys = "b75fff9849997d02d135140e4d0030944589586e22df1fc4b629082a";
- zs = "cdfd01838247f5de3cc70b688418046f10a2bfaca6de9ec836d48c27";
- ctx->digest = hash_string (&nettle_sha224, "abc");
- ctx->digest_size = 28;
- break;
-
- /* From RFC 4754 */
case 256:
ecc = &nettle_secp_256r1;
xs = "2442A5CC 0ECD015F A3CA31DC 8E2BBC70 BF42D60C BCA20085 E0822CB0 4235E970";
@@ -581,16 +563,6 @@ bench_openssl_ecdsa_init (unsigned size)
switch (size)
{
- case 192:
- ctx->key = EC_KEY_new_by_curve_name (NID_X9_62_prime192v1);
- ctx->digest_length = 24; /* truncated */
- ctx->digest = hash_string (&nettle_sha224, "abc");
- break;
- case 224:
- ctx->key = EC_KEY_new_by_curve_name (NID_secp224r1);
- ctx->digest_length = SHA224_DIGEST_SIZE;
- ctx->digest = hash_string (&nettle_sha224, "abc");
- break;
case 256:
ctx->key = EC_KEY_new_by_curve_name (NID_X9_62_prime256v1);
ctx->digest_length = SHA256_DIGEST_SIZE;
@@ -701,14 +673,10 @@ struct alg alg_list[] = {
#if 0
{ "dsa",2048, bench_dsa_init, bench_dsa_sign, bench_dsa_verify, bench_dsa_clear },
#endif
- { "ecdsa", 192, bench_ecdsa_init, bench_ecdsa_sign, bench_ecdsa_verify, bench_ecdsa_clear },
- { "ecdsa", 224, bench_ecdsa_init, bench_ecdsa_sign, bench_ecdsa_verify, bench_ecdsa_clear },
{ "ecdsa", 256, bench_ecdsa_init, bench_ecdsa_sign, bench_ecdsa_verify, bench_ecdsa_clear },
{ "ecdsa", 384, bench_ecdsa_init, bench_ecdsa_sign, bench_ecdsa_verify, bench_ecdsa_clear },
{ "ecdsa", 521, bench_ecdsa_init, bench_ecdsa_sign, bench_ecdsa_verify, bench_ecdsa_clear },
#if WITH_OPENSSL
- { "ecdsa (openssl)", 192, bench_openssl_ecdsa_init, bench_openssl_ecdsa_sign, bench_openssl_ecdsa_verify, bench_openssl_ecdsa_clear },
- { "ecdsa (openssl)", 224, bench_openssl_ecdsa_init, bench_openssl_ecdsa_sign, bench_openssl_ecdsa_verify, bench_openssl_ecdsa_clear },
{ "ecdsa (openssl)", 256, bench_openssl_ecdsa_init, bench_openssl_ecdsa_sign, bench_openssl_ecdsa_verify, bench_openssl_ecdsa_clear },
{ "ecdsa (openssl)", 384, bench_openssl_ecdsa_init, bench_openssl_ecdsa_sign, bench_openssl_ecdsa_verify, bench_openssl_ecdsa_clear },
{ "ecdsa (openssl)", 521, bench_openssl_ecdsa_init, bench_openssl_ecdsa_sign, bench_openssl_ecdsa_verify, bench_openssl_ecdsa_clear },
diff --git a/testsuite/ecdh-test.c b/testsuite/ecdh-test.c
index 5a2b39d..08870b1 100644
--- a/testsuite/ecdh-test.c
+++ b/testsuite/ecdh-test.c
@@ -138,26 +138,6 @@ test_dh (const char *name, const struct ecc_curve *ecc,
void
test_main(void)
{
- test_dh ("secp-192r1", &nettle_secp_192r1,
- "3406157206141798348095184987208239421004566462391397236532",
- "1050363442265225480786760666329560655512990381040021438562",
- "5298249600854377235107392014200406283816103564916230704184",
- "738368960171459956677260317271477822683777845013274506165",
- "2585840779771604687467445319428618542927556223024046979917",
- "293088185788565313717816218507714888251468410990708684573",
- "149293809021051532782730990145509724807636529827149481690",
- "2891131861147398318714693938158856874319184314120776776192");
-
- test_dh ("secp-224r1", &nettle_secp_224r1,
- "1321072106881784386340709783538698930880431939595776773514895067682",
- "6768311794185371282972144247871764855860666277647541840973645586477",
- "2880077809069104378181313860274147139049600284805670362929579614547",
- "13934723037778859565852601874354272638301919827851286722006496784914",
- "373124771833407982305885866158843810218322878380632071540538232035",
- "24223309755162432227459925493224336241652868856405241018762887667883",
- "8330362698029245839097779050425944245826040430538860338085968752913",
- "24167244512472228715617822000878192535267113543393576038737592837010");
-
test_dh ("secp-256r1", &nettle_secp_256r1,
"94731533361265297353914491124013058635674217345912524033267198103710636378786",
"22441589863306126152768848344973918725077248391248404659242620344938484650846",
diff --git a/testsuite/ecdsa-sign-test.c b/testsuite/ecdsa-sign-test.c
index 559de8e..1ca36c2 100644
--- a/testsuite/ecdsa-sign-test.c
+++ b/testsuite/ecdsa-sign-test.c
@@ -60,37 +60,6 @@ test_main (void)
{
/* Test cases for the smaller groups, verified with a
proof-of-concept implementation done for Yubico AB. */
- test_ecdsa (&nettle_secp_192r1,
- "DC51D3866A15BACDE33D96F992FCA99D"
- "A7E6EF0934E70975", /* z */
-
- "9E56F509196784D963D1C0A401510EE7"
- "ADA3DCC5DEE04B15", /* k */
-
- SHEX("BA7816BF8F01CFEA414140DE5DAE2223"
- "B00361A396177A9C"), /* h */
-
- "8c478db6a5c131540cebc739f9c0a9a8"
- "c720c2abdd14a891", /* r */
-
- "a91fb738f9f175d72f9c98527e881c36"
- "8de68cb55ffe589"); /* s */
-
- test_ecdsa (&nettle_secp_224r1,
- "446df0a771ed58403ca9cb316e617f6b"
- "158420465d00a69601e22858", /* z */
-
- "4c13f1905ad7eb201178bc08e0c9267b"
- "4751c15d5e1831ca214c33f4", /* z */
-
- SHEX("1b28a611fe62ab3649350525d06703ba"
- "4b979a1e543566fd5caa85c6"), /* h */
-
- "2cc280778f3d067df6d3adbe3a6aad63"
- "bc75f08f5c5f915411902a99", /* r */
-
- "d0f069fd0f108eb07b7bbc54c8d6c88d"
- "f2715c38a95c31a2b486995f"); /* s */
/* From RFC 4754 */
test_ecdsa (&nettle_secp_256r1,
diff --git a/testsuite/testutils.c b/testsuite/testutils.c
index 6f89761..901f62b 100644
--- a/testsuite/testutils.c
+++ b/testsuite/testutils.c
@@ -1212,8 +1212,6 @@ test_dsa_key(const struct dsa_params *params,
}
const struct ecc_curve * const ecc_curves[] = {
- &nettle_secp_192r1,
- &nettle_secp_224r1,
&nettle_secp_256r1,
&nettle_secp_384r1,
&nettle_secp_521r1,
@@ -1270,20 +1268,6 @@ test_ecc_mul_a (unsigned curve, unsigned n, const mp_limb_t *p)
{
/* For each curve, the points 2 g, 3 g and 4 g */
static const struct ecc_ref_point ref[6][3] = {
- { { "dafebf5828783f2ad35534631588a3f629a70fb16982a888",
- "dd6bda0d993da0fa46b27bbc141b868f59331afa5c7e93ab" },
- { "76e32a2557599e6edcd283201fb2b9aadfd0d359cbb263da",
- "782c37e372ba4520aa62e0fed121d49ef3b543660cfd05fd" },
- { "35433907297cc378b0015703374729d7a4fe46647084e4ba",
- "a2649984f2135c301ea3acb0776cd4f125389b311db3be32" }
- },
- { { "706a46dc76dcb76798e60e6d89474788d16dc18032d268fd1a704fa6",
- "1c2b76a7bc25e7702a704fa986892849fca629487acf3709d2e4e8bb" },
- { "df1b1d66a551d0d31eff822558b9d2cc75c2180279fe0d08fd896d04",
- "a3f7f03cadd0be444c0aa56830130ddf77d317344e1af3591981a925" },
- { "ae99feebb5d26945b54892092a8aee02912930fa41cd114e40447301",
- "482580a0ec5bc47e88bc8c378632cd196cb3fa058a7114eb03054c9" },
- },
{ { "7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978",
"7775510db8ed040293d9ac69f7430dbba7dade63ce982299e04b79d227873d1" },
{ "5ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c",

17
SOURCES/nettle-3.4-annocheck.patch
View File

@ -1,12 +1,13 @@
diff -up nettle-3.4/Makefile.in.annocheck nettle-3.4/Makefile.in
--- nettle-3.4/Makefile.in.annocheck 2018-10-16 15:06:53.340138708 +0200
+++ nettle-3.4/Makefile.in 2018-10-16 15:12:25.150276379 +0200
@@ -377,7 +377,7 @@ ecc-25519.$(OBJEXT): ecc-25519.h
Index: nettle-3.7/Makefile.in
===================================================================
--- nettle-3.7.orig/Makefile.in
+++ nettle-3.7/Makefile.in
@@ -291,7 +291,7 @@ libhogweed.a: $(hogweed_OBJS)
.asm.$(OBJEXT): $(srcdir)/asm.m4 machine.m4 config.m4
$(M4) $(srcdir)/asm.m4 machine.m4 config.m4 $< >$*.s
%.$(OBJEXT): %.asm $(srcdir)/m4-utils.m4 $(srcdir)/asm.m4 config.m4 machine.m4
$(M4) $(srcdir)/m4-utils.m4 $(srcdir)/asm.m4 config.m4 machine.m4 $< >$*.s
- $(COMPILE) -c $*.s
+ $(COMPILE) -c -Wa,--generate-missing-build-notes=yes $*.s
@echo "$@ : $< $(srcdir)/asm.m4 machine.m4 config.m4" >$@.d
# Texinfo rules
%.$(OBJEXT): %.c
$(COMPILE) -c $< \

109
SOURCES/nettle-3.4.1-ecdsa-verify.patch
View File

@ -1,109 +0,0 @@
From 932ea29845da1ae350d9c056cb2cb0379a66d642 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 30 Mar 2021 09:22:47 +0200
Subject: [PATCH] Port upstream hardening of EC scaler multiplication
Some internal functions used in point multiplications are known to
misbehave if the scaler is out-of-range. This performs canonical
reduction on scalers, before point multiplication.
Signed-off-by: Daiki Ueno <dueno@redhat.com>
---
ecc-ecdsa-sign.c | 7 +++++--
ecc-ecdsa-verify.c | 14 ++++++++++++--
eddsa-hash.c | 9 +++++++--
3 files changed, 24 insertions(+), 6 deletions(-)
diff --git a/ecc-ecdsa-sign.c b/ecc-ecdsa-sign.c
index 3b9e9cc1..45062528 100644
--- a/ecc-ecdsa-sign.c
+++ b/ecc-ecdsa-sign.c
@@ -62,6 +62,8 @@ ecc_ecdsa_sign (const struct ecc_curve *ecc,
mp_limb_t *rp, mp_limb_t *sp,
mp_limb_t *scratch)
{
+ mp_limb_t cy;
+
#define P scratch
#define kinv scratch /* Needs 5*ecc->p.size for computation */
#define hp (scratch + ecc->p.size) /* NOTE: ecc->p.size + 1 limbs! */
@@ -91,8 +93,9 @@ ecc_ecdsa_sign (const struct ecc_curve *ecc,
ecc_modq_mul (ecc, tp, zp, rp);
ecc_modq_add (ecc, hp, hp, tp);
ecc_modq_mul (ecc, tp, hp, kinv);
-
- mpn_copyi (sp, tp, ecc->p.size);
+ /* Ensure canonical reduction. */
+ cy = mpn_sub_n (sp, tp, ecc->q.m, ecc->q.size);
+ cnd_copy (cy, sp, tp, ecc->q.size);
#undef P
#undef hp
#undef kinv
diff --git a/ecc-ecdsa-verify.c b/ecc-ecdsa-verify.c
index d7f5b684..6b8acb07 100644
--- a/ecc-ecdsa-verify.c
+++ b/ecc-ecdsa-verify.c
@@ -75,6 +75,8 @@ ecc_ecdsa_verify (const struct ecc_curve *ecc,
const mp_limb_t *rp, const mp_limb_t *sp,
mp_limb_t *scratch)
{
+ mp_limb_t cy;
+
/* Procedure, according to RFC 6090, "KT-I". q denotes the group
order.
@@ -98,6 +100,7 @@ ecc_ecdsa_verify (const struct ecc_curve *ecc,
#define P1 (scratch + 4*ecc->p.size)
#define sinv (scratch)
#define hp (scratch + ecc->p.size)
+#define tp (scratch + 4*ecc->p.size)
if (! (ecdsa_in_range (ecc, rp)
&& ecdsa_in_range (ecc, sp)))
@@ -112,10 +115,16 @@ ecc_ecdsa_verify (const struct ecc_curve *ecc,
/* u1 = h / s, P1 = u1 * G */
ecc_hash (&ecc->q, hp, length, digest);
- ecc_modq_mul (ecc, u1, hp, sinv);
+ ecc_modq_mul (ecc, tp, hp, sinv);
+ /* Ensure canonical reduction. */
+ cy = mpn_sub_n (u1, tp, ecc->q.m, ecc->q.size);
+ cnd_copy (cy, u1, tp, ecc->q.size);
/* u2 = r / s, P2 = u2 * Y */
- ecc_modq_mul (ecc, u2, rp, sinv);
+ ecc_modq_mul (ecc, hp, rp, sinv);
+ /* Ensure canonical reduction. */
+ cy = mpn_sub_n (u2, hp, ecc->q.m, ecc->q.size);
+ cnd_copy (cy, u2, hp, ecc->q.size);
/* Total storage: 5*ecc->p.size + ecc->mul_itch */
ecc->mul (ecc, P2, u2, pp, u2 + ecc->p.size);
@@ -154,4 +163,5 @@ ecc_ecdsa_verify (const struct ecc_curve *ecc,
#undef u2
#undef hp
#undef u1
+#undef tp
}
diff --git a/eddsa-hash.c b/eddsa-hash.c
index 4fb79f1b..53c6fc49 100644
--- a/eddsa-hash.c
+++ b/eddsa-hash.c
@@ -45,7 +45,12 @@ void
_eddsa_hash (const struct ecc_modulo *m,
mp_limb_t *rp, const uint8_t *digest)
{
+ mp_limb_t cy;
+
size_t nbytes = 1 + m->bit_size / 8;
- mpn_set_base256_le (rp, 2*m->size, digest, 2*nbytes);
- m->mod (m, rp);
+ mpn_set_base256_le (rp + m->size, 2*m->size, digest, 2*nbytes);
+ m->mod (m, rp + m->size);
+ /* Ensure canonical reduction. */
+ cy = mpn_sub_n (rp, rp + m->size, m->m, m->size);
+ cnd_copy (cy, rp, rp + m->size, m->size);
}
--
2.30.2

210
SOURCES/nettle-3.4.1-enable-intel-cet.patch
View File

@ -1,210 +0,0 @@
diff --git a/asm.m4 b/asm.m4
index 8da47201..59d64098 100644
--- a/asm.m4
+++ b/asm.m4
@@ -32,7 +32,7 @@ define(<GMP_NUMB_BITS>,<>)dnl
define(<PROLOGUE>,
<.globl C_NAME($1)
DECLARE_FUNC(C_NAME($1))
-C_NAME($1):>)
+C_NAME($1): ASM_X86_ENDBR>)
define(<EPILOGUE>,
<ifelse(ELF_STYLE,yes,
--- a/config.m4.in 2018-12-04 21:56:06.000000000 +0100
+++ b/config.m4.in 2020-05-15 11:25:42.350465132 +0200
@@ -7,6 +7,9 @@
define(<ALIGN_LOG>, <@ASM_ALIGN_LOG@>)dnl
define(<W64_ABI>, <@W64_ABI@>)dnl
define(<RODATA>, <@ASM_RODATA@>)dnl
+define(<ASM_X86_ENDBR>,<@ASM_X86_ENDBR@>)dnl
+define(<ASM_X86_MARK_CET_ALIGN>,<@ASM_X86_MARK_CET_ALIGN@>)dnl
divert(1)
+@ASM_X86_MARK_CET@
@ASM_MARK_NOEXEC_STACK@
divert
--- a/configure.ac 2018-12-04 21:56:06.000000000 +0100
+++ b/configure.ac 2020-05-15 11:46:39.152373137 +0200
@@ -787,6 +787,68 @@
ASM_ALIGN_LOG="$nettle_cv_asm_align_log"
fi
+dnl Define
+dnl 1. ASM_X86_ENDBR for endbr32/endbr64.
+dnl 2. ASM_X86_MARK_CET to add a .note.gnu.property section to mark
+dnl Intel CET support if needed.
+dnl 3. ASM_X86_MARK_CET_ALIGN to align ASM_X86_MARK_CET.
+AC_CACHE_CHECK([if Intel CET is enabled],
+ [nettle_cv_asm_x86_intel_cet],
+ [AC_TRY_COMPILE([
+#ifndef __CET__
+#error Intel CET is not enabled
+#endif
+ ], [],
+ [nettle_cv_asm_x86_intel_cet=yes],
+ [nettle_cv_asm_x86_intel_cet=no])])
+if test "$nettle_cv_asm_x86_intel_cet" = yes; then
+ case $ABI in
+ 32|standard)
+ ASM_X86_ENDBR=endbr32
+ ASM_X86_MARK_CET_ALIGN=2
+ ;;
+ 64)
+ ASM_X86_ENDBR=endbr64
+ ASM_X86_MARK_CET_ALIGN=3
+ ;;
+ x32)
+ ASM_X86_ENDBR=endbr64
+ ASM_X86_MARK_CET_ALIGN=2
+ ;;
+ esac
+ AC_CACHE_CHECK([if .note.gnu.property section is needed],
+ [nettle_cv_asm_x86_gnu_property],
+ [AC_TRY_COMPILE([
+#if !defined __ELF__ || !defined __CET__
+#error GNU property is not needed
+#endif
+ ], [],
+ [nettle_cv_asm_x86_gnu_property=yes],
+ [nettle_cv_asm_x86_gnu_property=no])])
+else
+ nettle_cv_asm_x86_gnu_property=no
+fi
+if test "$nettle_cv_asm_x86_gnu_property" = yes; then
+ ASM_X86_MARK_CET='
+ .pushsection ".note.gnu.property", "a"
+ .p2align ASM_X86_MARK_CET_ALIGN
+ .long 1f - 0f
+ .long 4f - 1f
+ .long 5
+0:
+ .asciz "GNU"
+1:
+ .p2align ASM_X86_MARK_CET_ALIGN
+ .long 0xc0000002
+ .long 3f - 2f
+2:
+ .long 3
+3:
+ .p2align ASM_X86_MARK_CET_ALIGN
+4:
+ .popsection'
+fi
+
AC_SUBST(ASM_SYMBOL_PREFIX)
AC_SUBST(ASM_ELF_STYLE)
AC_SUBST(ASM_COFF_STYLE)
@@ -796,6 +858,9 @@
AC_SUBST(ASM_ALIGN_LOG)
AC_SUBST(W64_ABI)
AC_SUBST(EMULATOR)
+AC_SUBST(ASM_X86_ENDBR)
+AC_SUBST(ASM_X86_MARK_CET)
+AC_SUBST(ASM_X86_MARK_CET_ALIGN)
AC_SUBST(LIBNETTLE_MAJOR)
AC_SUBST(LIBNETTLE_MINOR)
diff --git a/testsuite/.test-rules.make b/testsuite/.test-rules.make
index 922a2c7f..9de8f412 100644
--- a/testsuite/.test-rules.make
+++ b/testsuite/.test-rules.make
@@ -178,6 +178,9 @@ xts-test$(EXEEXT): xts-test.$(OBJEXT)
pbkdf2-test$(EXEEXT): pbkdf2-test.$(OBJEXT)
$(LINK) pbkdf2-test.$(OBJEXT) $(TEST_OBJS) -o pbkdf2-test$(EXEEXT)
+x86-ibt-test$(EXEEXT): x86-ibt-test.$(OBJEXT)
+ $(LINK) x86-ibt-test.$(OBJEXT) $(TEST_OBJS) -o x86-ibt-test$(EXEEXT)
+
sexp-test$(EXEEXT): sexp-test.$(OBJEXT)
$(LINK) sexp-test.$(OBJEXT) $(TEST_OBJS) -o sexp-test$(EXEEXT)
--- a/testsuite/Makefile.in 2018-12-04 21:56:06.000000000 +0100
+++ b/testsuite/Makefile.in 2020-05-15 11:21:15.673321598 +0200
@@ -31,7 +31,8 @@
hmac-test.c umac-test.c \
meta-hash-test.c meta-cipher-test.c\
meta-aead-test.c meta-armor-test.c \
- buffer-test.c yarrow-test.c pbkdf2-test.c
+ buffer-test.c yarrow-test.c pbkdf2-test.c \
+ x86-ibt-test.c
TS_HOGWEED_SOURCES = sexp-test.c sexp-format-test.c \
rsa2sexp-test.c sexp2rsa-test.c \
diff --git a/testsuite/x86-ibt-test.c b/testsuite/x86-ibt-test.c
new file mode 100644
index 00000000..1f3d1d67
--- /dev/null
+++ b/testsuite/x86-ibt-test.c
@@ -0,0 +1,69 @@
+#include "testutils.h"
+#if defined(__GNUC__) && (defined(__i386__) || defined(__x86_64__)) \
+ && defined(__CET__) && defined(__linux__)
+#include <signal.h>
+
+static void
+segfault_handler(int signo)
+{
+ exit(0);
+}
+
+static void
+ibt_violation(void)
+{
+#ifdef __i386__
+ unsigned int reg;
+ asm volatile("lea 1f, %0\n\t"
+ "jmp *%0\n"
+ "1:" : "=r" (reg));
+#else
+ unsigned long long reg;
+ asm volatile("lea 1f(%%rip), %0\n\t"
+ "jmp *%0\n"
+ "1:" : "=r" (reg));
+#endif
+}
+
+#ifdef __i386__
+static unsigned int
+_get_ssp(void)
+{
+ unsigned int ssp;
+ asm volatile("xor %0, %0\n\trdsspd %0" : "=r" (ssp));
+ return ssp;
+}
+#else
+static unsigned long long
+_get_ssp(void)
+{
+ unsigned long long ssp;
+ asm volatile("xor %0, %0\n\trdsspq %0" : "=r" (ssp));
+ return ssp;
+}
+#endif
+
+void
+test_main(void)
+{
+ /* NB: This test should trigger SIGSEGV on CET platforms. _get_ssp
+ returns the address of shadow stack pointer. If the address of
+ shadow stack pointer is 0, SHSTK is disabled and we assume that
+ IBT is also disabled. */
+ if (_get_ssp() == 0)
+ {
+ ibt_violation();
+ SKIP();
+ }
+
+ signal(SIGSEGV, segfault_handler);
+ ibt_violation();
+ FAIL();
+}
+#else
+void
+test_main(void)
+{
+ SKIP();
+}
+#endif
--
2.25.4

1142
SOURCES/nettle-3.4.1-powerpc64-aes-asm.patch
View File

File diff suppressed because it is too large Load Diff

1519
SOURCES/nettle-3.4.1-powerpc64-ghash-asm.patch
View File

File diff suppressed because it is too large Load Diff

609
SOURCES/nettle-3.4.1-rsa-decrypt.patch
View File

@ -1,609 +0,0 @@
From 5646ca77ee92de0ae33e7d2e0a3383c61a4091ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niels=20M=C3=B6ller?= <nisse@lysator.liu.se>
Date: Thu, 6 May 2021 21:30:23 +0200
Subject: [PATCH 1/4] Add check that message length to _pkcs1_sec_decrypt is
valid.
* pkcs1-sec-decrypt.c (_pkcs1_sec_decrypt): Check that message
length is valid, for given key size.
* testsuite/rsa-sec-decrypt-test.c (test_main): Add test cases for
calls to rsa_sec_decrypt specifying a too large message length.
(cherry picked from commit 7616541e6eff73353bf682c62e3a68e4fe696707)
---
ChangeLog | 8 ++++++++
pkcs1-sec-decrypt.c | 4 +++-
testsuite/rsa-sec-decrypt-test.c | 17 ++++++++++++++++-
3 files changed, 27 insertions(+), 2 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 4c7338a1..7cd0455e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2021-05-06 Niels Möller <nisse@lysator.liu.se>
+
+ Bug fixes merged from from 3.7.3 release (starting from 2021-05-06).
+ * pkcs1-sec-decrypt.c (_pkcs1_sec_decrypt): Check that message
+ length is valid, for given key size.
+ * testsuite/rsa-sec-decrypt-test.c (test_main): Add test cases for
+ calls to rsa_sec_decrypt specifying a too large message length.
+
2018-12-04 Niels Möller <nisse@lysator.liu.se>
* Released nettle-3.4.1.
diff --git a/pkcs1-sec-decrypt.c b/pkcs1-sec-decrypt.c
index 722044b0..02fd07e1 100644
--- a/pkcs1-sec-decrypt.c
+++ b/pkcs1-sec-decrypt.c
@@ -64,7 +64,9 @@ _pkcs1_sec_decrypt (size_t length, uint8_t *message,
volatile int ok;
size_t i, t;
- assert (padded_message_length >= length);
+ /* Message independent branch */
+ if (length + 11 > padded_message_length)
+ return 0;
t = padded_message_length - length - 1;
diff --git a/testsuite/rsa-sec-decrypt-test.c b/testsuite/rsa-sec-decrypt-test.c
index 64f0b13c..4a9f301b 100644
--- a/testsuite/rsa-sec-decrypt-test.c
+++ b/testsuite/rsa-sec-decrypt-test.c
@@ -55,6 +55,7 @@ rsa_decrypt_for_test(const struct rsa_public_key *pub,
#endif
#define PAYLOAD_SIZE 50
+#define DECRYPTED_SIZE 256
void
test_main(void)
{
@@ -63,7 +64,7 @@ test_main(void)
struct knuth_lfib_ctx random_ctx;
uint8_t plaintext[PAYLOAD_SIZE];
- uint8_t decrypted[PAYLOAD_SIZE];
+ uint8_t decrypted[DECRYPTED_SIZE];
uint8_t verifybad[PAYLOAD_SIZE];
unsigned n_size = 1024;
mpz_t gibberish;
@@ -98,6 +99,20 @@ test_main(void)
PAYLOAD_SIZE, decrypted, gibberish) == 1);
ASSERT (MEMEQ (PAYLOAD_SIZE, plaintext, decrypted));
+ ASSERT (pub.size > 10);
+ ASSERT (pub.size <= DECRYPTED_SIZE);
+
+ /* Check that too large message length is rejected, largest
+ valid size is pub.size - 11. */
+ ASSERT (!rsa_decrypt_for_test (&pub, &key, &random_ctx,
+ (nettle_random_func *) knuth_lfib_random,
+ pub.size - 10, decrypted, gibberish));
+
+ /* This case used to result in arithmetic underflow and a crash. */
+ ASSERT (!rsa_decrypt_for_test (&pub, &key, &random_ctx,
+ (nettle_random_func *) knuth_lfib_random,
+ pub.size, decrypted, gibberish));
+
/* bad one */
memcpy(decrypted, verifybad, PAYLOAD_SIZE);
nettle_mpz_random_size(garbage, &random_ctx,
--
2.31.1
From 743cdf38353f6dd5d3d91eadc769106cfc116301 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niels=20M=C3=B6ller?= <nisse@lysator.liu.se>
Date: Tue, 8 Jun 2021 21:30:48 +0200
Subject: [PATCH 2/4] Fix comment typos.
(cherry picked from commit 0a714543136de97c7fd34f1c6ac1592dc5036879)
---
pkcs1-sec-decrypt.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/pkcs1-sec-decrypt.c b/pkcs1-sec-decrypt.c
index 02fd07e1..a7f85c2e 100644
--- a/pkcs1-sec-decrypt.c
+++ b/pkcs1-sec-decrypt.c
@@ -102,8 +102,8 @@ _pkcs1_sec_decrypt_variable(size_t *length, uint8_t *message,
/* length is discovered in a side-channel silent way.
* not_found goes to 0 when the terminator is found.
- * offset strts at 3 as it includes the terminator and
- * the fomat bytes already */
+ * offset starts at 3 as it includes the terminator and
+ * the format bytes already */
offset = 3;
for (i = 2; i < padded_message_length; i++)
{
--
2.31.1
From dfce46c4540d2abf040073070cff15f9d1708050 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niels=20M=C3=B6ller?= <nisse@lysator.liu.se>
Date: Tue, 8 Jun 2021 21:31:39 +0200
Subject: [PATCH 3/4] Change _rsa_sec_compute_root_tr to take a fix input size.
Improves consistency with _rsa_sec_compute_root, and fixes zero-input bug.
(cherry picked from commit 485b5e2820a057e873b1ba812fdb39cae4adf98c)
---
ChangeLog | 17 +++++++++-
rsa-decrypt-tr.c | 7 ++---
rsa-internal.h | 4 +--
rsa-sec-decrypt.c | 9 ++++--
rsa-sign-tr.c | 61 +++++++++++++++++-------------------
testsuite/rsa-encrypt-test.c | 14 ++++++++-
6 files changed, 69 insertions(+), 43 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 7cd0455e..ae660fc0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,21 @@
-2021-05-06 Niels Möller <nisse@lysator.liu.se>
+2021-05-14 Niels Möller <nisse@lysator.liu.se>
Bug fixes merged from from 3.7.3 release (starting from 2021-05-06).
+ * rsa-sign-tr.c (rsa_sec_blind): Delete mn argument.
+ (_rsa_sec_compute_root_tr): Delete mn argument, instead require
+ that input size matches key size. Rearrange use of temporary
+ storage, to support in-place operation, x == m. Update all
+ callers.
+
+ * rsa-decrypt-tr.c (rsa_decrypt_tr): Make zero-padded copy of
+ input, for calling _rsa_sec_compute_root_tr.
+ * rsa-sec-decrypt.c (rsa_sec_decrypt): Likewise.
+
+ * testsuite/rsa-encrypt-test.c (test_main): Test calling all of
+ rsa_decrypt, rsa_decrypt_tr, and rsa_sec_decrypt with zero input.
+
+2021-05-06 Niels Möller <nisse@lysator.liu.se>
+
* pkcs1-sec-decrypt.c (_pkcs1_sec_decrypt): Check that message
length is valid, for given key size.
* testsuite/rsa-sec-decrypt-test.c (test_main): Add test cases for
diff --git a/rsa-decrypt-tr.c b/rsa-decrypt-tr.c
index 5dfb91b1..c118e852 100644
--- a/rsa-decrypt-tr.c
+++ b/rsa-decrypt-tr.c
@@ -52,14 +52,13 @@ rsa_decrypt_tr(const struct rsa_public_key *pub,
mp_size_t key_limb_size;
int res;
- key_limb_size = NETTLE_OCTET_SIZE_TO_LIMB_SIZE(key->size);
+ key_limb_size = mpz_size(pub->n);
TMP_GMP_ALLOC (m, key_limb_size);
TMP_GMP_ALLOC (em, key->size);
+ mpz_limbs_copy(m, gibberish, key_limb_size);
- res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, m,
- mpz_limbs_read(gibberish),
- mpz_size(gibberish));
+ res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, m, m);
mpn_get_base256 (em, key->size, m, key_limb_size);
diff --git a/rsa-internal.h b/rsa-internal.h
index bd667bc2..64a7edf6 100644
--- a/rsa-internal.h
+++ b/rsa-internal.h
@@ -53,12 +53,12 @@ _rsa_sec_compute_root(const struct rsa_private_key *key,
mp_limb_t *scratch);
/* Safe side-channel silent variant, using RSA blinding, and checking the
- * result after CRT. */
+ * result after CRT. In-place calls, with x == m, is allowed. */
int
_rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
const struct rsa_private_key *key,
void *random_ctx, nettle_random_func *random,
- mp_limb_t *x, const mp_limb_t *m, size_t mn);
+ mp_limb_t *x, const mp_limb_t *m);
/* additional resistance to memory access side-channel attacks.
* Note: message buffer is returned unchanged on error */
diff --git a/rsa-sec-decrypt.c b/rsa-sec-decrypt.c
index e6a4b267..633a6852 100644
--- a/rsa-sec-decrypt.c
+++ b/rsa-sec-decrypt.c
@@ -57,9 +57,12 @@ rsa_sec_decrypt(const struct rsa_public_key *pub,
TMP_GMP_ALLOC (m, mpz_size(pub->n));
TMP_GMP_ALLOC (em, key->size);
- res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, m,
- mpz_limbs_read(gibberish),
- mpz_size(gibberish));
+ /* We need a copy because m can be shorter than key_size,
+ * but _rsa_sec_compute_root_tr expect all inputs to be
+ * normalized to a key_size long buffer length */
+ mpz_limbs_copy(m, gibberish, mpz_size(pub->n));
+
+ res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, m, m);
mpn_get_base256 (em, key->size, m, mpz_size(pub->n));
diff --git a/rsa-sign-tr.c b/rsa-sign-tr.c
index 59c9bd07..141a52c7 100644
--- a/rsa-sign-tr.c
+++ b/rsa-sign-tr.c
@@ -131,35 +131,34 @@ int
_rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
const struct rsa_private_key *key,
void *random_ctx, nettle_random_func *random,
- mp_limb_t *x, const mp_limb_t *m, size_t mn)
+ mp_limb_t *x, const mp_limb_t *m)
{
+ mp_size_t nn;
mpz_t mz;
mpz_t xz;
int res;
- mpz_init(mz);
mpz_init(xz);
- mpn_copyi(mpz_limbs_write(mz, mn), m, mn);
- mpz_limbs_finish(mz, mn);
+ nn = mpz_size (pub->n);
- res = rsa_compute_root_tr(pub, key, random_ctx, random, xz, mz);
+ res = rsa_compute_root_tr(pub, key, random_ctx, random, xz,
+ mpz_roinit_n(mz, m, nn));
if (res)
- mpz_limbs_copy(x, xz, mpz_size(pub->n));
+ mpz_limbs_copy(x, xz, nn);
- mpz_clear(mz);
mpz_clear(xz);
return res;
}
#else
/* Blinds m, by computing c = m r^e (mod n), for a random r. Also
- returns the inverse (ri), for use by rsa_unblind. */
+ returns the inverse (ri), for use by rsa_unblind. Must have c != m,
+ no in-place operation.*/
static void
rsa_sec_blind (const struct rsa_public_key *pub,
void *random_ctx, nettle_random_func *random,
- mp_limb_t *c, mp_limb_t *ri, const mp_limb_t *m,
- mp_size_t mn)
+ mp_limb_t *c, mp_limb_t *ri, const mp_limb_t *m)
{
const mp_limb_t *ep = mpz_limbs_read (pub->e);
const mp_limb_t *np = mpz_limbs_read (pub->n);
@@ -177,15 +176,15 @@ rsa_sec_blind (const struct rsa_public_key *pub,
/* c = m*(r^e) mod n */
itch = mpn_sec_powm_itch(nn, ebn, nn);
- i2 = mpn_sec_mul_itch(nn, mn);
+ i2 = mpn_sec_mul_itch(nn, nn);
itch = MAX(itch, i2);
- i2 = mpn_sec_div_r_itch(nn + mn, nn);
+ i2 = mpn_sec_div_r_itch(2*nn, nn);
itch = MAX(itch, i2);
i2 = mpn_sec_invert_itch(nn);
itch = MAX(itch, i2);
- TMP_GMP_ALLOC (tp, nn + mn + itch);
- scratch = tp + nn + mn;
+ TMP_GMP_ALLOC (tp, 2*nn + itch);
+ scratch = tp + 2*nn;
/* ri = r^(-1) */
do
@@ -198,9 +197,8 @@ rsa_sec_blind (const struct rsa_public_key *pub,
while (!mpn_sec_invert (ri, tp, np, nn, 2 * nn * GMP_NUMB_BITS, scratch));
mpn_sec_powm (c, rp, nn, ep, ebn, np, nn, scratch);
- /* normally mn == nn, but m can be smaller in some cases */
- mpn_sec_mul (tp, c, nn, m, mn, scratch);
- mpn_sec_div_r (tp, nn + mn, np, nn, scratch);
+ mpn_sec_mul (tp, c, nn, m, nn, scratch);
+ mpn_sec_div_r (tp, 2*nn, np, nn, scratch);
mpn_copyi(c, tp, nn);
TMP_GMP_FREE (r);
@@ -208,7 +206,7 @@ rsa_sec_blind (const struct rsa_public_key *pub,
TMP_GMP_FREE (tp);
}
-/* m = c ri mod n */
+/* m = c ri mod n. Allows x == c. */
static void
rsa_sec_unblind (const struct rsa_public_key *pub,
mp_limb_t *x, mp_limb_t *ri, const mp_limb_t *c)
@@ -298,7 +296,7 @@ int
_rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
const struct rsa_private_key *key,
void *random_ctx, nettle_random_func *random,
- mp_limb_t *x, const mp_limb_t *m, size_t mn)
+ mp_limb_t *x, const mp_limb_t *m)
{
TMP_GMP_DECL (c, mp_limb_t);
TMP_GMP_DECL (ri, mp_limb_t);
@@ -306,7 +304,7 @@ _rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
size_t key_limb_size;
int ret;
- key_limb_size = NETTLE_OCTET_SIZE_TO_LIMB_SIZE(key->size);
+ key_limb_size = mpz_size(pub->n);
/* mpz_powm_sec handles only odd moduli. If p, q or n is even, the
key is invalid and rejected by rsa_private_key_prepare. However,
@@ -320,19 +318,18 @@ _rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
}
assert(mpz_size(pub->n) == key_limb_size);
- assert(mn <= key_limb_size);
TMP_GMP_ALLOC (c, key_limb_size);
TMP_GMP_ALLOC (ri, key_limb_size);
TMP_GMP_ALLOC (scratch, _rsa_sec_compute_root_itch(key));
- rsa_sec_blind (pub, random_ctx, random, x, ri, m, mn);
+ rsa_sec_blind (pub, random_ctx, random, c, ri, m);
- _rsa_sec_compute_root(key, c, x, scratch);
+ _rsa_sec_compute_root(key, x, c, scratch);
- ret = rsa_sec_check_root(pub, c, x);
+ ret = rsa_sec_check_root(pub, x, c);
- rsa_sec_unblind(pub, x, ri, c);
+ rsa_sec_unblind(pub, x, ri, x);
cnd_mpn_zero(1 - ret, x, key_limb_size);
@@ -356,17 +353,17 @@ rsa_compute_root_tr(const struct rsa_public_key *pub,
mpz_t x, const mpz_t m)
{
TMP_GMP_DECL (l, mp_limb_t);
+ mp_size_t nn = mpz_size(pub->n);
int res;
- mp_size_t l_size = NETTLE_OCTET_SIZE_TO_LIMB_SIZE(key->size);
- TMP_GMP_ALLOC (l, l_size);
+ TMP_GMP_ALLOC (l, nn);
+ mpz_limbs_copy(l, m, nn);
- res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, l,
- mpz_limbs_read(m), mpz_size(m));
+ res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, l, l);
if (res) {
- mp_limb_t *xp = mpz_limbs_write (x, l_size);
- mpn_copyi (xp, l, l_size);
- mpz_limbs_finish (x, l_size);
+ mp_limb_t *xp = mpz_limbs_write (x, nn);
+ mpn_copyi (xp, l, nn);
+ mpz_limbs_finish (x, nn);
}
TMP_GMP_FREE (l);
diff --git a/testsuite/rsa-encrypt-test.c b/testsuite/rsa-encrypt-test.c
index 87525f78..d3bc374b 100644
--- a/testsuite/rsa-encrypt-test.c
+++ b/testsuite/rsa-encrypt-test.c
@@ -19,6 +19,7 @@ test_main(void)
uint8_t after;
mpz_t gibberish;
+ mpz_t zero;
rsa_private_key_init(&key);
rsa_public_key_init(&pub);
@@ -101,6 +102,17 @@ test_main(void)
ASSERT(decrypted[decrypted_length] == after);
ASSERT(decrypted[0] == 'A');
+ /* Test zero input. */
+ mpz_init_set_ui (zero, 0);
+ decrypted_length = msg_length;
+ ASSERT(!rsa_decrypt(&key, &decrypted_length, decrypted, zero));
+ ASSERT(!rsa_decrypt_tr(&pub, &key,
+ &lfib, (nettle_random_func *) knuth_lfib_random,
+ &decrypted_length, decrypted, zero));
+ ASSERT(!rsa_sec_decrypt(&pub, &key,
+ &lfib, (nettle_random_func *) knuth_lfib_random,
+ decrypted_length, decrypted, zero));
+ ASSERT(decrypted_length == msg_length);
/* Test invalid key. */
mpz_add_ui (key.q, key.q, 2);
@@ -112,6 +124,6 @@ test_main(void)
rsa_private_key_clear(&key);
rsa_public_key_clear(&pub);
mpz_clear(gibberish);
+ mpz_clear(zero);
free(decrypted);
}
-
--
2.31.1
From f601611b3c315aba373c0ab2ddf24772e88c1b3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niels=20M=C3=B6ller?= <nisse@lysator.liu.se>
Date: Tue, 8 Jun 2021 21:32:38 +0200
Subject: [PATCH 4/4] Add input check to rsa_decrypt family of functions.
(cherry picked from commit 0ad0b5df315665250dfdaa4a1e087f4799edaefe)
---
ChangeLog | 10 +++++++++-
rsa-decrypt-tr.c | 4 ++++
rsa-decrypt.c | 10 ++++++++++
rsa-sec-decrypt.c | 4 ++++
rsa.h | 5 +++--
testsuite/rsa-encrypt-test.c | 38 ++++++++++++++++++++++++++++++------
6 files changed, 62 insertions(+), 9 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index ae660fc0..27f022db 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,14 @@
-2021-05-14 Niels Möller <nisse@lysator.liu.se>
+2021-05-17 Niels Möller <nisse@lysator.liu.se>
Bug fixes merged from from 3.7.3 release (starting from 2021-05-06).
+ * rsa-decrypt-tr.c (rsa_decrypt_tr): Check up-front that input is
+ in range.
+ * rsa-sec-decrypt.c (rsa_sec_decrypt): Likewise.
+ * rsa-decrypt.c (rsa_decrypt): Likewise.
+ * testsuite/rsa-encrypt-test.c (test_main): Add tests with input > n.
+
+2021-05-14 Niels Möller <nisse@lysator.liu.se>
+
* rsa-sign-tr.c (rsa_sec_blind): Delete mn argument.
(_rsa_sec_compute_root_tr): Delete mn argument, instead require
that input size matches key size. Rearrange use of temporary
diff --git a/rsa-decrypt-tr.c b/rsa-decrypt-tr.c
index c118e852..1ba3d286 100644
--- a/rsa-decrypt-tr.c
+++ b/rsa-decrypt-tr.c
@@ -52,6 +52,10 @@ rsa_decrypt_tr(const struct rsa_public_key *pub,
mp_size_t key_limb_size;
int res;
+ /* First check that input is in range. */
+ if (mpz_sgn (gibberish) < 0 || mpz_cmp (gibberish, pub->n) >= 0)
+ return 0;
+
key_limb_size = mpz_size(pub->n);
TMP_GMP_ALLOC (m, key_limb_size);
diff --git a/rsa-decrypt.c b/rsa-decrypt.c
index 7681439d..540d8baa 100644
--- a/rsa-decrypt.c
+++ b/rsa-decrypt.c
@@ -48,6 +48,16 @@ rsa_decrypt(const struct rsa_private_key *key,
int res;
mpz_init(m);
+
+ /* First check that input is in range. Since we don't have the
+ public key available here, we need to reconstruct n. */
+ mpz_mul (m, key->p, key->q);
+ if (mpz_sgn (gibberish) < 0 || mpz_cmp (gibberish, m) >= 0)
+ {
+ mpz_clear (m);
+ return 0;
+ }
+
rsa_compute_root(key, m, gibberish);
res = pkcs1_decrypt (key->size, m, length, message);
diff --git a/rsa-sec-decrypt.c b/rsa-sec-decrypt.c
index 633a6852..53113c69 100644
--- a/rsa-sec-decrypt.c
+++ b/rsa-sec-decrypt.c
@@ -54,6 +54,10 @@ rsa_sec_decrypt(const struct rsa_public_key *pub,
TMP_GMP_DECL (em, uint8_t);
int res;
+ /* First check that input is in range. */
+ if (mpz_sgn (gibberish) < 0 || mpz_cmp (gibberish, pub->n) >= 0)
+ return 0;
+
TMP_GMP_ALLOC (m, mpz_size(pub->n));
TMP_GMP_ALLOC (em, key->size);
diff --git a/rsa.h b/rsa.h
index 0aac6a26..54c35688 100644
--- a/rsa.h
+++ b/rsa.h
@@ -433,13 +433,14 @@ rsa_sec_decrypt(const struct rsa_public_key *pub,
size_t length, uint8_t *message,
const mpz_t gibberish);
-/* Compute x, the e:th root of m. Calling it with x == m is allowed. */
+/* Compute x, the e:th root of m. Calling it with x == m is allowed.
+ It is required that 0 <= m < n. */
void
rsa_compute_root(const struct rsa_private_key *key,
mpz_t x, const mpz_t m);
/* Safer variant, using RSA blinding, and checking the result after
- CRT. */
+ CRT. It is required that 0 <= m < n. */
int
rsa_compute_root_tr(const struct rsa_public_key *pub,
const struct rsa_private_key *key,
diff --git a/testsuite/rsa-encrypt-test.c b/testsuite/rsa-encrypt-test.c
index d3bc374b..d1a440f6 100644
--- a/testsuite/rsa-encrypt-test.c
+++ b/testsuite/rsa-encrypt-test.c
@@ -19,11 +19,12 @@ test_main(void)
uint8_t after;
mpz_t gibberish;
- mpz_t zero;
+ mpz_t bad_input;
rsa_private_key_init(&key);
rsa_public_key_init(&pub);
mpz_init(gibberish);
+ mpz_init(bad_input);
knuth_lfib_init(&lfib, 17);
@@ -103,15 +104,40 @@ test_main(void)
ASSERT(decrypted[0] == 'A');
/* Test zero input. */
- mpz_init_set_ui (zero, 0);
+ mpz_set_ui (bad_input, 0);
decrypted_length = msg_length;
- ASSERT(!rsa_decrypt(&key, &decrypted_length, decrypted, zero));
+ ASSERT(!rsa_decrypt(&key, &decrypted_length, decrypted, bad_input));
ASSERT(!rsa_decrypt_tr(&pub, &key,
&lfib, (nettle_random_func *) knuth_lfib_random,
- &decrypted_length, decrypted, zero));
+ &decrypted_length, decrypted, bad_input));
ASSERT(!rsa_sec_decrypt(&pub, &key,
&lfib, (nettle_random_func *) knuth_lfib_random,
- decrypted_length, decrypted, zero));
+ decrypted_length, decrypted, bad_input));
+ ASSERT(decrypted_length == msg_length);
+
+ /* Test input that is slightly larger than n */
+ mpz_add(bad_input, gibberish, pub.n);
+ decrypted_length = msg_length;
+ ASSERT(!rsa_decrypt(&key, &decrypted_length, decrypted, bad_input));
+ ASSERT(!rsa_decrypt_tr(&pub, &key,
+ &lfib, (nettle_random_func *) knuth_lfib_random,
+ &decrypted_length, decrypted, bad_input));
+ ASSERT(!rsa_sec_decrypt(&pub, &key,
+ &lfib, (nettle_random_func *) knuth_lfib_random,
+ decrypted_length, decrypted, bad_input));
+ ASSERT(decrypted_length == msg_length);
+
+ /* Test input that is considerably larger than n */
+ mpz_mul_2exp (bad_input, pub.n, 100);
+ mpz_add (bad_input, bad_input, gibberish);
+ decrypted_length = msg_length;
+ ASSERT(!rsa_decrypt(&key, &decrypted_length, decrypted, bad_input));
+ ASSERT(!rsa_decrypt_tr(&pub, &key,
+ &lfib, (nettle_random_func *) knuth_lfib_random,
+ &decrypted_length, decrypted, bad_input));
+ ASSERT(!rsa_sec_decrypt(&pub, &key,
+ &lfib, (nettle_random_func *) knuth_lfib_random,
+ decrypted_length, decrypted, bad_input));
ASSERT(decrypted_length == msg_length);
/* Test invalid key. */
@@ -124,6 +150,6 @@ test_main(void)
rsa_private_key_clear(&key);
rsa_public_key_clear(&pub);
mpz_clear(gibberish);
- mpz_clear(zero);
+ mpz_clear(bad_input);
free(decrypted);
}
--
2.31.1

334
SOURCES/nettle-3.8-zeroize-stack.patch Normal file
View File

@ -0,0 +1,334 @@
From 894b22e6d851512776bd62e85e749d6950ce16fc Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Wed, 24 Aug 2022 17:19:57 +0900
Subject: [PATCH] Clear any intermediate data allocate on stack
Signed-off-by: Daiki Ueno <dueno@redhat.com>
---
cbc.c | 3 +++
cfb.c | 13 +++++++++++++
ctr.c | 4 ++++
ctr16.c | 2 ++
ecc-random.c | 3 +++
ecdsa-keygen.c | 2 ++
ecdsa-sign.c | 2 ++
ed25519-sha512-sign.c | 2 ++
ed448-shake256-sign.c | 2 ++
gostdsa-sign.c | 2 ++
hmac.c | 10 +++++++---
nettle-internal.h | 5 +++++
pbkdf2.c | 5 ++++-
pss-mgf1.c | 5 ++++-
pss.c | 4 ++++
15 files changed, 59 insertions(+), 5 deletions(-)
diff --git a/cbc.c b/cbc.c
index 76b6492d..b9da3aa0 100644
--- a/cbc.c
+++ b/cbc.c
@@ -128,6 +128,9 @@ cbc_decrypt(const void *ctx, nettle_cipher_func *f,
length - block_size);
/* Writes first block. */
memxor3(dst, buffer, initial_iv, block_size);
+
+ TMP_CLEAR(buffer, buffer_size);
+ TMP_CLEAR(initial_iv, block_size);
}
}
diff --git a/cfb.c b/cfb.c
index b9da3159..b1b01b9e 100644
--- a/cfb.c
+++ b/cfb.c
@@ -83,6 +83,8 @@ cfb_encrypt(const void *ctx, nettle_cipher_func *f,
/* We do not care about updating IV here. This is the last call in
* message sequence and one has to set IV afterwards anyway */
}
+
+ TMP_CLEAR(buffer, block_size);
}
/* Don't allocate any more space than this on the stack */
@@ -115,6 +117,8 @@ cfb_decrypt(const void *ctx, nettle_cipher_func *f,
f(ctx, block_size, buffer, iv);
memxor3(dst + length, src + length, buffer, left);
+
+ TMP_CLEAR(buffer, block_size);
}
}
else
@@ -160,6 +164,9 @@ cfb_decrypt(const void *ctx, nettle_cipher_func *f,
f(ctx, block_size, buffer, iv);
memxor(dst, buffer, left);
}
+
+ TMP_CLEAR(buffer, buffer_size);
+ TMP_CLEAR(initial_iv, block_size);
}
}
@@ -196,6 +203,9 @@ cfb8_encrypt(const void *ctx, nettle_cipher_func *f,
pos ++;
}
memcpy(iv, buffer + pos, block_size);
+
+ TMP_CLEAR(buffer, block_size * 2);
+ TMP_CLEAR(outbuf, block_size);
}
void
@@ -235,4 +245,7 @@ cfb8_decrypt(const void *ctx, nettle_cipher_func *f,
}
memcpy(iv, buffer + i, block_size);
+
+ TMP_CLEAR(buffer, block_size * 2);
+ TMP_CLEAR(outbuf, block_size * 2);
}
diff --git a/ctr.c b/ctr.c
index 8c6b4626..217d1abb 100644
--- a/ctr.c
+++ b/ctr.c
@@ -137,6 +137,8 @@ ctr_crypt(const void *ctx, nettle_cipher_func *f,
f(ctx, block_size, block, ctr);
INCREMENT(block_size, ctr);
memxor3(dst + filled, src + filled, block, length - filled);
+
+ TMP_CLEAR(block, block_size);
}
}
else
@@ -173,5 +175,7 @@ ctr_crypt(const void *ctx, nettle_cipher_func *f,
INCREMENT(block_size, ctr);
memxor(dst, buffer, length);
}
+
+ TMP_CLEAR(buffer, buffer_size);
}
}
diff --git a/ctr16.c b/ctr16.c
index d744d2a9..ec0abd72 100644
--- a/ctr16.c
+++ b/ctr16.c
@@ -102,5 +102,7 @@ _nettle_ctr_crypt16(const void *ctx, nettle_cipher_func *f,
done:
memxor3 (dst + i, src + i, buffer->b, length - i);
}
+
+ TMP_CLEAR(buffer, MIN(blocks, CTR_BUFFER_LIMIT / 16));
}
}
diff --git a/ecc-random.c b/ecc-random.c
index a7b48d6a..676f5933 100644
--- a/ecc-random.c
+++ b/ecc-random.c
@@ -36,6 +36,7 @@
#endif
#include <assert.h>
+#include <string.h>
#include "ecc.h"
#include "ecc-internal.h"
@@ -79,4 +80,6 @@ ecc_scalar_random (struct ecc_scalar *x,
TMP_ALLOC (scratch, ECC_MOD_RANDOM_ITCH (x->ecc->q.size));
ecc_mod_random (&x->ecc->q, x->p, random_ctx, random, scratch);
+
+ TMP_CLEAR (scratch, ECC_MOD_RANDOM_ITCH (x->ecc->q.size));
}
diff --git a/ecdsa-keygen.c b/ecdsa-keygen.c
index 870282b0..05dd827a 100644
--- a/ecdsa-keygen.c
+++ b/ecdsa-keygen.c
@@ -59,4 +59,6 @@ ecdsa_generate_keypair (struct ecc_point *pub,
ecc_mod_random (&ecc->q, key->p, random_ctx, random, p);
ecc->mul_g (ecc, p, key->p, p + 3*ecc->p.size);
ecc->h_to_a (ecc, 0, pub->p, p, p + 3*ecc->p.size);
+
+ TMP_CLEAR (p, itch);
}
diff --git a/ecdsa-sign.c b/ecdsa-sign.c
index e6fb3287..e6b960bf 100644
--- a/ecdsa-sign.c
+++ b/ecdsa-sign.c
@@ -68,4 +68,6 @@ ecdsa_sign (const struct ecc_scalar *key,
mpz_limbs_finish (signature->s, size);
}
while (mpz_sgn (signature->r) == 0 || mpz_sgn (signature->s) == 0);
+
+ TMP_CLEAR (k, size + ECC_ECDSA_SIGN_ITCH (size));
}
diff --git a/ed25519-sha512-sign.c b/ed25519-sha512-sign.c
index 389a157e..52a46ea5 100644
--- a/ed25519-sha512-sign.c
+++ b/ed25519-sha512-sign.c
@@ -38,6 +38,7 @@
#include "ecc-internal.h"
#include "sha2.h"
+#include <string.h>
void
ed25519_sha512_sign (const uint8_t *pub,
@@ -61,6 +62,7 @@ ed25519_sha512_sign (const uint8_t *pub,
length, msg, signature, scratch_out);
gmp_free_limbs (scratch, itch);
+ explicit_bzero (digest, sizeof(digest));
#undef k1
#undef k2
#undef scratch_out
diff --git a/ed448-shake256-sign.c b/ed448-shake256-sign.c
index c524593d..01abf457 100644
--- a/ed448-shake256-sign.c
+++ b/ed448-shake256-sign.c
@@ -39,6 +39,7 @@
#include "ecc-internal.h"
#include "eddsa-internal.h"
#include "sha3.h"
+#include <string.h>
void
ed448_shake256_sign (const uint8_t *pub,
@@ -63,6 +64,7 @@ ed448_shake256_sign (const uint8_t *pub,
length, msg, signature, scratch_out);
gmp_free_limbs (scratch, itch);
+ explicit_bzero (digest, sizeof(digest));
#undef k1
#undef k2
#undef scratch_out
diff --git a/gostdsa-sign.c b/gostdsa-sign.c
index 892c0742..a7e0c21d 100644
--- a/gostdsa-sign.c
+++ b/gostdsa-sign.c
@@ -71,4 +71,6 @@ gostdsa_sign (const struct ecc_scalar *key,
mpz_limbs_finish (signature->s, size);
}
while (mpz_sgn (signature->r) == 0 || mpz_sgn (signature->s) == 0);
+
+ TMP_CLEAR (k, size + ECC_GOSTDSA_SIGN_ITCH (size));
}
diff --git a/hmac.c b/hmac.c
index 6ac5e11a..0ac33bed 100644
--- a/hmac.c
+++ b/hmac.c
@@ -55,6 +55,8 @@ hmac_set_key(void *outer, void *inner, void *state,
{
TMP_DECL(pad, uint8_t, NETTLE_MAX_HASH_BLOCK_SIZE);
TMP_ALLOC(pad, hash->block_size);
+ TMP_DECL(digest, uint8_t, NETTLE_MAX_HASH_DIGEST_SIZE);
+ TMP_ALLOC(digest, hash->digest_size);
hash->init(outer);
hash->init(inner);
@@ -64,9 +66,6 @@ hmac_set_key(void *outer, void *inner, void *state,
/* Reduce key to the algorithm's hash size. Use the area pointed
* to by state for the temporary state. */
- TMP_DECL(digest, uint8_t, NETTLE_MAX_HASH_DIGEST_SIZE);
- TMP_ALLOC(digest, hash->digest_size);
-
hash->init(state);
hash->update(state, key_length, key);
hash->digest(state, hash->digest_size, digest);
@@ -88,6 +87,9 @@ hmac_set_key(void *outer, void *inner, void *state,
hash->update(inner, hash->block_size, pad);
memcpy(state, inner, hash->context_size);
+
+ TMP_CLEAR(pad, hash->block_size);
+ TMP_CLEAR(digest, hash->digest_size);
}
void
@@ -114,4 +116,6 @@ hmac_digest(const void *outer, const void *inner, void *state,
hash->digest(state, length, dst);
memcpy(state, inner, hash->context_size);
+
+ TMP_CLEAR(digest, hash->digest_size);
}
diff --git a/nettle-internal.h b/nettle-internal.h
index ddc483de..9fc55514 100644
--- a/nettle-internal.h
+++ b/nettle-internal.h
@@ -72,6 +72,11 @@
do { assert((size_t)(size) <= (sizeof(name))); } while (0)
#endif
+#include <string.h> /* explicit_bzero */
+
+#define TMP_CLEAR(name, size) (explicit_bzero (name, sizeof (*name) * (size)))
+#define TMP_CLEAR_ALIGN(name, size) (explicit_bzero (name, size))
+
/* Arbitrary limits which apply to systems that don't have alloca */
#define NETTLE_MAX_HASH_BLOCK_SIZE 128
#define NETTLE_MAX_HASH_DIGEST_SIZE 64
diff --git a/pbkdf2.c b/pbkdf2.c
index 291d138a..a8ecba5b 100644
--- a/pbkdf2.c
+++ b/pbkdf2.c
@@ -92,8 +92,11 @@ pbkdf2 (void *mac_ctx,
if (length <= digest_size)
{
memcpy (dst, T, length);
- return;
+ break;
}
memcpy (dst, T, digest_size);
}
+
+ TMP_CLEAR (U, digest_size);
+ TMP_CLEAR (T, digest_size);
}
diff --git a/pss-mgf1.c b/pss-mgf1.c
index 3f5e204b..3644c642 100644
--- a/pss-mgf1.c
+++ b/pss-mgf1.c
@@ -66,8 +66,11 @@ pss_mgf1(const void *seed, const struct nettle_hash *hash,
if (length <= hash->digest_size)
{
hash->digest(state, length, mask);
- return;
+ break;
}
hash->digest(state, hash->digest_size, mask);
}
+
+ TMP_CLEAR(h, hash->digest_size);
+ TMP_CLEAR_ALIGN(state, hash->context_size);
}
diff --git a/pss.c b/pss.c
index d28e7b13..8106ebf2 100644
--- a/pss.c
+++ b/pss.c
@@ -77,6 +77,7 @@ pss_encode_mgf1(mpz_t m, size_t bits,
if (key_size < hash->digest_size + salt_length + 2)
{
TMP_GMP_FREE(em);
+ TMP_CLEAR_ALIGN(state, hash->context_size);
return 0;
}
@@ -111,6 +112,7 @@ pss_encode_mgf1(mpz_t m, size_t bits,
nettle_mpz_set_str_256_u(m, key_size, em);
TMP_GMP_FREE(em);
+ TMP_CLEAR_ALIGN(state, hash->context_size);
return 1;
}
@@ -194,5 +196,7 @@ pss_verify_mgf1(const mpz_t m, size_t bits,
ret = 1;
cleanup:
TMP_GMP_FREE(em);
+ TMP_CLEAR(h2, hash->digest_size);
+ TMP_CLEAR_ALIGN(state, hash->context_size);
return ret;
}
--
2.37.2

265
SPECS/nettle.spec
View File

@ -1,38 +1,52 @@
# Recent so-version, so we do not bump accidentally.
%global nettle_so_ver 8
%global hogweed_so_ver 6
# Set to 1 when building a bootstrap for a bumped so-name.
%global bootstrap 0
%if 0%{?bootstrap}
%global version_old 3.5.1
%global nettle_so_ver_old 7
%global hogweed_so_ver_old 5
%endif
%bcond_without fips
Name: nettle
Version: 3.4.1
Release: 7%{?dist}
Version: 3.8
Release: 3%{?dist}
Summary: A low-level cryptographic library
Group: Development/Libraries
License: LGPLv3+ or GPLv2+
URL: http://www.lysator.liu.se/~nisse/nettle/
Source0: %{name}-%{version}-hobbled.tar.xz
#Source0: http://www.lysator.liu.se/~nisse/archive/%{name}-%{version}.tar.gz
Patch0: nettle-3.3-remove-ecc-testsuite.patch
Patch1: nettle-3.4-annocheck.patch
Patch2: nettle-3.4.1-enable-intel-cet.patch
# https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009458.html
Patch3: nettle-3.4.1-ecdsa-verify.patch
Patch4: nettle-3.4.1-powerpc64-aes-asm.patch
Patch5: nettle-3.4.1-powerpc64-ghash-asm.patch
Patch6: nettle-3.4.1-rsa-decrypt.patch
#Source0: http://www.lysator.liu.se/~nisse/archive/%%{name}-%%{version}.tar.gz
%if 0%{?bootstrap}
Source1: %{name}-%{version_old}-hobbled.tar.xz
Source2: nettle-3.5-remove-ecc-testsuite.patch
%endif
Patch: nettle-3.4-annocheck.patch
Patch: nettle-3.8-zeroize-stack.patch
Source100: gmp-6.2.1.tar.xz
# Taken from the main gmp package
Source101: gmp-6.2.1-intel-cet.patch
Source102: gmp-6.2.1-zeroize-allocator.patch
BuildRequires: make
BuildRequires: gcc
BuildRequires: gmp-devel, m4
%if !%{with fips}
BuildRequires: gmp-devel
%endif
BuildRequires: m4
BuildRequires: libtool, automake, autoconf, gettext-devel
%if %{with fips}
BuildRequires: fipscheck
%endif
Requires(post): info
Requires(preun): info
%package devel
Summary: Development headers for a low-level cryptographic library
Group: Development/Libraries
Requires: %{name} = %{version}-%{release}
Requires: gmp-devel%{?_isa}
@ -51,38 +65,98 @@ applications with nettle.
%prep
%setup -q
%autosetup -Tb 0 -p1
%if %{with fips}
mkdir -p bundled_gmp
pushd bundled_gmp
tar --strip-components=1 -xf %{SOURCE100}
patch -p1 < %{SOURCE101}
patch -p1 < %{SOURCE102}
popd
# Prevent -lgmp appearing in the compiler command line in dependent components
sed -i '/^Libs.private:/d' hogweed.pc.in
%endif
%if 0%{?bootstrap}
mkdir -p bootstrap_ver
pushd bootstrap_ver
tar --strip-components=1 -xf %{SOURCE1}
patch -p1 < %{SOURCE2}
# Disable -ggdb3 which makes debugedit unhappy
sed s/ggdb3/g/ -i configure
sed 's/ecc-192.c//g' -i Makefile.in
sed 's/ecc-224.c//g' -i Makefile.in
%patch0 -p1
%patch1 -p1
%patch2 -p1
%patch3 -p1
%patch4 -p1
%patch5 -p1
%patch6 -p1
popd
%endif
# Disable -ggdb3 which makes debugedit unhappy
sed s/ggdb3/g/ -i configure
sed 's/ecc-secp192r1.c//g' -i Makefile.in
sed 's/ecc-secp224r1.c//g' -i Makefile.in
%build
%if %{with fips}
pushd bundled_gmp
autoreconf -ifv
%configure --enable-shared --enable-fat
make %{?_smp_mflags}
%configure --disable-cxx --disable-shared --enable-fat --with-pic
%make_build
popd
%endif
autoreconf -ifv
%configure --enable-shared --enable-fat \
%if %{with fips}
--with-include-path=$PWD/bundled_gmp --with-lib-path=$PWD/bundled_gmp/.libs \
%endif
%{nil}
%make_build
%if 0%{?bootstrap}
pushd bootstrap_ver
autoconf
%configure --with-tests
%make_build
popd
%endif
%if %{with fips}
%define fipshmac() \
fipshmac -d $RPM_BUILD_ROOT%{_libdir} $RPM_BUILD_ROOT%{_libdir}/%1.* \
file=`basename $RPM_BUILD_ROOT%{_libdir}/%1.*.hmac` && \
mv $RPM_BUILD_ROOT%{_libdir}/$file $RPM_BUILD_ROOT%{_libdir}/.$file && \
ln -s .$file $RPM_BUILD_ROOT%{_libdir}/.%1.hmac
%if 0%{?bootstrap}
%define bootstrap_fips 1
%endif
%define __spec_install_post \
%{?__debug_package:%{__debug_install_post}} \
%{__arch_install_post} \
%{__os_install_post} \
fipshmac -d $RPM_BUILD_ROOT%{_libdir} $RPM_BUILD_ROOT%{_libdir}/libnettle.so.6.* \
fipshmac -d $RPM_BUILD_ROOT%{_libdir} $RPM_BUILD_ROOT%{_libdir}/libhogweed.so.4.* \
file=`basename $RPM_BUILD_ROOT%{_libdir}/libnettle.so.6.*.hmac` && mv $RPM_BUILD_ROOT%{_libdir}/$file $RPM_BUILD_ROOT%{_libdir}/.$file && ln -s .$file $RPM_BUILD_ROOT%{_libdir}/.libnettle.so.6.hmac \
file=`basename $RPM_BUILD_ROOT%{_libdir}/libhogweed.so.4.*.hmac` && mv $RPM_BUILD_ROOT%{_libdir}/$file $RPM_BUILD_ROOT%{_libdir}/.$file && ln -s .$file $RPM_BUILD_ROOT%{_libdir}/.libhogweed.so.4.hmac \
%fipshmac libnettle.so.%{nettle_so_ver} \
%fipshmac libhogweed.so.%{hogweed_so_ver} \
%{?bootstrap_fips:%fipshmac libnettle.so.%{nettle_so_ver_old}} \
%{?bootstrap_fips:%fipshmac libhogweed.so.%{hogweed_so_ver_old}} \
%{nil}
%endif
%install
make install DESTDIR=$RPM_BUILD_ROOT INSTALL="install -p"
%if 0%{?bootstrap}
make -C bootstrap_ver install-shared-nettle DESTDIR=$RPM_BUILD_ROOT INSTALL="install -p"
make -C bootstrap_ver install-shared-hogweed DESTDIR=$RPM_BUILD_ROOT INSTALL="install -p"
chmod 0755 $RPM_BUILD_ROOT%{_libdir}/libnettle.so.%{nettle_so_ver_old}.*
chmod 0755 $RPM_BUILD_ROOT%{_libdir}/libhogweed.so.%{hogweed_so_ver_old}.*
%endif
%make_install
make install-shared DESTDIR=$RPM_BUILD_ROOT INSTALL="install -p"
mkdir -p $RPM_BUILD_ROOT%{_infodir}
install -p -m 644 nettle.info $RPM_BUILD_ROOT%{_infodir}/
@ -94,20 +168,26 @@ rm -f $RPM_BUILD_ROOT%{_bindir}/sexp-conv
rm -f $RPM_BUILD_ROOT%{_bindir}/nettle-hash
rm -f $RPM_BUILD_ROOT%{_bindir}/nettle-pbkdf2
chmod 0755 $RPM_BUILD_ROOT%{_libdir}/libnettle.so.6.*
chmod 0755 $RPM_BUILD_ROOT%{_libdir}/libhogweed.so.4.*
chmod 0755 $RPM_BUILD_ROOT%{_libdir}/libnettle.so.%{nettle_so_ver}.*
chmod 0755 $RPM_BUILD_ROOT%{_libdir}/libhogweed.so.%{hogweed_so_ver}.*
%check
make check
%files
%doc AUTHORS NEWS README TODO
%doc AUTHORS NEWS README
%license COPYINGv2 COPYING.LESSERv3
%{_infodir}/nettle.info.gz
%{_libdir}/libnettle.so.6
%{_libdir}/libnettle.so.6.*
%{_libdir}/libhogweed.so.4
%{_libdir}/libhogweed.so.4.*
%{_infodir}/nettle.info.*
%{_libdir}/libnettle.so.%{nettle_so_ver}
%{_libdir}/libnettle.so.%{nettle_so_ver}.*
%{_libdir}/libhogweed.so.%{hogweed_so_ver}
%{_libdir}/libhogweed.so.%{hogweed_so_ver}.*
%if 0%{?bootstrap}
%{_libdir}/libnettle.so.%{nettle_so_ver_old}
%{_libdir}/libnettle.so.%{nettle_so_ver_old}.*
%{_libdir}/libhogweed.so.%{hogweed_so_ver_old}
%{_libdir}/libhogweed.so.%{hogweed_so_ver_old}.*
%endif
%if %{with fips}
%{_libdir}/.libhogweed.so.*.hmac
%{_libdir}/.libnettle.so.*.hmac
@ -121,45 +201,94 @@ make check
%{_libdir}/pkgconfig/hogweed.pc
%{_libdir}/pkgconfig/nettle.pc
%post
/sbin/install-info %{_infodir}/%{name}.info %{_infodir}/dir || :
/sbin/ldconfig
%preun
if [ $1 = 0 ]; then
/sbin/install-info --delete %{_infodir}/%{name}.info %{_infodir}/dir || :
fi
%postun -p /sbin/ldconfig
%ldconfig_scriptlets
%changelog
* Wed Jul 14 2021 Daiki Ueno <dueno@redhat.com> - 3.4.1-7
- Backport CVE-2021-3580 from upstream 3.7.3 release (#1967990)
* Thu Aug 25 2022 Daiki Ueno <dueno@redhat.com> - 3.8-3
- Rebuild in new side-tag
* Wed Jul 14 2021 Daiki Ueno <dueno@redhat.com> - 3.4.1-6
- Enable CTR mode optimization when the block size is 16
* Thu Aug 18 2022 Daiki Ueno <dueno@redhat.com> - 3.8-2
- Bundle GMP to privatize memory functions
- Zeroize stack allocated intermediate data
* Wed Jun 30 2021 Daiki Ueno <dueno@redhat.com> - 3.4.1-5
- Backport powerpc64 optimization patches from upstream (#1855228)
Patch from Christopher M. Riedl.
* Tue Jun 28 2022 Daiki Ueno <dueno@redhat.com> - 3.8-1
- Update to nettle 3.8 (#2100350)
* Wed Apr 7 2021 Daiki Ueno <dueno@redhat.com> - 3.4.1-4
- Fix patch application
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 3.7.3-2
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Tue Mar 30 2021 Daiki Ueno <dueno@redhat.com> - 3.4.1-3
- Port fixes for potential miscalculation in ecdsa_verify (#1942925)
* Wed Jul 28 2021 Daiki Ueno <dueno@redhat.com> - 3.7.3-1
- Update to nettle 3.7.3 (#1986712)
* Fri May 15 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.4.1-2
- Enable Intel CET support (#1737542)
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 3.7.2-2
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Tue Dec 11 2018 Daiki Ueno <dueno@redhat.com> - 3.4.1-1
* Sun Mar 21 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-1
- Update to nettle 3.7.2
- Merge nettle-3.6-remove-ecc-testsuite.patch to hobble-nettle script
* Tue Mar 9 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-1
- Update to nettle 3.7.1
* Wed Feb 10 2021 Daiki Ueno <dueno@redhat.com> - 3.7-3
- Port a fix for chacha counter issue on ppc64le
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.7-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Mon Jan 11 2021 Daiki Ueno <dueno@redhat.com> - 3.7-1
- Update to nettle 3.7
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.6-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue Jul 14 2020 Tom Stellard <tstellar@redhat.com> - 3.6-2
- Use make macros
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
* Mon May 4 2020 Daiki Ueno <dueno@redhat.com> - 3.6-1
- Update to nettle 3.6
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.5.1-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Thu Oct 31 2019 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.5.1-4
- New upstream release
* Tue Oct 16 2018 Tomáš Mráz <tmraz@redhat.com> - 3.4-4
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.5.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Tue Jul 16 2019 Daiki Ueno <dueno@redhat.com> - 3.5.1-2
- Rebuild with bootstrap enabled
* Mon Jul 15 2019 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.5.1-1
- New upstream release
* Wed Apr 24 2019 Björn Esser <besser82@fedoraproject.org> - 3.4.1rc1-3
- Remove hardcoded gzip suffix from GNU info pages
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.4.1rc1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Fri Nov 30 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.4.1rc1-1
- New upstream release; provides API for constant memory access RSA operations
* Tue Oct 16 2018 Tomáš Mráz <tmraz@redhat.com> - 3.4-7
- Generate the .hmac checksums unless --without fips is used
* Tue Oct 16 2018 Tomáš Mráz <tmraz@redhat.com> - 3.4-6
- Cover the gaps in annotation coverage for assembler sources
- Add .hmac checksums for FIPS mode integrity checking
* Fri Aug 31 2018 Leigh Scott <leigh123linux@googlemail.com> - 3.4-5
- update libary versions used for fips
* Sat Jul 28 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 3.4-4
- Replace obsolete scriptlets
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild