Fixed in rG69614d55018d: scd: Support longer data length for special DOs for v3 card..

Fixed in rC1d8e4c2c3a7d: Remove byte order mark.

Thank you for the report. I think that there is a https://en.wikipedia.org/wiki/Byte_order_mark in those files.

https://patents.stackexchange.com/questions/5766/is-an-expired-patent-in-the-public-domain

I found US patent which is expired due to fee: https://patents.google.com/patent/US7080109B2/en
The technique is described in : https://koclab.cs.ucsb.edu/docs/koc/j56.pdf
This is related paper: https://koclab.cs.ucsb.edu/docs/koc/j47.pdf

Intel has patent application for folding technique for Montgomery reduction: US8392494
which is described in this paper: https://www.cse.buffalo.edu/srds2009/escs2009_submission_Gopal.pdf

Intel has patent application for folding technique for Barret reduction: US20070297601
and it is granted as: US8229109

The part of using Simultaneous Multiple Exponentiation (SME) for RSA is not patented, I think.
So, let me consider with SME.

Another area would be faster (constant time) Barrett reduction.

In search of algorithm, I found this slide:
http://www1.spms.ntu.edu.sg/~ccrg/documents/chienning-multiexponentiation.pdf

Applied as rG8fd9f72e1b2e: rsa: Add exponent blinding..
Needed rG994d5b707559: rsa: Allow different build directory. for different build directory.
And added rG1b1f44846b5f: rsa: Reduce secmem pressure. to lower the secmem pressure.

OK, I'm going to apply this patch to gpg1.4 and then, to modify a bit to lower the secmem pressure.

(1) is done in rG12029f83fd0a: mpi: Same computation for square and multiply for mpi_pow..
(3) is partially done.

For your reference, this is the BSI document URL: https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Zertifizierung/Interpretationen/AIS_46_BSI_guidelines_SCA_RSA_V1_0_e_pdf.html

Comments (and complaints to academic paper :-) were at jabber, yesterday. My point is that their claims are for their community to be accepted as a good paper, I have my own view.

I can replicate the issue on my system.
It is not the line 681, actually.

I think that the problem is in your usage with your tool. Please have a look at md_open function in cipher/md.c.
This bug is not the one in libgcrypt, but in the compiler.

Same argument can apply to MD5. See T3249: sha256.c:265:3: runtime error: unsigned integer overflow: 4084723048 + 1633837952 cannot be represented in type 'unsigned int' of SHA2.

See T3245: cipher-gcm-intel-pclmul.c:418:17: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'size_t' (aka 'unsigned long').

See T3248: mpiutil.c:501:37: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'unsigned long' for unsigned integer overflow.

It is intentionally used.
And in the C programming language, it is defined that unsigned integer never overflows (it is computed as modulo 2).

See T3249: sha256.c:265:3: runtime error: unsigned integer overflow: 4084723048 + 1633837952 cannot be represented in type 'unsigned int'.

In the SHA2 computation, it is defined that addition is calculated modulo 2^32.
And in the C programming language, "unsigned integer" operation never overflows (it is defined as modulo).

OK, closed.

"gpg: selecting openpgp failed: Operation not supported by device" means that gpg tried to access smartcard (expecting OpenPGP card), but it failed.

Specification is finished.

bit 0 (in smartcard context, we say b1 as it starts from 1) of Extended Capabilities specifies if KDF-DO is supported.

Tag for KDF-DO is assigned as:

This bug was introduced when I tried to handle T1983: gpg2 prefers missing secret key to available key on card. In master, this bug was fixed in: rGfbb2259d22e6: g10: Fix default-key selection for signing, possibly by card.

Applied in rCe0958debe1a7: secmem: Fix SEGV and stat calculation..

Here is a test case:

libgcrypt secmem fix is not that in hurry, I think. nPTh bug for macOS sounds more severe.

I managed to replicate this issue by preparing artificial nPth on x86 GNU/Linux.

I fixed a bug in nPth: rPTH4fae99976c31: Fix busy_wait_for.
During this debug, I also found a bug and fixed in libassuan: rA62f3123d3877: Use gpgrt_free to release memory allocated by gpgrt_asprintf.
Also, I fixed two related bug in GnuPG:
rGc03e0eb01dc4: agent: Fix error from do_encryption.
rG996544626ea4: agent: Fix memory leaks.