diff --git a/NEWS b/NEWS index 0678dd28..76dada39 100644 --- a/NEWS +++ b/NEWS @@ -1,586 +1,588 @@ Noteworthy changes in version 1.4.4 ------------------------------------------------ * Publish GCRY_MODULE_ID_USER and GCRY_MODULE_ID_USER_LAST constants. This functionality is in Libgcrypt since 1.3.0. + * MD5 may now be used in non-enforced fips mode. + Noteworthy changes in version 1.4.3 (2008-09-18) ------------------------------------------------ * Try to auto-initialize Libgcrypt to minimize the effect of applications not doing that correctly. This is not a perfect solution but given that many applicationion would totally fail without such a hack, we try to help at least with the most common cases. Folks, please read the manual to learn how to properly initialize Libgcrypt! * Auto-initialize the secure memory to 32k instead of aborting the process. * Log fatal errors via syslog. * Changed the name and the semantics of the fips mode config file. * Add convenience macro gcry_fips_mode_active. * More self-tests. * Documentation cleanups. Noteworthy changes in version 1.4.2 (2008-09-08) ------------------------------------------------ * The long missing gcry_mpi_lshift function has been added. * RSA key generation now supports a "transient-key" flag. * The keygrip computation for ECDSA has been implemented thus ECDSA is now fully supported. * A few macros have been replaced by functions for better type checking. * The thread initialization structure now carries version information. * The manual describes more clearly how to initialize Libgcrypt. * The library may now be switched into a FIPS mode. * Interface changes relative to the 1.3.0 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ GCRYCTL_OPERATIONAL_P NEW. GCRYCTL_FIPS_MODE_P NEW. GCRYCTL_FORCE_FIPS_MODE NEW. gcry_cipher_setkey NEW: Replaces macro. gcry_cipher_setiv NEW: Replaces macro. gcry_cipher_setctr NEW: Replaces macro. gcry_mpi_lshift NEW. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Noteworthy changes in version 1.4.1 (2008-04-25) ------------------------------------------------ * Fixed a bug introduced by 1.3.1 which led to the comsumption of far too much entropy for the intial seeding. * Improved AES performance for CFB and CBC modes. * Removed build problems for the Padlock support. Noteworthy changes in version 1.4.0 (2007-12-10) ------------------------------------------------ * New configure option --disable-padlock-support which is mostly useful in case of build problems. Noteworthy changes in version 1.3.2 (2007-12-03) ------------------------------------------------ * The visibility attribute is now used if supported by the toolchain. * The ACE engine of VIA processors is now used for AES-128. * The ASN.1 DER template for SHA-224 has been fixed. Noteworthy changes in version 1.3.1 (2007-10-26) ------------------------------------------------ * The entire library is now under the LGPL. The helper programs and the manual are under the GPL. Kudos to Peter Gutmann for giving permissions to relicense the rndw32 and rndunix modules. * The Camellia cipher is now under the LGPL and included by default. * Fixed a bug in the detection of symbol prefixes which inhibited the build of optimzied assembler code on certain systems. * Updated the entropy gatherer for W32. Noteworthy changes in version 1.3.0 (2007-05-04) ------------------------------------------------ * Changed the way the RNG gets initialized. This allows to keep it uninitialized as long as no random numbers are used. To override this, the new macro gcry_fast_random_poll may be used. It is in general a good idea to spread this macro into the application code to make sure that these polls happen often enough. * Made the RNG immune against fork without exec. * Reading and writing the random seed file is now protected by a fcntl style file lock on systems that provide this function. * Support for SHA-224 and HMAC using SHA-384 and SHA-512. * Support for the SEED cipher. * Support for the Camellia cipher. Note that Camellia is disabled by default, and that enabling it changes the license of libgcrypt from LGPL to GPL. * Support for OFB encryption mode. * gcry_mpi_rshift does not anymore truncate the shift count. * Reserved algorithm ranges for use by applications. * Support for DSA2. * The new function gcry_md_debug should be used instead of the gcry_md_start_debug and gcry_md_stop_debug macros. * New configure option --enable-random-daemon to support a system wide random daemon. The daemon code is experimental and not yet very well working. It will eventually allow to keep a global random pool for the sake of short living processes. * Non executable stack support is now used by default on systems supporting it. * Support for Microsoft Windows. * Assembler support for the AMD64 architecture. * New configure option --enable-mpi-path for optimized builds. * Experimental support for ECDSA; should only be used for testing. * New control code GCRYCTL_PRINT_CONFIG to print the build configuration. * Minor changes to some function declarations. Buffer arguments are now typed as void pointer. This should not affect any compilation. Fixed two bugs in return values and clarified documentation. * Interface changes relative to the 1.2.0 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ gcry_fast_random_poll NEW gcry_md_debug NEW gcry_sexp_nth_string NEW GCRY_MD_SHA224 NEW GCRY_PK_USAGE_CERT NEW GCRY_PK_USAGE_AUTH NEW GCRY_PK_USAGE_UNKN NEW GCRY_PK_ECDSA NEW GCRY_CIPHER_SEED NEW GCRY_CIPHER_CAMELLIA128 NEW GCRY_CIPHER_CAMELLIA192 NEW GCRY_CIPHER_CAMELLIA256 NEW GCRYCTL_FAKED_RANDOM_P NEW GCRYCTL_PRINT_CONFIG NEW GCRYCTL_SET_RNDEGD_SOCKET NEW. gcry_mpi_scan CHANGED: Argument BUFFER is now void*. gcry_pk_algo_name CHANGED: Returns "?" instead of NULL. gcry_cipher_algo_name CHANGED: Returns "?" instead of "". gcry_pk_spec_t CHANGED: Element ALIASES is now const ptr. gcry_md_write_t CHANGED: Argument BUF is now a const void*. gcry_md_ctl CHANGED: Argument BUFFER is now void*. gcry_cipher_encrypt CHANGED: Arguments IN and OUT are now void*. gcry_cipher_decrypt CHANGED: Arguments IN and OUT are now void*. gcry_sexp_sprint CHANGED: Argument BUFFER is now void*. gcry_create_nonce CHANGED: Argument BUFFER is now void*. gcry_randomize CHANGED: Argument BUFFER is now void*. gcry_cipher_register CHANGED: Argument ALGORITHM_ID is now int*. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Noteworthy changes in version 1.2.0 (2004-04-15) ------------------------------------------------ * First stable release. Noteworthy changes in version 1.1.94 (2004-03-29) ------------------------------------------------- * The support for multi-threaded users goes into its third incarnation. We removed compile time support for thread libraries. To support the thread library of your choice, you have to set up callback handlers at initialization time. New data structures, a new control command, and default initializers are provided for this purpose. * Interface changes relative to the 1.1.93 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ libgcrypt-config --thread OBSOLETE libgcrypt-pth.la REMOVED libgcrypt-pthread.la REMOVED GCRYCTL_SET_THREAD_CBS NEW struct gcrypt_thread_cbs NEW enum gcry_thread_option NEW GCRY_THREAD_OPTION_PTH_IMPL NEW GCRY_THREAD_OPTION_PTHREAD_IMPL NEW ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Noteworthy changes in version 1.1.93 (2004-03-06) ------------------------------------------------- * The automatic thread library detection has finally been removed. From now on, only linking explicitely to libgcrypt, libgcrypt-pth or libgcrypt-pthread is supported. Noteworthy changes in version 1.1.92 (2004-02-20) ------------------------------------------------- * Minor bug fixes. * Included a limited implementation of RFC2268. * Changed API of the gcry_ac_ functions. Only a very few programs should be affected by this. * Interface changes relative to the 1.1.91 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ GCRY_CIPHER_RFC2268_40 NEW. gcry_ac_data_set CHANGED: New argument FLAGS. gcry_ac_data_get_name CHANGED: New argument FLAGS. gcry_ac_data_get_index CHANGED: New argument FLAGS. gcry_ac_key_pair_generate CHANGED: New and reordered arguments. gcry_ac_key_test CHANGED: New argument HANDLE. gcry_ac_key_get_nbits CHANGED: New argument HANDLE. gcry_ac_key_get_grip CHANGED: New argument HANDLE. gcry_ac_data_search REMOVED. gcry_ac_data_add REMOVED. GCRY_AC_DATA_FLAG_NO_BLINDING REMOVED. GCRY_AC_FLAG_NO_BLINDING NEW: Replaces above. Noteworthy changes in version 1.1.91 (2003-12-19) ------------------------------------------------- * Code cleanups and minor bug fixes. Noteworthy changes in version 1.1.90 (2003-11-14) ------------------------------------------------- * The use of the GCRY_WEAK_RANDOM level is now deprecated in favor of the new gcry_create_nonce function. * gcry_sexp_build now supports a "%b" format to include a memory buffer. * Minor configuration fixes. * Interface changes relative to the 1.1.44 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ gcry_create_nonce NEW gcry_sexp_build ENHANCED Noteworthy changes in version 1.1.44 (2003-10-31) ------------------------------------------------- * Bug fixes and more code cleanups. * Enhanced the prime API. * Interface changes relative to the 1.1.43 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ gcry_prime_group_generator NEW gcry_prime_release_factors NEW Noteworthy changes in version 1.1.43 (2003-09-04) ------------------------------------------------- * Bug fixes and internal code cleanups. * Support for the Serpent cipher algorithm. * Interface changes relative to the 1.1.42 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ gcry_prime_generate NEW gcry_prime_check NEW Noteworthy changes in version 1.1.42 (2003-07-31) ------------------------------------------------- * Major API cleanup. Applications need to be converted to the new API. See README.apichanges for hints on how to do that. Backward compatibility is provided where it was possible without too much effort and did not collide with the overall sanitization effort. However, this is only for ease of transition. NO DEPRECATED FUNCTION OR DATA TYPE IS CONSIDERED A PART OF THE API OR ABI AND WILL BE DROPPED IN THE FUTURE WITHOUT CHANGING THE SONAME OF THE LIBRARY. * If gcrypt.h is included in sources compiled by GCC 3.1 or later, deprecated attributes will warn about use of obsolete functions and type definitions. You can suppress these warnings by passing -Wno-deprecated-declarations to the gcc command. * gcry_check_version must be called from now on to initialize the library, it is not longer optional. * Removed `libgcrypt errno' concept. * Libgcrypt depends on libgpg-error, a library that provides error codes and according functions for all GnuPG components. Functions that used to return error codes asa `int' have been changed to return a code of type `gcry_error_t'. All GCRYERR_* error symbols have been removed, since they are now contained in libgpg-error (GPG_ERR_*). All functions and types in libgpg-error have also been wrapped in Libgcrypt. The new types are gcry_err_code_t and gcry_err_source_t. The new functions are gcry_err_code, gcry_err_source, gcry_error, gcry_err_make, gcry_error_from_errno, gcry_err_make_from_errno, gcry_err_code_from_errno, gcry_err_code_to_errno, gcry_strsource. * New function gcry_mpi_dump to help in debugging. * Added alternative interface for asymmetric cryptography. * CRC-32, CRC-32 a'la RFC 1510, CRC-24 a'la RFC 2440 are now supported. * SHA-256, SHA-384 and SHA-512 are now supported. * 128 bit Twofish is now supported. * The random module won't print the "not enough random bytes available" anymore. A new progress status is issued instead. * CBC-MAC for block ciphers is now supported, by using a GCRY_CIPHER_CBC_MAC cipher flag. * CTR mode for block ciphers is now supported. * The public RSA exponent can now be specified in key generation. * RSA blinding is now supported and is used automatically for RSA decryption. It can be explicitely disabled by using the `no-blinding' symbol in the `flags' S-Expression or by using the GCRY_AC_FLAG_DATA_NO_BLINDING flag when using the ac interface. * gcry_sexp_canon_len does not use a `historically encoded' error code anymore. * Interface changes relative to the 1.1.12 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ GCRY_MPI DEPRECATED; Use: gcry_mpi_t GcryMPI DEPRECATED; Use: gcry_mpi_t GCRY_SEXP DEPRECATED; Use: gcry_sexp_t GcrySexp DEPRECATED; Use: gcry_sexp_t GCRY_CIPHER_HD DEPRECATED; Use: gcry_cipher_hd_t GcryCipherHd DEPRECATED; Use: gcry_cipher_hd_t GCRY_MD_HD DEPRECATED; Use: gcry_md_hd_t GcryMDHd DEPRECATED; Use: gcry_md_hd_t gcry_error_t NEW gcry_err_code_t NEW gcry_err_source_t NEW gcry_err_make NEW gcry_error NEW gcry_err_code NEW gcry_err_source NEW gcry_err_code_from_errno NEW gcry_err_code_to_errno NEW gcry_err_make_from_errno NEW gcry_error_from_errno NEW gcry_strsource NEW GCRYERR_{some error code} REMOVED; Use GPG_ERR_* from libgpg-error instead. gcry_errno REMOVED gcry_sexp_canon_len CHANGED gcry_sexp_build_array NEW gcry_mpi_scan CHANGED: New argument to separate in/out args. gcry_mpi_print CHANGED: Ditto. gcry_mpi_dump NEW gcry_cipher_open CHANGED gcry_cipher_reset NEW gcry_cipher_register NEW gcry_cipher_unregister NEW gcry_cipher_list NEW gcry_cipher_algo_keylen REPLACED macro with function. gcry_cipher_algo_blklen REPLACED macro with function. gcry_pk_register NEW gcry_pk_unregister NEW gcry_pk_list NEW gcry_pk_decrypt ENHANCED: Allows flag to return complete S-expression. gcry_md_open CHANGED gcry_md_copy CHANGED gcry_md_is_enabled NEW gcry_md_is_secure NEW gcry_md_register NEW gcry_md_unregister NEW gcry_md_list NEW gcry_ac_data_t NEW gcry_ac_key_t NEW gcry_ac_key_pair_t NEW gcry_ac_handle_t NEW gcry_ac_key_spec_rsa_t NEW gcry_ac_data_new NEW gcry_ac_data_destroy NEW gcry_ac_data_set NEW gcry_ac_data_copy NEW gcry_ac_data_length NEW gcry_ac_data_get_name NEW gcry_ac_data_get_index NEW gcry_ac_data_clear NEW gcry_ac_open NEW gcry_ac_close NEW gcry_ac_key_init NEW gcry_ac_key_pair_generate NEW gcry_ac_key_pair_extract NEW gcry_ac_key_data_get NEW gcry_ac_key_test NEW gcry_ac_key_get_nbits NEW gcry_ac_key_get_grip NEW gcry_ac_key_destroy NEW gcry_ac_key_pair_destroy NEW gcry_ac_data_encrypt NEW gcry_ac_data_decrypt NEW gcry_ac_data_sign NEW gcry_ac_data_verify NEW gcry_ac_id_to_name NEW gcry_ac_name_to_id NEW gcry_handler_progress_t NEW gcry_handler_alloc_t NEW gcry_handler_secure_check_t NEW gcry_handle_realloc_t NEW gcry_handler_free_t NEW gcry_handler_no_mem_t NEW gcry_handler_error_t NEW gcry_handler_log_t NEW ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Noteworthy changes in version 1.1.12 (2003-01-20) ------------------------------------------------- * gcry_pk_sign, gcry_pk_verify and gcry_pk_encrypt can now handle an optional pkcs1 flags parameter in the S-expression. A similar flag may be passed to gcry_pk_decrypt but it is only syntactically implemented. * New convenience macro gcry_md_get_asnoid. * There is now some real stuff in the manual. Noteworthy changes in version 1.1.11 (2002-12-21) ------------------------------------------------- * Don't export internal symbols anymore (currently only for GNU systems) * New algorithm: MD4 * Implemented ciphertext stealing. * Smaller bugs fixes and a few new OIDs. * Interface changes relative to the 1.1.8 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ gcry_cipher_cts NEW ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Noteworthy changes in version 1.1.10 (2002-09-20) ------------------------------------------------- * Fixed shared library builds for i386, PPC and Sparc. * Added simple benchmark tool. * Replaced the internal mutexes by code which automatically adapts to the used threading library. Currently Pth and Pthread are supported. For non-ELF systems the GNU toolchain is now required.. * Added untested support to build Windows DLLs. Noteworthy changes in version 1.1.9 (2002-08-23) ------------------------------------------------ * Support for plain old DES. Noteworthy changes in version 1.1.8 (2002-06-25) ------------------------------------------------ * Minor cleanups and exported a few new functions. * Interface changes relative to the 1.1.7 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ gcry_mpi_div NEW gcry_mpi_mod NEW gcry_mpi_invm NEW gcry_mpi_swap NEW ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Noteworthy changes in version 1.1.7 (2002-05-21) ------------------------------------------------ * Libgcrypt is now distributed under the terms of the GNU Lesser General Public License; see the README file for details. * It is possible to use libgcrypt w/o intialized secure memory. * Libgcrypt should now be thread safe after the initialization. gcry_control (GCRYCRL_INITIALIZATION_FINISHED,NULL,0) should have been called before creating additional threads. * Interface changes relative to the 1.1.6 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ GCRYCTL_DISABLE_INTERNAL_LOCKING NEW GCRYCTL_DISABLE_SECMEM NEW GCRYCTL_INITIALIZATION_FINISHED NEW GCRYCTL_INITIALIZATION_FINISHED_P NEW GCRYCTL_ANY_INITIALIZATION_P NEW gcry_strdup NEW gcry_sexp_create NEW gcry_sexp_new NEW gcry_set_progress_handler NEW ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Noteworthy changes in version 1.1.6 (2002-02-07) ------------------------------------------------ * Enhanced the S-expression conversion functions. Noteworthy changes in version 1.1.5 (2001-12-18) ------------------------------------------------ * gcry_{cipher,md}_map_name are now able to map stringified object IDs. * New functions gcry_sexp_canon_len and gcry_cipher_mode_from_oid. * Closed some memory leaks. Noteworthy changes in version 1.1.4 (2001-08-03) ------------------------------------------------ * Arcfour does now work. * Some minor fixes. * Added a first test program * Migrated to autoconf 2.52. Noteworthy changes in version 1.1.3 (2001-05-31) ------------------------------------------------ * First release of Libgcrypt which is a result of splitting GnuPG into into libgcrypt and GnuPG. Copyright 2001, 2002, 2003, 2004, 2007, 2008 Free Software Foundation, Inc. This file is free software; as a special exception the author gives unlimited permission to copy and/or distribute it, with or without modifications, as long as this notice is preserved. This file is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY, to the extent permitted by law; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. diff --git a/cipher/ChangeLog b/cipher/ChangeLog index b8ed7921..6e24cfc0 100644 --- a/cipher/ChangeLog +++ b/cipher/ChangeLog @@ -1,3785 +1,3791 @@ +2008-10-24 Werner Koch + + * md.c (digest_table): Allow MD5 in fips mode. + (md_register_default): Take special action for MD5. + (md_enable, gcry_md_hash_buffer): Ditto. + 2008-09-30 Werner Koch * rijndael.c (do_setkey): Properly align "t" and "tk". (prepare_decryption): Properly align "w". Fixes bug #936. 2008-09-18 Werner Koch * pubkey.c (gcry_pk_genkey): Parse domain parameter. (pubkey_generate): Add new arg DOMAIN and remove special case for DSA with qbits. * rsa.c (rsa_generate): Add dummy args QBITS, NAME and DOMAIN and rename to rsa_generate_ext. Change caller. (_gcry_rsa_generate, _gcry_rsa_check_secret_key) (_gcry_rsa_encrypt, _gcry_rsa_decrypt, _gcry_rsa_sign) (_gcry_rsa_verify, _gcry_rsa_get_nbits): Make static and remove _gcry_ prefix. (_gcry_pubkey_spec_rsa, _gcry_pubkey_extraspec_rsa): Adjust names. * dsa.c (dsa_generate_ext): New. (_gcry_dsa_generate): Replace code by a call to dsa_generate. (_gcry_dsa_check_secret_key, _gcry_dsa_sign, _gcry_dsa_verify) (_gcry_dsa_get_nbits): Make static and remove _gcry prefix. (_gcry_dsa_generate2): Remove. (_gcry_pubkey_spec_dsa): Adjust to name changes. (_gcry_pubkey_extraspec_rsa): Add dsa_generate_ext. 2008-09-16 Werner Koch * ecc.c (run_selftests): Add arg EXTENDED. 2008-09-12 Werner Koch * rsa.c (test_keys): Do a bad case signature check. * dsa.c (test_keys): Do a bad case check. * cipher.c (_gcry_cipher_selftest): Add arg EXTENDED and pass it to the called tests. * md.c (_gcry_md_selftest): Ditto. * pubkey.c (_gcry_pk_selftest): Ditto. * rijndael.c (run_selftests): Add arg EXTENDED and pass it to the called tests. (selftest_fips_128): Add arg EXTENDED and run only one test non-extended mode. (selftest_fips_192): Add dummy arg EXTENDED. (selftest_fips_256): Ditto. * hmac-tests.c (_gcry_hmac_selftest): Ditto. (run_selftests): Ditto. (selftests_sha1): Add arg EXTENDED and run only one test non-extended mode. (selftests_sha224, selftests_sha256): Ditto. (selftests_sha384, selftests_sha512): Ditto. * sha1.c (run_selftests): Add arg EXTENDED and pass it to the called test. (selftests_sha1): Add arg EXTENDED and run only one test non-extended mode. * sha256.c (run_selftests): Add arg EXTENDED and pass it to the called tests. (selftests_sha224): Add arg EXTENDED and run only one test non-extended mode. (selftests_sha256): Ditto. * sha512.c (run_selftests): Add arg EXTENDED and pass it to the called tests. (selftests_sha384): Add arg EXTENDED and run only one test non-extended mode. (selftests_sha512): Ditto. * des.c (run_selftests): Add arg EXTENDED and pass it to the called test. (selftest_fips): Add dummy arg EXTENDED. * rsa.c (run_selftests): Add dummy arg EXTENDED. * dsa.c (run_selftests): Add dummy arg EXTENDED. * rsa.c (extract_a_from_sexp): New. (selftest_encr_1024): Check that the ciphertext does not match the plaintext. (test_keys): Improve tests and return an error status. (generate): Return an error if test_keys fails. * dsa.c (test_keys): Add comments and return an error status. (generate): Return an error if test_keys failed. 2008-09-11 Werner Koch * rsa.c (_gcry_rsa_decrypt): Return an error instead of calling BUG in case of a practically impossible condition. (sample_secret_key, sample_public_key): New. (selftest_sign_1024, selftest_encr_1024): New. (selftests_rsa): Implement tests. * dsa.c (sample_secret_key, sample_public_key): New. (selftest_sign_1024): New. (selftests_dsa): Implement tests. 2008-09-09 Werner Koch * hmac-tests.c (selftests_sha1): Add tests. (selftests_sha224, selftests_sha384, selftests_sha512): Make up tests. * hash-common.c, hash-common.h: New. * sha1.c (selftests_sha1): Add 3 tests. * sha256.c (selftests_sha256, selftests_sha224): Ditto. * sha512.c (selftests_sha512, selftests_sha384): Ditto. 2008-08-29 Werner Koch * pubkey.c (gcry_pk_get_keygrip): Remove the special case for RSA and check whether a custom computation function has been setup. * rsa.c (compute_keygrip): New. (_gcry_pubkey_extraspec_rsa): Setup this function. * ecc.c (compute_keygrip): New. (_gcry_pubkey_extraspec_ecdsa): Setup this function. 2008-08-28 Werner Koch * cipher.c (cipher_decrypt, cipher_encrypt): Return an error if mode NONE is used. (gcry_cipher_open): Allow mode NONE only with a debug flag set and if not in FIPS mode. 2008-08-26 Werner Koch * pubkey.c (pubkey_generate): Add arg KEYGEN_FLAGS. (gcry_pk_genkey): Implement new parameter "transient-key" and pass it as flags to pubkey_generate. (pubkey_generate): Make use of an ext_generate function. * rsa.c (generate): Add new arg transient_key and pass appropriate args to the prime generator. (_gcry_rsa_generate): Factor all code out to ... (rsa_generate): .. new func with extra arg KEYGEN_FLAGS. (_gcry_pubkey_extraspec_ecdsa): Setup rsa_generate. * primegen.c (_gcry_generate_secret_prime) (_gcry_generate_public_prime): Add new arg RANDOM_LEVEL. 2008-08-21 Werner Koch * primegen.c (_gcry_generate_secret_prime) (_gcry_generate_public_prime): Use a constant macro for the random level. 2008-08-19 Werner Koch * pubkey.c (sexp_elements_extract_ecc) [!USE_ECC]: Do not allow allow "curve" parameter. 2008-08-15 Werner Koch * pubkey.c (_gcry_pk_selftest): New. * dsa.c (selftests_dsa, run_selftests): New. * rsa.c (selftests_rsa, run_selftests): New. * ecc.c (selftests_ecdsa, run_selftests): New. * md.c (_gcry_md_selftest): New. * sha1.c (run_selftests, selftests_sha1): New. * sha256.c (selftests_sha224, selftests_sha256, run_selftests): New. * sha512.c (selftests_sha384, selftests_sha512, run_selftests): New. * des.c (selftest): Remove static variable form selftest. (des_setkey): No on-the-fly self test in fips mode. (tripledes_set3keys): Ditto. * cipher.c (_gcry_cipher_setkey, _gcry_cipher_setiv): * dsa.c (generate): Bail out in fips mode if NBITS is less than 1024. * rsa.c (generate): Return an error code if the the requested size is less than 1024 and we are in fpis mode. (_gcry_rsa_generate): Take care of that error code. * ecc.c (generate_curve): In fips mode enable only NIST curves. * cipher.c (_gcry_cipher_selftest): New. * sha512.c (_gcry_digest_extraspec_sha384) (_gcry_digest_extraspec_sha512): New. * sha256.c (_gcry_digest_extraspec_sha224) (_gcry_digest_extraspec_sha256): New. * sha1.c (_gcry_digest_extraspec_sha1): New. * ecc.c (_gcry_pubkey_extraspec_ecdsa): New. * dsa.c (_gcry_pubkey_extraspec_dsa): New. * rsa.c (_gcry_pubkey_extraspec_rsa): New. * rijndael.c (_gcry_cipher_extraspec_aes) (_gcry_cipher_extraspec_aes192, _gcry_cipher_extraspec_aes256): New. * des.c (_gcry_cipher_extraspec_tripledes): New. * cipher.c (gcry_cipher_register): Rename to _gcry_cipher_register. Add arg EXTRASPEC. (dummy_extra_spec): New. (cipher_table_entry): Add extraspec field. * md.c (_gcry_md_register): Rename to _gcry_md_register. Add arg EXTRASPEC. (dummy_extra_spec): New. (digest_table_entry): Add extraspec field. * pubkey.c (gcry_pk_register): Rename to _gcry_pk_register. Add arg EXTRASPEC. (dummy_extra_spec): New. (pubkey_table_entry): Add extraspec field. * ac.c: Let most public functions return GPG_ERR_UNSUPPORTED in fips mode. * pubkey.c (pubkey_table_entry): Add field FIPS_ALLOWED and mark appropriate algorithms. (dummy_generate, dummy_check_secret_key, dummy_encrypt) (dummy_decrypt, dummy_sign, dummy_verify, dummy_get_nbits): Signal a fips error when used. (gcry_pk_register): In fips mode do not allow to register new algorithms. * md.c (digest_table): Add field FIPS_ALLOWED and mark appropriate algorithms. (md_register_default): In fips mode register only fips algorithms. (gcry_md_register): In fips mode do not allow to register new algorithms. (gcry_md_get): Signal a fips error if called. (gcry_md_hash_buffer): Do not allow rmd160 when not in fips mode. (md_start_debug): Disable in fips_mode. * md.c (gcry_md_register_default): Rename to .. (md_register_default): .. this. (md_digest): Remove this commented fucntion. * pubkey.c (gcry_pk_register_default): Rename to .. (pk_register_default): .. this. * cipher.c (cipher_table_entry): Add field FIPS_ALLOWED. (gcry_cipher_register_default): Register only fips approved algorithms. (gcry_cipher_register): Do not allow to register new ciphers. (cipher_setiv): Signal fips error. * cipher (gcry_cipher_register_default): Rename to .. (cipher_register_default): .. this. (REGISTER_DEFAULT_CIPHERS): Adjust for that change. 2008-07-05 Werner Koch * random-daemon.c, random.h, rndhw.c, rndunix.c, rand-internal.h * random.c, rndegd.c, rndlinux.c, rndw32.c: Move to ../cipher. * Makefile.am: Remove random stuff. 2008-06-24 Szakats Istvan (wk) * ac.c (_gcry_ac_key_destroy, _gcry_ac_key_pair_generate): Relase some more memory. 2008-04-22 Werner Koch * rijndael.c (_gcry_aes_cfb_enc, _gcry_aes_cbc_enc) (_gcry_aes_cfb_dec, _gcry_aes_cbc_dec): Use Padlock if possible. 2008-04-18 Werner Koch * sha1.c (transform_aligned): Remove. That is will obviosuly not work because we need a scratch working area and our internal API does not allow to modify the buffers. * rijndael.c: Factor tables out to .. * rijndael-tables.h: .. new. * ac.c (ac_data_extract): Make static. * camellia.h [HAVE_CONFIG_H]: Include config.h. * rndw32.c (registry_poll): Only print the performance data problem warning once. Suggested by Simon Josefsson. 2008-03-19 Werner Koch * cipher.c (gcry_cipher_open) [USE_AES]: Init bulk encryption only if requested. Suggested by Dirk Stoecker. 2008-03-18 Werner Koch * sha1.c: Include stdint.h. (transform): Add arg NBLOCKS so that we can work on more than one block and avoid updates of the chaining variables. Changed all callers to use 1. (sha1_write): Replace loop around transform. (transform_aligned) [WORDS_BIGENDIAN]: New. (TRANSFORM): New macro to replace all direct calls of transform. 2008-03-17 Werner Koch * rijndael.c (_gcry_aes_cfb_dec): New. (do_encrypt): Factor code out to .. (do_encrypt_aligned): .. New. (_gcry_aes_cfb_enc, _gcry_aes_cfb_dec): Use new function. (do_decrypt): Factor code out to .. (do_decrypt_aligned): .. new. (_gcry_aes_cbc_enc, _gcry_aes_cbc_dec): New. * cipher.c (struct gcry_cipher_handle): Put field IV into new union U_IV to enforce proper alignment. Change all users. (do_cfb_decrypt): Optimize. (do_cbc_encrypt, do_cbc_decrypt): Optimize. 2008-03-15 Werner Koch * rijndael.c (_gcry_aes_cfb_enc): New. * cipher.c (struct gcry_cipher_handle): Add field ALGO and BULK. (gcry_cipher_open): Set ALGO and BULK. (do_cfb_encrypt): Optimize. 2008-02-18 Werner Koch * rsa.c (_gcry_rsa_verify) [IS_DEVELOPMENT_VERSION]: Print intermediate results. 2008-01-08 Werner Koch * random.c (add_randomness): Do not just increment POOL_FILLED_COUNTER but update it by the actual amount of data. 2007-12-13 Werner Koch * pubkey.c (sexp_data_to_mpi): Support SHA-224. 2007-12-05 Werner Koch * rijndael.c (USE_PADLOCK): Depend on ENABLE_PADLOCK_SUPPORT. * rndhw.c (USE_PADLOCK): Ditto * rsa.c (secret): Fixed condition test for using CRT. Reported by Dean Scarff. Fixes bug#864. (_gcry_rsa_check_secret_key): Return an erro if the optional parameters are missing. * pubkey.c (sexp_elements_extract): Add arg ALGO_NAME. Changed all callers to pass NULL. Add hack to allow for optional RSA parameters. (sexp_to_key): Pass algo name to sexp_elements_extract. 2007-12-03 Werner Koch * random.c (gcry_random_add_bytes): Implement it. * rand-internal.h (RANDOM_ORIGIN_EXTERNAL): New. 2007-11-30 Werner Koch * rndhw.c: New. * rndlinux.c (_gcry_rndlinux_gather_random): Try to read 50% directly from the hwrng. * random.c (do_fast_random_poll): Also run the hw rng fast poll. (_gcry_random_dump_stats): Tell whether the hw rng failed. 2007-11-29 Werner Koch * rijndael.c (USE_PADLOCK): Define new macro used for ia32. (RIJNDAEL_context) [USE_PADLOCK]: Add fields USE_PADLOCK and PADLOCK_KEY. (do_setkey) [USE_PADLOCK]: Enable padlock if available for 128 bit AES. (do_padlock) [USE_PADLOCK]: New. (rijndael_encrypt, rijndael_decrypt) [USE_PADLOCK]: Divert to do_padlock. * cipher.c (cipher_context_alignment_t): New. Use it in this module in place of PROPERLY_ALIGNED_TYPE. (NEED_16BYTE_ALIGNED_CONTEXT): Define macro for ia32. (struct gcry_cipher_handle): Add field HANDLE_OFFSET. (gcry_cipher_open): Take care of increased alignment requirements. (gcry_cipher_close): Ditto. 2007-11-28 Werner Koch * sha256.c (asn224): Fixed wrong template. It happened due to a bug in RFC4880. SHA-224 is not in the stable version of libgcrypt so the consequences are limited to users of this devel version. 2007-10-31 Werner Koch * ac.c (gcry_ac_data_new): Remove due to the visibility wrapper. (gcry_ac_data_destroy, gcry_ac_data_copy, gcry_ac_data_length) (gcry_ac_data_set, gcry_ac_data_get_name, gcry_ac_data_get_index) (gcry_ac_data_to_sexp, gcry_ac_data_from_sexp) (gcry_ac_data_clear, gcry_ac_io_init, gcry_ac_open) (gcry_ac_close, gcry_ac_key_init, gcry_ac_key_pair_generate) (gcry_ac_key_pair_extract, gcry_ac_key_destroy) (gcry_ac_key_pair_destroy, gcry_ac_key_data_get) (gcry_ac_key_test, gcry_ac_key_get_nbits, gcry_ac_key_get_grip) (gcry_ac_data_encrypt, gcry_ac_data_decrypt, gcry_ac_data_sign) (gcry_ac_data_verify, gcry_ac_data_encode, gcry_ac_data_decode) (gcry_ac_mpi_to_os, gcry_ac_mpi_to_os_alloc, gcry_ac_os_to_mpi) (gcry_ac_data_encrypt_scheme, gcry_ac_data_decrypt_scheme) (gcry_ac_data_sign_scheme, gcry_ac_data_verify_scheme) (gcry_ac_io_init_va): Ditto. (gcry_ac_id_to_name, gcry_ac_name_to_id): Remove as these deprecated functions are now implemented by visibility.c. 2007-10-26 Werner Koch * rndw32.c: Disable debug flag. 2007-10-25 Werner Koch * rndw32.c: Updated from current cryptlib snapshot and modified for our use. Removed support from pre NT systems. (slow_gatherer_windows95): Remove. (_gcry_rndw32_gather_random): Require an NT platform. (init_system_rng, read_system_rng, read_mbm_data): New. (slow_gatherer_windowsNT): Rename to ... (slow_gatherer): .. this. Read system RNG and MBM. (registry_poll): New with code factored out from slow_gatherer. 2007-08-23 Werner Koch * random.c (pool_filled_counter): New. (add_randomness): Use it. 2007-08-22 Werner Koch * rndw32.c, rndunix.c: Switched to LGPL. 2007-05-30 Werner Koch * camellia.h, camellia.c: Replace by new LGPL version and adjusted camellia.h. 2007-05-09 Marcus Brinkmann * ac.c (_gcry_ac_io_init_va, _gcry_ac_io_write, _gcry_ac_io_read): Adjust users of gcry_ac_io_t because union is not anonymous anymore. 2007-05-02 Werner Koch * camellia-glue.c (camellia_setkey, camellia_encrypt) (camellia_decrypt): Recalculated used stack size in called functions. * camellia.h: Redefine external symbols. 2007-05-02 David Shaw * Makefile.am, cipher.c: Add Camellia. * camellia-glue.c: New. The necessary glue to interface libgcrypt to the stock NTT Camellia distribution. * camellia.h, camellia.c: The stock NTT Camellia distribution (GPL). 2007-04-30 David Shaw * cipher.c: Use #if instead of #ifdef as configure defines the USE_cipher defines as 0 for disabled. 2007-04-30 Werner Koch * rndegd.c (_gcry_rndegd_set_socket_name): New. 2007-04-30 Marcus Brinkmann * ecc.c (ec2os): Fix relocation of short numbers. * ecc.c (generate_key): Do not allocate D, which will be allocated by GEN_K. Remove G. Fix test if g_x, g_y resp. q_x, q_y are requested. (_gcry_ecc_generate): Release unneeded members of SK. * pubkey.c (sexp_to_key): Release NAME. 2007-04-28 Marcus Brinkmann * ac.c (gcry_ac_mpi): Remove member NAME_PROVIDED. (ac_data_mpi_copy, _gcry_ac_data_set, _gcry_ac_data_get_name) (_gcry_ac_data_get_index, ac_data_construct): Adjust handling of NAME accordingly. 2007-04-20 Werner Koch * ecc.c (domain_parms): Add standard brainpool curves. 2007-04-18 Werner Koch * ecc.c (generate_curve): Implement alias mechanism. * pubkey.c (sexp_elements_extract_ecc): New. (sexp_to_key): Add special case for ecc. (sexp_to_key, sexp_to_sig, sexp_to_enc, gcry_pk_genkey): Replace name_terminated stuff by a call to _gcry_sexp_nth_string. (gcry_pk_get_keygrip): Ditto. 2007-04-16 Werner Koch * ecc.c (_gcry_ecc_generate): Renamed DUMMY to CURVE and use it. 2007-04-13 Marcus Brinkmann * ac.c (ac_data_construct): Cast const away to suppress compiler warning. * ecc.c (ecc_generate): Avoid compiler warning for unused argument DUMMY. (ecc_verify): Avoid compiler warning for unused arguments CMP and OPAQUEV. 2007-04-06 Werner Koch * sha1.c (oid_spec_sha1): Add another oid from X9.62. 2007-03-28 Werner Koch * pubkey.c (gcry_pk_genkey): Do not issue misc-key-info if it is empty. (gcry_pk_genkey): New parameter "curve". * ecc.c: Entirely rewritten with only a few traces of the old code left. (_gcry_ecc_generate): New. (generate_key) New arg NAME. (generate_curve): Ditto. Return actual number of NBITS. 2007-03-26 Werner Koch * pubkey.c (gcry_pk_genkey): Increase size of SKEY array and add a runtime bounds check. 2007-03-23 Werner Koch * ecc.c (ecc_ctx_init, ecc_ctx_free, ecc_mod, ecc_mulm): New. (duplicate_point, sum_points, escalar_mult): Don't use a copy of base->p. Replaced all mpi_mulm by ecc_mulm so that we can experiment with different algorithms. (generate_key, check_secret_key, sign, verify): Initialize a computation context for use by ecc_mulm. 2007-03-22 Werner Koch * pubkey.c (pubkey_table): Initialize ECC. * Makefile.am (EXTRA_libcipher_la_SOURCES): Add ecc.c. * ecc.c: New. Heavily reformatted and changed for use in libgcrypt. (point_init): New. (escalar_mult): Make arg R the first arg to be similar to the mpi functions. (duplicate_point): Ditto (sum_points): Ditto (sign, verify): Remove unneeded copy operations. (sum_points): Removed memory leaks and optimized some compares. (verify): Simplified input check. 2007-03-14 Werner Koch * random.c (MASK_LEVEL): Removed macro as it was used only at one place. Open coded it there. (gcry_randomize, _gcry_update_random_seed_file) (_gcry_fast_random_poll): Factor lock code out to .. (lock_pool, unlock_pool): .. new. (initialize): Look the pool while allocating. (read_random_source, do_fast_random_poll): Moved intialization to ... (initialize): .. here. (_gcry_enable_quick_random_gen): No more need for initialization. (is_initialized): Moved this global flag to .. (initialize): .. here and changed all users to unconditionally call initialize. (add_randomness): Remove initalization here. It simply can't happen. * random.c (enum random_origins): Moved to .. * rand-internal.h: .. here. * rndunix.c (_gcry_rndunix_gather_random): Use enum in prototype for ORIGIN and renamed REQUESTOR to ORIGIN. * rndegd.c (_gcry_rndegd_gather_random): Ditto. * rndlinux.c (_gcry_rndlinux_gather_random): Ditto. * rndw32.c (_gcry_rndw32_gather_random): Ditto. (_gcry_rndw32_gather_random_fast): Ditto. 2007-03-13 Werner Koch * random.c (enum random_origins): New. (add_randomness): Renamed arg SOURCE to ORIGIN. (read_random_source): Renamed arg REQUESTOR to ORIGIN. (getfnc_gather_random): Removed static variable because this function is only called one and thus we don't need this optimization. (_gcry_quick_random_gen): Removed and replaced by.. (_gcry_enable_quick_random_gen): .. this. It is onlyu used to enable it and it does not make sense to disable it later. Changed the only one caller too. (get_random_bytes): Removed. (gcry_random_bytes, gcry_random_bytes_secure): Implement in terms of gcry_randomize. * random-daemon.c (_gcry_daemon_get_random_bytes): Removed. 2007-02-23 Werner Koch * elgamal.c (generate): Removed unused variable TEMP. (test_keys): New arg NODIE. (generate_using_x, _gcry_elg_generate_using_x): New. * pubkey.c (pubkey_generate): New arg XVALUE and direct call to the new elgamal generate fucntion. (gcry_pk_genkey): Parse the new "xvalue" tag. 2007-02-22 Werner Koch * pubkey.c (sexp_data_to_mpi): Handle dynamically allocated algorithms. Suggested by Neil Dunbar. Fixes bug#596. * rndw32.c (_gcry_rndw32_gather_random_fast): Make it return void. * cipher.c (gcry_cipher_algo_name): Simplified. * random.c: Use the daemon only if compiled with USE_RANDOM_DAEMON. * Makefile.am (libcipher_la_SOURCES): Build random-daemon support only if requested. 2007-02-21 Werner Koch * random.c (rndpool, keypool): Make unsigned. (mix_pool): Change char* variables to unsigned char*. (gcry_randomize): Make arg BUFFER a void*. (gcry_create_nonce): Ditto. * rmd160.c (gcry_rmd160_mixblock): Make BUFFER a void*. (_gcry_rmd160_hash_buffer): Make OUTBUF and BUFFER void*. * sha1.c (_gcry_sha1_hash_buffer): Ditto. * cipher.c (gcry_cipher_encrypt, cry_cipher_decrypt): Change buffer args to void*. (gcry_cipher_register): Make ALGORITHM_ID a int *. * md.c (md_start_debug): Make SUFFIX a const char*. Use snprintf. (gcry_md_debug): New. (gcry_md_ctl): Changed arg BUFFER from unsigned char*. * md.c (md_write): Make INBUF a const void*. (gcry_md_write): Remove needless cast. * crc.c (crc32_write): Make INBUF a const void* (update_crc32, crc24rfc2440_write): Ditto. * sha512.c (sha512_write, transform): Ditto. * sha256.c (sha256_write, transform): Ditto. * rmd160.c (rmd160_write, transform): Ditto. * md5.c (md5_write, transform): Ditto. * md4.c (md4_write, transform): Ditto. * sha1.c (sha1_write, transform): Ditto. * tiger.c (tiger_write, transform): Ditto. * whirlpool.c (whirlpool_write, whirlpool_add, transform): Ditto. * elgamal.c (elg_names): Change to a const*. * dsa.c (dsa_names): Ditto. * rsa.c (rsa_names): Ditto. * pubkey.c (gcry_pk_lookup_func_name): Make ALIASES a const. 2007-02-20 Werner Koch * rndlinux.c (open_device): Remove unsused arg MINOR. 2007-01-30 Werner Koch * sha256.c (oid_spec_sha256): Add alias from pkcs#1. * sha512.c (oid_spec_sha512): Ditto. (oid_spec_sha384): Ditto. 2006-12-18 Werner Koch * rndlinux.c (set_cloexec_flag): New. (open_device): Set close-on-exit flags. Suggested by Max Kellermann. Fixes Debian#403613. * Makefile.am (AM_CPPFLAGS, AM_CFLAGS): Splitted and merged Moritz' changes. (INCLUDES): Removed. 2006-11-30 Werner Koch * serpent.c (byte_swap_32): Remove trailing semicolon. 2006-11-15 Werner Koch * Makefile.am (INCLUDES): Include ../src/ 2006-11-03 Werner Koch * random.c [HAVE_GETTIMEOFDAY]: Included sys/time.h and not sys/times.h. Reported by Rafaël Carré. 2006-11-05 Moritz Schulte * Makefile.am (AM_CFLAGS): Added -I$(top_builddir)/src so that the new gcrypt.h is used, not the one installed in the system. 2006-10-25 Werner Koch * primegen.c (prime_generate_internal): Tweaked use of secure memory and entropy use. Safe unused primes from the pool. Allocate at least a pool of 30. (save_pool_prime, get_pool_prime): New. 2006-10-23 Werner Koch * ac.c (_gcry_ac_data_from_sexp): Reset sexp_tmp for failsafe means. Release sexp_cur if needed. Reported by Dirk Stoecker. * pubkey.c (pubkeys_registered_lock): Intialized it. It is not realy needed because this is a mere initialization to 0 anyway. Noted by Victor Stinner. 2006-10-17 Werner Koch * dsa.c (_gcry_dsa_generate2): New. (generate): New arg QBITS. Add sanity checks for reasonable qbits and nbits. * pubkey.c (gcry_pk_genkey): Parse an qbits element. (pubkey_generate): New arg QBITS. Pass it to the DSA generation. 2006-10-05 Werner Koch * md.c (gcry_md_algo_info) : Check that the algo is available. 2006-10-04 David Shaw (wk) * tiger.c (round): Rename to tiger_round as gcc 4 has a built-in round function that this conflicts with. 2006-09-11 Werner Koch * rndw32.c (slow_gatherer_windowsNT): While adding data use the size of the diskPerformance and not its address. Has been fixed in GnuPG more than a year ago. Noted by Lee Fisher. 2006-08-30 Werner Koch * pubkey.c (sexp_data_to_mpi): Need to allow "ripemd160" here as this is the canonical name. 2006-08-29 Hye-Shik Chang (wk) * seed.c: New. 2006-08-03 Werner Koch * random-daemon.c (_gcry_daemon_initialize_basics): Don't initialize the socket. Remove arg SOCKETNAME. (connect_to_socket): Make sure that daemon is set to -1 on error. (call_daemon): Initialize the socket on the first call. (_gcry_daemon_randomize, _gcry_daemon_get_random_bytes) (_gcry_daemon_create_nonce): New arg SOCKETNAME. * random.c (initialize): Call new daemon initializator. (get_random_bytes, gcry_randomize, gcry_create_nonce): Pass socket name to daemon call and reset allow_daemon on failure. 2006-07-26 Werner Koch * rmd160.c (_gcry_rmd160_mixblock): Add cast to transform call. * blowfish.c (selftest): Cast string to usnigned char*. * primegen.c (prime_generate_internal): Cast unsigned/char* mismatch in calling m_out_of_n. (is_prime): Changed COUNT to unsigned int *. * ac.c (_gcry_ac_data_copy): Initialize DATA_MPIS. * random.c (gcry_create_nonce): Update the pid after a fork. Reported by Uoti Urpala. 2006-07-04 Marcus Brinkmann * sha512.c: Fix typo in copyright notice. 2006-06-21 Werner Koch * rsa.c (_gcry_rsa_generate): Replace xcalloc by calloc. * pubkey.c (gcry_pk_encrypt, gcry_pk_sign): Ditto. (sexp_to_key, sexp_to_sig, sexp_to_enc, gcry_pk_encrypt) (gcry_pk_sign, gcry_pk_genkey, gcry_pk_get_keygrip): Ditto. * md.c (md_copy): Ditto. 2006-04-22 Moritz Schulte * random-daemon.c (_gcry_daemon_initialize_basics): New argument: SOCKETNAME. Passing on to connect_to_socket() if non-NULL. (connect_to_socket, writen, readn, call_daemon): New functions. (_gcry_daemon_randomize, _gcry_daemon_get_random_bytes) (_gcry_daemon_create_nonce): Call call_daemon(). (RANDOM_DAEMON_SOCKET): New symbol. (daemon_socket): New static variable. * random.h (_gcry_daemon_initialize_basics): New parameter: SOCKETNAME. (_gcry_set_random_daemon_socket): New declaration. * random.c (initialize_basics): Pass DAEMON_SOCKET_NAME to _gcry_daemon_initialize_basics. (_gcry_set_random_daemon_socket): New function, setting DAEMON_SOCKET_NAME. 2006-04-01 Moritz Schulte * ac.c (eme_pkcs_v1_5_encode): Use KEY_SIZE directly, no need to call gcry_ac_key_get_nbits. (eme_pkcs_v1_5_decode): Likewise. (ac_es_dencode_prepare_pkcs_v1_5): Fill options_em structure with key_size. (_gcry_ac_data_dump, gcry_ac_data_dump): New functions. (_gcry_ac_data_to_sexp, _gcry_ac_data_from_sexp): More or less rewritten; changed S-Expression format so that it matches the one used in pubkey.c. 2006-03-15 Werner Koch * random-daemon.c: New. * random.c (_gcry_use_random_daemon): New. (get_random_bytes, gcry_randomize, gcry_create_nonce): Try diverting to the daemon functions. 2006-03-14 Werner Koch * random.c (lock_seed_file): New. (read_seed_file, _gcry_update_random_seed_file): Use it. * random.c (gcry_create_nonce): Detect a fork and re-seed. (read_pool): Fixed the fork detection; it used to work only for multi-threaded processes. 2006-03-12 Brad Hards (wk) * md.c (md_open): Use new variable macpads_Bsize instead of hardwiring the block size. Changed at all places. 2006-03-10 Brad Hards (wk, patch 2005-04-22) * md.c, sha256.c: Add support for SHA-224. (sha224_init): New. 2006-01-18 Brad Hards (wk 2006-03-07) * cipher.c (cipher_encrypt, cipher_decrypt, do_ofb_encrypt) (do_ofb_decrypt, gcry_cipher_open): Implement Output Feedback Mode. 2005-11-02 Moritz Schulte * pubkey.c (gcry_pk_algo_name): Return "?" instead of NULL for unknown algorithm IDs. * cipher.c (cipher_algo_to_string): Likewise. 2005-11-01 Moritz Schulte * pubkey.c (gcry_pk_algo_info): Don't forget to break after switch case. 2005-09-19 Werner Koch * dsa.c (generate): Add preliminary support for 2 and 4 keys. Return an error code if the key size is not supported. (_gcry_dsa_generate): Return an error. 2005-08-22 Werner Koch * primegen.c (check_prime): New arg RM_ROUNDS. (prime_generate_internal): Call it here with 5 rounds as used before. (gcry_prime_check): But here with 64 rounds. (is_prime): Make sure never to use less than 5 rounds. 2005-04-16 Moritz Schulte * ac.c (_gcry_ac_init): New function. 2005-04-12 Moritz Schulte * ac.c (_gcry_ac_io_write, _gcry_ac_io_read): Initialize err to make the compiler happy. Always use errno, now that gcry_malloc() is guaranteed to set errno on failure. (_gcry_ac_data_to_sexp): Don't forget to goto out after error in loop. (_gcry_ac_data_to_sexp): Remove unused variable: mpi_list; (_gcry_ac_data_to_sexp): Always deallocate sexp_buffer. (_gcry_ac_data_from_sexp): Don't forget to initialize data_set_new. (_gcry_ac_data_from_sexp): Handle special case, which is necessary, since gcry_sexp_nth() does not distinguish between "element does not exist" and "element is the empty list". (_gcry_ac_io_init_va): Use assert to make sure that mode and type are correct. Use gcry_error_t types where gcry_err_code_t types have been used before. 2005-04-11 Moritz Schulte * ac.c (_gcry_ac_data_sign_scheme): Don't forget to initialize buffer. * whirlpool.c: New file. * md.c (digest_table): Add whirlpool. * Makefile.am (EXTRA_libcipher_la_SOURCES): Added: whirlpool.c. 2005-03-30 Moritz Schulte * ac.c (_gcry_ac_data_from_sexp): Use length of SEXP_CUR, not length of SEXP; do not forget to set SEXP_TMP to NULL after it has been released. (struct gcry_ac_mpi): New member: name_provided. (_gcry_ac_data_set): Rename variable `name_final' to `name_cp'; remove const qualifier; change code to not cast away const qualifiers; use name_provided member as well. (_gcry_ac_data_set, _gcry_ac_data_get_name): Use name_provided member of named mpi structure. (gcry_ac_name_to_id): Do not forget to initialize err. (_gcry_ac_data_get_index): Do not forget to initialize mpi_return; use gcry_free() instead of free(); remove unnecessary cast; rename mpi_return and name_return to mpi_cp and name_cp; adjust code. (ac_data_mpi_copy): Do not cast away const qualifier. (ac_data_values_destroy): Likewise. (ac_data_construct): Likewise. (ac_data_mpi_copy): Initialize flags to GCRY_AC_FLAG_DEALLOC. (ac_data_extract): Use GCRY_AC_FLAG_DEALLOC instead of GCRY_AC_FLAG_COPY. (_gcry_ac_io_init_va, _gcry_ac_io_init, gcry_ac_io_init) (gcry_ac_io_init_va, _gcry_ac_io_write, _gcry_ac_io_read) (_gcry_ac_io_read_all, _gcry_ac_io_process): New functions. (gry_ac_em_dencode_t): Use gcry_ac_io_t in prototype instead of memroy strings directly; adjust encode/decode functions to use io objects. (emsa_pkcs_v1_5_encode_data_cb): New function ... (emsa_pkcs_v1_5_encode): ... use it here. (ac_data_dencode): Use io objects. (_gcry_ac_data_encode, _gcry_ac_data_decode, gcry_ac_data_encode) (gcry_ac_data_decode): Likewise. (_gcry_ac_data_encrypt_scheme, gcry_ac_data_encrypt_scheme) (_gcry_ac_data_decrypt_scheme, gcry_ac_data_decrypt_scheme) (_gcry_ac_data_sign_scheme, gcry_ac_data_sign_scheme) (_gcry_ac_data_verify_scheme, gcry_ac_data_verify_scheme): Likewise. 2005-03-23 Werner Koch * rndw32.c (_gcry_rndw32_gather_random_fast): While adding data use the size of the object and not the one of its address. Bug reported by Sascha Kiefer. 2005-03-19 Moritz Schulte * cipher.c (do_cbc_encrypt): Be careful to not overwrite data, which is to be used later on. This happend, in case CTS is enabled and OUTBUF is equal to INBUF. 2005-02-25 Werner Koch * pubkey.c (gcry_pk_get_keygrip): Allow for shadowed-private-key. 2005-02-13 Moritz Schulte * serpent.c: Updated from 1.2 branch: s/u32_t/u32/ and s/byte_t/byte/. Too match what we have always used and are using in all other files too (serpent_test): Moved prototype out of a fucntion. 2005-02-07 Moritz Schulte * ac.c: Major parts rewritten. * pubkey.c (_gcry_pk_get_elements): New function. 2004-12-09 Werner Koch * serpent.c (serpent_setkey): Moved prototype of serpent_test to outer scope. 2004-09-11 Moritz Schulte * pubkey.c (pubkey_table): Added an alias entry for GCRY_PK_ELG_E. 2004-08-23 Moritz Schulte * ac.c: Do not include . * rndegd.c: Likewise. * sha1.c: Likewise. * rndunix.c: Likewise. * rndlinux.c: Likewise. * rmd160.c: Likewise. * md5.c: Likewise. * md4.c: Likewise. * cipher.c: Likewise. * crc.c: Likewise. * blowfish.c: Likewise. * pubkey.c (dummy_generate, dummy_check_secret_key) (dummy_encrypt, dummy_decrypt, dummy_sign, dummy_verify): Return err code GPG_ERR_NOT_IMPLEMENTED instead of aborting through log_bug(). (dummy_get_nbits): Return 0 instead of aborting though log_bug(). 2004-08-19 Werner Koch * pubkey.c (sexp_data_to_mpi): Changed the zero random byte substituting code to actually do clever things. Thanks to Matthias Urlichs for noting the implementation problem. 2004-08-09 Moritz Schulte * pubkey.c (gcry_pk_sign): Fixed memory leak; fix provided by Modestas Vainius. 2004-07-16 Werner Koch * rijndael.c (do_encrypt): Fix alignment problem. Bugs found by Matthias Urlichs. (do_decrypt): Ditto. (keySched, keySched2): Use 2 macros along with unions in the key schedule context. 2004-07-14 Moritz Schulte * rsa.c (_gcry_rsa_decrypt): Don't forget to free "a". Thanks to Nikos Mavroyanopoulos. 2004-05-09 Werner Koch * random.c (read_pool): Mix the PID in to better protect after a fork. 2004-07-04 Moritz Schulte * serpent.c: Use "u32_t" instead of "unsigned long", do not declare S-Box variables as "register". Fixes failure on OpenBSD/sparc64, reported by Nikolay Sturm. 2004-05-07 Werner Koch * random.c (initialize): Factored out some code to .. (initialize_basics): .. new function. (_gcry_random_initialize): Just call initialize_basics unless the new arg FULL is set to TRUE. (_gcry_fast_random_poll): Don't do anything unless the random system has been really initialized. 2004-05-07 Moritz Schulte * ac.c (gcry_ac_open): Do not dereference NULL pointer. Reported by Umberto Salsi. 2004-02-20 Werner Koch * primegen.c (check_prime): New args CB_FUNC and CB_ARG; call them at different stages. Pass these arguments through all callers. 2004-02-06 Werner Koch * des.c: Add a new OID as used by pkcs#12. * rfc2268.c: New. Taken from libgcrypt. * cipher.c: Setup the rfc2268 algorithm. 2004-01-25 Moritz Schulte * primegen.c (prime_generate_internal): Do not forget to free `q_factor'; fixed by Brieuc Jeunhomme. (prime_generate_internal): Do not forget to free `prime'. 2004-01-14 Moritz Schulte * ac.c (gcry_ac_data_set): New argument: flags; slightly rewritten. (gcry_ac_data_get_name, gcry_ac_data_get_index): Likewise. (gcry_ac_key_pair_generate): New argument: misc_data; modified order of arguments. (gcry_ac_key_test): New argument: handle. (gcry_ac_key_get_nbits, gcry_ac_key_get_grip): Likewise. Use GCRY_AC_FLAG_NO_BLINDING instead of GCRY_AC_DATA_FLAG_NO_BLINDING. (gcry_ac_mpi): New member: flags. (gcry_ac_data_search, gcry_ac_data_add): Removed functions. 2003-12-22 Werner Koch * primegen.c (is_prime): Release A2. 2003-12-19 Werner Koch * md.c: Moved a couple of functions down below the data structure definitions. (struct gcry_md_context): New field ACTUAL_HANDLE_SIZE. (md_open): Set it here. (strcut gcry_md_list): New field ACTUAL_STRUCT_SIZE. (md_enable): Set it here. (md_close): Wipe the context memory. secure memory. * cipher.c (struct gcry_cipher_handle): New field ACTUAL_HANDLE_SIZE. (gcry_cipher_open): Set it here. (gcry_cipher_close): Use it to always wipe out the handle data. * ac.c (gcry_ac_open): Make sure HANDLE gets initialized even when the function is not successful. (gcry_ac_close): Allow a NULL handle. (gcry_ac_key_destroy, gcry_ac_key_pair_destroy): Ditto. (gcry_ac_key_get_grip): Return INV_OBJ on error. * primegen.c (prime_generate_internal): Fixed error code for failed malloc. Replaced the !err if chain by gotos. (gcry_prime_group_generator): Remove the extra sanity check. * md.c: Minor code and comment cleanups. 2003-12-16 Werner Koch * primegen.c (gen_prime): Doc fix. Thanks to Newton Hammet. 2003-12-11 Werner Koch * rndunix.c (slow_poll): Don't use #warning but #error. * rndegd.c: Changed indentation. (my_make_filename): Removd the var_arg cruft becuase we don't need it here. Changed caller. * rndlinux.c: Changed indentation. (open_device): Remove the superfluous stat call and clarify comment. * rsa.c: Changed indentation. (secret): Use the standard algorithm if p, q and u are not available. (rsa_blind, rsa_unblind): Renamed from _gcry_rsa_blind, _gcry_rsa_unblind and moved more to the top. * md4.c: Changed indentation. Removed unnecessary casts. * md5.c, rmd160.c, sha1.c, tiger.c: Ditto. * rijndael.c, twofish.c: Ditto. * serpent.c: Removed unnecessary casts. * sha256.c, sha512.c: Ditto. 2003-12-09 Werner Koch * dsa.c: Unified indentation style. * elgamal.c: Ditto. * des.c (des_key_schedule): Code beautifications. * blowfish.c: Changed indentation style. * cast5.c (do_cast_setkey): Ditto. * pubkey.c (gcry_pk_encrypt): Replaced the chain of if(!err) tests by straightforward gotos. Other cleanups. (gcry_pk_decrypt): Ditto. (gcry_pk_sign): Ditto. (gcry_pk_verify): Ditto. (gcry_pk_genkey): Ditto. Use strtoul instead of strtol. (gcry_pk_ctl): Use GPG_ERR_INV_ARG to indicate bad arguments. 2003-12-07 Werner Koch * pubkey.c (gcry_pk_register_default): Undef the helper macro. (gcry_pk_map_name): Allow NULL for string. (sexp_to_key): Use memcpy and not strncpy. Use gcry_free and not free. (sexp_to_sig): Ditto. (sexp_to_enc): Ditto. Replaced the chain of if(!err) tests by straightforward gotos. 2003-12-05 Werner Koch * cipher.c: Documentation cleanups. (gcry_cipher_mode_from_oid): Allow NULL for STRING. 2003-12-03 Werner Koch * elgamal.c (sign, do_encrypt, gen_k): Make sure that a small K is only used for encryption. 2003-11-18 Werner Koch * random.h (rndw32_set_dll_name): Removed unused prototype. * Makefile.am (EXTRA_DIST): Added Manifest. 2003-11-11 Werner Koch * Manifest: New. 2003-11-04 Werner Koch * md.c (gcry_md_hash_buffer): Use shortcut for SHA1 * sha1.c (_gcry_sha1_hash_buffer): New. * random.c: Reformatted most functions. (mix_pool): Moved the failsafe_digest from global scope to here. (do_fast_random_poll): Use the generic fucntions even if a fast gathering function has been used. (read_pool): Detect a fork and retry. (gcry_randomize, get_random_bytes): Don't distinguish anymore between weak and strong random. (gcry_create_nonce): New. 2003-10-31 Werner Koch * rndw32.c (slow_gatherer_windowsNT): Use a plain buffer for the disk performance values and not the W32 API structure. * dsa.c (verify): s/exp/ex/ due to shadowing of a builtin. * elgamal.c (verify): Ditto. * ac.c (gcry_ac_data_get_index): s/index/idx/ (gcry_ac_data_copy_internal): Remove the cast in _gcry_malloc. (gcry_ac_data_add): Must use gcry_realloc instead of realloc. * pubkey.c (sexp_elements_extract): s/index/idx/ as tribute to the forehackers. (gcry_pk_encrypt): Removed shadowed definition of I. Reordered arguments to malloc for clarity. (gcry_pk_sign, gcry_pk_genkey): Ditto. * primegen.c (prime_generate_internal): s/random/randomlevel/. 2003-10-27 Moritz Schulte * pubkey.c (gcry_pk_encrypt): Don't forget to deallocate pkey. 2003-10-27 Werner Koch * random.c (gcry_random_add_bytes): Return if buflen is zero to avoid gcc warning about unsed parameter. (MASK_LEVEL): Simplified; does now work for signed and unsigned w/o warnings. * md.c (md_start_debug): Removed the const from SUFFIX, because this function is called from the control fucntion which does not require const. Prefixed all (pubkey,digest,cipher}_spec_* globale variables with _gcry_. * ac.c (ac_key_identifiers): Made static. * random.c (getfnc_gather_random,getfnc_fast_random_poll): Move prototypes to .. * rand-internal.h: .. here * random.c (getfnc_gather_random): Include rndw32 gatherer. * rndunix.c, rndw32.c, rndegd.c: Include them here. * rndlinux.c (_gcry_rndlinux_gather_random): Prepend the _gcry_ prefix. Changed all callers. * rndegd.c (_gcry_rndegd_gather_random): Likewise. (_gcry_rndegd_connect_socket): Likewise. * rndunix.c (_gcry_rndunix_gather_random): Likewise. (waitpid): Made static. * rndw32.c: Removed the old and unused winseed.dll cruft. (_gcry_rndw32_gather_random_fast): Renamed from gather_random_fast. (_gcry_rndw32_gather_random): Renamed from gather_random. Note, that the changes 2003-04-08 somehow got lost. * sha512.c (sha512_init, sha384_init): Made static. * cipher.c (do_ctr_decrypt): Removed "return" from this void function. 2003-10-24 Moritz Schulte * serpent.c: Fix an issue on big-endian systems. * rndw32.c: Removed IS_MODULE -cruft. * rndlinux.c (rndlinux_gather_random): Likewise. 2003-10-10 Werner Koch * primegen.c (gen_prime): Bail out if NBITS is less than 16. (prime_generate_internal): Initialize prime variable to suppress compiler warning. Check pbits, initialize qbits when passed as zero. * primegen.c (prime_generate_internal): New arg ALL_FACTORS. Changed all callers. (gcry_prime_generate): Make the factors arg optional. Request all_factors. Make sure PRIME is set to NULL even on error. (gcry_prime_group_generator): New. (gcry_prime_release_factors): New. 2003-10-06 Werner Koch * primegen.c (gen_prime): Assert that NBITS is never zero, it would cause a segv. 2003-09-28 Moritz Schulte * ac.c: Include "cipher.h". 2003-09-27 Moritz Schulte * rndegd.c (do_read): Return nread instead of nbytes; thanks to Michael Caerwyn. 2003-09-04 Werner Koch * pubkey.c (_gcry_pk_aliased_algo_name): New. * ac.c (gcry_ac_open): Use it here. * Makefile.am (EXTRA_libcipher_la_SOURCES): Add serpent.c 2003-09-02 Moritz Schulte * primegen.c (gcry_prime_check, gcry_prime_generate): New functions. (prime_generate_internal): New function, based on _gcry_generate_elg_prime. (_gcry_generate_elg_prime): Rewritten as a wrapper for prime_generate_internal. 2003-08-28 Werner Koch * pubkey.c (gcry_pk_encrypt): Don't include the flags list in the return value. This does not make sense and breaks any programs parsing the output strictly (e.g. current gpgsm). (gcry_pk_encrypt): If aliases for the algorithm name exists, take the first one instead of the regular name to adhere to SPKI conventions. (gcry_pk_genkey): Ditto. (gcry_pk_sign): Ditto. Removed unused KEY_ALGO_NAME. 2003-08-19 Moritz Schulte * cipher.c: Add support for Serpent * serpent.c: New file. 2003-08-10 Moritz Schulte * rsa.c (_gcry_rsa_blind, _gcry_rsa_unblind): Declare static. 2003-08-09 Timo Schulz * random.c (getfnc_gather_random): Don't check NAME_OF_DEV_RANDOM two times, but also the NAME_OF_DEV_URANDOM device. 2003-08-08 Moritz Schulte * pubkey.c (sexp_to_enc): Fixed extraction of S-Expression: do not fail if no `flags' sub S-Expression is found. 2003-07-27 Werner Koch * md.c (gcry_md_lookup_func_oid): Allow for empty OID lists. 2003-07-23 Moritz Schulte * ac.c (gcry_ac_data_construct): New argument: include_flags, only include `flags' S-expression, if include_flags is true. Adjust callers. Thanks for triggering a bug caused by `flags' sub-S-expression where they are not expected to Ralf Schneider. 2003-07-21 Moritz Schulte * pubkey.c (gcry_pk_lookup_func_name): Use new member name `aliases' instead of `sexp_names'. * ac.c (gcry_ac_key_data_get): New function. * cipher.c (gcry_cipher_lookup_func_name): Fix return value. 2003-07-20 Moritz Schulte * blowfish.c: Adjusted for new gcry_cipher_spec_t structure. * cast5.c: Likewise. * twofish.c: Likewise. * arcfour.c: Likewise. * rijndael.c (rijndael_oids, rijndael192_oids, rijndael256_oids): New variables, adjust for new gcry_cipher_spec_t structure. * des.c (oids_tripledes): New variable, adjust for new gcry_cipher_spec_t structure. * md.c (oid_table): Removed. * tiger.c (oid_spec_tiger): New variable. (digest_spec_tiger): Adjusted for new gry_md_spec_t structure. * sha512.c (oid_spec_sha512): New variable. (digest_spec_sha512): Adjusted for new gry_md_spec_t structure. * sha512.c (oid_spec_sha384): New variable. (digest_spec_sha384): Adjusted for new gry_md_spec_t structure. * sha256.c (oid_spec_sha256): New variable. (digest_spec_sha256): Adjusted for new gry_md_spec_t structure. * sha1.c (oid_spec_sha1): New variable. (digest_spec_sha1): Adjusted for new gry_md_spec_t structure. * rmd160.c (oid_spec_rmd160): New variable. (digest_spec_rnd160): Adjusted for new gry_md_spec_t structure. * md5.c (oid_spec_md5): New variable. (digest_spec_md5): Adjusted for new gry_md_spec_t structure. * md4.c (oid_spec_md4): New variable. (digest_spec_md4): Adjusted for new gry_md_spec_t structure. * crc.c (digest_spec_crc32, digest_spec_crc32_rfc1510, digest_spec_crc32_rfc2440): Adjusted for new gry_md_spec_t structure. 2003-07-19 Moritz Schulte * md.c (gcry_md_lookup_func_oid): New function. (search_oid): New function, copied from cipher.c. (gcry_md_map_name): Adjust for new search_oid_interface. * cipher.c (oid_table): Removed table. (gcry_cipher_lookup_func_oid): New function. (search_oid): Rewritten to use the module functions. (gcry_cipher_map_name): Adjust for new search_oid interface. (gcry_cipher_mode_from_oid): Likewise. 2003-07-18 Werner Koch * md.c (gcry_md_hash_buffer): Convert ERR to gpg_error_t in gpg_strerror. 2003-07-14 Moritz Schulte * cipher.c (gcry_cipher_lookup_func_name): Also check the cipher name aliases, not just the primary name. (gcry_cipher_map_name): Remove kludge for aliasing Rijndael to AES. * arcfour.c, blowfish.c, cast5.c, des.c, twofish.c: Adjust cipher specification structures. * rijndael.c (rijndael_names, rijndael192_names, rijndael256_names): New variables, use them in the cipher specifications. * rmd160test.c: Removed file. * ac.c, arcfour.c, blowfish.c, cast5.c, cipher.c, des.c, dsa.c, elgamal.c, md.c, pubkey.c, random.c, rijndael.c, rsa.c, twofish.c: Used gcry_err* wrappers for libgpg symbols. * primegen.c (gen_prime): Correct the order arguments to extra_check. 2003-07-12 Moritz Schulte * ac.c: Replaced all public occurences of gpg_error_t with gcry_error_t. * cipher.c: Likewise. * md.c: Likewise. * pubkey.c: Likewise. * random.c: Likewise. * cipher.c: Added support for TWOFISH128. 2003-07-08 Moritz Schulte * ac.c (gcry_ac_data_copy_internal): New function, based on gcry_ac_data_copy. (gcry_ac_data_copy): Made public, use gcry_ac_data_copy_internal. (gcry_ac_key_init): Use gcry_ac_data_copy_internal. 2003-07-07 Moritz Schulte * ac.c (gcry_ac_data_set): Only release old MPI value if it is different from the new value. Bug reported by Simon Josefsson . * pubkey.c (gcry_pk_list): New function. * md.c (gcry_md_list): New function. * ac.c (gcry_ac_key_pair_generate): Fix calculation of format string size. 2003-07-05 Moritz Schulte * md.c: Named struct of digest_table `digest_table_entry'. (digest_table_entry): New member: algorithm; filled in. (digest_table_entry): Removed unused member: flags. (gcry_md_register): New argument: algorithm_id, filled in. (gcry_md_register_default): Used algorithm ID from module structure. (gcry_md_map_name): Likewise. (md_enable): Likewise. (md_read): Likewise. (gcry_md_info): Likewise. * pubkey.c: Named truct for pubkey_table `pubkey_table_entry'. (pubkey_table_entry): New member: algorithm; filled in. (gcry_pk_register_default): Used algorithm ID from pubkey_table. (gcry_pk_register): New argument: algorithm_id, filled in. (gcry_pk_map_name): Used algorithm ID from module structure. (gcry_pk_decrypt): Likewise. (gcry_pk_encrypt): Likewise. (gcry_pk_verify): Likewise. (gcry_pk_sign): Likewise. (gcry_pk_testkey): Likewise. (gcry_pk_genkey): Likewise. (gcry_pk_get_nbits): Likewise. (sexp_to_key): Removed unused variable: algo. (sexp_to_sig): Likewise. * cipher.c: Named struct for cipher_table `cipher_table_entry'. (cipher_table_entry): New member: algorithm; filled in. (gcry_cipher_register_default): Used algorithm ID from cipher_table. (gcry_cipher_register): New argument: algorithm_id, filled in. (gcry_cipher_map_name): Used algorithm ID from module structure. * arcfour.c (cipher_spec_arcfour): Removed algorithm ID. * blowfish.c (cipher_spec_blowfish): Likewise. * cast5.c (cipher_spec_cast5): Likewise. * crc.c (digest_spec_crc32): Likewise. * crc.c (digest_spec_crc32_rfc1510): Likewise. * crc.c (digest_spec_crc32_rfc2440): Likewise. * des.c (cipher_spec_des): Likewise. * des.c (cipher_spec_tripledes): Likewise. * dsa.c (pubkey_spec_dsa): Likewise. * elgamal.c (pubkey_spec_elg): Likewise. * md4.c (digest_spec_md4): Likewise. * md5.c (digest_spec_md5): Likewise. * aes.c (cipher_spec_aes): Likewise. * aes.c (cipher_spec_aes192): Likewise. * aes.c (cipher_spec_aes256): Likewise. * rsa.c (pubkey_spec_rsa): Likewise. * sha1.c (digest_spec_sha1): Likewise. * sha256.c (digest_spec_sha256): Likewise. * sha512.c (digest_spec_sha512): Likewise. * tiger.c (digest_spec_tiger): Likewise. * twofish.c (cipher_spec_twofish): Likewise. * twofish.c (cipher_spec_twofish128): Likewise. * Makefile.am (EXTRA_libcipher_la_SOURCES): Fix list of source files; reported by Simon Josefsson . * pubkey.c: Replaced all occurences of `id' with `algorithm', since `id' is a keyword in obj-c. * md.c: Likewise. * cipher.c: Likewise. * crc.c, md4.c, md5.c, rmd160.c, sha1.c, sha256.c, tiger.c: Replaced all occurences of gcry_digest_spec_t with gcry_md_spec_t. * dsa.c, rsa.c, elgamal.c: Replaced all occurencens of gcry_pubkey_spec_t with gcry_pk_spec_t. * md.c: Replaced all occurences of gcry_digest_spec_t with gcry_md_spec_t. (gcry_digest_register_default): Renamed to ... (gcry_md_register_default): ... this; adjusted callers. (gcry_digest_lookup_func_name): Renamed to ... (gcry_md_lookup_func_name): ... this; adjusted callers. (gcry_digest_lookup_name): Renamed to ... (gcry_md_lookup_name): ... this; adjusted callers. (gcry_digest_register): Renamed to ... (gcry_md_register): ... this. (gcry_digest_unregister): Renamed to ... (gcry_md_unregister): ... this. * pubkey.c (gcry_pubkey_register): Renamed to ... (gcry_pk_register): ... this. (gcry_pubkey_unregister): Renamed to ... (gcry_pk_unregister): ... this. Replaced all occurences of gcry_pubkey_spec_t with gcry_pk_spec_t. (gcry_pubkey_register_default): Renamed to ... (gcry_pk_register_default): ... this; adjusted callers. (gcry_pubkey_lookup_func_name): Renamed to ... (gcry_pk_lookup_func_name): ... this; adjusted callers. (gcry_pubkey_lookup_name): Renamed to ... (gcry_pk_lookup_name): ... this; adjusted callers. * md.c (gcry_md_hash_buffer): Fix error checking. Thanks to Simon Josefsson . 2003-07-04 Moritz Schulte * cipher.c (gcry_cipher_list): New function. 2003-07-01 Moritz Schulte * pubkey.c (sexp_to_sig): Accept a `flags' S-expression to be more consistent with sexp_to_enc. 2003-06-30 Moritz Schulte * Makefile.am (libcipher_la_SOURCES): Added: ac.c. * pubkey.c (_gcry_pk_module_lookup): New function. (_gcry_pk_module_release): New function. 2003-06-29 Moritz Schulte * ac.c: New file. 2003-06-26 Werner Koch * md.c (gcry_md_hash_buffer): Trigger BUG correcly with new API. 2003-06-19 Werner Koch * md.c (gcry_md_is_enabled): Fixed. 2003-06-18 Werner Koch * cipher.c (gcry_cipher_get_algo_keylen): New. (gcry_cipher_get_algo_blklen): New. 2003-06-18 Moritz Schulte * arcfour.c, cipher.c, blowfish.c, md.c, cast5.c, pubkey.c, crc.c, des.c, dsa.c, elgamal.c, md4.c, md5.c, random.c, rijndael.c, rmd160.c, rsa.c, sha1.c, sha256.c, sha512.c, tiger.c, twofish.c: Replaced older types GcryDigestSpec, GcryCipherSpec and GcryPubkeySpec with newer types: gcry_digest_spec_t, gcry_cipher_spec_t and gcry_pubkey_spec_t. * md.c (gcry_digest_id_new): Removed function. (gcry_digest_register): Removed code for generating a new module ID. * pubkey.c (gcry_pubkey_id_new): Removed function. (gcry_pubkey_register): Removed code for generating a new module ID. * cipher.c, md.c, pubkey.c: Replace old type GcryModule with newer one: gcry_module_t. (gcry_cipher_id_new): Removed function. (gcry_cipher_register): Removed code for generating a new module ID. * cipher.c (gcry_cipher_register): Adjust call to _gcry_module_add. (gcry_cipher_register_default): Likewise. * pubkey.c (gcry_pubkey_register_default): Likewise. (gcry_pubkey_register): Likewise. * md.c (gcry_digest_register_default): Likewise. (gcry_digest_register): Likewise. * md.c (gcry_digest_lookup_func_id): Removed function. (gcry_digest_lookup_id): Likewise. (gcry_digest_id_new): Use _gcry_module_lookup_id instead of gcry_digest_lookup_id. (digest_algo_to_string): Likewise. (check_digest_algo): Likewise. (md_enable): Likewise. (md_digest_length): Likewise. (md_asn_oid): Likewise. * pubkey.c (gcry_pubkey_lookup_id): Removed function. (gcry_pubkey_lookup_func_id): Likewise. (gcry_pubkey_id_new): Use _gcry_module_lookup_id instead of gcry_pubkey_id_new. (gcry_pk_algo_name): Likewise. (disable_pubkey_algo): Likewise. (check_pubkey_algo): Likewise. (pubkey_get_npkey): Likewise. (pubkey_get_nskey): Likewise. (pubkey_get_nsig): Likewise. (pubkey_get_nenc): Likewise. (pubkey_generate): Likewise. (pubkey_check_secret_key): Likewise. (pubkey_encrypt): Likewise. (pubkey_decrypt): Likewise. (pubkey_sign): Likewise. (pubkey_verify): Likewise. (gcry_pk_algo_info): Likewise. * cipher.c (gcry_cipher_lookup_func_id): Removed function. (gcry_cipher_lookup_id): Likewise. (cipher_algo_to_string): use _gcry_module_lookup_id instead of gcry_cipher_lookup_id. (disable_cipher_algo): Likewise. (check_cipher_algo): Likewise. (cipher_get_blocksize): Likewise. (gcry_cipher_open): Likewise. (gcry_cipher_id_new): Likewise. 2003-06-17 Moritz Schulte * Makefile.am (GCRYPT_MODULES): Set to @GCRYPT_CIPHERS@, @GCRYPT_PUBKEY_CIPHERS@, @GCRYPT_DIGESTS@ and @GCRYPT_RANDOM@. (libcipher_la_DEPENDENCIES): Set to $(GCRYPT_MODULES). (libcipher_la_LIBADD): Likewise. (AM_CFLAGS): Added: @GPG_ERROR_CFLAGS@. (EXTRA_libcipher_la_SOURCES): Added all conditional sources. * md.c (md_open): Use _gcry_fast_random_poll instead of fast_random_poll. * cipher.c (gcry_cipher_open): Likewise. * random.h (fast_random_poll): Removed macro. * blowfish.c, md4.c, md5.c, rmd160.c, sha1.c, sha256.c, sha512.c, tiger.c: Use Autoconf's WORDS_BIGENDIAN instead of our own BIG_ENDIAN_HOST. 2003-06-16 Moritz Schulte * random.c (getfnc_gather_random): Do not special-case USE_ALL_RANDOM_MODULES, make it the default. * dsa.c: Replace last occurences of old type names with newer names (i.e. replace MPI with gcry_mpi_t). * elgamal.c: Likewise. * primegen.c: Likewise. * pubkey.c: Likewise. * rsa.c: Likewise. 2003-06-14 Moritz Schulte * des.c (des_setkey): Add selftest check. (tripledes_set3keys): Likewise. (do_tripledes_setkey): Remove selftest check. (do_des_setkey): Likewise. 2003-06-11 Moritz Schulte * md.c (_gcry_md_init): New function. * cipher.c (_gcry_cipher_init): New function. * pubkey.c (_gcry_pk_init): New function. 2003-06-13 Werner Koch * md.c (gcry_md_get_algo): Reverted to old API. This is a convenience function anyway and error checking is not approriate. (gcry_md_is_secure): New. (gcry_md_is_enabled): New. 2003-06-12 Werner Koch * cipher.c (gcry_cipher_open): Make sure HANDLE is set to NULL on error. 2003-06-11 Werner Koch * md.c (gcry_md_open): Make sure H receives either NULL or an valid handle. (gcry_md_copy): Swapped arguments so that it is more in lione with md_open and most other API fucntions like memcpy (destination comes first). Make sure HANDLE is set to NULL on error. * rijndael.c (do_encrypt): Hack to force correct alignment. It seems not to be not sufficient, though. We should rework this fucntions and remove all these ugly casts. Let the compiler optimize or have an assembler implementation. 2003-06-09 Moritz Schulte * Makefile.am: Removed rules serpent, since that is not commited yet. 2003-06-08 Moritz Schulte * pubkey.c (gcry_pk_encrypt): Improve calculation for size of the format string. 2003-06-07 Moritz Schulte * arcfour.c, bithelp.h, blowfish.c, cast5.c, cipher.c, crc.c, des.c, dsa.c, elgamal.c, md4.c, md5.c, md.c, primegen.c, pubkey.c, rand-internal.h, random.c, random.h, rijndael.c, rmd160.c, rmd160test.c, rmd.h, rndeged.c, rndlinux.c, rndunix.c, rndw32.c, rsa.c, sha1.c, sha256.c, sha512.c, tiger.c, twofish.c: Edited all preprocessor instructions to remove whitespace before the '#'. This is not required by C89, but there are some compilers out there that don't like it. Replaced any occurence of the now deprecated type names with the new ones. 2003-06-04 Moritz Schulte * pubkey.c (gcry_pk_encrypt): Construct an arg_list and use gcry_sexp_build_array instead of gcry_sexp_build. (gcry_pk_sign): Likewise. (gcry_pk_genkey): Likewise. 2003-06-01 Moritz Schulte * dsa.c (_gcry_dsa_generate): Do not check wether the algorithm ID does indeed belong to DSA. (_gcry_dsa_sign): Likewise. (_gcry_dsa_verify): Likewise. (_gcry_dsa_get_nbits): Likewise. * elgamal.c (_gcry_elg_check_secret_key): Do not check wether the algorithm ID does indeed belong to ElGamal. (_gcry_elg_encrypt): Likewise. (_gcry_elg_decrypt): Likewise. (_gcry_elg_sign): Likewise. (_gcry_elg_verify): Likewise. (_gcry_elg_get_nbits): Likewise. (_gcry_elg_generate): Likewise. * rsa.c (_gcry_rsa_generate): Do not check wether the algorithm ID does indeed belong to RSA. (_gcry_rsa_encrypt): Likewise. (_gcry_rsa_decrypt): Likewise. (_gcry_rsa_sign): Likewise. (_gcry_rsa_verify): Likewise. (_gcry_rsa_get_nbits): Likewise. 2003-05-30 Moritz Schulte * md.c (md_get_algo): Return zero in case to algorithm is enabled. * md.c (gcry_md_info): Adjusted for new no-errno-API. (md_final): Likewise. (gcry_md_get_algo): Likewise. * pubkey.c (gcry_pk_get_keygrip): Likewise. (gcry_pk_ctl): Likewise. (gcry_pk_algo_info): Likewise. * des.c (selftest): Likewise. 2003-05-29 Moritz Schulte * md.c (md_enable): Do not forget to release module on error. (gcry_md_open): Adjusted for new no-errno-API. (md_open): Likewise. (md_copy): Likewise. (gcry_md_copy): Likewise. (gcry_md_setkey): Likewise. (gcry_md_algo_info): Likewise. * cipher.c (gcry_cipher_open): Adjusted for new no-errno-API and also fixed a locking bug. (gcry_cipher_encrypt): Adjusted for new no-errno-API. (gcry_cipher_decrypt): Likewise. (gcry_cipher_ctl): Likewise. (gcry_cipher_info): Likewise. (gcry_cipher_algo_info): Likewise. 2003-05-28 Moritz Schulte * md.c (md_enable): Adjusted for libgpg-error. (gcry_md_enable): Likewise. (gcry_digest_register_default): Likewise. (gcry_digest_register): Likewise. (check_digest_algo): Likewise. (prepare_macpads): Likewise. (gcry_md_setkey): Likewise. (gcry_md_ctl): Likewise. (gcry_md_get): Likewise. (gcry_md_algo_info): Likewise. (gcry_md_info): Likewise. * dsa.c (_gcry_dsa_generate): Likewise. (_gcry_dsa_check_secret_key): Likewise. (_gcry_dsa_sign): Likewie. (_gcry_dsa_verify): Likewise. * twofish.c (do_twofish_setkey): Likewise. (twofish_setkey): Likewise. * cipher.c (gcry_cipher_register): Likewise. 2003-05-25 Moritz Schulte * rijndael.c (do_setkey): Adjusted for libgpg-error. (rijndael_setkey): Likewise. * random.c (gcry_random_add_bytes): Likewise. * elgamal.c (_gcry_elg_generate): Likewise. (_gcry_elg_check_secret_key): Likewise. (_gcry_elg_encrypt): Likewise. (_gcry_elg_decrypt): Likewise. (_gcry_elg_sign): Likewise. (_gcry_elg_verify): Likewise. * rsa.c (_gcry_rsa_generate): Likewise. (_gcry_rsa_check_secret_key): Likewise. (_gcry_rsa_encrypt): Likewise. (_gcry_rsa_decrypt): Likewise. (_gcry_rsa_sign): Likewise. (_gcry_rsa_verify): Likewise. * pubkey.c (dummy_generate, dummy_check_secret_key, dummy_encrypt, dummy_decrypt, dummy_sign, dummy_verify): Likewise. (gcry_pubkey_register): Likewise. (check_pubkey_algo): Likewise. (pubkey_generate): Likewise. (pubkey_check_secret_key): Likewise. (pubkey_encrypt): Likewise. (pubkey_decrypt): Likewise. (pubkey_sign): Likewise. (pubkey_verify): Likewise. (sexp_elements_extract): Likewise. (sexp_to_key): Likewise. (sexp_to_sig): Likewise. (sexp_to_enc): Likewise. (sexp_data_to_mpi): Likewise. (gcry_pk_encrypt): Likewise. (gcry_pk_decrypt): Likewise. (gcry_pk_sign): Likewise. (gcry_pk_verify): Likewise. (gcry_pk_testkey): Likewise. (gcry_pk_genkey): Likewise. (gcry_pk_ctl): Likewise. * cipher.c (dummy_setkey): Likewise. (check_cipher_algo): Likewise. (gcry_cipher_open): Likewise. (cipher_setkey): Likewise. (gcry_cipher_ctl): Likewise. (cipher_encrypt): Likewise. (gcry_cipher_encrypt): Likewise. (cipher_decrypt): Likewise. (gcry_cipher_decrypt): Likewise. (gcry_cipher_info): Likewise. (gcry_cipher_algo_info): Likewise. * cast5.c (cast_setkey): Likewise. (do_cast_setkey): Likewise. * arcfour.c (arcfour_setkey): Likewise. (do_arcfour_setkey): Likewise. * blowfish.c (do_bf_setkey): Likewise. (bf_setkey): Likewise. * des.c (do_des_setkey): Likewise. (do_tripledes_setkey): Likewise. 2003-05-22 Moritz Schulte * tiger.c: Merged code ussing the U64_C macro from GnuPG. * sha512.c: Likewise. 2003-05-17 Moritz Schulte * pubkey.c (gcry_pk_genkey): Fix type: acquire a lock, instead of releasing it. 2003-05-11 Moritz Schulte * pubkey.c (gcry_pk_testkey): Call REGISTER_DEFAULT_CIPHERS. (gcry_pk_ctl): Likewise. 2003-04-27 Moritz Schulte * pubkey.c (gcry_pk_genkey): Release sexp after extracted data has been used. * md.c (gcry_md_get_algo_dlen): Simplified, simply call md_digest_length to do the job. * des.c (do_des_setkey): Check for selftest failure not only during initialization. (do_tripledes_setkey): Include check for selftest failure. * pubkey.c (gcry_pubkey_register_default): New macro `pubkey_use_dummy', use it. * elgamal.c (elg_names): New variable. (pubkey_spec_elg): Include elg_names. * dsa.c (dsa_names): New variable. (pubkey_spec_dsa): Include dsa_names. * rsa.c (rsa_names): New variable. (pubkey_spec_rsa): Include rsa_names. * pubkey.c (gcry_pubkey_lookup_func_name): Compare name also with the names listed in `sexp_names'. 2003-04-24 Moritz Schulte * pubkey.c (sexp_to_key): New variables: module, pubkey. Adjusted to new module interface. (sexp_to_key): Changend type of argument `retalgo' from `int *' to `GcryModule **'. Adjusted all callers. Removed argument: r_algotblidx. (sexp_to_sig): Changend type of argument `retalgo' from `int *' to `GcryModule **'. Adjusted all callers. (sexp_to_enc): Likewise. (pubkey_get_npkey, pubkey_get_nskey, pubkey_get_nsig, pubkey_get_nenc): Use strlen to find out the number. * rsa.c: Adjust pubkey_spec_rsa to new internal interface. * dsa.c: Likewise. * elgamal.c: Likewise. 2003-04-17 Moritz Schulte * pubkey.c (sexp_elements_extract): New function. * pubkey.c (sexp_to_key): Removed variable `idx', added `err', use sexp_elements_extract. (sexp_to_sig): Likewise. (sexp_to_enc): Likewise. * pubkey.c: Terminate list correctly. * md.c: Include sha512/sha384 in digest_table. 2003-04-16 Moritz Schulte * Makefile.am: Include support for sha512.c. * sha512.c: New file, merged from GnuPG, with few modifications for libgcrypt. * rand-internal.h: Removed declarations for constructor functions. * md.c (md_copy): Call _gcry_module_use for incrementing the usage counter of the digest modules. * rsa.c: Do not include "rsa.h". * dsa.c: Do not include "dsa.h". * elgamal.c: Do not include "elgamal.h". * des.c: Do not include "des.h". * cast5.c: Do not include "cast5.h". * blowfish.c: Do not include "blowfish.h". * arcfour.c: Do not include "arcfour.h". * Makefile.am (libcipher_la_DEPENDENCIES): Removed. (libcipher_la_LIBADD): Removed. Use Automake conditionals for conditional compilation. 2003-04-13 Moritz Schulte * cipher.c (gcry_cipher_open): Call REGISTER_DEFAULT_CIPHERS. * md.c (gcry_md_list): New member: module. (md_enable): New variable: module, changed use of module and digest. (md_enable): Initialize member: module. (md_close): Call _gcry_module_release. * cipher.c (gcry_cipher_open): New variable: module, changed use of module and cipher. (struct gcry_cipher_handle): New member: module. (gcry_cipher_open): Initialize member: module. (gcry_cipher_close): Call _gcry_module_release. 2003-04-09 Moritz Schulte * cipher.c: Include "ath.h". * md.c: Likewise. * pubkey.c: Likewise. * cipher.c (ciphers_registered_lock): New variable. * md.c (digests_registered_lock): New variable. * pubkey.c (pubkeys_registered_lock): New variable. * rndlinux.c (gnupgext_version, func_table): Removed definitions. (gnupgext_enum_func): Removed function. (_gcry_rndlinux_constructor): Removed function. * rndegd.c (gnupgext_version, func_table): Removed definitions. (gnupgext_enum_func): Removed function. (_gcry_rndegd_constructor): Removed function. * rndunix.c (gnupgext_version, func_table): Removed definitions. (gnupgext_enum_func): Removed function. (_gcry_rndunix_constructor): Removed function. * rndw32.c (gnupgext_version, func_table): Removed definitions. (gnupgext_enum_func): Removed function. (_gcry_rndw32_constructor): Removed function. * rndegd.c (rndegd_connect_socket): Simplify code for creating the egd socket address. (rndegd_connect_socket): Call log_fatal use instead of g10_log_fatal. (egd_gather_random): Renamed to ... (rndegd_gather_random): ... here. 2003-04-08 Moritz Schulte * rndlinux.c: Do not include "dynload.h". * rndunix.c: Likewise. * rndw32.c: Likewise. * rndegd.c (rndegd_connect_socket): Factored out from ... (egd_gather_random): here; call it. (egd_socket): New variable. (egd_gather_random): Initialize fd with egd_socket, do not declare fd static. (do_read): Merged few changes from GnuPG. FIXME - not finished? Do not include "dynload.h". * rndw32.c (gather_random): Renamed to rndw32_gather_random, do not declare static. (gather_random_fast): Renamed to rndw32_gather_random_fast, do not declare static. * rndunix.c (gather_random): Renamed to rndunix_gather_random, do not declare static. * rndegd.c (gather_random): Renamed to rndegd_gather_random, do not declare static. * rndlinux.c (gather_random): Renamed to rndlinux_gather_random, do not declare static. 2003-04-07 Moritz Schulte * Makefile.am (libcipher_la_SOURCES): Removed construct.c. (libcipher_la_SOURCES): Added sha1.c, sha256.c, rmd160.c, md4.c, md5.c, tiger.c and crc.c (EXTRA_PROGRAMS): Removed sha1, sha256, rmd160, md4, md5, tiger and crc. Removed definitions: EXTRA_md4_SOURCES, EXTRA_md5_SOURCES, EXTRA_rmd160_SOURCES, EXTRA_sha1_SOURCES, EXTRA_sha256_SOURCES, EXTRA_tiger_SOURCES and EXTRA_crc_SOURCES, BUILT_SOURCES, DISTCLEANFILES. * pubkey.c: Do not include "elgamal.h", "dsa.h" and "rsa.h". * Makefile.am (libcipher_la_SOURCES): Removed rsa.h, elgamal.h, dsa.h, des.h, cast5.h, arcfour.h and blowfish.h. * rsa.h: Removed file. * elgamal.h: Removed file. * dsa.h: Removed file. * des.h: Removed file. * cast5.h: Removed file. * arcfour.h: Removed file. * blowfish.h: Removed file. * Makefile.am (libcipher_la_SOURCES): Removed dynload.c and dynload.h. * rsa.c (pubkey_spec_rsa): New variable. * dsa.c (pubkey_spec_rsa): New variable. * elgamal.c (pubkey_spec_elg): New variable. * rsa.c (_gcry_rsa_get_info): Removed function. * elgamal.c (_gcry_elg_get_info): Removed function. * dsa.c (_gcry_dsa_get_info): Removed function. * tiger.c (tiger_get_info): Removed function. (gnupgext_version, func_table): Removed definitions. (gnupgext_enum_func): Removed function. (_gcry_tiger_constructor): Removed function. * sha1.c (sha1_get_info): Removed function. (gnupgext_version, func_table): Removed definitions. (gnupgext_enum_func): Removed function. (_gcry_sha1_constructor): Removed function. * sha256.c (sha256_get_info): Removed function. (gnupgext_version, func_table): Removed definitions. (gnupgext_enum_func): Removed function. (_gcry_sha256_constructor): Removed function. * rmd160.c (rmd160_get_info): Removed function. (gnupgext_version, func_table): Removed definitions. (gnupgext_enum_func): Removed function. (_gcry_rmd160_constructor): Removed function. * md5.c (md5_get_info): Removed function. (gnupgext_version, func_table): Removed definitions. (gnupgext_enum_func): Removed function. (_gcry_md5_constructor): Removed function. * md4.c (md4_get_info): Removed function. (gnupgext_version, func_table): Removed definitions. (gnupgext_enum_func): Removed function. (_gcry_md4_constructor): Removed function. * crc.c (crc_get_info): Removed function. * arcfour.c (do_arcfour_setkey): Changed type of context argument to `void *', added local variable for cast, adjusted callers. (arcfour_setkey): Likewise. (encrypt_stream): Likewise. * cast5.c (cast_setkey): Likewise. (encrypt_block): Likewise. * rijndael.c (rijndael_setkey): Likewise. (rijndael_encrypt): Likewise. (rijndael_decrypt): Likewise. * twofish.c (twofish_setkey): Likewise. (twofish_encrypt): Likewise. (twofish_decrypt): Likewise. * des.c (do_des_setkey): Likewise. (do_des_encrypt): Likewise. (do_des_encrypt): Likewise. (do_tripledes_encrypt): Likewise. (do_tripledes_encrypt): Likewise. * blowfish.c (bf_setkey: Likewise. (encrypt_block): Likewise. (decrypt_block): Likewise. * arcfour.c (encrypt_stream): Likewise. * rijndael.c (gnupgext_version, func_table): Removed definitions. (gnupgext_enum_func) Removed function. * twofish.c (gnupgext_version, func_table): Removed definitions. (gnupgext_enum_func) Removed function. * cast5.c (CIPHER_ALGO_CAST5): Removed. * blowfish.c (FNCCAST_SETKEY, FNCCAST_CRYPT): Removed macros. (CIPHER_ALGO_BLOWFISH): Removed symbol. * cast5.c (FNCCAST_SETKEY, FNCCAST_CRYPT): Likewise. * des.c (selftest_failed): Removed. (initialized): New variable. (do_des_setkey): Run selftest, if not yet done. (FNCCAST_SETKEY, FNCCAST_CRYPT): Removed macros. * arcfour.c (_gcry_arcfour_get_info): Removed function. * blowfish.c (_gcry_blowfish_get_info): Removed function. * cast5.c (_gcry_cast5_get_info): Removed function. * des.c (_gcry_des_get_info): Removed function. * rijndael.c (_gcry_rijndael_get_info): Removed function. * twofish.c (_gcry_twofish_get_info): Removed function. * arcfour.c (cipher_spec_arcfour): New variable. * twofish.c (cipher_spec_twofish, cipher_spec_twofish128): New variables. * rijndael.c (cipher_spec_aes, cipher_spec_aes192, cipher_spec256): New variables. * des.c (cipher_spec_des, cipher_spec_tripledes): New variables. * cast5.c (cipher_spec_cast5): New variable. * blowfish.c (cipher_spec_blowfish): Likewise. * twofish.c: Do not include "dynload.h". * rijndael.c: Likewise. * des.c: Likewise. * cast5.c: Likewise. * blowfish.c: Likewise. * cipher.c: Likewise. * crc.c: Likewise. * md4.c: Likewise. * md5.c: Likewise. * md.c: Likewise. * pubkey.c: Likewise. * rijndael.c: Likewise. * sha1.c: Likewise. * sha256.c: Likewise. * arcfour.c: Include "cipher.h". * twofish.c: Likewise. * rijndael.c: Likewise. * des.c: Likewise. * cast5.c: Likewise. * blowfish.c: Likewise. * twofish.c (twofish_setkey): Declared argument `key' const. (twofish_encrypt): Declared argument `inbuf' const. (twofish_decrypt): Likewise. * rijndael.c (rijndael_setkey): Declared argument `key' const. (rijndael_encrypt): Declared argument `inbuf' const. (rijndael_decrypt): Likewise. * des.c (do_des_setkey): Declared argument `key' const. (do_tripledes_setkey): Likewise. (do_des_encrypt): Declared argument `inbuf' const. (do_des_decrypt): Likewise. (do_tripledes_encrypt): Likewise. (do_tripledes_decrypt): Likewise. * cast5.c (encrypt_block): Declared argument `inbuf' const. (decrypt_block): Likewise. (cast_setkey): Declared argument `key' const. * blowfish.c (do_bf_setkey): Declared argument `key' const. (encrypt_block): Declared argument `inbuf' const. (encrypt_block): Likewise. * cipher.c: Remove CIPHER_ALGO_DUMMY related code. Removed struct cipher_table_s. Changed definition of cipher_table. Removed definition of disabled_algos. (ciphers_registered, default_ciphers_registered): New variables. (REGISTER_DEFAULT_CIPHERS): New macro. (dummy_setkey): Declared argument `key' const. (dummy_encrypt_block): Declared argument `inbuf' const. (dummy_encrypt_block): Likewise. (dummy_encrypt_stream): Likewise. (dummy_encrypt_stream): Likewise. (dummy_setkey): Use `unsigned char' instead of `byte'. (dummy_encrypt_block): Likewise. (dummy_decrypt_block): Likewise. (dummy_encrypt_stream): Likewise. (dummy_decrypt_stream): Likewise. (gcry_cipher_register_default): New function. (gcry_cipher_lookup_func_id): New function. (gcry_cipher_lookup_func_name): New function. (gcry_cipher_lookup_id): New function. (gcry_cipher_lookup_name): New function. (gcry_cipher_id_new): New function. (gcry_cipher_register): New function. (gcry_cipher_unregister): New function. (setup_cipher_table): Removed function. (load_cipher_modules): Removed function. (gcry_cipher_map_name): Adjusted to use new module management. (cipher_algo_to_string): Likewise. (disable_cipher_algo): Likewise. (check_cipher_algo): Likewise. (cipher_get_keylen): Likewise. (cipher_get_blocksize): Likewise. (gcry_cipher_open): Likewise. (struct gcry_cipher_handle): Replaced members algo, algo_index, blocksize, setkey, encrypt, decrypt, stencrypt, stdecrypt with one member: cipher. (gcry_cipher_open): Adjusted code for new handle structure. (cipher_setkey): Likewise. (cipher_setiv): Likewise. (cipher_reset): Likewise. (do_ecb_encrypt): Likewise. (do_ecb_decrypt): Likewise. (do_cbc_encrypt): Likewise. (do_cbc_decrypt): Likewise. (do_cfb_encrypt): Likewise. (do_cfb_decrypt): Likewise. (do_ctr_encrypt): Likewise. (cipher_encrypt): Likewise. (gcry_cipher_encrypt): Likewise. (cipher_decrypt): Likewise. (gcry_cipher_decrypt): Likewise. (cipher_sync): Likewise. (gcry_cipher_ctl): Likewise. * pubkey.c: Removed struct pubkey_table_s. Changed definition of pubkey_table. Removed definition of disabled_algos. (pubkeys_registered, default_pubkeys_registered): New variables. (REGISTER_DEFAULT_PUBKEYS): New macro. (setup_pubkey_table): Removed function. (load_pubkey_modules): Removed function. (gcry_pubkey_register_default): New function. (gcry_pubkey_lookup_func_id): New function. (gcry_pubkey_lookup_func_name): New function. (gcry_pubkey_lookup_id): New function. (gcry_pubkey_lookup_name): New function. (gcry_pubkey_id_new): New function. (gcry_pubkey_register): New function. (gcry_pubkey_unregister): New function. (gcry_pk_map_name): Adjusted to use new module management. (gcry_pk_algo_name): Likewise. (disable_pubkey_algo): Likewise. (check_pubkey_algo): Likewise. (pubkey_get_npkey): Likewise. (pubkey_get_nskey): Likewise. (pubkey_get_nsig): Likewise. (pubkey_get_nenc): Likewise. (pubkey_generate): Likewise. (pubkey_check_secret_key): Likewise. (pubkey_encrypt): Likewise. (pubkey_decrypt): Likewise. (pubkey_sign): Likewise. (pubkey_verify): Likewise. (gcry_pk_get_nbits): Likewise. (gcry_pk_algo_info): Likewise. * md.c: Removed struct md_digest_list_s. (digest_list): Changed definition. (digests_registered, default_digests_registered): New variables. (REGISTER_DEFAULT_DIGESTS): New macro. (new_list_item): Removed function. (setup_md_table): Removed function. (load_digest_module): Removed function. (gcry_digest_register_default): New function. (gcry_digest_lookup_func_id): New function. (gcry_digest_lookup_func_name): New function. (gcry_digest_lookup_id): New function. (gcry_digest_lookup_name): New function. (gcry_digest_id_new): New function. (gcry_digest_register): New function. (gcry_digest_unregister): New function. (GcryDigestEntry): New type. (struct gcry_md_context): Adjusted type of `list'. (gcry_md_map_name): Adjusted to use new module management. (digest_algo_to_string): Likewise. (check_digest_algo): Likewise. (md_enable): Likewise. (md_digest_length): Likewise. (md_asn_oid): Likewise. 2003-04-07 Moritz Schulte * pubkey.c: Replaced PUBKEY_ALGO_DSA with GCRY_PK_DSA, PUBKEY_ALGO_RSA with GCRY_PK_RSA and PUBKEY_ALGO_ELGAMAL with GCRY_PK_ELG. * dsa.c: Replaced PUBKEY_ALGO_DSA with GCRY_PK_DSA. 2003-04-01 Moritz Schulte * des.c: Removed checks for GCRY_CIPHER_3DES and GCRY_CIPHER_DES. 2003-03-31 Moritz Schulte * tiger.c (tiger_get_info): Do not declare static. * sha256.c (sha256_get_info): Likewise. * sha1.c (sha1_get_info): Likewise. * rmd160.c (rmd160_get_info): Likewise. * md5.c (md5_get_info): Likewise. * md4.c (md4_get_info): Likewise. * crc.c (crc_get_info): Likewise. * md.c (load_digest_module): Call setup_md_table during initialization. (new_list_item): Link new element into digest_list. * cipher.c (do_ctr_decrypt): Made do_ctr_encrypt act as a wrapper for do_ctr_encrypt, since these functions are identical. 2003-03-30 Simon Josefsson * cipher.c (struct gcry_cipher_handle): Add counter field. (gcry_cipher_open): Add CTR. (cipher_reset): Clear counter field. (do_ctr_encrypt, do_ctr_decrypt): New functions. (cipher_encrypt, cipher_decrypt): Call CTR functions. (gcry_cipher_ctl): Add SET_CTR to set counter. 2003-03-30 Moritz Schulte * rsa.c (_gcry_rsa_blind): New function. (_gcry_rsa_unblind): New function. (_gcry_rsa_decrypt): Use _gcry_rsa_blind and _gcry_rsa_decrypt. 2003-03-26 Moritz Schulte * dynload.c (_gcry_enum_gnupgext_pubkeys): Adjust `encrypt' and `decrypt' function arguments. (_gcry_enum_gnupgext_pubkeys): Likewise. * dynload.h: Likewise. * pubkey.c (dummy_decrypt): Add argument: int flags. (dummy_encrypt): Likewise. * elgamal.c (_gcry_elg_encrypt): Add argument: int flags. (_gcry_elg_decrypt): Likewise. * rsa.c (_gcry_rsa_encrypt): Add argument: int flags. (_gcry_rsa_decrypt): Likewise. * pubkey.c: Add `flags' argument to members `encrypt' and `decrypt' of struct `pubkey_table_s'. * rsa.h: Add `flags' argument to function declarations. * elgamal.h: Likewise. * pubkey.c (sexp_data_to_mpi): New variable: int parsed_flags. (sexp_data_to_mpi): Set `parsed_flags'. (sexp_data_to_mpi): New argument: int *flags. (gcry_pk_encrypt): New variable: int flags. (gcry_pk_encrypt): Pass `flags' to pubkey_encrypt. (pubkey_encrypt): New variable: int flags. (pubkey_encrypt): Pass `flags' to pubkey encrypt function. (pubkey_decrypt): Likewise. (pubkey_decrypt): Pass `flags' to pubkey encrypt function. (gcry_pk_encrypt): Include `flags' s-exp in return list. (sexp_to_enc): New argument: int *flags. (gcry_pk_decrypt): New variable: int flags. (gcry_pk_decrypt): Pass `flags' to pubkey_decrypt. (sexp_to_enc): New variable: int parsed_flags. (sexp_to_enc): Set `parsed_flags'. 2003-03-22 Simon Josefsson * cipher.c (gcry_cipher_open, do_cbc_encrypt) (gcry_cipher_encrypt): Support GCRY_CIPHER_CBC_MAC. (gcry_cipher_ctl): Support GCRYCTL_SET_CBC_MAC. 2003-03-19 Werner Koch * primegen.c (gen_prime): New args EXTRA_CHECK and EXTRA_CHECK_ARG to allow for a user callback. Changed all callers. (_gcry_generate_secret_prime) (_gcry_generate_public_prime): Ditto, pass them to gen_prime. * rsa.c (check_exponent): New. (generate): Use a callback to ensure that a given exponent is actually generated. 2003-03-12 Moritz Schulte * primegen.c: Initialize `no_of_small_prime_numbers' statically. (gen_prime): Remove calculation of `no_of_small_prime_numbers'. 2003-03-03 Moritz Schulte * md.c (gcry_md_ctl): Rewritten to use same style like the other functions dispatchers. 2003-03-02 Moritz Schulte * cipher.c (struct gcry_cipher_handle): New member: algo_index. (gcry_cipher_open): Allocate memory for two cipher contexts. Initialize algo_index. (cipher_setkey): Duplicate context into reserved memory. (cipher_reset): New function, which resets the context and clear the IV. (gcry_cipher_ctl): Call cipher_reset. 2003-02-23 Moritz Schulte * cipher.c: Remove (bogus) `digitp' macro definition. * md.c: Likewise. * blowfish.c (burn_stack): Removed. * arcfour.c (burn_stack): Likewise. * cast5.c (burn_stack): Likewise. * des.c (burn_stack): Likewise. * md4.c (burn_stack): Likewise. * md5.c (burn_stack): Likewise. * random.c (burn_stack): Likewise. * rijndael.c (burn_stack): Likewise. * rmd160.c (burn_stack): Likewise. * sha1.c (burn_stack): Likewise. * sha256.c (burn_stack): Likewise. * tiger.c (burn_stack): Likewise. * twofish.c (burn_stack): Likewise. * blowfish.c: Changed all occurences of burn_stack to _gcry_burn_stack. * arcfour.c: Likewise. * cast5.c: Likewise. * des.c: Likewise. * md4.c: Likewise. * md5.c: Likewise. * random.c: Likewise. * rijndael.c: Likewise. * rmd160.c: Likewise. * sha1.c: Likewise. * sha256.c: Likewise. * tiger.c: Likewise. * twofish.c: Likewise. * arcfour.c (_gcry_arcfour_get_info): Use GCRY_CIPHER_ARCFOUR instead of hard-coded value `301'. 2003-01-24 Werner Koch * random.c (_gcry_register_random_progress): New. (_gcry_random_progress): New. * rndlinux.c (gather_random): Call the random progress function. 2003-01-23 Werner Koch * rsa.c (generate): New arg USE_E to request a specific public exponent. (_gcry_rsa_generate): Ditto. * elgamal.c (_gcry_elg_generate): Must add an dummy argument instead of USE_E. * dsa.c (_gcry_dsa_generate): Ditto. * pubkey.c (dummy_generate): Ditto. (pubkey_generate): Add USE_E arg and pass it down. (gcry_pk_genkey): Detect "rsa-use-e" parameter and pass it to generate. * pubkey.c (sexp_to_enc): New arg RET_MODERN. (gcry_pk_decrypt): Make use of it to return a real S-expression. Return better error codes. (gcry_pk_verify): Return better error codes. 2003-01-21 Werner Koch * random.c (gcry_random_add_bytes): Add QUALITY argument, let function return an error code and disable its core for now. 2003-01-21 Timo Schulz * random.c (gcry_random_add_bytes): New. Function to add external random to the pool. 2003-01-20 Simon Josefsson * crc.c: New. * Makefile.am (EXTRA_PROGRAMS, EXTRA_crc_SOURCES): Add crc.c. * md.c (gcry_md_get_algo_dlen): Add values for CRC. 2003-01-20 Werner Koch * sha256.c: New. * bithelp.h (ror): New. * Makfile.am: Add sha256.c. * md.c (oid_table): Add values for SHA256 et al. (gcry_md_get_algo_dlen): Likewise 2003-01-20 Werner Koch * pubkey.c (gcry_pk_get_keygrip): Implemented keygrips for DSA and ElGamal. 2003-01-17 Werner Koch * cipher.c (gcry_cipher_encrypt): Reworked so that the output will never contain the plaintext even if the caller did not checked the return value. * md.c (gcry_md_get_algo): Changed error code to GCRYERR_GENERAL because we don't have an invalid md algo but no algorithm enabled. * pubkey.c (gcry_pk_genkey): Changed error code for bounds check of table parameters to GCRYERR_INTERNAL. * md.c (gcry_md_open): Partly reverted Timo's change from 2002-10-10 by removing the check for the algorithm. An algorithm of 0 is allowed and anyway we should not double check it or check it using a different function. Also fixed the flags check. * pubkey.c (gcry_pk_encrypt): Make sure that R_CIPH points to NULL on error. (gcry_pk_decrypt): Ditto for R_PLAIN. (gcry_pk_sign): Ditto for R_SIG. (gcry_pk_genkey): Ditto for R_KEY. 2003-01-16 Werner Koch * md.c (gcry_md_write): Changed 2nd argument type to void*. (gcry_md_hash_buffer): Changed type of boths buffers to void*. (gcry_md_setkey): Changed 2nd argument type to void*. 2003-01-15 Werner Koch * pubkey.c (sexp_data_to_mpi): New. This handles pkcs1 padding. (gcry_pk_sign, gcry_pk_verify): Use it here. (gcry_pk_encrypt): And here. (pubkey_verify): Add debug code. (sexp_to_enc): Handle flags in the input and return the pkcs1 flag in a new parameter. (gcry_pk_decrypt): Prepare for future pkcs1 handling. 2002-12-19 Werner Koch * random.c (_gcry_random_initialize): New. 2002-12-16 Werner Koch * cipher.c: Added a Teletrust specific OID for 3DES. 2002-12-12 Werner Koch * md.c: Added another oddball OIW OID (sha-1WithRSAEncryption). 2002-11-23 Werner Koch * md.c (load_digest_module): Enlarged checked_algos bitmap. * md4.c (func_table): Fixed entry for md4. Both by Simon Josephson. (transform): Copy data to get the alignment straight. Tested only on i386. 2002-11-10 Simon Josefsson * cipher.c (gcry_cipher_open): Don't reject CTS flag. (do_cbc_encrypt, do_cbc_decrypt, cipher_encrypt) (gcry_cipher_encrypt, cipher_decrypt) (gcry_cipher_decrypt): Support CTS flag. (gcry_cipher_ctl): Toggle CTS flag. 2002-11-10 Werner Koch * md4.c: New. By Simon Josefsson. * Makefile.am (EXTRA_PROGRAMS): Add md4.c. * md.c (oid_table,gcry_md_get_algo_dlen): MD4 support. 2002-10-14 Werner Koch * arcfour.c (do_encrypt_stream): Don't use increment op when assigning to the same variable. 2002-10-10 Timo Schulz * pubkey.c (gcry_pk_genkey): Check boundaries. * md.c (gcry_md_open): Check that algo is available and only valid flag values are used. (gcry_md_get_algo): Add error handling. 2002-09-26 Werner Koch * md.c: Include an OID for TIGER. * tiger.c (tiger_get_info): Use a regular OID. 2002-09-17 Werner Koch * random.c: Replaced mutex.h by the new ath.h. Changed all calls. 2002-09-16 Werner Koch * arcfour.c (do_encrypt_stream): Use register modifier and modulo. According to Nikos Mavroyanopoulos this increases perfromace on i386 system noticable. And I always tought gcc is clever enough. * md5.c (transform): Use register modifier. * rmd160.c (transform): Ditto. * sha1.c (transform): Ditto. We hope that there are 6 free registers. * random.c (gcry_randomize): Rewrote to avoid malloc calls. * rndlinux.c (gather_random): Replaced remaining fprintfs by log_*. * arcfour.c (do_arcfour_setkey): Ditto. * twofish.c (do_twofish_setkey): Ditto. * rndegd.c (gather_random): Ditto. * rijndael.c (do_setkey): Ditto. * random.c (_gcry_random_dump_stats): Ditto. * primegen.c (_gcry_generate_elg_prime): Ditto. * des.c (_gcry_des_get_info): Ditto. * cast5.c (do_cast_setkey): Ditto. * blowfish.c (do_bf_setkey): Ditto. 2002-08-26 Werner Koch * des.c (weak_keys): Fixed one entry in the table and compared all entries against the literature. (selftest): Checksum the weak key table. 2002-08-21 Werner Koch * pubkey.c: Enable keygrip calculation for "openpgp-rsa". 2002-08-17 Werner Koch * cipher.c (setup_cipher_table): Don't overwrite the DES entry with the entry for DUMMY. 2002-08-14 Werner Koch * des.c (do_des_setkey,do_des_encrypt, do_des_decrypt): New. (_gcry_des_get_info): Support plain old DES. * cipher.c (setup_cipher_table): Put DES into the table. 2002-07-25 Werner Koch * rndunix.c (_gcry_rndunix_constructor): Prefixed with _gcry_. Noted by Stephan Austermuehle. 2002-07-08 Timo Schulz * rndw32.c: Replaced the m_ memory functions with the real gcry_ functions. Renamed all g10_ prefixed functions to log_. 2002-06-12 Werner Koch * rsa.c (generate): Use e = 65537 for now. 2002-06-11 Werner Koch * pubkey.c (gcry_pk_get_keygrip): Allow a "protected-private-key". 2002-06-05 Timo Schulz * cipher.c (gcry_cipher_encrypt, gcry_cipher_decrypt): Check that the input size is a multiple of the blocksize. 2002-05-23 Werner Koch * md.c (oid_table): Add an rsadsi OID for MD5. 2002-05-21 Werner Koch * primegen.c, elgamal.c, dsa.c (progress): Do not print anything by default. Pass an extra identifying string to the callback and reserved 2 argumenst for current and total counters. Changed the register function prototype. 2002-05-17 Werner Koch * rndegd.c (rndegd_constructor): Fixed name of register function and prefixed the function name with _gcry_. * rndw32.c (rndw32_constructor): Ditto. * tiger.c (tiger_constructor): Ditto. * Makefile.am: Removed all dynamic loading stuff. * dynload.c: Ditto. Now only used for the constructor system. 2002-05-15 Werner Koch * random.c (gcry_random_bytes,gcry_random_bytes_secure) (gcry_randomize): Make sure we are initialized. 2002-05-14 Werner Koch Changed license of most files to the LGPL. 2002-05-02 Werner Koch * random.c (_gcry_fast_random_poll): Initialize the module so the mutex can be used. * primegen.c (small_prime_numbers): Moved table from smallprime.c * smallprime.c: File removed. * des.c (leftkey_swap, rightkey_swap, working_memcmp): Made static. * cipher.c (gcry_cipher_map_name): Map "RIJNDAEL" to "AES". * rijndael.c (rijndael_get_info): We do only support a 128 bit blocksize so it makes sense to change the algorithm strings to AES. * tiger.c (tiger_final): Removed superfluous token pasting operators. * md5.c (md5_final): Ditto. 2002-04-30 Werner Koch * cipher.c: Fixed list of copyright years. 2002-03-18 Werner Koch * random.c (initialize): Initialize the new pool lock mutex. (_gcry_fast_random_poll): Add locking and moved main code out to... (do_fast_random_poll): new function. (read_pool): Use the new function here. (get_random_bytes): Add locking. (_gcry_update_random_seed_file): Ditto. 2002-03-11 Werner Koch * md.c: Add rsaSignatureWithripemd160 to OID table. 2002-02-20 Werner Koch * sha1.c: Removed a left over comment note. The code has been rewritten from scratch in 1998. Thanks to Niels Möller for reporting this misleading comment. 2002-02-18 Werner Koch * rndunix.c (rndunix_constructor): Use the the new prefixed function name. Reported by Jordi Mallach. 2002-02-10 Werner Koch * random.c (mix_pool): Carry an extra failsafe_digest buffer around to make the function more robust. 2002-02-08 Werner Koch * random.c (add_randomness): Xor new data into the pool and not just copy it. This avoids any choosen input attacks which are not serious in our setting because an outsider won't be able to mix data in and even then we keep going with a PRNG. Thanks to Stefan Keller for pointing this out. 2002-01-04 Werner Koch * pubkey.c (gcry_pk_genkey): Do not release skey - it is static. * primegen.c (gen_prime): Of course we should use set_bit and not set_highbit to set the second high bit. 2001-12-18 Werner Koch * rsa.c (generate): Loop until we find the exact modulus size. Changed the exponent to 41. (rsa_get_info): s/usage/r_usage/ to avoid shadow warnings. * primegen.c (gen_prime): Set 2 high order bits for secret primes. * Makefile.am (DISTCLEANFILES): Include construct.c. 2001-12-17 Werner Koch * pubkey.c (gcry_pk_get_keygrip): New - experimental. 2001-12-11 Werner Koch * cipher.c: Added OIDs for AES. (gcry_cipher_mode_from_oid): New. (gcry_cipher_map_name): Moved OID search code to .. (search_oid): .. new function. 2001-12-10 Werner Koch * pubkey.c (gcry_pk_encrypt): Find the signature algorithm by name and not by number. * pubkey.c (gcry_pk_encrypt,gcry_pk_decrypt,gcry_pk_sign) (gcry_pk_verify,gcry_pk_testkey, gcry_pk_genkey) (gcry_pk_get_nbits): Release the arrays. Noted by Nikos Mavroyanopoulos. 2001-12-06 Werner Koch * cipher.c (gcry_cipher_map_name): Look also for OIDs prefixed with "oid." or "OID.". 2001-12-05 Werner Koch * pubkey.c (algo_info_table): Fixed entry for openpgp-rsa. 2001-11-24 Werner Koch * pubkey.c: Added the rsaEncryption OID to the tables. (sexp_to_key): Add an arg to return the index of the algorithm, changed all callers. (gcry_pk_sign): Find the signature algorithm by name and not by number. (gcry_pk_get_nbits): Fixed so that we can now really pass a secret key to get the result. * md.c (gcry_md_map_name): Look also for OIDs prefixed with "oid." or "OID." so that an OID string can be used as an S-Exp token. 2001-11-20 Werner Koch * md.c (gcry_md_map_name): Lookup by OID if the the name begins with a digit. (oid_table): New. 2001-11-16 Werner Koch * md.c (gcry_md_info): New operator GCRYCTL_IS_ALGO_ENABLED. 2001-11-07 Werner Koch * md.c (gcry_md_hash_buffer): Close the handle which was left open for algorithms other than rmd160. 2001-08-08 Werner Koch * rndw32.c (gather_random): Use toolhelp in addition to the NT gatherer for Windows2000. Suggested by Sami Tolvanen. * random.c (read_pool): Fixed length check, this used to be one byte to strict. Made an assert out of it because the caller has already made sure that only poolsize bytes are requested. Reported by Marcus Brinkmann. 2001-08-03 Werner Koch * cipher.c (cipher_encrypt, cipher_decrypt): Prepare to return errors. We have to change the interface to all ciphers to make this really work but we should do so to prepare for hardware encryption modules. (gcry_cipher_encrypt, gcry_cipher_decrypt): Return the error and set lasterr. (gcry_cipher_ctl): Make sure that errors from setkey are returned. 2001-08-02 Werner Koch * rndlinux.c (gather_random): casted a size_t arg to int so that the format string is correct. Casting is okay here and avoids translation changes. * random.c (fast_random_poll): Do not check the return code of getrusage. * rndunix.c: Add a signal.h header to avoid warnings on Solaris 7 and 8. * tiger.c (print_abc,print_data): Removed. * rijndael.c, des.c, blowfish.c, twofish.c, cast5.c, arcfour.c (burn_stack): New. Add wrappers for most functions to be able to call burn_stack after the function invocation. This methods seems to be the most portable way to zeroise the stack used. It does only work on stack frame based machines but it is highly portable and has no side effects. Just setting the automatic variables at the end of a function to zero does not work well because the compiler will optimize them away - marking them as volatile would be bad for performance. * md5.c, sha1.c, rmd160.c, tiger.c (burn_stack): Likewise. * random.c (burn_stack): New. (mix_pool): Use it here to burn the stack of the mixblock function. * primegen.c (_gcry_generate_elg_prime): Freed q at 3 places. Thanks to Tommi Komulainen. * arcfour.c (arcfour_setkey): Check the minimim keylength against bytes and not bits. (selftest): Must reset the key before decryption. 2001-05-31 Werner Koch * sha1.c (sha1_init): Made static. Changed all g10_ prefixed function names as well as some mpi_ function names to cope with the introduced naming changes. * md.c (prepare_macpads): Made key const. 2001-05-28 Werner Koch * rndegd.c (gather_random): Removed the use of tty_printf. 2001-03-29 Werner Koch * md5.c (md5_final): Fixed calculation of hashed length. Thanks to disastry@saiknes.lv for pointing out that it was horrible wrong for more than 512MB of input. * sha1.c (sha1_final): Ditto. * rmd160.c (rmd160_final): Ditto. * tiger.c (tiger_final): Ditto. * blowfish.c (encrypt,do_encrypt): Changed name to do_encrypt to avoid name clashes with an encrypt function in stdlib.h of Dynix/PIX. Thanks to Gene Carter. * elgamal.c (encrypt,do_encrypt): Ditto. * twofish.c (gnupgext_enum_func): Use only when when compiled as a module. * rijndael.c (gnupgext_enum_func): Ditto. * tiger.c (tiger_get_info): Return "TIGER192" and not just "TIGER". By Edwin Woudt. * random.c: Always include time.h - standard requirement. Thanks to James Troup. * rndw32.c: Fixes to the macros. 2001-01-11 Werner Koch * cipher.c (cipher_encrypt,gcry_cipher_encrypt): Use blocksize and not 8. 2000-12-19 Werner Koch Major change: Removed all GnuPG stuff and renamed this piece of software to gcrypt. 2000-11-14 Werner Koch * dsa.c (test_keys): Replaced mpi_alloc by gcry_mpi_new and mpi_free by gcry_mpi_release. * elgamal.c (test_keys,generate): Ditto, also for mpi_alloc_secure. * rsa.c (test_keys,generate,rsa_verify): Ditto. * primegen.c (generate_elg_prime): Ditto. (gen_prime): Ditto and removed nlimbs. * rsa.c (generate): Allocate 2 more vars in secure memory. * Makefile.am (OMIT_DEPENDENCIES): Hack to work around dependency problems. 2000-10-09 Werner Koch * arcfour.c, arcfour.h: New. * cipher.c (cipher_encrypt, cipher_decrypt): Add stream mode. (setup_cipher_table): Add Arcfour. (gcry_cipher_open): Kludge to allow stream mode. Wed Oct 4 13:16:18 CEST 2000 Werner Koch * sha1.c (transform): Use rol() macro. Actually this is not needed for a newer gcc but there are still aoter compilers. * rsa.c (test_keys): Use new random function. * md.c (gcry_md_setkey): New function to overcome problems with const conflics. (gcry_md_ctl): Pass set key to the new functions. * rijndael.c: New. * cipher.c: Add Rijndael support. Mon Sep 18 16:35:45 CEST 2000 Werner Koch * rndlinux.c (open_device): Loose random device checking. By Nils Ellmenreich. * random.c (fast_random_poll): Check ENOSYS for getrusage. * rndunix.c: Add 2 sources for QNX. By Sam Roberts. * pubkey.c (gcry_pk_algo_info): Add GCRYCTL_GET_ALGO_USAGE. * rsa.c: Changed the comment about the patent. (secret): Speed up by using the CRT. For a 2k keys this is about 3 times faster. (stronger_key_check): New but unused code to check the secret key. * Makefile.am: Included rsa.[ch]. * pubkey.c: Enabled RSA support. (pubkey_get_npkey): Removed RSA workaround. Mon Jul 31 10:04:47 CEST 2000 Werner Koch * pubkey.c: Replaced all gcry_sexp_{car,cdr}_{data,mpi} by the new gcry_sexp_nth_{data,mpi} functions. Tue Jul 25 17:44:15 CEST 2000 Werner Koch * pubkey.c (exp_to_key,sexp_to_sig,sexp_to_enc,gcry_pk_encrypt, gcry_pk_decrypt,gcry_pk_sign,gcry_pk_genkey): Changed to work with the new S-Exp interface. Mon Jul 17 16:35:47 CEST 2000 Werner Koch * random.c (gather_faked): Replaced make_timestamp by time(2) again. Fri Jul 14 19:38:23 CEST 2000 Werner Koch * md.c (gcry_md_ctl): Support GCRYCTL_{START,STOP}_DUMP. * Makefile.am: Never compile mingw32 as module. * Makefile.am: Tweaked module build and removed libtool * Makefile.am: Replaced -O1 by -O. Suggested by Alec Habig. * elgamal.c (sign): Removed inactive code. * rsa.c, rsa.h: New based on the old module version (only in CVS for now). * pubkey.c (setup_pubkey_table): Added commented support for RSA. * rndunix.c (waitpid): New. For UTS 2.1. All by Dave Dykstra. (my_popen): Do the FD_CLOEXEC only if it is available (start_gatherer): Cope with missing _SC_OPEN_MAX * rndunix.c: Add some more headers for QNX. By Sam Roberts. * rndegd.c (gather_random): Shortcut level 0. * rndunix.c (gather_random): Ditto. * rndw32.c (gather_random): Ditto. * rndw32.c: Replaced with code from Cryptlib and commented the old stuff. * rndw32.c: Add some debuging code enabled by an environment variable. * random.c (read_seed_file): Binary open for DOSish system (update_random_seed_file): Ditto. * random.c [MINGW32]: Include process.h for getpid. * random.c (fast_random_poll): Add clock_gettime() as fallback for system which support this POSIX.4 fucntion. By Sam Roberts. * random.c (read_seed_file): Removed the S_ISLNK test becuase it is already covered by !S_ISREG and is not defined in Unixware. Reported by Dave Dykstra. (update_random_seed_file): Silently ignore update request when pool is not filled. * random.c (read_seed_file): New. (set_random_seed_file): New. (read_pool): Try to read the seeding file. (update_random_seed_file): New. (read_pool): Do an initial extra seeding when level 2 quality random is requested the first time. This requestes at least POOLSIZE/2 bytes of entropy. Compined with the seeding file this should make normal random bytes cheaper and increase the quality of the random bytes used for key generation. * random.c (read_pool): Print a more friendly error message in cases when too much random is requested in one call. * random.c (fast_random_poll): Check whether RUSAGE_SELF is defined; this is not the case for some ESIX and Unixware, although they have getrusage(). * primegen.c (generate_elg_prime): All primes are now generated with the lowest random quality level. Because they are public anyway we don't need stronger random and by this we do not drain the systems entropy so much. * primegen.c (register_primegen_progress): New. * dsa.c (register_pk_dsa_progress): New. * elgamal.c (register_pk_elg_progress): New. * elgamal.c (wiener_map): New. (gen_k): Use a much smaller k. (generate): Calculate the qbits using the wiener map and choose an x at a size comparable to the one choosen in gen_k * rmd160.c (rmd160_get_info): Moved casting to the left side due to a problem with UTS4.3. Suggested by Dave Dykstra. * sha1.c (sha1_get_info): Ditto. * tiger.c (tiger_get_info): Ditto. * md5.c (md5_get_info): Ditto * des.c (des_get_info): Ditto. * blowfish.c (blowfish_get_info): Ditto. * cast5.c (cast5_get_info): Ditto. * twofish.c (twofish_get_info): Ditto. Fri Mar 24 11:25:45 CET 2000 Werner Koch * md.c (md_open): Add hmac arg and allocate space for the pads. (md_finalize): Add HMAC support. (md_copy): Ditto. (md_close): Ditto. (gcry_md_reset): Ditto. (gcry_md_ctl): Ditto. (prepare_macpdas): New. Mon Mar 13 19:22:46 CET 2000 Werner Koch * md.c (gcry_md_hash_buffer): Add support for the other algorithms. Mon Jan 31 16:37:34 CET 2000 Werner Koch * genprime.c (generate_elg_prime): Fixed returned factors which never worked for non-DSA keys. Thu Jan 27 18:00:44 CET 2000 Werner Koch * pubkey.c (sexp_to_key): Fixed mem leaks in case of errors. Mon Jan 24 22:24:38 CET 2000 Werner Koch * pubkey.c (gcry_pk_decrypt): Implemented. (gcry_pk_encrypt): Implemented. (gcry_pk_testkey): New. (gcry_pk_genkey): New. (pubkey_decrypt): Made static. (pubkey_encrypt): Ditto. (pubkey_check_secret_key): Ditto. (pubkey_generate): Ditto. Mon Jan 24 13:04:28 CET 2000 Werner Koch * pubkey.c (pubkey_nbits): Removed and replaced by ... (gcry_pk_get_nbits): this new one. Wed Dec 8 21:58:32 CET 1999 Werner Koch * dsa.c: s/mpi_powm/gcry_mpi_powm/g * elgamal.c: Ditto. * primegen.c: Ditto. * : Replaced g10_opt_verbose by g10_log_verbosity(). * Makefile.am (INCLUDES): removed intl, add ../gcrypt Fri Nov 19 17:15:20 CET 1999 Werner Koch * dynload.c (cmp_filenames): New to replaced compare_filename() in module. (register_cipher_extension): Removed the tilde expansion stuff. * rndeg.c (my_make_filename): New. * : Replaced header util.h by g10lib.h * random.c (gather_faked): Replaced make_timestamp by time(2). Disabled wrning printed with tty_printf. * rndlinux.c (gather_random): Always use fprintf instead of tty_xxx; this should be replaced by a callback function. * primegen.c (gen_prime): Use gcry_mpi_randomize. (is_prime): Ditto. * elgamal.c (test_keys): Ditto. * dsa.c (test_keys): Ditto. * cipher.c (gcry_cipher_close): Die on invalid handle. Mon Nov 15 21:36:02 CET 1999 Werner Koch * elgamal.c (gen_k): Use the new random API. (generate): Ditto. * dsa.c (gen_k): Ditto. (generate): Ditto. Sat Nov 13 17:44:23 CET 1999 Werner Koch * pubkey.c (disable_pubkey_algo): Made static. (gcry_pk_ctl): New. * random.c (get_random_bits): Renamed to ... (get_random_bytes): ... this and made static. (gcry_random_bytes): New. (gcry_random_bytes_secure): New. (randomize_buffer): Renamed to ... (gcry_randomize): ...this. * md.c (gcry_md_hash_buffer): New. * pubkey.c (gcry_pk_algo_info): 4 new commands. (pubkey_get_npkey): Made static. (pubkey_get_nskey): Made static. (pubkey_get_nsig): Made static. (pubkey_get_nenc): Made static. * pubkey.c: Removed all G10ERR_xxx. * cipher.c: Changed all GCRYERR_INV_ALGO to GCRYERR_INV_CIPHER_ALGO. * md.c: Changed all GCRYERR_INV_ALGO to GCRYERR_INV_MD_ALGO. * cast5.c (cast_setkey): Changed errocodes to GCRYERR_xxx. * blowfish.c: Ditto. * des.c: Ditto. * twofish.c: Ditto. * dsa.c: Ditto. * elgamal.c: Ditto. * g10c.c: Removed * cipher.c (gcry_cipher_open): Replaced alloc functions and return NULL if we are out of core. * dynload.c: Replaced all memory allocation functions. * md.c: Ditto. * primegen.c: Ditto. * pubkey.c: Ditto. * random.c: Ditto. * rndw32.c: Ditto. * elgamal.c: Ditto. * dsa.c: Ditto. Tue Oct 26 14:10:21 CEST 1999 Werner Koch * elgamal.c (sign): Hugh found strange code here. Replaced by BUG(). * cipher.c: Merged with gcrypt/symapi.c. * pubkey.c (string_to_pubkey_algo): Renamed function to ... (gcry_pk_map_name): ... this. (pubkey_algo_to_string): Renamed function to ... (gcry_pk_algo_name): ... this. (gcry_pk_algo_info): New. * pubkey.c: Merged with gcrypt/pkapi.c. * md.c (md_reset): Clear finalized; thanks to Ulf Moeller for fixing this bug. * md.c: Merged with gcrypt/mdapi.c Wed Sep 15 14:39:59 CEST 1999 Michael Roth * des.c: Various speed improvements: One bit pre rotation trick after initial permutation (Richard Outerbridge). Finished test of SSLeay Tripple-DES patterns. Wed Sep 15 16:22:17 CEST 1999 Werner Koch * rndw32.c: New. Mon Sep 13 10:51:29 CEST 1999 Werner Koch * bithelp.h: New. * rmd160.h, sha1.h, md5.h: Use the rol macro from bithelp.h Tue Sep 7 16:23:36 CEST 1999 Werner Koch * Makefile.am: Fixed seds for latest egcc. By Ollivier Robert. Mon Sep 6 19:59:08 CEST 1999 Werner Koch * des.c (selftest): Add some testpattern Mon Aug 30 20:38:33 CEST 1999 Werner Koch * cipher.c (do_cbc_encrypt): Fixed serious bug occuring when not using in place encryption. Pointed out by Frank Stajano. Mon Jul 26 09:34:46 CEST 1999 Werner Koch * md5.c (md5_final): Fix for a SCO cpp bug. Thu Jul 15 10:15:35 CEST 1999 Werner Koch * elgamal.c (elg_check_secret_key,elg_encrypt elg_decrypt,elg_sign,elg_verify): Sanity check on the args. * dsa.c (dsa_check_secret_key,dsa_sign,dsa_verify): Ditto. * pubkey.c (disable_pubkey_algo): New. (check_pubkey_algo2): Look at disabled algo table. * cipher.c (disable_cipher_algo): New. (check_cipher_algo): Look at disabled algo table. Wed Jul 7 13:08:40 CEST 1999 Werner Koch * Makefile.am: Support for libtool. Fri Jul 2 11:45:54 CEST 1999 Werner Koch * dsa.c (gen_k): Changed algorithm to consume less random bytes * elgamal.c (gen_k): Ditto. * random.c (random_dump_stats): New. Thu Jul 1 12:47:31 CEST 1999 Werner Koch * primegen.c, elgamal.c, dsa.c (progess): New and replaced all fputc with a call to this function. Sat Jun 26 12:15:59 CEST 1999 Werner Koch * rndegd.c (do_write): s/ssize_t/int/ due to SunOS 4.1 probs. * cipher.c (do_cbc_encrypt, do_cbc_decrypt): New. * dynload.c (HAVE_DL_SHL_LOAD): Map hpux API to dlopen (Dave Dykstra). * Makefile.am (install-exec-hook): Removed. Sun May 23 14:20:22 CEST 1999 Werner Koch * cipher.c (setup_cipher_table): Enable Twofish * random.c (fast_random_poll): Disable use of times() for mingw32. Mon May 17 21:54:43 CEST 1999 Werner Koch * dynload.c (register_internal_cipher_extension): Minor init fix. Tue May 4 15:47:53 CEST 1999 Werner Koch * primegen.c (gen_prime): Readded the Fermat test. Fixed the bug that we didn't correct for step when passing the prime to the Rabin-Miller test which led to bad performance (Stefan Keller). (check_prime): Add a first Fermat test. Sun Apr 18 10:11:28 CEST 1999 Werner Koch * cipher.c (cipher_setiv): Add ivlen arg, changed all callers. * random.c (randomize_buffer): alway use secure memory because we can't use m_is_secure() on a statically allocated buffer. * twofish.c: Replaced some macros by a loop to reduce text size. * Makefile.am (twofish): No more need for sed editing. Fri Apr 9 12:26:25 CEST 1999 Werner Koch * cipher.c (cipher_open): Reversed the changes for AUTO_CFB. * blowfish.c: Dropped the Blowfish 160 mode. * cipher.c (cipher_open): Ditto. (setup_cipher_table): Ditto. And removed support of twofish128 Wed Apr 7 20:51:39 CEST 1999 Werner Koch * random.c (get_random_bits): Can now handle requests > POOLSIZE * cipher.c (cipher_open): Now uses standard CFB for automode if the blocksize is gt 8 (according to rfc2440). * twofish.c: Applied Matthew Skala's patches for 256 bit key. Tue Apr 6 19:58:12 CEST 1999 Werner Koch * random.c (get_random_bits): Can now handle requests > POOLSIZE * cipher.c (cipher_open): Now uses standard CFB for automode if the blocksize is gt 8 (according to rfc2440). Sat Mar 20 11:44:21 CET 1999 Werner Koch * rndlinux.c (tty_printf) [IS_MODULE]: Removed. * rndegd.c (gather_random): Some fixes. Wed Mar 17 13:09:03 CET 1999 Werner Koch * rndegd.c (do_read): New. (gather_random): Changed the implementation. Mon Mar 8 20:47:17 CET 1999 Werner Koch * dynload.c (DLSYM_NEEDS_UNDERSCORE): Renamed. Fri Feb 26 17:55:41 CET 1999 Werner Koch * md.c: Nearly a total rewrote. Wed Feb 24 11:07:27 CET 1999 Werner Koch * cipher.c (context): Fixed alignment * md.c: Ditto. * rndegd.c: New Mon Feb 22 20:04:00 CET 1999 Werner Koch * rndegd.c: New. Wed Feb 10 17:15:39 CET 1999 Werner Koch * Makefile.am: Modules are now figured out by configure * construct.c: New. Generated by configure. Changed all modules to work with that. * sha1.h: Removed. * md5.h: Removed. * twofish.c: Changed interface to allow Twofish/256 * rndunix.c (start_gatherer): Die on SIGPIPE. Wed Jan 20 18:59:49 CET 1999 Werner Koch * rndunix.c (gather_random): Fix to avoid infinite loop. Sun Jan 17 11:04:33 CET 1999 Werner Koch * des.c (is_weak_key): Replace system memcmp due to bugs in SunOS's memcmp. (des_get_info): Return error on failed selftest. * twofish.c (twofish_setkey): Return error on failed selftest or invalid keylength. * cast5.c (cast_setkey): Ditto. * blowfish.c (bf_setkey): Return error on failed selftest. Tue Jan 12 11:17:18 CET 1999 Werner Koch * random.c (random_is_faked): New. * tiger.c: Only compile if we have the u64 type Sat Jan 9 16:02:23 CET 1999 Werner Koch * rndunix.c (gather_random): check for setuid. * Makefile.am: Add a way to staically link random modules Thu Jan 7 18:00:58 CET 1999 Werner Koch * md.c (md_stop_debug): Do a flush first. (md_open): size of buffer now depends on the secure parameter Sun Jan 3 15:28:44 CET 1999 Werner Koch * rndunix.c (start_gatherer): Fixed stupid ==/= bug 1998-12-31 Geoff Keating * des.c (is_weak_key): Rewrite loop end condition. Tue Dec 29 14:41:47 CET 1998 Werner Koch * random.c: add unistd.h for getpid(). (RAND_MAX): Fallback value for Sun. Wed Dec 23 17:12:24 CET 1998 Werner Koch * md.c (md_copy): Reset debug. Mon Dec 14 21:18:49 CET 1998 Werner Koch * random.c (read_random_source): Changed the interface to the random gathering function. (gather_faked): Use new interface. * dynload.c (dynload_getfnc_fast_random_poll): Ditto. (dynload_getfnc_gather_random): Ditto. * rndlinux.c (gather_random): Ditto. * rndunix.c (gather_random): Ditto. Sat Dec 12 18:40:32 CET 1998 Werner Koch * dynload.c (SYMBOL_VERSION): New to cope with system which needs underscores. * rndunix.c: Rewrote large parts Thu Dec 10 20:15:36 CET 1998 Werner Koch * dynload.c (load_extension): increased needed verbosity level. * random.c (fast_random_poll): Fallback to a default fast random poll function. (read_random_source): Always use the faked entroy gatherer if no gather module is available. * rndlinux.c (fast_poll): Removed. * rndunix.c (fast_poll): Removed. Wed Nov 25 12:33:41 1998 Werner Koch (wk@isil.d.shuttle.de) * rand-*.c: Removed. * rndlinux.c : New. * rndunix.c : New. * random.c : Restructured the interface to the gather modules. (intialize): Call constructor functions (read_radnom_source): Moved to here. * dynload.c (dynload_getfnc_gather_random): New. (dynload_getfnc_fast_random_poll): New. (register_internal_cipher_extension): New. (register_cipher_extension): Support of internal modules. Sun Nov 8 17:44:36 1998 Werner Koch (wk@isil.d.shuttle.de) * rand-unix.c (read_random_source): Removed the assert. Mon Oct 19 18:34:30 1998 me,,, (wk@tobold) * pubkey.c: Hack to allow us to give some info about RSA keys back. Thu Oct 15 11:47:57 1998 Werner Koch (wk@isil.d.shuttle.de) * dynload.c: Support for DLD Wed Oct 14 12:13:07 1998 Werner Koch (wk@isil.d.shuttle.de) * rand-unix.c: Now uses names from configure for /dev/random. 1998-10-10 SL Baur * Makefile.am: fix sed -O substitutions to catch -O6, etc. Tue Oct 6 10:06:32 1998 Werner Koch (wk@isil.d.shuttle.de) * rand-unix.c (HAVE_GETTIMEOFDAY): Fixed (was ..GETTIMEOFTIME :-) * rand-dummy.c (HAVE_GETTIMEOFDAY): Ditto. Mon Sep 28 13:23:09 1998 Werner Koch (wk@isil.d.shuttle.de) * md.c (md_digest): New. (md_reset): New. Wed Sep 23 12:27:02 1998 Werner Koch (wk@isil.d.shuttle.de) * tiger.c (TIGER_CONTEXT): moved "buf", so that it is 64 bit aligned. Mon Sep 21 06:22:53 1998 Werner Koch (wk@(none)) * des.c: Some patches from Michael. Thu Sep 17 19:00:06 1998 Werner Koch (wk@(none)) * des.c : New file from Michael Roth Mon Sep 14 11:10:55 1998 Werner Koch (wk@(none)) * blowfish.c (bf_setkey): Niklas Hernaeus patch to detect weak keys. Mon Sep 14 09:19:25 1998 Werner Koch (wk@(none)) * dynload.c (RTLD_NOW): Now defined to 1 if it is undefined. Mon Sep 7 17:04:33 1998 Werner Koch (wk@(none)) * Makefile.am: Fixes to allow a different build directory Thu Aug 6 17:25:38 1998 Werner Koch,mobil,,, (wk@tobold) * random.c (get_random_byte): Removed and changed all callers to use get_random_bits() Mon Jul 27 10:30:22 1998 Werner Koch (wk@(none)) * cipher.c : Support for other blocksizes (cipher_get_blocksize): New. * twofish.c: New. * Makefile.am: Add twofish module. Mon Jul 13 21:30:52 1998 Werner Koch (wk@isil.d.shuttle.de) * random.c (read_pool): Simple alloc if secure_alloc is not set. (get_random_bits): Ditto. Thu Jul 9 13:01:14 1998 Werner Koch (wk@isil.d.shuttle.de) * dynload.c (load_extension): Function now nbails out if the program is run setuid. Wed Jul 8 18:58:23 1998 Werner Koch (wk@isil.d.shuttle.de) * rmd160.c (rmd160_hash_buffer): New. Thu Jul 2 10:50:30 1998 Werner Koch (wk@isil.d.shuttle.de) * cipher.c (cipher_open): algos >=100 use standard CFB Thu Jun 25 11:18:25 1998 Werner Koch (wk@isil.d.shuttle.de) * Makefile.am: Support for extensions Thu Jun 18 12:09:38 1998 Werner Koch (wk@isil.d.shuttle.de) * random.c (mix_pool): simpler handling for level 0 Mon Jun 15 14:40:48 1998 Werner Koch (wk@isil.d.shuttle.de) * tiger.c: Removed from dist, will reappear as dynload module Sat Jun 13 14:16:57 1998 Werner Koch (wk@isil.d.shuttle.de) * pubkey.c: Major changes to allow extensions. Changed the inteface of all public key ciphers and added the ability to load extensions on demand. * misc.c: Removed. Wed Jun 10 07:52:08 1998 Werner Koch,mobil,,, (wk@tobold) * dynload.c: New. * cipher.c: Major changes to allow extensions. Mon Jun 8 22:43:00 1998 Werner Koch (wk@isil.d.shuttle.de) * cipher.c: Major internal chnages to support extensions. * blowfish.c (blowfish_get_info): New and made all internal functions static, changed heder. * cast5.c (cast5_get_info): Likewise. Mon Jun 8 12:27:52 1998 Werner Koch (wk@isil.d.shuttle.de) * tiger.c (transform): Fix for big endian * cipher.c (do_cfb_decrypt): Big endian fix. Fri May 22 07:30:39 1998 Werner Koch (wk@isil.d.shuttle.de) * md.c (md_get_oid): Add a new one for TIGER. Thu May 21 13:24:52 1998 Werner Koch (wk@isil.d.shuttle.de) * cipher.c: Add support for a dummy cipher Thu May 14 15:40:36 1998 Werner Koch (wk@isil.d.shuttle.de) * rmd160.c (transform): fixed sigbus - I should better add Christian von Roques's new implemenation of rmd160_write. Fri May 8 18:07:44 1998 Werner Koch (wk@isil.d.shuttle.de) * rand-internal.h, rand-unix.c, rand-w32.c, rand_dummy.c: New * random.c: Moved system specific functions to rand-****.c Fri May 8 14:01:17 1998 Werner Koch (wk@isil.d.shuttle.de) * random.c (fast_random_poll): add call to gethrtime. Tue May 5 21:28:55 1998 Werner Koch (wk@isil.d.shuttle.de) * elgamal.c (elg_generate): choosing x was not correct, could yield 6 bytes which are not from the random pool, tsss, tsss.. Tue May 5 14:09:06 1998 Werner Koch (wk@isil.d.shuttle.de) * primegen.c (generate_elg_prime): Add arg mode, changed all callers and implemented mode 1. Mon Apr 27 14:41:58 1998 Werner Koch (wk@isil.d.shuttle.de) * cipher.c (cipher_get_keylen): New. Sun Apr 26 14:44:52 1998 Werner Koch (wk@isil.d.shuttle.de) * tiger.c, tiger.h: New. Wed Apr 8 14:57:11 1998 Werner Koch (wk@isil.d.shuttle.de) * misc.c (check_pubkey_algo2): New. Tue Apr 7 18:46:49 1998 Werner Koch (wk@isil.d.shuttle.de) * cipher.c: New * misc.c (check_cipher_algo): Moved to cipher.c * cast5.c: Moved many functions to cipher.c * blowfish.c: Likewise. Sat Apr 4 19:52:08 1998 Werner Koch (wk@isil.d.shuttle.de) * cast5.c: Implemented and tested. Wed Apr 1 16:38:27 1998 Werner Koch (wk@isil.d.shuttle.de) * elgamal.c (elg_generate): Faster generation of x in some cases. Thu Mar 19 13:54:48 1998 Werner Koch (wk@isil.d.shuttle.de) * blowfish.c (blowfish_decode_cfb): changed XOR operation (blowfish_encode_cfb): Ditto. Thu Mar 12 14:04:05 1998 Werner Koch (wk@isil.d.shuttle.de) * sha1.c (transform): Rewrote * blowfish.c (encrypt): Unrolled for rounds == 16 (decrypt): Ditto. Tue Mar 10 16:32:08 1998 Werner Koch (wk@isil.d.shuttle.de) * rmd160.c (transform): Unrolled the loop. Tue Mar 10 13:05:14 1998 Werner Koch (wk@isil.d.shuttle.de) * random.c (read_pool): Add pool_balance stuff. (get_random_bits): New. * elgamal.c (elg_generate): Now uses get_random_bits to generate x. Tue Mar 10 11:33:51 1998 Werner Koch (wk@isil.d.shuttle.de) * md.c (md_digest_length): New. Tue Mar 10 11:27:41 1998 Werner Koch (wk@isil.d.shuttle.de) * dsa.c (dsa_verify): Works. Mon Mar 9 12:59:08 1998 Werner Koch (wk@isil.d.shuttle.de) * dsa.c, dsa.h: Removed some unused code. Wed Mar 4 10:39:22 1998 Werner Koch (wk@isil.d.shuttle.de) * md.c (md_open): Add call to fast_random_poll. blowfish.c (blowfish_setkey): Ditto. Tue Mar 3 13:32:54 1998 Werner Koch (wk@isil.d.shuttle.de) * rmd160.c (rmd160_mixblock): New. * random.c: Restructured to start with a new RNG implementation. * random.h: New. Mon Mar 2 19:21:46 1998 Werner Koch (wk@isil.d.shuttle.de) * gost.c, gost.h: Removed because they did only contain trash. Sun Mar 1 16:42:29 1998 Werner Koch (wk@isil.d.shuttle.de) * random.c (fill_buffer): removed error message if n == -1. Fri Feb 27 16:39:34 1998 Werner Koch (wk@isil.d.shuttle.de) * md.c (md_enable): No init if called twice. Thu Feb 26 07:57:02 1998 Werner Koch (wk@isil.d.shuttle.de) * primegen.c (generate_elg_prime): Changed the progress printing. (gen_prime): Ditto. Tue Feb 24 12:28:42 1998 Werner Koch (wk@isil.d.shuttle.de) * md5.c, md.5 : Replaced by a modified version of md5.c from GNU textutils 1.22. Wed Feb 18 14:08:30 1998 Werner Koch (wk@isil.d.shuttle.de) * md.c, md.h : New debugging support Mon Feb 16 10:08:47 1998 Werner Koch (wk@isil.d.shuttle.de) * misc.c (cipher_algo_to_string): New (pubkey_algo_to_string): New. (digest_algo_to_string): New. Copyright 1998,1999,2000,2001,2002,2003,2004,2005,2006 2007, 2008 Free Software Foundation, Inc. This file is free software; as a special exception the author gives unlimited permission to copy and/or distribute it, with or without modifications, as long as this notice is preserved. This file is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY, to the extent permitted by law; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. diff --git a/cipher/md.c b/cipher/md.c index ce128bb7..d6890873 100644 --- a/cipher/md.c +++ b/cipher/md.c @@ -1,1340 +1,1371 @@ /* md.c - message digest dispatcher * Copyright (C) 1998, 1999, 2002, 2003, 2006, * 2008 Free Software Foundation, Inc. * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser general Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ #include #include #include #include #include #include "g10lib.h" #include "cipher.h" #include "ath.h" #include "rmd.h" /* A dummy extraspec so that we do not need to tests the extraspec field from the module specification against NULL and instead directly test the respective fields of extraspecs. */ static md_extra_spec_t dummy_extra_spec; /* This is the list of the digest implementations included in libgcrypt. */ static struct digest_table_entry { gcry_md_spec_t *digest; md_extra_spec_t *extraspec; unsigned int algorithm; - int fips_allowed; + int fips_allowed; } digest_table[] = { #if USE_CRC /* We allow the CRC algorithms even in FIPS mode because they are actually no cryptographic primitives. */ { &_gcry_digest_spec_crc32, &dummy_extra_spec, GCRY_MD_CRC32, 1 }, { &_gcry_digest_spec_crc32_rfc1510, &dummy_extra_spec, GCRY_MD_CRC32_RFC1510, 1 }, { &_gcry_digest_spec_crc24_rfc2440, &dummy_extra_spec, GCRY_MD_CRC24_RFC2440, 1 }, #endif #if USE_MD4 { &_gcry_digest_spec_md4, &dummy_extra_spec, GCRY_MD_MD4 }, #endif #if USE_MD5 { &_gcry_digest_spec_md5, - &dummy_extra_spec, GCRY_MD_MD5 }, + &dummy_extra_spec, GCRY_MD_MD5, 1 }, #endif #if USE_RMD160 { &_gcry_digest_spec_rmd160, &dummy_extra_spec, GCRY_MD_RMD160 }, #endif #if USE_SHA1 { &_gcry_digest_spec_sha1, &_gcry_digest_extraspec_sha1, GCRY_MD_SHA1, 1 }, #endif #if USE_SHA256 { &_gcry_digest_spec_sha256, &_gcry_digest_extraspec_sha256, GCRY_MD_SHA256, 1 }, { &_gcry_digest_spec_sha224, &_gcry_digest_extraspec_sha224, GCRY_MD_SHA224, 1 }, #endif #if USE_SHA512 { &_gcry_digest_spec_sha512, &_gcry_digest_extraspec_sha512, GCRY_MD_SHA512, 1 }, { &_gcry_digest_spec_sha384, &_gcry_digest_extraspec_sha384, GCRY_MD_SHA384, 1 }, #endif #if USE_TIGER { &_gcry_digest_spec_tiger, &dummy_extra_spec, GCRY_MD_TIGER }, #endif #if USE_WHIRLPOOL { &_gcry_digest_spec_whirlpool, &dummy_extra_spec, GCRY_MD_WHIRLPOOL }, #endif { NULL }, }; /* List of registered digests. */ static gcry_module_t digests_registered; /* This is the lock protecting DIGESTS_REGISTERED. */ static ath_mutex_t digests_registered_lock = ATH_MUTEX_INITIALIZER; /* Flag to check wether the default ciphers have already been registered. */ static int default_digests_registered; typedef struct gcry_md_list { gcry_md_spec_t *digest; gcry_module_t module; struct gcry_md_list *next; size_t actual_struct_size; /* Allocated size of this structure. */ PROPERLY_ALIGNED_TYPE context; } GcryDigestEntry; /* this structure is put right after the gcry_md_hd_t buffer, so that * only one memory block is needed. */ struct gcry_md_context { int magic; size_t actual_handle_size; /* Allocated size of this handle. */ int secure; FILE *debug; int finalized; GcryDigestEntry *list; byte *macpads; int macpads_Bsize; /* Blocksize as used for the HMAC pads. */ }; #define CTX_MAGIC_NORMAL 0x11071961 #define CTX_MAGIC_SECURE 0x16917011 /* Convenient macro for registering the default digests. */ #define REGISTER_DEFAULT_DIGESTS \ do \ { \ ath_mutex_lock (&digests_registered_lock); \ if (! default_digests_registered) \ { \ md_register_default (); \ default_digests_registered = 1; \ } \ ath_mutex_unlock (&digests_registered_lock); \ } \ while (0) static const char * digest_algo_to_string( int algo ); static gcry_err_code_t check_digest_algo (int algo); static gcry_err_code_t md_open (gcry_md_hd_t *h, int algo, int secure, int hmac); static gcry_err_code_t md_enable (gcry_md_hd_t hd, int algo); static gcry_err_code_t md_copy (gcry_md_hd_t a, gcry_md_hd_t *b); static void md_close (gcry_md_hd_t a); static void md_write (gcry_md_hd_t a, const void *inbuf, size_t inlen); static void md_final(gcry_md_hd_t a); static byte *md_read( gcry_md_hd_t a, int algo ); static int md_get_algo( gcry_md_hd_t a ); static int md_digest_length( int algo ); static const byte *md_asn_oid( int algo, size_t *asnlen, size_t *mdlen ); static void md_start_debug ( gcry_md_hd_t a, const char *suffix ); static void md_stop_debug ( gcry_md_hd_t a ); /* Internal function. Register all the ciphers included in CIPHER_TABLE. Returns zero on success or an error code. */ static void md_register_default (void) { gcry_err_code_t err = 0; int i; for (i = 0; !err && digest_table[i].digest; i++) { - if ( fips_mode () && !digest_table[i].fips_allowed ) - continue; + if ( fips_mode ()) + { + if (!digest_table[i].fips_allowed) + continue; + if (digest_table[i].algorithm == GCRY_MD_MD5 + && _gcry_enforced_fips_mode () ) + continue; /* Do not register in enforced fips mode. */ + } err = _gcry_module_add (&digests_registered, digest_table[i].algorithm, (void *) digest_table[i].digest, (void *) digest_table[i].extraspec, NULL); } if (err) BUG (); } /* Internal callback function. */ static int gcry_md_lookup_func_name (void *spec, void *data) { gcry_md_spec_t *digest = (gcry_md_spec_t *) spec; char *name = (char *) data; return (! stricmp (digest->name, name)); } /* Internal callback function. Used via _gcry_module_lookup. */ static int gcry_md_lookup_func_oid (void *spec, void *data) { gcry_md_spec_t *digest = (gcry_md_spec_t *) spec; char *oid = (char *) data; gcry_md_oid_spec_t *oid_specs = digest->oids; int ret = 0, i; if (oid_specs) { for (i = 0; oid_specs[i].oidstring && (! ret); i++) if (! stricmp (oid, oid_specs[i].oidstring)) ret = 1; } return ret; } /* Internal function. Lookup a digest entry by it's name. */ static gcry_module_t gcry_md_lookup_name (const char *name) { gcry_module_t digest; digest = _gcry_module_lookup (digests_registered, (void *) name, gcry_md_lookup_func_name); return digest; } /* Internal function. Lookup a cipher entry by it's oid. */ static gcry_module_t gcry_md_lookup_oid (const char *oid) { gcry_module_t digest; digest = _gcry_module_lookup (digests_registered, (void *) oid, gcry_md_lookup_func_oid); return digest; } /* Register a new digest module whose specification can be found in DIGEST. On success, a new algorithm ID is stored in ALGORITHM_ID and a pointer representhing this module is stored in MODULE. */ gcry_error_t _gcry_md_register (gcry_md_spec_t *digest, md_extra_spec_t *extraspec, unsigned int *algorithm_id, gcry_module_t *module) { gcry_err_code_t err = 0; gcry_module_t mod; /* We do not support module loading in fips mode. */ if (fips_mode ()) return gpg_error (GPG_ERR_NOT_SUPPORTED); ath_mutex_lock (&digests_registered_lock); err = _gcry_module_add (&digests_registered, 0, (void *) digest, (void *)(extraspec? extraspec : &dummy_extra_spec), &mod); ath_mutex_unlock (&digests_registered_lock); if (! err) { *module = mod; *algorithm_id = mod->mod_id; } return gcry_error (err); } /* Unregister the digest identified by ID, which must have been registered with gcry_digest_register. */ void gcry_md_unregister (gcry_module_t module) { ath_mutex_lock (&digests_registered_lock); _gcry_module_release (module); ath_mutex_unlock (&digests_registered_lock); } static int search_oid (const char *oid, int *algorithm, gcry_md_oid_spec_t *oid_spec) { gcry_module_t module; int ret = 0; if (oid && ((! strncmp (oid, "oid.", 4)) || (! strncmp (oid, "OID.", 4)))) oid += 4; module = gcry_md_lookup_oid (oid); if (module) { gcry_md_spec_t *digest = module->spec; int i; for (i = 0; digest->oids[i].oidstring && !ret; i++) if (! stricmp (oid, digest->oids[i].oidstring)) { if (algorithm) *algorithm = module->mod_id; if (oid_spec) *oid_spec = digest->oids[i]; ret = 1; } _gcry_module_release (module); } return ret; } /**************** * Map a string to the digest algo */ int gcry_md_map_name (const char *string) { gcry_module_t digest; int ret, algorithm = 0; if (! string) return 0; REGISTER_DEFAULT_DIGESTS; /* If the string starts with a digit (optionally prefixed with either "OID." or "oid."), we first look into our table of ASN.1 object identifiers to figure out the algorithm */ ath_mutex_lock (&digests_registered_lock); ret = search_oid (string, &algorithm, NULL); if (! ret) { /* Not found, search a matching digest name. */ digest = gcry_md_lookup_name (string); if (digest) { algorithm = digest->mod_id; _gcry_module_release (digest); } } ath_mutex_unlock (&digests_registered_lock); return algorithm; } /**************** * Map a digest algo to a string */ static const char * digest_algo_to_string (int algorithm) { const char *name = NULL; gcry_module_t digest; REGISTER_DEFAULT_DIGESTS; ath_mutex_lock (&digests_registered_lock); digest = _gcry_module_lookup_id (digests_registered, algorithm); if (digest) { name = ((gcry_md_spec_t *) digest->spec)->name; _gcry_module_release (digest); } ath_mutex_unlock (&digests_registered_lock); return name; } /**************** * This function simply returns the name of the algorithm or some constant * string when there is no algo. It will never return NULL. * Use the macro gcry_md_test_algo() to check whether the algorithm * is valid. */ const char * gcry_md_algo_name (int algorithm) { const char *s = digest_algo_to_string (algorithm); return s ? s : "?"; } static gcry_err_code_t check_digest_algo (int algorithm) { gcry_err_code_t rc = 0; gcry_module_t digest; REGISTER_DEFAULT_DIGESTS; ath_mutex_lock (&digests_registered_lock); digest = _gcry_module_lookup_id (digests_registered, algorithm); if (digest) _gcry_module_release (digest); else rc = GPG_ERR_DIGEST_ALGO; ath_mutex_unlock (&digests_registered_lock); return rc; } /**************** * Open a message digest handle for use with algorithm ALGO. * More algorithms may be added by md_enable(). The initial algorithm * may be 0. */ static gcry_err_code_t md_open (gcry_md_hd_t *h, int algo, int secure, int hmac) { gcry_err_code_t err = GPG_ERR_NO_ERROR; int bufsize = secure ? 512 : 1024; struct gcry_md_context *ctx; gcry_md_hd_t hd; size_t n; /* Allocate a memory area to hold the caller visible buffer with it's * control information and the data required by this module. Set the * context pointer at the beginning to this area. * We have to use this strange scheme because we want to hide the * internal data but have a variable sized buffer. * * +---+------+---........------+-------------+ * !ctx! bctl ! buffer ! private ! * +---+------+---........------+-------------+ * ! ^ * !---------------------------! * * We have to make sure that private is well aligned. */ n = sizeof (struct gcry_md_handle) + bufsize; n = ((n + sizeof (PROPERLY_ALIGNED_TYPE) - 1) / sizeof (PROPERLY_ALIGNED_TYPE)) * sizeof (PROPERLY_ALIGNED_TYPE); /* Allocate and set the Context pointer to the private data */ if (secure) hd = gcry_malloc_secure (n + sizeof (struct gcry_md_context)); else hd = gcry_malloc (n + sizeof (struct gcry_md_context)); if (! hd) err = gpg_err_code_from_errno (errno); if (! err) { hd->ctx = ctx = (struct gcry_md_context *) ((char *) hd + n); /* Setup the globally visible data (bctl in the diagram).*/ hd->bufsize = n - sizeof (struct gcry_md_handle) + 1; hd->bufpos = 0; /* Initialize the private data. */ memset (hd->ctx, 0, sizeof *hd->ctx); ctx->magic = secure ? CTX_MAGIC_SECURE : CTX_MAGIC_NORMAL; ctx->actual_handle_size = n + sizeof (struct gcry_md_context); ctx->secure = secure; if (hmac) { if ( (GCRY_MD_SHA384 == algo) || (GCRY_MD_SHA512 == algo) ) { ctx->macpads_Bsize = 128; ctx->macpads = gcry_malloc_secure (2*(ctx->macpads_Bsize)); } else { ctx->macpads_Bsize = 64; ctx->macpads = gcry_malloc_secure (2*(ctx->macpads_Bsize)); } if (! ctx->macpads) { err = gpg_err_code_from_errno (errno); md_close (hd); } } } if (! err) { /* Hmmm, should we really do that? - yes [-wk] */ _gcry_fast_random_poll (); if (algo) { err = md_enable (hd, algo); if (err) md_close (hd); } } if (! err) *h = hd; return err; } /* Create a message digest object for algorithm ALGO. FLAGS may be given as an bitwise OR of the gcry_md_flags values. ALGO may be given as 0 if the algorithms to be used are later set using gcry_md_enable. H is guaranteed to be a valid handle or NULL on error. */ gcry_error_t gcry_md_open (gcry_md_hd_t *h, int algo, unsigned int flags) { gcry_err_code_t err = GPG_ERR_NO_ERROR; gcry_md_hd_t hd; if ((flags & ~(GCRY_MD_FLAG_SECURE | GCRY_MD_FLAG_HMAC))) err = GPG_ERR_INV_ARG; else { err = md_open (&hd, algo, (flags & GCRY_MD_FLAG_SECURE), (flags & GCRY_MD_FLAG_HMAC)); } *h = err? NULL : hd; return gcry_error (err); } static gcry_err_code_t md_enable (gcry_md_hd_t hd, int algorithm) { struct gcry_md_context *h = hd->ctx; gcry_md_spec_t *digest = NULL; GcryDigestEntry *entry; gcry_module_t module; gcry_err_code_t err = 0; for (entry = h->list; entry; entry = entry->next) if (entry->module->mod_id == algorithm) return err; /* already enabled */ REGISTER_DEFAULT_DIGESTS; ath_mutex_lock (&digests_registered_lock); module = _gcry_module_lookup_id (digests_registered, algorithm); ath_mutex_unlock (&digests_registered_lock); if (! module) { log_debug ("md_enable: algorithm %d not available\n", algorithm); err = GPG_ERR_DIGEST_ALGO; } - else + else digest = (gcry_md_spec_t *) module->spec; - if (! err) + + if (!err && algorithm == GCRY_MD_MD5 && fips_mode ()) + { + _gcry_inactivate_fips_mode ("MD5 used"); + if (_gcry_enforced_fips_mode () ) + { + /* We should never get to here because we do not register + MD5 in enforced fips mode. But better throw an error. */ + err = GPG_ERR_DIGEST_ALGO; + } + } + + if (!err) { size_t size = (sizeof (*entry) + digest->contextsize - sizeof (entry->context)); /* And allocate a new list entry. */ if (h->secure) entry = gcry_malloc_secure (size); else entry = gcry_malloc (size); if (! entry) err = gpg_err_code_from_errno (errno); else { entry->digest = digest; entry->module = module; entry->next = h->list; entry->actual_struct_size = size; h->list = entry; /* And init this instance. */ entry->digest->init (&entry->context.c); } } if (err) { if (module) { ath_mutex_lock (&digests_registered_lock); _gcry_module_release (module); ath_mutex_unlock (&digests_registered_lock); } } return err; } gcry_error_t gcry_md_enable (gcry_md_hd_t hd, int algorithm) { return gcry_error (md_enable (hd, algorithm)); } static gcry_err_code_t md_copy (gcry_md_hd_t ahd, gcry_md_hd_t *b_hd) { gcry_err_code_t err = GPG_ERR_NO_ERROR; struct gcry_md_context *a = ahd->ctx; struct gcry_md_context *b; GcryDigestEntry *ar, *br; gcry_md_hd_t bhd; size_t n; if (ahd->bufpos) md_write (ahd, NULL, 0); n = (char *) ahd->ctx - (char *) ahd; if (a->secure) bhd = gcry_malloc_secure (n + sizeof (struct gcry_md_context)); else bhd = gcry_malloc (n + sizeof (struct gcry_md_context)); if (! bhd) err = gpg_err_code_from_errno (errno); if (! err) { bhd->ctx = b = (struct gcry_md_context *) ((char *) bhd + n); /* No need to copy the buffer due to the write above. */ gcry_assert (ahd->bufsize == (n - sizeof (struct gcry_md_handle) + 1)); bhd->bufsize = ahd->bufsize; bhd->bufpos = 0; gcry_assert (! ahd->bufpos); memcpy (b, a, sizeof *a); b->list = NULL; b->debug = NULL; if (a->macpads) { b->macpads = gcry_malloc_secure (2*(a->macpads_Bsize)); if (! b->macpads) { err = gpg_err_code_from_errno (errno); md_close (bhd); } else memcpy (b->macpads, a->macpads, (2*(a->macpads_Bsize))); } } /* Copy the complete list of algorithms. The copied list is reversed, but that doesn't matter. */ if (!err) { for (ar = a->list; ar; ar = ar->next) { if (a->secure) br = gcry_malloc_secure (sizeof *br + ar->digest->contextsize - sizeof(ar->context)); else br = gcry_malloc (sizeof *br + ar->digest->contextsize - sizeof (ar->context)); if (!br) { err = gpg_err_code_from_errno (errno); md_close (bhd); break; } memcpy (br, ar, (sizeof (*br) + ar->digest->contextsize - sizeof (ar->context))); br->next = b->list; b->list = br; /* Add a reference to the module. */ ath_mutex_lock (&digests_registered_lock); _gcry_module_use (br->module); ath_mutex_unlock (&digests_registered_lock); } } if (a->debug && !err) md_start_debug (bhd, "unknown"); if (!err) *b_hd = bhd; return err; } gcry_error_t gcry_md_copy (gcry_md_hd_t *handle, gcry_md_hd_t hd) { gcry_err_code_t err; err = md_copy (hd, handle); if (err) *handle = NULL; return gcry_error (err); } /* * Reset all contexts and discard any buffered stuff. This may be used * instead of a md_close(); md_open(). */ void gcry_md_reset (gcry_md_hd_t a) { GcryDigestEntry *r; /* Note: We allow this even in fips non operational mode. */ a->bufpos = a->ctx->finalized = 0; for (r = a->ctx->list; r; r = r->next) { memset (r->context.c, 0, r->digest->contextsize); (*r->digest->init) (&r->context.c); } if (a->ctx->macpads) md_write (a, a->ctx->macpads, a->ctx->macpads_Bsize); /* inner pad */ } static void md_close (gcry_md_hd_t a) { GcryDigestEntry *r, *r2; if (! a) return; if (a->ctx->debug) md_stop_debug (a); for (r = a->ctx->list; r; r = r2) { r2 = r->next; ath_mutex_lock (&digests_registered_lock); _gcry_module_release (r->module); ath_mutex_unlock (&digests_registered_lock); wipememory (r, r->actual_struct_size); gcry_free (r); } if (a->ctx->macpads) { wipememory (a->ctx->macpads, 2*(a->ctx->macpads_Bsize)); gcry_free(a->ctx->macpads); } wipememory (a, a->ctx->actual_handle_size); gcry_free(a); } void gcry_md_close (gcry_md_hd_t hd) { /* Note: We allow this even in fips non operational mode. */ md_close (hd); } static void md_write (gcry_md_hd_t a, const void *inbuf, size_t inlen) { GcryDigestEntry *r; if (a->ctx->debug) { if (a->bufpos && fwrite (a->buf, a->bufpos, 1, a->ctx->debug) != 1) BUG(); if (inlen && fwrite (inbuf, inlen, 1, a->ctx->debug) != 1) BUG(); } for (r = a->ctx->list; r; r = r->next) { if (a->bufpos) (*r->digest->write) (&r->context.c, a->buf, a->bufpos); (*r->digest->write) (&r->context.c, inbuf, inlen); } a->bufpos = 0; } void gcry_md_write (gcry_md_hd_t hd, const void *inbuf, size_t inlen) { md_write (hd, inbuf, inlen); } static void md_final (gcry_md_hd_t a) { GcryDigestEntry *r; if (a->ctx->finalized) return; if (a->bufpos) md_write (a, NULL, 0); for (r = a->ctx->list; r; r = r->next) (*r->digest->final) (&r->context.c); a->ctx->finalized = 1; if (a->ctx->macpads) { /* Finish the hmac. */ int algo = md_get_algo (a); byte *p = md_read (a, algo); size_t dlen = md_digest_length (algo); gcry_md_hd_t om; gcry_err_code_t err = md_open (&om, algo, a->ctx->secure, 0); if (err) _gcry_fatal_error (err, NULL); md_write (om, (a->ctx->macpads)+(a->ctx->macpads_Bsize), a->ctx->macpads_Bsize); md_write (om, p, dlen); md_final (om); /* Replace our digest with the mac (they have the same size). */ memcpy (p, md_read (om, algo), dlen); md_close (om); } } static gcry_err_code_t prepare_macpads( gcry_md_hd_t hd, const byte *key, size_t keylen) { int i; int algo = md_get_algo( hd ); byte *helpkey = NULL; byte *ipad, *opad; if ( !algo ) return GPG_ERR_DIGEST_ALGO; /* i.e. no algo enabled */ if ( keylen > 64 ) { helpkey = gcry_malloc_secure ( md_digest_length( algo ) ); if ( !helpkey ) return gpg_err_code_from_errno (errno); gcry_md_hash_buffer ( algo, helpkey, key, keylen ); key = helpkey; keylen = md_digest_length( algo ); gcry_assert ( keylen <= 64 ); } memset ( hd->ctx->macpads, 0, 2*(hd->ctx->macpads_Bsize) ); ipad = hd->ctx->macpads; opad = (hd->ctx->macpads)+(hd->ctx->macpads_Bsize); memcpy ( ipad, key, keylen ); memcpy ( opad, key, keylen ); for (i=0; i < (hd->ctx->macpads_Bsize); i++ ) { ipad[i] ^= 0x36; opad[i] ^= 0x5c; } gcry_free( helpkey ); return GPG_ERR_NO_ERROR; } gcry_error_t gcry_md_ctl (gcry_md_hd_t hd, int cmd, void *buffer, size_t buflen) { gcry_err_code_t rc = 0; switch (cmd) { case GCRYCTL_FINALIZE: md_final (hd); break; case GCRYCTL_SET_KEY: rc = gcry_err_code (gcry_md_setkey (hd, buffer, buflen)); break; case GCRYCTL_START_DUMP: md_start_debug (hd, buffer); break; case GCRYCTL_STOP_DUMP: md_stop_debug ( hd ); break; default: rc = GPG_ERR_INV_OP; } return gcry_error (rc); } gcry_error_t gcry_md_setkey (gcry_md_hd_t hd, const void *key, size_t keylen) { gcry_err_code_t rc = GPG_ERR_NO_ERROR; if (!hd->ctx->macpads) rc = GPG_ERR_CONFLICT; else { rc = prepare_macpads (hd, key, keylen); if (! rc) gcry_md_reset (hd); } return gcry_error (rc); } /* The new debug interface. If SUFFIX is a string it creates an debug file for the context HD. IF suffix is NULL, the file is closed and debugging is stopped. */ void gcry_md_debug (gcry_md_hd_t hd, const char *suffix) { if (suffix) md_start_debug (hd, suffix); else md_stop_debug (hd); } /**************** * if ALGO is null get the digest for the used algo (which should be only one) */ static byte * md_read( gcry_md_hd_t a, int algo ) { GcryDigestEntry *r = a->ctx->list; if (! algo) { /* return the first algorithm */ if (r && r->next) log_debug ("more than one algorithm in md_read(0)\n"); return r->digest->read( &r->context.c ); } else { for (r = a->ctx->list; r; r = r->next) if (r->module->mod_id == algo) return r->digest->read (&r->context.c); } BUG(); return NULL; } /* * Read out the complete digest, this function implictly finalizes * the hash. */ byte * gcry_md_read (gcry_md_hd_t hd, int algo) { /* This function is expected to always return a digest, thus we can't return an error which we actually should do in non-operational state. */ gcry_md_ctl (hd, GCRYCTL_FINALIZE, NULL, 0); return md_read (hd, algo); } /* * Read out an intermediate digest. Not yet functional. */ gcry_err_code_t gcry_md_get (gcry_md_hd_t hd, int algo, byte *buffer, int buflen) { (void)hd; (void)algo; (void)buffer; (void)buflen; /*md_digest ... */ fips_signal_error ("unimplemented function called"); return GPG_ERR_INTERNAL; } /* * Shortcut function to hash a buffer with a given algo. The only * guaranteed supported algorithms are RIPE-MD160 and SHA-1. The * supplied digest buffer must be large enough to store the resulting * hash. No error is returned, the function will abort on an invalid * algo. DISABLED_ALGOS are ignored here. */ void gcry_md_hash_buffer (int algo, void *digest, const void *buffer, size_t length) { if (algo == GCRY_MD_SHA1) _gcry_sha1_hash_buffer (digest, buffer, length); else if (algo == GCRY_MD_RMD160 && !fips_mode () ) _gcry_rmd160_hash_buffer (digest, buffer, length); else { /* For the others we do not have a fast function, so we use the normal functions. */ gcry_md_hd_t h; - gpg_err_code_t err = md_open (&h, algo, 0, 0); + gpg_err_code_t err; + + if (algo == GCRY_MD_MD5 && fips_mode ()) + { + _gcry_inactivate_fips_mode ("MD5 used"); + if (_gcry_enforced_fips_mode () ) + { + /* We should never get to here because we do not register + MD5 in enforced fips mode. */ + _gcry_fips_noreturn (); + } + } + + err = md_open (&h, algo, 0, 0); if (err) log_bug ("gcry_md_open failed for algo %d: %s", algo, gpg_strerror (gcry_error(err))); md_write (h, (byte *) buffer, length); md_final (h); memcpy (digest, md_read (h, algo), md_digest_length (algo)); md_close (h); } } static int md_get_algo (gcry_md_hd_t a) { GcryDigestEntry *r = a->ctx->list; if (r && r->next) { fips_signal_error ("possible usage error"); log_error ("WARNING: more than one algorithm in md_get_algo()\n"); } return r ? r->module->mod_id : 0; } int gcry_md_get_algo (gcry_md_hd_t hd) { return md_get_algo (hd); } /**************** * Return the length of the digest */ static int md_digest_length (int algorithm) { gcry_module_t digest; int mdlen = 0; REGISTER_DEFAULT_DIGESTS; ath_mutex_lock (&digests_registered_lock); digest = _gcry_module_lookup_id (digests_registered, algorithm); if (digest) { mdlen = ((gcry_md_spec_t *) digest->spec)->mdlen; _gcry_module_release (digest); } ath_mutex_unlock (&digests_registered_lock); return mdlen; } /**************** * Return the length of the digest in bytes. * This function will return 0 in case of errors. */ unsigned int gcry_md_get_algo_dlen (int algorithm) { return md_digest_length (algorithm); } /* Hmmm: add a mode to enumerate the OIDs * to make g10/sig-check.c more portable */ static const byte * md_asn_oid (int algorithm, size_t *asnlen, size_t *mdlen) { const byte *asnoid = NULL; gcry_module_t digest; REGISTER_DEFAULT_DIGESTS; ath_mutex_lock (&digests_registered_lock); digest = _gcry_module_lookup_id (digests_registered, algorithm); if (digest) { if (asnlen) *asnlen = ((gcry_md_spec_t *) digest->spec)->asnlen; if (mdlen) *mdlen = ((gcry_md_spec_t *) digest->spec)->mdlen; asnoid = ((gcry_md_spec_t *) digest->spec)->asnoid; _gcry_module_release (digest); } else log_bug ("no ASN.1 OID for md algo %d\n", algorithm); ath_mutex_unlock (&digests_registered_lock); return asnoid; } /**************** * Return information about the given cipher algorithm * WHAT select the kind of information returned: * GCRYCTL_TEST_ALGO: * Returns 0 when the specified algorithm is available for use. * buffer and nbytes must be zero. * GCRYCTL_GET_ASNOID: * Return the ASNOID of the algorithm in buffer. if buffer is NULL, only * the required length is returned. * * Note: Because this function is in most cases used to return an * integer value, we can make it easier for the caller to just look at * the return value. The caller will in all cases consult the value * and thereby detecting whether a error occured or not (i.e. while checking * the block size) */ gcry_error_t gcry_md_algo_info (int algo, int what, void *buffer, size_t *nbytes) { gcry_err_code_t err = GPG_ERR_NO_ERROR; switch (what) { case GCRYCTL_TEST_ALGO: if (buffer || nbytes) err = GPG_ERR_INV_ARG; else err = check_digest_algo (algo); break; case GCRYCTL_GET_ASNOID: /* We need to check that the algo is available because md_asn_oid would otherwise raise an assertion. */ err = check_digest_algo (algo); if (!err) { const char unsigned *asn; size_t asnlen; asn = md_asn_oid (algo, &asnlen, NULL); if (buffer && (*nbytes >= asnlen)) { memcpy (buffer, asn, asnlen); *nbytes = asnlen; } else if (!buffer && nbytes) *nbytes = asnlen; else { if (buffer) err = GPG_ERR_TOO_SHORT; else err = GPG_ERR_INV_ARG; } } break; default: err = GPG_ERR_INV_OP; } return gcry_error (err); } static void md_start_debug ( gcry_md_hd_t md, const char *suffix ) { static int idx=0; char buf[50]; if (fips_mode ()) return; if ( md->ctx->debug ) { log_debug("Oops: md debug already started\n"); return; } idx++; snprintf (buf, DIM(buf)-1, "dbgmd-%05d.%.10s", idx, suffix ); md->ctx->debug = fopen(buf, "w"); if ( !md->ctx->debug ) log_debug("md debug: can't open %s\n", buf ); } static void md_stop_debug( gcry_md_hd_t md ) { if ( md->ctx->debug ) { if ( md->bufpos ) md_write ( md, NULL, 0 ); fclose (md->ctx->debug); md->ctx->debug = NULL; } #ifdef HAVE_U64_TYPEDEF { /* a kludge to pull in the __muldi3 for Solaris */ volatile u32 a = (u32)(ulong)md; volatile u64 b = 42; volatile u64 c; c = a * b; } #endif } /* * Return information about the digest handle. * GCRYCTL_IS_SECURE: * Returns 1 when the handle works on secured memory * otherwise 0 is returned. There is no error return. * GCRYCTL_IS_ALGO_ENABLED: * Returns 1 if the algo is enabled for that handle. * The algo must be passed as the address of an int. */ gcry_error_t gcry_md_info (gcry_md_hd_t h, int cmd, void *buffer, size_t *nbytes) { gcry_err_code_t err = GPG_ERR_NO_ERROR; switch (cmd) { case GCRYCTL_IS_SECURE: *nbytes = h->ctx->secure; break; case GCRYCTL_IS_ALGO_ENABLED: { GcryDigestEntry *r; int algo; if ( !buffer || (nbytes && (*nbytes != sizeof (int)))) err = GPG_ERR_INV_ARG; else { algo = *(int*)buffer; *nbytes = 0; for(r=h->ctx->list; r; r = r->next ) { if (r->module->mod_id == algo) { *nbytes = 1; break; } } } break; } default: err = GPG_ERR_INV_OP; } return gcry_error (err); } /* Explicitly initialize this module. */ gcry_err_code_t _gcry_md_init (void) { gcry_err_code_t err = GPG_ERR_NO_ERROR; REGISTER_DEFAULT_DIGESTS; return err; } int gcry_md_is_secure (gcry_md_hd_t a) { size_t value; if (gcry_md_info (a, GCRYCTL_IS_SECURE, NULL, &value)) value = 1; /* It seems to be better to assume secure memory on error. */ return value; } int gcry_md_is_enabled (gcry_md_hd_t a, int algo) { size_t value; value = sizeof algo; if (gcry_md_info (a, GCRYCTL_IS_ALGO_ENABLED, &algo, &value)) value = 0; return value; } /* Get a list consisting of the IDs of the loaded message digest modules. If LIST is zero, write the number of loaded message digest modules to LIST_LENGTH and return. If LIST is non-zero, the first *LIST_LENGTH algorithm IDs are stored in LIST, which must be of according size. In case there are less message digest modules than *LIST_LENGTH, *LIST_LENGTH is updated to the correct number. */ gcry_error_t gcry_md_list (int *list, int *list_length) { gcry_err_code_t err = GPG_ERR_NO_ERROR; ath_mutex_lock (&digests_registered_lock); err = _gcry_module_list (digests_registered, list, list_length); ath_mutex_unlock (&digests_registered_lock); return err; } /* Run the selftests for digest algorithm ALGO with optional reporting function REPORT. */ gpg_error_t _gcry_md_selftest (int algo, int extended, selftest_report_func_t report) { gcry_module_t module = NULL; cipher_extra_spec_t *extraspec = NULL; gcry_err_code_t ec = 0; REGISTER_DEFAULT_DIGESTS; ath_mutex_lock (&digests_registered_lock); module = _gcry_module_lookup_id (digests_registered, algo); if (module && !(module->flags & FLAG_MODULE_DISABLED)) extraspec = module->extraspec; ath_mutex_unlock (&digests_registered_lock); if (extraspec && extraspec->selftest) ec = extraspec->selftest (algo, extended, report); else { ec = GPG_ERR_DIGEST_ALGO; if (report) report ("digest", algo, "module", module && !(module->flags & FLAG_MODULE_DISABLED)? "no selftest available" : module? "algorithm disabled" : "algorithm not found"); } if (module) { ath_mutex_lock (&digests_registered_lock); _gcry_module_release (module); ath_mutex_unlock (&digests_registered_lock); } return gpg_error (ec); } diff --git a/cipher/rsa.c b/cipher/rsa.c index 434fd8ba..8b0fe9f4 100644 --- a/cipher/rsa.c +++ b/cipher/rsa.c @@ -1,1107 +1,1107 @@ /* rsa.c - RSA implementation * Copyright (C) 1997, 1998, 1999 by Werner Koch (dd9jn) * Copyright (C) 2000, 2001, 2002, 2003, 2008 Free Software Foundation, Inc. * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ /* This code uses an algorithm protected by U.S. Patent #4,405,829 which expired on September 20, 2000. The patent holder placed that patent into the public domain on Sep 6th, 2000. */ #include #include #include #include #include #include "g10lib.h" #include "mpi.h" #include "cipher.h" typedef struct { gcry_mpi_t n; /* modulus */ gcry_mpi_t e; /* exponent */ } RSA_public_key; typedef struct { gcry_mpi_t n; /* public modulus */ gcry_mpi_t e; /* public exponent */ gcry_mpi_t d; /* exponent */ gcry_mpi_t p; /* prime p. */ gcry_mpi_t q; /* prime q. */ gcry_mpi_t u; /* inverse of p mod q. */ } RSA_secret_key; /* A sample 1024 bit RSA key used for the selftests. */ static const char sample_secret_key[] = "(private-key" " (rsa" " (n #00e0ce96f90b6c9e02f3922beada93fe50a875eac6bcc18bb9a9cf2e84965caa" " 2d1ff95a7f542465c6c0c19d276e4526ce048868a7a914fd343cc3a87dd74291" " ffc565506d5bbb25cbac6a0e2dd1f8bcaab0d4a29c2f37c950f363484bf269f7" " 891440464baf79827e03a36e70b814938eebdc63e964247be75dc58b014b7ea251#)" " (e #010001#)" " (d #046129f2489d71579be0a75fe029bd6cdb574ebf57ea8a5b0fda942cab943b11" " 7d7bb95e5d28875e0f9fc5fcc06a72f6d502464dabded78ef6b716177b83d5bd" " c543dc5d3fed932e59f5897e92e6f58a0f33424106a3b6fa2cbf877510e4ac21" " c3ee47851e97d12996222ac3566d4ccb0b83d164074abf7de655fc2446da1781#)" " (p #00e861b700e17e8afe6837e7512e35b6ca11d0ae47d8b85161c67baf64377213" " fe52d772f2035b3ca830af41d8a4120e1c1c70d12cc22f00d28d31dd48a8d424f1#)" " (q #00f7a7ca5367c661f8e62df34f0d05c10c88e5492348dd7bddc942c9a8f369f9" " 35a07785d2db805215ed786e4285df1658eed3ce84f469b81b50d358407b4ad361#)" " (u #304559a9ead56d2309d203811a641bb1a09626bc8eb36fffa23c968ec5bd891e" " ebbafc73ae666e01ba7c8990bae06cc2bbe10b75e69fcacb353a6473079d8e9b#)))"; /* A sample 1024 bit RSA key used for the selftests (public only). */ static const char sample_public_key[] = "(public-key" " (rsa" " (n #00e0ce96f90b6c9e02f3922beada93fe50a875eac6bcc18bb9a9cf2e84965caa" " 2d1ff95a7f542465c6c0c19d276e4526ce048868a7a914fd343cc3a87dd74291" " ffc565506d5bbb25cbac6a0e2dd1f8bcaab0d4a29c2f37c950f363484bf269f7" " 891440464baf79827e03a36e70b814938eebdc63e964247be75dc58b014b7ea251#)" " (e #010001#)))"; static int test_keys (RSA_secret_key *sk, unsigned nbits); static gpg_err_code_t generate (RSA_secret_key *sk, unsigned int nbits, unsigned long use_e, int transient_key); static int check_secret_key (RSA_secret_key *sk); static void public (gcry_mpi_t output, gcry_mpi_t input, RSA_public_key *skey); static void secret (gcry_mpi_t output, gcry_mpi_t input, RSA_secret_key *skey); /* Check that a freshly generated key actually works. Returns 0 on success. */ static int test_keys (RSA_secret_key *sk, unsigned int nbits) { int result = -1; /* Default to failure. */ RSA_public_key pk; gcry_mpi_t plaintext = gcry_mpi_new (nbits); gcry_mpi_t ciphertext = gcry_mpi_new (nbits); gcry_mpi_t decr_plaintext = gcry_mpi_new (nbits); gcry_mpi_t signature = gcry_mpi_new (nbits); /* Put the relevant parameters into a public key structure. */ pk.n = sk->n; pk.e = sk->e; /* Create a random plaintext. */ gcry_mpi_randomize (plaintext, nbits, GCRY_WEAK_RANDOM); /* Encrypt using the public key. */ public (ciphertext, plaintext, &pk); /* Check that the cipher text does not match the plaintext. */ if (!gcry_mpi_cmp (ciphertext, plaintext)) goto leave; /* Ciphertext is identical to the plaintext. */ /* Decrypt using the secret key. */ secret (decr_plaintext, ciphertext, sk); /* Check that the decrypted plaintext matches the original plaintext. */ if (gcry_mpi_cmp (decr_plaintext, plaintext)) goto leave; /* Plaintext does not match. */ /* Create another random plaintext as data for signature checking. */ gcry_mpi_randomize (plaintext, nbits, GCRY_WEAK_RANDOM); /* Use the RSA secret function to create a signature of the plaintext. */ secret (signature, plaintext, sk); /* Use the RSA public function to verify this signature. */ public (decr_plaintext, signature, &pk); if (gcry_mpi_cmp (decr_plaintext, plaintext)) goto leave; /* Signature does not match. */ /* Modify the signature and check that the signing fails. */ gcry_mpi_add_ui (signature, signature, 1); public (decr_plaintext, signature, &pk); if (!gcry_mpi_cmp (decr_plaintext, plaintext)) goto leave; /* Signature matches but should not. */ result = 0; /* All tests succeeded. */ leave: gcry_mpi_release (signature); gcry_mpi_release (decr_plaintext); gcry_mpi_release (ciphertext); gcry_mpi_release (plaintext); return result; } /* Callback used by the prime generation to test whether the exponent is suitable. Returns 0 if the test has been passed. */ static int check_exponent (void *arg, gcry_mpi_t a) { gcry_mpi_t e = arg; gcry_mpi_t tmp; int result; mpi_sub_ui (a, a, 1); tmp = _gcry_mpi_alloc_like (a); result = !gcry_mpi_gcd(tmp, e, a); /* GCD is not 1. */ gcry_mpi_release (tmp); mpi_add_ui (a, a, 1); return result; } /**************** * Generate a key pair with a key of size NBITS. * USE_E = 0 let Libcgrypt decide what exponent to use. * = 1 request the use of a "secure" exponent; this is required by some * specification to be 65537. * > 2 Use this public exponent. If the given exponent * is not odd one is internally added to it. * TRANSIENT_KEY: If true, generate the primes using the standard RNG. * Returns: 2 structures filled with all needed values */ static gpg_err_code_t generate (RSA_secret_key *sk, unsigned int nbits, unsigned long use_e, int transient_key) { gcry_mpi_t p, q; /* the two primes */ gcry_mpi_t d; /* the private key */ gcry_mpi_t u; gcry_mpi_t t1, t2; gcry_mpi_t n; /* the public key */ gcry_mpi_t e; /* the exponent */ gcry_mpi_t phi; /* helper: (p-1)(q-1) */ gcry_mpi_t g; gcry_mpi_t f; gcry_random_level_t random_level; if (fips_mode ()) - { - if (nbits < 1024) - return GPG_ERR_INV_VALUE; - if (transient_key) - return GPG_ERR_INV_VALUE; - } + { + if (nbits < 1024) + return GPG_ERR_INV_VALUE; + if (transient_key) + return GPG_ERR_INV_VALUE; + } /* The random quality depends on the transient_key flag. */ random_level = transient_key ? GCRY_STRONG_RANDOM : GCRY_VERY_STRONG_RANDOM; /* Make sure that nbits is even so that we generate p, q of equal size. */ if ( (nbits&1) ) nbits++; if (use_e == 1) /* Alias for a secure value. */ use_e = 65537; /* as demanded by Spinx. */ /* Public exponent: In general we use 41 as this is quite fast and more secure than the commonly used 17. Benchmarking the RSA verify function with a 1024 bit key yields (2001-11-08): e=17 0.54 ms e=41 0.75 ms e=257 0.95 ms e=65537 1.80 ms */ e = mpi_alloc( (32+BITS_PER_MPI_LIMB-1)/BITS_PER_MPI_LIMB ); if (!use_e) mpi_set_ui (e, 41); /* This is a reasonable secure and fast value */ else { use_e |= 1; /* make sure this is odd */ mpi_set_ui (e, use_e); } n = gcry_mpi_new (nbits); p = q = NULL; do { /* select two (very secret) primes */ if (p) gcry_mpi_release (p); if (q) gcry_mpi_release (q); if (use_e) { /* Do an extra test to ensure that the given exponent is suitable. */ p = _gcry_generate_secret_prime (nbits/2, random_level, check_exponent, e); q = _gcry_generate_secret_prime (nbits/2, random_level, check_exponent, e); } else { /* We check the exponent later. */ p = _gcry_generate_secret_prime (nbits/2, random_level, NULL, NULL); q = _gcry_generate_secret_prime (nbits/2, random_level, NULL, NULL); } if (mpi_cmp (p, q) > 0 ) /* p shall be smaller than q (for calc of u)*/ mpi_swap(p,q); /* calculate the modulus */ mpi_mul( n, p, q ); } while ( mpi_get_nbits(n) != nbits ); /* calculate Euler totient: phi = (p-1)(q-1) */ t1 = mpi_alloc_secure( mpi_get_nlimbs(p) ); t2 = mpi_alloc_secure( mpi_get_nlimbs(p) ); phi = gcry_mpi_snew ( nbits ); g = gcry_mpi_snew ( nbits ); f = gcry_mpi_snew ( nbits ); mpi_sub_ui( t1, p, 1 ); mpi_sub_ui( t2, q, 1 ); mpi_mul( phi, t1, t2 ); gcry_mpi_gcd(g, t1, t2); mpi_fdiv_q(f, phi, g); while (!gcry_mpi_gcd(t1, e, phi)) /* (while gcd is not 1) */ { if (use_e) BUG (); /* The prime generator already made sure that we never can get to here. */ mpi_add_ui (e, e, 2); } /* calculate the secret key d = e^1 mod phi */ d = gcry_mpi_snew ( nbits ); mpi_invm(d, e, f ); /* calculate the inverse of p and q (used for chinese remainder theorem)*/ u = gcry_mpi_snew ( nbits ); mpi_invm(u, p, q ); if( DBG_CIPHER ) { log_mpidump(" p= ", p ); log_mpidump(" q= ", q ); log_mpidump("phi= ", phi ); log_mpidump(" g= ", g ); log_mpidump(" f= ", f ); log_mpidump(" n= ", n ); log_mpidump(" e= ", e ); log_mpidump(" d= ", d ); log_mpidump(" u= ", u ); } gcry_mpi_release (t1); gcry_mpi_release (t2); gcry_mpi_release (phi); gcry_mpi_release (f); gcry_mpi_release (g); sk->n = n; sk->e = e; sk->p = p; sk->q = q; sk->d = d; sk->u = u; /* Now we can test our keys. */ if (test_keys (sk, nbits - 64)) { gcry_mpi_release (sk->n); sk->n = NULL; gcry_mpi_release (sk->e); sk->e = NULL; gcry_mpi_release (sk->p); sk->p = NULL; gcry_mpi_release (sk->q); sk->q = NULL; gcry_mpi_release (sk->d); sk->d = NULL; gcry_mpi_release (sk->u); sk->u = NULL; fips_signal_error ("self-test after key generation failed"); return GPG_ERR_SELFTEST_FAILED; } return 0; } /**************** * Test wether the secret key is valid. * Returns: true if this is a valid key. */ static int check_secret_key( RSA_secret_key *sk ) { int rc; gcry_mpi_t temp = mpi_alloc( mpi_get_nlimbs(sk->p)*2 ); mpi_mul(temp, sk->p, sk->q ); rc = mpi_cmp( temp, sk->n ); mpi_free(temp); return !rc; } /**************** * Public key operation. Encrypt INPUT with PKEY and put result into OUTPUT. * * c = m^e mod n * * Where c is OUTPUT, m is INPUT and e,n are elements of PKEY. */ static void public(gcry_mpi_t output, gcry_mpi_t input, RSA_public_key *pkey ) { if( output == input ) /* powm doesn't like output and input the same */ { gcry_mpi_t x = mpi_alloc( mpi_get_nlimbs(input)*2 ); mpi_powm( x, input, pkey->e, pkey->n ); mpi_set(output, x); mpi_free(x); } else mpi_powm( output, input, pkey->e, pkey->n ); } #if 0 static void stronger_key_check ( RSA_secret_key *skey ) { gcry_mpi_t t = mpi_alloc_secure ( 0 ); gcry_mpi_t t1 = mpi_alloc_secure ( 0 ); gcry_mpi_t t2 = mpi_alloc_secure ( 0 ); gcry_mpi_t phi = mpi_alloc_secure ( 0 ); /* check that n == p * q */ mpi_mul( t, skey->p, skey->q); if (mpi_cmp( t, skey->n) ) log_info ( "RSA Oops: n != p * q\n" ); /* check that p is less than q */ if( mpi_cmp( skey->p, skey->q ) > 0 ) { log_info ("RSA Oops: p >= q - fixed\n"); _gcry_mpi_swap ( skey->p, skey->q); } /* check that e divides neither p-1 nor q-1 */ mpi_sub_ui(t, skey->p, 1 ); mpi_fdiv_r(t, t, skey->e ); if ( !mpi_cmp_ui( t, 0) ) log_info ( "RSA Oops: e divides p-1\n" ); mpi_sub_ui(t, skey->q, 1 ); mpi_fdiv_r(t, t, skey->e ); if ( !mpi_cmp_ui( t, 0) ) log_info ( "RSA Oops: e divides q-1\n" ); /* check that d is correct */ mpi_sub_ui( t1, skey->p, 1 ); mpi_sub_ui( t2, skey->q, 1 ); mpi_mul( phi, t1, t2 ); gcry_mpi_gcd(t, t1, t2); mpi_fdiv_q(t, phi, t); mpi_invm(t, skey->e, t ); if ( mpi_cmp(t, skey->d ) ) { log_info ( "RSA Oops: d is wrong - fixed\n"); mpi_set (skey->d, t); _gcry_log_mpidump (" fixed d", skey->d); } /* check for correctness of u */ mpi_invm(t, skey->p, skey->q ); if ( mpi_cmp(t, skey->u ) ) { log_info ( "RSA Oops: u is wrong - fixed\n"); mpi_set (skey->u, t); _gcry_log_mpidump (" fixed u", skey->u); } log_info ( "RSA secret key check finished\n"); mpi_free (t); mpi_free (t1); mpi_free (t2); mpi_free (phi); } #endif /**************** * Secret key operation. Encrypt INPUT with SKEY and put result into OUTPUT. * * m = c^d mod n * * Or faster: * * m1 = c ^ (d mod (p-1)) mod p * m2 = c ^ (d mod (q-1)) mod q * h = u * (m2 - m1) mod q * m = m1 + h * p * * Where m is OUTPUT, c is INPUT and d,n,p,q,u are elements of SKEY. */ static void secret(gcry_mpi_t output, gcry_mpi_t input, RSA_secret_key *skey ) { if (!skey->p || !skey->q || !skey->u) { mpi_powm (output, input, skey->d, skey->n); } else { gcry_mpi_t m1 = mpi_alloc_secure( mpi_get_nlimbs(skey->n)+1 ); gcry_mpi_t m2 = mpi_alloc_secure( mpi_get_nlimbs(skey->n)+1 ); gcry_mpi_t h = mpi_alloc_secure( mpi_get_nlimbs(skey->n)+1 ); /* m1 = c ^ (d mod (p-1)) mod p */ mpi_sub_ui( h, skey->p, 1 ); mpi_fdiv_r( h, skey->d, h ); mpi_powm( m1, input, h, skey->p ); /* m2 = c ^ (d mod (q-1)) mod q */ mpi_sub_ui( h, skey->q, 1 ); mpi_fdiv_r( h, skey->d, h ); mpi_powm( m2, input, h, skey->q ); /* h = u * ( m2 - m1 ) mod q */ mpi_sub( h, m2, m1 ); if ( mpi_is_neg( h ) ) mpi_add ( h, h, skey->q ); mpi_mulm( h, skey->u, h, skey->q ); /* m = m2 + h * p */ mpi_mul ( h, h, skey->p ); mpi_add ( output, m1, h ); mpi_free ( h ); mpi_free ( m1 ); mpi_free ( m2 ); } } /* Perform RSA blinding. */ static gcry_mpi_t rsa_blind (gcry_mpi_t x, gcry_mpi_t r, gcry_mpi_t e, gcry_mpi_t n) { /* A helper. */ gcry_mpi_t a; /* Result. */ gcry_mpi_t y; a = gcry_mpi_snew (gcry_mpi_get_nbits (n)); y = gcry_mpi_snew (gcry_mpi_get_nbits (n)); /* Now we calculate: y = (x * r^e) mod n, where r is the random number, e is the public exponent, x is the non-blinded data and n is the RSA modulus. */ gcry_mpi_powm (a, r, e, n); gcry_mpi_mulm (y, a, x, n); gcry_mpi_release (a); return y; } /* Undo RSA blinding. */ static gcry_mpi_t rsa_unblind (gcry_mpi_t x, gcry_mpi_t ri, gcry_mpi_t n) { gcry_mpi_t y; y = gcry_mpi_snew (gcry_mpi_get_nbits (n)); /* Here we calculate: y = (x * r^-1) mod n, where x is the blinded decrypted data, ri is the modular multiplicative inverse of r and n is the RSA modulus. */ gcry_mpi_mulm (y, ri, x, n); return y; } /********************************************* ************** interface ****************** *********************************************/ static gcry_err_code_t rsa_generate_ext (int algo, unsigned int nbits, unsigned int qbits, unsigned long use_e, const char *name, const gcry_sexp_t domain, unsigned int keygen_flags, gcry_mpi_t *skey, gcry_mpi_t **retfactors) { RSA_secret_key sk; gpg_err_code_t ec; int i; (void)algo; (void)qbits; (void)name; (void)domain; ec = generate (&sk, nbits, use_e, !!(keygen_flags & PUBKEY_FLAG_TRANSIENT_KEY) ); if (!ec) { skey[0] = sk.n; skey[1] = sk.e; skey[2] = sk.d; skey[3] = sk.p; skey[4] = sk.q; skey[5] = sk.u; /* Make an empty list of factors. */ *retfactors = gcry_calloc ( 1, sizeof **retfactors ); if (!*retfactors) { ec = gpg_err_code_from_syserror (); for (i=0; i <= 5; i++) { gcry_mpi_release (skey[i]); skey[i] = NULL; } } else ec = 0; } return ec; } static gcry_err_code_t rsa_generate (int algo, unsigned int nbits, unsigned long use_e, gcry_mpi_t *skey, gcry_mpi_t **retfactors) { return rsa_generate_ext (algo, nbits, 0, use_e, NULL, NULL, 0, skey, retfactors); } static gcry_err_code_t rsa_check_secret_key (int algo, gcry_mpi_t *skey) { gcry_err_code_t err = GPG_ERR_NO_ERROR; RSA_secret_key sk; (void)algo; sk.n = skey[0]; sk.e = skey[1]; sk.d = skey[2]; sk.p = skey[3]; sk.q = skey[4]; sk.u = skey[5]; if (!sk.p || !sk.q || !sk.u) err = GPG_ERR_NO_OBJ; /* To check the key we need the optional parameters. */ else if (!check_secret_key (&sk)) err = GPG_ERR_PUBKEY_ALGO; return err; } static gcry_err_code_t rsa_encrypt (int algo, gcry_mpi_t *resarr, gcry_mpi_t data, gcry_mpi_t *pkey, int flags) { RSA_public_key pk; (void)algo; (void)flags; pk.n = pkey[0]; pk.e = pkey[1]; resarr[0] = mpi_alloc (mpi_get_nlimbs (pk.n)); public (resarr[0], data, &pk); return GPG_ERR_NO_ERROR; } static gcry_err_code_t rsa_decrypt (int algo, gcry_mpi_t *result, gcry_mpi_t *data, gcry_mpi_t *skey, int flags) { RSA_secret_key sk; gcry_mpi_t r = MPI_NULL; /* Random number needed for blinding. */ gcry_mpi_t ri = MPI_NULL; /* Modular multiplicative inverse of r. */ gcry_mpi_t x = MPI_NULL; /* Data to decrypt. */ gcry_mpi_t y; /* Result. */ (void)algo; /* Extract private key. */ sk.n = skey[0]; sk.e = skey[1]; sk.d = skey[2]; sk.p = skey[3]; /* Optional. */ sk.q = skey[4]; /* Optional. */ sk.u = skey[5]; /* Optional. */ y = gcry_mpi_snew (gcry_mpi_get_nbits (sk.n)); /* We use blinding by default to mitigate timing attacks which can be practically mounted over the network as shown by Brumley and Boney in 2003. */ if (! (flags & PUBKEY_FLAG_NO_BLINDING)) { /* Initialize blinding. */ /* First, we need a random number r between 0 and n - 1, which is relatively prime to n (i.e. it is neither p nor q). */ r = gcry_mpi_snew (gcry_mpi_get_nbits (sk.n)); ri = gcry_mpi_snew (gcry_mpi_get_nbits (sk.n)); gcry_mpi_randomize (r, gcry_mpi_get_nbits (sk.n), GCRY_STRONG_RANDOM); gcry_mpi_mod (r, r, sk.n); /* Calculate inverse of r. It practically impossible that the follwing test fails, thus we do not add code to release allocated resources. */ if (!gcry_mpi_invm (ri, r, sk.n)) return GPG_ERR_INTERNAL; } if (! (flags & PUBKEY_FLAG_NO_BLINDING)) x = rsa_blind (data[0], r, sk.e, sk.n); else x = data[0]; /* Do the encryption. */ secret (y, x, &sk); if (! (flags & PUBKEY_FLAG_NO_BLINDING)) { /* Undo blinding. */ gcry_mpi_t a = gcry_mpi_copy (y); gcry_mpi_release (y); y = rsa_unblind (a, ri, sk.n); gcry_mpi_release (a); } if (! (flags & PUBKEY_FLAG_NO_BLINDING)) { /* Deallocate resources needed for blinding. */ gcry_mpi_release (x); gcry_mpi_release (r); gcry_mpi_release (ri); } /* Copy out result. */ *result = y; return GPG_ERR_NO_ERROR; } static gcry_err_code_t rsa_sign (int algo, gcry_mpi_t *resarr, gcry_mpi_t data, gcry_mpi_t *skey) { RSA_secret_key sk; (void)algo; sk.n = skey[0]; sk.e = skey[1]; sk.d = skey[2]; sk.p = skey[3]; sk.q = skey[4]; sk.u = skey[5]; resarr[0] = mpi_alloc( mpi_get_nlimbs (sk.n)); secret (resarr[0], data, &sk); return GPG_ERR_NO_ERROR; } static gcry_err_code_t rsa_verify (int algo, gcry_mpi_t hash, gcry_mpi_t *data, gcry_mpi_t *pkey, int (*cmp) (void *opaque, gcry_mpi_t tmp), void *opaquev) { RSA_public_key pk; gcry_mpi_t result; gcry_err_code_t rc; (void)algo; (void)cmp; (void)opaquev; pk.n = pkey[0]; pk.e = pkey[1]; result = gcry_mpi_new ( 160 ); public( result, data[0], &pk ); #ifdef IS_DEVELOPMENT_VERSION if (DBG_CIPHER) { log_mpidump ("rsa verify result:", result ); log_mpidump (" hash:", hash ); } #endif /*IS_DEVELOPMENT_VERSION*/ /*rc = (*cmp)( opaquev, result );*/ rc = mpi_cmp (result, hash) ? GPG_ERR_BAD_SIGNATURE : GPG_ERR_NO_ERROR; gcry_mpi_release (result); return rc; } static unsigned int rsa_get_nbits (int algo, gcry_mpi_t *pkey) { (void)algo; return mpi_get_nbits (pkey[0]); } /* Compute a keygrip. MD is the hash context which we are going to update. KEYPARAM is an S-expression with the key parameters, this is usually a public key but may also be a secret key. An example of such an S-expression is: (rsa (n #00B...#) (e #010001#)) PKCS-15 says that for RSA only the modulus should be hashed - however, it is not clear wether this is meant to use the raw bytes (assuming this is an unsigned integer) or whether the DER required 0 should be prefixed. We hash the raw bytes. */ static gpg_err_code_t compute_keygrip (gcry_md_hd_t md, gcry_sexp_t keyparam) { gcry_sexp_t l1; const char *data; size_t datalen; l1 = gcry_sexp_find_token (keyparam, "n", 1); if (!l1) return GPG_ERR_NO_OBJ; data = gcry_sexp_nth_data (l1, 1, &datalen); if (!data) { gcry_sexp_release (l1); return GPG_ERR_NO_OBJ; } gcry_md_write (md, data, datalen); gcry_sexp_release (l1); return 0; } /* Self-test section. */ static const char * selftest_sign_1024 (gcry_sexp_t pkey, gcry_sexp_t skey) { static const char sample_data[] = "(data (flags pkcs1)" " (hash sha1 #11223344556677889900aabbccddeeff10203040#))"; static const char sample_data_bad[] = "(data (flags pkcs1)" " (hash sha1 #11223344556677889900aabbccddeeff80203040#))"; const char *errtxt = NULL; gcry_error_t err; gcry_sexp_t data = NULL; gcry_sexp_t data_bad = NULL; gcry_sexp_t sig = NULL; err = gcry_sexp_sscan (&data, NULL, sample_data, strlen (sample_data)); if (!err) err = gcry_sexp_sscan (&data_bad, NULL, sample_data_bad, strlen (sample_data_bad)); if (err) { errtxt = "converting data failed"; goto leave; } err = gcry_pk_sign (&sig, data, skey); if (err) { errtxt = "signing failed"; goto leave; } err = gcry_pk_verify (sig, data, pkey); if (err) { errtxt = "verify failed"; goto leave; } err = gcry_pk_verify (sig, data_bad, pkey); if (gcry_err_code (err) != GPG_ERR_BAD_SIGNATURE) { errtxt = "bad signature not detected"; goto leave; } leave: gcry_sexp_release (sig); gcry_sexp_release (data_bad); gcry_sexp_release (data); return errtxt; } /* Given an S-expression ENCR_DATA of the form: (enc-val (rsa (a a-value))) as returned by gcry_pk_decrypt, return the the A-VALUE. On error, return NULL. */ static gcry_mpi_t extract_a_from_sexp (gcry_sexp_t encr_data) { gcry_sexp_t l1, l2, l3; gcry_mpi_t a_value; l1 = gcry_sexp_find_token (encr_data, "enc-val", 0); if (!l1) return NULL; l2 = gcry_sexp_find_token (l1, "rsa", 0); gcry_sexp_release (l1); if (!l2) return NULL; l3 = gcry_sexp_find_token (l2, "a", 0); gcry_sexp_release (l2); if (!l3) return NULL; a_value = gcry_sexp_nth_mpi (l3, 1, 0); gcry_sexp_release (l3); return a_value; } static const char * selftest_encr_1024 (gcry_sexp_t pkey, gcry_sexp_t skey) { const char *errtxt = NULL; gcry_error_t err; const unsigned int nbits = 1000; /* Encrypt 1000 random bits. */ gcry_mpi_t plaintext = NULL; gcry_sexp_t plain = NULL; gcry_sexp_t encr = NULL; gcry_mpi_t ciphertext = NULL; gcry_sexp_t decr = NULL; gcry_mpi_t decr_plaintext = NULL; gcry_sexp_t tmplist = NULL; /* Create plaintext. The plaintext is actually a big integer number. */ plaintext = gcry_mpi_new (nbits); gcry_mpi_randomize (plaintext, nbits, GCRY_WEAK_RANDOM); /* Put the plaintext into an S-expression. */ err = gcry_sexp_build (&plain, NULL, "(data (flags raw) (value %m))", plaintext); if (err) { errtxt = "converting data failed"; goto leave; } /* Encrypt. */ err = gcry_pk_encrypt (&encr, plain, pkey); if (err) { errtxt = "encrypt failed"; goto leave; } /* Extraxt the ciphertext from the returned S-expression. */ /*gcry_sexp_dump (encr);*/ ciphertext = extract_a_from_sexp (encr); if (!ciphertext) { errtxt = "gcry_pk_decrypt returned garbage"; goto leave; } /* Check that the ciphertext does no match the plaintext. */ /* _gcry_log_mpidump ("plaintext", plaintext); */ /* _gcry_log_mpidump ("ciphertxt", ciphertext); */ if (!gcry_mpi_cmp (plaintext, ciphertext)) { errtxt = "ciphertext matches plaintext"; goto leave; } /* Decrypt. */ err = gcry_pk_decrypt (&decr, encr, skey); if (err) { errtxt = "decrypt failed"; goto leave; } /* Extract the decrypted data from the S-expression. Note that the output of gcry_pk_decrypt depends on whether a flags lists occurs in its input data. Because we passed the output of gcry_pk_encrypt directly to gcry_pk_decrypt, such a flag value won't be there as of today. To be prepared for future changes we take care of it anyway. */ tmplist = gcry_sexp_find_token (decr, "value", 0); if (tmplist) decr_plaintext = gcry_sexp_nth_mpi (tmplist, 1, GCRYMPI_FMT_USG); else decr_plaintext = gcry_sexp_nth_mpi (decr, 0, GCRYMPI_FMT_USG); if (!decr_plaintext) { errtxt = "decrypt returned no plaintext"; goto leave; } /* Check that the decrypted plaintext matches the original plaintext. */ if (gcry_mpi_cmp (plaintext, decr_plaintext)) { errtxt = "mismatch"; goto leave; } leave: gcry_sexp_release (tmplist); gcry_mpi_release (decr_plaintext); gcry_sexp_release (decr); gcry_mpi_release (ciphertext); gcry_sexp_release (encr); gcry_sexp_release (plain); gcry_mpi_release (plaintext); return errtxt; } static gpg_err_code_t selftests_rsa (selftest_report_func_t report) { const char *what; const char *errtxt; gcry_error_t err; gcry_sexp_t skey = NULL; gcry_sexp_t pkey = NULL; /* Convert the S-expressions into the internal representation. */ what = "convert"; err = gcry_sexp_sscan (&skey, NULL, sample_secret_key, strlen (sample_secret_key)); if (!err) err = gcry_sexp_sscan (&pkey, NULL, sample_public_key, strlen (sample_public_key)); if (err) { errtxt = gcry_strerror (err); goto failed; } what = "key consistency"; err = gcry_pk_testkey (skey); if (err) { errtxt = gcry_strerror (err); goto failed; } what = "sign"; errtxt = selftest_sign_1024 (pkey, skey); if (errtxt) goto failed; what = "encrypt"; errtxt = selftest_encr_1024 (pkey, skey); if (errtxt) goto failed; gcry_sexp_release (pkey); gcry_sexp_release (skey); return 0; /* Succeeded. */ failed: gcry_sexp_release (pkey); gcry_sexp_release (skey); if (report) report ("pubkey", GCRY_PK_RSA, what, errtxt); return GPG_ERR_SELFTEST_FAILED; } /* Run a full self-test for ALGO and return 0 on success. */ static gpg_err_code_t run_selftests (int algo, int extended, selftest_report_func_t report) { gpg_err_code_t ec; (void)extended; switch (algo) { case GCRY_PK_RSA: ec = selftests_rsa (report); break; default: ec = GPG_ERR_PUBKEY_ALGO; break; } return ec; } static const char *rsa_names[] = { "rsa", "openpgp-rsa", "oid.1.2.840.113549.1.1.1", NULL, }; gcry_pk_spec_t _gcry_pubkey_spec_rsa = { "RSA", rsa_names, "ne", "nedpqu", "a", "s", "n", GCRY_PK_USAGE_SIGN | GCRY_PK_USAGE_ENCR, rsa_generate, rsa_check_secret_key, rsa_encrypt, rsa_decrypt, rsa_sign, rsa_verify, rsa_get_nbits, }; pk_extra_spec_t _gcry_pubkey_extraspec_rsa = { run_selftests, rsa_generate_ext, compute_keygrip }; diff --git a/doc/gcrypt.texi b/doc/gcrypt.texi index 32f21171..87fb9cec 100644 --- a/doc/gcrypt.texi +++ b/doc/gcrypt.texi @@ -1,5732 +1,5755 @@ \input texinfo @c -*- Texinfo -*- @c %**start of header @setfilename gcrypt.info @include version.texi @settitle The Libgcrypt Reference Manual @c Unify some of the indices. @syncodeindex tp fn @syncodeindex pg fn @c %**end of header @copying This manual is for Libgcrypt (version @value{VERSION}, @value{UPDATED}), which is GNU's library of cryptographic building blocks. Copyright @copyright{} 2000, 2002, 2003, 2004, 2006, 2007, 2008 Free Software Foundation, Inc. @quotation Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. The text of the license can be found in the section entitled ``GNU General Public License''. @end quotation @end copying @dircategory GNU Libraries @direntry * libgcrypt: (gcrypt). Cryptographic function library. @end direntry @c @c Titlepage @c @setchapternewpage odd @titlepage @title The Libgcrypt Reference Manual @subtitle Version @value{VERSION} @subtitle @value{UPDATED} @author Werner Koch (@email{wk@@gnupg.org}) @author Moritz Schulte (@email{mo@@g10code.com}) @page @vskip 0pt plus 1filll @insertcopying @end titlepage @ifnothtml @summarycontents @contents @page @end ifnothtml @ifnottex @node Top @top The Libgcrypt Library @insertcopying @end ifnottex @menu * Introduction:: What is Libgcrypt. * Preparation:: What you should do before using the library. * Generalities:: General library functions and data types. * Handler Functions:: Working with handler functions. * Symmetric cryptography:: How to use symmetric cryptography. * Public Key cryptography:: How to use public key cryptography. * Hashing:: How to use hash and MAC algorithms. * Random Numbers:: How to work with random numbers. * S-expressions:: How to manage S-expressions. * MPI library:: How to work with multi-precision-integers. * Prime numbers:: How to use the Prime number related functions. * Utilities:: Utility functions. * Architecture:: How Libgcrypt works internally. Appendices * Self-Tests:: Description of the self-tests. * FIPS Mode:: Description of the FIPS mode. * Library Copying:: The GNU Lesser General Public License says how you can copy and share Libgcrypt. * Copying:: The GNU General Public License says how you can copy and share some parts of Libgcrypt. Indices * Figures and Tables:: Index of figures and tables. * Concept Index:: Index of concepts and programs. * Function and Data Index:: Index of functions, variables and data types. @end menu @ifhtml @page @summarycontents @contents @end ifhtml @c ********************************************************** @c ******************* Introduction *********************** @c ********************************************************** @node Introduction @chapter Introduction Libgcrypt is a library providing cryptographic building blocks. @menu * Getting Started:: How to use this manual. * Features:: A glance at Libgcrypt's features. * Overview:: Overview about the library. @end menu @node Getting Started @section Getting Started This manual documents the Libgcrypt library application programming interface (API). All functions and data types provided by the library are explained. @noindent The reader is assumed to possess basic knowledge about applied cryptography. This manual can be used in several ways. If read from the beginning to the end, it gives a good introduction into the library and how it can be used in an application. Forward references are included where necessary. Later on, the manual can be used as a reference manual to get just the information needed about any particular interface of the library. Experienced programmers might want to start looking at the examples at the end of the manual, and then only read up those parts of the interface which are unclear. @node Features @section Features Libgcrypt might have a couple of advantages over other libraries doing a similar job. @table @asis @item It's Free Software Anybody can use, modify, and redistribute it under the terms of the GNU Lesser General Public License (@pxref{Library Copying}). Note, that some parts (which are in general not needed by applications) are subject to the terms of the GNU General Public License (@pxref{Copying}); please see the README file of the distribution for of list of these parts. @item It encapsulates the low level cryptography Libgcrypt provides a high level interface to cryptographic building blocks using an extensible and flexible API. @end table @node Overview @section Overview @noindent The Libgcrypt library is fully thread-safe, where it makes sense to be thread-safe. Not thread-safe are some cryptographic functions that modify a certain context stored in handles. If the user really intents to use such functions from different threads on the same handle, he has to take care of the serialization of such functions himself. If not described otherwise, every function is thread-safe. Libgcrypt depends on the library `libgpg-error', which contains common error handling related code for GnuPG components. @c ********************************************************** @c ******************* Preparation ************************ @c ********************************************************** @node Preparation @chapter Preparation To use Libgcrypt, you have to perform some changes to your sources and the build system. The necessary changes are small and explained in the following sections. At the end of this chapter, it is described how the library is initialized, and how the requirements of the library are verified. @menu * Header:: What header file you need to include. * Building sources:: How to build sources using the library. * Building sources using Automake:: How to build sources with the help of Automake. * Initializing the library:: How to initialize the library. * Multi-Threading:: How Libgcrypt can be used in a MT environment. * Enabling FIPS mode:: How to enable the FIPS mode. @end menu @node Header @section Header All interfaces (data types and functions) of the library are defined in the header file @file{gcrypt.h}. You must include this in all source files using the library, either directly or through some other header file, like this: @example #include @end example The name space of Libgcrypt is @code{gcry_*} for function and type names and @code{GCRY*} for other symbols. In addition the same name prefixes with one prepended underscore are reserved for internal use and should never be used by an application. Note that Libgcrypt uses libgpg-error, which uses @code{gpg_*} as name space for function and type names and @code{GPG_*} for other symbols, including all the error codes. @noindent Certain parts of gcrypt.h may be excluded by defining these macros: @table @code @item GCRYPT_NO_MPI_MACROS Do not define the shorthand macros @code{mpi_*} for @code{gcry_mpi_*}. @item GCRYPT_NO_DEPRECATED Do not include defintions for deprecated features. This is useful to make sure that no deprecated features are used. @end table @node Building sources @section Building sources If you want to compile a source file including the `gcrypt.h' header file, you must make sure that the compiler can find it in the directory hierarchy. This is accomplished by adding the path to the directory in which the header file is located to the compilers include file search path (via the @option{-I} option). However, the path to the include file is determined at the time the source is configured. To solve this problem, Libgcrypt ships with a small helper program @command{libgcrypt-config} that knows the path to the include file and other configuration options. The options that need to be added to the compiler invocation at compile time are output by the @option{--cflags} option to @command{libgcrypt-config}. The following example shows how it can be used at the command line: @example gcc -c foo.c `libgcrypt-config --cflags` @end example Adding the output of @samp{libgcrypt-config --cflags} to the compilers command line will ensure that the compiler can find the Libgcrypt header file. A similar problem occurs when linking the program with the library. Again, the compiler has to find the library files. For this to work, the path to the library files has to be added to the library search path (via the @option{-L} option). For this, the option @option{--libs} to @command{libgcrypt-config} can be used. For convenience, this option also outputs all other options that are required to link the program with the Libgcrypt libraries (in particular, the @samp{-lgcrypt} option). The example shows how to link @file{foo.o} with the Libgcrypt library to a program @command{foo}. @example gcc -o foo foo.o `libgcrypt-config --libs` @end example Of course you can also combine both examples to a single command by specifying both options to @command{libgcrypt-config}: @example gcc -o foo foo.c `libgcrypt-config --cflags --libs` @end example @node Building sources using Automake @section Building sources using Automake It is much easier if you use GNU Automake instead of writing your own Makefiles. If you do that, you do not have to worry about finding and invoking the @command{libgcrypt-config} script at all. Libgcrypt provides an extension to Automake that does all the work for you. @c A simple macro for optional variables. @macro ovar{varname} @r{[}@var{\varname\}@r{]} @end macro @defmac AM_PATH_LIBGCRYPT (@ovar{minimum-version}, @ovar{action-if-found}, @ovar{action-if-not-found}) Check whether Libgcrypt (at least version @var{minimum-version}, if given) exists on the host system. If it is found, execute @var{action-if-found}, otherwise do @var{action-if-not-found}, if given. Additionally, the function defines @code{LIBGCRYPT_CFLAGS} to the flags needed for compilation of the program to find the @file{gcrypt.h} header file, and @code{LIBGCRYPT_LIBS} to the linker flags needed to link the program to the Libgcrypt library. @end defmac You can use the defined Autoconf variables like this in your @file{Makefile.am}: @example AM_CPPFLAGS = $(LIBGCRYPT_CFLAGS) LDADD = $(LIBGCRYPT_LIBS) @end example @node Initializing the library @section Initializing the library Before the library can be used, it must initialize itself. This is achieved by invoking the function @code{gcry_check_version} described below. Also, it is often desirable to check that the version of Libgcrypt used is indeed one which fits all requirements. Even with binary compatibility, new features may have been introduced, but due to problem with the dynamic linker an old version may actually be used. So you may want to check that the version is okay right after program startup. @deftypefun {const char *} gcry_check_version (const char *@var{req_version}) The function @code{gcry_check_version} initializes some subsystems used by Libgcrypt and must be invoked before any other function in the library, with the exception of the @code{GCRYCTL_SET_THREAD_CBS} command (called via the @code{gcry_control} function). @xref{Multi-Threading}. Furthermore, this function returns the version number of the library. It can also verify that the version number is higher than a certain required version number @var{req_version}, if this value is not a null pointer. @end deftypefun Libgcrypt uses a concept known as secure memory, which is a region of memory set aside for storing sensitive data. Because such memory is a scarce resource, it needs to be setup in advanced to a fixed size. Further, most operating systems have special requirements on how that secure memory can be used. For example, it might be required to install an application as ``setuid(root)'' to allow allocating such memory. Libgcrypt requires a sequence of initialization steps to make sure that this works correctly. The following examples show the necessary steps. If you don't have a need for secure memory, for example if your application does not use secret keys or other confidential data or it runs in a controlled environment where key material floating around in memory is not a problem, you should initialize Libgcrypt this way: @example /* Version check should be the very first call because it makes sure that important subsystems are intialized. */ if (!gcry_check_version (GCRYPT_VERSION)) @{ fputs ("libgcrypt version mismatch\n", stderr); exit (2); @} /* Disable secure memory. */ gcry_control (GCRYCTL_DISABLE_SECMEM, 0); /* ... If required, other initialization goes here. */ /* Tell Libgcrypt that initialization has completed. */ gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0); @end example If you have to protect your keys or other information in memory against being swapped out to disk and to enable an automatic overwrite of used and freed memory, you need to initialize Libgcrypt this way: @example /* Version check should be the very first call because it makes sure that important subsystems are intialized. */ if (!gcry_check_version (GCRYPT_VERSION)) @{ fputs ("libgcrypt version mismatch\n", stderr); exit (2); @} @anchor{sample-use-suspend-secmem} /* We don't want to see any warnings, e.g. because we have not yet parsed program options which might be used to suppress such warnings. */ gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN); /* ... If required, other initialization goes here. Note that the process might still be running with increased privileges and that the secure memory has not been intialized. */ /* Allocate a pool of 16k secure memory. This make the secure memory available and also drops privileges where needed. */ gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0); @anchor{sample-use-resume-secmem} /* It is now okay to let Libgcrypt complain when there was/is a problem with the secure memory. */ gcry_control (GCRYCTL_RESUME_SECMEM_WARN); /* ... If required, other initialization goes here. */ /* Tell Libgcrypt that initialization has completed. */ gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0); @end example It is important that these initialization steps are not done by a library but by the actual application. A library using Libgcrypt might want to check for finished initialization using: @example if (!gcry_control (GCRYCTL_INITIALIZATION_FINISHED_P)) @{ fputs ("libgcrypt has not been initialized\n", stderr); abort (); @} @end example Instead of terminating the process, the library may instead print a warning and try to initialize Libgcrypt itself. See also the section on multi-threading below for more pitfalls. @node Multi-Threading @section Multi-Threading As mentioned earlier, the Libgcrypt library is thread-safe if you adhere to the following requirements: @itemize @bullet @item If your application is multi-threaded, you must set the thread support callbacks with the @code{GCRYCTL_SET_THREAD_CBS} command @strong{before} any other function in the library. This is easy enough if you are indeed writing an application using Libgcrypt. It is rather problematic if you are writing a library instead. Here are some tips what to do if you are writing a library: If your library requires a certain thread package, just initialize Libgcrypt to use this thread package. If your library supports multiple thread packages, but needs to be configured, you will have to implement a way to determine which thread package the application wants to use with your library anyway. Then configure Libgcrypt to use this thread package. If your library is fully reentrant without any special support by a thread package, then you are lucky indeed. Unfortunately, this does not relieve you from doing either of the two above, or use a third option. The third option is to let the application initialize Libgcrypt for you. Then you are not using Libgcrypt transparently, though. As if this was not difficult enough, a conflict may arise if two libraries try to initialize Libgcrypt independently of each others, and both such libraries are then linked into the same application. To make it a bit simpler for you, this will probably work, but only if both libraries have the same requirement for the thread package. This is currently only supported for the non-threaded case, GNU Pth and pthread. Support for more thread packages is easy to add, so contact us if you require it. @item The function @code{gcry_check_version} must be called before any other function in the library, except the @code{GCRYCTL_SET_THREAD_CBS} command (called via the @code{gcry_control} function), because it initializes the thread support subsystem in Libgcrypt. To achieve this in multi-threaded programs, you must synchronize the memory with respect to other threads that also want to use Libgcrypt. For this, it is sufficient to call @code{gcry_check_version} before creating the other threads using Libgcrypt@footnote{At least this is true for POSIX threads, as @code{pthread_create} is a function that synchronizes memory with respects to other threads. There are many functions which have this property, a complete list can be found in POSIX, IEEE Std 1003.1-2003, Base Definitions, Issue 6, in the definition of the term ``Memory Synchronization''. For other thread packages, more relaxed or more strict rules may apply.}. @item Just like the function @code{gpg_strerror}, the function @code{gcry_strerror} is not thread safe. You have to use @code{gpg_strerror_r} instead. @end itemize Libgcrypt contains convenient macros, which define the necessary thread callbacks for PThread and for GNU Pth: @table @code @item GCRY_THREAD_OPTION_PTH_IMPL This macro defines the following (static) symbols: @code{gcry_pth_init}, @code{gcry_pth_mutex_init}, @code{gcry_pth_mutex_destroy}, @code{gcry_pth_mutex_lock}, @code{gcry_pth_mutex_unlock}, @code{gcry_pth_read}, @code{gcry_pth_write}, @code{gcry_pth_select}, @code{gcry_pth_waitpid}, @code{gcry_pth_accept}, @code{gcry_pth_connect}, @code{gcry_threads_pth}. After including this macro, @code{gcry_control()} shall be used with a command of @code{GCRYCTL_SET_THREAD_CBS} in order to register the thread callback structure named ``gcry_threads_pth''. @item GCRY_THREAD_OPTION_PTHREAD_IMPL This macro defines the following (static) symbols: @code{gcry_pthread_mutex_init}, @code{gcry_pthread_mutex_destroy}, @code{gcry_pthread_mutex_lock}, @code{gcry_pthread_mutex_unlock}, @code{gcry_threads_pthread}. After including this macro, @code{gcry_control()} shall be used with a command of @code{GCRYCTL_SET_THREAD_CBS} in order to register the thread callback structure named ``gcry_threads_pthread''. @end table Note that these macros need to be terminated with a semicolon. Keep in mind that these are convenient macros for C programmers; C++ programmers might have to wrap these macros in an ``extern C'' body. @node Enabling FIPS mode @section How to enable the FIPS mode @cindex FIPS mode Libgcrypt may be used in a FIPS 140-2 mode. Note, that this does not necessary mean that Libcgrypt is an appoved FIPS 140-2 module. Check the NIST database at @url{http://csrc.nist.gov/groups/STM/cmvp/} to see what versions of Libgcrypt are approved. Because FIPS 140 has certain restrictions on the use of cryptography which are not always wanted, Libgcrypt needs to be put into FIPS mode explicitly. Three alternative mechanisms are provided to switch Libgcrypt into this mode: @itemize @item If the file @file{/proc/sys/crypto/fips_enabled} exists and contains a numeric value other than @code{0}, Libgcrypt is put into FIPS mode at initialization time. Obviously this works only on systems with a @code{proc} file system (i.e. GNU/Linux). @item If the file @file{/etc/gcrypt/fips_enabled} exists, Libgcrypt is put into FIPS mode at initialization time. Note that this filename is hardwired and does not depend on any configuration options. @item If the application requests FIPS mode using the control command @code{GCRYCTL_FORCE_FIPS_MODE}. This must be done prior to any initialization (i.e. before @code{gcry_check_version}). @end itemize @cindex Enforced FIPS mode In addition to the standard FIPS mode, Libgcrypt may also be put into an Enforced FIPS mode by writing a non-zero value into the file @file{/etc/gcrypt/fips_enabled}. The Enforced FIPS mode helps to detect applications which don't fulfill all requirements for using Libgcrypt in FIPS mode (@pxref{FIPS Mode}). Once Libgcrypt has been put into FIPS mode, it is not possible to switch back to standard mode without terminating the process first. If the logging verbosity level of Libgcrypt has been set to at least 2, the state transitions and the self-tests are logged. @c ********************************************************** @c ******************* General **************************** @c ********************************************************** @node Generalities @chapter Generalities @menu * Controlling the library:: Controlling Libgcrypt's behavior. * Modules:: Description of extension modules. * Error Handling:: Error codes and such. @end menu @node Controlling the library @section Controlling the library @deftypefun gcry_error_t gcry_control (enum gcry_ctl_cmds @var{cmd}, ...) This function can be used to influence the general behavior of Libgcrypt in several ways. Depending on @var{cmd}, more arguments can or have to be provided. @table @code @item GCRYCTL_ENABLE_M_GUARD; Arguments: none This command enables the built-in memory guard. It must not be used to activate the memory guard after the memory management has already been used; therefore it can ONLY be used at initialization time. Note that the memory guard is NOT used when the user of the library has set his own memory management callbacks. @item GCRYCTL_ENABLE_QUICK_RANDOM; Arguments: none This command inhibits the use the very secure random quality level (@code{GCRY_VERY_STRONG_RANDOM}) and degrades all request down to @code{GCRY_STRONG_RANDOM}. In general this is not recommened. However, for some applications the extra quality random Libgcrypt tries to create is not justified and this option may help to get better performace. Please check with a crypto expert whether this option can be used for your application. This option can only be used at initialization time. @item GCRYCTL_DUMP_RANDOM_STATS; Arguments: none This command dumps randum number generator related statistics to the library's logging stream. @item GCRYCTL_DUMP_MEMORY_STATS; Arguments: none This command dumps memory managment related statistics to the library's logging stream. @item GCRYCTL_DUMP_SECMEM_STATS; Arguments: none This command dumps secure memory manamgent related statistics to the library's logging stream. @item GCRYCTL_DROP_PRIVS; Arguments: none This command disables the use of secure memory and drops the priviliges of the current process. This command has not much use; the suggested way to disable secure memory is to use @code{GCRYCTL_DISABLE_SECMEM} right after initialization. @item GCRYCTL_DISABLE_SECMEM; Arguments: none This command disables the use of secure memory. If this command is used in FIPS mode, FIPS mode will be disabled and the fucntion @code{gcry_fips_mode_active} returns false. However, in Enforced FIPS mode this command has no effect at all. Many applications do not require secure memory, so they should disable it right away. This command should be executed right after @code{gcry_check_version}. @item GCRYCTL_INIT_SECMEM; Arguments: int nbytes This command is used to allocate a pool of secure memory and thus enabling the use of secure memory. It also drops all extra privileges the process has (i.e. if it is run as setuid (root)). If the argument @var{nbytes} is 0, secure memory will be disabled. The minimum amount of secure memory allocated is currently 16384 bytes; you may thus use a value of 1 to request that default size. @item GCRYCTL_TERM_SECMEM; Arguments: none This command zeroises the secure memory and destroys the handler. The secure memory pool may not be used anymore after running this command. If the secure memory pool as already been destroyed, this command has no effect. Applications might want to run this command from their exit handler to make sure that the secure memory gets properly destroyed. This command is not necessarily thread-safe but that should not be needed in cleanup code. It may be called from a signal handler. @item GCRYCTL_DISABLE_SECMEM_WARN; Arguments: none Disable warning messages about problems with the secure memory subsystem. This command should be run right after @code{gcry_check_version}. @item GCRYCTL_SUSPEND_SECMEM_WARN; Arguments: none Postpone warning messages from the secure memory subsystem. @xref{sample-use-suspend-secmem,,the initialization example}, on how to use it. @item GCRYCTL_RESUME_SECMEM_WARN; Arguments: none Resume warning messages from the secure memory subsystem. @xref{sample-use-resume-secmem,,the initialization example}, on how to use it. @item GCRYCTL_USE_SECURE_RNDPOOL; Arguments: none This command tells the PRNG to store random numbers in secure memory. This command should be run right after @code{gcry_check_version} and not later than the command GCRYCTL_INIT_SECMEM. Note that in FIPS mode the secure memory is always used. @item GCRYCTL_SET_RANDOM_SEED_FILE; Arguments: const char *filename This command specifies the file, which is to be used as seed file for the PRNG. If the seed file is registered prior to initialization of the PRNG, the seed file's content (if it exists and seems to be valid) is fed into the PRNG pool. After the seed file has been registered, the PRNG can be signalled to write out the PRNG pool's content into the seed file with the following command. @item GCRYCTL_UPDATE_RANDOM_SEED_FILE; Arguments: none Write out the PRNG pool's content into the registered seed file. Multiple instances of the applications sharing the same random seed file can be started in parallel, in which case they will read out the same pool and then race for updating it (the last update overwrites earlier updates). They will differentiate only by the weak entropy that is added in read_seed_file based on the PID and clock, and up to 16 bytes of weak random non-blockingly. The consequence is that the output of these different instances is correlated to some extent. In a perfect attack scenario, the attacker can control (or at least guess) the PID and clock of the application, and drain the system's entropy pool to reduce the "up to 16 bytes" above to 0. Then the dependencies of the inital states of the pools are completely known. Note that this is not an issue if random of @code{GCRY_VERY_STRONG_RANDOM} quality is requested as in this case enough extra entropy gets mixed. It is also not an issue when using Linux (rndlinux driver), because this one guarantees to read full 16 bytes from /dev/urandom and thus there is no way for an attacker without kernel access to control these 16 bytes. @item GCRYCTL_SET_VERBOSITY; Arguments: int level This command sets the verbosity of the logging. A level of 0 disables all extra logging whereas positive numbers enable more verbose logging. The level may be changed at any time but be aware that no memory synchronization is done so the effect of this command might not immediately show up in other threads. This command may even be used prior to @code{gcry_check_version}. @item GCRYCTL_SET_DEBUG_FLAGS; Arguments: unsigned int flags Set the debug flag bits as given by the argument. Be aware that that no memory synchronization is done so the effect of this command might not immediately show up in other threads. The debug flags are not considered part of the API and thus may change without notice. As of now bit 0 enables debugging of cipher functions and bit 1 debugging of multi-precision-integers. This command may even be used prior to @code{gcry_check_version}. @item GCRYCTL_CLEAR_DEBUG_FLAGS; Arguments: unsigned int flags Set the debug flag bits as given by the argument. Be aware that that no memory synchronization is done so the effect of this command might not immediately show up in other threads. This command may even be used prior to @code{gcry_check_version}. @item GCRYCTL_DISABLE_INTERNAL_LOCKING; Arguments: none This command does nothing. It exists only for backward compatibility. @item GCRYCTL_ANY_INITIALIZATION_P; Arguments: none This command returns true if the library has been basically initialized. Such a basic initialization happens implicitly with many commands to get certain internal subsystems running. The common and suggested way to do this basic intialization is by calling gcry_check_version. @item GCRYCTL_INITIALIZATION_FINISHED; Arguments: none This command tells the libray that the application has finished the intialization. @item GCRYCTL_INITIALIZATION_FINISHED_P; Arguments: none This command returns true if the command@* GCRYCTL_INITIALIZATION_FINISHED has already been run. @item GCRYCTL_SET_THREAD_CBS; Arguments: struct ath_ops *ath_ops This command registers a thread-callback structure. @xref{Multi-Threading}. @item GCRYCTL_FAST_POLL; Arguments: none Run a fast random poll. @item GCRYCTL_SET_RNDEGD_SOCKET; Arguments: const char *filename This command may be used to override the default name of the EGD socket to connect to. It may be used only during initialization as it is not thread safe. Changing the socket name again is not supported. The function may return an error if the given filename is too long for a local socket name. EGD is an alternative random gatherer, used only on systems lacking a proper random device. @item GCRYCTL_PRINT_CONFIG; Arguments: FILE *stream This command dumps information pertaining to the configuration of the library to the given stream. If NULL is given for @var{stream}, the log system is used. This command may be used before the intialization has been finished but not before a gcry_version_check. @item GCRYCTL_OPERATIONAL_P; Arguments: none This command returns true if the library is in an operational state. This information makes only sense in FIPS mode. In contrast to other functions, this is a pure test function and won't put the library into FIPS mode or change the internal state. This command may be used before the intialization has been finished but not before a gcry_version_check. @item GCRYCTL_FIPS_MODE_P; Arguments: none This command returns true if the library is in FIPS mode. Note, that this is no indication about the current state of the library. This command may be used before the intialization has been finished but not before a gcry_version_check. An application may use this command or the convenience macro below to check whether FIPS mode is actually active. @deftypefun int gcry_fips_mode_active (void) Returns true if the FIPS mode is active. Note that this is implemented as a macro. @end deftypefun @item GCRYCTL_FORCE_FIPS_MODE; Arguments: none Running this command puts the library into FIPS mode. If the library is already in FIPS mode, a self-test is triggered and thus the library will be put into operational state. This command may be used before a call to gcry_check_version and that is actually the recommended way to let an application switch the library into FIPS mode. Note that Libgcrypt will reject an attempt to switch to fips mode during or after the intialization. @item GCRYCTL_SELFTEST; Arguments: none This may be used at anytime to have the library run all implemented self-tests. It works in standard and in FIPS mode. Returns 0 on success or an error code on failure. @end table @end deftypefun @node Modules @section Modules Libgcrypt supports the use of `extension modules', which implement algorithms in addition to those already built into the library directly. @deftp {Data type} gcry_module_t This data type represents a `module'. @end deftp Functions registering modules provided by the user take a `module specification structure' as input and return a value of @code{gcry_module_t} and an ID that is unique in the modules' category. This ID can be used to reference the newly registered module. After registering a module successfully, the new functionality should be able to be used through the normal functions provided by Libgcrypt until it is unregistered again. @c ********************************************************** @c ******************* Errors **************************** @c ********************************************************** @node Error Handling @section Error Handling Many functions in Libgcrypt can return an error if they fail. For this reason, the application should always catch the error condition and take appropriate measures, for example by releasing the resources and passing the error up to the caller, or by displaying a descriptive message to the user and cancelling the operation. Some error values do not indicate a system error or an error in the operation, but the result of an operation that failed properly. For example, if you try to decrypt a tempered message, the decryption will fail. Another error value actually means that the end of a data buffer or list has been reached. The following descriptions explain for many error codes what they mean usually. Some error values have specific meanings if returned by a certain functions. Such cases are described in the documentation of those functions. Libgcrypt uses the @code{libgpg-error} library. This allows to share the error codes with other components of the GnuPG system, and to pass error values transparently from the crypto engine, or some helper application of the crypto engine, to the user. This way no information is lost. As a consequence, Libgcrypt does not use its own identifiers for error codes, but uses those provided by @code{libgpg-error}. They usually start with @code{GPG_ERR_}. However, Libgcrypt does provide aliases for the functions defined in libgpg-error, which might be preferred for name space consistency. Most functions in Libgcrypt return an error code in the case of failure. For this reason, the application should always catch the error condition and take appropriate measures, for example by releasing the resources and passing the error up to the caller, or by displaying a descriptive message to the user and canceling the operation. Some error values do not indicate a system error or an error in the operation, but the result of an operation that failed properly. GnuPG components, including Libgcrypt, use an extra library named libgpg-error to provide a common error handling scheme. For more information on libgpg-error, see the according manual. @menu * Error Values:: The error value and what it means. * Error Sources:: A list of important error sources. * Error Codes:: A list of important error codes. * Error Strings:: How to get a descriptive string from a value. @end menu @node Error Values @subsection Error Values @cindex error values @cindex error codes @cindex error sources @deftp {Data type} {gcry_err_code_t} The @code{gcry_err_code_t} type is an alias for the @code{libgpg-error} type @code{gpg_err_code_t}. The error code indicates the type of an error, or the reason why an operation failed. A list of important error codes can be found in the next section. @end deftp @deftp {Data type} {gcry_err_source_t} The @code{gcry_err_source_t} type is an alias for the @code{libgpg-error} type @code{gpg_err_source_t}. The error source has not a precisely defined meaning. Sometimes it is the place where the error happened, sometimes it is the place where an error was encoded into an error value. Usually the error source will give an indication to where to look for the problem. This is not always true, but it is attempted to achieve this goal. A list of important error sources can be found in the next section. @end deftp @deftp {Data type} {gcry_error_t} The @code{gcry_error_t} type is an alias for the @code{libgpg-error} type @code{gpg_error_t}. An error value like this has always two components, an error code and an error source. Both together form the error value. Thus, the error value can not be directly compared against an error code, but the accessor functions described below must be used. However, it is guaranteed that only 0 is used to indicate success (@code{GPG_ERR_NO_ERROR}), and that in this case all other parts of the error value are set to 0, too. Note that in Libgcrypt, the error source is used purely for diagnostic purposes. Only the error code should be checked to test for a certain outcome of a function. The manual only documents the error code part of an error value. The error source is left unspecified and might be anything. @end deftp @deftypefun {gcry_err_code_t} gcry_err_code (@w{gcry_error_t @var{err}}) The static inline function @code{gcry_err_code} returns the @code{gcry_err_code_t} component of the error value @var{err}. This function must be used to extract the error code from an error value in order to compare it with the @code{GPG_ERR_*} error code macros. @end deftypefun @deftypefun {gcry_err_source_t} gcry_err_source (@w{gcry_error_t @var{err}}) The static inline function @code{gcry_err_source} returns the @code{gcry_err_source_t} component of the error value @var{err}. This function must be used to extract the error source from an error value in order to compare it with the @code{GPG_ERR_SOURCE_*} error source macros. @end deftypefun @deftypefun {gcry_error_t} gcry_err_make (@w{gcry_err_source_t @var{source}}, @w{gcry_err_code_t @var{code}}) The static inline function @code{gcry_err_make} returns the error value consisting of the error source @var{source} and the error code @var{code}. This function can be used in callback functions to construct an error value to return it to the library. @end deftypefun @deftypefun {gcry_error_t} gcry_error (@w{gcry_err_code_t @var{code}}) The static inline function @code{gcry_error} returns the error value consisting of the default error source and the error code @var{code}. For @acronym{GCRY} applications, the default error source is @code{GPG_ERR_SOURCE_USER_1}. You can define @code{GCRY_ERR_SOURCE_DEFAULT} before including @file{gcrypt.h} to change this default. This function can be used in callback functions to construct an error value to return it to the library. @end deftypefun The @code{libgpg-error} library provides error codes for all system error numbers it knows about. If @var{err} is an unknown error number, the error code @code{GPG_ERR_UNKNOWN_ERRNO} is used. The following functions can be used to construct error values from system errno numbers. @deftypefun {gcry_error_t} gcry_err_make_from_errno (@w{gcry_err_source_t @var{source}}, @w{int @var{err}}) The function @code{gcry_err_make_from_errno} is like @code{gcry_err_make}, but it takes a system error like @code{errno} instead of a @code{gcry_err_code_t} error code. @end deftypefun @deftypefun {gcry_error_t} gcry_error_from_errno (@w{int @var{err}}) The function @code{gcry_error_from_errno} is like @code{gcry_error}, but it takes a system error like @code{errno} instead of a @code{gcry_err_code_t} error code. @end deftypefun Sometimes you might want to map system error numbers to error codes directly, or map an error code representing a system error back to the system error number. The following functions can be used to do that. @deftypefun {gcry_err_code_t} gcry_err_code_from_errno (@w{int @var{err}}) The function @code{gcry_err_code_from_errno} returns the error code for the system error @var{err}. If @var{err} is not a known system error, the function returns @code{GPG_ERR_UNKNOWN_ERRNO}. @end deftypefun @deftypefun {int} gcry_err_code_to_errno (@w{gcry_err_code_t @var{err}}) The function @code{gcry_err_code_to_errno} returns the system error for the error code @var{err}. If @var{err} is not an error code representing a system error, or if this system error is not defined on this system, the function returns @code{0}. @end deftypefun @node Error Sources @subsection Error Sources @cindex error codes, list of The library @code{libgpg-error} defines an error source for every component of the GnuPG system. The error source part of an error value is not well defined. As such it is mainly useful to improve the diagnostic error message for the user. If the error code part of an error value is @code{0}, the whole error value will be @code{0}. In this case the error source part is of course @code{GPG_ERR_SOURCE_UNKNOWN}. The list of error sources that might occur in applications using @acronym{Libgcrypt} is: @table @code @item GPG_ERR_SOURCE_UNKNOWN The error source is not known. The value of this error source is @code{0}. @item GPG_ERR_SOURCE_GPGME The error source is @acronym{GPGME} itself. @item GPG_ERR_SOURCE_GPG The error source is GnuPG, which is the crypto engine used for the OpenPGP protocol. @item GPG_ERR_SOURCE_GPGSM The error source is GPGSM, which is the crypto engine used for the OpenPGP protocol. @item GPG_ERR_SOURCE_GCRYPT The error source is @code{libgcrypt}, which is used by crypto engines to perform cryptographic operations. @item GPG_ERR_SOURCE_GPGAGENT The error source is @command{gpg-agent}, which is used by crypto engines to perform operations with the secret key. @item GPG_ERR_SOURCE_PINENTRY The error source is @command{pinentry}, which is used by @command{gpg-agent} to query the passphrase to unlock a secret key. @item GPG_ERR_SOURCE_SCD The error source is the SmartCard Daemon, which is used by @command{gpg-agent} to delegate operations with the secret key to a SmartCard. @item GPG_ERR_SOURCE_KEYBOX The error source is @code{libkbx}, a library used by the crypto engines to manage local keyrings. @item GPG_ERR_SOURCE_USER_1 @item GPG_ERR_SOURCE_USER_2 @item GPG_ERR_SOURCE_USER_3 @item GPG_ERR_SOURCE_USER_4 These error sources are not used by any GnuPG component and can be used by other software. For example, applications using Libgcrypt can use them to mark error values coming from callback handlers. Thus @code{GPG_ERR_SOURCE_USER_1} is the default for errors created with @code{gcry_error} and @code{gcry_error_from_errno}, unless you define @code{GCRY_ERR_SOURCE_DEFAULT} before including @file{gcrypt.h}. @end table @node Error Codes @subsection Error Codes @cindex error codes, list of The library @code{libgpg-error} defines many error values. The following list includes the most important error codes. @table @code @item GPG_ERR_EOF This value indicates the end of a list, buffer or file. @item GPG_ERR_NO_ERROR This value indicates success. The value of this error code is @code{0}. Also, it is guaranteed that an error value made from the error code @code{0} will be @code{0} itself (as a whole). This means that the error source information is lost for this error code, however, as this error code indicates that no error occurred, this is generally not a problem. @item GPG_ERR_GENERAL This value means that something went wrong, but either there is not enough information about the problem to return a more useful error value, or there is no separate error value for this type of problem. @item GPG_ERR_ENOMEM This value means that an out-of-memory condition occurred. @item GPG_ERR_E... System errors are mapped to GPG_ERR_EFOO where FOO is the symbol for the system error. @item GPG_ERR_INV_VALUE This value means that some user provided data was out of range. @item GPG_ERR_UNUSABLE_PUBKEY This value means that some recipients for a message were invalid. @item GPG_ERR_UNUSABLE_SECKEY This value means that some signers were invalid. @item GPG_ERR_NO_DATA This value means that data was expected where no data was found. @item GPG_ERR_CONFLICT This value means that a conflict of some sort occurred. @item GPG_ERR_NOT_IMPLEMENTED This value indicates that the specific function (or operation) is not implemented. This error should never happen. It can only occur if you use certain values or configuration options which do not work, but for which we think that they should work at some later time. @item GPG_ERR_DECRYPT_FAILED This value indicates that a decryption operation was unsuccessful. @item GPG_ERR_WRONG_KEY_USAGE This value indicates that a key is not used appropriately. @item GPG_ERR_NO_SECKEY This value indicates that no secret key for the user ID is available. @item GPG_ERR_UNSUPPORTED_ALGORITHM This value means a verification failed because the cryptographic algorithm is not supported by the crypto backend. @item GPG_ERR_BAD_SIGNATURE This value means a verification failed because the signature is bad. @item GPG_ERR_NO_PUBKEY This value means a verification failed because the public key is not available. @item GPG_ERR_NOT_OPERATIONAL This value means that the library is not yet in state which allows to use this function. This error code is in particular returned if Libgcrypt is operated in FIPS mode and the internal state of the library does not yet or not anymore allow the use of a service. This error code is only available with newer libgpg-error versions, thus you might see ``invalid error code'' when passing this to @code{gpg_strerror}. The numeric value of this error code is 176. @item GPG_ERR_USER_1 @item GPG_ERR_USER_2 @item ... @item GPG_ERR_USER_16 These error codes are not used by any GnuPG component and can be freely used by other software. Applications using Libgcrypt might use them to mark specific errors returned by callback handlers if no suitable error codes (including the system errors) for these errors exist already. @end table @node Error Strings @subsection Error Strings @cindex error values, printing of @cindex error codes, printing of @cindex error sources, printing of @cindex error strings @deftypefun {const char *} gcry_strerror (@w{gcry_error_t @var{err}}) The function @code{gcry_strerror} returns a pointer to a statically allocated string containing a description of the error code contained in the error value @var{err}. This string can be used to output a diagnostic message to the user. @end deftypefun @deftypefun {const char *} gcry_strsource (@w{gcry_error_t @var{err}}) The function @code{gcry_strerror} returns a pointer to a statically allocated string containing a description of the error source contained in the error value @var{err}. This string can be used to output a diagnostic message to the user. @end deftypefun The following example illustrates the use of the functions described above: @example @{ gcry_cipher_hd_t handle; gcry_error_t err = 0; err = gcry_cipher_open (&handle, GCRY_CIPHER_AES, GCRY_CIPHER_MODE_CBC, 0); if (err) @{ fprintf (stderr, "Failure: %s/%s\n", gcry_strsource (err), gcry_strerror (err)); @} @} @end example @c ********************************************************** @c ******************* General **************************** @c ********************************************************** @node Handler Functions @chapter Handler Functions Libgcrypt makes it possible to install so called `handler functions', which get called by Libgcrypt in case of certain events. @menu * Progress handler:: Using a progress handler function. * Allocation handler:: Using special memory allocation functions. * Error handler:: Using error handler functions. * Logging handler:: Using a special logging function. @end menu @node Progress handler @section Progress handler It is often useful to retrieve some feedback while long running operations are performed. @deftp {Data type} gcry_handler_progress_t Progress handler functions have to be of the type @code{gcry_handler_progress_t}, which is defined as: @code{void (*gcry_handler_progress_t) (void *, const char *, int, int, int)} @end deftp The following function may be used to register a handler function for this purpose. @deftypefun void gcry_set_progress_handler (gcry_handler_progress_t @var{cb}, void *@var{cb_data}) This function installs @var{cb} as the `Progress handler' function. @var{cb} must be defined as follows: @example void my_progress_handler (void *@var{cb_data}, const char *@var{what}, int @var{printchar}, int @var{current}, int @var{total}) @{ /* Do something. */ @} @end example A description of the arguments of the progress handler function follows. @table @var @item cb_data The argument provided in the call to @code{gcry_set_progress_handler}. @item what A string identifying the type of the progress output. The following values for @var{what} are defined: @table @code @item need_entropy Not enough entropy is available. @var{total} holds the number of required bytes. @item primegen Values for @var{printchar}: @table @code @item \n Prime generated. @item ! Need to refresh the pool of prime numbers. @item <, > Number of bits adjusted. @item ^ Searching for a generator. @item . Fermat test on 10 candidates failed. @item : Restart with a new random value. @item + Rabin Miller test passed. @end table @end table @end table @end deftypefun @node Allocation handler @section Allocation handler It is possible to make Libgcrypt use special memory allocation functions instead of the built-in ones. Memory allocation functions are of the following types: @deftp {Data type} gcry_handler_alloc_t This type is defined as: @code{void *(*gcry_handler_alloc_t) (size_t n)}. @end deftp @deftp {Data type} gcry_handler_secure_check_t This type is defined as: @code{int *(*gcry_handler_secure_check_t) (const void *)}. @end deftp @deftp {Data type} gcry_handler_realloc_t This type is defined as: @code{void *(*gcry_handler_realloc_t) (void *p, size_t n)}. @end deftp @deftp {Data type} gcry_handler_free_t This type is defined as: @code{void *(*gcry_handler_free_t) (void *)}. @end deftp Special memory allocation functions can be installed with the following function: @deftypefun void gcry_set_allocation_handler (gcry_handler_alloc_t @var{func_alloc}, gcry_handler_alloc_t @var{func_alloc_secure}, gcry_handler_secure_check_t @var{func_secure_check}, gcry_handler_realloc_t @var{func_realloc}, gcry_handler_free_t @var{func_free}) Install the provided functions and use them instead of the built-in functions for doing memory allocation. @end deftypefun @node Error handler @section Error handler The following functions may be used to register handler functions that are called by Libgcrypt in case certain error conditions occur. They may and should be registered prior to calling @code{gcry_check_version}. @deftp {Data type} gcry_handler_no_mem_t This type is defined as: @code{int (*gcry_handler_no_mem_t) (void *, size_t, unsigned int)} @end deftp @deftypefun void gcry_set_outofcore_handler (gcry_handler_no_mem_t @var{func_no_mem}, void *@var{cb_data}) This function registers @var{func_no_mem} as `out-of-core handler', which means that it will be called in the case of not having enough memory available. The handler is called with 3 arguments: The first one is the pointer @var{cb_data} as set with this function, the second is the requested memory size and the last being a flag. If bit 0 of the flag is set, secure memory has been requested. The handler should either return true to indicate that Libgcrypt should try again allocating memory or return false to let Libgcrypt use its default fatal error handler. @end deftypefun @deftp {Data type} gcry_handler_error_t This type is defined as: @code{void (*gcry_handler_error_t) (void *, int, const char *)} @end deftp @deftypefun void gcry_set_fatalerror_handler (gcry_handler_error_t @var{func_error}, void *@var{cb_data}) This function registers @var{func_error} as `error handler', which means that it will be called in error conditions. @end deftypefun @node Logging handler @section Logging handler @deftp {Data type} gcry_handler_log_t This type is defined as: @code{void (*gcry_handler_log_t) (void *, int, const char *, va_list)} @end deftp @deftypefun void gcry_set_log_handler (gcry_handler_log_t @var{func_log}, void *@var{cb_data}) This function registers @var{func_log} as `logging handler', which means that it will be called in case Libgcrypt wants to log a message. This function may and should be used prior to calling @code{gcry_check_version}. @end deftypefun @c ********************************************************** @c ******************* Ciphers **************************** @c ********************************************************** @c @include cipher-ref.texi @node Symmetric cryptography @chapter Symmetric cryptography The cipher functions are used for symmetrical cryptography, i.e. cryptography using a shared key. The programming model follows an open/process/close paradigm and is in that similar to other building blocks provided by Libgcrypt. @menu * Available ciphers:: List of ciphers supported by the library. * Cipher modules:: How to work with cipher modules. * Available cipher modes:: List of cipher modes supported by the library. * Working with cipher handles:: How to perform operations related to cipher handles. * General cipher functions:: General cipher functions independent of cipher handles. @end menu @node Available ciphers @section Available ciphers @table @code @item GCRY_CIPHER_NONE This is not a real algorithm but used by some functions as error return. The value always evaluates to false. @item GCRY_CIPHER_IDEA @cindex IDEA This is the IDEA algorithm. The constant is provided but there is currently no implementation for it because the algorithm is patented. @item GCRY_CIPHER_3DES @cindex 3DES @cindex Triple-DES @cindex DES-EDE @cindex Digital Encryption Standard Triple-DES with 3 Keys as EDE. The key size of this algorithm is 168 but you have to pass 192 bits because the most significant bits of each byte are ignored. @item GCRY_CIPHER_CAST5 @cindex CAST5 CAST128-5 block cipher algorithm. The key size is 128 bits. @item GCRY_CIPHER_BLOWFISH @cindex Blowfish The blowfish algorithm. The current implementation allows only for a key size of 128 bits. @item GCRY_CIPHER_SAFER_SK128 Reserved and not currently implemented. @item GCRY_CIPHER_DES_SK Reserved and not currently implemented. @item GCRY_CIPHER_AES @itemx GCRY_CIPHER_AES128 @itemx GCRY_CIPHER_RIJNDAEL @itemx GCRY_CIPHER_RIJNDAEL128 @cindex Rijndael @cindex AES @cindex Advanced Encryption Standard AES (Rijndael) with a 128 bit key. @item GCRY_CIPHER_AES192 @itemx GCRY_CIPHER_RIJNDAEL192 AES (Rijndael) with a 192 bit key. @item GCRY_CIPHER_AES256 @itemx GCRY_CIPHER_RIJNDAEL256 AES (Rijndael) with a 256 bit key. @item GCRY_CIPHER_TWOFISH @cindex Twofish The Twofish algorithm with a 256 bit key. @item GCRY_CIPHER_TWOFISH128 The Twofish algorithm with a 128 bit key. @item GCRY_CIPHER_ARCFOUR @cindex Arcfour @cindex RC4 An algorithm which is 100% compatible with RSA Inc.'s RC4 algorithm. Note that this is a stream cipher and must be used very carefully to avoid a couple of weaknesses. @item GCRY_CIPHER_DES @cindex DES Standard DES with a 56 bit key. You need to pass 64 bit but the high bits of each byte are ignored. Note, that this is a weak algorithm which can be broken in reasonable time using a brute force approach. @item GCRY_CIPHER_SERPENT128 @itemx GCRY_CIPHER_SERPENT192 @itemx GCRY_CIPHER_SERPENT256 @cindex Serpent The Serpent cipher from the AES contest. @item GCRY_CIPHER_RFC2268_40 @itemx GCRY_CIPHER_RFC2268_128 @cindex rfc-2268 @cindex RC2 Ron's Cipher 2 in the 40 and 128 bit variants. Note, that we currently only support the 40 bit variant. The identifier for 128 is reserved for future use. @item GCRY_CIPHER_SEED @cindex Seed (cipher) A 128 bit cipher as described by RFC4269. @item GCRY_CIPHER_CAMELLIA128 @itemx GCRY_CIPHER_CAMELLIA192 @itemx GCRY_CIPHER_CAMELLIA256 @cindex Camellia The Camellia cipher by NTT. See @uref{http://info.isl.ntt.co.jp/@/crypt/@/eng/@/camellia/@/specifications.html}. @end table @node Cipher modules @section Cipher modules Libgcrypt makes it possible to load additional `cipher modules'; these ciphers can be used just like the cipher algorithms that are built into the library directly. For an introduction into extension modules, see @xref{Modules}. @deftp {Data type} gcry_cipher_spec_t This is the `module specification structure' needed for registering cipher modules, which has to be filled in by the user before it can be used to register a module. It contains the following members: @table @code @item const char *name The primary name of the algorithm. @item const char **aliases A list of strings that are `aliases' for the algorithm. The list must be terminated with a NULL element. @item gcry_cipher_oid_spec_t *oids A list of OIDs that are to be associated with the algorithm. The list's last element must have it's `oid' member set to NULL. See below for an explanation of this type. @item size_t blocksize The block size of the algorithm, in bytes. @item size_t keylen The length of the key, in bits. @item size_t contextsize The size of the algorithm-specific `context', that should be allocated for each handle. @item gcry_cipher_setkey_t setkey The function responsible for initializing a handle with a provided key. See below for a description of this type. @item gcry_cipher_encrypt_t encrypt The function responsible for encrypting a single block. See below for a description of this type. @item gcry_cipher_decrypt_t decrypt The function responsible for decrypting a single block. See below for a description of this type. @item gcry_cipher_stencrypt_t stencrypt Like `encrypt', for stream ciphers. See below for a description of this type. @item gcry_cipher_stdecrypt_t stdecrypt Like `decrypt', for stream ciphers. See below for a description of this type. @end table @end deftp @deftp {Data type} gcry_cipher_oid_spec_t This type is used for associating a user-provided algorithm implementation with certain OIDs. It contains the following members: @table @code @item const char *oid Textual representation of the OID. @item int mode Cipher mode for which this OID is valid. @end table @end deftp @deftp {Data type} gcry_cipher_setkey_t Type for the `setkey' function, defined as: gcry_err_code_t (*gcry_cipher_setkey_t) (void *c, const unsigned char *key, unsigned keylen) @end deftp @deftp {Data type} gcry_cipher_encrypt_t Type for the `encrypt' function, defined as: gcry_err_code_t (*gcry_cipher_encrypt_t) (void *c, const unsigned char *outbuf, const unsigned char *inbuf) @end deftp @deftp {Data type} gcry_cipher_decrypt_t Type for the `decrypt' function, defined as: gcry_err_code_t (*gcry_cipher_decrypt_t) (void *c, const unsigned char *outbuf, const unsigned char *inbuf) @end deftp @deftp {Data type} gcry_cipher_stencrypt_t Type for the `stencrypt' function, defined as: gcry_err_code_t (*gcry_@/cipher_@/stencrypt_@/t) (void *c, const unsigned char *outbuf, const unsigned char *, unsigned int n) @end deftp @deftp {Data type} gcry_cipher_stdecrypt_t Type for the `stdecrypt' function, defined as: gcry_err_code_t (*gcry_@/cipher_@/stdecrypt_@/t) (void *c, const unsigned char *outbuf, const unsigned char *, unsigned int n) @end deftp @deftypefun gcry_error_t gcry_cipher_register (gcry_cipher_spec_t *@var{cipher}, unsigned int *algorithm_id, gcry_module_t *@var{module}) Register a new cipher module whose specification can be found in @var{cipher}. On success, a new algorithm ID is stored in @var{algorithm_id} and a pointer representing this module is stored in @var{module}. @end deftypefun @deftypefun void gcry_cipher_unregister (gcry_module_t @var{module}) Unregister the cipher identified by @var{module}, which must have been registered with gcry_cipher_register. @end deftypefun @deftypefun gcry_error_t gcry_cipher_list (int *@var{list}, int *@var{list_length}) Get a list consisting of the IDs of the loaded cipher modules. If @var{list} is zero, write the number of loaded cipher modules to @var{list_length} and return. If @var{list} is non-zero, the first *@var{list_length} algorithm IDs are stored in @var{list}, which must be of according size. In case there are less cipher modules than *@var{list_length}, *@var{list_length} is updated to the correct number. @end deftypefun @node Available cipher modes @section Available cipher modes @table @code @item GCRY_CIPHER_MODE_NONE No mode specified. This should not be used. The only exception is that if Libgcrypt is not used in FIPS mode and if any debug flag has been set, this mode may be used to bypass the actual encryption. @item GCRY_CIPHER_MODE_ECB @cindex ECB, Electronic Codebook mode Electronic Codebook mode. @item GCRY_CIPHER_MODE_CFB @cindex CFB, Cipher Feedback mode Cipher Feedback mode. The shift size equals the block size of the cipher (e.g. for AES it is CFB-128). @item GCRY_CIPHER_MODE_CBC @cindex CBC, Cipher Block Chaining mode Cipher Block Chaining mode. @item GCRY_CIPHER_MODE_STREAM Stream mode, only to be used with stream cipher algorithms. @item GCRY_CIPHER_MODE_OFB @cindex OFB, Output Feedback mode Output Feedback mode. @item GCRY_CIPHER_MODE_CTR @cindex CTR, Counter mode Counter mode. @end table @node Working with cipher handles @section Working with cipher handles To use a cipher algorithm, you must first allocate an according handle. This is to be done using the open function: @deftypefun gcry_error_t gcry_cipher_open (gcry_cipher_hd_t *@var{hd}, int @var{algo}, int @var{mode}, unsigned int @var{flags}) This function creates the context handle required for most of the other cipher functions and returns a handle to it in `hd'. In case of an error, an according error code is returned. The ID of algorithm to use must be specified via @var{algo}. See @xref{Available ciphers}, for a list of supported ciphers and the according constants. Besides using the constants directly, the function @code{gcry_cipher_map_name} may be used to convert the textual name of an algorithm into the according numeric ID. The cipher mode to use must be specified via @var{mode}. See @xref{Available cipher modes}, for a list of supported cipher modes and the according constants. Note that some modes are incompatible with some algorithms - in particular, stream mode (@code{GCRY_CIPHER_MODE_STREAM}) only works with stream ciphers. Any block cipher mode (@code{GCRY_CIPHER_MODE_ECB}, @code{GCRY_CIPHER_MODE_CBC}, @code{GCRY_CIPHER_MODE_CFB}, @code{GCRY_CIPHER_MODE_OFB} or @code{GCRY_CIPHER_MODE_CTR}) will work with any block cipher algorithm. The third argument @var{flags} can either be passed as @code{0} or as the bit-wise OR of the following constants. @table @code @item GCRY_CIPHER_SECURE Make sure that all operations are allocated in secure memory. This is useful when the key material is highly confidential. @item GCRY_CIPHER_ENABLE_SYNC @cindex sync mode (OpenPGP) This flag enables the CFB sync mode, which is a special feature of Libgcrypt's CFB mode implementation to allow for OpenPGP's CFB variant. See @code{gcry_cipher_sync}. @item GCRY_CIPHER_CBC_CTS @cindex cipher text stealing Enable cipher text stealing (CTS) for the CBC mode. Cannot be used simultaneous as GCRY_CIPHER_CBC_MAC. CTS mode makes it possible to transform data of almost arbitrary size (only limitation is that it must be greater than the algorithm's block size). @item GCRY_CIPHER_CBC_MAC @cindex CBC-MAC Compute CBC-MAC keyed checksums. This is the same as CBC mode, but only output the last block. Cannot be used simultaneous as GCRY_CIPHER_CBC_CTS. @end table @end deftypefun Use the following function to release an existing handle: @deftypefun void gcry_cipher_close (gcry_cipher_hd_t @var{h}) This function releases the context created by @code{gcry_cipher_open}. @end deftypefun In order to use a handle for performing cryptographic operations, a `key' has to be set first: @deftypefun gcry_error_t gcry_cipher_setkey (gcry_cipher_hd_t @var{h}, const void *@var{k}, size_t @var{l}) Set the key @var{k} used for encryption or decryption in the context denoted by the handle @var{h}. The length @var{l} of the key @var{k} must match the required length of the algorithm set for this context or be in the allowed range for algorithms with variable key size. The function checks this and returns an error if there is a problem. A caller should always check for an error. @end deftypefun Most crypto modes requires an initialization vector (IV), which usually is a non-secret random string acting as a kind of salt value. The CTR mode requires a counter, which is also similar to a salt value. To set the IV or CTR, use these functions: @deftypefun gcry_error_t gcry_cipher_setiv (gcry_cipher_hd_t @var{h}, const void *@var{k}, size_t @var{l}) Set the initialization vector used for encryption or decryption. The vector is passed as the buffer @var{K} of length @var{l} and copied to internal data structures. The function checks that the IV matches the requirement of the selected algorithm and mode. @end deftypefun @deftypefun gcry_error_t gcry_cipher_setctr (gcry_cipher_hd_t @var{h}, const void *@var{c}, size_t @var{l}) Set the counter vector used for encryption or decryption. The counter is passed as the buffer @var{c} of length @var{l} and copied to internal data structures. The function checks that the counter matches the requirement of the selected algorithm (i.e., it must be the same size as the block size). @end deftypefun @deftypefun gcry_error_t gcry_cipher_reset (gcry_cipher_hd_t @var{h}) Set the given handle's context back to the state it had after the last call to gcry_cipher_setkey and clear the initialization vector. Note that gcry_cipher_reset is implemented as a macro. @end deftypefun The actual encryption and decryption is done by using one of the following functions. They may be used as often as required to process all the data. @deftypefun gcry_error_t gcry_cipher_encrypt (gcry_cipher_hd_t @var{h}, unsigned char *{out}, size_t @var{outsize}, const unsigned char *@var{in}, size_t @var{inlen}) @code{gcry_cipher_encrypt} is used to encrypt the data. This function can either work in place or with two buffers. It uses the cipher context already setup and described by the handle @var{h}. There are 2 ways to use the function: If @var{in} is passed as @code{NULL} and @var{inlen} is @code{0}, in-place encryption of the data in @var{out} or length @var{outsize} takes place. With @var{in} being not @code{NULL}, @var{inlen} bytes are encrypted to the buffer @var{out} which must have at least a size of @var{inlen}. @var{outsize} must be set to the allocated size of @var{out}, so that the function can check that there is sufficient space. Note that overlapping buffers are not allowed. Depending on the selected algorithms and encryption mode, the length of the buffers must be a multiple of the block size. The function returns @code{0} on success or an error code. @end deftypefun @deftypefun gcry_error_t gcry_cipher_decrypt (gcry_cipher_hd_t @var{h}, unsigned char *{out}, size_t @var{outsize}, const unsigned char *@var{in}, size_t @var{inlen}) @code{gcry_cipher_decrypt} is used to decrypt the data. This function can either work in place or with two buffers. It uses the cipher context already setup and described by the handle @var{h}. There are 2 ways to use the function: If @var{in} is passed as @code{NULL} and @var{inlen} is @code{0}, in-place decryption of the data in @var{out} or length @var{outsize} takes place. With @var{in} being not @code{NULL}, @var{inlen} bytes are decrypted to the buffer @var{out} which must have at least a size of @var{inlen}. @var{outsize} must be set to the allocated size of @var{out}, so that the function can check that there is sufficient space. Note that overlapping buffers are not allowed. Depending on the selected algorithms and encryption mode, the length of the buffers must be a multiple of the block size. The function returns @code{0} on success or an error code. @end deftypefun OpenPGP (as defined in RFC-2440) requires a special sync operation in some places. The following function is used for this: @deftypefun gcry_error_t gcry_cipher_sync (gcry_cipher_hd_t @var{h}) Perform the OpenPGP sync operation on context @var{h}. Note that this is a no-op unless the context was created with the flag @code{GCRY_CIPHER_ENABLE_SYNC} @end deftypefun Some of the described functions are implemented as macros utilizing a catch-all control function. This control function is rarely used directly but there is nothing which would inhibit it: @deftypefun gcry_error_t gcry_cipher_ctl (gcry_cipher_hd_t @var{h}, int @var{cmd}, void *@var{buffer}, size_t @var{buflen}) @code{gcry_cipher_ctl} controls various aspects of the cipher module and specific cipher contexts. Usually some more specialized functions or macros are used for this purpose. The semantics of the function and its parameters depends on the the command @var{cmd} and the passed context handle @var{h}. Please see the comments in the source code (@code{src/global.c}) for details. @end deftypefun @deftypefun gcry_error_t gcry_cipher_info (gcry_cipher_hd_t @var{h}, int @var{what}, void *@var{buffer}, size_t *@var{nbytes}) @code{gcry_cipher_info} is used to retrieve various information about a cipher context or the cipher module in general. Currently no information is available. @end deftypefun @node General cipher functions @section General cipher functions To work with the algorithms, several functions are available to map algorithm names to the internal identifiers, as well as ways to retrieve information about an algorithm or the current cipher context. @deftypefun gcry_error_t gcry_cipher_algo_info (int @var{algo}, int @var{what}, void *@var{buffer}, size_t *@var{nbytes}) This function is used to retrieve information on a specific algorithm. You pass the cipher algorithm ID as @var{algo} and the type of information requested as @var{what}. The result is either returned as the return code of the function or copied to the provided @var{buffer} whose allocated length must be available in an integer variable with the address passed in @var{nbytes}. This variable will also receive the actual used length of the buffer. Here is a list of supported codes for @var{what}: @c begin constants for gcry_cipher_algo_info @table @code @item GCRYCTL_GET_KEYLEN: Return the length of the key. If the algorithm supports multiple key lengths, the maximum supported value is returned. The length is returned as number of octets (bytes) and not as number of bits in @var{nbytes}; @var{buffer} must be zero. @item GCRYCTL_GET_BLKLEN: Return the block length of the algorithm. The length is returned as a number of octets in @var{nbytes}; @var{buffer} must be zero. @item GCRYCTL_TEST_ALGO: Returns @code{0} when the specified algorithm is available for use. @var{buffer} and @var{nbytes} must be zero. @end table @c end constants for gcry_cipher_algo_info @end deftypefun @c end gcry_cipher_algo_info @deftypefun {const char *} gcry_cipher_algo_name (int @var{algo}) @code{gcry_cipher_algo_name} returns a string with the name of the cipher algorithm @var{algo}. If the algorithm is not known or another error occurred, the string @code{"?"} is returned. This function should not be used to test for the availability of an algorithm. @end deftypefun @deftypefun int gcry_cipher_map_name (const char *@var{name}) @code{gcry_cipher_map_name} returns the algorithm identifier for the cipher algorithm described by the string @var{name}. If this algorithm is not available @code{0} is returned. @end deftypefun @deftypefun int gcry_cipher_mode_from_oid (const char *@var{string}) Return the cipher mode associated with an @acronym{ASN.1} object identifier. The object identifier is expected to be in the @acronym{IETF}-style dotted decimal notation. The function returns @code{0} for an unknown object identifier or when no mode is associated with it. @end deftypefun @c ********************************************************** @c ******************* Public Key ************************* @c ********************************************************** @node Public Key cryptography @chapter Public Key cryptography Public key cryptography, also known as asymmetric cryptography, is an easy way for key management and to provide digital signatures. Libgcrypt provides two completely different interfaces to public key cryptography, this chapter explains the one based on S-expressions. @menu * Available algorithms:: Algorithms supported by the library. * Used S-expressions:: Introduction into the used S-expression. * Public key modules:: How to work with public key modules. * Cryptographic Functions:: Functions for performing the cryptographic actions. * General public-key related Functions:: General functions, not implementing any cryptography. * AC Interface:: Alternative interface to public key functions. @end menu @node Available algorithms @section Available algorithms Libgcrypt supports the RSA (Rivest-Shamir-Adleman) algorithms as well as DSA (Digital Signature Algorithm) and Elgamal. The versatile interface allows to add more algorithms in the future. @node Used S-expressions @section Used S-expressions Libgcrypt's API for asymmetric cryptography is based on data structures called S-expressions (see @uref{http://people.csail.mit.edu/@/rivest/@/sexp.html}) and does not work with contexts as most of the other building blocks of Libgcrypt do. @noindent The following information are stored in S-expressions: @itemize @asis @item keys @item plain text data @item encrypted data @item signatures @end itemize @noindent To describe how Libgcrypt expect keys, we use examples. Note that words in @ifnottex uppercase @end ifnottex @iftex italics @end iftex indicate parameters whereas lowercase words are literals. Note that all MPI (multi-precision-integers) values are expected to be in @code{GCRYMPI_FMT_USG} format. An easy way to create S-expressions is by using @code{gcry_sexp_build} which allows to pass a string with printf-like escapes to insert MPI values. @menu * RSA key parameters:: Parameters used with an RSA key. * DSA key parameters:: Parameters used with a DSA key. * ECC key parameters:: Parameters used with ECC keys. @end menu @node RSA key parameters @subsection RSA key parameters @noindent An RSA private key is described by this S-expression: @example (private-key (rsa (n @var{n-mpi}) (e @var{e-mpi}) (d @var{d-mpi}) (p @var{p-mpi}) (q @var{q-mpi}) (u @var{u-mpi}))) @end example @noindent An RSA public key is described by this S-expression: @example (public-key (rsa (n @var{n-mpi}) (e @var{e-mpi}))) @end example @table @var @item n-mpi RSA public modulus @math{n}. @item e-mpi RSA public exponent @math{e}. @item d-mpi RSA secret exponent @math{d = e^{-1} \bmod (p-1)(q-1)}. @item p-mpi RSA secret prime @math{p}. @item q-mpi RSA secret prime @math{q} with @math{p < q}. @item u-mpi Multiplicative inverse @math{u = p^{-1} \bmod q}. @end table For signing and decryption the parameters @math{(p, q, u)} are optional but greatly improve the performance. Either all of these optional parameters must be given or none of them. They are mandatory for gcry_pk_testkey. Note that OpenSSL uses slighly different parameters: @math{q < p} and @math{u = q^{-1} \bmod p}. To use these parameters you will need to swap the values and recompute @math{u}. Here is example code to do this: @example if (gcry_mpi_cmp (p, q) > 0) @{ gcry_mpi_swap (p, q); gcry_mpi_invm (u, p, q); @} @end example @node DSA key parameters @subsection DSA key parameters @noindent A DSA private key is described by this S-expression: @example (private-key (dsa (p @var{p-mpi}) (q @var{q-mpi}) (g @var{g-mpi}) (y @var{y-mpi}) (x @var{x-mpi}))) @end example @table @var @item p-mpi DSA prime @math{p}. @item q-mpi DSA group order @math{q} (which is a prime divisor of @math{p-1}). @item g-mpi DSA group generator @math{g}. @item y-mpi DSA public key value @math{y = g^x \bmod p}. @item x-mpi DSA secret exponent x. @end table The public key is similar with "private-key" replaced by "public-key" and no @var{x-mpi}. @node ECC key parameters @subsection ECC key parameters @noindent An ECC private key is described by this S-expression: @example (private-key (ecc (p @var{p-mpi}) (a @var{a-mpi}) (b @var{b-mpi}) (g @var{g-point}) (n @var{n-mpi}) (q @var{q-point}) (d @var{d-mpi}))) @end example @table @var @item p-mpi Prime specifying the field @math{GF(p)}. @item a-mpi @itemx b-mpi The two coefficients of the Weierstrass equation @math{y^2 = x^3 + ax + b} @item g-point Base point @math{g}. @item n-mpi Order of @math{g} @item q-point The point representing the public key @math{Q = dP}. @item d-mpi The private key @math{d} @end table All point values are encoded in standard format; Libgcrypt does currently only support uncompressed points, thus the first byte needs to be @code{0x04}. The public key is similar with "private-key" replaced by "public-key" and no @var{d-mpi}. If the domain parameters are well-known, the name of this curve may be used. For example @example (private-key (ecc (curve "NIST P-192") (q @var{q-point}) (d @var{d-mpi}))) @end example The @code{curve} parameter may be given in any case and is used to replace missing parameters. @noindent Currently implemented curves are: @table @code @item NIST P-192 @itemx 1.2.840.10045.3.1.1 @itemx prime192v1 @itemx secp192r1 The NIST 192 bit curve, its OID, X9.62 and SECP aliases. @item NIST P-224 @itemx secp224r1 The NIST 224 bit curve and its SECP alias. @item NIST P-256 @itemx 1.2.840.10045.3.1.7 @itemx prime256v1 @itemx secp256r1 The NIST 256 bit curve, its OID, X9.62 and SECP aliases. @item NIST P-384 @itemx secp384r1 The NIST 384 bit curve and its SECP alias. @item NIST P-521 @itemx secp521r1 The NIST 521 bit curve and its SECP alias. @end table As usual the OIDs may optionally be prefixed with the string @code{OID.} or @code{oid.}. @node Public key modules @section Public key modules Libgcrypt makes it possible to load additional `public key modules'; these public key algorithms can be used just like the algorithms that are built into the library directly. For an introduction into extension modules, see @xref{Modules}. @deftp {Data type} gcry_pk_spec_t This is the `module specification structure' needed for registering public key modules, which has to be filled in by the user before it can be used to register a module. It contains the following members: @table @code @item const char *name The primary name of this algorithm. @item char **aliases A list of strings that are `aliases' for the algorithm. The list must be terminated with a NULL element. @item const char *elements_pkey String containing the one-letter names of the MPI values contained in a public key. @item const char *element_skey String containing the one-letter names of the MPI values contained in a secret key. @item const char *elements_enc String containing the one-letter names of the MPI values that are the result of an encryption operation using this algorithm. @item const char *elements_sig String containing the one-letter names of the MPI values that are the result of a sign operation using this algorithm. @item const char *elements_grip String containing the one-letter names of the MPI values that are to be included in the `key grip'. @item int use The bitwise-OR of the following flags, depending on the abilities of the algorithm: @table @code @item GCRY_PK_USAGE_SIGN The algorithm supports signing and verifying of data. @item GCRY_PK_USAGE_ENCR The algorithm supports the encryption and decryption of data. @end table @item gcry_pk_generate_t generate The function responsible for generating a new key pair. See below for a description of this type. @item gcry_pk_check_secret_key_t check_secret_key The function responsible for checking the sanity of a provided secret key. See below for a description of this type. @item gcry_pk_encrypt_t encrypt The function responsible for encrypting data. See below for a description of this type. @item gcry_pk_decrypt_t decrypt The function responsible for decrypting data. See below for a description of this type. @item gcry_pk_sign_t sign The function responsible for signing data. See below for a description of this type. @item gcry_pk_verify_t verify The function responsible for verifying that the provided signature matches the provided data. See below for a description of this type. @item gcry_pk_get_nbits_t get_nbits The function responsible for returning the number of bits of a provided key. See below for a description of this type. @end table @end deftp @deftp {Data type} gcry_pk_generate_t Type for the `generate' function, defined as: gcry_err_code_t (*gcry_pk_generate_t) (int algo, unsigned int nbits, unsigned long use_e, gcry_mpi_t *skey, gcry_mpi_t **retfactors) @end deftp @deftp {Data type} gcry_pk_check_secret_key_t Type for the `check_secret_key' function, defined as: gcry_err_code_t (*gcry_pk_check_secret_key_t) (int algo, gcry_mpi_t *skey) @end deftp @deftp {Data type} gcry_pk_encrypt_t Type for the `encrypt' function, defined as: gcry_err_code_t (*gcry_pk_encrypt_t) (int algo, gcry_mpi_t *resarr, gcry_mpi_t data, gcry_mpi_t *pkey, int flags) @end deftp @deftp {Data type} gcry_pk_decrypt_t Type for the `decrypt' function, defined as: gcry_err_code_t (*gcry_pk_decrypt_t) (int algo, gcry_mpi_t *result, gcry_mpi_t *data, gcry_mpi_t *skey, int flags) @end deftp @deftp {Data type} gcry_pk_sign_t Type for the `sign' function, defined as: gcry_err_code_t (*gcry_pk_sign_t) (int algo, gcry_mpi_t *resarr, gcry_mpi_t data, gcry_mpi_t *skey) @end deftp @deftp {Data type} gcry_pk_verify_t Type for the `verify' function, defined as: gcry_err_code_t (*gcry_pk_verify_t) (int algo, gcry_mpi_t hash, gcry_mpi_t *data, gcry_mpi_t *pkey, int (*cmp) (void *, gcry_mpi_t), void *opaquev) @end deftp @deftp {Data type} gcry_pk_get_nbits_t Type for the `get_nbits' function, defined as: unsigned (*gcry_pk_get_nbits_t) (int algo, gcry_mpi_t *pkey) @end deftp @deftypefun gcry_error_t gcry_pk_register (gcry_pk_spec_t *@var{pubkey}, unsigned int *algorithm_id, gcry_module_t *@var{module}) Register a new public key module whose specification can be found in @var{pubkey}. On success, a new algorithm ID is stored in @var{algorithm_id} and a pointer representing this module is stored in @var{module}. @end deftypefun @deftypefun void gcry_pk_unregister (gcry_module_t @var{module}) Unregister the public key module identified by @var{module}, which must have been registered with gcry_pk_register. @end deftypefun @deftypefun gcry_error_t gcry_pk_list (int *@var{list}, int *@var{list_length}) Get a list consisting of the IDs of the loaded pubkey modules. If @var{list} is zero, write the number of loaded pubkey modules to @var{list_length} and return. If @var{list} is non-zero, the first *@var{list_length} algorithm IDs are stored in @var{list}, which must be of according size. In case there are less pubkey modules than *@var{list_length}, *@var{list_length} is updated to the correct number. @end deftypefun @node Cryptographic Functions @section Cryptographic Functions @noindent Note that we will in future allow to use keys without p,q and u specified and may also support other parameters for performance reasons. @noindent Some functions operating on S-expressions support `flags', that influence the operation. These flags have to be listed in a sub-S-expression named `flags'; the following flags are known: @table @code @item pkcs1 Use PKCS#1 block type 2 padding. @item no-blinding Do not use a technique called `blinding', which is used by default in order to prevent leaking of secret information. Blinding is only implemented by RSA, but it might be implemented by other algorithms in the future as well, when necessary. @end table @noindent Now that we know the key basics, we can carry on and explain how to encrypt and decrypt data. In almost all cases the data is a random session key which is in turn used for the actual encryption of the real data. There are 2 functions to do this: @deftypefun gcry_error_t gcry_pk_encrypt (@w{gcry_sexp_t *@var{r_ciph},} @w{gcry_sexp_t @var{data},} @w{gcry_sexp_t @var{pkey}}) Obviously a public key must be provided for encryption. It is expected as an appropriate S-expression (see above) in @var{pkey}. The data to be encrypted can either be in the simple old format, which is a very simple S-expression consisting only of one MPI, or it may be a more complex S-expression which also allows to specify flags for operation, like e.g. padding rules. @noindent If you don't want to let Libgcrypt handle the padding, you must pass an appropriate MPI using this expression for @var{data}: @example (data (flags raw) (value @var{mpi})) @end example @noindent This has the same semantics as the old style MPI only way. @var{MPI} is the actual data, already padded appropriate for your protocol. Most systems however use PKCS#1 padding and so you can use this S-expression for @var{data}: @example (data (flags pkcs1) (value @var{block})) @end example @noindent Here, the "flags" list has the "pkcs1" flag which let the function know that it should provide PKCS#1 block type 2 padding. The actual data to be encrypted is passed as a string of octets in @var{block}. The function checks that this data actually can be used with the given key, does the padding and encrypts it. If the function could successfully perform the encryption, the return value will be 0 and a new S-expression with the encrypted result is allocated and assigned to the variable at the address of @var{r_ciph}. The caller is responsible to release this value using @code{gcry_sexp_release}. In case of an error, an error code is returned and @var{r_ciph} will be set to @code{NULL}. @noindent The returned S-expression has this format when used with RSA: @example (enc-val (rsa (a @var{a-mpi}))) @end example @noindent Where @var{a-mpi} is an MPI with the result of the RSA operation. When using the Elgamal algorithm, the return value will have this format: @example (enc-val (elg (a @var{a-mpi}) (b @var{b-mpi}))) @end example @noindent Where @var{a-mpi} and @var{b-mpi} are MPIs with the result of the Elgamal encryption operation. @end deftypefun @c end gcry_pk_encrypt @deftypefun gcry_error_t gcry_pk_decrypt (@w{gcry_sexp_t *@var{r_plain},} @w{gcry_sexp_t @var{data},} @w{gcry_sexp_t @var{skey}}) Obviously a private key must be provided for decryption. It is expected as an appropriate S-expression (see above) in @var{skey}. The data to be decrypted must match the format of the result as returned by @code{gcry_pk_encrypt}, but should be enlarged with a @code{flags} element: @example (enc-val (flags) (elg (a @var{a-mpi}) (b @var{b-mpi}))) @end example @noindent Note that this function currently does not know of any padding methods and the caller must do any un-padding on his own. @noindent The function returns 0 on success or an error code. The variable at the address of @var{r_plain} will be set to NULL on error or receive the decrypted value on success. The format of @var{r_plain} is a simple S-expression part (i.e. not a valid one) with just one MPI if there was no @code{flags} element in @var{data}; if at least an empty @code{flags} is passed in @var{data}, the format is: @example (value @var{plaintext}) @end example @end deftypefun @c end gcry_pk_decrypt Another operation commonly performed using public key cryptography is signing data. In some sense this is even more important than encryption because digital signatures are an important instrument for key management. Libgcrypt supports digital signatures using 2 functions, similar to the encryption functions: @deftypefun gcry_error_t gcry_pk_sign (@w{gcry_sexp_t *@var{r_sig},} @w{gcry_sexp_t @var{data},} @w{gcry_sexp_t @var{skey}}) This function creates a digital signature for @var{data} using the private key @var{skey} and place it into the variable at the address of @var{r_sig}. @var{data} may either be the simple old style S-expression with just one MPI or a modern and more versatile S-expression which allows to let Libgcrypt handle padding: @example (data (flags pkcs1) (hash @var{hash-algo} @var{block})) @end example @noindent This example requests to sign the data in @var{block} after applying PKCS#1 block type 1 style padding. @var{hash-algo} is a string with the hash algorithm to be encoded into the signature, this may be any hash algorithm name as supported by Libgcrypt. Most likely, this will be "sha1", "rmd160" or "md5". It is obvious that the length of @var{block} must match the size of that message digests; the function checks that this and other constraints are valid. @noindent If PKCS#1 padding is not required (because the caller does already provide a padded value), either the old format or better the following format should be used: @example (data (flags raw) (value @var{mpi})) @end example @noindent Here, the data to be signed is directly given as an @var{MPI}. @noindent The signature is returned as a newly allocated S-expression in @var{r_sig} using this format for RSA: @example (sig-val (rsa (s @var{s-mpi}))) @end example Where @var{s-mpi} is the result of the RSA sign operation. For DSA the S-expression returned is: @example (sig-val (dsa (r @var{r-mpi}) (s @var{s-mpi}))) @end example Where @var{r-mpi} and @var{s-mpi} are the result of the DSA sign operation. For Elgamal signing (which is slow, yields large numbers and probably is not as secure as the other algorithms), the same format is used with "elg" replacing "dsa". @end deftypefun @c end gcry_pk_sign @noindent The operation most commonly used is definitely the verification of a signature. Libgcrypt provides this function: @deftypefun gcry_error_t gcry_pk_verify (@w{gcry_sexp_t @var{sig}}, @w{gcry_sexp_t @var{data}}, @w{gcry_sexp_t @var{pkey}}) This is used to check whether the signature @var{sig} matches the @var{data}. The public key @var{pkey} must be provided to perform this verification. This function is similar in its parameters to @code{gcry_pk_sign} with the exceptions that the public key is used instead of the private key and that no signature is created but a signature, in a format as created by @code{gcry_pk_sign}, is passed to the function in @var{sig}. @noindent The result is 0 for success (i.e. the data matches the signature), or an error code where the most relevant code is @code{GCRYERR_BAD_SIGNATURE} to indicate that the signature does not match the provided data. @end deftypefun @c end gcry_pk_verify @node General public-key related Functions @section General public-key related Functions @noindent A couple of utility functions are available to retrieve the length of the key, map algorithm identifiers and perform sanity checks: @deftypefun {const char *} gcry_pk_algo_name (int @var{algo}) Map the public key algorithm id @var{algo} to a string representation of the algorithm name. For unknown algorithms this functions returns the string @code{"?"}. This function should not be used to test for the availability of an algorithm. @end deftypefun @deftypefun int gcry_pk_map_name (const char *@var{name}) Map the algorithm @var{name} to a public key algorithm Id. Returns 0 if the algorithm name is not known. @end deftypefun @deftypefun int gcry_pk_test_algo (int @var{algo}) Return 0 if the public key algorithm @var{algo} is available for use. Note that this is implemented as a macro. @end deftypefun @deftypefun {unsigned int} gcry_pk_get_nbits (gcry_sexp_t @var{key}) Return what is commonly referred as the key length for the given public or private in @var{key}. @end deftypefun @deftypefun {unsigned char *} gcry_pk_get_keygrip (@w{gcry_sexp_t @var{key}}, @w{unsigned char *@var{array}}) Return the so called "keygrip" which is the SHA-1 hash of the public key parameters expressed in a way depended on the algorithm. @var{array} must either provide space for 20 bytes or be @code{NULL}. In the latter case a newly allocated array of that size is returned. On success a pointer to the newly allocated space or to @var{array} is returned. @code{NULL} is returned to indicate an error which is most likely an unknown algorithm or one where a "keygrip" has not yet been defined. The function accepts public or secret keys in @var{key}. @end deftypefun @deftypefun gcry_error_t gcry_pk_testkey (gcry_sexp_t @var{key}) Return zero if the private key @var{key} is `sane', an error code otherwise. Note that it is not possible to check the `saneness' of a public key. @end deftypefun @deftypefun gcry_error_t gcry_pk_algo_info (@w{int @var{algo}}, @w{int @var{what}}, @w{void *@var{buffer}}, @w{size_t *@var{nbytes}}) Depending on the value of @var{what} return various information about the public key algorithm with the id @var{algo}. Note that the function returns @code{-1} on error and the actual error code must be retrieved using the function @code{gcry_errno}. The currently defined values for @var{what} are: @table @code @item GCRYCTL_TEST_ALGO: Return 0 if the specified algorithm is available for use. @var{buffer} must be @code{NULL}, @var{nbytes} may be passed as @code{NULL} or point to a variable with the required usage of the algorithm. This may be 0 for "don't care" or the bit-wise OR of these flags: @table @code @item GCRY_PK_USAGE_SIGN Algorithm is usable for signing. @item GCRY_PK_USAGE_ENCR Algorithm is usable for encryption. @end table Unless you need to test for the allowed usage, it is in general better to use the macro gcry_pk_test_algo instead. @item GCRYCTL_GET_ALGO_USAGE: Return the usage flags for the given algorithm. An invalid algorithm return 0. Disabled algorithms are ignored here because we want to know whether the algorithm is at all capable of a certain usage. @item GCRYCTL_GET_ALGO_NPKEY Return the number of elements the public key for algorithm @var{algo} consist of. Return 0 for an unknown algorithm. @item GCRYCTL_GET_ALGO_NSKEY Return the number of elements the private key for algorithm @var{algo} consist of. Note that this value is always larger than that of the public key. Return 0 for an unknown algorithm. @item GCRYCTL_GET_ALGO_NSIGN Return the number of elements a signature created with the algorithm @var{algo} consists of. Return 0 for an unknown algorithm or for an algorithm not capable of creating signatures. @item GCRYCTL_GET_ALGO_NENC Return the number of elements a encrypted message created with the algorithm @var{algo} consists of. Return 0 for an unknown algorithm or for an algorithm not capable of encryption. @end table @noindent Please note that parameters not required should be passed as @code{NULL}. @end deftypefun @c end gcry_pk_algo_info @deftypefun gcry_error_t gcry_pk_ctl (@w{int @var{cmd}}, @w{void *@var{buffer}}, @w{size_t @var{buflen}}) This is a general purpose function to perform certain control operations. @var{cmd} controls what is to be done. The return value is 0 for success or an error code. Currently supported values for @var{cmd} are: @table @code @item GCRYCTL_DISABLE_ALGO Disable the algorithm given as an algorithm id in @var{buffer}. @var{buffer} must point to an @code{int} variable with the algorithm id and @var{buflen} must have the value @code{sizeof (int)}. @end table @end deftypefun @c end gcry_pk_ctl @noindent Libgcrypt also provides a function to generate public key pairs: @deftypefun gcry_error_t gcry_pk_genkey (@w{gcry_sexp_t *@var{r_key}}, @w{gcry_sexp_t @var{parms}}) This function create a new public key pair using information given in the S-expression @var{parms} and stores the private and the public key in one new S-expression at the address given by @var{r_key}. In case of an error, @var{r_key} is set to @code{NULL}. The return code is 0 for success or an error code otherwise. @noindent Here is an example for @var{parms} to create an 2048 bit RSA key: @example (genkey (rsa (nbits 4:2048))) @end example @noindent To create an Elgamal key, substitute "elg" for "rsa" and to create a DSA key use "dsa". Valid ranges for the key length depend on the algorithms; all commonly used key lengths are supported. Currently supported parameters are: @table @code @item nbits This is always required to specify the length of the key. The argument is a string with a number in C-notation. The value should be a multiple of 8. @item curve @var{name} For ECC a named curve may be used instead of giving the number of requested bits. This allows to request a specific curve to override a default selection Libgcrypt would have taken if @code{nbits} has been given. The available names are listed with the description of the ECC public key parameters. @item rsa-use-e This is only used with RSA to give a hint for the public exponent. The value will be used as a base to test for a usable exponent. Some values are special: @table @samp @item 0 Use a secure and fast value. This is currently the number 41. @item 1 Use a value as required by some crypto policies. This is currently the number 65537. @item 2 Reserved @item > 2 Use the given value. @end table @noindent If this parameter is not used, Libgcrypt uses for historic reasons 65537. @item qbits This is only meanigful for DSA keys. If it is given the DSA key is generated with a Q parameyer of this size. If it is not given or zero Q is deduced from NBITS in this way: @table @samp @item 512 <= N <= 1024 Q = 160 @item N = 2048 Q = 224 @item N = 3072 Q = 256 @item N = 7680 Q = 384 @item N = 15360 Q = 512 @end table Note that in this case only the values for N, as given in the table, are allowed. When specifying Q all values of N in the range 512 to 15680 are valid as long as they are multiples of 8. @item transient-key This is only meaningful for RSA keys. This is a flag with no value. If given the RSA key is created using a faster and a somewhat less secure random number generator. This flag may be used for keys which are only used for a short time and do not require full cryptographic strength. @item domain This is only meaningful for DLP algorithms. If specified keys are generated with domain parameters taken from this list. The exact format of this parameter depends on the actual algorithm. It is currently only implemented for DSA using this format: @example (genkey (dsa (domain (p @var{p-mpi}) (q @var{q-mpi}) (g @var{q-mpi}) (seed @var{seed-mpi}) (counter @var{counter-mpi}) (h @var{h-mpi})))) @end example The @code{seed}, @code{counter} and @code{h} domain parameters are optional and currently not used. @end table @c end table of parameters @noindent The key pair is returned in a format depending on the algorithm. Both private and public keys are returned in one container and may be accompanied by some miscellaneous information. @noindent As an example, here is what the Elgamal key generation returns: @example (key-data (public-key (elg (p @var{p-mpi}) (g @var{g-mpi}) (y @var{y-mpi}))) (private-key (elg (p @var{p-mpi}) (g @var{g-mpi}) (y @var{y-mpi}) (x @var{x-mpi}))) (misc-key-info (pm1-factors @var{n1 n2 ... nn}))) @end example @noindent As you can see, some of the information is duplicated, but this provides an easy way to extract either the public or the private key. Note that the order of the elements is not defined, e.g. the private key may be stored before the public key. @var{n1 n2 ... nn} is a list of prime numbers used to composite @var{p-mpi}; this is in general not a very useful information. @end deftypefun @c end gcry_pk_genkey @node AC Interface @section Alternative Public Key Interface This section documents the alternative interface to asymmetric cryptography (ac) that is not based on S-expressions, but on native C data structures. As opposed to the pk interface described in the former chapter, this one follows an open/use/close paradigm like other building blocks of the library. @strong{This interface has a few known problems; most noteworthy an inherent tendency to leak memory. It might not be available in forthcoming versions Libgcrypt.} @menu * Available asymmetric algorithms:: List of algorithms supported by the library. * Working with sets of data:: How to work with sets of data. * Working with IO objects:: How to work with IO objects. * Working with handles:: How to use handles. * Working with keys:: How to work with keys. * Using cryptographic functions:: How to perform cryptographic operations. * Handle-independent functions:: General functions independent of handles. @end menu @node Available asymmetric algorithms @subsection Available asymmetric algorithms Libgcrypt supports the RSA (Rivest-Shamir-Adleman) algorithms as well as DSA (Digital Signature Algorithm) and Elgamal. The versatile interface allows to add more algorithms in the future. @deftp {Data type} gcry_ac_id_t The following constants are defined for this type: @table @code @item GCRY_AC_RSA Rivest-Shamir-Adleman @item GCRY_AC_DSA Digital Signature Algorithm @item GCRY_AC_ELG Elgamal @item GCRY_AC_ELG_E Elgamal, encryption only. @end table @end deftp @node Working with sets of data @subsection Working with sets of data In the context of this interface the term `data set' refers to a list of `named MPI values' that is used by functions performing cryptographic operations; a named MPI value is a an MPI value, associated with a label. Such data sets are used for representing keys, since keys simply consist of a variable amount of numbers. Furthermore some functions return data sets to the caller that are to be provided to other functions. This section documents the data types, symbols and functions that are relevant for working with data sets. @deftp {Data type} gcry_ac_data_t A single data set. @end deftp The following flags are supported: @table @code @item GCRY_AC_FLAG_DEALLOC Used for storing data in a data set. If given, the data will be released by the library. Note that whenever one of the ac functions is about to release objects because of this flag, the objects are expected to be stored in memory allocated through the Libgcrypt memory management. In other words: gcry_free() is used instead of free(). @item GCRY_AC_FLAG_COPY Used for storing/retrieving data in/from a data set. If given, the library will create copies of the provided/contained data, which will then be given to the user/associated with the data set. @end table @deftypefun gcry_error_t gcry_ac_data_new (gcry_ac_data_t *@var{data}) Creates a new, empty data set and stores it in @var{data}. @end deftypefun @deftypefun void gcry_ac_data_destroy (gcry_ac_data_t @var{data}) Destroys the data set @var{data}. @end deftypefun @deftypefun gcry_error_t gcry_ac_data_set (gcry_ac_data_t @var{data}, unsigned int @var{flags}, char *@var{name}, gcry_mpi_t @var{mpi}) Add the value @var{mpi} to @var{data} with the label @var{name}. If @var{flags} contains GCRY_AC_FLAG_COPY, the data set will contain copies of @var{name} and @var{mpi}. If @var{flags} contains GCRY_AC_FLAG_DEALLOC or GCRY_AC_FLAG_COPY, the values contained in the data set will be deallocated when they are to be removed from the data set. @end deftypefun @deftypefun gcry_error_t gcry_ac_data_copy (gcry_ac_data_t *@var{data_cp}, gcry_ac_data_t @var{data}) Create a copy of the data set @var{data} and store it in @var{data_cp}. FIXME: exact semantics undefined. @end deftypefun @deftypefun {unsigned int} gcry_ac_data_length (gcry_ac_data_t @var{data}) Returns the number of named MPI values inside of the data set @var{data}. @end deftypefun @deftypefun gcry_error_t gcry_ac_data_get_name (gcry_ac_data_t @var{data}, unsigned int @var{flags}, char *@var{name}, gcry_mpi_t *@var{mpi}) Store the value labelled with @var{name} found in @var{data} in @var{mpi}. If @var{flags} contains GCRY_AC_FLAG_COPY, store a copy of the @var{mpi} value contained in the data set. @var{mpi} may be NULL (this might be useful for checking the existence of an MPI with extracting it). @end deftypefun @deftypefun gcry_error_t gcry_ac_data_get_index (gcry_ac_data_t @var{data}, unsigned int flags, unsigned int @var{index}, const char **@var{name}, gcry_mpi_t *@var{mpi}) Stores in @var{name} and @var{mpi} the named @var{mpi} value contained in the data set @var{data} with the index @var{idx}. If @var{flags} contains GCRY_AC_FLAG_COPY, store copies of the values contained in the data set. @var{name} or @var{mpi} may be NULL. @end deftypefun @deftypefun void gcry_ac_data_clear (gcry_ac_data_t @var{data}) Destroys any values contained in the data set @var{data}. @end deftypefun @deftypefun gcry_error_t gcry_ac_data_to_sexp (gcry_ac_data_t @var{data}, gcry_sexp_t *@var{sexp}, const char **@var{identifiers}) This function converts the data set @var{data} into a newly created S-Expression, which is to be stored in @var{sexp}; @var{identifiers} is a NULL terminated list of C strings, which specifies the structure of the S-Expression. Example: If @var{identifiers} is a list of pointers to the strings ``foo'' and ``bar'' and if @var{data} is a data set containing the values ``val1 = 0x01'' and ``val2 = 0x02'', then the resulting S-Expression will look like this: (foo (bar ((val1 0x01) (val2 0x02))). @end deftypefun @deftypefun gcry_error gcry_ac_data_from_sexp (gcry_ac_data_t *@var{data}, gcry_sexp_t @var{sexp}, const char **@var{identifiers}) This function converts the S-Expression @var{sexp} into a newly created data set, which is to be stored in @var{data}; @var{identifiers} is a NULL terminated list of C strings, which specifies the structure of the S-Expression. If the list of identifiers does not match the structure of the S-Expression, the function fails. @end deftypefun @node Working with IO objects @subsection Working with IO objects Note: IO objects are currently only used in the context of message encoding/decoding and encryption/signature schemes. @deftp {Data type} {gcry_ac_io_t} @code{gcry_ac_io_t} is the type to be used for IO objects. @end deftp IO objects provide an uniform IO layer on top of different underlying IO mechanisms; either they can be used for providing data to the library (mode is GCRY_AC_IO_READABLE) or they can be used for retrieving data from the library (mode is GCRY_AC_IO_WRITABLE). IO object need to be initialized by calling on of the following functions: @deftypefun void gcry_ac_io_init (gcry_ac_io_t *@var{ac_io}, gcry_ac_io_mode_t @var{mode}, gcry_ac_io_type_t @var{type}, ...); Initialize @var{ac_io} according to @var{mode}, @var{type} and the variable list of arguments. The list of variable arguments to specify depends on the given @var{type}. @end deftypefun @deftypefun void gcry_ac_io_init_va (gcry_ac_io_t *@var{ac_io}, gcry_ac_io_mode_t @var{mode}, gcry_ac_io_type_t @var{type}, va_list @var{ap}); Initialize @var{ac_io} according to @var{mode}, @var{type} and the variable list of arguments @var{ap}. The list of variable arguments to specify depends on the given @var{type}. @end deftypefun The following types of IO objects exist: @table @code @item GCRY_AC_IO_STRING In case of GCRY_AC_IO_READABLE the IO object will provide data from a memory string. Arguments to specify at initialization time: @table @code @item unsigned char * Pointer to the beginning of the memory string @item size_t Size of the memory string @end table In case of GCRY_AC_IO_WRITABLE the object will store retrieved data in a newly allocated memory string. Arguments to specify at initialization time: @table @code @item unsigned char ** Pointer to address, at which the pointer to the newly created memory string is to be stored @item size_t * Pointer to address, at which the size of the newly created memory string is to be stored @end table @item GCRY_AC_IO_CALLBACK In case of GCRY_AC_IO_READABLE the object will forward read requests to a provided callback function. Arguments to specify at initialization time: @table @code @item gcry_ac_data_read_cb_t Callback function to use @item void * Opaque argument to provide to the callback function @end table In case of GCRY_AC_IO_WRITABLE the object will forward write requests to a provided callback function. Arguments to specify at initialization time: @table @code @item gcry_ac_data_write_cb_t Callback function to use @item void * Opaque argument to provide to the callback function @end table @end table @node Working with handles @subsection Working with handles In order to use an algorithm, an according handle must be created. This is done using the following function: @deftypefun gcry_error_t gcry_ac_open (gcry_ac_handle_t *@var{handle}, int @var{algorithm}, int @var{flags}) Creates a new handle for the algorithm @var{algorithm} and stores it in @var{handle}. @var{flags} is not used currently. @var{algorithm} must be a valid algorithm ID, see @xref{Available asymmetric algorithms}, for a list of supported algorithms and the according constants. Besides using the listed constants directly, the functions @code{gcry_pk_name_to_id} may be used to convert the textual name of an algorithm into the according numeric ID. @end deftypefun @deftypefun void gcry_ac_close (gcry_ac_handle_t @var{handle}) Destroys the handle @var{handle}. @end deftypefun @node Working with keys @subsection Working with keys @deftp {Data type} gcry_ac_key_type_t Defined constants: @table @code @item GCRY_AC_KEY_SECRET Specifies a secret key. @item GCRY_AC_KEY_PUBLIC Specifies a public key. @end table @end deftp @deftp {Data type} gcry_ac_key_t This type represents a single `key', either a secret one or a public one. @end deftp @deftp {Data type} gcry_ac_key_pair_t This type represents a `key pair' containing a secret and a public key. @end deftp Key data structures can be created in two different ways; a new key pair can be generated, resulting in ready-to-use key. Alternatively a key can be initialized from a given data set. @deftypefun gcry_error_t gcry_ac_key_init (gcry_ac_key_t *@var{key}, gcry_ac_handle_t @var{handle}, gcry_ac_key_type_t @var{type}, gcry_ac_data_t @var{data}) Creates a new key of type @var{type}, consisting of the MPI values contained in the data set @var{data} and stores it in @var{key}. @end deftypefun @deftypefun gcry_error_t gcry_ac_key_pair_generate (gcry_ac_handle_t @var{handle}, unsigned int @var{nbits}, void *@var{key_spec}, gcry_ac_key_pair_t *@var{key_pair}, gcry_mpi_t **@var{misc_data}) Generates a new key pair via the handle @var{handle} of @var{NBITS} bits and stores it in @var{key_pair}. In case non-standard settings are wanted, a pointer to a structure of type @code{gcry_ac_key_spec__t}, matching the selected algorithm, can be given as @var{key_spec}. @var{misc_data} is not used yet. Such a structure does only exist for RSA. A description of the members of the supported structures follows. @table @code @item gcry_ac_key_spec_rsa_t @table @code @item gcry_mpi_t e Generate the key pair using a special @code{e}. The value of @code{e} has the following meanings: @table @code @item = 0 Let Libgcrypt decide what exponent should be used. @item = 1 Request the use of a ``secure'' exponent; this is required by some specification to be 65537. @item > 2 Try starting at this value until a working exponent is found. Note that the current implementation leaks some information about the private key because the incrementation used is not randomized. Thus, this function will be changed in the future to return a random exponent of the given size. @end table @end table @end table Example code: @example @{ gcry_ac_key_pair_t key_pair; gcry_ac_key_spec_rsa_t rsa_spec; rsa_spec.e = gcry_mpi_new (0); gcry_mpi_set_ui (rsa_spec.e, 1); err = gcry_ac_open (&handle, GCRY_AC_RSA, 0); assert (! err); err = gcry_ac_key_pair_generate (handle, 1024, &rsa_spec, &key_pair, NULL); assert (! err); @} @end example @end deftypefun @deftypefun gcry_ac_key_t gcry_ac_key_pair_extract (gcry_ac_key_pair_t @var{key_pair}, gcry_ac_key_type_t @var{which}) Returns the key of type @var{which} out of the key pair @var{key_pair}. @end deftypefun @deftypefun void gcry_ac_key_destroy (gcry_ac_key_t @var{key}) Destroys the key @var{key}. @end deftypefun @deftypefun void gcry_ac_key_pair_destroy (gcry_ac_key_pair_t @var{key_pair}) Destroys the key pair @var{key_pair}. @end deftypefun @deftypefun gcry_ac_data_t gcry_ac_key_data_get (gcry_ac_key_t @var{key}) Returns the data set contained in the key @var{key}. @end deftypefun @deftypefun gcry_error_t gcry_ac_key_test (gcry_ac_handle_t @var{handle}, gcry_ac_key_t @var{key}) Verifies that the private key @var{key} is sane via @var{handle}. @end deftypefun @deftypefun gcry_error_t gcry_ac_key_get_nbits (gcry_ac_handle_t @var{handle}, gcry_ac_key_t @var{key}, unsigned int *@var{nbits}) Stores the number of bits of the key @var{key} in @var{nbits} via @var{handle}. @end deftypefun @deftypefun gcry_error_t gcry_ac_key_get_grip (gcry_ac_handle_t @var{handle}, gcry_ac_key_t @var{key}, unsigned char *@var{key_grip}) Writes the 20 byte long key grip of the key @var{key} to @var{key_grip} via @var{handle}. @end deftypefun @node Using cryptographic functions @subsection Using cryptographic functions The following flags might be relevant: @table @code @item GCRY_AC_FLAG_NO_BLINDING Disable any blinding, which might be supported by the chosen algorithm; blinding is the default. @end table There exist two kinds of cryptographic functions available through the ac interface: primitives, and high-level functions. Primitives deal with MPIs (data sets) directly; what they provide is direct access to the cryptographic operations provided by an algorithm implementation. High-level functions deal with octet strings, according to a specified ``scheme''. Schemes make use of ``encoding methods'', which are responsible for converting the provided octet strings into MPIs, which are then forwared to the cryptographic primitives. Since schemes are to be used for a special purpose in order to achieve a particular security goal, there exist ``encryption schemes'' and ``signature schemes''. Encoding methods can be used seperately or implicitly through schemes. What follows is a description of the cryptographic primitives. @deftypefun gcry_error_t gcry_ac_data_encrypt (gcry_ac_handle_t @var{handle}, unsigned int @var{flags}, gcry_ac_key_t @var{key}, gcry_mpi_t @var{data_plain}, gcry_ac_data_t *@var{data_encrypted}) Encrypts the plain text MPI value @var{data_plain} with the key public @var{key} under the control of the flags @var{flags} and stores the resulting data set into @var{data_encrypted}. @end deftypefun @deftypefun gcry_error_t gcry_ac_data_decrypt (gcry_ac_handle_t @var{handle}, unsigned int @var{flags}, gcry_ac_key_t @var{key}, gcry_mpi_t *@var{data_plain}, gcry_ac_data_t @var{data_encrypted}) Decrypts the encrypted data contained in the data set @var{data_encrypted} with the secret key KEY under the control of the flags @var{flags} and stores the resulting plain text MPI value in @var{DATA_PLAIN}. @end deftypefun @deftypefun gcry_error_t gcry_ac_data_sign (gcry_ac_handle_t @var{handle}, gcry_ac_key_t @var{key}, gcry_mpi_t @var{data}, gcry_ac_data_t *@var{data_signature}) Signs the data contained in @var{data} with the secret key @var{key} and stores the resulting signature in the data set @var{data_signature}. @end deftypefun @deftypefun gcry_error_t gcry_ac_data_verify (gcry_ac_handle_t @var{handle}, gcry_ac_key_t @var{key}, gcry_mpi_t @var{data}, gcry_ac_data_t @var{data_signature}) Verifies that the signature contained in the data set @var{data_signature} is indeed the result of signing the data contained in @var{data} with the secret key belonging to the public key @var{key}. @end deftypefun What follows is a description of the high-level functions. The type ``gcry_ac_em_t'' is used for specifying encoding methods; the following methods are supported: @table @code @item GCRY_AC_EME_PKCS_V1_5 PKCS-V1_5 Encoding Method for Encryption. Options must be provided through a pointer to a correctly initialized object of type gcry_ac_eme_pkcs_v1_5_t. @item GCRY_AC_EMSA_PKCS_V1_5 PKCS-V1_5 Encoding Method for Signatures with Appendix. Options must be provided through a pointer to a correctly initialized object of type gcry_ac_emsa_pkcs_v1_5_t. @end table Option structure types: @table @code @item gcry_ac_eme_pkcs_v1_5_t @table @code @item gcry_ac_key_t key @item gcry_ac_handle_t handle @end table @item gcry_ac_emsa_pkcs_v1_5_t @table @code @item gcry_md_algo_t md @item size_t em_n @end table @end table Encoding methods can be used directly through the following functions: @deftypefun gcry_error_t gcry_ac_data_encode (gcry_ac_em_t @var{method}, unsigned int @var{flags}, void *@var{options}, unsigned char *@var{m}, size_t @var{m_n}, unsigned char **@var{em}, size_t *@var{em_n}) Encodes the message contained in @var{m} of size @var{m_n} according to @var{method}, @var{flags} and @var{options}. The newly created encoded message is stored in @var{em} and @var{em_n}. @end deftypefun @deftypefun gcry_error_t gcry_ac_data_decode (gcry_ac_em_t @var{method}, unsigned int @var{flags}, void *@var{options}, unsigned char *@var{em}, size_t @var{em_n}, unsigned char **@var{m}, size_t *@var{m_n}) Decodes the message contained in @var{em} of size @var{em_n} according to @var{method}, @var{flags} and @var{options}. The newly created decoded message is stored in @var{m} and @var{m_n}. @end deftypefun The type ``gcry_ac_scheme_t'' is used for specifying schemes; the following schemes are supported: @table @code @item GCRY_AC_ES_PKCS_V1_5 PKCS-V1_5 Encryption Scheme. No options can be provided. @item GCRY_AC_SSA_PKCS_V1_5 PKCS-V1_5 Signature Scheme (with Appendix). Options can be provided through a pointer to a correctly initialized object of type gcry_ac_ssa_pkcs_v1_5_t. @end table Option structure types: @table @code @item gcry_ac_ssa_pkcs_v1_5_t @table @code @item gcry_md_algo_t md @end table @end table The functions implementing schemes: @deftypefun gcry_error_t gcry_ac_data_encrypt_scheme (gcry_ac_handle_t @var{handle}, gcry_ac_scheme_t @var{scheme}, unsigned int @var{flags}, void *@var{opts}, gcry_ac_key_t @var{key}, gcry_ac_io_t *@var{io_message}, gcry_ac_io_t *@var{io_cipher}) Encrypts the plain text readable from @var{io_message} through @var{handle} with the public key @var{key} according to @var{scheme}, @var{flags} and @var{opts}. If @var{opts} is not NULL, it has to be a pointer to a structure specific to the chosen scheme (gcry_ac_es_*_t). The encrypted message is written to @var{io_cipher}. @end deftypefun @deftypefun gcry_error_t gcry_ac_data_decrypt_scheme (gcry_ac_handle_t @var{handle}, gcry_ac_scheme_t @var{scheme}, unsigned int @var{flags}, void *@var{opts}, gcry_ac_key_t @var{key}, gcry_ac_io_t *@var{io_cipher}, gcry_ac_io_t *@var{io_message}) Decrypts the cipher text readable from @var{io_cipher} through @var{handle} with the secret key @var{key} according to @var{scheme}, @var{flags} and @var{opts}. If @var{opts} is not NULL, it has to be a pointer to a structure specific to the chosen scheme (gcry_ac_es_*_t). The decrypted message is written to @var{io_message}. @end deftypefun @deftypefun gcry_error_t gcry_ac_data_sign_scheme (gcry_ac_handle_t @var{handle}, gcry_ac_scheme_t @var{scheme}, unsigned int @var{flags}, void *@var{opts}, gcry_ac_key_t @var{key}, gcry_ac_io_t *@var{io_message}, gcry_ac_io_t *@var{io_signature}) Signs the message readable from @var{io_message} through @var{handle} with the secret key @var{key} according to @var{scheme}, @var{flags} and @var{opts}. If @var{opts} is not NULL, it has to be a pointer to a structure specific to the chosen scheme (gcry_ac_ssa_*_t). The signature is written to @var{io_signature}. @end deftypefun @deftypefun gcry_error_t gcry_ac_data_verify_scheme (gcry_ac_handle_t @var{handle}, gcry_ac_scheme_t @var{scheme}, unsigned int @var{flags}, void *@var{opts}, gcry_ac_key_t @var{key}, gcry_ac_io_t *@var{io_message}, gcry_ac_io_t *@var{io_signature}) Verifies through @var{handle} that the signature readable from @var{io_signature} is indeed the result of signing the message readable from @var{io_message} with the secret key belonging to the public key @var{key} according to @var{scheme} and @var{opts}. If @var{opts} is not NULL, it has to be an anonymous structure (gcry_ac_ssa_*_t) specific to the chosen scheme. @end deftypefun @node Handle-independent functions @subsection Handle-independent functions These two functions are deprecated; do not use them for new code. @deftypefun gcry_error_t gcry_ac_id_to_name (gcry_ac_id_t @var{algorithm}, const char **@var{name}) Stores the textual representation of the algorithm whose id is given in @var{algorithm} in @var{name}. Deprecated; use @code{gcry_pk_algo_name}. @end deftypefun @deftypefun gcry_error_t gcry_ac_name_to_id (const char *@var{name}, gcry_ac_id_t *@var{algorithm}) Stores the numeric ID of the algorithm whose textual representation is contained in @var{name} in @var{algorithm}. Deprecated; use @code{gcry_pk_map_name}. @end deftypefun @c ********************************************************** @c ******************* Hash Functions ********************* @c ********************************************************** @node Hashing @chapter Hashing Libgcrypt provides an easy and consistent to use interface for hashing. Hashing is buffered and several hash algorithms can be updated at once. It is possible to compute a MAC using the same routines. The programming model follows an open/process/close paradigm and is in that similar to other building blocks provided by Libgcrypt. For convenience reasons, a few cyclic redundancy check value operations are also supported. @menu * Available hash algorithms:: List of hash algorithms supported by the library. * Hash algorithm modules:: How to work with hash algorithm modules. * Working with hash algorithms:: List of functions related to hashing. @end menu @node Available hash algorithms @section Available hash algorithms @c begin table of hash algorithms @cindex SHA-1 @cindex SHA-224, SHA-256, SHA-384, SHA-512 @cindex RIPE-MD-160 @cindex MD2, MD4, MD5 @cindex TIGER @cindex HAVAL @cindex Whirlpool @cindex CRC32 @table @code @item GCRY_MD_NONE This is not a real algorithm but used by some functions as an error return value. This constant is guaranteed to have the value @code{0}. @item GCRY_MD_SHA1 This is the SHA-1 algorithm which yields a message digest of 20 bytes. @item GCRY_MD_RMD160 This is the 160 bit version of the RIPE message digest (RIPE-MD-160). Like SHA-1 it also yields a digest of 20 bytes. @item GCRY_MD_MD5 This is the well known MD5 algorithm, which yields a message digest of 16 bytes. @item GCRY_MD_MD4 This is the MD4 algorithm, which yields a message digest of 16 bytes. @item GCRY_MD_MD2 This is an reserved identifier for MD-2; there is no implementation yet. @item GCRY_MD_TIGER This is the TIGER/192 algorithm which yields a message digest of 24 bytes. @item GCRY_MD_HAVAL This is an reserved for the HAVAL algorithm with 5 passes and 160 bit. It yields a message digest of 20 bytes. Note that there is no implementation yet available. @item GCRY_MD_SHA224 This is the SHA-224 algorithm which yields a message digest of 28 bytes. See Change Notice 1 for FIPS 180-2 for the specification. @item GCRY_MD_SHA256 This is the SHA-256 algorithm which yields a message digest of 32 bytes. See FIPS 180-2 for the specification. @item GCRY_MD_SHA384 This is the SHA-384 algorithm which yields a message digest of 48 bytes. See FIPS 180-2 for the specification. @item GCRY_MD_SHA512 This is the SHA-384 algorithm which yields a message digest of 64 bytes. See FIPS 180-2 for the specification. @item GCRY_MD_CRC32 This is the ISO 3309 and ITU-T V.42 cyclic redundancy check. It yields an output of 4 bytes. @item GCRY_MD_CRC32_RFC1510 This is the above cyclic redundancy check function, as modified by RFC 1510. It yields an output of 4 bytes. @item GCRY_MD_CRC24_RFC2440 This is the OpenPGP cyclic redundancy check function. It yields an output of 3 bytes. @item GCRY_MD_WHIRLPOOL This is the Whirlpool algorithm which yields a message digest of 64 bytes. @end table @c end table of hash algorithms @node Hash algorithm modules @section Hash algorithm modules Libgcrypt makes it possible to load additional `message digest modules'; these digests can be used just like the message digest algorithms that are built into the library directly. For an introduction into extension modules, see @xref{Modules}. @deftp {Data type} gcry_md_spec_t This is the `module specification structure' needed for registering message digest modules, which has to be filled in by the user before it can be used to register a module. It contains the following members: @table @code @item const char *name The primary name of this algorithm. @item unsigned char *asnoid Array of bytes that form the ASN OID. @item int asnlen Length of bytes in `asnoid'. @item gcry_md_oid_spec_t *oids A list of OIDs that are to be associated with the algorithm. The list's last element must have it's `oid' member set to NULL. See below for an explanation of this type. See below for an explanation of this type. @item int mdlen Length of the message digest algorithm. See below for an explanation of this type. @item gcry_md_init_t init The function responsible for initializing a handle. See below for an explanation of this type. @item gcry_md_write_t write The function responsible for writing data into a message digest context. See below for an explanation of this type. @item gcry_md_final_t final The function responsible for `finalizing' a message digest context. See below for an explanation of this type. @item gcry_md_read_t read The function responsible for reading out a message digest result. See below for an explanation of this type. @item size_t contextsize The size of the algorithm-specific `context', that should be allocated for each handle. @end table @end deftp @deftp {Data type} gcry_md_oid_spec_t This type is used for associating a user-provided algorithm implementation with certain OIDs. It contains the following members: @table @code @item const char *oidstring Textual representation of the OID. @end table @end deftp @deftp {Data type} gcry_md_init_t Type for the `init' function, defined as: void (*gcry_md_init_t) (void *c) @end deftp @deftp {Data type} gcry_md_write_t Type for the `write' function, defined as: void (*gcry_md_write_t) (void *c, unsigned char *buf, size_t nbytes) @end deftp @deftp {Data type} gcry_md_final_t Type for the `final' function, defined as: void (*gcry_md_final_t) (void *c) @end deftp @deftp {Data type} gcry_md_read_t Type for the `read' function, defined as: unsigned char *(*gcry_md_read_t) (void *c) @end deftp @deftypefun gcry_error_t gcry_md_register (gcry_md_spec_t *@var{digest}, unsigned int *algorithm_id, gcry_module_t *@var{module}) Register a new digest module whose specification can be found in @var{digest}. On success, a new algorithm ID is stored in @var{algorithm_id} and a pointer representing this module is stored in @var{module}. @end deftypefun @deftypefun void gcry_md_unregister (gcry_module_t @var{module}) Unregister the digest identified by @var{module}, which must have been registered with gcry_md_register. @end deftypefun @deftypefun gcry_error_t gcry_md_list (int *@var{list}, int *@var{list_length}) Get a list consisting of the IDs of the loaded message digest modules. If @var{list} is zero, write the number of loaded message digest modules to @var{list_length} and return. If @var{list} is non-zero, the first *@var{list_length} algorithm IDs are stored in @var{list}, which must be of according size. In case there are less message digests modules than *@var{list_length}, *@var{list_length} is updated to the correct number. @end deftypefun @node Working with hash algorithms @section Working with hash algorithms To use most of these function it is necessary to create a context; this is done using: @deftypefun gcry_error_t gcry_md_open (gcry_md_hd_t *@var{hd}, int @var{algo}, unsigned int @var{flags}) Create a message digest object for algorithm @var{algo}. @var{flags} may be given as an bitwise OR of constants described below. @var{algo} may be given as @code{0} if the algorithms to use are later set using @code{gcry_md_enable}. @var{hd} is guaranteed to either receive a valid handle or NULL. For a list of supported algorithms, see @xref{Available hash algorithms}. The flags allowed for @var{mode} are: @c begin table of hash flags @table @code @item GCRY_MD_FLAG_SECURE Allocate all buffers and the resulting digest in "secure memory". Use this is the hashed data is highly confidential. @item GCRY_MD_FLAG_HMAC @cindex HMAC Turn the algorithm into a HMAC message authentication algorithm. This only works if just one algorithm is enabled for the handle. Note that the function @code{gcry_md_setkey} must be used to set the MAC key. The size of the MAC is equal to the message digest of the underlying hash algorithm. If you want CBC message authentication codes based on a cipher, see @xref{Working with cipher handles}. @end table @c begin table of hash flags You may use the function @code{gcry_md_is_enabled} to later check whether an algorithm has been enabled. @end deftypefun @c end function gcry_md_open If you want to calculate several hash algorithms at the same time, you have to use the following function right after the @code{gcry_md_open}: @deftypefun gcry_error_t gcry_md_enable (gcry_md_hd_t @var{h}, int @var{algo}) Add the message digest algorithm @var{algo} to the digest object described by handle @var{h}. Duplicated enabling of algorithms is detected and ignored. @end deftypefun If the flag @code{GCRY_MD_FLAG_HMAC} was used, the key for the MAC must be set using the function: @deftypefun gcry_error_t gcry_md_setkey (gcry_md_hd_t @var{h}, const void *@var{key}, size_t @var{keylen}) For use with the HMAC feature, set the MAC key to the value of @var{key} of length @var{keylen}. There is no restriction on the length of the key. @end deftypefun After you are done with the hash calculation, you should release the resources by using: @deftypefun void gcry_md_close (gcry_md_hd_t @var{h}) Release all resources of hash context @var{h}. @var{h} should not be used after a call to this function. A @code{NULL} passed as @var{h} is ignored. @end deftypefun Often you have to do several hash operations using the same algorithm. To avoid the overhead of creating and releasing context, a reset function is provided: @deftypefun void gcry_md_reset (gcry_md_hd_t @var{h}) Reset the current context to its initial state. This is effectively identical to a close followed by an open and enabling all currently active algorithms. @end deftypefun Often it is necessary to start hashing some data and then continue to hash different data. To avoid hashing the same data several times (which might not even be possible if the data is received from a pipe), a snapshot of the current hash context can be taken and turned into a new context: @deftypefun gcry_error_t gcry_md_copy (gcry_md_hd_t *@var{handle_dst}, gcry_md_hd_t @var{handle_src}) Create a new digest object as an exact copy of the object described by handle @var{handle_src} and store it in @var{handle_dst}. The context is not reset and you can continue to hash data using this context and independently using the original context. @end deftypefun Now that we have prepared everything to calculate hashes, it is time to see how it is actually done. There are two ways for this, one to update the hash with a block of memory and one macro to update the hash by just one character. Both methods can be used on the same hash context. @deftypefun void gcry_md_write (gcry_md_hd_t @var{h}, const void *@var{buffer}, size_t @var{length}) Pass @var{length} bytes of the data in @var{buffer} to the digest object with handle @var{h} to update the digest values. This function should be used for large blocks of data. @end deftypefun @deftypefun void gcry_md_putc (gcry_md_hd_t @var{h}, int @var{c}) Pass the byte in @var{c} to the digest object with handle @var{h} to update the digest value. This is an efficient function, implemented as a macro to buffer the data before an actual update. @end deftypefun The semantics of the hash functions do not provide for reading out intermediate message digests because the calculation must be finalized first. This finalization may for example include the number of bytes hashed in the message digest or some padding. @deftypefun void gcry_md_final (gcry_md_hd_t @var{h}) Finalize the message digest calculation. This is not really needed because @code{gcry_md_read} does this implicitly. After this has been done no further updates (by means of @code{gcry_md_write} or @code{gcry_md_putc} are allowed. Only the first call to this function has an effect. It is implemented as a macro. @end deftypefun The way to read out the calculated message digest is by using the function: @deftypefun {unsigned char *} gcry_md_read (gcry_md_hd_t @var{h}, int @var{algo}) @code{gcry_md_read} returns the message digest after finalizing the calculation. This function may be used as often as required but it will always return the same value for one handle. The returned message digest is allocated within the message context and therefore valid until the handle is released or reseted (using @code{gcry_md_close} or @code{gcry_md_reset}. @var{algo} may be given as 0 to return the only enabled message digest or it may specify one of the enabled algorithms. The function does return @code{NULL} if the requested algorithm has not been enabled. @end deftypefun Because it is often necessary to get the message digest of one block of memory, a fast convenience function is available for this task: @deftypefun void gcry_md_hash_buffer (int @var{algo}, void *@var{digest}, const void *@var{buffer}, size_t @var{length}); @code{gcry_md_hash_buffer} is a shortcut function to calculate a message digest of a buffer. This function does not require a context and immediately returns the message digest of the @var{length} bytes at @var{buffer}. @var{digest} must be allocated by the caller, large enough to hold the message digest yielded by the the specified algorithm @var{algo}. This required size may be obtained by using the function @code{gcry_md_get_algo_dlen}. Note that this function will abort the process if an unavailable algorithm is used. @end deftypefun @c *********************************** @c ***** MD info functions *********** @c *********************************** Hash algorithms are identified by internal algorithm numbers (see @code{gcry_md_open} for a list). However, in most applications they are used by names, so two functions are available to map between string representations and hash algorithm identifiers. @deftypefun {const char *} gcry_md_algo_name (int @var{algo}) Map the digest algorithm id @var{algo} to a string representation of the algorithm name. For unknown algorithms this function returns the string @code{"?"}. This function should not be used to test for the availability of an algorithm. @end deftypefun @deftypefun int gcry_md_map_name (const char *@var{name}) Map the algorithm with @var{name} to a digest algorithm identifier. Returns 0 if the algorithm name is not known. Names representing @acronym{ASN.1} object identifiers are recognized if the @acronym{IETF} dotted format is used and the OID is prefixed with either "@code{oid.}" or "@code{OID.}". For a list of supported OIDs, see the source code at @file{cipher/md.c}. This function should not be used to test for the availability of an algorithm. @end deftypefun @deftypefun gcry_error_t gcry_md_get_asnoid (int @var{algo}, void *@var{buffer}, size_t *@var{length}) Return an DER encoded ASN.1 OID for the algorithm @var{algo} in the user allocated @var{buffer}. @var{length} must point to variable with the available size of @var{buffer} and receives after return the actual size of the returned OID. The returned error code may be @code{GPG_ERR_TOO_SHORT} if the provided buffer is to short to receive the OID; it is possible to call the function with @code{NULL} for @var{buffer} to have it only return the required size. The function returns 0 on success. @end deftypefun To test whether an algorithm is actually available for use, the following macro should be used: @deftypefun gcry_error_t gcry_md_test_algo (int @var{algo}) The macro returns 0 if the algorithm @var{algo} is available for use. @end deftypefun If the length of a message digest is not known, it can be retrieved using the following function: @deftypefun {unsigned int} gcry_md_get_algo_dlen (int @var{algo}) Retrieve the length in bytes of the digest yielded by algorithm @var{algo}. This is often used prior to @code{gcry_md_read} to allocate sufficient memory for the digest. @end deftypefun In some situations it might be hard to remember the algorithm used for the ongoing hashing. The following function might be used to get that information: @deftypefun int gcry_md_get_algo (gcry_md_hd_t @var{h}) Retrieve the algorithm used with the handle @var{h}. Note that this does not work reliable if more than one algorithm is enabled in @var{h}. @end deftypefun The following macro might also be useful: @deftypefun int gcry_md_is_secure (gcry_md_hd_t @var{h}) This function returns true when the digest object @var{h} is allocated in "secure memory"; i.e. @var{h} was created with the @code{GCRY_MD_FLAG_SECURE}. @end deftypefun @deftypefun int gcry_md_is_enabled (gcry_md_hd_t @var{h}, int @var{algo}) This function returns true when the algorithm @var{algo} has been enabled for the digest object @var{h}. @end deftypefun Tracking bugs related to hashing is often a cumbersome task which requires to add a lot of printf statements into the code. Libgcrypt provides an easy way to avoid this. The actual data hashed can be written to files on request. @deftypefun void gcry_md_debug (gcry_md_hd_t @var{h}, const char *@var{suffix}) Enable debugging for the digest object with handle @var{h}. This creates create files named @file{dbgmd-.} while doing the actual hashing. @var{suffix} is the string part in the filename. The number is a counter incremented for each new hashing. The data in the file is the raw data as passed to @code{gcry_md_write} or @code{gcry_md_putc}. If @code{NULL} is used for @var{suffix}, the debugging is stopped and the file closed. This is only rarely required because @code{gcry_md_close} implicitly stops debugging. @end deftypefun The following two deprecated macros are used for debugging by old code. They shopuld be replaced by @code{gcry_md_debug}. @deftypefun void gcry_md_start_debug (gcry_md_hd_t @var{h}, const char *@var{suffix}) Enable debugging for the digest object with handle @var{h}. This creates create files named @file{dbgmd-.} while doing the actual hashing. @var{suffix} is the string part in the filename. The number is a counter incremented for each new hashing. The data in the file is the raw data as passed to @code{gcry_md_write} or @code{gcry_md_putc}. @end deftypefun @deftypefun void gcry_md_stop_debug (gcry_md_hd_t @var{h}, int @var{reserved}) Stop debugging on handle @var{h}. @var{reserved} should be specified as 0. This function is usually not required because @code{gcry_md_close} does implicitly stop debugging. @end deftypefun @c ********************************************************** @c ******************* Random ***************************** @c ********************************************************** @node Random Numbers @chapter Random Numbers @menu * Quality of random numbers:: Libgcrypt uses different quality levels. * Retrieving random numbers:: How to retrieve random numbers. @end menu @node Quality of random numbers @section Quality of random numbers @acronym{Libgcypt} offers random numbers of different quality levels: @deftp {Data type} gcry_random_level_t The constants for the random quality levels are of this enum type. @end deftp @table @code @item GCRY_WEAK_RANDOM For all functions, except for @code{gcry_mpi_randomize}, this level maps to GCRY_STRONG_RANDOM. If you do not want this, consider using @code{gcry_create_nonce}. @item GCRY_STRONG_RANDOM Use this level for session keys and similar purposes. @item GCRY_VERY_STRONG_RANDOM Use this level for long term key material. @end table @node Retrieving random numbers @section Retrieving random numbers @deftypefun void gcry_randomize (unsigned char *@var{buffer}, size_t @var{length}, enum gcry_random_level @var{level}) Fill @var{buffer} with @var{length} random bytes using a random quality as defined by @var{level}. @end deftypefun @deftypefun {void *} gcry_random_bytes (size_t @var{nbytes}, enum gcry_random_level @var{level}) Convenience function to allocate a memory block consisting of @var{nbytes} fresh random bytes using a random quality as defined by @var{level}. @end deftypefun @deftypefun {void *} gcry_random_bytes_secure (size_t @var{nbytes}, enum gcry_random_level @var{level}) Convenience function to allocate a memory block consisting of @var{nbytes} fresh random bytes using a random quality as defined by @var{level}. This function differs from @code{gcry_random_bytes} in that the returned buffer is allocated in a ``secure'' area of the memory. @end deftypefun @deftypefun void gcry_create_nonce (unsigned char *@var{buffer}, size_t @var{length}) Fill @var{buffer} with @var{length} unpredictable bytes. This is commonly called a nonce and may also be used for initialization vectors and padding. This is an extra function nearly independent of the other random function for 3 reasons: It better protects the regular random generator's internal state, provides better performance and does not drain the precious entropy pool. @end deftypefun @c ********************************************************** @c ******************* S-Expressions *********************** @c ********************************************************** @node S-expressions @chapter S-expressions S-expressions are used by the public key functions to pass complex data structures around. These LISP like objects are used by some cryptographic protocols (cf. RFC-2692) and Libgcrypt provides functions to parse and construct them. For detailed information, see @cite{Ron Rivest, code and description of S-expressions, @uref{http://theory.lcs.mit.edu/~rivest/sexp.html}}. @menu * Data types for S-expressions:: Data types related with S-expressions. * Working with S-expressions:: How to work with S-expressions. @end menu @node Data types for S-expressions @section Data types for S-expressions @deftp {Data type} gcry_sexp_t The @code{gcry_sexp_t} type describes an object with the Libgcrypt internal representation of an S-expression. @end deftp @node Working with S-expressions @section Working with S-expressions @noindent There are several functions to create an Libgcrypt S-expression object from its external representation or from a string template. There is also a function to convert the internal representation back into one of the external formats: @deftypefun gcry_error_t gcry_sexp_new (@w{gcry_sexp_t *@var{r_sexp}}, @w{const void *@var{buffer}}, @w{size_t @var{length}}, @w{int @var{autodetect}}) This is the generic function to create an new S-expression object from its external representation in @var{buffer} of @var{length} bytes. On success the result is stored at the address given by @var{r_sexp}. With @var{autodetect} set to 0, the data in @var{buffer} is expected to be in canonized format, with @var{autodetect} set to 1 the parses any of the defined external formats. If @var{buffer} does not hold a valid S-expression an error code is returned and @var{r_sexp} set to @code{NULL}. Note that the caller is responsible for releasing the newly allocated S-expression using @code{gcry_sexp_release}. @end deftypefun @deftypefun gcry_error_t gcry_sexp_create (@w{gcry_sexp_t *@var{r_sexp}}, @w{void *@var{buffer}}, @w{size_t @var{length}}, @w{int @var{autodetect}}, @w{void (*@var{freefnc})(void*)}) This function is identical to @code{gcry_sexp_new} but has an extra argument @var{freefnc}, which, when not set to @code{NULL}, is expected to be a function to release the @var{buffer}; most likely the standard @code{free} function is used for this argument. This has the effect of transferring the ownership of @var{buffer} to the created object in @var{r_sexp}. The advantage of using this function is that Libgcrypt might decide to directly use the provided buffer and thus avoid extra copying. @end deftypefun @deftypefun gcry_error_t gcry_sexp_sscan (@w{gcry_sexp_t *@var{r_sexp}}, @w{size_t *@var{erroff}}, @w{const char *@var{buffer}}, @w{size_t @var{length}}) This is another variant of the above functions. It behaves nearly identical but provides an @var{erroff} argument which will receive the offset into the buffer where the parsing stopped on error. @end deftypefun @deftypefun gcry_error_t gcry_sexp_build (@w{gcry_sexp_t *@var{r_sexp}}, @w{size_t *@var{erroff}}, @w{const char *@var{format}, ...}) This function creates an internal S-expression from the string template @var{format} and stores it at the address of @var{r_sexp}. If there is a parsing error, the function returns an appropriate error code and stores the offset into @var{format} where the parsing stopped in @var{erroff}. The function supports a couple of printf-like formatting characters and expects arguments for some of these escape sequences right after @var{format}. The following format characters are defined: @table @samp @item %m The next argument is expected to be of type @code{gcry_mpi_t} and a copy of its value is inserted into the resulting S-expression. @item %s The next argument is expected to be of type @code{char *} and that string is inserted into the resulting S-expression. @item %d The next argument is expected to be of type @code{int} and its value is inserted into the resulting S-expression. @item %b The next argument is expected to be of type @code{int} directly followed by an argument of type @code{char *}. This represents a buffer of given length to be inserted into the resulting regular expression. @end table @noindent No other format characters are defined and would return an error. Note that the format character @samp{%%} does not exists, because a percent sign is not a valid character in an S-expression. @end deftypefun @deftypefun void gcry_sexp_release (@w{gcry_sexp_t @var{sexp}}) Release the S-expression object @var{sexp}. @end deftypefun @noindent The next 2 functions are used to convert the internal representation back into a regular external S-expression format and to show the structure for debugging. @deftypefun size_t gcry_sexp_sprint (@w{gcry_sexp_t @var{sexp}}, @w{int @var{mode}}, @w{char *@var{buffer}}, @w{size_t @var{maxlength}}) Copies the S-expression object @var{sexp} into @var{buffer} using the format specified in @var{mode}. @var{maxlength} must be set to the allocated length of @var{buffer}. The function returns the actual length of valid bytes put into @var{buffer} or 0 if the provided buffer is too short. Passing @code{NULL} for @var{buffer} returns the required length for @var{buffer}. For convenience reasons an extra byte with value 0 is appended to the buffer. @noindent The following formats are supported: @table @code @item GCRYSEXP_FMT_DEFAULT Returns a convenient external S-expression representation. @item GCRYSEXP_FMT_CANON Return the S-expression in canonical format. @item GCRYSEXP_FMT_BASE64 Not currently supported. @item GCRYSEXP_FMT_ADVANCED Returns the S-expression in advanced format. @end table @end deftypefun @deftypefun void gcry_sexp_dump (@w{gcry_sexp_t @var{sexp}}) Dumps @var{sexp} in a format suitable for debugging to Libgcrypt's logging stream. @end deftypefun @noindent Often canonical encoding is used in the external representation. The following function can be used to check for valid encoding and to learn the length of the S-expression" @deftypefun size_t gcry_sexp_canon_len (@w{const unsigned char *@var{buffer}}, @w{size_t @var{length}}, @w{size_t *@var{erroff}}, @w{int *@var{errcode}}) Scan the canonical encoded @var{buffer} with implicit length values and return the actual length this S-expression uses. For a valid S-expression it should never return 0. If @var{length} is not 0, the maximum length to scan is given; this can be used for syntax checks of data passed from outside. @var{errcode} and @var{erroff} may both be passed as @code{NULL}. @end deftypefun @noindent There are a couple of functions to parse S-expressions and retrieve elements: @deftypefun gcry_sexp_t gcry_sexp_find_token (@w{const gcry_sexp_t @var{list}}, @w{const char *@var{token}}, @w{size_t @var{toklen}}) Scan the S-expression for a sublist with a type (the car of the list) matching the string @var{token}. If @var{toklen} is not 0, the token is assumed to be raw memory of this length. The function returns a newly allocated S-expression consisting of the found sublist or @code{NULL} when not found. @end deftypefun @deftypefun int gcry_sexp_length (@w{const gcry_sexp_t @var{list}}) Return the length of the @var{list}. For a valid S-expression this should be at least 1. @end deftypefun @deftypefun gcry_sexp_t gcry_sexp_nth (@w{const gcry_sexp_t @var{list}}, @w{int @var{number}}) Create and return a new S-expression from the element with index @var{number} in @var{list}. Note that the first element has the index 0. If there is no such element, @code{NULL} is returned. @end deftypefun @deftypefun gcry_sexp_t gcry_sexp_car (@w{const gcry_sexp_t @var{list}}) Create and return a new S-expression from the first element in @var{list}; this called the "type" and should always exist and be a string. @code{NULL} is returned in case of a problem. @end deftypefun @deftypefun gcry_sexp_t gcry_sexp_cdr (@w{const gcry_sexp_t @var{list}}) Create and return a new list form all elements except for the first one. Note that this function may return an invalid S-expression because it is not guaranteed, that the type exists and is a string. However, for parsing a complex S-expression it might be useful for intermediate lists. Returns @code{NULL} on error. @end deftypefun @deftypefun {const char *} gcry_sexp_nth_data (@w{const gcry_sexp_t @var{list}}, @w{int @var{number}}, @w{size_t *@var{datalen}}) This function is used to get data from a @var{list}. A pointer to the actual data with index @var{number} is returned and the length of this data will be stored to @var{datalen}. If there is no data at the given index or the index represents another list, @code{NULL} is returned. @strong{Caution:} The returned pointer is valid as long as @var{list} is not modified or released. @noindent Here is an example on how to extract and print the surname (Meier) from the S-expression @samp{(Name Otto Meier (address Burgplatz 3))}: @example size_t len; const char *name; name = gcry_sexp_nth_data (list, 2, &len); printf ("my name is %.*s\n", (int)len, name); @end example @end deftypefun @deftypefun {char *} gcry_sexp_nth_string (@w{gcry_sexp_t @var{list}}, @w{int @var{number}}) This function is used to get and convert data from a @var{list}. The data is assumed to be a Nul terminated string. The caller must release this returned value using @code{gcry_free}. If there is no data at the given index, the index represents a list or the value can't be converted to a string, @code{NULL} is returned. @end deftypefun @deftypefun gcry_mpi_t gcry_sexp_nth_mpi (@w{gcry_sexp_t @var{list}}, @w{int @var{number}}, @w{int @var{mpifmt}}) This function is used to get and convert data from a @var{list}. This data is assumed to be an MPI stored in the format described by @var{mpifmt} and returned as a standard Libgcrypt MPI. The caller must release this returned value using @code{gcry_mpi_release}. If there is no data at the given index, the index represents a list or the value can't be converted to an MPI, @code{NULL} is returned. @end deftypefun @c ********************************************************** @c ******************* MPIs ******** *********************** @c ********************************************************** @node MPI library @chapter MPI library @menu * Data types:: MPI related data types. * Basic functions:: First steps with MPI numbers. * MPI formats:: External representation of MPIs. * Calculations:: Performing MPI calculations. * Comparisons:: How to compare MPI values. * Bit manipulations:: How to access single bits of MPI values. * Miscellaneous:: Miscellaneous MPI functions. @end menu Public key cryptography is based on mathematics with large numbers. To implement the public key functions, a library for handling these large numbers is required. Because of the general usefulness of such a library, its interface is exposed by Libgcrypt. In the context of Libgcrypt and in most other applications, these large numbers are called MPIs (multi-precision-integers). @node Data types @section Data types @deftp {Data type} {gcry_mpi_t} This type represents an object to hold an MPI. @end deftp @node Basic functions @section Basic functions @noindent To work with MPIs, storage must be allocated and released for the numbers. This can be done with one of these functions: @deftypefun gcry_mpi_t gcry_mpi_new (@w{unsigned int @var{nbits}}) Allocate a new MPI object, initialize it to 0 and initially allocate enough memory for a number of at least @var{nbits}. This pre-allocation is only a small performance issue and not actually necessary because Libgcrypt automatically re-allocates the required memory. @end deftypefun @deftypefun gcry_mpi_t gcry_mpi_snew (@w{unsigned int @var{nbits}}) This is identical to @code{gcry_mpi_new} but allocates the MPI in the so called "secure memory" which in turn will take care that all derived values will also be stored in this "secure memory". Use this for highly confidential data like private key parameters. @end deftypefun @deftypefun gcry_mpi_t gcry_mpi_copy (@w{const gcry_mpi_t @var{a}}) Create a new MPI as the exact copy of @var{a}. @end deftypefun @deftypefun void gcry_mpi_release (@w{gcry_mpi_t @var{a}}) Release the MPI @var{a} and free all associated resources. Passing @code{NULL} is allowed and ignored. When a MPI stored in the "secure memory" is released, that memory gets wiped out immediately. @end deftypefun @noindent The simplest operations are used to assign a new value to an MPI: @deftypefun gcry_mpi_t gcry_mpi_set (@w{gcry_mpi_t @var{w}}, @w{const gcry_mpi_t @var{u}}) Assign the value of @var{u} to @var{w} and return @var{w}. If @code{NULL} is passed for @var{w}, a new MPI is allocated, set to the value of @var{u} and returned. @end deftypefun @deftypefun gcry_mpi_t gcry_mpi_set_ui (@w{gcry_mpi_t @var{w}}, @w{unsigned long @var{u}}) Assign the value of @var{u} to @var{w} and return @var{w}. If @code{NULL} is passed for @var{w}, a new MPI is allocated, set to the value of @var{u} and returned. This function takes an @code{unsigned int} as type for @var{u} and thus it is only possible to set @var{w} to small values (usually up to the word size of the CPU). @end deftypefun @deftypefun void gcry_mpi_swap (@w{gcry_mpi_t @var{a}}, @w{gcry_mpi_t @var{b}}) Swap the values of @var{a} and @var{b}. @end deftypefun @node MPI formats @section MPI formats @noindent The following functions are used to convert between an external representation of an MPI and the internal one of Libgcrypt. @deftypefun gcry_error_t gcry_mpi_scan (@w{gcry_mpi_t *@var{r_mpi}}, @w{enum gcry_mpi_format @var{format}}, @w{const unsigned char *@var{buffer}}, @w{size_t @var{buflen}}, @w{size_t *@var{nscanned}}) Convert the external representation of an integer stored in @var{buffer} with a length of @var{buflen} into a newly created MPI returned which will be stored at the address of @var{r_mpi}. For certain formats the length argument is not required and should be passed as @code{0}. After a successful operation the variable @var{nscanned} receives the number of bytes actually scanned unless @var{nscanned} was given as @code{NULL}. @var{format} describes the format of the MPI as stored in @var{buffer}: @table @code @item GCRYMPI_FMT_STD 2-complement stored without a length header. @item GCRYMPI_FMT_PGP As used by OpenPGP (only defined as unsigned). This is basically @code{GCRYMPI_FMT_STD} with a 2 byte big endian length header. @item GCRYMPI_FMT_SSH As used in the Secure Shell protocol. This is @code{GCRYMPI_FMT_STD} with a 4 byte big endian header. @item GCRYMPI_FMT_HEX Stored as a C style string with each byte of the MPI encoded as 2 hex digits. When using this format, @var{buflen} must be zero. @item GCRYMPI_FMT_USG Simple unsigned integer. @end table @noindent Note that all of the above formats store the integer in big-endian format (MSB first). @end deftypefun @deftypefun gcry_error_t gcry_mpi_print (@w{enum gcry_mpi_format @var{format}}, @w{unsigned char *@var{buffer}}, @w{size_t @var{buflen}}, @w{size_t *@var{nwritten}}, @w{const gcry_mpi_t @var{a}}) Convert the MPI @var{a} into an external representation described by @var{format} (see above) and store it in the provided @var{buffer} which has a usable length of at least the @var{buflen} bytes. If @var{nwritten} is not NULL, it will receive the number of bytes actually stored in @var{buffer} after a successful operation. @end deftypefun @deftypefun gcry_error_t gcry_mpi_aprint (@w{enum gcry_mpi_format @var{format}}, @w{unsigned char **@var{buffer}}, @w{size_t *@var{nbytes}}, @w{const gcry_mpi_t @var{a}}) Convert the MPI @var{a} into an external representation described by @var{format} (see above) and store it in a newly allocated buffer which address will be stored in the variable @var{buffer} points to. The number of bytes stored in this buffer will be stored in the variable @var{nbytes} points to, unless @var{nbytes} is @code{NULL}. @end deftypefun @deftypefun void gcry_mpi_dump (@w{const gcry_mpi_t @var{a}}) Dump the value of @var{a} in a format suitable for debugging to Libgcrypt's logging stream. Note that one leading space but no trailing space or linefeed will be printed. It is okay to pass @code{NULL} for @var{a}. @end deftypefun @node Calculations @section Calculations @noindent Basic arithmetic operations: @deftypefun void gcry_mpi_add (@w{gcry_mpi_t @var{w}}, @w{gcry_mpi_t @var{u}}, @w{gcry_mpi_t @var{v}}) @math{@var{w} = @var{u} + @var{v}}. @end deftypefun @deftypefun void gcry_mpi_add_ui (@w{gcry_mpi_t @var{w}}, @w{gcry_mpi_t @var{u}}, @w{unsigned long @var{v}}) @math{@var{w} = @var{u} + @var{v}}. Note that @var{v} is an unsigned integer. @end deftypefun @deftypefun void gcry_mpi_addm (@w{gcry_mpi_t @var{w}}, @w{gcry_mpi_t @var{u}}, @w{gcry_mpi_t @var{v}}, @w{gcry_mpi_t @var{m}}) @math{@var{w} = @var{u} + @var{v} \bmod @var{m}}. @end deftypefun @deftypefun void gcry_mpi_sub (@w{gcry_mpi_t @var{w}}, @w{gcry_mpi_t @var{u}}, @w{gcry_mpi_t @var{v}}) @math{@var{w} = @var{u} - @var{v}}. @end deftypefun @deftypefun void gcry_mpi_sub_ui (@w{gcry_mpi_t @var{w}}, @w{gcry_mpi_t @var{u}}, @w{unsigned long @var{v}}) @math{@var{w} = @var{u} - @var{v}}. @var{v} is an unsigned integer. @end deftypefun @deftypefun void gcry_mpi_subm (@w{gcry_mpi_t @var{w}}, @w{gcry_mpi_t @var{u}}, @w{gcry_mpi_t @var{v}}, @w{gcry_mpi_t @var{m}}) @math{@var{w} = @var{u} - @var{v} \bmod @var{m}}. @end deftypefun @deftypefun void gcry_mpi_mul (@w{gcry_mpi_t @var{w}}, @w{gcry_mpi_t @var{u}}, @w{gcry_mpi_t @var{v}}) @math{@var{w} = @var{u} * @var{v}}. @end deftypefun @deftypefun void gcry_mpi_mul_ui (@w{gcry_mpi_t @var{w}}, @w{gcry_mpi_t @var{u}}, @w{unsigned long @var{v}}) @math{@var{w} = @var{u} * @var{v}}. @var{v} is an unsigned integer. @end deftypefun @deftypefun void gcry_mpi_mulm (@w{gcry_mpi_t @var{w}}, @w{gcry_mpi_t @var{u}}, @w{gcry_mpi_t @var{v}}, @w{gcry_mpi_t @var{m}}) @math{@var{w} = @var{u} * @var{v} \bmod @var{m}}. @end deftypefun @deftypefun void gcry_mpi_mul_2exp (@w{gcry_mpi_t @var{w}}, @w{gcry_mpi_t @var{u}}, @w{unsigned long @var{e}}) @c FIXME: I am in need for a real TeX{info} guru: @c I don't know why TeX can grok @var{e} here. @math{@var{w} = @var{u} * 2^e}. @end deftypefun @deftypefun void gcry_mpi_div (@w{gcry_mpi_t @var{q}}, @w{gcry_mpi_t @var{r}}, @w{gcry_mpi_t @var{dividend}}, @w{gcry_mpi_t @var{divisor}}, @w{int @var{round}}) @math{@var{q} = @var{dividend} / @var{divisor}}, @math{@var{r} = @var{dividend} \bmod @var{divisor}}. @var{q} and @var{r} may be passed as @code{NULL}. @var{round} should be negative or 0. @end deftypefun @deftypefun void gcry_mpi_mod (@w{gcry_mpi_t @var{r}}, @w{gcry_mpi_t @var{dividend}}, @w{gcry_mpi_t @var{divisor}}) @math{@var{r} = @var{dividend} \bmod @var{divisor}}. @end deftypefun @deftypefun void gcry_mpi_powm (@w{gcry_mpi_t @var{w}}, @w{const gcry_mpi_t @var{b}}, @w{const gcry_mpi_t @var{e}}, @w{const gcry_mpi_t @var{m}}) @c I don't know why TeX can grok @var{e} here. @math{@var{w} = @var{b}^e \bmod @var{m}}. @end deftypefun @deftypefun int gcry_mpi_gcd (@w{gcry_mpi_t @var{g}}, @w{gcry_mpi_t @var{a}}, @w{gcry_mpi_t @var{b}}) Set @var{g} to the greatest common divisor of @var{a} and @var{b}. Return true if the @var{g} is 1. @end deftypefun @deftypefun int gcry_mpi_invm (@w{gcry_mpi_t @var{x}}, @w{gcry_mpi_t @var{a}}, @w{gcry_mpi_t @var{m}}) Set @var{x} to the multiplicative inverse of @math{@var{a} \bmod @var{m}}. Return true if the inverse exists. @end deftypefun @node Comparisons @section Comparisons @noindent The next 2 functions are used to compare MPIs: @deftypefun int gcry_mpi_cmp (@w{const gcry_mpi_t @var{u}}, @w{const gcry_mpi_t @var{v}}) Compare the multi-precision-integers number @var{u} and @var{v} returning 0 for equality, a positive value for @var{u} > @var{v} and a negative for @var{u} < @var{v}. @end deftypefun @deftypefun int gcry_mpi_cmp_ui (@w{const gcry_mpi_t @var{u}}, @w{unsigned long @var{v}}) Compare the multi-precision-integers number @var{u} with the unsigned integer @var{v} returning 0 for equality, a positive value for @var{u} > @var{v} and a negative for @var{u} < @var{v}. @end deftypefun @node Bit manipulations @section Bit manipulations @noindent There are a couple of functions to get information on arbitrary bits in an MPI and to set or clear them: @deftypefun {unsigned int} gcry_mpi_get_nbits (@w{gcry_mpi_t @var{a}}) Return the number of bits required to represent @var{a}. @end deftypefun @deftypefun int gcry_mpi_test_bit (@w{gcry_mpi_t @var{a}}, @w{unsigned int @var{n}}) Return true if bit number @var{n} (counting from 0) is set in @var{a}. @end deftypefun @deftypefun void gcry_mpi_set_bit (@w{gcry_mpi_t @var{a}}, @w{unsigned int @var{n}}) Set bit number @var{n} in @var{a}. @end deftypefun @deftypefun void gcry_mpi_clear_bit (@w{gcry_mpi_t @var{a}}, @w{unsigned int @var{n}}) Clear bit number @var{n} in @var{a}. @end deftypefun @deftypefun void gcry_mpi_set_highbit (@w{gcry_mpi_t @var{a}}, @w{unsigned int @var{n}}) Set bit number @var{n} in @var{a} and clear all bits greater than @var{n}. @end deftypefun @deftypefun void gcry_mpi_clear_highbit (@w{gcry_mpi_t @var{a}}, @w{unsigned int @var{n}}) Clear bit number @var{n} in @var{a} and all bits greater than @var{n}. @end deftypefun @deftypefun void gcry_mpi_rshift (@w{gcry_mpi_t @var{x}}, @w{gcry_mpi_t @var{a}}, @w{unsigned int @var{n}}) Shift the value of @var{a} by @var{n} bits to the right and store the result in @var{x}. @end deftypefun @deftypefun void gcry_mpi_lshift (@w{gcry_mpi_t @var{x}}, @w{gcry_mpi_t @var{a}}, @w{unsigned int @var{n}}) Shift the value of @var{a} by @var{n} bits to the left and store the result in @var{x}. @end deftypefun @node Miscellaneous @section Miscellaneous @deftypefun gcry_mpi_t gcry_mpi_set_opaque (@w{gcry_mpi_t @var{a}}, @w{void *@var{p}}, @w{unsigned int @var{nbits}}) Store @var{nbits} of the value @var{p} points to in @var{a} and mark @var{a} as an opaque value (i.e. an value that can't be used for any math calculation and is only used to store an arbitrary bit pattern in @var{a}). WARNING: Never use an opaque MPI for actual math operations. The only valid functions are gcry_mpi_get_opaque and gcry_mpi_release. Use gcry_mpi_scan to convert a string of arbitrary bytes into an MPI. @end deftypefun @deftypefun {void *} gcry_mpi_get_opaque (@w{gcry_mpi_t @var{a}}, @w{unsigned int *@var{nbits}}) Return a pointer to an opaque value stored in @var{a} and return its size in @var{nbits}. Note that the returned pointer is still owned by @var{a} and that the function should never be used for an non-opaque MPI. @end deftypefun @deftypefun void gcry_mpi_set_flag (@w{gcry_mpi_t @var{a}}, @w{enum gcry_mpi_flag @var{flag}}) Set the @var{flag} for the MPI @var{a}. Currently only the flag @code{GCRYMPI_FLAG_SECURE} is allowed to convert @var{a} into an MPI stored in "secure memory". @end deftypefun @deftypefun void gcry_mpi_clear_flag (@w{gcry_mpi_t @var{a}}, @w{enum gcry_mpi_flag @var{flag}}) Clear @var{flag} for the multi-precision-integers @var{a}. Note that this function is currently useless as no flags are allowed. @end deftypefun @deftypefun int gcry_mpi_get_flag (@w{gcry_mpi_t @var{a}}, @w{enum gcry_mpi_flag @var{flag}}) Return true when the @var{flag} is set for @var{a}. @end deftypefun @deftypefun void gcry_mpi_randomize (@w{gcry_mpi_t @var{w}}, @w{unsigned int @var{nbits}}, @w{enum gcry_random_level @var{level}}) Set the multi-precision-integers @var{w} to a random value of @var{nbits}, using random data quality of level @var{level}. In case @var{nbits} is not a multiple of a byte, @var{nbits} is rounded up to the next byte boundary. When using a @var{level} of @code{GCRY_WEAK_RANDOM} this function makes use of @code{gcry_create_nonce}. @end deftypefun @c ********************************************************** @c ******************** Prime numbers *********************** @c ********************************************************** @node Prime numbers @chapter Prime numbers @menu * Generation:: Generation of new prime numbers. * Checking:: Checking if a given number is prime. @end menu @node Generation @section Generation @deftypefun gcry_error_t gcry_prime_generate (gcry_mpi_t *@var{prime},unsigned int @var{prime_bits}, unsigned int @var{factor_bits}, gcry_mpi_t **@var{factors}, gcry_prime_check_func_t @var{cb_func}, void *@var{cb_arg}, gcry_random_level_t @var{random_level}, unsigned int @var{flags}) Generate a new prime number of @var{prime_bits} bits and store it in @var{prime}. If @var{factor_bits} is non-zero, one of the prime factors of (@var{prime} - 1) / 2 must be @var{factor_bits} bits long. If @var{factors} is non-zero, allocate a new, @code{NULL}-terminated array holding the prime factors and store it in @var{factors}. @var{flags} might be used to influence the prime number generation process. @end deftypefun @deftypefun gcry_error_t gcry_prime_group_generator (gcry_mpi_t *@var{r_g}, gcry_mpi_t @var{prime}, gcry_mpi_t *@var{factors}, gcry_mpi_t @var{start_g}) Find a generator for @var{prime} where the factorization of (@var{prime}-1) is in the @code{NULL} terminated array @var{factors}. Return the generator as a newly allocated MPI in @var{r_g}. If @var{start_g} is not NULL, use this as the start for the search. @end deftypefun @deftypefun void gcry_prime_release_factors (gcry_mpi_t *@var{factors}) Convenience function to release the @var{factors} array. @end deftypefun @node Checking @section Checking @deftypefun gcry_error_t gcry_prime_check (gcry_mpi_t @var{p}, unsigned int @var{flags}) Check wether the number @var{p} is prime. Returns zero in case @var{p} is indeed a prime, returns @code{GPG_ERR_NO_PRIME} in case @var{p} is not a prime and a different error code in case something went horribly wrong. @end deftypefun @c ********************************************************** @c ******************** Utilities *************************** @c ********************************************************** @node Utilities @chapter Utilities @menu * Memory allocation:: Functions related with memory allocation. @end menu @node Memory allocation @section Memory allocation @deftypefun {void *} gcry_malloc (size_t @var{n}) This function tries to allocate @var{n} bytes of memory. On success it returns a pointer to the memory area, in an out-of-core condition, it returns NULL. @end deftypefun @deftypefun {void *} gcry_malloc_secure (size_t @var{n}) Like @code{gcry_malloc}, but uses secure memory. @end deftypefun @deftypefun {void *} gcry_calloc (size_t @var{n}) This function tries to allocate @var{n} bytes of cleared memory (i.e. memory that is initialized with zero bytes). On success it returns a pointer to the memory area, in an out-of-core condition, it returns NULL. @end deftypefun @deftypefun {void *} gcry_calloc_secure (size_t @var{n}) Like @code{gcry_calloc}, but uses secure memory. @end deftypefun @deftypefun {void *} gcry_realloc (void *@var{p}, size_t @var{n}) This function tries to resize the memory area pointed to by @var{p} to @var{n} bytes. On success it returns a pointer to the new memory area, in an out-of-core condition, it returns NULL. Depending on whether the memory pointed to by @var{p} is secure memory or not, gcry_realloc tries to use secure memory as well. @end deftypefun @deftypefun void gcry_free (void *@var{p}) Release the memory area pointed to by @var{p}. @end deftypefun @c ********************************************************** @c ***************** Architecure Overview ***************** @c ********************************************************** @node Architecture @chapter Architecture This chapter describes the internal architecture of Libgcrypt. Libgcrypt is a function library written in ISO C-90. Any compliant compiler should be able to build Libgcrypt as long as the target is either a POSIX platform or compatible to the API used by Windows NT. Provisions have been take so that the library can be directly used from C++ applications; however building with a C++ compiler is not supported. Building Libgcrypt is done by using the common @code{./configure && make} approach. The configure command is included in the source distribution and as a portable shell script it works on any Unix-alike system. The result of running the configure script are a C header file (@file{config.h}), customized Makefiles, the setup of symbolic links and a few other things. After that the make tool builds and optionally installs the library and the documentation. See the files @file{INSTALL} and @file{README} in the source distribution on how to do this. Libgcrypt is developed using a Subversion@footnote{A version control system available for many platforms} repository. Although all released versions are tagged in this repository, they should not be used to build production versions of Libgcrypt. Instead released tarballs should be used. These tarballs are available from several places with the master copy at @indicateurl{ftp://ftp.gnupg.org/gcrypt/libgcrypt/}. Announcements of new releases are posted to the @indicateurl{gnupg-announce@@gnupg.org} mailing list@footnote{See @url{http://www.gnupg.org/documentation/mailing-lists.en.html} for details.}. @float Figure,fig:subsystems @caption{Libgcrypt subsystems} @center @image{libgcrypt-modules, 150mm,,Libgcrypt subsystems} @end float Libgcrypt consists of several subsystems (@pxref{fig:subsystems}) and all these subsystems provide a public API; this includes the helper subsystems like the one for S-expressions. The API style depends on the subsystem; in general an open-use-close approach is implemented. The open returns a handle to a context used for all further operations on this handle, several functions may then be used on this handle and a final close function releases all resources associated with the handle. @menu * Public-Key Subsystem Architecture:: About public keys. * Symmetric Encryption Subsystem Architecture:: About standard ciphers. * Hashing and MACing Subsystem Architecture:: About hashing. * Multi-Precision-Integer Subsystem Architecture:: About big integers. * Prime-Number-Generator Subsystem Architecture:: About prime numbers. * Random-Number Subsystem Architecture:: About random stuff. @c * Helper Subsystems Architecture:: About other stuff. @end menu @node Public-Key Subsystem Architecture @section Public-Key Architecture Libgcrypt implements two interfaces for public key cryptography: The standard interface is PK interface using functions in the @code{gcry_pk_} name space. The AC interface in an alternative one which is now deprecated and will not be further described. The AC interface is also disabled in FIPS mode. Because public key cryptography is almost always used to process small amounts of data (hash values or session keys), the interface is not implemented using the open-use-close paradigm, but with single self-contained functions. Due to the wide variety of parameters required by different algorithms S-expressions, as flexible way to convey these parameters, are used. There is a set of helper functions to work with these S-expressions. @c see @xref{S-expression Subsystem Architecture}. Aside of functions to register new algorithms, map algorithms names to algorithms identifiers and to lookup properties of a key, the following main functions are available: @table @code @item gcry_pk_encrypt Encrypt data using a public key. @item gcry_pk_decrypt Decrypt data using a private key. @item gcry_pk_sign Sign data using a private key. @item gcry_pk_verify Verify that a signature matches the data. @item gcry_pk_testkey Perform a consistency over a public or private key. @item gcry_pk_genkey Create a new public/private key pair. @end table With the help of the module registration system all these functions lookup the module implementing the algorithm and pass the actual work to that module. The parsing of the S-expression input and the construction of S-expression for the return values is done by the high level code (@file{cipher/pubkey.c}). Thus the internal interface between the algorithm modules and the high level functions passes data in a custom format. The interface to the modules is published (@file{gcrypt-modules.h}) so that it can used to register external implementations of algorithms with Libgcrypt. However, for some algorithms this module interface is to limited and thus for the internal modules an extra interface is sometimes used to convey more information. By default Libgcrypt uses a blinding technique for RSA decryption to mitigate real world timing attacks over a network: Instead of using the RSA decryption directly, a blinded value @math{y = x r^{e} \bmod n} is decrypted and the unblinded value @math{x' = y' r^{-1} \bmod n} returned. The blinding value @math{r} is a random value with the size of the modulus @math{n} and generated with @code{GCRY_STRONG_RANDOM} random level. @node Symmetric Encryption Subsystem Architecture @section Symmetric Encryption Subsystem Architecture The interface to work with symmetric encryption algorithms is made up of functions from the @code{gcry_cipher_} name space. The implementation follows the open-use-close paradigm and uses registered algorithm modules for the actual work. Unless a module implements optimized cipher mode implementations, the high level code (@file{cipher/cipher.c}) implements the modes and calls the core algorithm functions to process each block. The most important functions are: @table @code @item gcry_cipher_open Create a new instance to encrypt or decrypt using a specified algorithm and mode. @item gcry_cipher_close Release an instance. @item gcry_cipher_setkey Set a key to be used for encryption or decryption. @item gcry_cipher_setiv Set an initialization vector to be used for encryption or decryption. @item gcry_cipher_encrypt @itemx gcry_cipher_decrypt Encrypt or decrypt data. These functions may be called with arbitrary amounts of data and as often as needed to encrypt or decrypt all data. @end table There are also functions to query properties of algorithms or context, like block length, key length, map names or to enable features like padding methods. @node Hashing and MACing Subsystem Architecture @section Hashing and MACing Subsystem Architecture The interface to work with message digests and CRC algorithms is made up of functions from the @code{gcry_md_} name space. The implementation follows the open-use-close paradigm and uses registered algorithm modules for the actual work. Although CRC algorithms are not considered cryptographic hash algorithms, they share enough properties so that it makes sense to handle them in the same way. It is possible to use several algorithms at once with one context and thus compute them all on the same data. The most important functions are: @table @code @item gcry_md_open Create a new message digest instance and optionally enable one algorithm. A flag may be used to turn the message digest algorithm into a HMAC algorithm. @item gcry_md_enable Enable an additional algorithm for the instance. @item gcry_md_setkey Set the key for the MAC. @item gcry_md_write Pass more data for computing the message digest to an instance. @item gcry_md_putc Buffered version of @code{gcry_md_write} implemented as a macro. @item gcry_md_read Finalize the computation of the message digest or HMAC and return the result. @item gcry_md_close Release an instance @item gcry_md_hash_buffer Convenience function to directly compute a message digest over a memory buffer without the need to create an instance first. @end table There are also functions to query properties of algorithms or the instance, like enabled algorithms, digest length, map algorithm names. it is also possible to reset an instance or to copy the current state of an instance at any time. Debug functions to write the hashed data to files are available as well. @node Multi-Precision-Integer Subsystem Architecture @section Multi-Precision-Integer Subsystem Architecture The implementation of Libgcrypt's big integer computation code is based on an old release of GNU Multi-Precision Library (GMP). The decision not to use the GMP library directly was due to stalled development at that time and due to security requirements which could not be provided by the code in GMP. As GMP does, Libgcrypt provides high performance assembler implementations of low level code for several CPUS to gain much better performance than with a generic C implementation. @noindent Major features of Libgcrypt's multi-precision-integer code compared to GMP are: @itemize @item Avoidance of stack based allocations to allow protection against swapping out of sensitive data and for easy zeroing of sensitive intermediate results. @item Optional use of secure memory and tracking of its use so that results are also put into secure memory. @item MPIs are identified by a handle (implemented as a pointer) to give better control over allocations and to augment them with extra properties like opaque data. @item Removal of unnecessary code to reduce complexity. @item Functions specialized for public key cryptography. @end itemize @node Prime-Number-Generator Subsystem Architecture @section Prime-Number-Generator Subsystem Architecture Libgcrypt provides an interface to its prime number generator. These functions make use of the internal prime number generator which is required for the generation for public key key pairs. The plain prime checking function is exported as well. The generation of random prime numbers is based on the Lim and Lee algorithm to create practically save primes.@footnote{Chae Hoon Lim and Pil Joong Lee. A key recovery attack on discrete log-based shemes using a prime order subgroup. In Burton S. Kaliski Jr., editor, Advances in Cryptology: Crypto '97, pages 249­-263, Berlin / Heidelberg / New York, 1997. Springer-Verlag. Described on page 260.} This algorithm creates a pool of smaller primes, select a few of them to create candidate primes of the form @math{2 * p_0 * p_1 * ... * p_n + 1}, tests the candidate for primality and permutates the pool until a prime has been found. It is possible to clamp one of the small primes to a certain size to help DSA style algorithms. Because most of the small primes in the pool are not used for the resulting prime number, they are saved for later use (see @code{save_pool_prime} and @code{get_pool_prime} in @file{cipher/primegen.c}). The prime generator optionally supports the finding of an appropriate generator. @noindent The primality test works in three steps: @enumerate @item The standard sieve algorithm using the primes up to 4999 is used as a quick first check. @item A Fermat test filters out almost all non-primes. @item A 5 round Rabin-Miller test is finally used. The first round uses a witness of 2, whereas the next rounds use a random witness. @end enumerate @node Random-Number Subsystem Architecture @section Random-Number Subsystem Architecture Libgcrypt provides 3 levels or random quality: The level @code{GCRY_VERY_STRONG_RANDOM} usually used for key generation, the level @code{GCRY_STRONG_RANDOM} for all other strong random requirements and the function @code{gcry_create_nonce} which is used for weaker usages like nonces. There is also a level @code{GCRY_WEAK_RANDOM} which in general maps to @code{GCRY_STRONG_RANDOM} except when used with the function @code{gcry_mpi_randomize}, where it randomizes an multi-precision-integer using the @code{gcry_create_nonce} function. @noindent There are two distinct random generators available: @itemize @item The Continuously Seeded Pseudo Random Number Generator (CSPRNG), which is based on the classic GnuPG derived big pool implementation. Implemented in @code{random/random-csprng.c} and used by default. @item A FIPS approved ANSI X9.31 PRNG using AES with a 128 bit key. Implemented in @code{random/random-fips.c} and used if Libgcrypt is in FIPS mode. @end itemize @noindent Both generators make use of so-called entropy gathering modules: @table @asis @item rndlinux Uses the operating system provided @file{/dev/random} and @file{/dev/urandom} devices. @item rndunix Runs several operating system commands to collect entropy from sources like virtual machine and process statistics. It is a kind of poor-man's @code{/dev/random} implementation. It is not available in FIPS mode. @item rndegd Uses the operating system provided Entropy Gathering Daemon (EGD). The EGD basically uses the same algorithms as rndunix does. However as a system daemon it keeps on running and thus can serve several processes requiring entropy input and does not waste collected entropy if the application does not need all the collected entropy. It is not available in FIPS mode. @item rndw32 Targeted for the Microsoft Windows OS. It uses certain properties of that system and is the only gathering module available for that OS. @item rndhw Extra module to collect additional entropy by utilizing a hardware random number generator. As of now the only supported hardware RNG is the Padlock engine of VIA (Centaur) CPUs. It is not available in FIPS mode. @end table @menu * CSPRNG Description:: Description of the CSPRNG. * FIPS PRNG Description:: Description of the FIPS X9.31 PRNG. @end menu @node CSPRNG Description @subsection Description of the CSPRNG This random number generator is loosely modelled after the one described in Peter Gutmann's paper: "Software Generation of Practically Strong Random Numbers".@footnote{Also described in chapter 6 of his book "Cryptographic Security Architecture", New York, 2004, ISBN 0-387-95387-6.} A pool of 600 bytes is used and mixed using the core RIPE-MD160 hash transform function. Several extra features are used to make the robust against a wide variety of attacks and to protect against failures of subsystems. The state of the generator may be saved to a file and initially seed form a file. Depending on how Libgcrypt was build the generator is able to select the best working entropy gathering module. It makes use of the slow and fast collection methods and requires the pool to initially seeded form the slow gatherer or a seed file. An entropy estimation is used to mix in enough data from the gather modules before returning the actual random output. Process fork detection and protection is implemented. @c FIXME: The design and implementaion needs a more verbose description. The implementation of the nonce generator (for @code{gcry_create_nonce}) is a straightforward repeated hash design: A 28 byte buffer is initially seeded with the PID and the time in seconds in the first 20 bytes and with 8 bytes of random taken from the @code{GCRY_STRONG_RANDOM} generator. Random numbers are then created by hashing all the 28 bytes with SHA-1 and saving that again in the first 20 bytes. The hash is also returned as result. @node FIPS PRNG Description @subsection Description of the FIPS X9.31 PRNG The core of this deterministic random number generator is implemented according to the document ``NIST-Recommended Random Number Generator Based on ANSI X9.31 Appendix A.2.4 Using the 3-Key Triple DES and AES Algorithms'', dated 2005-01-31. This implementation uses the AES variant. The generator is based on contexts to utilize the same core functions for all random levels as required by the high-level interface. All random generators return their data in 128 bit blocks. If the caller requests less bits, the extra bits are not used. The key for each generator is only set once at the first time a generator context is used. The seed value is set along with the key and again after 1000 output blocks. On Unix like systems the @code{GCRY_VERY_STRONG_RANDOM} and @code{GCRY_STRONG_RANDOM} generators are keyed and seeded using the rndlinux module with the @file{/dev/radnom} device. Thus these generators may block until the OS kernel has collected enough entropy. When used with Microsoft Windows the rndw32 module is used instead. The generator used for @code{gcry_create_nonce} is keyed and seeded from the @code{GCRY_STRONG_RANDOM} generator. Thus is may also block if the @code{GCRY_STRONG_RANDOM} generator has not yet been used before and thus gets initialized on the first use by @code{gcry_create_nonce}. This special treatment is justified by the weaker requirements for a nonce generator and to save precious kernel entropy for use by the ``real'' random generators. A self-test facility uses a separate context to check the functionality of the core X9.31 functions using a known answers test. During runtime each output block is compared to the previous one to detect a stucked generator. The DT value for the generator is made up of the current time down to microseconds (if available) and a free running 64 bit counter. When used with the test context the DT value is taken from the context and incremented on each use. @c @node Helper Subsystems Architecture @c @section Helper Subsystems Architecture @c @c There are a few smaller subsystems which are mainly used internally by @c Libgcrypt but also available to applications. @c @c @menu @c * S-expression Subsystem Architecture:: Details about the S-expression architecture. @c * Memory Subsystem Architecture:: Details about the memory allocation architecture. @c * Miscellaneous Subsystems Architecture:: Details about other subsystems. @c @end menu @c @c @node S-expression Subsystem Architecture @c @subsection S-expression Subsystem Architecture @c @c Libgcrypt provides an interface to S-expression to create and parse @c them. To use an S-expression with Libgcrypt it needs first be @c converted into the internal representation used by Libgcrypt (the type @c @code{gcry_sexp_t}). The conversion functions support a large subset @c of the S-expression specification and further fature a printf like @c function to convert a list of big integers or other binary data into @c an S-expression. @c @c Libgcrypt currently implements S-expressions using a tagged linked @c list. However this is not exposed to an application and may be @c changed in future releases to reduce overhead when already working @c with canonically encoded S-expressions. Secure memory is supported by @c this S-expressions implementation. @c @c @node Memory Subsystem Architecture @c @subsection Memory Subsystem Architecture @c @c TBD. @c @c @c @node Miscellaneous Subsystems Architecture @c @subsection Miscellaneous Subsystems Architecture @c @c TBD. @c @c @c ********************************************************** @c ******************* Appendices ************************* @c ********************************************************** @c ******************************************** @node Self-Tests @appendix Description of the Self-Tests In addition to the build time regression test suite, Libgcrypt implements self-tests to be performed at runtime. Which self-tests are actually used depends on the mode Libgcrypt is used in. In standard mode a limited set of self-tests is run at the time an algorithm is first used. Note that not all algorithms feature a self-test in standard mode. The @code{GCRYCTL_SELFTEST} control command may be used to run all implemented self-tests at any time; this will even run more tests than those run in FIPS mode. If any of the self-tests fails, the library immediately returns an error code to the caller. If Libgcrypt is in FIPS mode the self-tests will be performed within the ``Self-Test'' state and any failure puts the library into the ``Error'' state. @c -------------------------------- @section Power-Up Tests Power-up tests are only performed if Libgcrypt is in FIPS mode. @subsection Symmetric Cipher Algorithm Power-Up Tests The following symmetric encryption algorithm tests are run during power-up: @table @asis @item 3DES To test the 3DES 3-key EDE encryption in ECB mode these tests are run: @enumerate @item A known answer test is run on a 64 bit test vector processed by 64 rounds of Single-DES block encryption and decryption using a key changed with each round. @item A known answer test is run on a 64 bit test vector processed by 16 rounds of 2-key and 3-key Triple-DES block encryption and decryptions using a key changed with each round. @item 10 known answer tests using 3-key Triple-DES EDE encryption, comparing the ciphertext to the known value, then running a decryption and comparing it to the initial plaintext. @end enumerate (@code{cipher/des.c:selftest}) @item AES-128 A known answer tests is run using one test vector and one test key with AES in ECB mode. (@code{cipher/rijndael.c:selftest_basic_128}) @item AES-192 A known answer tests is run using one test vector and one test key with AES in ECB mode. (@code{cipher/rijndael.c:selftest_basic_192}) @item AES-256 A known answer tests is run using one test vector and one test key with AES in ECB mode. (@code{cipher/rijndael.c:selftest_basic_256}) @end table @subsection Hash Algorithm Power-Up Tests The following hash algorithm tests are run during power-up: @table @asis @item SHA-1 A known answer test using the string @code{"abc"} is run. (@code{cipher/@/sha1.c:@/selftests_sha1}) @item SHA-224 A known answer test using the string @code{"abc"} is run. (@code{cipher/@/sha256.c:@/selftests_sha224}) @item SHA-256 A known answer test using the string @code{"abc"} is run. (@code{cipher/@/sha256.c:@/selftests_sha256}) @item SHA-384 A known answer test using the string @code{"abc"} is run. (@code{cipher/@/sha512.c:@/selftests_sha384}) @item SHA-512 A known answer test using the string @code{"abc"} is run. (@code{cipher/@/sha512.c:@/selftests_sha512}) @end table @subsection MAC Algorithm Power-Up Tests The following MAC algorithm tests are run during power-up: @table @asis @item HMAC SHA-1 A known answer test using 9 byte of data and a 64 byte key is run. (@code{cipher/hmac-tests.c:selftests_sha1}) @item HMAC SHA-224 A known answer test using 28 byte of data and a 4 byte key is run. (@code{cipher/hmac-tests.c:selftests_sha224}) @item HMAC SHA-256 A known answer test using 28 byte of data and a 4 byte key is run. (@code{cipher/hmac-tests.c:selftests_sha256}) @item HMAC SHA-384 A known answer test using 28 byte of data and a 4 byte key is run. (@code{cipher/hmac-tests.c:selftests_sha384}) @item HMAC SHA-512 A known answer test using 28 byte of data and a 4 byte key is run. (@code{cipher/hmac-tests.c:selftests_sha512}) @end table @subsection Random Number Power-Up Test The DRNG is tested during power-up this way: @enumerate @item Requesting one block of random using the public interface to check general working and the duplicated block detection. @item 3 know answer tests using pre-defined keys, seed and initial DT values. For each test 3 blocks of 16 bytes are requested and compared to the expected result. The DT value is incremented for each block. @end enumerate @subsection Public Key Algorithm Power-Up Tests The public key algorithms are tested during power-up: @table @asis @item RSA A pre-defined 1024 bit RSA key is used and these tests are run in turn: @enumerate @item Conversion of S-expression to internal format. (@code{cipher/@/rsa.c:@/selftests_rsa}) @item Private key consistency check. (@code{cipher/@/rsa.c:@/selftests_rsa}) @item A pre-defined 20 byte value is signed with PKCS#1 padding for SHA-1. The result is verified using the public key against the original data and against modified data. (@code{cipher/@/rsa.c:@/selftest_sign_1024}) @item A 1000 bit random value is encrypted and checked that it does not match the orginal random value. The encrtypted result is then decrypted and checked that it macthes the original random value. (@code{cipher/@/rsa.c:@/selftest_encr_1024}) @end enumerate @item DSA A pre-defined 1024 bit DSA key is used and these tests are run in turn: @enumerate @item Conversion of S-expression to internal format. (@code{cipher/@/dsa.c:@/selftests_dsa}) @item Private key consistency check. (@code{cipher/@/dsa.c:@/selftests_dsa}) @item A pre-defined 20 byte value is signed with PKCS#1 padding for SHA-1. The result is verified using the public key against the original data and against modified data. (@code{cipher/@/dsa.c:@/selftest_sign_1024}) @end enumerate @end table @subsection Integrity Power-Up Tests The integrity of the Libgcrypt is tested during power-up but only if checking has been enabled at build time. The check works by computing a HMAC SHA-256 checksum over the file used to load Libgcrypt into memory. That checksum is compared against a checksum stored in a file of the same name but with a single dot as a prefix and a suffix of @file{.hmac}. @subsection Critical Functions Power-Up Tests The 3DES weak key detection is tested during power-up by calling the detection function with keys taken from a table listening all weak keys. The table itself is protected using a SHA-1 hash. (@code{cipher/@/des.c:@/selftest}) @c -------------------------------- @section Conditional Tests The conditional tests are performed if a certain contidion is met. This may occur at any time; the library does not necessary enter the ``Self-Test'' state to run these tests but will transit to the ``Error'' state if a test failed. @subsection Key-Pair Generation Tests After an asymmetric key-pair has been generated, Libgcrypt runs a pair-wise consistency tests on the generated key. On failure the generated key is not used, an error code is returned and, if in FIPS mode, the library is put into the ``Error'' state. @table @asis @item RSA The test uses a random number 64 bits less the size of the modulus as plaintext and runs an encryption and decryption operation in turn. The encrypted value is checked to not match the plaintext and the result of the decryption is checked to match the plaintext. A new random number of the same size is generated, signed and verified to test the correctness of the signing operation. As a second signing test, the signature is modified by incrementing its value and then verified with the expected result that the verification fails. (@code{cipher/@/rsa.c:@/test_keys}) @item DSA The test uses a random number of the size of the Q parameter to create a signature and then checks that the signature verifies. As a second signing test, the data is modified by incrementing its value and then verified against the signature with the expected result that the verification fails. (@code{cipher/@/dsa.c:@/test_keys}) @end table @subsection Software Load Tests Loading of extra modules into libgcrypt is disabled in FIPS mode and thus no tests are implemented. (@code{cipher/@/cipher.c:@/gcry_cipher_register}, @code{cipher/@/md.c:@/gcry_md_register}, @code{cipher/@/md.c:@/gcry_pk_register}) @subsection Manual Key Entry Tests A manual key entry feature is not implemented in Libgcrypt. @subsection Continuous RNG Tests The continuous random number test is only used in FIPS mode. The RNG generates blocks of 128 bit size; the first block generated per context is saved in the context and another block is generated to be returned to the caller. Each block is compared against the saved block and then stored in the context. If a duplicated block is detected an error is signaled and the libray is put into the ``Fatal-Error'' state. (@code{random/@/random-fips.c:@/x931_aes_driver}) @c -------------------------------- @section Application Requested Tests The application may requests tests at any time by means of the @code{GCRYCTL_SELFTEST} control command. Note that using these tests is not FIPS conform: Although Libgcrypt rejects all application requests for services while running self-tests, it does not ensure that no other operations of Libgcrypt are still being executed. Thus, in FIPS mode an application requesting self-tests needs to power-cycle Libgcrypt instead. When self-tests are requested, Libgcrypt runs all the tests it does during power-up as well as a few extra checks as described below. @subsection Symmetric Cipher Algorithm Tests The following symmetric encryption algorithm tests are run in addition to the power-up tests: @table @asis @item AES-128 A known answer tests with test vectors taken from NIST SP800-38a and using the high level functions is run for block modes CFB and OFB. @end table @subsection Hash Algorithm Tests The following hash algorithm tests are run in addition to the power-up tests: @table @asis @item SHA-1 @itemx SHA-224 @itemx SHA-256 @enumerate @item A known answer test using a 56 byte string is run. @item A known answer test using a string of one million letters "a" is run. @end enumerate (@code{cipher/@/sha1.c:@/selftests_sha1}, @code{cipher/@/sha256.c:@/selftests_sha224}, @code{cipher/@/sha256.c:@/selftests_sha256}) @item SHA-384 @item SHA-512 @enumerate @item A known answer test using a 112 byte string is run. @item A known answer test using a string of one million letters "a" is run. @end enumerate (@code{cipher/@/sha512.c:@/selftests_sha384}, @code{cipher/@/sha512.c:@/selftests_sha512}) @end table @subsection MAC Algorithm Tests The following MAC algorithm tests are run in addition to the power-up tests: @table @asis @item HMAC SHA-1 @enumerate @item A known answer test using 9 byte of data and a 20 byte key is run. @item A known answer test using 9 byte of data and a 100 byte key is run. @item A known answer test using 9 byte of data and a 49 byte key is run. @end enumerate (@code{cipher/hmac-tests.c:selftests_sha1}) @item HMAC SHA-224 @itemx HMAC SHA-256 @itemx HMAC SHA-384 @itemx HMAC SHA-512 @enumerate @item A known answer test using 9 byte of data and a 20 byte key is run. @item A known answer test using 50 byte of data and a 20 byte key is run. @item A known answer test using 50 byte of data and a 26 byte key is run. @item A known answer test using 54 byte of data and a 131 byte key is run. @item A known answer test using 152 byte of data and a 131 byte key is run. @end enumerate (@code{cipher/@/hmac-tests.c:@/selftests_sha224}, @code{cipher/@/hmac-tests.c:@/selftests_sha256}, @code{cipher/@/hmac-tests.c:@/selftests_sha384}, @code{cipher/@/hmac-tests.c:@/selftests_sha512}) @end table @c ******************************************** @node FIPS Mode @appendix Description of the FIPS Mode This appendix gives detailed information pertaining to the FIPS mode. In particular, the changes to the standard mode and the finite state machine are described. The self-tests required in this mode are described in the appendix on self-tests. @c ------------------------------- @section Restrictions in FIPS Mode @noindent If Libgcrypt is used in FIPS mode these restrictions are effective: @itemize @item The cryptographic algorithms are restricted to this list: @table @asis @item GCRY_CIPHER_3DES 3 key EDE Triple-DES symmetric encryption. @item GCRY_CIPHER_AES128 AES 128 bit symmetric encryption. @item GCRY_CIPHER_AES192 AES 192 bit symmetric encryption. @item GCRY_CIPHER_AES256 AES 256 bit symmetric encryption. @item GCRY_MD_SHA1 SHA-1 message digest. @item GCRY_MD_SHA224 SHA-224 message digest. @item GCRY_MD_SHA256 SHA-256 message digest. @item GCRY_MD_SHA384 SHA-384 message digest. @item GCRY_MD_SHA512 SHA-512 message digest. @item GCRY_MD_SHA1,GCRY_MD_FLAG_HMAC HMAC using a SHA-1 message digest. @item GCRY_MD_SHA224,GCRY_MD_FLAG_HMAC HMAC using a SHA-224 message digest. @item GCRY_MD_SHA256,GCRY_MD_FLAG_HMAC HMAC using a SHA-256 message digest. @item GCRY_MD_SHA384,GCRY_MD_FLAG_HMAC HMAC using a SHA-384 message digest. @item GCRY_MD_SHA512,GCRY_MD_FLAG_HMAC HMAC using a SHA-512 message digest. @item GCRY_PK_RSA RSA encryption and signing. @item GCRY_PK_DSA DSA signing. @end table Note that the CRC algorithms are not considered cryptographic algorithms and thus are in addition available. @item RSA and DSA key generation refuses to create a key with a keysize of less than 1024 bits. @item The @code{transient-key} flag for RSA key generation is ignored. @item Support for the VIA Padlock engine is disabled. @item FIPS mode may only be used on systems with a /dev/random device. Switching into FIPS mode on other systems will fail at runtime. @item Saving and loading a random seed file is ignored. @item An X9.31 style random number generator is used in place of the large-pool-CSPRNG generator. @item The command @code{GCRYCTL_ENABLE_QUICK_RANDOM} is ignored. @item The Alternative Public Key Interface (@code{gcry_ac_xxx}) is not supported and all API calls return an error. @item Registration of external modules is not supported. @item Message digest debugging is disabled. @item All debug output related to cryptographic data is suppressed. @item On-the-fly self-tests are not performed, instead self-tests are run before entering operational state. @item The function @code{gcry_set_allocation_handler} may not be used. If it is used Libgcrypt disables FIPS mode unless Enforced FIPS mode is enabled, in which case Libgcrypt will enter the error state. +@item +The digest algorithm MD5 may not be used. If it is used Libgcrypt +disables FIPS mode unless Enforced FIPS mode is enabled, in which case +Libgcrypt will enter the error state. + @item In Enforced FIPS mode the command @code{GCRYCTL_DISABLE_SECMEM} is ignored. In standard FIPS mode it disables FIPS mode. @item A handler set by @code{gcry_set_outofcore_handler} is ignored. @item A handler set by @code{gcry_set_fatalerror_handler} is ignored. @end itemize Note that when we speak about disabling FIPS mode, it merely means -that the fucntion @code{gcry_fips_mode_active} returns false; it does +that the function @code{gcry_fips_mode_active} returns false; it does not mean that any non FIPS algorithms are allowed. - @c ******************************************** @section FIPS Finite State Machine The FIPS mode of libgcrypt implements a finite state machine (FSM) using 8 states (@pxref{tbl:fips-states}) and checks at runtime that only valid transitions (@pxref{tbl:fips-state-transitions}) may happen. @float Figure,fig:fips-fsm @caption{FIPS mode state diagram} @center @image{fips-fsm,150mm,,FIPS FSM Diagram} @end float @float Table,tbl:fips-states @caption{FIPS mode states} @noindent States used by the FIPS FSM: @table @asis @item Power-Off Libgcrypt is not runtime linked to another application. This usually means that the library is not loaded into main memory. This state is documentation only. @item Power-On Libgcrypt is loaded into memory and API calls may be made. Compiler introducted constructor functions may be run. Note that Libgcrypt does not implement any arbitrary constructor functions to be called by the operating system @item Init The Libgcrypt initialization functions are performed and the library has not yet run any self-test. @item Self-Test Libgcrypt is performing self-tests. @item Operational Libgcrypt is in the operational state and all interfaces may be used. @item Error Libgrypt is in the error state. When calling any FIPS relevant interfaces they either return an error (@code{GPG_ERR_NOT_OPERATIONAL}) or put Libgcrypt into the Fatal-Error state and won't return. @item Fatal-Error Libgcrypt is in a non-recoverable error state and will automatically transit into the Shutdown state. @item Shutdown Libgcrypt is about to be terminated and removed from the memory. The application may at this point still runing cleanup handlers. @end table @end float @float Table,tbl:fips-state-transitions @caption{FIPS mode state transitions} @noindent The valid state transitions (@pxref{fig:fips-fsm}) are: @table @code @item 1 Power-Off to Power-On is implicitly done by the OS loading Libgcrypt as a shared library and having it linked to an application. @item 2 Power-On to Init is triggered by the application calling the Libgcrypt intialization function @code{gcry_check_version}. @item 3 Init to Self-Test is either triggred by a dedicated API call or implicit by invoking a libgrypt service conrolled by the FSM. @item 4 Self-Test to Operational is triggered after all self-tests passed successfully. @item 5 Operational to Shutdown is an artifical state without any direct action in Libgcrypt. When reaching the Shutdown state the library is deinitialized and can't return to any other state again. @item 6 Shutdown to Power-off is the process of removing Libgcrypt from the computer's memory. For obvious reasons the Power-Off state can't be represented within Libgcrypt and thus this transition is for documentation only. @item 7 Operational to Error is triggered if Libgcrypt detected an application error which can't be returned to the caller but still allows Libgcrypt to properly run. In the Error state all FIPS relevant interfaces return an error code. @item 8 Error to Shutdown is similar to the Operational to Shutdown transition (5). @item 9 Error to Fatal-Error is triggred if Libgrypt detects an fatal error while already being in Error state. @item 10 Fatal-Error to Shutdown is automatically entered by Libgcrypt after having reported the error. @item 11 Power-On to Shutdown is an artifical state to document that Libgcrypt has not ye been initializaed but the process is about to terminate. @item 12 Power-On to Fatal-Error will be triggerd if certain Libgcrypt functions are used without having reached the Init state. @item 13 Self-Test to Fatal-Error is triggred by severe errors in Libgcrypt while running self-tests. @item 14 Self-Test to Error is triggred by a failed self-test. @item 15 Operational to Fatal-Error is triggered if Libcrypt encountered a non-recoverable error. @item 16 Operational to Self-Test is triggred if the application requested to run the self-tests again. @item 17 Error to Self-Test is triggered if the application has requested to run self-tests to get to get back into operational state after an error. @item 18 Init to Error is triggered by errors in the initialization code. @item 19 Init to Fatal-Error is triggered by non-recoverable errors in the initialization code. @item 20 Error to Error is triggered by errors while already in the Error state. @end table @end float +@c ******************************************** +@section FIPS Miscellaneous Information + +Libgcrypt does not do any key management on itself; the application +needs to care about it. Keys which are passed to Libgcrypt should be +allocated in secure memory as available with the functions +@code{gcry_malloc_secure} and @code{gcry_calloc_secure}. By calling +@code{gcry_free} on this memory, the memory and thus the keys are +overwritten with zero bytes before releasing the memory. + +For use with the random number generator, Libgcrypt generates 3 +internal keys which are stored in the encryption contexts used by the +RNG. These keys are stored in secure memory for the lifetime of the +process. Application are required to use @code{GCRYCTL_TERM_SECMEM} +before process termination. This will zero out the entire secure +memory and thus also the encryption contexts with these keys. + + + @c ********************************************************** @c ************* Appendices (license etc.) **************** @c ********************************************************** @include lgpl.texi @include gpl.texi @node Figures and Tables @unnumbered List of Figures and Tables @listoffloats Figure @listoffloats Table @node Concept Index @unnumbered Concept Index @printindex cp @node Function and Data Index @unnumbered Function and Data Index @printindex fn @bye GCRYCTL_SET_RANDOM_DAEMON_SOCKET GCRYCTL_USE_RANDOM_DAEMON The random damon is still a bit experimental, thus we do not document them. Note that they should be used during initialization and that these functions are not really thread safe. @c LocalWords: int HD diff --git a/src/ChangeLog b/src/ChangeLog index 7759dbb8..ff50b49f 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,2065 +1,2072 @@ +2008-10-24 Werner Koch + + * global.c (inactive_fips_mode): Move to fips.c. + (gcry_set_allocation_handler): Factor code out to ... + * fips.c (_gcry_inactivate_fips_mode): New. + (_gcry_is_fips_mode_inactive): New. + 2008-09-29 Werner Koch * gcrypt-module.h (GCRY_MODULE_ID_USER, GCRY_MODULE_ID_USER_LAST): New. * module.c (MODULE_ID_USER, MODULE_ID_USER_LAST): Define using new macros. 2008-09-20 Werner Koch * hmac256.c (finalize) [WORDS_BIGENDIAN]: Fix sigbus problem. 2008-09-18 Werner Koch * cipher-proto.h (pk_ext_generate_t): Add args QBITS, NAME, DOMAIN. * fips.c (fips_new_state): Allow Error => Error transition. 2008-09-18 Werner Koch * gcrypt.h.in (gcry_fips_mode_active): New. * secmem.c (_gcry_secmem_init): Factor most code out to .. (secmem_init): .. new. (DEFAULT_POOL_SIZE): Rename to MINIMUM_POOL_SIZE. (STANDARD_POOL_SIZE): New. (_gcry_secmem_malloc_internal): Don't abort if the pool is not initialized but try to out intialize it first and only then print an error message and return NULL. If the pool is not locked while in FIPS mode, return NULL. * fips.c (FIPS_FORCE_FILE): New constant. Change the file name to "/etc/gcrypt/fips_enabled". (enforced_fips_mode): New. (_gcry_initialize_fips_mode): Set that flag. (_gcry_enforced_fips_mode): New. * global.c (inactive_fips_mode): New. (_gcry_vcontrol): Take that flag in account for GCRYCTL_FIPS_MODE_P. (gcry_set_allocation_handler): Take care of the enforced fips mdoe flag. (get_no_secure_memory): New. (do_malloc, gcry_is_secure): Use it. 2008-09-16 Werner Koch * global.c (print_config): Use y/n for fips mode. * fips.c (fips_new_state): Allow transition to Error and Fatal-error from Init. 2008-09-15 Werner Koch * fips.c [HAVE_SYSLOG]: Include syslog.h. (_gcry_initialize_fips_mode, lock_fsm, unlock_fsm) (_gcry_fips_signal_error, fips_new_state) (_gcry_fips_noreturn) [HAVE_SYSLOG]: Also log via syslog. (check_binary_integrity) [HAVE_SYSLOG]: Log failure. * global.h [HAVE_SYSLOG]: Include syslog.h. (_gcry_global_is_operational) [HAVE_SYSLOG]: Print warning. * global.c (_gcry_vcontrol): Use GCRYCTL_INITIALIZATION_FINISHED to run power-up tests. Add unpublished control commands 58-60. * global.c (_gcry_global_is_operational): New. * g10lib.h (fips_is_operational): Change to call this function. 2008-09-12 Werner Koch * fips.c (_gcry_fips_run_selftests): Add arg EXTENDED. (run_cipher_selftests, run_digest_selftests, run_hmac_selftests) (run_pubkey_selftests): Ditto. * cipher-proto.h (selftest_func_t): Add arg EXTENDED 2008-09-11 Werner Koch * fips.c: Include string.h. (loxtoi_1, loxtoi_2, loxdigit_p): New. (check_binary_integrity): Change the format of the expected file. * fips.c (_gcry_fips_run_selftests): Run random tests before the pubkey tests. 2008-09-05 Werner Koch * gcrypt.h.in (GCYRCTL_SELFTEST): New. * global.c (_gcry_vcontrol): Implement. * fips.c (_gcry_fips_run_selftests): Do state transitions only if in fips mode. Return an error code. 2008-09-01 Werner Koch * stdmem.c: Re-indented. 2008-08-29 Werner Koch * fips.c (_gcry_initialize_fips_mode): Changed /proc file to test for FIPS mode. * cipher-proto.h (pk_compute_keygrip_t): New. (pk_extra_spec): Add field comp_keygrip. 2008-08-28 Werner Koch * hwfeatures.c (_gcry_detect_hw_features): Disable hardware detection in FIPS mode. 2008-08-27 Werner Koch * global.c (_gcry_vcontrol): Allow running selftests from error state. (gcry_set_outofcore_handler): Only print a warning if used in FIPS mode. (gcry_xmalloc, gcry_xrealloc, gcry_xmalloc_secure, gcry_xstrdup): Ignore an outofcore handler in FIPS mode. * fips.c (_gcry_fips_test_error_or_operational): New. (fips_new_state): Allow transition from error into selftest. Disallow error to init. 2008-08-26 Werner Koch * fips.c (fips_new_state): Print state transitions only at verbosity level of 2. (reporter): Likewise. * cipher-proto.h (pk_ext_generate_t): New. (pk_extra_spec): Add member ext_generate. * cipher.h (PUBKEY_FLAG_TRANSIENT_KEY): New. 2008-08-22 Werner Koch * hmac256.c (_gcry_hmac256_file): New. (main): New option --binary. * fips.c (check_binary_integrity): New. (_gcry_fips_run_selftests): Run it. * global.c (_gcry_vcontrol) : Check for fips operational state. (_gcry_vcontrol) : Ditt. 2008-08-21 Werner Koch * misc.c (_gcry_log_printhex): New. 2008-08-20 Werner Koch * g10lib.h (gcry_assert): New. use this at almost all places where we used a plain assert. * misc.c (_gcry_assert_failed): New. (_gcry_bug): Also use func variant for ISO-C99. 2008-08-19 Werner Koch * visibility.c, visibility.h (gcry_mpi_lshift): New. * libgcrypt.vers, libgcrypt.def, gcrypt.h.in: Ditto. 2008-08-15 Werner Koch * gcrypt.h.in (gcry_cipher_setkey): Replace macro by function. (gcry_cipher_setiv): Ditto. (gcry_cipher_setctr): Ditto. * visibility.c (gcry_cipher_setkey, gcry_cipher_setiv) (gcry_cipher_setctr): New. * visibility.h (gcry_cipher_setkey, gcry_cipher_setiv) (gcry_cipher_setctr): New. * libgcrypt.vers (gcry_cipher_setkey, gcry_cipher_setiv) (gcry_cipher_setctr): New. * libgcrypt.def (gcry_cipher_setkey, gcry_cipher_setiv) (gcry_cipher_setctr): New. * hmac256.h, hmac256.c: New. * Makefile.am (hmac256_SOURCES): New. * Makefile.am (bin_PROGRAMS): Add hmac256. * gcrypt.h.in (struct gcry_thread_cbs): Change type of OPTION to unsigned int. Although this is a type change it does not make a difference. * ath.c (ath_install): Take the version of the option field in account. * visibility.c (gcry_pk_encrypt, gcry_pk_decrypt, gcry_pk_sign) (gcry_pk_verify, gcry_pk_testkey, gcry_pk_genkey) (gcry_pk_get_nbits, gcry_pk_get_keygrip) (gcry_md_open, gcry_md_copy, gcry_md_enable) (gcry_md_write, md_final, gcry_md_ctl, gcry_md_setkey) (gcry_md_hash_buffer, gcry_md_get_algo, gcry_md_info) (gcry_md_is_enabled) (gcry_cipher_open, gcry_cipher_encrypt) (gcry_cipher_decrypt, gcry_cipher_ctl) (gcry_cipher_algo_info): Check whether the library is operational. * cipher-proto.h: New. * cipher.h: Include cipher-proto.h. * visibility.h: Remove duplicate macro definitions. Remove gcry_cipher_register, gcry_md_register, gcry_pk_register macros. * visibility.c: Include cipher-proto.h. (gcry_cipher_register): Pass dummy extra args to the internal register function. (gcry_md_register, gcry_pk_register): Ditto. * g10lib.h (struct gcry_module): Add field EXTRASPEC. * module.c (_gcry_module_add): Add arg EXTRASPEC. Changed all callers to pass NULL. * fips.c: New. * gcrypt.h.in (GCRYCTL_FIPS_MODE_P): New. * global.c (global_init): Call fips initialization. (_gcry_vcontrol): Add GCRYCTL_FIPS_MODE_P code. (print_config): Add config item fips-mode. (gcry_set_allocation_handler): Do not allow the use of custom allocation handlers. (gcry_set_outofcore_handler): Ditto. (_gcry_get_debug_flag): Do not return any debug flags in fips mode. * misc.c (_gcry_logv): Signal fips error on BUG or FATAL. (_gcry_fatal_error): Ditto. 2008-07-05 Werner Koch * Makefile.am: Include librandom.la. 2008-04-18 Werner Koch * missing-string.c (vasprintf): Remove. It is not used. Reported by Simon Josefsson. 2008-03-11 Werner Koch * gcrypt.h.in (gcry_ac_em_t, gcry_ac_scheme_t): Remove trailing comma for full C-89 compatibility. 2008-01-21 Marcus Brinkmann * hwfeatures.c (detect_ia32_gnuc): Fix inline asm. 2007-12-11 Werner Koch * visibility.c (gcry_md_hash_buffer): Don't use return vor a void function. Hey, why does gcc not complain about this? (gcry_ac_io_init_va): Ditto. 2007-12-05 Werner Koch * hwfeatures.c (detect_ia32_gnuc): Depend on ENABLE_PADLOCK_SUPPORT. 2007-12-03 Werner Koch * misc.c (_gcry_logv): Use abort for error levels fatal and bug as this is more approriate for a library. Terminate the secmem before doing so. (_gcry_fatal_error): Terminate secmem before abort. * secmem.c (_gcry_secmem_malloc_internal): Use log_bug instead of exit. 2007-11-29 Werner Koch * hwfeatures.c (detect_ia32_gnuc): Detect Padlock engine. 2007-11-13 Werner Koch * gcrypt.h.in (_GCRY_GCC_ATTR_MALLOC): Fixed gcc version check. Reported by Gabriele Monti. 2007-10-31 Werner Koch * global.c (gcry_control): Factor most code out to .. (_gcry_vcontrol): .. new. * sexp.c (_gcry_sexp_vbuild): New. * mpi.h (_gcry_mpi_set, _gcry_mpi_set_ui, _gcry_mpi_invm): Remove prototypes as they are already in gcrypt.h. 2007-10-30 Werner Koch * sexp.c (gcry_sexp_nth_string): Replace by _gcry_sexp_nth_string. * visibility.h, visibility.c: New. * g10lib.h: Include visibility.h instead of gcrypt.h. * globals.c (_gcry_malloc): Rename to .. (do_malloc): .. this. * hwfeatures.c: New. * global.c (global_init): Detect features. (print_config): Print them. 2007-08-22 Werner Koch * dumpsexp.c: New. * Makefile.am (bin_PROGRAMS): Install it. * getrandom.c (print_version): Use new standard license line. * gcryptrnd.c (print_version): Ditto. 2007-06-06 Werner Koch * gcrypt.h.in (GCRY_THREAD_OPTION_PTH_IMPL): Factror network related code out so that the prototypes can be adjusted for W32. (_GCRY_THREAD_OPTION_PTH_IMPL_NET): New. 2007-05-09 Werner Koch * libgcrypt.m4: Print found version on success. 2007-05-09 Marcus Brinkmann * gcrypt.h.in (gcry_ac_io_t): Add name for anonymous union, and mark all members as internal (actually: deprecated). 2007-05-04 Werner Koch * Makefile.am (.rc.lo): New to replace gmake specific suffix rule. 2007-05-03 Werner Koch * libgcrypt.def (gcry_sexp_nth_string): New. * Makefile.am (EXTRA_DIST): Add libgcrypt.def. 2007-05-02 Werner Koch * global.c (print_config): Print ciphers, digests and pubkeys. 2007-05-02 David Shaw * cipher.h, gcrypt.h.in: Add Camellia. 2007-04-30 Werner Koch * gcrypt.h.in (GCRYCTL_PRINT_CONFIG): New. (GCRYCTL_SET_RNDEGD_SOCKET): New. * global.c (gcry_control): Add GCRYCTL_PRINT_CONFIG and GCRYCTL_SET_RNDEGD_SOCKET. (print_config): New. * misc.c (_gcry_log_info_with_dummy_fp): New. 2007-04-18 Werner Koch * gcrypt.h.in (gcry_sexp_nth_string): New. * sexp.c (gcry_sexp_nth_data): Factored code out to ... (sexp_nth_data): ... new. (gcry_sexp_nth_string): New. (gcry_sexp_nth_mpi): Reimplemented in terms of sexp_ntd_data. 2007-04-16 Werner Koch * secmem.c (init_pool): Use sysconf() if available to determine page size. 2007-03-22 Werner Koch * mpi.h (mpi_mod): New. (mpi_new, mpi_snew): New. * gcrypt.h.in: Add GCRY_PK_ECDSA. 2007-03-16 Werner Koch * gcrypt.h.in (GCRY_THREAD_OPTION_PTHREAD_IMPL): Fixed typo introduced by me on 2006-10-23. 2007-02-22 Werner Koch * gcrypt.h.in (gcry_ac_id_to_name, gcry_ac_name_to_id): Mark as deprecated. * libgcrypt.def (gcry_fast_random_poll): Removed - it is a macro. (gcry_cipher_register, gcry_cipher_unregister): New. (gcry_md_register, gcry_md_unregister): New. (gcry_pk_register, gcry_pk_unregister): New. (gcry_ac_data_from_sexp, gcry_ac_data_to_sexp): New. (gcry_ac_io_init, gcry_ac_io_init_va): New. (gcry_ac_data_encrypt_scheme, gcry_ac_data_decrypt_scheme): New. (gcry_ac_data_sign_scheme, gcry_ac_data_verify_scheme): New. * missing-string.c: Include stdio.h for the vsprintf prototype. * ath.h (struct ath_ops) [_WIN32]: Use int instead of socklen_t. 2007-02-21 Werner Koch * libgcrypt.def (gcry_create_nonce, gcry_fast_random_poll) (gcry_md_debug): New. * libgcrypt-config.in: Remove duplicates from --cflags and --libs. Print a error for option --thread. * gcrypt.h.in (gcry_sexp_sprint): Change BUFFER from char* to void*. (gcry_md_ctl): Change BUFFER from unsigned char* to void*. (gcry_md_debug): New. (gcry_cipher_encrypt, gcry_cipher_decrypt): Change buffer args to void*. (gcry_randomize): Change BUFFER to void. (gcry_create_nonce): Ditto. * libgcrypt.vers (gcry_md_debug): New. * sexp.c (gcry_sexp_sprint): Ditto. (normalize): Make P unsigned. (gcry_sexp_nth_data): Cast return value to char*. (sexp_sscan): Fix sign/unsigned conflicts. (whitespacep): Change P to char*. (unquote_string): Change STRING to char*. (convert_to_hex): Change DEST to char*. (convert_to_string): Change DEST and P to char*. (convert_to_token): Chnage DEST to char*. (gcry_sexp_canon_len): Change DISPHINT to unsigned char*. * gcrypt-module.h (gcry_pk_spec): Made ALIASES a const. (gcry_md_write_t): Changed BUF to a const void*. 2007-02-12 Werner Koch * gcrypt.h.in: Include stdlib.h for the sake fo the trheading macros. Suggested by Andreas Metzler. * secmem.c (ptr_into_pool_p): New. (_gcry_private_is_secure): Implement in terms of new function. (BLOCK_VALID): Removed. Replaced all users by new function. 2007-01-31 Werner Koch * secmem.c (_gcry_private_is_secure): Fixed severe implementation flaw. Might be the reason for some of the more obscure bugs. (MB_WIPE_OUT): Use wipememory2. 2006-10-23 Werner Koch * gcrypt.h.in (GCRY_THREAD_OPTION_PTHREAD_IMPL): Add some cast for use by C-doubleplus. In general I don't like this but due to public demand I give up ;-) 2006-10-19 Werner Koch * global.c (gcry_control) : Return an error if the memory could not be locked. * secmem.c (not_locked): New. (_gcry_secmem_get_flags): Return that flag. * secmem.h (GCRY_SECMEM_FLAG_NOT_LOCKED): New. 2006-10-05 Werner Koch * module.c (_gcry_module_id_new): Don't assign modules in the range the range of 1024..4096. * gcrypt.h (GCRY_MD_USER, GCRY_MD_USER_LAST): New (GCRY_PK_USER, GCRY_PK_USER_LAST): New. (GCRY_CIPHER_USER, GCRY_CIPHER_USER_LAST): New. 2006-10-12 Marcus Brinkmann * gcrypt.h.in: Replace socklen_t with gcry_socklen_t. 2006-10-11 Marcus Brinkmann * gcrypt.h.in: Replace version by @VERSION@. 2006-10-10 Marcus Brinkmann * gcrypt.h: Add fallback type for socklen_t. Move to ... * gcrypt.h.in: ... this file. * Makefile.am (EXTRA_DIST): Add gcrypt.h.in. 2006-09-04 Werner Koch * gcrypt.h: Removed some trailing comma in enums. 2006-08-29 Werner Koch * global.c (gcry_xrealloc): Pass secure flag to outofcore handler. * gcrypt.h (GCRY_CIPHER_SEED): New. 2006-08-21 Werner Koch * gcrypt.h (GCRYCTL_FAKED_RANDOM_P): New. 2006-07-29 Marcus Brinkmann * secmem.c (init_pool): Close FD after establishing the mapping. 2006-07-12 Marcus Brinkmann * ath.c (ath_mutex_destroy): Microoptimize destruction of unused statitically initialized mutexes. Suggested by Victor Stinner . * gcrypt.h (GCRY_THREAD_OPTION_PTHREAD_IMPL, (GCRY_THREAD_OPTION_PTH_IMPL): Add missing initializers to suppress gcc warning. Submitted by Victor Stinner . 2006-07-04 Marcus Brinkmann * ath.c: Avoid warning about double defined type byte and other hacks to let it build for W32 (backported from LIBGCRYPT-1-2-BRANCH). * ath.h, gcrypt.h, tests/benchmark.c, src/types.h: Likewise. * gcrypt.h: Revert last change, and instead: [_WIN32 || __WIN32__]: Do not include , but and . Suggested by Simon Josefsson . * Makefile.am (install-data-local, uninstall-local, %.lo, (install-def-file, uninstall-def-file): New targets. (LTRCCOMPILE, gcrypt_res, gcrypt_res_ldflag, no_undefined, (export_symbols, gcrypt_deps): New variables. * versioninfo.rc.in: New file. * libgcrypt.def: New file from ../w32-dll/libgcrypt.def. * gcrypt.h [!HAVE_SYS_SOCKET_H]: Do not include sys/socket.h, but the appropriate windows socket header. 2006-06-21 Werner Koch * global.c (gcry_xcalloc, gcry_xcalloc_secure): Made safe against integer overflow. * sexp.c (make_space): Return an error on out of core. (sexp_sscan): Remove all xmalloc style calls and return proper error codes on allocation failures. (gcry_sexp_find_token): Ditto. (gcry_sexp_nth): * sexp.c (gcry_sexp_find_token): Re-indented and removed a cruft "while(level);" which fortunately had no effect. 2006-04-28 Werner Koch * gcrypt.h (GCRY_MD_SHA224): Change value from 306 to 11 to match the use in OpenPGP. There has been no release yet, so we can safely do it. 2006-04-22 Moritz Schulte * gcrypt.h (gcry_ctl_cmds): New commands: GCRYCTL_SET_RANDOM_DAEMON_SOCKET, GCRYCTL_USE_RANDOM_DAEMON. * global.c (gcry_control): Handle new commands, calling _gcry_set_random_daemon_socket() and _gcry_use_random_daemon(). 2006-04-18 Werner Koch * gcrypt.h (GCRY_PK_USAGE_CERT, GCRY_PK_USAGE_AUTH) (GCRY_PK_USAGE_UNKN): New. 2006-04-01 Moritz Schulte * gcrypt.h (gcry_ac_eme_pkcs_v1_5): Removed members: key, handle; added member: key_size. * secmem.c (MB_FLAG_ACTIVE): Write braces around MB_FLAG_ACTIVE definition. 2006-03-15 Werner Koch * getrandom.c: New. 2006-03-14 Werner Koch * gcryptrnd.c: New. 2006-03-10 Werner Koch * gcrypt.h: Add GCRY_MD_SHA224. 2005-11-02 Moritz Schulte * gcrypt.h: Update comments for functions: gcry_cipher_algo_name, gcry_pk_algo_name. 2005-10-31 Moritz Schulte * global.c: Added documentation. 2005-10-16 Moritz Schulte * global.c (global_init): Use gcry_error_t instead of gcry_err_code_t; use goto instead of if constructs. * stdmem.c: Inserted description of the layered memory management in Libgcrypt. * g10lib.h: Removed G10_I18N_H related check; it seems to be a GnuPG relict (Libgcrypt does not define this symbol anywhere). (FLAG_MODULE_DISABLED): Don't forget parantheses around shifted value. Removed GCC_ATTR_PURE macro definitions, since gcrypt.h does already contain such a macro named _GCRY_GCC_ATTR_PURE, which we can use here as well. Likewise for GCC_ATTR_MALLOC and _GCRY_GCC_ATTR_MALLOC. * stdmem.h: Use _GCRY_GCC_ATTR_MALLOC instead of GCC_ATTR_MALLOC. * secmem.h: Likewise. 2005-10-09 Moritz Schulte * global.c (gcry_control): Call global_init() after passing thread cbs to ath. global_init() MUST to be called AFTER passing the cbs to ath and BEFORE calling library functions, which make use of ath. This change combines cbs installing with ath initialization and thus removes the need to call other library initialization functions inbetween like e.g. gcry_check_version(). 2005-10-01 Moritz Schulte * ath.c: Assign copyright to FSF. * ath.h: Likewise. 2005-06-25 Moritz Schulte * Makefile.am (pkgconfigdir, pkgconfig_DATA): Removed variables. * libgcrypt.pc.in: Removed file - we do not want to support a second, foreign configuration system. 2005-06-17 Moritz Schulte * global.c (gcry_xstrdup): Removed superfluous strcpy call. 2005-04-22 Moritz Schulte * Makefile.am (pkgconfigdir, pkgconfig_DATA): New; support for pkgconfig provided by Albert Chin. * libgcrypt.pc.in (Cflags): New file. 2005-04-16 Moritz Schulte * g10lib.h (_gcry_ac_init): Declare. * global.c (global_init): Call _gcry_ac_init; don't forget to set err. 2005-04-14 Werner Koch * sexp.c (whitespacep): New. (sexp_sscan): Replaced isdigit and isspace by whitespacep and digitp. 2005-04-11 Moritz Schulte * gcrypt.h (gcry_md_algos): Added: GCRY_MD_WHIRLPOOL. * cipher.h (_gcry_digest_spec_whirlpool): Declare. 2005-03-30 Moritz Schulte * libgcrypt.vers: Added: gcry_ac_io_init, gry_ac_io_init_va. * gcrypt.h (gcry_ac_data_read_cb_t, gcry_ac_data_write_cb_t, gcry_ac_io_mode_t, gcry_ac_io_type_t, gcry_ac_io_t): New types. (gcry_ac_io_init_va): Declare function. (gcry_ac_data_encode, gcry_ac_data_decode, gcry_ac_data_encrypt_scheme, gcry_ac_data_decrypt_scheme, gcry_ac_data_sign_scheme, gcry_ac_data_verify_scheme): Use gcry_ac_io_type_t objects instead of memory strings directly. 2005-03-03 Moritz Schulte * libgcrypt.vers: Added: gcry_ac_data_to_sexp() and gcry_ac_data_from_sexp(). 2005-02-22 Werner Koch * global.c (_gcry_malloc): Make sure ERRNO is set if we return NULL. Remove unneeded initialization of M to allow the compiler to catch errors. (gcry_realloc): Make sure ERRNO is set if we return NULL> 2005-02-13 Moritz Schulte * gcrypt.h: Declare new functions: gcry_ac_data_encrypt_scheme, gcry_ac_data_decrypt_scheme, gcry_ac_data_sign_scheme, gcry_ac_data_verify_scheme, gcry_ac_data_encode, gcry_ac_data_decode, gcry_ac_data_to_sexp, gcry_ac_data_from_sexp. New types: gcry_ac_emsa_pkcs_v1_5_t, gcry_ac_ssa_pkcs_v1_5_t, gcry_md_algo_t. New enumeration lists: gcry_ac_scheme_t, gcry_ac_em_t. * libgcrypt.vers: Added new ac functions. * g10lib.h: Declare function: _gcry_pk_get_elements. * mpi.h (mpi_get_ui): New macro. Declare function: _gcry_mpi_get_ui. 2004-11-09 Werner Koch * gcrypt.h: Removed 3 trailing commas from enums. Noted by Heiko Stamer. 2004-09-21 Werner Koch * sexp.c (sexp_sscan): Removed C++ style comments. Noted by Yoann Vandoorselaere. 2004-08-23 Moritz Schulte * global.c: Do not include . * sexp.c: Likewise. * module.c: Likewise. * misc.c: Likewise. 2004-08-18 Moritz Schulte * secmem.c (_gcry_secmem_init): Try to lock pool into core not only when running with root privileges. 2004-08-16 Werner Koch * secmem.h (_gcry_secmem_set_flags,_gcry_secmem_get_flags): Removed __pure__. (GCRY_SECMEM_FLAG_NO_WARNING): Put macro value into parens. * secmem.c (_gcry_secmem_init): Defer printing of the warning. 2004-08-10 Moritz Schulte * gcrypt.h: Include , thanks to Simon Josefsson. 2004-05-07 Werner Koch * gcrypt.h: Added GCRYCTL_FAST_POLL. (gcry_fast_random_poll): New. * global.c (gcry_control) : Do only basic random subsystem init. (gcry_control) : New. 2004-04-22 Marcus Brinkmann * libgcrypt.m4: Quote first argument to AC_DEFUN. 2004-04-15 Werner Koch * secmem.c (_gcry_secmem_malloc_internal): Removed old extra info error output. (_gcry_secmem_term): Use wipememory2 here. * misc.c (_gcry_burn_stack): Use wipememory to avoid optimizations. * string.c: Removed. Was never used. * global.c (gcry_strdup): Replaced by the version from string.c (gcry_xstrdup): Rewritten. * gcrypt.h: Removed duplicate prototype for gcry_strdup. 2004-03-29 Werner Koch * secmem.c (_gcry_secmem_realloc): Fixed double unlock; bug manifested itself due to the more rigorous checking in the changed ath.h * libgcrypt-config.in (Options): Ignore the obsolete --threads option for now. 2004-03-17 Marcus Brinkmann * libgcrypt-config.in (includedir, libdir): Quote'em. Use $gpg_error_cflags and $gpg_error_libs. Fix construction of $includes. 2004-03-14 Marcus Brinkmann * libgcrypt-config.in (includedir, libdir): New variables. For --cflags, don't test $cflags. Also check against /include for the GNU/Hurd. Don't overwrite but extend $cflags_final. Likewise for --libs. 2004-03-10 Marcus Brinkmann * Makefile.am (ltlib_libgcrypt_pthread, ltlib_libgcrypt_pth): Removed. (lib_LTLIBRARIES): Remove those variables from here. (libgcrypt_pthread_la_SOURCES, libgcrypt_pthread_la_LDFLAGS, (libgcrypt_pthread_la_DEPENDENCIES, libgcrypt_pthread_la_LIBADD, (libgcrypt_pth_la_SOURCES, libgcrypt_pth_la_LDFLAGS, (libgcrypt_pth_la_DEPENDENCIES, libgcrypt_pth_la_LIBADD, (noinst_LTLIBRARIES): Removed. (libgcrypt_real_la_SOURCES): Merge with ... (libgcrypt_la_SOURCES): ... likewise. (libgcrypt_real_la_DEPENDENCIES): Merge with ... (libgcrypt_la_DEPENDENCIES): ... this. (libgcrypt_real_la_LIBADD): Merge with ... (libgcrypt_la_LIBADD): ... this. * libgcrypt-config.in (libs_pthread, libs_pth, cflags_pth) (cflags_pthread, thread_module, thread_modules): Removed. (Options): Remove --thread option from help output. If the option is specified, output an error and exit. For --cflags and --libs option, remove pth and pthread from output. * gcrypt.h: Include and . (enum gcry_ctl_cmds): Add GCRYCTL_SET_THREAD_CBS. (gcry_thread_cbs): New struct. * global.c (gcry_control): Implement GCRYCTL_SET_THREAD_CBS. (global_init): Don't call ath_init here. * ath.h: Rewritten. * ath.c: Rewritten. 2004-03-06 Werner Koch * libgcrypt-config.in: s/--soname-number/--api-version/ * libgcrypt.m4: Changed test for API version. 2004-03-05 Werner Koch * libgcrypt.m4: Optionally check the SONAME number. * libgcrypt-config.in: Add option --soname-number 2004-03-01 Marcus Brinkmann * Makefile.am (libgcrypt_la_SOURCES): Add ath.c. * ath.c (ath_init): Add missing function. * Makefile.am (ath_pth_src): Removed. (ath_pthread_src): Removed. (libgcrypt_la_SOURCES): Remove ath-compat, $(ath_pth_src) and $(ath_pthread_src). * ath-compat.c, ath-pth-compat.c, ath-pthread-compat.c: Files removed. 2004-02-20 Werner Koch * gcrypt.h (GCRY_PRIME_CHECK_AT_GOT_PRIME) (GCRY_PRIME_CHECK_AT_FINISH), (GCRY_PRIME_CHECK_AT_MAYBE_PRIME): New. 2004-02-18 Werner Koch * libgcrypt-config.in: Ignore setting of --prefix. 2004-02-13 Werner Koch * gcrypt.h: Added GCRY_CIPHER_RFC2268_128, alsthough not yet supported. 2004-02-06 Werner Koch * gcrypt.h: Added GCRY_CIPHER_RFC2268_40. 2004-02-03 Werner Koch * secmem.c (_gcry_secmem_init): Do not print the "not locked into core warning" if the NO_WARNING flag has been set. * sexp.c (sexp_sscan): Allocate result in secure memory if BUFFER is in secure memory. Switch to secure memory for the a secure %b format item. Extra paranoid wipe on error. (gcry_sexp_release): Added paranoid wiping for securely allocated S-expressions. 2004-01-25 Moritz Schulte * ath.h: Include . 2004-01-12 Moritz Schulte * gcrypt.h: Adjusted declarations of: gcry_ac_data_set, gcry_ac_data_get_name, gcry_ac_data_get_index, gcry_ac_key_pair_generate, gcry_ac_key_test, gcry_ac_key_get_nbits, gcry_ac_key_get_grip. * gcrypt.h (GCRY_AC_FLAG_DATA_NO_BLINDING): Removed symbol. (GCRY_AC_FLAG_DEALLOC, GCRY_AC_FLAG_COPY) (GCRY_AC_FLAG_NO_BLINDING): New symbols. * global.c (gcry_strdup): Removed function. * string.c: New file. * Makefile.am (libgcrypt_real_la_SOURCES): Added: string.c. * string.c (gcry_strdup): New function. * gcrypt.h (gcry_strdup): Declare. 2003-12-19 Werner Koch * g10lib.h (wipememory, wipememory2): New; taken from gnupg. 2003-11-14 Werner Koch * global.c (gcry_strdup): Don't copy the string after a malloc error. 2003-11-11 Werner Koch * sexp.c (sexp_sscan): Implemented "%b" format specifier. 2003-11-11 Moritz Schulte * libgcrypt.m4: Do not set prefix when calling libgcrypt-config. Thanks to Nikos Mavroyanopoulos. 2003-11-08 Moritz Schulte * cipher.h (small_prime_numbers): Removed declaration. (PUBKEY_FLAG_NO_BLINDING): Put braces around shift. 2003-11-04 Werner Koch * cipher.h (_gcry_sha1_has_buffer): New. * gcrypt.h (gcry_create_nonce): New. 2003-10-31 Werner Koch * libgcrypt.vers (_gcry_generate_elg_prime): Removed this symbol; gnutls does not need it anymore. * secmem.c (mb_get_new): s/pool/block/ due to global pool. * misc.c (gcry_set_log_handler): s/logf/f/ to avoid shadowing warning against a builtin. * ath-pth-compat.c: cast pth_connect to get rid of the const prototype. 2003-10-27 Werner Koch * ath.h (ATH_MUTEX_INITIALIZER): Removed spurious semicolon. 2003-10-27 Moritz Schulte * libgcrypt-config.in: Include libs/cflags of libgpg-error. * sexp.c (sexp_sscan): Cleaned up, deallocate scanned sexp on error. * module.c (MODULE_ID_MIN): New symbol, use it. 2003-10-27 Werner Koch * gcrypt.h (gcry_pk_testkey): Doc fix. 2003-09-29 Moritz Schulte * libgcrypt-config.in: Fix --algorithms option. 2003-10-23 Werner Koch * gcrypt.h (gcry_err_code): Use GPG_ERR_INLINE instead of __inline__. * secmem.c (lock_pool): Don't print the warning for certain systems, handle ENOMEM. 2003-10-21 Werner Koch * secmem.c (_gcry_secmem_dump_stats): Fixed format sepcifier for a size_t. Reported by Stephane Corthesy. 2003-10-10 Werner Koch * global.c (_gcry_malloc): Handle the no_secure_memory option. * gcrypt.h (gcry_prime_group_generator): New. (gcry_prime_release_factors): New. 2003-10-07 Werner Koch * sexp.c (sexp_sscan): Check that parenthesis are matching. 2003-09-28 Moritz Schulte * g10lib.h: Declare: _gcry_malloc. (GCRY_ALLOC_FLAG_SECURE): New symbol. * global.c (_gcry_malloc): New function... (gcry_malloc): ... use it. (gcry_malloc_secure): Likewise. * ath.c: Change License to LGPL. * ath-pthread-compat.c: Likewise. * ath-pthread.c: Likewise. * ath-pth-compat.c: Likewise. * ath-pth.c: Likewise. * ath.h: Likewise. * ath-compat.c: Likewise. * secmem.c (_gcry_secmem_realloc): Do not forget to release secmem lock. Thanks to low halo for triggering this bug. 2003-09-04 Werner Koch * gcrypt.h (_GCRY_ERR_SOURCE_DEFAULT): Removed cruft. (gcry_prime_check_func_t): Renamed arg for clarity. 2003-09-02 Moritz Schulte * gcrypt.h (GCRY_PRIME_FLAG_SPECIAL_FACTOR): New symbol. 2003-09-01 Moritz Schulte * gcrypt.h (gcry_random_level_t): New type. (gcry_prime_check_func_t): Likewise. (GCRY_PRIME_FLAG_SECRET): New symbol. (gcry_prime_generate, gcry_prime_check): Declare functions. 2003-08-28 Werner Koch * Makefile.am (libgcrypt_pth_la_LDFLAGS): Removed PTH_CFLAGS cruft. 2003-08-27 Moritz Schulte * global.c (gcry_control): Remove call to ath_deinit. * Makefile.am (libgcrypt_real_la_DEPENDENCIES): Fixed. (libgcrypt_real_la_LIBADD): Fixed. Removed unecessary variables. * libgcrypt-config.in: Adjusted script for new thread handling. * Makefile.am: New version, based on GPGMEs Makefile.am. * ath.c, ath-compat.c, ath.h, ath-pth.c, ath-pth-compat.c, ath-pthread.c, ath-pthread-compat.c: New files, merged from GPGME. * ath.c, ath.h, ath-pthread.c, ath-pth.c: Removed files. 2003-08-08 Moritz Schulte * global.c (gcry_realloc): Remove FIXME about `clearing out realloced memory', since _gcry_secmem_realloc takes care of overwriting old memory. 2003-08-07 Werner Koch * module.c (_gcry_module_release): Don't act if module is NULL. 2003-07-30 Moritz Schulte * gcrypt.h (enum gcry_ac_id): Added: GCRY_AC_ELG_E. Reverted change: use gcry_md_flags enumeration list instead of defines. 2003-07-29 Werner Koch * global.c (gcry_control): Add GCRYCTL_SET_RANDOM_SEED_FILE and GCRYCTL_UPDATE_RANDOM_SEED_FILE. * gcrypt.h: Ditto. Renamed index to idx, so avoid warning related to the old index function. 2003-07-28 Moritz Schulte * global.c (gcry_err_code_from_errno, gcry_err_code_to_errno) (gcry_err_make_from_errno, gcry_error_from_errno): New functions. * gcrypt.h: Declared: gcry_err_code_from_errno, gcry_err_code_to_errno, gcry_err_make_from_errno, gcry_error_from_errno. * Makefile.am (include_HEADERS): Added: gcrypt-module.h. * gcrypt.h: Include . * gcrypt-module.h: New file. 2003-07-27 Werner Koch * gcrypt.h (gcry_mpi_scan, gcry_mpi_print): API change. (gcry_mpi_dump): New. 2003-07-21 Moritz Schulte * gcrypt.h: Declared: gcry_ac_key_data_get. (gcry_pk_spec): Renamed member `sexp_names' into `aliases'. 2003-07-20 Moritz Schulte * gcrypt.h (gcry_md_oid_spec_t): New type. (gcry_md_spec): New member: oids. 2003-07-19 Moritz Schulte * gcrypt.h (gcry_cipher_oid_spec_t): New type. (gcry_cipher_spec): New member: oids; 2003-07-18 Werner Koch * gcrypt.h (gcry_mpi_set_opaque): Add a warning comment. 2003-07-15 Moritz Schulte * secmem.c (compress_pool): Remove function, since unused blocks are automatically concatenad. * gcrypt.h: Bumped version number up to 1.1.42-cvs. 2003-07-14 Moritz Schulte * gcrypt.h (gcry_cipher_spec): New member: aliases. * Makefile.am (noinst_PROGRAMS, testapi_SOURCES, testapai_LDADD, benchmark_SOURCES, benchmark_LDADD): Removed. * benchmark.c, testapi.c: Removed files. * mpi.h: Removed disabled typedef. * g10lib.h: Likewise. * benchmark.c, g10lib.h, gcrypt.h, global.c, module.c, sexp.c: Used gcry_err* wrappers for libgpg-error symbols. 2003-07-12 Moritz Schulte * global.c: Likewise. * gcrypt.h: New type: gcry_error_t, gcry_err_code_t and gcry_err_source_t. (gcry_err_make, gcry_error, gcry_err_code, gcry_err_source): New functions. * global.c (gcry_strerror): New function. (gcry_strsource): New function. * gcrypt.h: New symbol: GCRY_CIPHER_TWOFISH128. 2003-07-09 Moritz Schulte * gcrypt.h (enum gcry_md_flags): Removed, used define instead, since that is more common than an enumeration list when it comes to flags that can be bitwise ORed. 2003-07-08 Moritz Schulte * global.c: Use new types for handlers. * gcrypt.h: Declare: gcry_ac_data_copy. 2003-07-07 Moritz Schulte * sexp.c (gcry_sexp_build_array): Use dummy argument pointer. Thanks to Simon Josefsson . * gcrypt.h: Declare: gcry_cipher_list, gcry_pk_list, gcry_md_list. 2003-07-05 Moritz Schulte * gcrypt.h: Declare: gcry_cipher_register, gcry_cipher_unregister, gcry_md_register, gcry_md_unregister, gcry_pk_register, gcry_pk_unregister. (gcry_cipher_spec): Removed member: algorithm. (gcry_pk_spec): Likewise. (gcry_md_spec): Likewise. Adjusted declarations: gcry_cipher_register, gcry_pk_register, gcry_md_register. * module.c: Replaced all occurences of `id' with `mod_id', since `id' is a keyword in obj-c. * gcrypt.h (gcry_cipher_spec): Renamed member `id' to `algorithm'. (gcry_pk_spec): Likewise. (gcry_md_spec): Likewise. * cipher.h: Removed types: gcry_pubkey_generate_t, gcry_pubkey_check_secret_key_t, gcry_pubkey_encrypt_t, gcry_pubkey_decrypt_t, gcry_pubkey_sign_t, gcry_pubkey_verify_t, gcry_pubkey_get_nbits_t, gcry_pk_spec_t, gcry_digest_init_t, gcry_digest_write_t, gcry_digest_final_t, gcry_digest_read_t, gcry_digest_spec_t, gcry_cipher_setkey_t, gcry_cipher_encrypt_t, gcry_cipher_decrypt_t, gcry_cipher_stencrypt_t, gcry_cipher_stdecrypt_t, gcry_cipher_spec_t. * gcrypt.h: New types: gcry_pk_generate_t, gcry_pk_check_secret_key_t, gcry_pk_encrypt_t, gcry_pk_decrypt_t, gcry_pk_sign_t, gcry_pk_verify_t, gcry_pk_get_nbits_t, gcry_pk_spec_t, gcry_md_init_t, gcry_md_write_t, gcry_md_final_t, gcry_md_read_t, gcry_md_spec_t, gcry_cipher_setkey_t, gcry_cipher_encrypt_t, gcry_cipher_decrypt_t, gcry_cipher_stencrypt_t, gcry_cipher_stdecrypt_t, gcry_cipher_spec_t, gcry_module_t. 2003-07-04 Moritz Schulte * module.c (_gcry_module_list): New function. 2003-07-02 Moritz Schulte * module.c (_gcry_module_lookup): Fixed typo. * gcrypt.h: Added all definitions and declarations necessary for the new ac interface. 2003-06-30 Moritz Schulte * g10lib.h: Added declarations: _gcry_pk_module_lookup, _gcry_pk_module_release. 2003-06-18 Werner Koch * benchmark.c (cipher_bench): Adjusted for new API of get_blklen and get_keylen. * gcrypt.h (gcry_cipher_get_algo_blklen) (gcry_cipher_get_algo_keylen): Replaced macro by funcion. 2003-06-18 Moritz Schulte * cipher.h: Renamed types GcryDigestSpec, GcryCipherSpec and GcryPubkeySpec into: gcry_digest_spec_t, gcry_cipher_spec_t and gcry_pubkey_spec_t. (gcry_pubkey_spec): Defined member `id' as unsigned. (gcry_digest_spec): Likewise. (gcry_cipher_spec): Likewise. * module.c (_gcry_module_id_new): New function. (_gcry_module_add): Generate a new ID via _gcry_module_id_new in case `id' is zero. * g10lib.h, module.c: Replace old type GcryModule with newer one: gcry_module_t. * module.c (_gcry_module_add): Added argument `id', use it. * g10lib.h: Added declaration: _gcry_module_lookup_id. (_gcry_module_add): Added argument `id'. * module.c (_gcry_module_lookup_id): New function. * g10lib.h (struct gcry_module): New member: id. * gcrypt.h: New type: gcry_handler_progress_t, gcry_handler_alloc_t, gcry_haandler_secure_check_t, gcry_handler_realloc_t, gcry_handler_free_t, gcry_handler_no_mem_t, gcry_handler_error_t, gcry_handler_log_t. Use new types. * cipher.h: Include . New types: gcry_pk_generate_t, gcry_pk_check_secret_key_t, gcry_pk_encrypt_t, gcry_pk_decrypt_t, gcry_pk_sign_t, gcry_pk_verify_t, gcry_pk_get_nbits_t, gcry_md_init_t, gcry_md_write_t, gcry_md_final_t, gcry_md_read_t, gcry_cipher_setkey_t, gcry_cipher_encrypt_t, gcry_cipher_decrypt_t, gcry_cipher_stencrypt_t, gcry_cipher_stdecrypt_t. Use new types. 2003-06-17 Moritz Schulte * Makefile.am (AM_CFLAGS): Added: @GPG_ERROR_CFLAGS@. 2003-06-16 Moritz Schulte * g10lib.h: Replace last occurences of old type names with newer names (i.e. replace MPI with gcry_mpi_t). * mpi.h: Likewise. * sexp.c: Likewise. 2003-06-15 Moritz Schulte * testapi.c (test_genkey): Use gpg_strerror instead of gcry_strerror. * global.c (gcry_control): Fixed typo. * misc.c (_gcry_fatal_error): Use gpg_strerror instead of gcry_strerror. * types.h (STRLIST): Removed type since it is not used. 2003-06-11 Moritz Schulte * global.c (global_init): Call: _gcry_cipher_init, _gcry_md_init, _gcry_pk_init. * g10lib.h: Declare: _gcry_cipher_init, _gcry_md_init, _gcry_pk_init. * global.c (gcry_strerror): Remove compatibility code. * Makefile.am: Remove support libgpg-error special handling. (AM_CPPFLAGS): Add @GPG_ERROR_CFLAGS@ * gcrypt.h: Likewise. 2003-06-13 Werner Koch * gcrypt.h (gcry_md_get_algo): Reverted to old API. This is a convenience function anyway and error checking is not approriate. (gcry_md_is_enabled): New. (gcry_md_is_secure): Replaced macro by function and reverted to old API. 2003-06-11 Werner Koch * gcrypt.h (GCRYERR): Define _GCRY_ERR_SOURCE_DEFAULT instead of GPG_ERR_SOURCE_DEFAULT, so that libgpg-error still works despite the use of the old gcrypt error codes. (gcry_md_copy): Swapped arguments. 2003-06-09 Moritz Schulte * Makefile.am: Support for libgpg-error. 2003-06-08 Moritz Schulte * sexp.c (gcry_sexp_create): Expect sane error values from gcry_sexp_canon_len instead of the `historical' values. 2003-06-07 Moritz Schulte * ath.c, ath.c, ath-pth.c, ath-pthread.c, benchmark.c, cipher.h, g10lib.h, gcrypt.h, global.c, misc.c, missing-string.c, module.c, mpi.h, secmem.c, secmem.h, sexp.c, stdmem.c, stdmem.h, testapi.c, types.h: Edited all preprocessor instructions to remove whitespace before the '#'. This is not required by C89, but there are some compilers out there that don't like it. Replaced any occurence of the now deprecated type names with the new ones. * gcrypt.h: Re-organized checking for gcc features; New macro: _GCRY_GCC_ATTR_DEPRECATED. Include copy of libgpg-error's gpg-error.h in order to make it easy to build libgcrypt without needing libgpg-error.h. (GCRY_MPI, GcryMPI, GCRY_SEXP, GcrySexp, GCRY_CIPHER_HD, GcryCipherHd, GCRY_MD_HD, GcryMDHd): Declared deprecated. (gcry_mpi_t, gcry_sexp_t, gcry_cipher_hd_t, gcry_md_hd_t): New types. 2003-06-04 Moritz Schulte * sexp.c (sexp_sscan): New argument: arg_list, adjusted all callers. (ARG_NEXT): New macro. (sexp_sscan): Use ARG_NEXT for receiving format string arguments. (gcry_sexp_build_array): New function. 2003-06-02 Moritz Schulte * gcrypt.h: Added some comments describing the gcry_sexp_* functions. Include instead of . 2003-06-01 Moritz Schulte * sexp.c (OLDPARSECODE): Removed macro... (gcry_sexp_canon_len): ... and do not use it. * gcrypt.h (gcry_errno): Removed declaration. * g10lib.h (string_to_pubkey_algo, pubkey_algo_to_string, pubkey_nbits): Removed declarations for non-existing functions. 2003-05-31 Moritz Schulte * cipher.h (is_RSA, is_ELGAMAL): Removed macros. * g10lib.h (set_lasterr): Removed macro. (_gcry_set_lasterr): Removed declaration. * gcrypt.h: Changed declarations for: gcry_pk_algo_info, gcry_md_open, gcry_md_copy, gcry_md_algo_info, gcry_md_info, gcry_md_get_algo, gcry_random_add_bytes. (gcry_md_is_secure): Adjust macro for new API. 2003-05-29 Moritz Schulte * gcrypt.h: Changed declarations for: gcry_cipher_open, gcry_cipher_info, gcry_cipher_algo_info. (gcry_cipher_get_algo_keylen): Adjuster for new gcry_cipher_algo_info interface. (gcry_cipher_get_algo_blklen): Likewise. * global.c (gcry_errno): Removed function. (gcry_strerror): Do not use gcry_errno. (_gcry_set_lasterr): Removed function. (last_ec): Removed variable. 2003-05-27 Moritz Schulte * gcrypt.h (enum gcry_cipher_algos): Make Serpent IDs do not conflict with OpenPGP. Reported by Timo Schulz. * global.c (gcry_control): Fixed name of enum list. 2003-05-25 Moritz Schulte * cipher.h (gcry_cipher_spec): Adjust return type of `setkey' for libgpg-error. (gcry_pubkey_spec): Adjust return type of `generate', `check_secret_key', `encrypt', `decrypt', `sign' and `verify' for libgpg-error. * sexp.c (gcry_sexp_canon_len): Adjusted for libgpg-error. (gcry_sexp_create): Likewise. (gcry_sexp_new): Likewise. (sexp_sscan): Likewise. (gcry_sexp_build): Likewise. (gcry_sexp_sscan): Likewise. * module.c (_gcry_module_add): Likewise. * global.c (last_ec): Change type to gpg_error_t. (gcry_control): Adjust for libgpg-error. (gcry_errno): Likewise. (gcry_strerror): Likewise. (_gcry_set_lasterr): Likewise. (gcry_xmalloc): Likewise. (gcry_xrealloc): Likewise. 2003-05-22 Moritz Schulte * types.h: Merged code from GnuPG regarding U64_C. * missing-string.c (strsep): Removed function. * g10lib.h: Removed declarations: strsep, strlwr. * secmem.c (secmem_lock): New variable. (SECMEM_LOCK, SECMEM_UNLOCK): New macros. (_gcry_secmem_set_flags): Use SECMEM_LOCK and SECMEM_UNLOCK. (_gcry_secmem_get_flags): Likewise. (_gcry_secmem_init): Likewie. (_gcry_secmem_malloc): Likewise. (_gcry_secmem_free): Likewise. (_gcry_secmem_malloc): Renamed to ... (_gcry_secmem_malloc_internal): ... this. (_gcry_secmem_malloc): New function, use SECMEM_LOCK, SECMEM_UNLOCK, call _gcry_secmem_malloc_internal. (_gcry_secmem_free): Renamed to ... (_gcry_secmem_free_internal): ... this. (_gcry_secmem_free): New function, use SECMEM_LOCK, SECMEM_UNLOCK, call _gcry_secmem_free_internal. (_gcry_secmem_realloc): Use SECMEM_LOCK, SECMEM_UNLOCK, call _gcry_secmem_malloc_internal and _gcry_secmem_free_internal. (_gcry_private_is_secure): Use SECMEM_LOCK, SECMEM_UNLOCK. (_gcry_secmem_dump_stats): Likewise. (_gcry_secmem_malloc_internal): Removed unused variable: compressed. Include "ath.h". 2003-05-21 Moritz Schulte * gcrypt.h (GCRY_CIPHER_SERPENT128, GCRY_CIPHER_SERPENT192, GCRY_CIPHER_SERPENT256): New symbols. 2003-05-19 Moritz Schulte * gcrypt.h: Reversed changes from 2003-03-03 since they would have been an unnecessary ABI break. 2003-05-13 Moritz Schulte * secmem.c (stats_update): New function. (BLOCK_HEAD_SIZE): New symbol. (MB_FLAG_ACTIVE): New symbol. (ADDR_TO_BLOCK, BLOCK_VALID): New macros. (mb_get_next): New function. (mb_get_prev): New function. (mb_merge): New function. (mb_get_new): New function. (unused_blocks): Removed variable. (init_pool): Initialize new memory pool. (_gcry_secmem_malloc): Use new heap management code. (_gcry_secmem_free): Likewise. (_gcry_secmem_realloc): Likewise. Renamed type MEMBLOCK to memblock_t. 2003-04-27 Moritz Schulte * cipher.h (gcry_pubkey_spec): New member: sexp_names. 2003-04-23 Moritz Schulte * cipher.h (gcry_pubkey_spec): Removed members: npkey, nskey, nenc, nsig. (gcry_pubkey_spec): Added members: elements_pkey, elements_skey, elements_enc, elements_sig, elements_grip. 2003-04-17 Moritz Schulte * g10lib.h (GcryModule): New typedef. * gcrypt.h (gcry_cipher_register, gcry_cipher_unregister, gcry_digest_register, gcry_digest_unregister, gcry_pubkey_register, gcry_pubkey_unregister): Function declarations removed - for now. * gcrypt.h (GcryModule): Declaration removed. * gcrypt.h (GcryPubkeySpec, GcryDigestSpec, GcryCipherSpec): Types Moved... * cipher.h: ... here. 2003-04-17 Moritz Schulte * cipher.h: Declare digest_spec_sha512 and digest_spec_384. 2003-04-16 Moritz Schulte * module.c (_gcry_module_use): New function. * g10lib.h (_gcry_module_use): Declare function. * libgcrypt-config.in: Support for --algorithms switch, which prints the algorithms included in the built libgcrypt. * global.c (gcry_set_progress_handler): Register progress functions depending on the enabled algorithms. 2003-04-07 Moritz Schulte * Makefile.am (libgcrypt_la_SOURCES): Added module.c * module.c: New file. (_gcry_module_add): New function. (_gcry_module_drop): New function. (_gcry_module_lookup): New function. (_gcry_module_release): New function. * g10lib.h (GcryModule): New types. (FLAG_MODULE_DISABLED): New symbol. Added declarations for _gcry_module_add, _gcry_module_release and _gcry_module_lookup. * gcrypt.h: New types: GcryPubkeySpec, GcryDigestSpec, GcryCipherSpec. Added declarations for: gcry_cipher_register, gcry_cipher_unregister, gcry_digest_register, gcry_digest_unregister, gcry_pubkey_register and gcry_pubkey_unregister. * cipher.h: Removed symbols: CIPHER_ALGO_NONE, CIPHER_ALGO_IDEA, CIPHER_ALGO_3DES, CIPHER_ALGO_CAST5, CIPHER_ALGO_BLOWFISH, CIPHER_ALGO_SAFER_SK128, CIPHER_ALGO_DES_SK, CIPHER_ALGO_TWOFISH, CIPHER_ALGO_TWOFISH_OLD, CIPHER_ALGO_DUMMY, PUBKEY_USAGE_SIG, PUBKEY_USAGE_ENC, DIGEST_ALGO_MD5, DIGEST_ALGO_SHA1, DIGEST_ALGO_RMD160, DIGEST_ALGO_TIGER, PUBKEY_ALGO_RSA, PUBKEY_ALGO_RSA_E, PUBKEY_ALGO_RSA_S, PUBKEY_ALGO_DSA, PUBKEY_ALGO_ELGAMAL, PUBKEY_ALGO_ELGAMAL_E. 2003-04-02 Moritz Schulte * benchmark.c (md_bench): Fix error message. 2003-03-31 Moritz Schulte * benchmark.c (cipher_bench): Added CTR mode. 2003-03-30 Simon Josefsson * gcrypt.h (enum gcry_control_cmds): Add GCRY_SET_CTR. (enum gcry_cipher_modes): Add GCRY_CIPHER_MODE_CTR. (gcry_cipher_setctr): New macro to set counter. 2003-03-19 Moritz Schulte * cipher.h (PUBKEY_FLAG_NO_BLINDING): New symbol. 2003-03-22 Simon Josefsson * gcrypt.h: Add GCRYCTL_SET_CBC_MAC and GCRY_CIPHER_CBC_MAC. 2003-03-19 Werner Koch * g10lib.h: Adjusted primegen.c prototypes. 2003-03-12 Werner Koch * sexp.c (sexp_sscan): Initialize NM. Thanks to Ian Peters for valgrinding this. 2003-03-06 Moritz Schulte * secmem.h (GCRY_SECMEM_FLAG_NO_WARNING, GCRY_SECMEM_FLAG_SUSPEND_WARNING): New symbols. * global.c (gcry_control): Use GCRY_SECMEM_FLAG_{NO,SUSPEND}_WARNING, instead of hard-coded values. * secmem.c (_gcry_secmem_set_flags): Likewise. * secmem.c (_gcry_secmem_get_flags): Likewise. 2003-03-03 Moritz Schulte * misc.c: Removed old FIXME, since there is already a function to set the value of `verbosity_level'. * gcrypt.h: Removed enumeration list: gcry_ctl_cmds. New enumeration lists: gcry_global_control_cmds, gcry_control_cmds, gcry_info_cmds, gcry_algo_info_cmds. 2003-03-02 Moritz Schulte * gcrypt.h (gcry_cipher_reset): New macro for resetting a handle. 2003-02-28 Moritz Schulte * secmem.c (DEFAULT_PAGESIZE): New symbol. (init_pool): Use DEFAULT_PAGESIZE. 2003-02-23 Moritz Schulte * secmem.h: Fix typo in declaration of _gcry_secmem_term. * sexp.c: Move macro definitions of `digitp', `octdigit', `alphap' and `hexdigit' ... * g10lib.h: ... here. * misc.c (_gcry_burn_stack): New function (former name: burn_stack). * g10lib.h (burn_stack): Declare _gcry_burn_stack(). 2003-01-24 Werner Koch * global.c (gcry_set_progress_handler): Register a random progress handler. 2003-01-23 Werner Koch * gcrypt.h (GCRY_ENABLE_QUICK_RANDOM): New. * global.c (gcry_control): Make use of it. 2003-01-21 Werner Koch * gcrypt.h (gcry_random_add_bytes): Add QUALITY argument. 2003-01-21 Timo Schulz * gcrypt.h (gcry_random_add_bytes): New. 2003-01-20 Simon Josefsson * gcrypt.h (gcry_md_algos): Add GCRY_MD_CRC32, GCRY_MD_CRC32_RFC1510, GCRY_MD_CRC24_RFC2440. 2003-01-16 Werner Koch * gcrypt.h (gcry_md_write): Changed type of 2nd argument to void*. (gcry_md_hash_buffer): Changed type of both buffers to void*. (gcry_md_setkey): Changed type of 2nd argument to void*. (gcry_md_get_asnoid): New. 2003-01-15 Werner Koch * sexp.c (gcry_sexp_length): Fixed. This was seriously broken. 2003-01-14 Werner Koch * gcrypt.h (GCRYERR_INV_FLAG), global.c (gcry_strerror): New. 2003-01-02 Werner Koch * libgcrypt.vers: Temporary export _gcry_generate_elg_prime for use by GNUTLS. 2002-12-21 Werner Koch * gcrypt.h: Make use of gcc's pure and malloc attributes (gcry_md_putc): Use a helper variable to avoid multiple evaluation of H. * g10lib.h, stdmem.h, secmem.h: Use gcc attributes pure and malloc. * stdmem.c (use_m_guard): Don't default to yes. 2002-12-19 Werner Koch * global.c (global_init): The meat was never run due to a faulty check. Thanks to Nikos for pointing this out. * global.c (gcry_control): Return 1 and not -1 for the initialization tests. * libgcrypt.vers: New. * Makefile.am: Use this instead of the build symbol file. * global.c (gcry_control) : Call the random module initializer to make sure that the pool lock flag has been initialized. 2002-12-09 Werner Koch * global.c (gcry_calloc,gcry_calloc_secure): Check for overflow. Noted by Florian Weimer. 2002-11-10 Simon Josefsson * gcrypt.h (gcry_ctl_cmds): New GCRYCTL_SET_CBC_CTS control flag. (gcry_cipher_flags): New GCRY_CIPHER_CBC_CTS gcry_cipher_open() flag. (gcry_cipher_cts): New macro for toggling CTS. 2002-11-10 Werner Koch * gcrypt.h (GCRY_MD_MD4): New. We use a non OpenPGP value here. 2002-09-20 Werner Koch * ath.c: Include sys.time.h if sys/select.h does not exist. (ath_select, ath_waitpid): Shortcut for Windows. * ath.h: Include some Windows headers. By Timo. 2002-09-18 Werner Koch * ath.h: Prefix ath_deinit. 2002-09-17 Werner Koch * benchmark.c: New. (mpi_bench, do_powm): Add a a simple test for RSA. * global.c (global_init): New. Use it instead of the setting any_init_done. Initialize the ATH system. (gcry_check_version): Hook global_init in. This is the suggested way to initialize the library. (_gcry_no_internal_locking): Removed. We simply call a ath_deinit and leave it to ATH to disbale the locking. * ath.c, ath.h, ath-pth.c, ath-pthread.c: New. Taken from GPGME. * mutex.h: Removed. * Makefile.am (ath_components): New. 2002-09-16 Werner Koch * secmem.c (_gcry_secmem_dump_stats): Replaced fprintf by log_*. 2002-08-23 Werner Koch * missing-string.c: Removed unneeded strlwr. * libgcrypt.m4: Made much more simple. * libgcrypt-config.in: Made --prefix work for --libs. 2002-08-14 Werner Koch * gcrypt.h: Add GCRY_CIPGER_DES. Included string.h for size_t. Suggested by Simon Josefsson. 2002-07-25 Werner Koch * cipher.h: Added prototypes for progress functions. * global.c: Include cipher.h for those prototypes. * stdmem.c (_gcry_private_realloc): Replaced void* by char * for pointer arithmetic reasons. Noted by Stephan Austermuehle. 2002-06-24 Werner Koch * missing-string.c: Include ctype.h. * gcrypt.h (gcry_mpi_invm, gcry_mpi_div, gcry_mpi_mod) (gcry_mpi_swap): New. 2002-06-18 Werner Koch * gcrypt.h: Added a bunch of brief function descriptions. 2002-05-21 Werner Koch * misc.c (_gcry_log_printf): Don't initialize a va_list. Noted by Jeff Johnson. * global.c (gcry_set_progress_handler): New. * gcrypt.h: Replaced the typedef for byte. 2002-05-16 Werner Koch * missing-string.c: New. * gcrypt.h: Add new error codes GCRYERR_SEXP_ and typedefs GcryMPI, GcrySexp, GcryCipherHd, GcryMDHd as aliases for the old ones using an underscore. * global.c (gcry_strerror): Add strings fro the new error codes. * sexp.c (gcry_sexp_canon_len): Use a macro to convert from new to old error codes. (gcry_sexp_create,gcry_sexp_new): New. 2002-05-15 Werner Koch * mutex.h (DEFINE_LOCAL_MUTEX): Macro to define a mutex and initialize it so that we can detect an unitialized mutex and don't read from stdin. 2002-05-14 Werner Koch Changed license of all files to the LGPL. 2002-05-07 Werner Koch * global.c (gcry_control): Add commands GCRYCTL_ANY_INITIALIZATION_P and GCRYCTL_INITIALIZATION_FINISHED_P so that other libraries are able to check for required initializations. 2002-05-02 Werner Koch * gcrypt.h (GCRYCTL_DISABLE_INTERNAL_LOCKING): New. * global.c (gcry_control): Implement it. (_gcry_no_internal_locking): New. * mutex.h: Prefixed all fucntions with _gcry_. Bypass all functions when desired. * gcrypt.h (GCRYCTL_DISABLE_SECMEM): New. * global.c (gcry_control,gcry_malloc_secure,gcry_is_secure): Implement it here. * secmem.c (_gcry_private_is_secure): Return false if the pool is not initialized. * gcrypt.h (GCRYCTL_INITIALIZATION_FINISHED): New. * gcrypt.h (gcry_cipher_algos): Replaced RINDAEL by AES and change the macros to expand from rijdael to aes. * stdmem.c (_gcry_private_malloc): Return NULL for 0 byte allocation. (_gcry_private_malloc_secure): Ditto. * g10lib.h: Copied the JNLIB_GCC macros from ../jnlib/mischelp.h and removed the inclusion of that file. 2002-04-15 Werner Koch * global.c (gcry_strdup): New. 2002-03-18 Werner Koch * mutex.h: New file with a portable thread mutex implementation written by Marcus Brinkmann. Taken from GPGME. 2002-02-18 Werner Koch * sexp.c (gcry_sexp_sscan): Don't initialize the dummy variable. Suggested by Jordi Mallach. 2002-01-31 Werner Koch * sexp.c (suitable_encoding,convert_to_hex,convert_to_string) (convert_to_token): New. (gcry_sexp_sprint): Better formatting of advanced encoding, does now insert LFs and escapes all unprintable characters. (unquote_string): New. (sexp_sscan): Implemented the missing conversion of quoted strings. 2002-01-26 Werner Koch * libgcrypt-config.in: Add copyright notice. 2002-01-11 Werner Koch * sexp.c (gcry_sexp_canon_len): Fixed last change. 2002-01-01 Timo Schulz * stdmem.c (_gcry_private_realloc): If pointer is NULL now realloc behaves like malloc. 2001-12-20 Werner Koch * sexp.c (gcry_sexp_canon_len): Describe the error codes and return an error if this is not a S-Exp; i.e. it does not start with an open parenthesis. 2001-12-18 Werner Koch * sexp.c (gcry_sexp_canon_len): Fixed the test on NULL buffer. * Makefile.am (DISTCLEANFILES): Include libgcrypt.sym * sexp.c: Removed the commented test code because we now have a test in ../tests/ 2001-12-17 Werner Koch * sexp.c (gcry_sexp_canon_len): New. 2001-12-11 Werner Koch * gcrypt.h: Fixed AES128 macro, add enum for OFB mode. 2001-12-05 Werner Koch * misc.c (_gcry_log_printf): New. * sexp.c (dump_string,gcry_sexp_dump): Use logging functions instead of stderr. 2001-11-16 Werner Koch * gcrypt.h: New constant GCRYCTL_IS_ALGO_ENABLED. 2001-10-02 Werner Koch * gcrypt.h: Removed a couple of trailing commas. 2001-08-28 Werner Koch * sexp.c (sexp_sscan): Add an argument to enable the arg_ptr. Changed all callers. Suggested by Tom Holroyd. 2001-08-03 Werner Koch * global.c (gcry_strerror): Updated list of error codes. 2001-07-23 Werner Koch * gcrypt.h: Replaced the last ulong. Noted by Rami Lehti. 2001-05-31 Werner Koch * gcrypt.h, mpi.h: Made some mpi functions public. * wrapper.c: Removed. * global.c: Renamed all g10_ prefixed functions which had wrappers to gcry_xxx. So we now use the exported memory functions inernally. Renamed all g10_ prefixed functions to _gcry_ prefixed ones. * g10lib.h (_GCRYPT_IN_LIBGCRYPT): Replace defintion by a test on it. 2001-05-28 Werner Koch * libgcrypt.m4: Check GCRYPT_VERSION macro and not LIBGCRYPT_VERSION. * mpi.h: Removed mpi_fromstr prototype. 2001-01-11 Werner Koch * Makefile.am (libgcrypt_la_SOURCES): Add mpi.h 2000-12-19 Werner Koch * types.h: Moved from ../include to here. Major change: Removed all GnuPG stuff and renamed this piece of software to gcrypt. 2000-11-14 Werner Koch * mpi.h: Moved to ../mpi. * Makefile.am (OMIT_DEPENDENCIES): Hack to work around dependency problems. 2000-10-11 Werner Koch * mpi.h: Changed the way mpi_limb_t is defined. 2000-10-10 Werner Koch * Makefile.am: Take version-info from configure. 2000-10-09 Werner Koch * gcrypt.h: New cipher mode, new algo Arcfour and new error code GCRYERR_INV_CIPHER_MODE. * global.c (gcry_strerror): New errorcode. Wed Oct 4 13:16:18 CEST 2000 Werner Koch * gcrypt.h (gcry_md_setkey): Replaced macro by function prototype. Mon Sep 18 16:35:45 CEST 2000 Werner Koch * gcrypt.h (GCRYCTL_GET_ALGO_USAGE): New. * secmem.c (secmem_realloc): check for failed secmem_malloc. By Matt Kraai. Mon Jul 31 10:04:47 CEST 2000 Werner Koch * sexp.c: Removed the datalen fields from list tags. (gcry_sexp_car_data,gcry_sexp_cdr_data,gcry_sexp_car_mpi, gcry_sexp_cdr_mpi): Removed. (gcry_sexp_nth,gcry_sexp_nth_data,gcry_sexp_nth_mpi): New. Fri Jul 28 18:19:11 CEST 2000 Werner Koch * sexp.c (sexp_sscan): Fixed reallocation to secure memory. (new_empty_list): Removed (gcry_sexp_length): New. (gcry_sexp_enum): Removed. (normalize): New. Reworked the whole thing to use NULL for an empty list. (make_space): New instead of the macro. Tue Jul 25 17:44:15 CEST 2000 Werner Koch * sexp.c: Major rewrite. (gcry_sexp_sscan): Reordered arguments. Moved functionality to .. (sexp_sscan): .. this. (gcry_sexp_build): New. (gcry_sexp_new_name_mpi, gcry_sexp_new_name_data, gcry_sexp_new_data, gcry_sexp_new_mpi): Removed. Fri Jul 14 19:38:23 CEST 2000 Werner Koch * gcrypt.h (gcry_md_start_debug, gcry_md_stop_debug): New. (gcry_ctl_cmds): New control values * sexp.c (gcry_sexp_sscan): Add hex format parsing. * secmem.c (lock_pool): Check for ENOSYS return my mlock() on old SCOs. (pool_is_mmapped): Made volatile. (lock_pool): No more warning for QNX. By Sam Roberts. (lock_pool,secmem_init): Additional check for dropped privs. 2000-03-21 09:18:48 Werner Koch (wk@habibti.gnupg.de) * gcrypt.h (gcry_md_setkey): New. (GCRY_MD_FLAG_HMAC): New. Mon Jan 31 16:37:34 CET 2000 Werner Koch * Makefile.am: Add g10lib.h Thu Jan 27 18:00:44 CET 2000 Werner Koch * sexp.c (gcry_sexp_sscan): Allow NULL for erroff. Mon Jan 24 22:24:38 CET 2000 Werner Koch * sexp.c (gcry_sexp_alist): New. Mon Jan 24 13:04:28 CET 2000 Werner Koch * secmem.c: Moved from ../util to here. * secmem.h: New. * stdmem.c: New. Based on the old ../util/memory.c. * stdmem.h: New. Wed Dec 8 21:58:32 CET 1999 Werner Koch * gcrypt.m4: New. * gcrypt-config: New. * mpi.h (mpi_get_nbit_info): Removed (mpi_set_nbit_info): Removed. (struct gcry_mpi): Removed the nbits field. * misc.c (g10_log_verbosity): New. * global.c (g10_xstrdup): New. * mpiapi.c: Removed. * mpi.h: Moved from ../include to here. Removed some obsolete prototypes and the iobuf.h header. * cipher.h: Moved from ../include to here. Removed the mpi.h header. * g10lib.h: Moved from ../include to here. Fri Nov 19 17:15:20 CET 1999 Werner Koch * sexp.c (dump_string): New. Taken from gnupg/util/miscutil.c. (do_dump_list): s/print_string/dump_string/. * testapi.c: New. * mpiapi.c (gcry_mpi_randomize): Use new random API. Sat Nov 13 17:44:23 CET 1999 Werner Koch * gloabl.c (gcry_control): Add cases for dumping random and secmem stats. Tue Oct 26 14:10:21 CEST 1999 Werner Koch * pkapi.c: Removed. * symapi.c: Removed. * g10lib.h: Moved to ../include. * mdapi.c: Removed. Wed Jul 7 13:08:40 CEST 1999 Werner Koch * sexp.c: New. Tue Dec 8 13:15:16 CET 1998 Werner Koch * gcrypt.h: New * mpiapi.c: New Copyright (C) 1998,1999,2000,2001,2002,2003 2004, 2005, 2008 Free Software Foundation, Inc. This file is free software; as a special exception the author gives unlimited permission to copy and/or distribute it, with or without modifications, as long as this notice is preserved. This file is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY, to the extent permitted by law; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. diff --git a/src/fips.c b/src/fips.c index 0a8a15e9..f2d898b1 100644 --- a/src/fips.c +++ b/src/fips.c @@ -1,798 +1,851 @@ /* fips.c - FIPS mode management * Copyright (C) 2008 Free Software Foundation, Inc. * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ #include #include #include #include #include #include #ifdef ENABLE_HMAC_BINARY_CHECK # include #endif #ifdef HAVE_SYSLOG # include #endif /*HAVE_SYSLOG*/ #include "g10lib.h" #include "ath.h" #include "cipher-proto.h" #include "hmac256.h" /* The name of the file used to foce libgcrypt into fips mode. */ #define FIPS_FORCE_FILE "/etc/gcrypt/fips_enabled" /* The states of the finite state machine used in fips mode. */ enum module_states { /* POWEROFF cannot be represented. */ STATE_POWERON = 0, STATE_INIT, STATE_SELFTEST, STATE_OPERATIONAL, STATE_ERROR, STATE_FATALERROR, STATE_SHUTDOWN }; /* Flag telling whether we are in fips mode. It uses inverse logic so that fips mode is the default unless changed by the intialization code. To check whether fips mode is enabled, use the function fips_mode()! */ static int no_fips_mode_required; /* Flag to indicate that we are in the enforced FIPS mode. */ static int enforced_fips_mode; +/* If this flag is set, the application may no longer assume that the + process is running in FIPS mode. This flag is protected by the + FSM_LOCK. */ +static int inactive_fips_mode; + /* This is the lock we use to protect the FSM. */ static ath_mutex_t fsm_lock = ATH_MUTEX_INITIALIZER; /* The current state of the FSM. The whole state machinery is only used while in fips mode. Change this only while holding fsm_lock. */ static enum module_states current_state; static void fips_new_state (enum module_states new_state); /* Convert lowercase hex digits; assumes valid hex digits. */ #define loxtoi_1(p) (*(p) <= '9'? (*(p)- '0'): (*(p)-'a'+10)) #define loxtoi_2(p) ((loxtoi_1(p) * 16) + loxtoi_1((p)+1)) /* Returns true if P points to a lowercase hex digit. */ #define loxdigit_p(p) !!strchr ("01234567890abcdef", *(p)) /* Check whether the OS is in FIPS mode and record that in a module local variable. If FORCE is passed as true, fips mode will be enabled anyway. Note: This function is not thread-safe and should be called before any threads are created. This function may only be called once. */ void _gcry_initialize_fips_mode (int force) { static int done; gpg_error_t err; /* Make sure we are not accidently called twice. */ if (done) { if ( fips_mode () ) { fips_new_state (STATE_FATALERROR); fips_noreturn (); } /* If not in fips mode an assert is sufficient. */ gcry_assert (!done); } done = 1; /* If the calling application explicitly requested fipsmode, do so. */ if (force) { gcry_assert (!no_fips_mode_required); goto leave; } /* For testing the system it is useful to override the system provided detection of the FIPS mode and force FIPS mode using a file. The filename is hardwired so that there won't be any confusion on whether /etc/gcrypt/ or /usr/local/etc/gcrypt/ is actually used. The file itself may be empty. */ if ( !access (FIPS_FORCE_FILE, F_OK) ) { gcry_assert (!no_fips_mode_required); goto leave; } /* Checking based on /proc file properties. */ { FILE *fp; int saved_errno; static const char const procfname[] = "/proc/sys/crypto/fips_enabled"; fp = fopen (procfname, "r"); if (fp) { char line[256]; if (fgets (line, sizeof line, fp) && atoi (line)) { /* System is in fips mode. */ fclose (fp); gcry_assert (!no_fips_mode_required); goto leave; } fclose (fp); } else if ((saved_errno = errno) != ENOENT && !access ("/proc/version", F_OK) ) { /* Problem reading the fips file despite that we have the proc file system. We better stop right away. */ log_info ("FATAL: error reading `%s' in libgcrypt: %s\n", procfname, strerror (saved_errno)); #ifdef HAVE_SYSLOG syslog (LOG_USER|LOG_ERR, "Libgcrypt error: " "reading `%s' failed: %s - abort", procfname, strerror (saved_errno)); #endif /*HAVE_SYSLOG*/ abort (); } } /* Fips not not requested, set flag. */ no_fips_mode_required = 1; leave: if (!no_fips_mode_required) { /* Yes, we are in FIPS mode. */ FILE *fp; /* Intitialize the lock to protect the FSM. */ err = ath_mutex_init (&fsm_lock); if (err) { /* If that fails we can't do anything but abort the process. We need to use log_info so that the FSM won't get involved. */ log_info ("FATAL: failed to create the FSM lock in libgcrypt: %s\n", strerror (err)); #ifdef HAVE_SYSLOG syslog (LOG_USER|LOG_ERR, "Libgcrypt error: " "creating FSM lock failed: %s - abort", strerror (err)); #endif /*HAVE_SYSLOG*/ abort (); } /* If the FIPS force files exists, is readable and has a number != 0 on its first line, we enable the enforced fips mode. */ fp = fopen (FIPS_FORCE_FILE, "r"); if (fp) { char line[256]; if (fgets (line, sizeof line, fp) && atoi (line)) enforced_fips_mode = 1; fclose (fp); } /* Now get us into the INIT state. */ fips_new_state (STATE_INIT); } return; } static void lock_fsm (void) { gpg_error_t err; err = ath_mutex_lock (&fsm_lock); if (err) { log_info ("FATAL: failed to acquire the FSM lock in libgrypt: %s\n", strerror (err)); #ifdef HAVE_SYSLOG syslog (LOG_USER|LOG_ERR, "Libgcrypt error: " "acquiring FSM lock failed: %s - abort", strerror (err)); #endif /*HAVE_SYSLOG*/ abort (); } } static void unlock_fsm (void) { gpg_error_t err; err = ath_mutex_unlock (&fsm_lock); if (err) { log_info ("FATAL: failed to release the FSM lock in libgrypt: %s\n", strerror (err)); #ifdef HAVE_SYSLOG syslog (LOG_USER|LOG_ERR, "Libgcrypt error: " "releasing FSM lock failed: %s - abort", strerror (err)); #endif /*HAVE_SYSLOG*/ abort (); } } /* This function returns true if fips mode is enabled. This is independent of the fips required finite state machine and only used to enable fips specific code. Please use the fips_mode macro instead of calling this function directly. */ int _gcry_fips_mode (void) { /* No locking is required becuase we have the requirement that this variable is only intialized once with no other threads - exiisting. */ + existing. */ return !no_fips_mode_required; } /* Return a flag telling whether we are in the enforced fips mode. */ int _gcry_enforced_fips_mode (void) { return enforced_fips_mode; } +/* If we do not want to enforce the fips mode, we can set a flag so + that the application may check whether it is still in fips mode. + TEXT will be printed as part of a syslog message. This function + may only be be called if in fips mode. */ +void +_gcry_inactivate_fips_mode (const char *text) +{ + gcry_assert (_gcry_fips_mode ()); + + if (_gcry_enforced_fips_mode () ) + { + /* Get us into the error state. */ + fips_signal_error (text); + return; + } + + lock_fsm (); + if (!inactive_fips_mode) + { + inactive_fips_mode = 1; + unlock_fsm (); +#ifdef HAVE_SYSLOG + syslog (LOG_USER|LOG_WARNING, "Libgcrypt warning: " + "%s - FIPS mode inactivated", text); +#endif /*HAVE_SYSLOG*/ + } + else + unlock_fsm (); +} + + +/* Return the FIPS mode inactive flag. If it is true the FIPS mode is + not anymore active. */ +int +_gcry_is_fips_mode_inactive (void) +{ + int flag; + + if (!_gcry_fips_mode ()) + return 0; + lock_fsm (); + flag = inactive_fips_mode; + unlock_fsm (); + return flag; +} + + + static const char * state2str (enum module_states state) { const char *s; switch (state) { case STATE_POWERON: s = "Power-On"; break; case STATE_INIT: s = "Init"; break; case STATE_SELFTEST: s = "Self-Test"; break; case STATE_OPERATIONAL: s = "Operational"; break; case STATE_ERROR: s = "Error"; break; case STATE_FATALERROR: s = "Fatal-Error"; break; case STATE_SHUTDOWN: s = "Shutdown"; break; default: s = "?"; break; } return s; } /* Return true if the library is in the operational state. */ int _gcry_fips_is_operational (void) { int result; if (!fips_mode ()) result = 1; else { lock_fsm (); if (current_state == STATE_INIT) { /* If we are still in the INIT state, we need to run the selftests so that the FSM can eventually get into operational state. Given that we would need a 2-phase initialization of libgcrypt, but that has traditionally not been enforced, we use this on demand self-test checking. Note that Proper applications would do the application specific libgcrypt initialization between a gcry_check_version() and gcry_control (GCRYCTL_INITIALIZATION_FINISHED) where the latter will run the selftests. The drawback of these on-demand self-tests are a small chance that self-tests are performed by severeal threads; that is no problem because our FSM make sure that we won't oversee any error. */ unlock_fsm (); _gcry_fips_run_selftests (0); lock_fsm (); } result = (current_state == STATE_OPERATIONAL); unlock_fsm (); } return result; } /* This is test on wether the library is in the operational state. In contrast to _gcry_fips_is_operational this function won't do a state transition on the fly. */ int _gcry_fips_test_operational (void) { int result; if (!fips_mode ()) result = 1; else { lock_fsm (); result = (current_state == STATE_OPERATIONAL); unlock_fsm (); } return result; } /* This is a test on whether the library is in the error or operational state. */ int _gcry_fips_test_error_or_operational (void) { int result; if (!fips_mode ()) result = 1; else { lock_fsm (); result = (current_state == STATE_OPERATIONAL || current_state == STATE_ERROR); unlock_fsm (); } return result; } static void reporter (const char *domain, int algo, const char *what, const char *errtxt) { if (!errtxt && !_gcry_log_verbosity (2)) return; log_info ("libgcrypt selftest: %s %s%s (%d): %s%s%s%s\n", !strcmp (domain, "hmac")? "digest":domain, !strcmp (domain, "hmac")? "HMAC-":"", !strcmp (domain, "cipher")? _gcry_cipher_algo_name (algo) : !strcmp (domain, "digest")? _gcry_md_algo_name (algo) : !strcmp (domain, "hmac")? _gcry_md_algo_name (algo) : !strcmp (domain, "pubkey")? _gcry_pk_algo_name (algo) : "", algo, errtxt? errtxt:"Okay", what?" (":"", what? what:"", what?")":""); } /* Run self-tests for all required cipher algorithms. Return 0 on success. */ static int run_cipher_selftests (int extended) { static int algos[] = { GCRY_CIPHER_3DES, GCRY_CIPHER_AES128, GCRY_CIPHER_AES192, GCRY_CIPHER_AES256, 0 }; int idx; gpg_error_t err; int anyerr = 0; for (idx=0; algos[idx]; idx++) { err = _gcry_cipher_selftest (algos[idx], extended, reporter); reporter ("cipher", algos[idx], NULL, err? gpg_strerror (err):NULL); if (err) anyerr = 1; } return anyerr; } /* Run self-tests for all required hash algorithms. Return 0 on success. */ static int run_digest_selftests (int extended) { static int algos[] = { GCRY_MD_SHA1, GCRY_MD_SHA224, GCRY_MD_SHA256, GCRY_MD_SHA384, GCRY_MD_SHA512, 0 }; int idx; gpg_error_t err; int anyerr = 0; for (idx=0; algos[idx]; idx++) { err = _gcry_md_selftest (algos[idx], extended, reporter); reporter ("digest", algos[idx], NULL, err? gpg_strerror (err):NULL); if (err) anyerr = 1; } return anyerr; } /* Run self-tests for all HMAC algorithms. Return 0 on success. */ static int run_hmac_selftests (int extended) { static int algos[] = { GCRY_MD_SHA1, GCRY_MD_SHA224, GCRY_MD_SHA256, GCRY_MD_SHA384, GCRY_MD_SHA512, 0 }; int idx; gpg_error_t err; int anyerr = 0; for (idx=0; algos[idx]; idx++) { err = _gcry_hmac_selftest (algos[idx], extended, reporter); reporter ("hmac", algos[idx], NULL, err? gpg_strerror (err):NULL); if (err) anyerr = 1; } return anyerr; } /* Run self-tests for all required public key algorithms. Return 0 on success. */ static int run_pubkey_selftests (int extended) { static int algos[] = { GCRY_PK_RSA, GCRY_PK_DSA, /* GCRY_PK_ECDSA is not enabled in fips mode. */ 0 }; int idx; gpg_error_t err; int anyerr = 0; for (idx=0; algos[idx]; idx++) { err = _gcry_pk_selftest (algos[idx], extended, reporter); reporter ("pubkey", algos[idx], NULL, err? gpg_strerror (err):NULL); if (err) anyerr = 1; } return anyerr; } /* Run self-tests for the random number generator. Returns 0 on success. */ static int run_random_selftests (void) { gpg_error_t err; err = _gcry_random_selftest (reporter); reporter ("random", 0, NULL, err? gpg_strerror (err):NULL); return !!err; } /* Run an integrity check on the binary. Returns 0 on success. */ static int check_binary_integrity (void) { #ifdef ENABLE_HMAC_BINARY_CHECK gpg_error_t err; Dl_info info; unsigned char digest[32]; int dlen; char *fname = NULL; const char key[] = "What am I, a doctor or a moonshuttle conductor?"; if (!dladdr ("gcry_check_version", &info)) err = gpg_error_from_syserror (); else { dlen = _gcry_hmac256_file (digest, sizeof digest, info.dli_fname, key, strlen (key)); if (dlen < 0) err = gpg_error_from_syserror (); else if (dlen != 32) err = gpg_error (GPG_ERR_INTERNAL); else { fname = gcry_malloc (strlen (info.dli_fname) + 1 + 5 + 1 ); if (!fname) err = gpg_error_from_syserror (); else { FILE *fp; char *p; /* Prefix the basename with a dot. */ strcpy (fname, info.dli_fname); p = strrchr (fname, '/'); if (p) p++; else p = fname; memmove (p+1, p, strlen (p)+1); *p = '.'; strcat (fname, ".hmac"); /* Open the file. */ fp = fopen (fname, "r"); if (!fp) err = gpg_error_from_syserror (); else { /* A buffer of 64 bytes plus one for a LF and one to detect garbage. */ unsigned char buffer[64+1+1]; const unsigned char *s; int n; /* The HMAC files consists of lowercase hex digits only with an optional trailing linefeed. Fail if there is any garbage. */ err = gpg_error (GPG_ERR_SELFTEST_FAILED); n = fread (buffer, 1, sizeof buffer, fp); if (n == 64 || (n == 65 && buffer[64] == '\n')) { buffer[64] = 0; for (n=0, s= buffer; n < 32 && loxdigit_p (s) && loxdigit_p (s+1); n++, s += 2) buffer[n] = loxtoi_2 (s); if ( n == 32 && !memcmp (digest, buffer, 32) ) err = 0; } fclose (fp); } } } } reporter ("binary", 0, fname, err? gpg_strerror (err):NULL); #ifdef HAVE_SYSLOG if (err) syslog (LOG_USER|LOG_ERR, "Libgcrypt error: " "integrity check using `%s' failed: %s", fname? fname:"[?]", gpg_strerror (err)); #endif /*HAVE_SYSLOG*/ gcry_free (fname); return !!err; #else return 0; #endif } /* Run the self-tests. If EXTENDED is true, extended versions of the selftest are run, that is more tests than required by FIPS. */ gpg_err_code_t _gcry_fips_run_selftests (int extended) { enum module_states result = STATE_ERROR; gcry_err_code_t ec = GPG_ERR_SELFTEST_FAILED; if (fips_mode ()) fips_new_state (STATE_SELFTEST); if (run_cipher_selftests (extended)) goto leave; if (run_digest_selftests (extended)) goto leave; if (run_hmac_selftests (extended)) goto leave; /* Run random tests before the pubkey tests because the latter require random. */ if (run_random_selftests ()) goto leave; if (run_pubkey_selftests (extended)) goto leave; /* Now check the integrity of the binary. We do this this after having checked the HMAC code. */ if (check_binary_integrity ()) goto leave; /* All selftests passed. */ result = STATE_OPERATIONAL; ec = 0; leave: if (fips_mode ()) fips_new_state (result); return ec; } /* This function is used to tell the FSM about errors in the library. The FSM will be put into an error state. This function should not be called directly but by one of the macros fips_signal_error (description) fips_signal_fatal_error (description) where DESCRIPTION is a string describing the error. */ void _gcry_fips_signal_error (const char *srcfile, int srcline, const char *srcfunc, int is_fatal, const char *description) { if (!fips_mode ()) return; /* Not required. */ /* Set new state before printing an error. */ fips_new_state (is_fatal? STATE_FATALERROR : STATE_ERROR); /* Print error. */ log_info ("%serror in libgcrypt, file %s, line %d%s%s: %s\n", is_fatal? "fatal ":"", srcfile, srcline, srcfunc? ", function ":"", srcfunc? srcfunc:"", description? description : "no description available"); #ifdef HAVE_SYSLOG syslog (LOG_USER|LOG_ERR, "Libgcrypt error: " "%serror in file %s, line %d%s%s: %s", is_fatal? "fatal ":"", srcfile, srcline, srcfunc? ", function ":"", srcfunc? srcfunc:"", description? description : "no description available"); #endif /*HAVE_SYSLOG*/ } /* Perform a state transition to NEW_STATE. If this is an invalid transition, the module will go into a fatal error state. */ static void fips_new_state (enum module_states new_state) { int ok = 0; enum module_states last_state; lock_fsm (); last_state = current_state; switch (current_state) { case STATE_POWERON: if (new_state == STATE_INIT || new_state == STATE_ERROR || new_state == STATE_FATALERROR) ok = 1; break; case STATE_INIT: if (new_state == STATE_SELFTEST || new_state == STATE_ERROR || new_state == STATE_FATALERROR) ok = 1; break; case STATE_SELFTEST: if (new_state == STATE_OPERATIONAL || new_state == STATE_ERROR || new_state == STATE_FATALERROR) ok = 1; break; case STATE_OPERATIONAL: if (new_state == STATE_SHUTDOWN || new_state == STATE_SELFTEST || new_state == STATE_ERROR || new_state == STATE_FATALERROR) ok = 1; break; case STATE_ERROR: if (new_state == STATE_SHUTDOWN || new_state == STATE_ERROR || new_state == STATE_FATALERROR || new_state == STATE_SELFTEST) ok = 1; break; case STATE_FATALERROR: if (new_state == STATE_SHUTDOWN ) ok = 1; break; case STATE_SHUTDOWN: /* We won't see any transition *from* Shutdown because the only allowed new state is Power-Off and that one can't be represented. */ break; } if (ok) { current_state = new_state; } unlock_fsm (); if (!ok || _gcry_log_verbosity (2)) log_info ("libgcrypt state transition %s => %s %s\n", state2str (last_state), state2str (new_state), ok? "granted":"denied"); if (!ok) { /* Invalid state transition. Halting library. */ #ifdef HAVE_SYSLOG syslog (LOG_USER|LOG_ERR, "Libgcrypt error: invalid state transition %s => %s", state2str (last_state), state2str (new_state)); #endif /*HAVE_SYSLOG*/ fips_noreturn (); } else if (new_state == STATE_ERROR || new_state == STATE_FATALERROR) { #ifdef HAVE_SYSLOG syslog (LOG_USER|LOG_WARNING, "Libgcrypt notice: state transition %s => %s", state2str (last_state), state2str (new_state)); #endif /*HAVE_SYSLOG*/ } } /* This function should be called to ensure that the execution shall not continue. */ void _gcry_fips_noreturn (void) { #ifdef HAVE_SYSLOG syslog (LOG_USER|LOG_ERR, "Libgcrypt terminated the application"); #endif /*HAVE_SYSLOG*/ fflush (NULL); abort (); /*NOTREACHED*/ } diff --git a/src/g10lib.h b/src/g10lib.h index 6a23f261..a3ffb127 100644 --- a/src/g10lib.h +++ b/src/g10lib.h @@ -1,329 +1,333 @@ /* g10lib.h - Internal definitions for libgcrypt * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2005 * 2007 Free Software Foundation, Inc. * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser general Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ /* This header is to be used inside of libgcrypt in place of gcrypt.h. This way we can better distinguish between internal and external usage of gcrypt.h. */ #ifndef G10LIB_H #define G10LIB_H 1 #ifdef _GCRYPT_H #error gcrypt.h already included #endif #ifndef _GCRYPT_IN_LIBGCRYPT #error something is wrong with config.h #endif #include #include #include "visibility.h" #include "types.h" /* Attribute handling macros. */ #if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 5 ) #define JNLIB_GCC_M_FUNCTION 1 #define JNLIB_GCC_A_NR __attribute__ ((noreturn)) #define JNLIB_GCC_A_PRINTF( f, a ) __attribute__ ((format (printf,f,a))) #define JNLIB_GCC_A_NR_PRINTF( f, a ) \ __attribute__ ((noreturn, format (printf,f,a))) #define GCC_ATTR_NORETURN __attribute__ ((__noreturn__)) #else #define JNLIB_GCC_A_NR #define JNLIB_GCC_A_PRINTF( f, a ) #define JNLIB_GCC_A_NR_PRINTF( f, a ) #define GCC_ATTR_NORETURN #endif /* Gettext macros. */ #define _(a) _gcry_gettext(a) #define N_(a) (a) /* Some handy macros */ #ifndef STR #define STR(v) #v #endif #define STR2(v) STR(v) #define DIM(v) (sizeof(v)/sizeof((v)[0])) #define DIMof(type,member) DIM(((type *)0)->member) /*-- src/global.c -*/ int _gcry_global_is_operational (void); gcry_error_t _gcry_vcontrol (enum gcry_ctl_cmds cmd, va_list arg_ptr); void _gcry_check_heap (const void *a); int _gcry_get_debug_flag (unsigned int mask); /*-- src/misc.c --*/ #if defined(JNLIB_GCC_M_FUNCTION) || __STDC_VERSION__ >= 199901L void _gcry_bug (const char *file, int line, const char *func) GCC_ATTR_NORETURN; void _gcry_assert_failed (const char *expr, const char *file, int line, const char *func) GCC_ATTR_NORETURN; #else void _gcry_bug (const char *file, int line); void _gcry_assert_failed (const char *expr, const char *file, int line); #endif const char *_gcry_gettext (const char *key); void _gcry_fatal_error(int rc, const char *text ) JNLIB_GCC_A_NR; void _gcry_log( int level, const char *fmt, ... ) JNLIB_GCC_A_PRINTF(2,3); void _gcry_log_bug( const char *fmt, ... ) JNLIB_GCC_A_NR_PRINTF(1,2); void _gcry_log_fatal( const char *fmt, ... ) JNLIB_GCC_A_NR_PRINTF(1,2); void _gcry_log_error( const char *fmt, ... ) JNLIB_GCC_A_PRINTF(1,2); void _gcry_log_info( const char *fmt, ... ) JNLIB_GCC_A_PRINTF(1,2); int _gcry_log_info_with_dummy_fp (FILE *fp, const char *fmt, ... ) JNLIB_GCC_A_PRINTF(2,3); void _gcry_log_debug( const char *fmt, ... ) JNLIB_GCC_A_PRINTF(1,2); void _gcry_log_printf ( const char *fmt, ... ) JNLIB_GCC_A_PRINTF(1,2); void _gcry_log_printhex (const char *text, const void *buffer, size_t length); void _gcry_set_log_verbosity( int level ); int _gcry_log_verbosity( int level ); #ifdef JNLIB_GCC_M_FUNCTION #define BUG() _gcry_bug( __FILE__ , __LINE__, __FUNCTION__ ) #define gcry_assert(expr) ((expr)? (void)0 \ : _gcry_assert_failed (STR(expr), __FILE__, __LINE__, __FUNCTION__)) #elif __STDC_VERSION__ >= 199901L #define BUG() _gcry_bug( __FILE__ , __LINE__, __func__ ) #define gcry_assert(expr) ((expr)? (void)0 \ : _gcry_assert_failed (STR(expr), __FILE__, __LINE__, __func__)) #else #define BUG() _gcry_bug( __FILE__ , __LINE__ ) #define gcry_assert(expr) ((expr)? (void)0 \ : _gcry_assert_failed (STR(expr), __FILE__, __LINE__)) #endif #define log_bug _gcry_log_bug #define log_fatal _gcry_log_fatal #define log_error _gcry_log_error #define log_info _gcry_log_info #define log_debug _gcry_log_debug #define log_printf _gcry_log_printf #define log_printhex _gcry_log_printhex /*-- src/hwfeatures.c --*/ /* (Do not change these values unless synced with the asm code.) */ #define HWF_PADLOCK_RNG 1 #define HWF_PADLOCK_AES 2 #define HWF_PADLOCK_SHA 4 #define HWF_PADLOCK_MMUL 8 unsigned int _gcry_get_hw_features (void); void _gcry_detect_hw_features (void); /*-- mpi/mpiutil.c --*/ const char *_gcry_mpi_get_hw_config (void); /*-- cipher/pubkey.c --*/ /* FIXME: shouldn't this go into mpi.h? */ #ifndef mpi_powm #define mpi_powm(w,b,e,m) gcry_mpi_powm( (w), (b), (e), (m) ) #endif /*-- primegen.c --*/ gcry_mpi_t _gcry_generate_secret_prime (unsigned int nbits, gcry_random_level_t random_level, int (*extra_check)(void*, gcry_mpi_t), void *extra_check_arg); gcry_mpi_t _gcry_generate_public_prime (unsigned int nbits, gcry_random_level_t random_level, int (*extra_check)(void*, gcry_mpi_t), void *extra_check_arg); gcry_mpi_t _gcry_generate_elg_prime (int mode, unsigned int pbits, unsigned int qbits, gcry_mpi_t g, gcry_mpi_t **factors); /* replacements of missing functions (missing-string.c)*/ #ifndef HAVE_STPCPY char *stpcpy (char *a, const char *b); #endif #ifndef HAVE_STRCASECMP int strcasecmp (const char *a, const char *b) _GCRY_GCC_ATTR_PURE; #endif /* macros used to rename missing functions */ #ifndef HAVE_STRTOUL #define strtoul(a,b,c) ((unsigned long)strtol((a),(b),(c))) #endif #ifndef HAVE_MEMMOVE #define memmove(d, s, n) bcopy((s), (d), (n)) #endif #ifndef HAVE_STRICMP #define stricmp(a,b) strcasecmp( (a), (b) ) #endif #ifndef HAVE_ATEXIT #define atexit(a) (on_exit((a),0)) #endif #ifndef HAVE_RAISE #define raise(a) kill(getpid(), (a)) #endif /* Stack burning. */ void _gcry_burn_stack (int bytes); /* To avoid that a compiler optimizes certain memset calls away, these macros may be used instead. */ #define wipememory2(_ptr,_set,_len) do { \ volatile char *_vptr=(volatile char *)(_ptr); \ size_t _vlen=(_len); \ while(_vlen) { *_vptr=(_set); _vptr++; _vlen--; } \ } while(0) #define wipememory(_ptr,_len) wipememory2(_ptr,0,_len) /* Digit predicates. */ #define digitp(p) (*(p) >= '0' && *(p) <= '9') #define octdigitp(p) (*(p) >= '0' && *(p) <= '7') #define alphap(a) ( (*(a) >= 'A' && *(a) <= 'Z') \ || (*(a) >= 'a' && *(a) <= 'z')) #define hexdigitp(a) (digitp (a) \ || (*(a) >= 'A' && *(a) <= 'F') \ || (*(a) >= 'a' && *(a) <= 'f')) /* Management for ciphers/digests/pubkey-ciphers. */ /* Structure for each registered `module'. */ struct gcry_module { struct gcry_module *next; /* List pointers. */ struct gcry_module **prevp; void *spec; /* Pointer to the subsystem-specific specification structure. */ void *extraspec; /* Pointer to the subsystem-specific extra specification structure. */ int flags; /* Associated flags. */ int counter; /* Use counter. */ unsigned int mod_id; /* ID of this module. */ }; /* Flags for the `flags' member of gcry_module_t. */ #define FLAG_MODULE_DISABLED (1 << 0) gcry_err_code_t _gcry_module_add (gcry_module_t *entries, unsigned int id, void *spec, void *extraspec, gcry_module_t *module); typedef int (*gcry_module_lookup_t) (void *spec, void *data); /* Lookup a module specification by it's ID. After a successfull lookup, the module has it's resource counter incremented. */ gcry_module_t _gcry_module_lookup_id (gcry_module_t entries, unsigned int id); /* Internal function. Lookup a module specification. */ gcry_module_t _gcry_module_lookup (gcry_module_t entries, void *data, gcry_module_lookup_t func); /* Release a module. In case the use-counter reaches zero, destroy the module. */ void _gcry_module_release (gcry_module_t entry); /* Add a reference to a module. */ void _gcry_module_use (gcry_module_t module); /* Return a list of module IDs. */ gcry_err_code_t _gcry_module_list (gcry_module_t modules, int *list, int *list_length); gcry_err_code_t _gcry_cipher_init (void); gcry_err_code_t _gcry_md_init (void); gcry_err_code_t _gcry_pk_init (void); gcry_err_code_t _gcry_ac_init (void); gcry_err_code_t _gcry_pk_module_lookup (int id, gcry_module_t *module); void _gcry_pk_module_release (gcry_module_t module); gcry_err_code_t _gcry_pk_get_elements (int algo, char **enc, char **sig); /* Memory management. */ #define GCRY_ALLOC_FLAG_SECURE (1 << 0) /*-- sexp.c --*/ gcry_error_t _gcry_sexp_vbuild (gcry_sexp_t *retsexp, size_t *erroff, const char *format, va_list arg_ptr); char *_gcry_sexp_nth_string (const gcry_sexp_t list, int number); /*-- fips.c --*/ void _gcry_initialize_fips_mode (int force); int _gcry_fips_mode (void); #define fips_mode() _gcry_fips_mode () int _gcry_enforced_fips_mode (void); +void _gcry_inactivate_fips_mode (const char *text); +int _gcry_is_fips_mode_inactive (void); + + void _gcry_fips_signal_error (const char *srcfile, int srcline, const char *srcfunc, int is_fatal, const char *description); #ifdef JNLIB_GCC_M_FUNCTION # define fips_signal_error(a) \ _gcry_fips_signal_error (__FILE__, __LINE__, __FUNCTION__, 0, (a)) # define fips_signal_fatal_error(a) \ _gcry_fips_signal_error (__FILE__, __LINE__, __FUNCTION__, 1, (a)) #else # define fips_signal_error(a) \ _gcry_fips_signal_error (__FILE__, __LINE__, NULL, 0, (a)) # define fips_signal_fatal_error(a) \ _gcry_fips_signal_error (__FILE__, __LINE__, NULL, 1, (a)) #endif int _gcry_fips_is_operational (void); #define fips_is_operational() (_gcry_global_is_operational ()) #define fips_not_operational() (GCRY_GPG_ERR_NOT_OPERATIONAL) int _gcry_fips_test_operational (void); int _gcry_fips_test_error_or_operational (void); gpg_err_code_t _gcry_fips_run_selftests (int extended); void _gcry_fips_noreturn (void); #define fips_noreturn() (_gcry_fips_noreturn ()) #endif /* G10LIB_H */ diff --git a/src/global.c b/src/global.c index 15b7672a..3177a02b 100644 --- a/src/global.c +++ b/src/global.c @@ -1,1072 +1,1060 @@ /* global.c - global control functions * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003 * 2004, 2005, 2006, 2008 Free Software Foundation, Inc. * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser general Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ #include #include #include #include #include #include #include #include #include #ifdef HAVE_SYSLOG # include #endif /*HAVE_SYSLOG*/ #include "g10lib.h" #include "cipher.h" #include "stdmem.h" /* our own memory allocator */ #include "secmem.h" /* our own secmem allocator */ #include "ath.h" /**************** * flag bits: 0 : general cipher debug * 1 : general MPI debug */ static unsigned int debug_flags; /* gcry_control (GCRYCTL_SET_FIPS_MODE), sets this flag so that the intialization code swicthed fips mode on. */ static int force_fips_mode; -/* If this flag is set, the application may no longer assume that the - process is running in FIPS mode. */ -static int inactive_fips_mode; - /* Controlled by global_init(). */ static int any_init_done; /* Memory management. */ static gcry_handler_alloc_t alloc_func; static gcry_handler_alloc_t alloc_secure_func; static gcry_handler_secure_check_t is_secure_func; static gcry_handler_realloc_t realloc_func; static gcry_handler_free_t free_func; static gcry_handler_no_mem_t outofcore_handler; static void *outofcore_handler_value; static int no_secure_memory; /* This is our handmade constructor. It gets called by any function likely to be called at startup. The suggested way for an application to make sure that this has been called is by using gcry_check_version. */ static void global_init (void) { gcry_error_t err = 0; if (any_init_done) return; any_init_done = 1; /* Initialize our portable thread/mutex wrapper. */ err = ath_init (); if (err) goto fail; /* See whether the system is in FIPS mode. This needs to come as early as possible put after the ATH has been initialized. */ _gcry_initialize_fips_mode (force_fips_mode); /* Before we do any other initialization we need to test available hardware features. */ _gcry_detect_hw_features (); err = _gcry_cipher_init (); if (err) goto fail; err = _gcry_md_init (); if (err) goto fail; err = _gcry_pk_init (); if (err) goto fail; #if 0 /* Hmmm, as of now ac_init does nothing. */ if ( !fips_mode () ) { err = _gcry_ac_init (); if (err) goto fail; } #endif return; fail: BUG (); } /* This function is called by the macro fips_is_operational and makes sure that the minimal initialization has been done. This is far from a perfect solution and hides problems with an improper initialization but at least in single-threaded mode it should work reliable. The reason we need this is that a lot of applications don't use Libgcrypt properly by not running any initialization code at all. They just call a Libgcrypt function and that is all what they want. Now with the FIPS mode, that has the side effect of entering FIPS mode (for security reasons, FIPS mode is the default if no initialization has been done) and bailing out immediately because the FSM is in the wrong state. If we always run the init code, Libgcrypt can test for FIPS mode and at least if not in FIPS mode, it will behave as before. Note that this on-the-fly initialization is only done for the cryptographic functions subject to FIPS mode and thus not all API calls will do such an initialization. */ int _gcry_global_is_operational (void) { if (!any_init_done) { #ifdef HAVE_SYSLOG syslog (LOG_USER|LOG_WARNING, "Libgcrypt warning: " "missing initialization - please fix the application"); #endif /*HAVE_SYSLOG*/ global_init (); } return _gcry_fips_is_operational (); } /* Version number parsing. */ /* This function parses the first portion of the version number S and stores it in *NUMBER. On sucess, this function returns a pointer into S starting with the first character, which is not part of the initial number portion; on failure, NULL is returned. */ static const char* parse_version_number( const char *s, int *number ) { int val = 0; if( *s == '0' && isdigit(s[1]) ) return NULL; /* leading zeros are not allowed */ for ( ; isdigit(*s); s++ ) { val *= 10; val += *s - '0'; } *number = val; return val < 0? NULL : s; } /* This function breaks up the complete string-representation of the version number S, which is of the following struture: ... The major, minor and micro number components will be stored in *MAJOR, *MINOR and *MICRO. On success, the last component, the patch level, will be returned; in failure, NULL will be returned. */ static const char * parse_version_string( const char *s, int *major, int *minor, int *micro ) { s = parse_version_number( s, major ); if( !s || *s != '.' ) return NULL; s++; s = parse_version_number( s, minor ); if( !s || *s != '.' ) return NULL; s++; s = parse_version_number( s, micro ); if( !s ) return NULL; return s; /* patchlevel */ } /* If REQ_VERSION is non-NULL, check that the version of the library is at minimum the requested one. Returns the string representation of the library version if the condition is satisfied; return NULL if the requested version is newer than that of the library. If a NULL is passed to this function, no check is done, but the string representation of the library is simply returned. */ const char * gcry_check_version( const char *req_version ) { const char *ver = VERSION; int my_major, my_minor, my_micro; int rq_major, rq_minor, rq_micro; const char *my_plvl, *rq_plvl; /* Initialize library. */ global_init (); if ( !req_version ) /* Caller wants our version number. */ return ver; /* Parse own version number. */ my_plvl = parse_version_string( ver, &my_major, &my_minor, &my_micro ); if ( !my_plvl ) /* very strange our own version is bogus. Shouldn't we use assert() here and bail out in case this happens? -mo. */ return NULL; /* Parse requested version number. */ rq_plvl = parse_version_string( req_version, &rq_major, &rq_minor, &rq_micro ); if ( !rq_plvl ) /* req version string is invalid, this can happen. */ return NULL; /* Compare version numbers. */ if ( my_major > rq_major || (my_major == rq_major && my_minor > rq_minor) || (my_major == rq_major && my_minor == rq_minor && my_micro > rq_micro) || (my_major == rq_major && my_minor == rq_minor && my_micro == rq_micro && strcmp( my_plvl, rq_plvl ) >= 0) ) { return ver; } return NULL; } static void print_config ( int (*fnc)(FILE *fp, const char *format, ...), FILE *fp) { unsigned int hwf; struct { unsigned int flag; const char *desc; } hwflist[] = { { HWF_PADLOCK_RNG, "padlock-rng" }, { HWF_PADLOCK_AES, "padlock-aes" }, { HWF_PADLOCK_SHA, "padlock-sha" }, { 0, NULL} }; int i; fnc (fp, "version:%s:\n", VERSION); fnc (fp, "ciphers:%s:\n", LIBGCRYPT_CIPHERS); fnc (fp, "pubkeys:%s:\n", LIBGCRYPT_PUBKEY_CIPHERS); fnc (fp, "digests:%s:\n", LIBGCRYPT_DIGESTS); fnc (fp, "rnd-mod:" #if USE_RNDEGD "egd:" #endif #if USE_RNDLINUX "linux:" #endif #if USE_RNDUNIX "unix:" #endif #if USE_RNDW32 "w32:" #endif "\n"); fnc (fp, "mpi-asm:%s:\n", _gcry_mpi_get_hw_config ()); hwf = _gcry_get_hw_features (); fnc (fp, "hwflist:"); for (i=0; hwflist[i].desc; i++) if ( (hwf & hwflist[i].flag) ) fnc (fp, "%s:", hwflist[i].desc); fnc (fp, "\n"); /* We use y/n instead of 1/0 for the simple reason that Emacsen's compile error parser would accidently flag that line when printed during "make check" as an error. */ fnc (fp, "fips-mode:%c:%c:\n", fips_mode ()? 'y':'n', _gcry_enforced_fips_mode ()? 'y':'n' ); } /* Command dispatcher function, acting as general control function. */ gcry_error_t _gcry_vcontrol (enum gcry_ctl_cmds cmd, va_list arg_ptr) { static int init_finished = 0; gcry_err_code_t err = 0; switch (cmd) { case GCRYCTL_ENABLE_M_GUARD: _gcry_private_enable_m_guard (); break; case GCRYCTL_ENABLE_QUICK_RANDOM: _gcry_enable_quick_random_gen (); break; case GCRYCTL_FAKED_RANDOM_P: /* Return an error if the RNG is faked one (e.g. enabled by ENABLE_QUICK_RANDOM. */ if (_gcry_random_is_faked ()) err = GPG_ERR_GENERAL; /* Use as TRUE value. */ break; case GCRYCTL_DUMP_RANDOM_STATS: _gcry_random_dump_stats (); break; case GCRYCTL_DUMP_MEMORY_STATS: /*m_print_stats("[fixme: prefix]");*/ break; case GCRYCTL_DUMP_SECMEM_STATS: _gcry_secmem_dump_stats (); break; case GCRYCTL_DROP_PRIVS: global_init (); _gcry_secmem_init (0); break; case GCRYCTL_DISABLE_SECMEM: global_init (); no_secure_memory = 1; break; case GCRYCTL_INIT_SECMEM: global_init (); _gcry_secmem_init (va_arg (arg_ptr, unsigned int)); if ((_gcry_secmem_get_flags () & GCRY_SECMEM_FLAG_NOT_LOCKED)) err = GPG_ERR_GENERAL; break; case GCRYCTL_TERM_SECMEM: global_init (); _gcry_secmem_term (); break; case GCRYCTL_DISABLE_SECMEM_WARN: _gcry_secmem_set_flags ((_gcry_secmem_get_flags () | GCRY_SECMEM_FLAG_NO_WARNING)); break; case GCRYCTL_SUSPEND_SECMEM_WARN: _gcry_secmem_set_flags ((_gcry_secmem_get_flags () | GCRY_SECMEM_FLAG_SUSPEND_WARNING)); break; case GCRYCTL_RESUME_SECMEM_WARN: _gcry_secmem_set_flags ((_gcry_secmem_get_flags () & ~GCRY_SECMEM_FLAG_SUSPEND_WARNING)); break; case GCRYCTL_USE_SECURE_RNDPOOL: global_init (); _gcry_secure_random_alloc (); /* Put random number into secure memory. */ break; case GCRYCTL_SET_RANDOM_SEED_FILE: _gcry_set_random_seed_file (va_arg (arg_ptr, const char *)); break; case GCRYCTL_UPDATE_RANDOM_SEED_FILE: if ( fips_is_operational () ) _gcry_update_random_seed_file (); break; case GCRYCTL_SET_VERBOSITY: _gcry_set_log_verbosity (va_arg (arg_ptr, int)); break; case GCRYCTL_SET_DEBUG_FLAGS: debug_flags |= va_arg (arg_ptr, unsigned int); break; case GCRYCTL_CLEAR_DEBUG_FLAGS: debug_flags &= ~va_arg (arg_ptr, unsigned int); break; case GCRYCTL_DISABLE_INTERNAL_LOCKING: /* Not used anymore. */ global_init (); break; case GCRYCTL_ANY_INITIALIZATION_P: if (any_init_done) err = GPG_ERR_GENERAL; break; case GCRYCTL_INITIALIZATION_FINISHED_P: if (init_finished) err = GPG_ERR_GENERAL; /* Yes. */ break; case GCRYCTL_INITIALIZATION_FINISHED: /* This is a hook which should be used by an application after all initialization has been done and right before any threads are started. It is not really needed but the only way to be really sure that all initialization for thread-safety has been done. */ if (! init_finished) { global_init (); /* Do only a basic random initialization, i.e. init the mutexes. */ _gcry_random_initialize (0); init_finished = 1; /* Force us into operational state if in FIPS mode. */ (void)fips_is_operational (); } break; case GCRYCTL_SET_THREAD_CBS: err = ath_install (va_arg (arg_ptr, void *), any_init_done); if (! err) global_init (); break; case GCRYCTL_FAST_POLL: /* We need to do make sure that the random pool is really initialized so that the poll function is not a NOP. */ _gcry_random_initialize (1); if ( fips_is_operational () ) _gcry_fast_random_poll (); break; case GCRYCTL_SET_RNDEGD_SOCKET: #if USE_RNDEGD err = _gcry_rndegd_set_socket_name (va_arg (arg_ptr, const char *)); #else err = gpg_error (GPG_ERR_NOT_SUPPORTED); #endif break; case GCRYCTL_SET_RANDOM_DAEMON_SOCKET: _gcry_set_random_daemon_socket (va_arg (arg_ptr, const char *)); break; case GCRYCTL_USE_RANDOM_DAEMON: /* We need to do make sure that the random pool is really initialized so that the poll function is not a NOP. */ _gcry_random_initialize (1); _gcry_use_random_daemon (!! va_arg (arg_ptr, int)); break; /* This command dumps information pertaining to the configuration of libgcrypt to the given stream. It may be used before the intialization has been finished but not before a gcry_version_check. */ case GCRYCTL_PRINT_CONFIG: { FILE *fp = va_arg (arg_ptr, FILE *); print_config (fp?fprintf:_gcry_log_info_with_dummy_fp, fp); } break; case GCRYCTL_OPERATIONAL_P: /* Returns true if the library is in an operational state. This is always true for non-fips mode. */ if (_gcry_fips_test_operational ()) err = GPG_ERR_GENERAL; /* Used as TRUE value */ break; case GCRYCTL_FIPS_MODE_P: - if (fips_mode () && !inactive_fips_mode && !no_secure_memory) + if (fips_mode () + && !_gcry_is_fips_mode_inactive () + && !no_secure_memory) err = GPG_ERR_GENERAL; /* Used as TRUE value */ break; case GCRYCTL_FORCE_FIPS_MODE: /* Performing this command puts the library into fips mode. If the library has already been initialized into fips mode, a selftest is triggered. it is not possible to put the libraty into fips mode after having passed the initialization. */ if (!any_init_done) { /* Not yet intialized at all. Set a flag so that we are put into fips mode during initialization. */ force_fips_mode = 1; } else { /* Already initialized. If we are already operational we run a selftest. If not we use the is_operational call to force us into operational state if possible. */ if (_gcry_fips_test_error_or_operational ()) _gcry_fips_run_selftests (1); if (_gcry_fips_is_operational ()) err = GPG_ERR_GENERAL; /* Used as TRUE value */ } break; case GCRYCTL_SELFTEST: /* Run a selftest. This works in fips mode as well as in standard mode. In contrast to the power-up tests, we use an extended version of the selftests. Returns 0 on success or an error code. */ global_init (); err = _gcry_fips_run_selftests (1); break; case 58: { void **rctx = va_arg (arg_ptr, void **); unsigned int flags = va_arg (arg_ptr, unsigned int); const void *key = va_arg (arg_ptr, const void *); size_t keylen = va_arg (arg_ptr, size_t); const void *seed = va_arg (arg_ptr, const void *); size_t seedlen = va_arg (arg_ptr, size_t); const void *dt = va_arg (arg_ptr, const void *); size_t dtlen = va_arg (arg_ptr, size_t); if (!fips_is_operational ()) err = fips_not_operational (); else err = _gcry_random_init_external_test (rctx, flags, key, keylen, seed, seedlen, dt, dtlen); } break; case 59: { void *ctx = va_arg (arg_ptr, void *); void *buffer = va_arg (arg_ptr, void *); size_t buflen = va_arg (arg_ptr, size_t); if (!fips_is_operational ()) err = fips_not_operational (); else err = _gcry_random_run_external_test (ctx, buffer, buflen); } break; case 60: { void *ctx = va_arg (arg_ptr, void *); _gcry_random_deinit_external_test (ctx); } break; default: err = GPG_ERR_INV_OP; } return gcry_error (err); } /* Command dispatcher function, acting as general control function. */ gcry_error_t gcry_control (enum gcry_ctl_cmds cmd, ...) { gcry_error_t err; va_list arg_ptr; va_start (arg_ptr, cmd); err = _gcry_vcontrol (cmd, arg_ptr); va_end(arg_ptr); return err; } /* Return a pointer to a string containing a description of the error code in the error value ERR. */ const char * gcry_strerror (gcry_error_t err) { return gpg_strerror (err); } /* Return a pointer to a string containing a description of the error source in the error value ERR. */ const char * gcry_strsource (gcry_error_t err) { return gpg_strsource (err); } /* Retrieve the error code for the system error ERR. This returns GPG_ERR_UNKNOWN_ERRNO if the system error is not mapped (report this). */ gcry_err_code_t gcry_err_code_from_errno (int err) { return gpg_err_code_from_errno (err); } /* Retrieve the system error for the error code CODE. This returns 0 if CODE is not a system error code. */ int gcry_err_code_to_errno (gcry_err_code_t code) { return gpg_err_code_from_errno (code); } /* Return an error value with the error source SOURCE and the system error ERR. */ gcry_error_t gcry_err_make_from_errno (gpg_err_source_t source, int err) { return gpg_err_make_from_errno (source, err); } /* Return an error value with the system error ERR. */ gcry_err_code_t gcry_error_from_errno (int err) { return gcry_error (gpg_err_code_from_errno (err)); } /* Set custom allocation handlers. This is in general not useful * because the libgcrypt allocation functions are guaranteed to * provide proper allocation handlers which zeroize memory if needed. * NOTE: All 5 functions should be set. */ void gcry_set_allocation_handler (gcry_handler_alloc_t new_alloc_func, gcry_handler_alloc_t new_alloc_secure_func, gcry_handler_secure_check_t new_is_secure_func, gcry_handler_realloc_t new_realloc_func, gcry_handler_free_t new_free_func) { global_init (); if (fips_mode ()) { - if (_gcry_enforced_fips_mode () ) - { - /* Get us into the error state. */ - fips_signal_error ("custom allocation handler used"); - return; - } /* We do not want to enforce the fips mode, but merely set a - flag so that the application may check wheter it is still in + flag so that the application may check whether it is still in fips mode. */ - inactive_fips_mode = 1; -#ifdef HAVE_SYSLOG - syslog (LOG_USER|LOG_WARNING, "Libgcrypt warning: " - "custom allocation handler used - FIPS mode disabled"); -#endif /*HAVE_SYSLOG*/ + _gcry_inactivate_fips_mode ("custom allocation handler"); } alloc_func = new_alloc_func; alloc_secure_func = new_alloc_secure_func; is_secure_func = new_is_secure_func; realloc_func = new_realloc_func; free_func = new_free_func; } /**************** * Set an optional handler which is called in case the xmalloc functions * ran out of memory. This handler may do one of these things: * o free some memory and return true, so that the xmalloc function * tries again. * o Do whatever it like and return false, so that the xmalloc functions * use the default fatal error handler. * o Terminate the program and don't return. * * The handler function is called with 3 arguments: The opaque value set with * this function, the requested memory size, and a flag with these bits * currently defined: * bit 0 set = secure memory has been requested. */ void gcry_set_outofcore_handler( int (*f)( void*, size_t, unsigned int ), void *value ) { global_init (); if (fips_mode () ) { log_info ("out of core handler ignored in FIPS mode\n"); return; } outofcore_handler = f; outofcore_handler_value = value; } /* Return the no_secure_memory flag. */ static int get_no_secure_memory (void) { if (!no_secure_memory) return 0; if (_gcry_enforced_fips_mode ()) { no_secure_memory = 0; return 0; } return no_secure_memory; } static gcry_err_code_t do_malloc (size_t n, unsigned int flags, void **mem) { gcry_err_code_t err = 0; void *m; if ((flags & GCRY_ALLOC_FLAG_SECURE) && !get_no_secure_memory ()) { if (alloc_secure_func) m = (*alloc_secure_func) (n); else m = _gcry_private_malloc_secure (n); } else { if (alloc_func) m = (*alloc_func) (n); else m = _gcry_private_malloc (n); } if (!m) { /* Make sure that ERRNO has been set in case a user supplied memory handler didn't it correctly. */ if (!errno) errno = ENOMEM; err = gpg_err_code_from_errno (errno); } else *mem = m; return err; } void * gcry_malloc (size_t n) { void *mem = NULL; do_malloc (n, 0, &mem); return mem; } void * gcry_malloc_secure (size_t n) { void *mem = NULL; do_malloc (n, GCRY_ALLOC_FLAG_SECURE, &mem); return mem; } int gcry_is_secure (const void *a) { if (get_no_secure_memory ()) return 0; if (is_secure_func) return is_secure_func (a) ; return _gcry_private_is_secure (a); } void _gcry_check_heap( const void *a ) { (void)a; /* FIXME: implement this*/ #if 0 if( some_handler ) some_handler(a) else _gcry_private_check_heap(a) #endif } void * gcry_realloc (void *a, size_t n) { void *p; if (realloc_func) p = realloc_func (a, n); else p = _gcry_private_realloc (a, n); if (!p && !errno) errno = ENOMEM; return p; } void gcry_free( void *p ) { if( !p ) return; if (free_func) free_func (p); else _gcry_private_free (p); } void * gcry_calloc (size_t n, size_t m) { size_t bytes; void *p; bytes = n * m; /* size_t is unsigned so the behavior on overflow is defined. */ if (m && bytes / m != n) { errno = ENOMEM; return NULL; } p = gcry_malloc (bytes); if (p) memset (p, 0, bytes); return p; } void * gcry_calloc_secure (size_t n, size_t m) { size_t bytes; void *p; bytes = n * m; /* size_t is unsigned so the behavior on overflow is defined. */ if (m && bytes / m != n) { errno = ENOMEM; return NULL; } p = gcry_malloc_secure (bytes); if (p) memset (p, 0, bytes); return p; } /* Create and return a copy of the null-terminated string STRING. If it is contained in secure memory, the copy will be contained in secure memory as well. In an out-of-memory condition, NULL is returned. */ char * gcry_strdup (const char *string) { char *string_cp = NULL; size_t string_n = 0; string_n = strlen (string); if (gcry_is_secure (string)) string_cp = gcry_malloc_secure (string_n + 1); else string_cp = gcry_malloc (string_n + 1); if (string_cp) strcpy (string_cp, string); return string_cp; } void * gcry_xmalloc( size_t n ) { void *p; while ( !(p = gcry_malloc( n )) ) { if ( fips_mode () || !outofcore_handler || !outofcore_handler (outofcore_handler_value, n, 0) ) { _gcry_fatal_error (gpg_err_code_from_errno (errno), NULL); } } return p; } void * gcry_xrealloc( void *a, size_t n ) { void *p; while ( !(p = gcry_realloc( a, n )) ) { if ( fips_mode () || !outofcore_handler || !outofcore_handler (outofcore_handler_value, n, gcry_is_secure(a)? 3:2 ) ) { _gcry_fatal_error (gpg_err_code_from_errno (errno), NULL ); } } return p; } void * gcry_xmalloc_secure( size_t n ) { void *p; while ( !(p = gcry_malloc_secure( n )) ) { if ( fips_mode () || !outofcore_handler || !outofcore_handler (outofcore_handler_value, n, 1) ) { _gcry_fatal_error (gpg_err_code_from_errno (errno), _("out of core in secure memory")); } } return p; } void * gcry_xcalloc( size_t n, size_t m ) { size_t nbytes; void *p; nbytes = n * m; if (m && nbytes / m != n) { errno = ENOMEM; _gcry_fatal_error(gpg_err_code_from_errno (errno), NULL ); } p = gcry_xmalloc ( nbytes ); memset ( p, 0, nbytes ); return p; } void * gcry_xcalloc_secure( size_t n, size_t m ) { size_t nbytes; void *p; nbytes = n * m; if (m && nbytes / m != n) { errno = ENOMEM; _gcry_fatal_error(gpg_err_code_from_errno (errno), NULL ); } p = gcry_xmalloc_secure ( nbytes ); memset ( p, 0, nbytes ); return p; } char * gcry_xstrdup (const char *string) { char *p; while ( !(p = gcry_strdup (string)) ) { size_t n = strlen (string); int is_sec = !!gcry_is_secure (string); if (fips_mode () || !outofcore_handler || !outofcore_handler (outofcore_handler_value, n, is_sec) ) { _gcry_fatal_error (gpg_err_code_from_errno (errno), is_sec? _("out of core in secure memory"):NULL); } } return p; } int _gcry_get_debug_flag (unsigned int mask) { if ( fips_mode () ) return 0; return (debug_flags & mask); } /* It is often useful to get some feedback of long running operations. This function may be used to register a handler for this. The callback function CB is used as: void cb (void *opaque, const char *what, int printchar, int current, int total); Where WHAT is a string identifying the the type of the progress output, PRINTCHAR the character usually printed, CURRENT the amount of progress currently done and TOTAL the expected amount of progress. A value of 0 for TOTAL indicates that there is no estimation available. Defined values for WHAT: "need_entropy" X 0 number-of-bytes-required When running low on entropy "primegen" '\n' 0 0 Prime generated '!' Need to refresh the prime pool '<','>' Number of bits adjusted '^' Looking for a generator '.' Fermat tests on 10 candidates failed ':' Restart with a new random value '+' Rabin Miller test passed "pk_elg" '+','-','.','\n' 0 0 Only used in debugging mode. "pk_dsa" Only used in debugging mode. */ void gcry_set_progress_handler (void (*cb)(void *,const char*,int, int, int), void *cb_data) { #if USE_DSA _gcry_register_pk_dsa_progress (cb, cb_data); #endif #if USE_ELGAMAL _gcry_register_pk_elg_progress (cb, cb_data); #endif _gcry_register_primegen_progress (cb, cb_data); _gcry_register_random_progress (cb, cb_data); } diff --git a/tests/ChangeLog b/tests/ChangeLog index ff5d0b45..2eb61fd1 100644 --- a/tests/ChangeLog +++ b/tests/ChangeLog @@ -1,650 +1,655 @@ +2008-10-24 Werner Koch + + * benchmark.c (md_bench): Do not test MD5 in fips mode. + * basic.c (check_digests, check_hmac): Ditto. + 2008-10-06 Werner Koch * cavs_driver.pl: New version from upstream. (libgcrypt_rsa_verify($$$$)): Pass pkcs1. (libgcrypt_rsa_sign($$$)): Pass pkcs1 and hash algo. * fipsdrv.c (run_rsa_sign): Hash data in pkcs1 mode. (run_rsa_verify): Ditto. (read_key_file): Rename to read_private_key_file. Factor public key code out to.. (read_public_key_file): .. new. 2008-10-02 Werner Koch * fipsdrv.c (print_buffer): Add base64 printing code. (base64_decode, read_key_file, parse_tag, read_sig_file): New. (run_rsa_gen, run_rsa_sign): New. (main): Add modes rsa-gen, rsa-sign and rsa-verify. 2008-09-29 Werner Koch * fipsdrv.c: Merge code from fipsrngdrv.c * fipsrngdrv.c: Remove. 2008-09-26 Werner Koch * Makefile.am: Distribute cavs_driver.pl. * cavs_tests.sh: New. * fipsdrv.c: New. 2008-09-18 Werner Koch * benchmark.c (main): Do not disable secure memory in FIPS mode. 2008-09-18 Werner Koch * basic.c (main): Do not disable secure memory in FIPS mode. 2008-09-16 Werner Koch * fipsrngdrv.c (main): Bail out on write error. Implement verbose option. (main): Use flag to disable dup block checks. 2008-09-15 Werner Koch * fipsrngdrv.c: New. 2008-09-09 Werner Koch * basic.c (main): New option --selftest. 2008-08-29 Werner Koch * keygrip.c: Update to also check ECDSA. 2008-08-28 Werner Koch * rsa-16k.key: New sample key. 2008-08-27 Werner Koch * pkbench.c (read_file): New. (process_key_pair_file): Replace mmap by read_file. (main): Add a --fips option. * Makefile.am (EXTRA_DIST): Remove. (EXTRA_PROGRAMS): Add pkbench. * basic.c (main): Extended FIPS self-test test. 2008-08-26 Werner Koch * basic.c (get_keys_new): Use transient-key flag. * benchmark.c (main): First check options then do the libgcrypt initialization. (rsa_bench): Use transient-key flag if not in fips mode. 2008-08-20 Werner Koch * t-mpi-bit.c (test_lshift): New. (mpi2bitstr_nlz, lshiftbitstring): New. (main): Run test. 2008-08-18 Werner Koch * basic.c (main): Add option --fips. 2008-08-15 Werner Koch * register.c (main): Check for fips mode. (check_run): Take care of fips mode. * basic.c (check_cbc_mac_cipher, check_ciphers, check_digests) (check_hmac, check_pubkey): Do not test unavalaible algorithms in fips mode. (main): Check for fips mode. 2008-04-22 Werner Koch * basic.c (check_one_cipher): Also check in-place encryption. 2008-03-17 Werner Koch * benchmark.c (main): Add option --cipher-repetition. (cipher_bench): Use it. 2008-03-12 Werner Koch * benchmark.c (rsa_bench): Add arg NO_BLINDING. (main): Add option --no-blinding. 2007-12-05 Werner Koch * pubkey.c (sample_private_key_1_1,sample_private_key_1_2): New. (get_keys_sample): Add arg SECRET_VARIANT. (check_run): Check all variants. Also check gcry_pk_testkey. (check_keys_crypt): Add DECRYPT_FAIL_CODE. (check_keys): Ditto. 2007-11-30 Werner Koch * benchmark.c (main): Add optione --verbose and reworked the option parsing. (random_bench): Dump random stats. 2007-10-31 Werner Koch * benchmark.c (start_timer, stop_timer, elapsed_time) [W32]: Fixed. 2007-06-20 Werner Koch * benchmark.c (rsa_bench): New. (main): New command "rsa". 2007-05-03 Werner Koch * Makefile.am (EXTRA_DIST): Do not build pkbench.c 2007-05-02 David Shaw * basic.c (check_ciphers): Add Camellia. 2007-04-30 David Shaw * basic.c (check_ciphers): #if out ciphers we don't have. Add test for GCRY_CIPHER_RFC2268_40. 2007-04-30 Werner Koch * version.c: New. * Makefile.am (TESTS): Add version. 2007-04-30 Marcus Brinkmann * benchmark.c (ecc_bench): Release KEY_SPEC. 2007-04-28 Marcus Brinkmann * ac-data.c (check_run): Don't give redundant GCRY_AC_FLAG_DEALLOC in addition to GCRY_AC_FLAG_COPY. Don't release LABEL1 or MPI0, as those are donated to libgcrypt, but do release MPI0 and MPI2. 2007-04-12 Marcus Brinkmann * ac-schemes.c (scheme_spec): Revert last change. * ac-schemes.c (scheme_spec): Remove const qualifier from member M. (es_check): Remove const qualifier from C and M2. 2007-03-28 Werner Koch * pkbench.c (generate_key): Support named curves. * benchmark.c (dsa_bench): New args ITERATIONS and PRINT_HEADER. (main): Call dsa and ecc benchs. (show_sexp): New. * Makefile.am (TESTS): Move pkbench to EXTRA_PROGRAMS. 2007-03-22 Werner Koch * benchmark.c (die): New. (ecc_bench): New. * pkbench.c (main): Reworked to provide proper option handling. 2007-03-13 Werner Koch * mpitests.c: Reformatted to GNU standards. (main): Add options --verbose and --debug for future use. 2007-03-13 Werner Dittmann (wk) * mpitests.c: New. 2007-02-23 Werner Koch * Makefile.am (TEST): Run benchmark as last. * ac-data.c (check_sexp_conversion): Print label only in verbose mode. * pubkey.c (main): Run test just 2 times instead of 10. (get_elg_key_new): New. (check_run): Also run tests with Elgamal keys. (check_keys): New arg NBITS_DATA. (get_elg_key_new): Use only 400 for the 512 bit Elgamal test. * random.c: New. 2007-02-22 Werner Koch * basic.c (check_pubkey_sign): Also try signing using an OID. * Makefile.am (TESTS) [W32]: Removed pkbench for now. * pkbench.c (benchmark): Fixed for W32. 2007-02-21 Werner Koch * hmac.c (check_one_mac): Make pointer args const. * basic.c (check_one_md): Ditto. (check_one_hmac): Ditto. * keygen.c (progress_cb): Filter out line feeds. * basic.c (progress_handler): Ditto. 2006-12-18 Werner Koch * Makefile.am (AM_CFLAGS, AM_CPPFLAGS): Splitted and merged with Moritz' changes. (INCLUDES): Removed. * keygen.c (progress_handler): New. (main): Use it in verbose mode. 2006-11-05 Moritz Schulte * Makefile.am (AM_CFLAGS): Added -I$(top_builddir)/src so that the new gcrypt.h is used, not the one installed in the system. 2006-10-17 Werner Koch * keygen.c (check_rsa_keys): Also create an 1536 bit DSA key. 2006-08-03 Werner Koch * t-mpi-bit.c: New. 2006-07-06 Werner Koch * benchmark.c (main): New option --use-random-daemon. New command strongrandom. (random_bench): New arg VERY_STRONG. 2006-03-14 Werner Koch * benchmark.c (main): Allow for seed file argument to random bench. * basic.c (main): Use progress handler only in verbose mode. (main): Speed up test key generation. * ac-data.c (check_sexp_conversion, check_run): Take care of VERBOSE. * ac.c (main): Ditto. * pubkey.c (main): Ditto. * pkbench.c (main): Ditto. * keygen.c (main): Ditto. (check_rsa_keys): Print key only in verbose mode. 2006-03-10 Brad Hards (wk, patch 2006-02-18) * basic.c (check_one_hmac, check_hmac): New. 2006-03-07 Werner Koch * benchmark.c (cipher_bench): Add OFB mode. 2006-01-18 Brad Hards (wk 2006-03-07) * basic.c: Added test cases for OFB and CFB modes. Fixed some compiler warnings for signedness. 2005-11-12 Moritz Schulte * ac-data.c: Added way more test cases. 2005-09-15 Moritz Schulte * Makefile.am (TESTS): Added keygrip. * keygrip.c: New. 2005-09-19 Werner Koch * benchmark.c (dsa_bench): New. 2005-08-19 Werner Koch * hmac.c (main): Added all FIPS tests. 2005-08-18 Werner Koch * hmac.c: New. 2005-04-22 Moritz Schulte * tsexp.c: Include in case HAVE_CONFIG_H is defined; thanks to Albert Chin. * testapi.c: Likewise. * register.c: Likewise. * pubkey.c: Likewise. * prime.c: Likewise. * pkbench.c: Likewise. * keygen.c: Likewise. * benchmark.c: Likewise. * basic.c: Likewise. * ac-schemes.c: Likewise. * ac-data.c: Likewise. * ac.c: Likewise. 2005-04-16 Moritz Schulte * ac-data.c (check_run): Include new test. 2005-04-11 Moritz Schulte * basic.c (check_digests): Add tests for Whirlpool. 2005-03-30 Moritz Schulte * ac-schemes.c: New file. * ac-data.c: New file. * Makefile.am (TESTS): Added ac-schemes and ac-data. 2004-09-15 Moritz Schulte * pkbench.c: Include . 2004-08-24 Moritz Schulte * pkbench.c (context_init): Improve generation of test data. 2004-08-23 Moritz Schulte * Makefile.am (TESTS): Added: pkbench. * pkbench.c: New file. 2004-02-25 Werner Koch * Makefile.am (TEST): Add benchmark. * benchmark.c (md_bench, cipher_bench): Allow NULL arg to to run tests for all algorithms. (main): Run all tests by default. 2004-02-03 Werner Koch * tsexp.c (basic): New pass to check secure memory switching. 2004-01-12 Moritz Schulte * ac.c (check_one): Adjust to new ac API. 2003-11-22 Werner Koch * pubkey.c (check_keys_crypt): Fixed my last patch. 2003-11-11 Werner Koch * tsexp.c (basic): Add pass structure and a test for the %b format. 2003-11-04 Werner Koch * Makefile.am (noinst_PROGRAMS): Use this so that test programs get always build. * keygen.c (check_nonce): New. (main): Add a basic check for the nocen function. 2003-10-31 Werner Koch * basic.c (check_aes128_cbc_cts_cipher): Make it a prototype * ac.c (check_run): Comment unused variable. 2003-10-10 Werner Koch * prime.c (check_primes): Generate a generator and avoid printing unless in verbose mode. 2003-10-07 Werner Koch * tsexp.c (check_sscan): New. 2003-09-04 Werner Koch * pubkey.c (check_keys_crypt): Fix for compatibility mode. 2003-09-02 Moritz Schulte * Makefile.am (TESTS): Added: prime. * prime.c: New file. 2003-08-27 Moritz Schulte * basic.c (check_ciphers): Added: Serpent. Write braces around flags. 2003-08-04 Moritz Schulte * benchmark.c (do_powm): Adjust for new gcry_mpi_scan interface. 2003-07-23 Moritz Schulte * ac.c (key_copy): New function... (check_one): ... use it. 2003-07-22 Moritz Schulte * basic.c (check_ciphers): Use gcry_cipher_map_name. 2003-07-18 Moritz Schulte * ac.c (check_run): Renamed to ... (check_one): ... this, changed calling interface. (check_run): New function. * register.c: Adjust gcry_cipher_spec_t structure. 2003-07-14 Moritz Schulte * register.c: Adjust cipher specification structure. * benchmark.c: New file. * testapi.c: New file. * Makefile.am (EXTRA_PROGRAMS): Set to: benchmark testapi. (check_PROGRAMS): Set to: $(TESTS). 2003-07-12 Moritz Schulte * ac.c, basic.c, keygen.c, register.c, sexp.c, tsexp.c: Used gcry_err* wrappers for libgpg symbols. * basic.c (check_ciphers): Added: GCRY_CIPHER_TWOFISH128. 2003-07-08 Moritz Schulte * Makefile.am (LIBS): Remove: -lpthread. * basic.c (check_one_cipher): Fix variable initialization. Thanks to Simon Joseffson . 2003-07-07 Moritz Schulte * Makefile.am (TESTS): Added: register. 2003-07-05 Moritz Schulte * register.c (check_run): Adjusted for new gcry_cipher_register API. 2003-07-02 Moritz Schulte * Makefile.am (TESTS): Added: ac. * ac.c: New file. 2003-06-18 Werner Koch * basic.c (check_cbc_mac_cipher): Adjusted for new API of get_blklen and get_keylen. (check_ctr_cipher): Ditto. (check_one_cipher): Ditto. (check_one_md): Adjusted for new API of gcry_md_copy. 2003-06-18 Moritz Schulte * register.c: Replace old type GcryModule with newer one: gcry_module_t. Adjusted for new API. * Makefile.am (AM_CFLAGS): Added: @GPG_ERROR_CFLAGS@. 2003-06-15 Moritz Schulte * basic.c (get_keys_new): New function. (do_check_one_pubkey): New function ... (check_one_pubkey): ... use it. (progress_handler): New function. (main): Use gcry_set_progress_handler. 2003-06-14 Moritz Schulte * basic.c: Replaced calls to gcry_strerror with calls to gpg_strerror. (check_one_md): Adjust for new gcry_md_copy API. * tsexp.c: Likewise. * keygen.c: Likewise. 2003-06-12 Moritz Schulte * basic.c: Changed here and there, reorganized pubkey checks, added DSA and ELG keys. 2003-06-09 Moritz Schulte * basic.c, keygen.c, pubkey.c, register.c, tsexp.c: Changed to use new API. 2003-06-01 Moritz Schulte * tsexp.c (canon_len): Adjust for new gcry_sexp_canon_len API. 2003-05-26 Moritz Schulte * basic.c (verify_one_signature): Adjust for libgpg-error. (check_pubkey_sign): Likewise. (check_pubkey): Likewise. * basic.c (check_pubkey_sign): Likewise. * tsexp.c (canon_len): Likewise. (back_and_forth_one): Likewise. 2003-04-27 Moritz Schulte * pubkey.c: Changed the sample private key to contain the identifier `openpgp-rsa' instead of `rsa'. * basic.c (check_digests): Enabled/fixed some tests for TIGER. 2003-04-17 Moritz Schulte * Makefile.am (TESTS): Removed `register' for now. 2003-04-17 Moritz Schulte * basic.c (check_digests): Include checks for SHA512 and SHA384. 2003-04-16 Moritz Schulte * basic.c (check_one_md): Also test md_copy. 2003-04-07 Moritz Schulte * Makefile.am (TESTS): Added register. * register.c: New file. 2003-03-30 Simon Josefsson * basic.c (check_one_cipher): New. Test CTR. (main): Call it. (check_ciphers): Check CTR mode. 2003-03-26 Moritz Schulte * Makefile.am (TESTS): Added pubkey. * pubkey.c: New file. 2003-03-22 Simon Josefsson * basic.c (check_cbc_mac_cipher): New. (main): Use it. 2003-03-19 Werner Koch * keygen.c (check_rsa_keys): Don't expect an exponent when asking for e=0. (check_generated_rsa_key): Just print exponent if EXPECTED_E is 0. 2003-03-02 Moritz Schulte * basic.c (check_one_cipher): Use gcry_cipher_reset() instead of gcry_cipher_close(), gcry_cipher_open and gcry_cipher_setkey(). 2003-01-23 Werner Koch * keygen.c: New. 2003-01-20 Simon Josefsson * basic.c (check_digests): Add CRC. (check_one_md): Print computed and expected values on error. 2003-01-20 Werner Koch * basic.c (check_one_md): Kludge to check a one million "a". (check_digests): Add checks for SHA-256. 2003-01-20 Werner Koch * basic.c (check_pubkey): Check the keygrip for the sample key. 2003-01-15 Werner Koch * basic.c (verify_one_signature,check_pubkey_sign) (check_pubkey): New. (main): Check public key functions. Add a --debug option. 2002-11-23 Werner Koch * basic.c (check_digests): Add another test for MD4. By Simon Josefsson. 2002-11-10 Simon Josefsson * basic.c (check_aes128_cbc_cts_cipher): New function. (check_one_cipher): Add flags parameter. (check_ciphers): Support flags parameter. (main): Check CTS. 2002-11-10 Werner Koch * basic.c (check_one_md): New. By Simon Josefsson. (check_digests): New tests for MD4. By Simon. 2002-08-26 Werner Koch * basic.c (check_ciphers): Check simple DES. 2002-05-16 Werner Koch * tsexp.c (back_and_forth): Very minimal test of the new functions. 2002-05-14 Werner Koch Changed license of all files to the LGPL. 2002-05-02 Werner Koch * basic.c: Add option --verbose. 2002-01-11 Werner Koch * tsexp.c (canon_len): Fixed tests. 2001-12-18 Werner Koch * tsexp.c: New. Copyright 2001, 2002, 2003, 2008 Free Software Foundation, Inc. This file is free software; as a special exception the author gives unlimited permission to copy and/or distribute it, with or without modifications, as long as this notice is preserved. This file is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY, to the extent permitted by law; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. diff --git a/tests/basic.c b/tests/basic.c index b735e0f1..0d489994 100644 --- a/tests/basic.c +++ b/tests/basic.c @@ -1,2174 +1,2180 @@ /* basic.c - basic regression tests * Copyright (C) 2001, 2002, 2003, 2005, 2008 Free Software Foundation, Inc. * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ #ifdef HAVE_CONFIG_H #include #endif #include #include #include #include #include "../src/gcrypt.h" typedef struct test_spec_pubkey_key { const char *secret; const char *public; const char *grip; } test_spec_pubkey_key_t; typedef struct test_spec_pubkey { int id; int flags; test_spec_pubkey_key_t key; } test_spec_pubkey_t; #define FLAG_CRYPT (1 << 0) #define FLAG_SIGN (1 << 1) #define FLAG_GRIP (1 << 2) static int verbose; static int error_count; static int in_fips_mode; static void fail (const char *format, ...) { va_list arg_ptr; va_start (arg_ptr, format); vfprintf (stderr, format, arg_ptr); va_end (arg_ptr); error_count++; } static void die (const char *format, ...) { va_list arg_ptr; va_start (arg_ptr, format); vfprintf (stderr, format, arg_ptr); va_end (arg_ptr); exit (1); } #define MAX_DATA_LEN 100 void progress_handler (void *cb_data, const char *what, int printchar, int current, int total) { (void)cb_data; (void)what; (void)current; (void)total; if (printchar == '\n') fputs ( "", stdout); else putchar (printchar); fflush (stdout); } static void check_cbc_mac_cipher (void) { struct tv { int algo; char key[MAX_DATA_LEN]; unsigned char plaintext[MAX_DATA_LEN]; size_t plaintextlen; char mac[MAX_DATA_LEN]; } tv[] = { { GCRY_CIPHER_AES, "chicken teriyaki", "This is a sample plaintext for CBC MAC of sixtyfour bytes.......", 0, "\x23\x8f\x6d\xc7\x53\x6a\x62\x97\x11\xc4\xa5\x16\x43\xea\xb0\xb6" }, { GCRY_CIPHER_3DES, "abcdefghABCDEFGH01234567", "This is a sample plaintext for CBC MAC of sixtyfour bytes.......", 0, "\x5c\x11\xf0\x01\x47\xbd\x3d\x3a" }, { GCRY_CIPHER_DES, "abcdefgh", "This is a sample plaintext for CBC MAC of sixtyfour bytes.......", 0, "\xfa\x4b\xdf\x9d\xfa\xab\x01\x70" } }; gcry_cipher_hd_t hd; unsigned char out[MAX_DATA_LEN]; int i, blklen, keylen; gcry_error_t err = 0; if (verbose) fprintf (stderr, "Starting CBC MAC checks.\n"); for (i = 0; i < sizeof (tv) / sizeof (tv[0]); i++) { if (gcry_cipher_test_algo (tv[i].algo) && in_fips_mode) { if (verbose) fprintf (stderr, " algorithm %d not available in fips mode\n", tv[i].algo); continue; } err = gcry_cipher_open (&hd, tv[i].algo, GCRY_CIPHER_MODE_CBC, GCRY_CIPHER_CBC_MAC); if (!hd) { fail ("cbc-mac algo %d, grcy_open_cipher failed: %s\n", tv[i].algo, gpg_strerror (err)); return; } blklen = gcry_cipher_get_algo_blklen(tv[i].algo); if (!blklen) { fail ("cbc-mac algo %d, gcry_cipher_get_algo_blklen failed\n", tv[i].algo); gcry_cipher_close (hd); return; } keylen = gcry_cipher_get_algo_keylen (tv[i].algo); if (!keylen) { fail ("cbc-mac algo %d, gcry_cipher_get_algo_keylen failed\n", tv[i].algo); return; } err = gcry_cipher_setkey (hd, tv[i].key, keylen); if (err) { fail ("cbc-mac algo %d, gcry_cipher_setkey failed: %s\n", tv[i].algo, gpg_strerror (err)); gcry_cipher_close (hd); return; } err = gcry_cipher_setiv (hd, NULL, 0); if (err) { fail ("cbc-mac algo %d, gcry_cipher_setiv failed: %s\n", tv[i].algo, gpg_strerror (err)); gcry_cipher_close (hd); return; } if (verbose) fprintf (stderr, " checking CBC MAC for %s [%i]\n", gcry_cipher_algo_name (tv[i].algo), tv[i].algo); err = gcry_cipher_encrypt (hd, out, blklen, tv[i].plaintext, tv[i].plaintextlen ? tv[i].plaintextlen : strlen ((char*)tv[i].plaintext)); if (err) { fail ("cbc-mac algo %d, gcry_cipher_encrypt failed: %s\n", tv[i].algo, gpg_strerror (err)); gcry_cipher_close (hd); return; } #if 0 { int j; for (j = 0; j < gcry_cipher_get_algo_blklen (tv[i].algo); j++) printf ("\\x%02x", out[j] & 0xFF); printf ("\n"); } #endif if (memcmp (tv[i].mac, out, blklen)) fail ("cbc-mac algo %d, encrypt mismatch entry %d\n", tv[i].algo, i); gcry_cipher_close (hd); } if (verbose) fprintf (stderr, "Completed CBC MAC checks.\n"); } static void check_aes128_cbc_cts_cipher (void) { char key[128 / 8] = "chicken teriyaki"; unsigned char plaintext[] = "I would like the General Gau's Chicken, please, and wonton soup."; struct tv { unsigned char out[MAX_DATA_LEN]; int inlen; } tv[] = { { "\xc6\x35\x35\x68\xf2\xbf\x8c\xb4\xd8\xa5\x80\x36\x2d\xa7\xff\x7f" "\x97", 17 }, { "\xfc\x00\x78\x3e\x0e\xfd\xb2\xc1\xd4\x45\xd4\xc8\xef\xf7\xed\x22" "\x97\x68\x72\x68\xd6\xec\xcc\xc0\xc0\x7b\x25\xe2\x5e\xcf\xe5", 31 }, { "\x39\x31\x25\x23\xa7\x86\x62\xd5\xbe\x7f\xcb\xcc\x98\xeb\xf5\xa8" "\x97\x68\x72\x68\xd6\xec\xcc\xc0\xc0\x7b\x25\xe2\x5e\xcf\xe5\x84", 32 }, { "\x97\x68\x72\x68\xd6\xec\xcc\xc0\xc0\x7b\x25\xe2\x5e\xcf\xe5\x84" "\xb3\xff\xfd\x94\x0c\x16\xa1\x8c\x1b\x55\x49\xd2\xf8\x38\x02\x9e" "\x39\x31\x25\x23\xa7\x86\x62\xd5\xbe\x7f\xcb\xcc\x98\xeb\xf5", 47 }, { "\x97\x68\x72\x68\xd6\xec\xcc\xc0\xc0\x7b\x25\xe2\x5e\xcf\xe5\x84" "\x9d\xad\x8b\xbb\x96\xc4\xcd\xc0\x3b\xc1\x03\xe1\xa1\x94\xbb\xd8" "\x39\x31\x25\x23\xa7\x86\x62\xd5\xbe\x7f\xcb\xcc\x98\xeb\xf5\xa8", 48 }, { "\x97\x68\x72\x68\xd6\xec\xcc\xc0\xc0\x7b\x25\xe2\x5e\xcf\xe5\x84" "\x39\x31\x25\x23\xa7\x86\x62\xd5\xbe\x7f\xcb\xcc\x98\xeb\xf5\xa8" "\x48\x07\xef\xe8\x36\xee\x89\xa5\x26\x73\x0d\xbc\x2f\x7b\xc8\x40" "\x9d\xad\x8b\xbb\x96\xc4\xcd\xc0\x3b\xc1\x03\xe1\xa1\x94\xbb\xd8", 64 }, }; gcry_cipher_hd_t hd; unsigned char out[MAX_DATA_LEN]; int i; gcry_error_t err = 0; if (verbose) fprintf (stderr, "Starting AES128 CBC CTS checks.\n"); err = gcry_cipher_open (&hd, GCRY_CIPHER_AES, GCRY_CIPHER_MODE_CBC, GCRY_CIPHER_CBC_CTS); if (err) { fail ("aes-cbc-cts, grcy_open_cipher failed: %s\n", gpg_strerror (err)); return; } err = gcry_cipher_setkey (hd, key, 128 / 8); if (err) { fail ("aes-cbc-cts, gcry_cipher_setkey failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hd); return; } for (i = 0; i < sizeof (tv) / sizeof (tv[0]); i++) { err = gcry_cipher_setiv (hd, NULL, 0); if (err) { fail ("aes-cbc-cts, gcry_cipher_setiv failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hd); return; } if (verbose) fprintf (stderr, " checking encryption for length %i\n", tv[i].inlen); err = gcry_cipher_encrypt (hd, out, MAX_DATA_LEN, plaintext, tv[i].inlen); if (err) { fail ("aes-cbc-cts, gcry_cipher_encrypt failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hd); return; } if (memcmp (tv[i].out, out, tv[i].inlen)) fail ("aes-cbc-cts, encrypt mismatch entry %d\n", i); err = gcry_cipher_setiv (hd, NULL, 0); if (err) { fail ("aes-cbc-cts, gcry_cipher_setiv failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hd); return; } if (verbose) fprintf (stderr, " checking decryption for length %i\n", tv[i].inlen); err = gcry_cipher_decrypt (hd, out, tv[i].inlen, NULL, 0); if (err) { fail ("aes-cbc-cts, gcry_cipher_decrypt failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hd); return; } if (memcmp (plaintext, out, tv[i].inlen)) fail ("aes-cbc-cts, decrypt mismatch entry %d\n", i); } gcry_cipher_close (hd); if (verbose) fprintf (stderr, "Completed AES128 CBC CTS checks.\n"); } static void check_ctr_cipher (void) { struct tv { int algo; char key[MAX_DATA_LEN]; char ctr[MAX_DATA_LEN]; struct data { unsigned char plaintext[MAX_DATA_LEN]; int inlen; char out[MAX_DATA_LEN]; } data[MAX_DATA_LEN]; } tv[] = { /* http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf */ { GCRY_CIPHER_AES, "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c", "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff", { { "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a", 16, "\x87\x4d\x61\x91\xb6\x20\xe3\x26\x1b\xef\x68\x64\x99\x0d\xb6\xce" }, { "\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e\x51", 16, "\x98\x06\xf6\x6b\x79\x70\xfd\xff\x86\x17\x18\x7b\xb9\xff\xfd\xff" }, { "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef", 16, "\x5a\xe4\xdf\x3e\xdb\xd5\xd3\x5e\x5b\x4f\x09\x02\x0d\xb0\x3e\xab" }, { "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10", 16, "\x1e\x03\x1d\xda\x2f\xbe\x03\xd1\x79\x21\x70\xa0\xf3\x00\x9c\xee" }, } }, { GCRY_CIPHER_AES192, "\x8e\x73\xb0\xf7\xda\x0e\x64\x52\xc8\x10\xf3\x2b" "\x80\x90\x79\xe5\x62\xf8\xea\xd2\x52\x2c\x6b\x7b", "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff", { { "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a", 16, "\x1a\xbc\x93\x24\x17\x52\x1c\xa2\x4f\x2b\x04\x59\xfe\x7e\x6e\x0b" }, { "\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e\x51", 16, "\x09\x03\x39\xec\x0a\xa6\xfa\xef\xd5\xcc\xc2\xc6\xf4\xce\x8e\x94" }, { "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef", 16, "\x1e\x36\xb2\x6b\xd1\xeb\xc6\x70\xd1\xbd\x1d\x66\x56\x20\xab\xf7" }, { "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10", 16, "\x4f\x78\xa7\xf6\xd2\x98\x09\x58\x5a\x97\xda\xec\x58\xc6\xb0\x50" }, } }, { GCRY_CIPHER_AES256, "\x60\x3d\xeb\x10\x15\xca\x71\xbe\x2b\x73\xae\xf0\x85\x7d\x77\x81" "\x1f\x35\x2c\x07\x3b\x61\x08\xd7\x2d\x98\x10\xa3\x09\x14\xdf\xf4", "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff", { { "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a", 16, "\x60\x1e\xc3\x13\x77\x57\x89\xa5\xb7\xa7\xf5\x04\xbb\xf3\xd2\x28" }, { "\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e\x51", 16, "\xf4\x43\xe3\xca\x4d\x62\xb5\x9a\xca\x84\xe9\x90\xca\xca\xf5\xc5" }, { "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef", 16, "\x2b\x09\x30\xda\xa2\x3d\xe9\x4c\xe8\x70\x17\xba\x2d\x84\x98\x8d" }, { "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10", 16, "\xdf\xc9\xc5\x8d\xb6\x7a\xad\xa6\x13\xc2\xdd\x08\x45\x79\x41\xa6" } } } }; gcry_cipher_hd_t hde, hdd; unsigned char out[MAX_DATA_LEN]; int i, j, keylen, blklen; gcry_error_t err = 0; if (verbose) fprintf (stderr, "Starting CTR cipher checks.\n"); for (i = 0; i < sizeof (tv) / sizeof (tv[0]); i++) { err = gcry_cipher_open (&hde, tv[i].algo, GCRY_CIPHER_MODE_CTR, 0); if (!err) err = gcry_cipher_open (&hdd, tv[i].algo, GCRY_CIPHER_MODE_CTR, 0); if (err) { fail ("aes-ctr, grcy_open_cipher failed: %s\n", gpg_strerror (err)); return; } keylen = gcry_cipher_get_algo_keylen(tv[i].algo); if (!keylen) { fail ("aes-ctr, gcry_cipher_get_algo_keylen failed\n"); return; } err = gcry_cipher_setkey (hde, tv[i].key, keylen); if (!err) err = gcry_cipher_setkey (hdd, tv[i].key, keylen); if (err) { fail ("aes-ctr, gcry_cipher_setkey failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } blklen = gcry_cipher_get_algo_blklen(tv[i].algo); if (!blklen) { fail ("aes-ctr, gcry_cipher_get_algo_blklen failed\n"); return; } err = gcry_cipher_setctr (hde, tv[i].ctr, blklen); if (!err) err = gcry_cipher_setctr (hdd, tv[i].ctr, blklen); if (err) { fail ("aes-ctr, gcry_cipher_setctr failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } if (verbose) fprintf (stderr, " checking CTR mode for for %s [%i]\n", gcry_cipher_algo_name (tv[i].algo), tv[i].algo); for (j = 0; tv[i].data[j].inlen; j++) { err = gcry_cipher_encrypt (hde, out, MAX_DATA_LEN, tv[i].data[j].plaintext, tv[i].data[j].inlen == -1 ? strlen ((char*)tv[i].data[j].plaintext) : tv[i].data[j].inlen); if (err) { fail ("aes-ctr, gcry_cipher_encrypt (%d, %d) failed: %s\n", i, j, gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } if (memcmp (tv[i].data[j].out, out, tv[i].data[j].inlen)) fail ("aes-ctr, encrypt mismatch entry %d:%d\n", i, j); err = gcry_cipher_decrypt (hdd, out, tv[i].data[j].inlen, NULL, 0); if (err) { fail ("aes-ctr, gcry_cipher_decrypt (%d, %d) failed: %s\n", i, j, gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } if (memcmp (tv[i].data[j].plaintext, out, tv[i].data[j].inlen)) fail ("aes-ctr, decrypt mismatch entry %d:%d\n", i, j); } gcry_cipher_close (hde); gcry_cipher_close (hdd); } if (verbose) fprintf (stderr, "Completed CTR cipher checks.\n"); } static void check_cfb_cipher (void) { struct tv { int algo; char key[MAX_DATA_LEN]; char iv[MAX_DATA_LEN]; struct data { unsigned char plaintext[MAX_DATA_LEN]; int inlen; char out[MAX_DATA_LEN]; } data[MAX_DATA_LEN]; } tv[] = { /* http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf */ { GCRY_CIPHER_AES, "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c", "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f", { { "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a", 16, "\x3b\x3f\xd9\x2e\xb7\x2d\xad\x20\x33\x34\x49\xf8\xe8\x3c\xfb\x4a" }, { "\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e\x51", 16, "\xc8\xa6\x45\x37\xa0\xb3\xa9\x3f\xcd\xe3\xcd\xad\x9f\x1c\xe5\x8b"}, { "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef", 16, "\x26\x75\x1f\x67\xa3\xcb\xb1\x40\xb1\x80\x8c\xf1\x87\xa4\xf4\xdf" }, { "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10", 16, "\xc0\x4b\x05\x35\x7c\x5d\x1c\x0e\xea\xc4\xc6\x6f\x9f\xf7\xf2\xe6" }, } }, { GCRY_CIPHER_AES192, "\x8e\x73\xb0\xf7\xda\x0e\x64\x52\xc8\x10\xf3\x2b" "\x80\x90\x79\xe5\x62\xf8\xea\xd2\x52\x2c\x6b\x7b", "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f", { { "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a", 16, "\xcd\xc8\x0d\x6f\xdd\xf1\x8c\xab\x34\xc2\x59\x09\xc9\x9a\x41\x74" }, { "\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e\x51", 16, "\x67\xce\x7f\x7f\x81\x17\x36\x21\x96\x1a\x2b\x70\x17\x1d\x3d\x7a" }, { "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef", 16, "\x2e\x1e\x8a\x1d\xd5\x9b\x88\xb1\xc8\xe6\x0f\xed\x1e\xfa\xc4\xc9" }, { "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10", 16, "\xc0\x5f\x9f\x9c\xa9\x83\x4f\xa0\x42\xae\x8f\xba\x58\x4b\x09\xff" }, } }, { GCRY_CIPHER_AES256, "\x60\x3d\xeb\x10\x15\xca\x71\xbe\x2b\x73\xae\xf0\x85\x7d\x77\x81" "\x1f\x35\x2c\x07\x3b\x61\x08\xd7\x2d\x98\x10\xa3\x09\x14\xdf\xf4", "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f", { { "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a", 16, "\xdc\x7e\x84\xbf\xda\x79\x16\x4b\x7e\xcd\x84\x86\x98\x5d\x38\x60" }, { "\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e\x51", 16, "\x39\xff\xed\x14\x3b\x28\xb1\xc8\x32\x11\x3c\x63\x31\xe5\x40\x7b" }, { "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef", 16, "\xdf\x10\x13\x24\x15\xe5\x4b\x92\xa1\x3e\xd0\xa8\x26\x7a\xe2\xf9" }, { "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10", 16, "\x75\xa3\x85\x74\x1a\xb9\xce\xf8\x20\x31\x62\x3d\x55\xb1\xe4\x71" } } } }; gcry_cipher_hd_t hde, hdd; unsigned char out[MAX_DATA_LEN]; int i, j, keylen, blklen; gcry_error_t err = 0; for (i = 0; i < sizeof (tv) / sizeof (tv[0]); i++) { err = gcry_cipher_open (&hde, tv[i].algo, GCRY_CIPHER_MODE_CFB, 0); if (!err) err = gcry_cipher_open (&hdd, tv[i].algo, GCRY_CIPHER_MODE_CFB, 0); if (err) { fail ("aes-cfb, grcy_open_cipher failed: %s\n", gpg_strerror (err)); return; } keylen = gcry_cipher_get_algo_keylen(tv[i].algo); if (!keylen) { fail ("aes-cfb, gcry_cipher_get_algo_keylen failed\n"); return; } err = gcry_cipher_setkey (hde, tv[i].key, keylen); if (!err) err = gcry_cipher_setkey (hdd, tv[i].key, keylen); if (err) { fail ("aes-cfb, gcry_cipher_setkey failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } blklen = gcry_cipher_get_algo_blklen(tv[i].algo); if (!blklen) { fail ("aes-cfb, gcry_cipher_get_algo_blklen failed\n"); return; } err = gcry_cipher_setiv (hde, tv[i].iv, blklen); if (!err) err = gcry_cipher_setiv (hdd, tv[i].iv, blklen); if (err) { fail ("aes-cfb, gcry_cipher_setiv failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } for (j = 0; tv[i].data[j].inlen; j++) { err = gcry_cipher_encrypt (hde, out, MAX_DATA_LEN, tv[i].data[j].plaintext, tv[i].data[j].inlen); if (err) { fail ("aes-cfb, gcry_cipher_encrypt (%d, %d) failed: %s\n", i, j, gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } if (memcmp (tv[i].data[j].out, out, tv[i].data[j].inlen)) { fail ("aes-cfb, encrypt mismatch entry %d:%d\n", i, j); } err = gcry_cipher_decrypt (hdd, out, tv[i].data[j].inlen, NULL, 0); if (err) { fail ("aes-cfb, gcry_cipher_decrypt (%d, %d) failed: %s\n", i, j, gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } if (memcmp (tv[i].data[j].plaintext, out, tv[i].data[j].inlen)) fail ("aes-cfb, decrypt mismatch entry %d:%d\n", i, j); } gcry_cipher_close (hde); gcry_cipher_close (hdd); } } static void check_ofb_cipher (void) { struct tv { int algo; char key[MAX_DATA_LEN]; char iv[MAX_DATA_LEN]; struct data { unsigned char plaintext[MAX_DATA_LEN]; int inlen; char out[MAX_DATA_LEN]; } data[MAX_DATA_LEN]; } tv[] = { /* http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf */ { GCRY_CIPHER_AES, "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c", "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f", { { "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a", 16, "\x3b\x3f\xd9\x2e\xb7\x2d\xad\x20\x33\x34\x49\xf8\xe8\x3c\xfb\x4a" }, { "\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e\x51", 16, "\x77\x89\x50\x8d\x16\x91\x8f\x03\xf5\x3c\x52\xda\xc5\x4e\xd8\x25"}, { "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef", 16, "\x97\x40\x05\x1e\x9c\x5f\xec\xf6\x43\x44\xf7\xa8\x22\x60\xed\xcc" }, { "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10", 16, "\x30\x4c\x65\x28\xf6\x59\xc7\x78\x66\xa5\x10\xd9\xc1\xd6\xae\x5e" }, } }, { GCRY_CIPHER_AES192, "\x8e\x73\xb0\xf7\xda\x0e\x64\x52\xc8\x10\xf3\x2b" "\x80\x90\x79\xe5\x62\xf8\xea\xd2\x52\x2c\x6b\x7b", "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f", { { "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a", 16, "\xcd\xc8\x0d\x6f\xdd\xf1\x8c\xab\x34\xc2\x59\x09\xc9\x9a\x41\x74" }, { "\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e\x51", 16, "\xfc\xc2\x8b\x8d\x4c\x63\x83\x7c\x09\xe8\x17\x00\xc1\x10\x04\x01" }, { "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef", 16, "\x8d\x9a\x9a\xea\xc0\xf6\x59\x6f\x55\x9c\x6d\x4d\xaf\x59\xa5\xf2" }, { "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10", 16, "\x6d\x9f\x20\x08\x57\xca\x6c\x3e\x9c\xac\x52\x4b\xd9\xac\xc9\x2a" }, } }, { GCRY_CIPHER_AES256, "\x60\x3d\xeb\x10\x15\xca\x71\xbe\x2b\x73\xae\xf0\x85\x7d\x77\x81" "\x1f\x35\x2c\x07\x3b\x61\x08\xd7\x2d\x98\x10\xa3\x09\x14\xdf\xf4", "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f", { { "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a", 16, "\xdc\x7e\x84\xbf\xda\x79\x16\x4b\x7e\xcd\x84\x86\x98\x5d\x38\x60" }, { "\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e\x51", 16, "\x4f\xeb\xdc\x67\x40\xd2\x0b\x3a\xc8\x8f\x6a\xd8\x2a\x4f\xb0\x8d" }, { "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef", 16, "\x71\xab\x47\xa0\x86\xe8\x6e\xed\xf3\x9d\x1c\x5b\xba\x97\xc4\x08" }, { "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10", 16, "\x01\x26\x14\x1d\x67\xf3\x7b\xe8\x53\x8f\x5a\x8b\xe7\x40\xe4\x84" } } } }; gcry_cipher_hd_t hde, hdd; unsigned char out[MAX_DATA_LEN]; int i, j, keylen, blklen; gcry_error_t err = 0; for (i = 0; i < sizeof (tv) / sizeof (tv[0]); i++) { err = gcry_cipher_open (&hde, tv[i].algo, GCRY_CIPHER_MODE_OFB, 0); if (!err) err = gcry_cipher_open (&hdd, tv[i].algo, GCRY_CIPHER_MODE_OFB, 0); if (err) { fail ("aes-ofb, grcy_open_cipher failed: %s\n", gpg_strerror (err)); return; } keylen = gcry_cipher_get_algo_keylen(tv[i].algo); if (!keylen) { fail ("aes-ofb, gcry_cipher_get_algo_keylen failed\n"); return; } err = gcry_cipher_setkey (hde, tv[i].key, keylen); if (!err) err = gcry_cipher_setkey (hdd, tv[i].key, keylen); if (err) { fail ("aes-ofb, gcry_cipher_setkey failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } blklen = gcry_cipher_get_algo_blklen(tv[i].algo); if (!blklen) { fail ("aes-ofb, gcry_cipher_get_algo_blklen failed\n"); return; } err = gcry_cipher_setiv (hde, tv[i].iv, blklen); if (!err) err = gcry_cipher_setiv (hdd, tv[i].iv, blklen); if (err) { fail ("aes-ofb, gcry_cipher_setiv failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } for (j = 0; tv[i].data[j].inlen; j++) { err = gcry_cipher_encrypt (hde, out, MAX_DATA_LEN, tv[i].data[j].plaintext, tv[i].data[j].inlen); if (err) { fail ("aes-ofb, gcry_cipher_encrypt (%d, %d) failed: %s\n", i, j, gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } if (memcmp (tv[i].data[j].out, out, tv[i].data[j].inlen)) fail ("aes-ofb, encrypt mismatch entry %d:%d\n", i, j); err = gcry_cipher_decrypt (hdd, out, tv[i].data[j].inlen, NULL, 0); if (err) { fail ("aes-ofb, gcry_cipher_decrypt (%d, %d) failed: %s\n", i, j, gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } if (memcmp (tv[i].data[j].plaintext, out, tv[i].data[j].inlen)) fail ("aes-ofb, decrypt mismatch entry %d:%d\n", i, j); } err = gcry_cipher_reset(hde); if (!err) err = gcry_cipher_reset(hdd); if (err) { fail ("aes-ofb, gcry_cipher_reset (%d, %d) failed: %s\n", i, j, gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } /* gcry_cipher_reset clears the IV */ err = gcry_cipher_setiv (hde, tv[i].iv, blklen); if (!err) err = gcry_cipher_setiv (hdd, tv[i].iv, blklen); if (err) { fail ("aes-ofb, gcry_cipher_setiv failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } /* this time we encrypt and decrypt one byte at a time */ for (j = 0; tv[i].data[j].inlen; j++) { int byteNum; for (byteNum = 0; byteNum < tv[i].data[j].inlen; ++byteNum) { err = gcry_cipher_encrypt (hde, out+byteNum, 1, (tv[i].data[j].plaintext) + byteNum, 1); if (err) { fail ("aes-ofb, gcry_cipher_encrypt (%d, %d) failed: %s\n", i, j, gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } } if (memcmp (tv[i].data[j].out, out, tv[i].data[j].inlen)) fail ("aes-ofb, encrypt mismatch entry %d:%d\n", i, j); for (byteNum = 0; byteNum < tv[i].data[j].inlen; ++byteNum) { err = gcry_cipher_decrypt (hdd, out+byteNum, 1, NULL, 0); if (err) { fail ("aes-ofb, gcry_cipher_decrypt (%d, %d) failed: %s\n", i, j, gpg_strerror (err)); gcry_cipher_close (hde); gcry_cipher_close (hdd); return; } } if (memcmp (tv[i].data[j].plaintext, out, tv[i].data[j].inlen)) fail ("aes-ofb, decrypt mismatch entry %d:%d\n", i, j); } gcry_cipher_close (hde); gcry_cipher_close (hdd); } } static void check_one_cipher (int algo, int mode, int flags) { gcry_cipher_hd_t hd; char key[32]; unsigned char plain[16], in[16], out[16]; int keylen; gcry_error_t err = 0; memcpy (key, "0123456789abcdef.,;/[]{}-=ABCDEF", 32); memcpy (plain, "foobar42FOOBAR17", 16); keylen = gcry_cipher_get_algo_keylen (algo); if (!keylen) { fail ("algo %d, mode %d, gcry_cipher_get_algo_keylen failed\n", algo, mode); return; } if (keylen < 40 / 8 || keylen > 32) { fail ("algo %d, mode %d, keylength problem (%d)\n", algo, mode, keylen); return; } err = gcry_cipher_open (&hd, algo, mode, flags); if (err) { fail ("algo %d, mode %d, grcy_open_cipher failed: %s\n", algo, mode, gpg_strerror (err)); return; } err = gcry_cipher_setkey (hd, key, keylen); if (err) { fail ("algo %d, mode %d, gcry_cipher_setkey failed: %s\n", algo, mode, gpg_strerror (err)); gcry_cipher_close (hd); return; } err = gcry_cipher_encrypt (hd, out, 16, plain, 16); if (err) { fail ("algo %d, mode %d, gcry_cipher_encrypt failed: %s\n", algo, mode, gpg_strerror (err)); gcry_cipher_close (hd); return; } gcry_cipher_reset (hd); err = gcry_cipher_decrypt (hd, in, 16, out, 16); if (err) { fail ("algo %d, mode %d, gcry_cipher_decrypt failed: %s\n", algo, mode, gpg_strerror (err)); gcry_cipher_close (hd); return; } if (memcmp (plain, in, 16)) fail ("algo %d, mode %d, encrypt-decrypt mismatch\n", algo, mode); /* Again, using in-place encryption. */ gcry_cipher_reset (hd); memcpy (out, plain, 16); err = gcry_cipher_encrypt (hd, out, 16, NULL, 0); if (err) { fail ("algo %d, mode %d, in-place, gcry_cipher_encrypt failed: %s\n", algo, mode, gpg_strerror (err)); gcry_cipher_close (hd); return; } gcry_cipher_reset (hd); err = gcry_cipher_decrypt (hd, out, 16, NULL, 0); if (err) { fail ("algo %d, mode %d, in-place, gcry_cipher_decrypt failed: %s\n", algo, mode, gpg_strerror (err)); gcry_cipher_close (hd); return; } if (memcmp (plain, out, 16)) fail ("algo %d, mode %d, in-place, encrypt-decrypt mismatch\n",algo, mode); gcry_cipher_close (hd); } static void check_ciphers (void) { static int algos[] = { #if USE_BLOWFISH GCRY_CIPHER_BLOWFISH, #endif #if USE_DES GCRY_CIPHER_DES, GCRY_CIPHER_3DES, #endif #if USE_CAST5 GCRY_CIPHER_CAST5, #endif #if USE_AES GCRY_CIPHER_AES, GCRY_CIPHER_AES192, GCRY_CIPHER_AES256, #endif #if USE_TWOFISH GCRY_CIPHER_TWOFISH, GCRY_CIPHER_TWOFISH128, #endif #if USE_SERPENT GCRY_CIPHER_SERPENT128, GCRY_CIPHER_SERPENT192, GCRY_CIPHER_SERPENT256, #endif #if USE_RFC2268 GCRY_CIPHER_RFC2268_40, #endif #if USE_SEED GCRY_CIPHER_SEED, #endif #if USE_CAMELLIA GCRY_CIPHER_CAMELLIA128, GCRY_CIPHER_CAMELLIA192, GCRY_CIPHER_CAMELLIA256, #endif 0 }; static int algos2[] = { #if USE_ARCFOUR GCRY_CIPHER_ARCFOUR, #endif 0 }; int i; if (verbose) fprintf (stderr, "Starting Cipher checks.\n"); for (i = 0; algos[i]; i++) { if (gcry_cipher_test_algo (algos[i]) && in_fips_mode) { if (verbose) fprintf (stderr, " algorithm %d not available in fips mode\n", algos[i]); continue; } if (verbose) fprintf (stderr, " checking %s [%i]\n", gcry_cipher_algo_name (algos[i]), gcry_cipher_map_name (gcry_cipher_algo_name (algos[i]))); check_one_cipher (algos[i], GCRY_CIPHER_MODE_ECB, 0); check_one_cipher (algos[i], GCRY_CIPHER_MODE_CFB, 0); check_one_cipher (algos[i], GCRY_CIPHER_MODE_OFB, 0); check_one_cipher (algos[i], GCRY_CIPHER_MODE_CBC, 0); check_one_cipher (algos[i], GCRY_CIPHER_MODE_CBC, GCRY_CIPHER_CBC_CTS); check_one_cipher (algos[i], GCRY_CIPHER_MODE_CTR, 0); } for (i = 0; algos2[i]; i++) { if (gcry_cipher_test_algo (algos[i]) && in_fips_mode) { if (verbose) fprintf (stderr, " algorithm %d not available in fips mode\n", algos[i]); continue; } if (verbose) fprintf (stderr, " checking `%s'\n", gcry_cipher_algo_name (algos2[i])); check_one_cipher (algos2[i], GCRY_CIPHER_MODE_STREAM, 0); } /* we have now run all cipher's selftests */ if (verbose) fprintf (stderr, "Completed Cipher checks.\n"); /* TODO: add some extra encryption to test the higher level functions */ } static void check_one_md (int algo, const char *data, int len, const char *expect) { gcry_md_hd_t hd, hd2; unsigned char *p; int mdlen; int i; gcry_error_t err = 0; err = gcry_md_open (&hd, algo, 0); if (err) { fail ("algo %d, grcy_md_open failed: %s\n", algo, gpg_strerror (err)); return; } mdlen = gcry_md_get_algo_dlen (algo); if (mdlen < 1 || mdlen > 500) { fail ("algo %d, grcy_md_get_algo_dlen failed: %d\n", algo, mdlen); return; } if (*data == '!' && !data[1]) { /* hash one million times a "a" */ char aaa[1000]; /* Write in odd size chunks so that we test the buffering. */ memset (aaa, 'a', 1000); for (i = 0; i < 1000; i++) gcry_md_write (hd, aaa, 1000); } else gcry_md_write (hd, data, len); err = gcry_md_copy (&hd2, hd); if (err) { fail ("algo %d, gcry_md_copy failed: %s\n", algo, gpg_strerror (err)); } gcry_md_close (hd); p = gcry_md_read (hd2, algo); if (memcmp (p, expect, mdlen)) { printf ("computed: "); for (i = 0; i < mdlen; i++) printf ("%02x ", p[i] & 0xFF); printf ("\nexpected: "); for (i = 0; i < mdlen; i++) printf ("%02x ", expect[i] & 0xFF); printf ("\n"); fail ("algo %d, digest mismatch\n", algo); } gcry_md_close (hd2); } static void check_digests (void) { static struct algos { int md; const char *data; const char *expect; } algos[] = { { GCRY_MD_MD4, "", "\x31\xD6\xCF\xE0\xD1\x6A\xE9\x31\xB7\x3C\x59\xD7\xE0\xC0\x89\xC0" }, { GCRY_MD_MD4, "a", "\xbd\xe5\x2c\xb3\x1d\xe3\x3e\x46\x24\x5e\x05\xfb\xdb\xd6\xfb\x24" }, { GCRY_MD_MD4, "message digest", "\xd9\x13\x0a\x81\x64\x54\x9f\xe8\x18\x87\x48\x06\xe1\xc7\x01\x4b" }, { GCRY_MD_MD5, "", "\xD4\x1D\x8C\xD9\x8F\x00\xB2\x04\xE9\x80\x09\x98\xEC\xF8\x42\x7E" }, { GCRY_MD_MD5, "a", "\x0C\xC1\x75\xB9\xC0\xF1\xB6\xA8\x31\xC3\x99\xE2\x69\x77\x26\x61" }, { GCRY_MD_MD5, "abc", "\x90\x01\x50\x98\x3C\xD2\x4F\xB0\xD6\x96\x3F\x7D\x28\xE1\x7F\x72" }, { GCRY_MD_MD5, "message digest", "\xF9\x6B\x69\x7D\x7C\xB7\x93\x8D\x52\x5A\x2F\x31\xAA\xF1\x61\xD0" }, { GCRY_MD_SHA1, "abc", "\xA9\x99\x3E\x36\x47\x06\x81\x6A\xBA\x3E" "\x25\x71\x78\x50\xC2\x6C\x9C\xD0\xD8\x9D" }, { GCRY_MD_SHA1, "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", "\x84\x98\x3E\x44\x1C\x3B\xD2\x6E\xBA\xAE" "\x4A\xA1\xF9\x51\x29\xE5\xE5\x46\x70\xF1" }, { GCRY_MD_SHA1, "!" /* kludge for "a"*1000000 */ , "\x34\xAA\x97\x3C\xD4\xC4\xDA\xA4\xF6\x1E" "\xEB\x2B\xDB\xAD\x27\x31\x65\x34\x01\x6F" }, /* From RFC3874 */ { GCRY_MD_SHA224, "abc", "\x23\x09\x7d\x22\x34\x05\xd8\x22\x86\x42\xa4\x77\xbd\xa2\x55\xb3" "\x2a\xad\xbc\xe4\xbd\xa0\xb3\xf7\xe3\x6c\x9d\xa7" }, { GCRY_MD_SHA224, "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", "\x75\x38\x8b\x16\x51\x27\x76\xcc\x5d\xba\x5d\xa1\xfd\x89\x01\x50" "\xb0\xc6\x45\x5c\xb4\xf5\x8b\x19\x52\x52\x25\x25" }, { GCRY_MD_SHA224, "!", "\x20\x79\x46\x55\x98\x0c\x91\xd8\xbb\xb4\xc1\xea\x97\x61\x8a\x4b" "\xf0\x3f\x42\x58\x19\x48\xb2\xee\x4e\xe7\xad\x67" }, { GCRY_MD_SHA256, "abc", "\xba\x78\x16\xbf\x8f\x01\xcf\xea\x41\x41\x40\xde\x5d\xae\x22\x23" "\xb0\x03\x61\xa3\x96\x17\x7a\x9c\xb4\x10\xff\x61\xf2\x00\x15\xad" }, { GCRY_MD_SHA256, "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", "\x24\x8d\x6a\x61\xd2\x06\x38\xb8\xe5\xc0\x26\x93\x0c\x3e\x60\x39" "\xa3\x3c\xe4\x59\x64\xff\x21\x67\xf6\xec\xed\xd4\x19\xdb\x06\xc1" }, { GCRY_MD_SHA256, "!", "\xcd\xc7\x6e\x5c\x99\x14\xfb\x92\x81\xa1\xc7\xe2\x84\xd7\x3e\x67" "\xf1\x80\x9a\x48\xa4\x97\x20\x0e\x04\x6d\x39\xcc\xc7\x11\x2c\xd0" }, { GCRY_MD_SHA384, "abc", "\xcb\x00\x75\x3f\x45\xa3\x5e\x8b\xb5\xa0\x3d\x69\x9a\xc6\x50\x07" "\x27\x2c\x32\xab\x0e\xde\xd1\x63\x1a\x8b\x60\x5a\x43\xff\x5b\xed" "\x80\x86\x07\x2b\xa1\xe7\xcc\x23\x58\xba\xec\xa1\x34\xc8\x25\xa7" }, { GCRY_MD_SHA512, "abc", "\xDD\xAF\x35\xA1\x93\x61\x7A\xBA\xCC\x41\x73\x49\xAE\x20\x41\x31" "\x12\xE6\xFA\x4E\x89\xA9\x7E\xA2\x0A\x9E\xEE\xE6\x4B\x55\xD3\x9A" "\x21\x92\x99\x2A\x27\x4F\xC1\xA8\x36\xBA\x3C\x23\xA3\xFE\xEB\xBD" "\x45\x4D\x44\x23\x64\x3C\xE8\x0E\x2A\x9A\xC9\x4F\xA5\x4C\xA4\x9F" }, { GCRY_MD_RMD160, "", "\x9c\x11\x85\xa5\xc5\xe9\xfc\x54\x61\x28" "\x08\x97\x7e\xe8\xf5\x48\xb2\x25\x8d\x31" }, { GCRY_MD_RMD160, "a", "\x0b\xdc\x9d\x2d\x25\x6b\x3e\xe9\xda\xae" "\x34\x7b\xe6\xf4\xdc\x83\x5a\x46\x7f\xfe" }, { GCRY_MD_RMD160, "abc", "\x8e\xb2\x08\xf7\xe0\x5d\x98\x7a\x9b\x04" "\x4a\x8e\x98\xc6\xb0\x87\xf1\x5a\x0b\xfc" }, { GCRY_MD_RMD160, "message digest", "\x5d\x06\x89\xef\x49\xd2\xfa\xe5\x72\xb8" "\x81\xb1\x23\xa8\x5f\xfa\x21\x59\x5f\x36" }, { GCRY_MD_CRC32, "", "\x00\x00\x00\x00" }, { GCRY_MD_CRC32, "foo", "\x8c\x73\x65\x21" }, { GCRY_MD_CRC32_RFC1510, "", "\x00\x00\x00\x00" }, { GCRY_MD_CRC32_RFC1510, "foo", "\x73\x32\xbc\x33" }, { GCRY_MD_CRC32_RFC1510, "test0123456789", "\xb8\x3e\x88\xd6" }, { GCRY_MD_CRC32_RFC1510, "MASSACHVSETTS INSTITVTE OF TECHNOLOGY", "\xe3\x41\x80\xf7" }, #if 0 { GCRY_MD_CRC32_RFC1510, "\x80\x00", "\x3b\x83\x98\x4b" }, { GCRY_MD_CRC32_RFC1510, "\x00\x08", "\x0e\xdb\x88\x32" }, { GCRY_MD_CRC32_RFC1510, "\x00\x80", "\xed\xb8\x83\x20" }, #endif { GCRY_MD_CRC32_RFC1510, "\x80", "\xed\xb8\x83\x20" }, #if 0 { GCRY_MD_CRC32_RFC1510, "\x80\x00\x00\x00", "\xed\x59\xb6\x3b" }, { GCRY_MD_CRC32_RFC1510, "\x00\x00\x00\x01", "\x77\x07\x30\x96" }, #endif { GCRY_MD_CRC24_RFC2440, "", "\xb7\x04\xce" }, { GCRY_MD_CRC24_RFC2440, "foo", "\x4f\xc2\x55" }, { GCRY_MD_TIGER, "", "\x24\xF0\x13\x0C\x63\xAC\x93\x32\x16\x16\x6E\x76" "\xB1\xBB\x92\x5F\xF3\x73\xDE\x2D\x49\x58\x4E\x7A" }, { GCRY_MD_TIGER, "abc", "\xF2\x58\xC1\xE8\x84\x14\xAB\x2A\x52\x7A\xB5\x41" "\xFF\xC5\xB8\xBF\x93\x5F\x7B\x95\x1C\x13\x29\x51" }, { GCRY_MD_TIGER, "Tiger", "\x9F\x00\xF5\x99\x07\x23\x00\xDD\x27\x6A\xBB\x38" "\xC8\xEB\x6D\xEC\x37\x79\x0C\x11\x6F\x9D\x2B\xDF" }, { GCRY_MD_TIGER, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefg" "hijklmnopqrstuvwxyz0123456789+-", "\x87\xFB\x2A\x90\x83\x85\x1C\xF7\x47\x0D\x2C\xF8" "\x10\xE6\xDF\x9E\xB5\x86\x44\x50\x34\xA5\xA3\x86" }, { GCRY_MD_TIGER, "ABCDEFGHIJKLMNOPQRSTUVWXYZ=abcdef" "ghijklmnopqrstuvwxyz+0123456789", "\x46\x7D\xB8\x08\x63\xEB\xCE\x48\x8D\xF1\xCD\x12" "\x61\x65\x5D\xE9\x57\x89\x65\x65\x97\x5F\x91\x97" }, { GCRY_MD_TIGER, "Tiger - A Fast New Hash Function, " "by Ross Anderson and Eli Biham", "\x0C\x41\x0A\x04\x29\x68\x86\x8A\x16\x71\xDA\x5A" "\x3F\xD2\x9A\x72\x5E\xC1\xE4\x57\xD3\xCD\xB3\x03" }, { GCRY_MD_TIGER, "Tiger - A Fast New Hash Function, " "by Ross Anderson and Eli Biham, proceedings of Fa" "st Software Encryption 3, Cambridge.", "\xEB\xF5\x91\xD5\xAF\xA6\x55\xCE\x7F\x22\x89\x4F" "\xF8\x7F\x54\xAC\x89\xC8\x11\xB6\xB0\xDA\x31\x93" }, { GCRY_MD_TIGER, "Tiger - A Fast New Hash Function, " "by Ross Anderson and Eli Biham, proceedings of Fa" "st Software Encryption 3, Cambridge, 1996.", "\x3D\x9A\xEB\x03\xD1\xBD\x1A\x63\x57\xB2\x77\x4D" "\xFD\x6D\x5B\x24\xDD\x68\x15\x1D\x50\x39\x74\xFC" }, { GCRY_MD_TIGER, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh" "ijklmnopqrstuvwxyz0123456789+-ABCDEFGHIJKLMNOPQRS" "TUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-", "\x00\xB8\x3E\xB4\xE5\x34\x40\xC5\x76\xAC\x6A\xAE" "\xE0\xA7\x48\x58\x25\xFD\x15\xE7\x0A\x59\xFF\xE4" }, { GCRY_MD_WHIRLPOOL, "", "\x19\xFA\x61\xD7\x55\x22\xA4\x66\x9B\x44\xE3\x9C\x1D\x2E\x17\x26" "\xC5\x30\x23\x21\x30\xD4\x07\xF8\x9A\xFE\xE0\x96\x49\x97\xF7\xA7" "\x3E\x83\xBE\x69\x8B\x28\x8F\xEB\xCF\x88\xE3\xE0\x3C\x4F\x07\x57" "\xEA\x89\x64\xE5\x9B\x63\xD9\x37\x08\xB1\x38\xCC\x42\xA6\x6E\xB3" }, { GCRY_MD_WHIRLPOOL, "a", "\x8A\xCA\x26\x02\x79\x2A\xEC\x6F\x11\xA6\x72\x06\x53\x1F\xB7\xD7" "\xF0\xDF\xF5\x94\x13\x14\x5E\x69\x73\xC4\x50\x01\xD0\x08\x7B\x42" "\xD1\x1B\xC6\x45\x41\x3A\xEF\xF6\x3A\x42\x39\x1A\x39\x14\x5A\x59" "\x1A\x92\x20\x0D\x56\x01\x95\xE5\x3B\x47\x85\x84\xFD\xAE\x23\x1A" }, { GCRY_MD_WHIRLPOOL, "a", "\x8A\xCA\x26\x02\x79\x2A\xEC\x6F\x11\xA6\x72\x06\x53\x1F\xB7\xD7" "\xF0\xDF\xF5\x94\x13\x14\x5E\x69\x73\xC4\x50\x01\xD0\x08\x7B\x42" "\xD1\x1B\xC6\x45\x41\x3A\xEF\xF6\x3A\x42\x39\x1A\x39\x14\x5A\x59" "\x1A\x92\x20\x0D\x56\x01\x95\xE5\x3B\x47\x85\x84\xFD\xAE\x23\x1A" }, { GCRY_MD_WHIRLPOOL, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", "\xDC\x37\xE0\x08\xCF\x9E\xE6\x9B\xF1\x1F\x00\xED\x9A\xBA\x26\x90" "\x1D\xD7\xC2\x8C\xDE\xC0\x66\xCC\x6A\xF4\x2E\x40\xF8\x2F\x3A\x1E" "\x08\xEB\xA2\x66\x29\x12\x9D\x8F\xB7\xCB\x57\x21\x1B\x92\x81\xA6" "\x55\x17\xCC\x87\x9D\x7B\x96\x21\x42\xC6\x5F\x5A\x7A\xF0\x14\x67" }, { GCRY_MD_WHIRLPOOL, "!", "\x0C\x99\x00\x5B\xEB\x57\xEF\xF5\x0A\x7C\xF0\x05\x56\x0D\xDF\x5D" "\x29\x05\x7F\xD8\x6B\x20\xBF\xD6\x2D\xEC\xA0\xF1\xCC\xEA\x4A\xF5" "\x1F\xC1\x54\x90\xED\xDC\x47\xAF\x32\xBB\x2B\x66\xC3\x4F\xF9\xAD" "\x8C\x60\x08\xAD\x67\x7F\x77\x12\x69\x53\xB2\x26\xE4\xED\x8B\x01" }, { 0 }, }; int i; if (verbose) fprintf (stderr, "Starting hash checks.\n"); for (i = 0; algos[i].md; i++) { - if (gcry_md_test_algo (algos[i].md) && in_fips_mode) + if ((gcry_md_test_algo (algos[i].md) || algos[i].md == GCRY_MD_MD5) + && in_fips_mode) { if (verbose) fprintf (stderr, " algorithm %d not available in fips mode\n", algos[i].md); continue; } if (verbose) fprintf (stderr, " checking %s [%i] for length %zi\n", gcry_md_algo_name (algos[i].md), algos[i].md, !strcmp (algos[i].data, "!")? 1000000 : strlen(algos[i].data)); check_one_md (algos[i].md, algos[i].data, strlen (algos[i].data), algos[i].expect); } if (verbose) fprintf (stderr, "Completed hash checks.\n"); } static void check_one_hmac (int algo, const char *data, int datalen, const char *key, int keylen, const char *expect) { gcry_md_hd_t hd, hd2; unsigned char *p; int mdlen; int i; gcry_error_t err = 0; err = gcry_md_open (&hd, algo, GCRY_MD_FLAG_HMAC); if (err) { fail ("algo %d, grcy_md_open failed: %s\n", algo, gpg_strerror (err)); return; } mdlen = gcry_md_get_algo_dlen (algo); if (mdlen < 1 || mdlen > 500) { fail ("algo %d, grcy_md_get_algo_dlen failed: %d\n", algo, mdlen); return; } gcry_md_setkey( hd, key, keylen ); gcry_md_write (hd, data, datalen); err = gcry_md_copy (&hd2, hd); if (err) { fail ("algo %d, gcry_md_copy failed: %s\n", algo, gpg_strerror (err)); } gcry_md_close (hd); p = gcry_md_read (hd2, algo); if (!p) fail("algo %d, hmac gcry_md_read failed\n", algo); if (memcmp (p, expect, mdlen)) { printf ("computed: "); for (i = 0; i < mdlen; i++) printf ("%02x ", p[i] & 0xFF); printf ("\nexpected: "); for (i = 0; i < mdlen; i++) printf ("%02x ", expect[i] & 0xFF); printf ("\n"); fail ("algo %d, digest mismatch\n", algo); } gcry_md_close (hd2); } static void check_hmac (void) { static struct algos { int md; const char *data; const char *key; const char *expect; } algos[] = { { GCRY_MD_MD5, "what do ya want for nothing?", "Jefe", "\x75\x0c\x78\x3e\x6a\xb0\xb5\x03\xea\xa8\x6e\x31\x0a\x5d\xb7\x38" }, { GCRY_MD_MD5, "Hi There", "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b", "\x92\x94\x72\x7a\x36\x38\xbb\x1c\x13\xf4\x8e\xf8\x15\x8b\xfc\x9d" }, { GCRY_MD_MD5, "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd", "\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA", "\x56\xbe\x34\x52\x1d\x14\x4c\x88\xdb\xb8\xc7\x33\xf0\xe8\xb3\xf6" }, { GCRY_MD_MD5, "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd", "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19", "\x69\x7e\xaf\x0a\xca\x3a\x3a\xea\x3a\x75\x16\x47\x46\xff\xaa\x79" }, { GCRY_MD_MD5, "Test With Truncation", "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c", "\x56\x46\x1e\xf2\x34\x2e\xdc\x00\xf9\xba\xb9\x95\x69\x0e\xfd\x4c" }, { GCRY_MD_MD5, "Test Using Larger Than Block-Size Key - Hash Key First", "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa", "\x6b\x1a\xb7\xfe\x4b\xd7\xbf\x8f\x0b\x62\xe6\xce\x61\xb9\xd0\xcd" }, { GCRY_MD_MD5, "Test Using Larger Than Block-Size Key and Larger Than One Block-Size Data", "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa", "\x6f\x63\x0f\xad\x67\xcd\xa0\xee\x1f\xb1\xf5\x62\xdb\x3a\xa5\x3e", }, { GCRY_MD_SHA256, "what do ya want for nothing?", "Jefe", "\x5b\xdc\xc1\x46\xbf\x60\x75\x4e\x6a\x04\x24\x26\x08\x95\x75\xc7\x5a" "\x00\x3f\x08\x9d\x27\x39\x83\x9d\xec\x58\xb9\x64\xec\x38\x43" }, { GCRY_MD_SHA256, "Hi There", "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b" "\x0b\x0b\x0b", "\xb0\x34\x4c\x61\xd8\xdb\x38\x53\x5c\xa8\xaf\xce\xaf\x0b\xf1\x2b\x88" "\x1d\xc2\x00\xc9\x83\x3d\xa7\x26\xe9\x37\x6c\x2e\x32\xcf\xf7" }, { GCRY_MD_SHA256, "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd", "\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA" "\xAA\xAA\xAA\xAA", "\x77\x3e\xa9\x1e\x36\x80\x0e\x46\x85\x4d\xb8\xeb\xd0\x91\x81\xa7" "\x29\x59\x09\x8b\x3e\xf8\xc1\x22\xd9\x63\x55\x14\xce\xd5\x65\xfe" }, { GCRY_MD_SHA256, "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd", "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19", "\x82\x55\x8a\x38\x9a\x44\x3c\x0e\xa4\xcc\x81\x98\x99\xf2\x08" "\x3a\x85\xf0\xfa\xa3\xe5\x78\xf8\x07\x7a\x2e\x3f\xf4\x67\x29\x66\x5b" }, { GCRY_MD_SHA256, "Test Using Larger Than Block-Size Key - Hash Key First", "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa", "\x60\xe4\x31\x59\x1e\xe0\xb6\x7f\x0d\x8a\x26\xaa\xcb\xf5\xb7\x7f" "\x8e\x0b\xc6\x21\x37\x28\xc5\x14\x05\x46\x04\x0f\x0e\xe3\x7f\x54" }, { GCRY_MD_SHA256, "This is a test using a larger than block-size key and a larger than block-size data. The key needs to be hashed before being used by the HMAC algorithm.", "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa", "\x9b\x09\xff\xa7\x1b\x94\x2f\xcb\x27\x63\x5f\xbc\xd5\xb0\xe9\x44" "\xbf\xdc\x63\x64\x4f\x07\x13\x93\x8a\x7f\x51\x53\x5c\x3a\x35\xe2" }, { GCRY_MD_SHA224, "what do ya want for nothing?", "Jefe", "\xa3\x0e\x01\x09\x8b\xc6\xdb\xbf\x45\x69\x0f\x3a\x7e\x9e\x6d\x0f" "\x8b\xbe\xa2\xa3\x9e\x61\x48\x00\x8f\xd0\x5e\x44" }, { GCRY_MD_SHA224, "Hi There", "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b" "\x0b\x0b\x0b", "\x89\x6f\xb1\x12\x8a\xbb\xdf\x19\x68\x32\x10\x7c\xd4\x9d\xf3\x3f\x47" "\xb4\xb1\x16\x99\x12\xba\x4f\x53\x68\x4b\x22" }, { GCRY_MD_SHA224, "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd", "\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA" "\xAA\xAA\xAA\xAA", "\x7f\xb3\xcb\x35\x88\xc6\xc1\xf6\xff\xa9\x69\x4d\x7d\x6a\xd2\x64" "\x93\x65\xb0\xc1\xf6\x5d\x69\xd1\xec\x83\x33\xea" }, { GCRY_MD_SHA224, "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd", "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19", "\x6c\x11\x50\x68\x74\x01\x3c\xac\x6a\x2a\xbc\x1b\xb3\x82\x62" "\x7c\xec\x6a\x90\xd8\x6e\xfc\x01\x2d\xe7\xaf\xec\x5a" }, { GCRY_MD_SHA224, "Test Using Larger Than Block-Size Key - Hash Key First", "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa", "\x95\xe9\xa0\xdb\x96\x20\x95\xad\xae\xbe\x9b\x2d\x6f\x0d\xbc\xe2" "\xd4\x99\xf1\x12\xf2\xd2\xb7\x27\x3f\xa6\x87\x0e" }, { GCRY_MD_SHA224, "This is a test using a larger than block-size key and a larger than block-size data. The key needs to be hashed before being used by the HMAC algorithm.", "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa", "\x3a\x85\x41\x66\xac\x5d\x9f\x02\x3f\x54\xd5\x17\xd0\xb3\x9d\xbd" "\x94\x67\x70\xdb\x9c\x2b\x95\xc9\xf6\xf5\x65\xd1" }, { GCRY_MD_SHA384, "what do ya want for nothing?", "Jefe", "\xaf\x45\xd2\xe3\x76\x48\x40\x31\x61\x7f\x78\xd2\xb5\x8a\x6b\x1b" "\x9c\x7e\xf4\x64\xf5\xa0\x1b\x47\xe4\x2e\xc3\x73\x63\x22\x44\x5e" "\x8e\x22\x40\xca\x5e\x69\xe2\xc7\x8b\x32\x39\xec\xfa\xb2\x16\x49" }, { GCRY_MD_SHA384, "Hi There", "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b" "\x0b\x0b\x0b", "\xaf\xd0\x39\x44\xd8\x48\x95\x62\x6b\x08\x25\xf4\xab\x46\x90\x7f\x15" "\xf9\xda\xdb\xe4\x10\x1e\xc6\x82\xaa\x03\x4c\x7c\xeb\xc5\x9c\xfa\xea" "\x9e\xa9\x07\x6e\xde\x7f\x4a\xf1\x52\xe8\xb2\xfa\x9c\xb6" }, { GCRY_MD_SHA384, "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd", "\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA" "\xAA\xAA\xAA\xAA", "\x88\x06\x26\x08\xd3\xe6\xad\x8a\x0a\xa2\xac\xe0\x14\xc8\xa8\x6f" "\x0a\xa6\x35\xd9\x47\xac\x9f\xeb\xe8\x3e\xf4\xe5\x59\x66\x14\x4b" "\x2a\x5a\xb3\x9d\xc1\x38\x14\xb9\x4e\x3a\xb6\xe1\x01\xa3\x4f\x27" }, { GCRY_MD_SHA384, "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd", "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19", "\x3e\x8a\x69\xb7\x78\x3c\x25\x85\x19\x33\xab\x62\x90\xaf\x6c\xa7" "\x7a\x99\x81\x48\x08\x50\x00\x9c\xc5\x57\x7c\x6e\x1f\x57\x3b\x4e" "\x68\x01\xdd\x23\xc4\xa7\xd6\x79\xcc\xf8\xa3\x86\xc6\x74\xcf\xfb" }, { GCRY_MD_SHA384, "Test Using Larger Than Block-Size Key - Hash Key First", "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa", "\x4e\xce\x08\x44\x85\x81\x3e\x90\x88\xd2\xc6\x3a\x04\x1b\xc5\xb4" "\x4f\x9e\xf1\x01\x2a\x2b\x58\x8f\x3c\xd1\x1f\x05\x03\x3a\xc4\xc6" "\x0c\x2e\xf6\xab\x40\x30\xfe\x82\x96\x24\x8d\xf1\x63\xf4\x49\x52" }, { GCRY_MD_SHA384, "This is a test using a larger than block-size key and a larger than block-size data. The key needs to be hashed before being used by the HMAC algorithm.", "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa", "\x66\x17\x17\x8e\x94\x1f\x02\x0d\x35\x1e\x2f\x25\x4e\x8f\xd3\x2c" "\x60\x24\x20\xfe\xb0\xb8\xfb\x9a\xdc\xce\xbb\x82\x46\x1e\x99\xc5" "\xa6\x78\xcc\x31\xe7\x99\x17\x6d\x38\x60\xe6\x11\x0c\x46\x52\x3e" }, { GCRY_MD_SHA512, "what do ya want for nothing?", "Jefe", "\x16\x4b\x7a\x7b\xfc\xf8\x19\xe2\xe3\x95\xfb\xe7\x3b\x56\xe0\xa3" "\x87\xbd\x64\x22\x2e\x83\x1f\xd6\x10\x27\x0c\xd7\xea\x25\x05\x54" "\x97\x58\xbf\x75\xc0\x5a\x99\x4a\x6d\x03\x4f\x65\xf8\xf0\xe6\xfd" "\xca\xea\xb1\xa3\x4d\x4a\x6b\x4b\x63\x6e\x07\x0a\x38\xbc\xe7\x37" }, { GCRY_MD_SHA512, "Hi There", "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b" "\x0b\x0b\x0b", "\x87\xaa\x7c\xde\xa5\xef\x61\x9d\x4f\xf0\xb4\x24\x1a\x1d\x6c\xb0" "\x23\x79\xf4\xe2\xce\x4e\xc2\x78\x7a\xd0\xb3\x05\x45\xe1\x7c\xde" "\xda\xa8\x33\xb7\xd6\xb8\xa7\x02\x03\x8b\x27\x4e\xae\xa3\xf4\xe4" "\xbe\x9d\x91\x4e\xeb\x61\xf1\x70\x2e\x69\x6c\x20\x3a\x12\x68\x54" }, { GCRY_MD_SHA512, "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" "\xdd\xdd\xdd\xdd\xdd", "\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA\xAA" "\xAA\xAA\xAA\xAA", "\xfa\x73\xb0\x08\x9d\x56\xa2\x84\xef\xb0\xf0\x75\x6c\x89\x0b\xe9" "\xb1\xb5\xdb\xdd\x8e\xe8\x1a\x36\x55\xf8\x3e\x33\xb2\x27\x9d\x39" "\xbf\x3e\x84\x82\x79\xa7\x22\xc8\x06\xb4\x85\xa4\x7e\x67\xc8\x07" "\xb9\x46\xa3\x37\xbe\xe8\x94\x26\x74\x27\x88\x59\xe1\x32\x92\xfb" }, { GCRY_MD_SHA512, "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" "\xcd\xcd\xcd\xcd\xcd", "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f" "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19", "\xb0\xba\x46\x56\x37\x45\x8c\x69\x90\xe5\xa8\xc5\xf6\x1d\x4a\xf7" "\xe5\x76\xd9\x7f\xf9\x4b\x87\x2d\xe7\x6f\x80\x50\x36\x1e\xe3\xdb" "\xa9\x1c\xa5\xc1\x1a\xa2\x5e\xb4\xd6\x79\x27\x5c\xc5\x78\x80\x63" "\xa5\xf1\x97\x41\x12\x0c\x4f\x2d\xe2\xad\xeb\xeb\x10\xa2\x98\xdd" }, { GCRY_MD_SHA512, "Test Using Larger Than Block-Size Key - Hash Key First", "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa", "\x80\xb2\x42\x63\xc7\xc1\xa3\xeb\xb7\x14\x93\xc1\xdd\x7b\xe8\xb4" "\x9b\x46\xd1\xf4\x1b\x4a\xee\xc1\x12\x1b\x01\x37\x83\xf8\xf3\x52" "\x6b\x56\xd0\x37\xe0\x5f\x25\x98\xbd\x0f\xd2\x21\x5d\x6a\x1e\x52" "\x95\xe6\x4f\x73\xf6\x3f\x0a\xec\x8b\x91\x5a\x98\x5d\x78\x65\x98" }, { GCRY_MD_SHA512, "This is a test using a larger than block-size key and a larger than block-size data. The key needs to be hashed before being used by the HMAC algorithm.", "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" "\xaa\xaa\xaa", "\xe3\x7b\x6a\x77\x5d\xc8\x7d\xba\xa4\xdf\xa9\xf9\x6e\x5e\x3f\xfd" "\xde\xbd\x71\xf8\x86\x72\x89\x86\x5d\xf5\xa3\x2d\x20\xcd\xc9\x44" "\xb6\x02\x2c\xac\x3c\x49\x82\xb1\x0d\x5e\xeb\x55\xc3\xe4\xde\x15" "\x13\x46\x76\xfb\x6d\xe0\x44\x60\x65\xc9\x74\x40\xfa\x8c\x6a\x58" }, { 0 }, }; int i; if (verbose) fprintf (stderr, "Starting hashed MAC checks.\n"); for (i = 0; algos[i].md; i++) { - if (gcry_md_test_algo (algos[i].md) && in_fips_mode) + if ((gcry_md_test_algo (algos[i].md) || algos[i].md == GCRY_MD_MD5) + && in_fips_mode) { if (verbose) fprintf (stderr, " algorithm %d not available in fips mode\n", algos[i].md); continue; } if (verbose) fprintf (stderr, " checking %s [%i] for length %zi\n", gcry_md_algo_name (algos[i].md), algos[i].md, strlen(algos[i].data)); check_one_hmac (algos[i].md, algos[i].data, strlen (algos[i].data), algos[i].key, strlen(algos[i].key), algos[i].expect); } if (verbose) fprintf (stderr, "Completed hashed MAC checks.\n"); } /* Check that the signature SIG matches the hash HASH. PKEY is the public key used for the verification. BADHASH is a hasvalue which should; result in a bad signature status. */ static void verify_one_signature (gcry_sexp_t pkey, gcry_sexp_t hash, gcry_sexp_t badhash, gcry_sexp_t sig) { gcry_error_t rc; rc = gcry_pk_verify (sig, hash, pkey); if (rc) fail ("gcry_pk_verify failed: %s\n", gpg_strerror (rc)); rc = gcry_pk_verify (sig, badhash, pkey); if (gcry_err_code (rc) != GPG_ERR_BAD_SIGNATURE) fail ("gcry_pk_verify failed to detect a bad signature: %s\n", gpg_strerror (rc)); } /* Test the public key sign function using the private ket SKEY. PKEY is used for verification. */ static void check_pubkey_sign (int n, gcry_sexp_t skey, gcry_sexp_t pkey) { gcry_error_t rc; gcry_sexp_t sig, badhash, hash; int dataidx; static const char baddata[] = "(data\n (flags pkcs1)\n" " (hash sha1 #11223344556677889900AABBCCDDEEFF10203041#))\n"; static struct { const char *data; int expected_rc; } datas[] = { { "(data\n (flags pkcs1)\n" " (hash sha1 #11223344556677889900AABBCCDDEEFF10203040#))\n", 0 }, /* This test is to see whether hash algorithms not hard wired in pubkey.c are detected: */ { "(data\n (flags pkcs1)\n" " (hash oid.1.3.14.3.2.29 " " #11223344556677889900AABBCCDDEEFF10203040#))\n", 0 }, { "(data\n (flags )\n" " (hash sha1 #11223344556677889900AABBCCDDEEFF10203040#))\n", GPG_ERR_CONFLICT }, { "(data\n (flags pkcs1)\n" " (hash foo #11223344556677889900AABBCCDDEEFF10203040#))\n", GPG_ERR_DIGEST_ALGO }, { "(data\n (flags )\n" " (value #11223344556677889900AA#))\n", 0 }, { "(data\n (flags )\n" " (value #0090223344556677889900AA#))\n", 0 }, { "(data\n (flags raw)\n" " (value #11223344556677889900AA#))\n", 0 }, { "(data\n (flags pkcs1)\n" " (value #11223344556677889900AA#))\n", GPG_ERR_CONFLICT }, { "(data\n (flags raw foo)\n" " (value #11223344556677889900AA#))\n", GPG_ERR_INV_FLAG }, { NULL } }; (void)n; rc = gcry_sexp_sscan (&badhash, NULL, baddata, strlen (baddata)); if (rc) die ("converting data failed: %s\n", gpg_strerror (rc)); for (dataidx = 0; datas[dataidx].data; dataidx++) { if (verbose) fprintf (stderr, " signature test %d\n", dataidx); rc = gcry_sexp_sscan (&hash, NULL, datas[dataidx].data, strlen (datas[dataidx].data)); if (rc) die ("converting data failed: %s\n", gpg_strerror (rc)); rc = gcry_pk_sign (&sig, hash, skey); if (gcry_err_code (rc) != datas[dataidx].expected_rc) fail ("gcry_pk_sign failed: %s\n", gpg_strerror (rc)); if (!rc) verify_one_signature (pkey, hash, badhash, sig); gcry_sexp_release (sig); sig = NULL; gcry_sexp_release (hash); hash = NULL; } gcry_sexp_release (badhash); } static void check_pubkey_grip (int n, const unsigned char *grip, gcry_sexp_t skey, gcry_sexp_t pkey) { unsigned char sgrip[20], pgrip[20]; if (!gcry_pk_get_keygrip (skey, sgrip)) die ("get keygrip for private RSA key failed\n"); if (!gcry_pk_get_keygrip (pkey, pgrip)) die ("[%i] get keygrip for public RSA key failed\n", n); if (memcmp (sgrip, pgrip, 20)) fail ("[%i] keygrips don't match\n", n); if (memcmp (sgrip, grip, 20)) fail ("wrong keygrip for RSA key\n"); } static void do_check_one_pubkey (int n, gcry_sexp_t skey, gcry_sexp_t pkey, const unsigned char *grip, int flags) { if (flags & FLAG_SIGN) check_pubkey_sign (n, skey, pkey); if (grip && (flags & FLAG_GRIP)) check_pubkey_grip (n, grip, skey, pkey); } static void check_one_pubkey (int n, test_spec_pubkey_t spec) { gcry_error_t err = GPG_ERR_NO_ERROR; gcry_sexp_t skey, pkey; err = gcry_sexp_sscan (&skey, NULL, spec.key.secret, strlen (spec.key.secret)); if (!err) err = gcry_sexp_sscan (&pkey, NULL, spec.key.public, strlen (spec.key.public)); if (err) die ("converting sample key failed: %s\n", gpg_strerror (err)); do_check_one_pubkey (n, skey, pkey, (const unsigned char*)spec.key.grip, spec.flags); gcry_sexp_release (skey); gcry_sexp_release (pkey); } static void get_keys_new (gcry_sexp_t *pkey, gcry_sexp_t *skey) { gcry_sexp_t key_spec, key, pub_key, sec_key; int rc; if (verbose) fprintf (stderr, " generating RSA key:"); rc = gcry_sexp_new (&key_spec, in_fips_mode ? "(genkey (rsa (nbits 4:1024)))" : "(genkey (rsa (nbits 4:1024)(transient-key)))", 0, 1); if (rc) die ("error creating S-expression: %s\n", gpg_strerror (rc)); rc = gcry_pk_genkey (&key, key_spec); gcry_sexp_release (key_spec); if (rc) die ("error generating RSA key: %s\n", gpg_strerror (rc)); pub_key = gcry_sexp_find_token (key, "public-key", 0); if (! pub_key) die ("public part missing in key\n"); sec_key = gcry_sexp_find_token (key, "private-key", 0); if (! sec_key) die ("private part missing in key\n"); gcry_sexp_release (key); *pkey = pub_key; *skey = sec_key; } static void check_one_pubkey_new (int n) { gcry_sexp_t skey, pkey; get_keys_new (&pkey, &skey); do_check_one_pubkey (n, skey, pkey, NULL, FLAG_SIGN | FLAG_CRYPT); } /* Run all tests for the public key functions. */ static void check_pubkey (void) { test_spec_pubkey_t pubkeys[] = { { GCRY_PK_RSA, FLAG_CRYPT | FLAG_SIGN, { "(private-key\n" " (rsa\n" " (n #00e0ce96f90b6c9e02f3922beada93fe50a875eac6bcc18bb9a9cf2e84965caa" " 2d1ff95a7f542465c6c0c19d276e4526ce048868a7a914fd343cc3a87dd74291" " ffc565506d5bbb25cbac6a0e2dd1f8bcaab0d4a29c2f37c950f363484bf269f7" " 891440464baf79827e03a36e70b814938eebdc63e964247be75dc58b014b7ea251#)\n" " (e #010001#)\n" " (d #046129F2489D71579BE0A75FE029BD6CDB574EBF57EA8A5B0FDA942CAB943B11" " 7D7BB95E5D28875E0F9FC5FCC06A72F6D502464DABDED78EF6B716177B83D5BD" " C543DC5D3FED932E59F5897E92E6F58A0F33424106A3B6FA2CBF877510E4AC21" " C3EE47851E97D12996222AC3566D4CCB0B83D164074ABF7DE655FC2446DA1781#)\n" " (p #00e861b700e17e8afe6837e7512e35b6ca11d0ae47d8b85161c67baf64377213" " fe52d772f2035b3ca830af41d8a4120e1c1c70d12cc22f00d28d31dd48a8d424f1#)\n" " (q #00f7a7ca5367c661f8e62df34f0d05c10c88e5492348dd7bddc942c9a8f369f9" " 35a07785d2db805215ed786e4285df1658eed3ce84f469b81b50d358407b4ad361#)\n" " (u #304559a9ead56d2309d203811a641bb1a09626bc8eb36fffa23c968ec5bd891e" " ebbafc73ae666e01ba7c8990bae06cc2bbe10b75e69fcacb353a6473079d8e9b#)))\n", "(public-key\n" " (rsa\n" " (n #00e0ce96f90b6c9e02f3922beada93fe50a875eac6bcc18bb9a9cf2e84965caa" " 2d1ff95a7f542465c6c0c19d276e4526ce048868a7a914fd343cc3a87dd74291" " ffc565506d5bbb25cbac6a0e2dd1f8bcaab0d4a29c2f37c950f363484bf269f7" " 891440464baf79827e03a36e70b814938eebdc63e964247be75dc58b014b7ea251#)\n" " (e #010001#)))\n", "\x32\x10\x0c\x27\x17\x3e\xf6\xe9\xc4\xe9" "\xa2\x5d\x3d\x69\xf8\x6d\x37\xa4\xf9\x39"} }, { GCRY_PK_DSA, FLAG_SIGN, { "(private-key\n" " (DSA\n" " (p #00AD7C0025BA1A15F775F3F2D673718391D00456978D347B33D7B49E7F32EDAB" " 96273899DD8B2BB46CD6ECA263FAF04A28903503D59062A8865D2AE8ADFB5191" " CF36FFB562D0E2F5809801A1F675DAE59698A9E01EFE8D7DCFCA084F4C6F5A44" " 44D499A06FFAEA5E8EF5E01F2FD20A7B7EF3F6968AFBA1FB8D91F1559D52D8777B#)\n" " (q #00EB7B5751D25EBBB7BD59D920315FD840E19AEBF9#)\n" " (g #1574363387FDFD1DDF38F4FBE135BB20C7EE4772FB94C337AF86EA8E49666503" " AE04B6BE81A2F8DD095311E0217ACA698A11E6C5D33CCDAE71498ED35D13991E" " B02F09AB40BD8F4C5ED8C75DA779D0AE104BC34C960B002377068AB4B5A1F984" " 3FBA91F537F1B7CAC4D8DD6D89B0D863AF7025D549F9C765D2FC07EE208F8D15#)\n" " (y #64B11EF8871BE4AB572AA810D5D3CA11A6CDBC637A8014602C72960DB135BF46" " A1816A724C34F87330FC9E187C5D66897A04535CC2AC9164A7150ABFA8179827" " 6E45831AB811EEE848EBB24D9F5F2883B6E5DDC4C659DEF944DCFD80BF4D0A20" " 42CAA7DC289F0C5A9D155F02D3D551DB741A81695B74D4C8F477F9C7838EB0FB#)\n" " (x #11D54E4ADBD3034160F2CED4B7CD292A4EBF3EC0#)))\n", "(public-key\n" " (DSA\n" " (p #00AD7C0025BA1A15F775F3F2D673718391D00456978D347B33D7B49E7F32EDAB" " 96273899DD8B2BB46CD6ECA263FAF04A28903503D59062A8865D2AE8ADFB5191" " CF36FFB562D0E2F5809801A1F675DAE59698A9E01EFE8D7DCFCA084F4C6F5A44" " 44D499A06FFAEA5E8EF5E01F2FD20A7B7EF3F6968AFBA1FB8D91F1559D52D8777B#)\n" " (q #00EB7B5751D25EBBB7BD59D920315FD840E19AEBF9#)\n" " (g #1574363387FDFD1DDF38F4FBE135BB20C7EE4772FB94C337AF86EA8E49666503" " AE04B6BE81A2F8DD095311E0217ACA698A11E6C5D33CCDAE71498ED35D13991E" " B02F09AB40BD8F4C5ED8C75DA779D0AE104BC34C960B002377068AB4B5A1F984" " 3FBA91F537F1B7CAC4D8DD6D89B0D863AF7025D549F9C765D2FC07EE208F8D15#)\n" " (y #64B11EF8871BE4AB572AA810D5D3CA11A6CDBC637A8014602C72960DB135BF46" " A1816A724C34F87330FC9E187C5D66897A04535CC2AC9164A7150ABFA8179827" " 6E45831AB811EEE848EBB24D9F5F2883B6E5DDC4C659DEF944DCFD80BF4D0A20" " 42CAA7DC289F0C5A9D155F02D3D551DB741A81695B74D4C8F477F9C7838EB0FB#)))\n", "\xc6\x39\x83\x1a\x43\xe5\x05\x5d\xc6\xd8" "\x4a\xa6\xf9\xeb\x23\xbf\xa9\x12\x2d\x5b" } }, { GCRY_PK_ELG, FLAG_SIGN | FLAG_CRYPT, { "(private-key\n" " (ELG\n" " (p #00B93B93386375F06C2D38560F3B9C6D6D7B7506B20C1773F73F8DE56E6CD65D" " F48DFAAA1E93F57A2789B168362A0F787320499F0B2461D3A4268757A7B27517" " B7D203654A0CD484DEC6AF60C85FEB84AAC382EAF2047061FE5DAB81A20A0797" " 6E87359889BAE3B3600ED718BE61D4FC993CC8098A703DD0DC942E965E8F18D2A7#)\n" " (g #05#)\n" " (y #72DAB3E83C9F7DD9A931FDECDC6522C0D36A6F0A0FEC955C5AC3C09175BBFF2B" " E588DB593DC2E420201BEB3AC17536918417C497AC0F8657855380C1FCF11C5B" " D20DB4BEE9BDF916648DE6D6E419FA446C513AAB81C30CB7B34D6007637BE675" " 56CE6473E9F9EE9B9FADD275D001563336F2186F424DEC6199A0F758F6A00FF4#)\n" " (x #03C28900087B38DABF4A0AB98ACEA39BB674D6557096C01D72E31C16BDD32214#)))\n", "(public-key\n" " (ELG\n" " (p #00B93B93386375F06C2D38560F3B9C6D6D7B7506B20C1773F73F8DE56E6CD65D" " F48DFAAA1E93F57A2789B168362A0F787320499F0B2461D3A4268757A7B27517" " B7D203654A0CD484DEC6AF60C85FEB84AAC382EAF2047061FE5DAB81A20A0797" " 6E87359889BAE3B3600ED718BE61D4FC993CC8098A703DD0DC942E965E8F18D2A7#)\n" " (g #05#)\n" " (y #72DAB3E83C9F7DD9A931FDECDC6522C0D36A6F0A0FEC955C5AC3C09175BBFF2B" " E588DB593DC2E420201BEB3AC17536918417C497AC0F8657855380C1FCF11C5B" " D20DB4BEE9BDF916648DE6D6E419FA446C513AAB81C30CB7B34D6007637BE675" " 56CE6473E9F9EE9B9FADD275D001563336F2186F424DEC6199A0F758F6A00FF4#)))\n", "\xa7\x99\x61\xeb\x88\x83\xd2\xf4\x05\xc8" "\x4f\xba\x06\xf8\x78\x09\xbc\x1e\x20\xe5" } }, }; int i; if (verbose) fprintf (stderr, "Starting public key checks.\n"); for (i = 0; i < sizeof (pubkeys) / sizeof (*pubkeys); i++) if (pubkeys[i].id) { if (gcry_pk_test_algo (pubkeys[i].id) && in_fips_mode) { if (verbose) fprintf (stderr, " algorithm %d not available in fips mode\n", pubkeys[i].id); continue; } check_one_pubkey (i, pubkeys[i]); } if (verbose) fprintf (stderr, "Completed public key checks.\n"); if (verbose) fprintf (stderr, "Starting additional public key checks.\n"); for (i = 0; i < sizeof (pubkeys) / sizeof (*pubkeys); i++) if (pubkeys[i].id) { if (gcry_pk_test_algo (pubkeys[i].id) && in_fips_mode) { if (verbose) fprintf (stderr, " algorithm %d not available in fips mode\n", pubkeys[i].id); continue; } check_one_pubkey_new (i); } if (verbose) fprintf (stderr, "Completed additional public key checks.\n"); } int main (int argc, char **argv) { gpg_error_t err; int last_argc = -1; int debug = 0; int use_fips = 0; int selftest_only = 0; if (argc) { argc--; argv++; } while (argc && last_argc != argc ) { last_argc = argc; if (!strcmp (*argv, "--")) { argc--; argv++; break; } else if (!strcmp (*argv, "--verbose")) { verbose++; argc--; argv++; } else if (!strcmp (*argv, "--debug")) { verbose = debug = 1; argc--; argv++; } else if (!strcmp (*argv, "--fips")) { use_fips = 1; argc--; argv++; } else if (!strcmp (*argv, "--selftest")) { selftest_only = 1; verbose += 2; argc--; argv++; } } gcry_control (GCRYCTL_SET_VERBOSITY, (int)verbose); if (use_fips) gcry_control (GCRYCTL_FORCE_FIPS_MODE, 0); if (!gcry_check_version (GCRYPT_VERSION)) die ("version mismatch\n"); if ( gcry_fips_mode_active () ) in_fips_mode = 1; if (!in_fips_mode) gcry_control (GCRYCTL_DISABLE_SECMEM, 0); if (verbose) gcry_set_progress_handler (progress_handler, NULL); gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0); if (debug) gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0); /* No valuable keys are create, so we can speed up our RNG. */ gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0); if (!selftest_only) { check_ciphers (); check_aes128_cbc_cts_cipher (); check_cbc_mac_cipher (); check_ctr_cipher (); check_cfb_cipher (); check_ofb_cipher (); check_digests (); check_hmac (); check_pubkey (); } + if (in_fips_mode && !selftest_only) { /* If we are in fips mode do some more tests. */ gcry_md_hd_t md; /* First trigger a self-test. */ gcry_control (GCRYCTL_FORCE_FIPS_MODE, 0); if (!gcry_control (GCRYCTL_OPERATIONAL_P, 0)) fail ("not in operational state after self-test\n"); /* Get us into the error state. */ err = gcry_md_open (&md, GCRY_MD_SHA1, 0); if (err) fail ("failed to open SHA-1 hash context: %s\n", gpg_strerror (err)); else { err = gcry_md_enable (md, GCRY_MD_SHA256); if (err) fail ("failed to add SHA-256 hash context: %s\n", gpg_strerror (err)); else { /* gcry_md_get_algo is only defined for a context with just one digest algorithm. With our setup it should put the oibrary intoerror state. */ fputs ("Note: Two lines with error messages follow " "- this is expected\n", stderr); gcry_md_get_algo (md); gcry_md_close (md); if (gcry_control (GCRYCTL_OPERATIONAL_P, 0)) fail ("expected error state but still in operational state\n"); else { /* Now run a self-test and to get back into operational state. */ gcry_control (GCRYCTL_FORCE_FIPS_MODE, 0); if (!gcry_control (GCRYCTL_OPERATIONAL_P, 0)) fail ("did not reach operational after error " "and self-test\n"); } } } } else { /* If in standard mode, run selftests. */ gcry_control (GCRYCTL_SELFTEST, 0); } if (verbose) fprintf (stderr, "\nAll tests completed. Errors: %i\n", error_count); + if (in_fips_mode && !gcry_fips_mode_active ()) + fprintf (stderr, "FIPS mode is not anymore active\n"); + return error_count ? 1 : 0; } diff --git a/tests/benchmark.c b/tests/benchmark.c index a7a0b413..f8a5b0e6 100644 --- a/tests/benchmark.c +++ b/tests/benchmark.c @@ -1,1141 +1,1152 @@ /* benchmark.c - for libgcrypt * Copyright (C) 2002, 2004, 2005, 2006, 2008 Free Software Foundation, Inc. * * This file is part of Libgcrypt. * * Libgcrypt is free software; you can redistribute it and/or modify * it under the terms of the GNU Lesser general Public License as * published by the Free Software Foundation; either version 2.1 of * the License, or (at your option) any later version. * * Libgcrypt is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this program; if not, see . */ #ifdef HAVE_CONFIG_H #include #endif #include #include #include #include #ifdef _WIN32 #include #else #include #endif #include #define PGM "benchmark" static int verbose; /* Do encryption tests with large buffers. */ static int large_buffers; /* Number of cipher repetitions. */ static int cipher_repetitions; +/* Whether fips mode was active at startup. */ +static int in_fips_mode; + static const char sample_private_dsa_key_1024[] = "(private-key\n" " (dsa\n" " (p #00A126202D592214C5A8F6016E2C3F4256052ACB1CB17D88E64B1293FAF08F5E4685" "03E6F68366B326A56284370EB2103E92D8346A163E44A08FDC422AC8E9E44268557A" "853539A6AF39353A59CE5E78FD98B57D0F3E3A7EBC8A256AC9A775BA59689F3004BF" "C3035730C4C0C51626C5D7F5852637EC589BB29DAB46C161572E4B#)\n" " (q #00DEB5A296421887179ECA1762884DE2AF8185AFC5#)\n" " (g #3958B34AE7747194ECBD312F8FEE8CBE3918E94DF9FD11E2912E56318F33BDC38622" "B18DDFF393074BCA8BAACF50DF27AEE529F3E8AEECE55C398DAB3A5E04C2EA142312" "FACA2FE7F0A88884F8DAC3979EE67598F9A383B2A2325F035C796F352A5C3CDF2CB3" "85AD24EC52A6E55247E1BB37D260F79E617D2A4446415B6AD79A#)\n" " (y #519E9FE9AB0545A6724E74603B7B04E48DC1437E0284A11EA605A7BA8AB1CF354FD4" "ECC93880AC293391C69B558AD84E7AAFA88F11D028CF3A378F241D6B056A90C588F6" "66F68D27262B4DA84657D15057D371BCEC1F6504032507D5B881E45FC93A1B973155" "D91C57219D090C3ACD75E7C2B9F1176A208AC03D6C12AC28A271#)\n" " (x #4186F8A58C5DF46C5BCFC7006BEEBF05E93C0CA7#)\n" "))\n"; static const char sample_public_dsa_key_1024[] = "(public-key\n" " (dsa\n" " (p #00A126202D592214C5A8F6016E2C3F4256052ACB1CB17D88E64B1293FAF08F5E4685" "03E6F68366B326A56284370EB2103E92D8346A163E44A08FDC422AC8E9E44268557A" "853539A6AF39353A59CE5E78FD98B57D0F3E3A7EBC8A256AC9A775BA59689F3004BF" "C3035730C4C0C51626C5D7F5852637EC589BB29DAB46C161572E4B#)\n" " (q #00DEB5A296421887179ECA1762884DE2AF8185AFC5#)\n" " (g #3958B34AE7747194ECBD312F8FEE8CBE3918E94DF9FD11E2912E56318F33BDC38622" "B18DDFF393074BCA8BAACF50DF27AEE529F3E8AEECE55C398DAB3A5E04C2EA142312" "FACA2FE7F0A88884F8DAC3979EE67598F9A383B2A2325F035C796F352A5C3CDF2CB3" "85AD24EC52A6E55247E1BB37D260F79E617D2A4446415B6AD79A#)\n" " (y #519E9FE9AB0545A6724E74603B7B04E48DC1437E0284A11EA605A7BA8AB1CF354FD4" "ECC93880AC293391C69B558AD84E7AAFA88F11D028CF3A378F241D6B056A90C588F6" "66F68D27262B4DA84657D15057D371BCEC1F6504032507D5B881E45FC93A1B973155" "D91C57219D090C3ACD75E7C2B9F1176A208AC03D6C12AC28A271#)\n" "))\n"; static const char sample_private_dsa_key_2048[] = "(private-key\n" " (dsa\n" " (p #00B54636673962B64F7DC23C71ACEF6E7331796F607560B194DFCC0CA370E858A365" "A413152FB6EB8C664BD171AC316FE5B381CD084D07377571599880A068EF1382D85C" "308B4E9DEAC12D66DE5C4A826EBEB5ED94A62E7301E18927E890589A2F230272A150" "C118BC3DC2965AE0D05BE4F65C6137B2BA7EDABB192C3070D202C10AA3F534574970" "71454DB8A73DDB6511A5BA98EF1450FD90DE5BAAFC9FD3AC22EBEA612DD075BB7405" "D56866D125E33982C046808F7CEBA8E5C0B9F19A6FE451461660A1CBA9EF68891179" "0256A573D3B8F35A5C7A0C6C31F2DB90E25A26845252AD9E485EF2D339E7B5890CD4" "2F9C9F315ED409171EC35CA04CC06B275577B3#)\n" " (q #00DA67989167FDAC4AE3DF9247A716859A30C0CF9C5A6DBA01EABA3481#)\n" " (g #48E35DA584A089D05142AA63603FDB00D131B07A0781E2D5A8F9614D2B33D3E40A78" "98A9E10CDBB612CF093F95A3E10D09566726F2C12823836B2D9CD974BB695665F3B3" "5D219A9724B87F380BD5207EDA0AE38C79E8F18122C3F76E4CEB0ABED3250914987F" "B30D4B9E19C04C28A5D4F45560AF586F6A1B41751EAD90AE7F044F4E2A4A50C1F508" "4FC202463F478F678B9A19392F0D2961C5391C546EF365368BB46410C9C1CEE96E9F" "0C953570C2ED06328B11C90E86E57CAA7FA5ABAA278E22A4C8C08E16EE59F484EC44" "2CF55535BAA2C6BEA8833A555372BEFE1E665D3C7DAEF58061D5136331EF4EB61BC3" "6EE4425A553AF8885FEA15A88135BE133520#)\n" " (y #66E0D1A69D663466F8FEF2B7C0878DAC93C36A2FB2C05E0306A53B926021D4B92A1C" "2FA6860061E88E78CBBBA49B0E12700F07DBF86F72CEB2927EDAC0C7E3969C3A47BB" "4E0AE93D8BB3313E93CC7A72DFEEE442EFBC81B3B2AEC9D8DCBE21220FB760201D79" "328C41C773866587A44B6954767D022A88072900E964089D9B17133603056C985C4F" "8A0B648F297F8D2C3CB43E4371DC6002B5B12CCC085BDB2CFC5074A0587566187EE3" "E11A2A459BD94726248BB8D6CC62938E11E284C2C183576FBB51749EB238C4360923" "79C08CE1C8CD77EB57404CE9B4744395ACF721487450BADE3220576F2F816248B0A7" "14A264330AECCB24DE2A1107847B23490897#)\n" " (x #477BD14676E22563C5ABA68025CEBA2A48D485F5B2D4AD4C0EBBD6D0#)\n" "))\n"; static const char sample_public_dsa_key_2048[] = "(public-key\n" " (dsa\n" " (p #00B54636673962B64F7DC23C71ACEF6E7331796F607560B194DFCC0CA370E858A365" "A413152FB6EB8C664BD171AC316FE5B381CD084D07377571599880A068EF1382D85C" "308B4E9DEAC12D66DE5C4A826EBEB5ED94A62E7301E18927E890589A2F230272A150" "C118BC3DC2965AE0D05BE4F65C6137B2BA7EDABB192C3070D202C10AA3F534574970" "71454DB8A73DDB6511A5BA98EF1450FD90DE5BAAFC9FD3AC22EBEA612DD075BB7405" "D56866D125E33982C046808F7CEBA8E5C0B9F19A6FE451461660A1CBA9EF68891179" "0256A573D3B8F35A5C7A0C6C31F2DB90E25A26845252AD9E485EF2D339E7B5890CD4" "2F9C9F315ED409171EC35CA04CC06B275577B3#)\n" " (q #00DA67989167FDAC4AE3DF9247A716859A30C0CF9C5A6DBA01EABA3481#)\n" " (g #48E35DA584A089D05142AA63603FDB00D131B07A0781E2D5A8F9614D2B33D3E40A78" "98A9E10CDBB612CF093F95A3E10D09566726F2C12823836B2D9CD974BB695665F3B3" "5D219A9724B87F380BD5207EDA0AE38C79E8F18122C3F76E4CEB0ABED3250914987F" "B30D4B9E19C04C28A5D4F45560AF586F6A1B41751EAD90AE7F044F4E2A4A50C1F508" "4FC202463F478F678B9A19392F0D2961C5391C546EF365368BB46410C9C1CEE96E9F" "0C953570C2ED06328B11C90E86E57CAA7FA5ABAA278E22A4C8C08E16EE59F484EC44" "2CF55535BAA2C6BEA8833A555372BEFE1E665D3C7DAEF58061D5136331EF4EB61BC3" "6EE4425A553AF8885FEA15A88135BE133520#)\n" " (y #66E0D1A69D663466F8FEF2B7C0878DAC93C36A2FB2C05E0306A53B926021D4B92A1C" "2FA6860061E88E78CBBBA49B0E12700F07DBF86F72CEB2927EDAC0C7E3969C3A47BB" "4E0AE93D8BB3313E93CC7A72DFEEE442EFBC81B3B2AEC9D8DCBE21220FB760201D79" "328C41C773866587A44B6954767D022A88072900E964089D9B17133603056C985C4F" "8A0B648F297F8D2C3CB43E4371DC6002B5B12CCC085BDB2CFC5074A0587566187EE3" "E11A2A459BD94726248BB8D6CC62938E11E284C2C183576FBB51749EB238C4360923" "79C08CE1C8CD77EB57404CE9B4744395ACF721487450BADE3220576F2F816248B0A7" "14A264330AECCB24DE2A1107847B23490897#)\n" "))\n"; static const char sample_private_dsa_key_3072[] = "(private-key\n" " (dsa\n" " (p #00BA73E148AEA5E8B64878AF5BE712B8302B9671C5F3EEB7722A9D0D9868D048C938" "877C91C335C7819292E69C7D34264F1578E32EC2DA8408DF75D0EB76E0D3030B84B5" "62D8EF93AB53BAB6B8A5DE464F5CA87AEA43BDCF0FB0B7815AA3114CFC84FD916A83" "B3D5FD78390189332232E9D037D215313FD002FF46C048B66703F87FAE092AAA0988" "AC745336EBE672A01DEDBD52395783579B67CF3AE1D6F1602CCCB12154FA0E00AE46" "0D9B289CF709194625BCB919B11038DEFC50ADBBA20C3F320078E4E9529B4F6848E2" "AB5E6278DB961FE226F2EEBD201E071C48C5BEF98B4D9BEE42C1C7102D893EBF8902" "D7A91266340AFD6CE1D09E52282FFF5B97EAFA3886A3FCF84FF76D1E06538D0D8E60" "B3332145785E07D29A5965382DE3470D1D888447FA9C00A2373378FC3FA7B9F7D17E" "95A6A5AE1397BE46D976EF2C96E89913AC4A09351CA661BF6F67E30407DA846946C7" "62D9BAA6B77825097D3E7B886456BB32E3E74516BF3FD93D71B257AA8F723E01CE33" "8015353D3778B02B892AF7#)\n" " (q #00BFF3F3CC18FA018A5B8155A8695E1E4939660D5E4759322C39D50F3B93E5F68B#)\n" " (g #6CCFD8219F5FCE8EF2BEF3262929787140847E38674B1EF8DB20255E212CB6330EC4" "DFE8A26AB7ECC5760DEB9BBF59A2B2821D510F1868172222867558B8D204E889C474" "7CA30FBF9D8CF41AE5D5BD845174641101593849FF333E6C93A6550931B2B9D56B98" "9CAB01729D9D736FA6D24A74D2DDE1E9E648D141473E443DD6BBF0B3CAB64F9FE4FC" "134B2EB57437789F75C744DF1FA67FA8A64603E5441BC7ECE29E00BDF262BDC81E8C" "7330A18A412DE38E7546D342B89A0AF675A89E6BEF00540EB107A2FE74EA402B0D89" "F5C02918DEEEAF8B8737AC866B09B50810AB8D8668834A1B9E1E53866E2B0A926FAB" "120A0CDE5B3715FFFE6ACD1AB73588DCC1EC4CE9392FE57F8D1D35811200CB07A0E6" "374E2C4B0AEB7E3D077B8545C0E438DCC0F1AE81E186930E99EBC5B91B77E92803E0" "21602887851A4FFDB3A7896AC655A0901218C121C5CBB0931E7D5EAC243F37711B5F" "D5A62B1B38A83F03D8F6703D8B98DF367FC8A76990335F62173A5391836F0F2413EC" "4997AF9EB55C6660B01A#)\n" " (y #2320B22434C5DB832B4EC267CC52E78DD5CCFA911E8F0804E7E7F32B186B2D4167AE" "4AA6869822E76400492D6A193B0535322C72B0B7AA4A87E33044FDC84BE24C64A053" "A37655EE9EABDCDC1FDF63F3F1C677CEB41595DF7DEFE9178D85A3D621B4E4775492" "8C0A58D2458D06F9562E4DE2FE6129A64063A99E88E54485B97484A28188C4D33F15" "DDC903B6CEA0135E3E3D27B4EA39319696305CE93D7BA7BE00367DBE3AAF43491E71" "CBF254744A5567F5D70090D6139E0C990239627B3A1C5B20B6F9F6374B8D8D8A8997" "437265BE1E3B4810D4B09254400DE287A0DFFBAEF339E48D422B1D41A37E642BC026" "73314701C8FA9792845C129351A87A945A03E6C895860E51D6FB8B7340A94D1A8A7B" "FA85AC83B4B14E73AB86CB96C236C8BFB0978B61B2367A7FE4F7891070F56C78D5DD" "F5576BFE5BE4F333A4E2664E79528B3294907AADD63F4F2E7AA8147B928D8CD69765" "3DB98C4297CB678046ED55C0DBE60BF7142C594603E4D705DC3D17270F9F086EC561" "2703D518D8D49FF0EBE6#)\n" " (x #00A9FFFC88E67D6F7B810E291C050BAFEA7FC4A75E8D2F16CFED3416FD77607232#)\n" "))\n"; static const char sample_public_dsa_key_3072[] = "(public-key\n" " (dsa\n" " (p #00BA73E148AEA5E8B64878AF5BE712B8302B9671C5F3EEB7722A9D0D9868D048C938" "877C91C335C7819292E69C7D34264F1578E32EC2DA8408DF75D0EB76E0D3030B84B5" "62D8EF93AB53BAB6B8A5DE464F5CA87AEA43BDCF0FB0B7815AA3114CFC84FD916A83" "B3D5FD78390189332232E9D037D215313FD002FF46C048B66703F87FAE092AAA0988" "AC745336EBE672A01DEDBD52395783579B67CF3AE1D6F1602CCCB12154FA0E00AE46" "0D9B289CF709194625BCB919B11038DEFC50ADBBA20C3F320078E4E9529B4F6848E2" "AB5E6278DB961FE226F2EEBD201E071C48C5BEF98B4D9BEE42C1C7102D893EBF8902" "D7A91266340AFD6CE1D09E52282FFF5B97EAFA3886A3FCF84FF76D1E06538D0D8E60" "B3332145785E07D29A5965382DE3470D1D888447FA9C00A2373378FC3FA7B9F7D17E" "95A6A5AE1397BE46D976EF2C96E89913AC4A09351CA661BF6F67E30407DA846946C7" "62D9BAA6B77825097D3E7B886456BB32E3E74516BF3FD93D71B257AA8F723E01CE33" "8015353D3778B02B892AF7#)\n" " (q #00BFF3F3CC18FA018A5B8155A8695E1E4939660D5E4759322C39D50F3B93E5F68B#)\n" " (g #6CCFD8219F5FCE8EF2BEF3262929787140847E38674B1EF8DB20255E212CB6330EC4" "DFE8A26AB7ECC5760DEB9BBF59A2B2821D510F1868172222867558B8D204E889C474" "7CA30FBF9D8CF41AE5D5BD845174641101593849FF333E6C93A6550931B2B9D56B98" "9CAB01729D9D736FA6D24A74D2DDE1E9E648D141473E443DD6BBF0B3CAB64F9FE4FC" "134B2EB57437789F75C744DF1FA67FA8A64603E5441BC7ECE29E00BDF262BDC81E8C" "7330A18A412DE38E7546D342B89A0AF675A89E6BEF00540EB107A2FE74EA402B0D89" "F5C02918DEEEAF8B8737AC866B09B50810AB8D8668834A1B9E1E53866E2B0A926FAB" "120A0CDE5B3715FFFE6ACD1AB73588DCC1EC4CE9392FE57F8D1D35811200CB07A0E6" "374E2C4B0AEB7E3D077B8545C0E438DCC0F1AE81E186930E99EBC5B91B77E92803E0" "21602887851A4FFDB3A7896AC655A0901218C121C5CBB0931E7D5EAC243F37711B5F" "D5A62B1B38A83F03D8F6703D8B98DF367FC8A76990335F62173A5391836F0F2413EC" "4997AF9EB55C6660B01A#)\n" " (y #2320B22434C5DB832B4EC267CC52E78DD5CCFA911E8F0804E7E7F32B186B2D4167AE" "4AA6869822E76400492D6A193B0535322C72B0B7AA4A87E33044FDC84BE24C64A053" "A37655EE9EABDCDC1FDF63F3F1C677CEB41595DF7DEFE9178D85A3D621B4E4775492" "8C0A58D2458D06F9562E4DE2FE6129A64063A99E88E54485B97484A28188C4D33F15" "DDC903B6CEA0135E3E3D27B4EA39319696305CE93D7BA7BE00367DBE3AAF43491E71" "CBF254744A5567F5D70090D6139E0C990239627B3A1C5B20B6F9F6374B8D8D8A8997" "437265BE1E3B4810D4B09254400DE287A0DFFBAEF339E48D422B1D41A37E642BC026" "73314701C8FA9792845C129351A87A945A03E6C895860E51D6FB8B7340A94D1A8A7B" "FA85AC83B4B14E73AB86CB96C236C8BFB0978B61B2367A7FE4F7891070F56C78D5DD" "F5576BFE5BE4F333A4E2664E79528B3294907AADD63F4F2E7AA8147B928D8CD69765" "3DB98C4297CB678046ED55C0DBE60BF7142C594603E4D705DC3D17270F9F086EC561" "2703D518D8D49FF0EBE6#)\n" "))\n"; #define DIM(v) (sizeof(v)/sizeof((v)[0])) #define DIMof(type,member) DIM(((type *)0)->member) #define BUG() do {fprintf ( stderr, "Ooops at %s:%d\n", __FILE__ , __LINE__ );\ exit(2);} while(0) /* Helper for the start and stop timer. */ #ifdef _WIN32 struct { FILETIME creation_time, exit_time, kernel_time, user_time; } started_at, stopped_at; #else static clock_t started_at, stopped_at; #endif static void die (const char *format, ...) { va_list arg_ptr ; va_start( arg_ptr, format ) ; putchar ('\n'); fputs ( PGM ": ", stderr); vfprintf (stderr, format, arg_ptr ); va_end(arg_ptr); exit (1); } static void show_sexp (const char *prefix, gcry_sexp_t a) { char *buf; size_t size; fputs (prefix, stderr); size = gcry_sexp_sprint (a, GCRYSEXP_FMT_ADVANCED, NULL, 0); buf = malloc (size); if (!buf) die ("out of core\n"); gcry_sexp_sprint (a, GCRYSEXP_FMT_ADVANCED, buf, size); fprintf (stderr, "%.*s", (int)size, buf); } static void start_timer (void) { #ifdef _WIN32 GetProcessTimes (GetCurrentProcess (), &started_at.creation_time, &started_at.exit_time, &started_at.kernel_time, &started_at.user_time); stopped_at = started_at; #else struct tms tmp; times (&tmp); started_at = stopped_at = tmp.tms_utime; #endif } static void stop_timer (void) { #ifdef _WIN32 GetProcessTimes (GetCurrentProcess (), &stopped_at.creation_time, &stopped_at.exit_time, &stopped_at.kernel_time, &stopped_at.user_time); #else struct tms tmp; times (&tmp); stopped_at = tmp.tms_utime; #endif } static const char * elapsed_time (void) { static char buf[50]; #if _WIN32 unsigned long long t1, t2, t; t1 = (((unsigned long long)started_at.kernel_time.dwHighDateTime << 32) + started_at.kernel_time.dwLowDateTime); t1 += (((unsigned long long)started_at.user_time.dwHighDateTime << 32) + started_at.user_time.dwLowDateTime); t2 = (((unsigned long long)stopped_at.kernel_time.dwHighDateTime << 32) + stopped_at.kernel_time.dwLowDateTime); t2 += (((unsigned long long)stopped_at.user_time.dwHighDateTime << 32) + stopped_at.user_time.dwLowDateTime); t = (t2 - t1)/10000; snprintf (buf, sizeof buf, "%5.0fms", (double)t ); #else snprintf (buf, sizeof buf, "%5.0fms", (((double) (stopped_at - started_at))/CLOCKS_PER_SEC)*10000000); #endif return buf; } static void random_bench (int very_strong) { char buf[128]; int i; printf ("%-10s", "random"); if (!very_strong) { start_timer (); for (i=0; i < 100; i++) gcry_randomize (buf, sizeof buf, GCRY_STRONG_RANDOM); stop_timer (); printf (" %s", elapsed_time ()); } start_timer (); for (i=0; i < 100; i++) gcry_randomize (buf, 8, very_strong? GCRY_VERY_STRONG_RANDOM:GCRY_STRONG_RANDOM); stop_timer (); printf (" %s", elapsed_time ()); putchar ('\n'); if (verbose) gcry_control (GCRYCTL_DUMP_RANDOM_STATS); } static void md_bench ( const char *algoname ) { int algo; gcry_md_hd_t hd; int i; char buf[1000]; gcry_error_t err = GPG_ERR_NO_ERROR; if (!algoname) { for (i=1; i < 400; i++) - if ( !gcry_md_test_algo (i) ) + if (in_fips_mode && i == GCRY_MD_MD5) + ; /* Don't use MD5 in fips mode. */ + else if ( !gcry_md_test_algo (i) ) md_bench (gcry_md_algo_name (i)); return; } algo = gcry_md_map_name (algoname); if (!algo) { fprintf (stderr, PGM ": invalid hash algorithm `%s'\n", algoname); exit (1); } err = gcry_md_open (&hd, algo, 0); if (err) { fprintf (stderr, PGM ": error opening hash algorithm `%s'\n", algoname); exit (1); } for (i=0; i < sizeof buf; i++) buf[i] = i; printf ("%-12s", gcry_md_algo_name (algo)); start_timer (); for (i=0; i < 1000; i++) gcry_md_write (hd, buf, sizeof buf); gcry_md_final (hd); stop_timer (); printf (" %s", elapsed_time ()); gcry_md_reset (hd); start_timer (); for (i=0; i < 10000; i++) gcry_md_write (hd, buf, sizeof buf/10); gcry_md_final (hd); stop_timer (); printf (" %s", elapsed_time ()); gcry_md_reset (hd); start_timer (); for (i=0; i < 1000000; i++) gcry_md_write (hd, "", 1); gcry_md_final (hd); stop_timer (); printf (" %s", elapsed_time ()); gcry_md_close (hd); putchar ('\n'); } static void cipher_bench ( const char *algoname ) { static int header_printed; int algo; gcry_cipher_hd_t hd; int i; int keylen, blklen; char key[128]; char *outbuf, *buf; size_t allocated_buflen, buflen; int repetitions; static struct { int mode; const char *name; int blocked; } modes[] = { { GCRY_CIPHER_MODE_ECB, "ECB", 1 }, { GCRY_CIPHER_MODE_CBC, "CBC", 1 }, { GCRY_CIPHER_MODE_CFB, "CFB", 0 }, { GCRY_CIPHER_MODE_OFB, "OFB", 0 }, { GCRY_CIPHER_MODE_CTR, "CTR", 0 }, { GCRY_CIPHER_MODE_STREAM, "STREAM", 0 }, {0} }; int modeidx; gcry_error_t err = GPG_ERR_NO_ERROR; if (!algoname) { for (i=1; i < 400; i++) if ( !gcry_cipher_test_algo (i) ) cipher_bench (gcry_cipher_algo_name (i)); return; } if (large_buffers) { allocated_buflen = 1024 * 100; repetitions = 10; } else { allocated_buflen = 1024; repetitions = 1000; } repetitions *= cipher_repetitions; buf = gcry_xmalloc (allocated_buflen); outbuf = gcry_xmalloc (allocated_buflen); if (!header_printed) { if (cipher_repetitions != 1) printf ("Running each test %d times.\n", cipher_repetitions); printf ("%-12s", ""); for (modeidx=0; modes[modeidx].mode; modeidx++) printf (" %-15s", modes[modeidx].name ); putchar ('\n'); printf ("%-12s", ""); for (modeidx=0; modes[modeidx].mode; modeidx++) printf (" ---------------" ); putchar ('\n'); header_printed = 1; } algo = gcry_cipher_map_name (algoname); if (!algo) { fprintf (stderr, PGM ": invalid cipher algorithm `%s'\n", algoname); exit (1); } keylen = gcry_cipher_get_algo_keylen (algo); if (!keylen) { fprintf (stderr, PGM ": failed to get key length for algorithm `%s'\n", algoname); exit (1); } if ( keylen > sizeof key ) { fprintf (stderr, PGM ": algo %d, keylength problem (%d)\n", algo, keylen ); exit (1); } for (i=0; i < keylen; i++) key[i] = i + (clock () & 0xff); blklen = gcry_cipher_get_algo_blklen (algo); if (!blklen) { fprintf (stderr, PGM ": failed to get block length for algorithm `%s'\n", algoname); exit (1); } printf ("%-12s", gcry_cipher_algo_name (algo)); fflush (stdout); for (modeidx=0; modes[modeidx].mode; modeidx++) { if ((blklen > 1 && modes[modeidx].mode == GCRY_CIPHER_MODE_STREAM) | (blklen == 1 && modes[modeidx].mode != GCRY_CIPHER_MODE_STREAM)) { printf (" " ); continue; } for (i=0; i < sizeof buf; i++) buf[i] = i; err = gcry_cipher_open (&hd, algo, modes[modeidx].mode, 0); if (err) { fprintf (stderr, PGM ": error opening cipher `%s'\n", algoname); exit (1); } err = gcry_cipher_setkey (hd, key, keylen); if (err) { fprintf (stderr, "gcry_cipher_setkey failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hd); exit (1); } buflen = allocated_buflen; if (modes[modeidx].blocked) buflen = (buflen / blklen) * blklen; start_timer (); for (i=err=0; !err && i < repetitions; i++) err = gcry_cipher_encrypt ( hd, outbuf, buflen, buf, buflen); stop_timer (); printf (" %s", elapsed_time ()); fflush (stdout); gcry_cipher_close (hd); if (err) { fprintf (stderr, "gcry_cipher_encrypt failed: %s\n", gpg_strerror (err) ); exit (1); } err = gcry_cipher_open (&hd, algo, modes[modeidx].mode, 0); if (err) { fprintf (stderr, PGM ": error opening cipher `%s'/n", algoname); exit (1); } err = gcry_cipher_setkey (hd, key, keylen); if (err) { fprintf (stderr, "gcry_cipher_setkey failed: %s\n", gpg_strerror (err)); gcry_cipher_close (hd); exit (1); } start_timer (); for (i=err=0; !err && i < repetitions; i++) err = gcry_cipher_decrypt ( hd, outbuf, buflen, buf, buflen); stop_timer (); printf (" %s", elapsed_time ()); fflush (stdout); gcry_cipher_close (hd); if (err) { fprintf (stderr, "gcry_cipher_decrypt failed: %s\n", gpg_strerror (err) ); exit (1); } } putchar ('\n'); gcry_free (buf); gcry_free (outbuf); } static void rsa_bench (int iterations, int print_header, int no_blinding) { gpg_error_t err; int p_sizes[] = { 1024, 2048, 3072, 4096 }; int testno; if (print_header) printf ("Algorithm generate %4d*sign %4d*verify\n" "------------------------------------------------\n", iterations, iterations ); for (testno=0; testno < DIM (p_sizes); testno++) { gcry_sexp_t key_spec, key_pair, pub_key, sec_key; gcry_mpi_t x; gcry_sexp_t data; gcry_sexp_t sig = NULL; int count; printf ("RSA %3d bit ", p_sizes[testno]); fflush (stdout); err = gcry_sexp_build (&key_spec, NULL, gcry_control (GCRYCTL_FIPS_MODE_P, 0) ? "(genkey (RSA (nbits %d)))" : "(genkey (RSA (nbits %d)(transient-key)))", p_sizes[testno]); if (err) die ("creating S-expression failed: %s\n", gcry_strerror (err)); start_timer (); err = gcry_pk_genkey (&key_pair, key_spec); if (err) die ("creating %d bit RSA key failed: %s\n", p_sizes[testno], gcry_strerror (err)); pub_key = gcry_sexp_find_token (key_pair, "public-key", 0); if (! pub_key) die ("public part missing in key\n"); sec_key = gcry_sexp_find_token (key_pair, "private-key", 0); if (! sec_key) die ("private part missing in key\n"); gcry_sexp_release (key_pair); gcry_sexp_release (key_spec); stop_timer (); printf (" %s", elapsed_time ()); fflush (stdout); x = gcry_mpi_new (p_sizes[testno]); gcry_mpi_randomize (x, p_sizes[testno]-8, GCRY_WEAK_RANDOM); err = gcry_sexp_build (&data, NULL, "(data (flags raw) (value %m))", x); gcry_mpi_release (x); if (err) die ("converting data failed: %s\n", gcry_strerror (err)); start_timer (); for (count=0; count < iterations; count++) { gcry_sexp_release (sig); err = gcry_pk_sign (&sig, data, sec_key); if (err) die ("signing failed (%d): %s\n", count, gpg_strerror (err)); } stop_timer (); printf (" %s", elapsed_time ()); fflush (stdout); start_timer (); for (count=0; count < iterations; count++) { err = gcry_pk_verify (sig, data, pub_key); if (err) { putchar ('\n'); show_sexp ("seckey:\n", sec_key); show_sexp ("data:\n", data); show_sexp ("sig:\n", sig); die ("verify failed (%d): %s\n", count, gpg_strerror (err)); } } stop_timer (); printf (" %s", elapsed_time ()); if (no_blinding) { fflush (stdout); x = gcry_mpi_new (p_sizes[testno]); gcry_mpi_randomize (x, p_sizes[testno]-8, GCRY_WEAK_RANDOM); err = gcry_sexp_build (&data, NULL, "(data (flags no-blinding) (value %m))", x); gcry_mpi_release (x); if (err) die ("converting data failed: %s\n", gcry_strerror (err)); start_timer (); for (count=0; count < iterations; count++) { gcry_sexp_release (sig); err = gcry_pk_sign (&sig, data, sec_key); if (err) die ("signing failed (%d): %s\n", count, gpg_strerror (err)); } stop_timer (); printf (" %s", elapsed_time ()); fflush (stdout); } putchar ('\n'); fflush (stdout); gcry_sexp_release (sig); gcry_sexp_release (data); gcry_sexp_release (sec_key); gcry_sexp_release (pub_key); } } static void dsa_bench (int iterations, int print_header) { gpg_error_t err; gcry_sexp_t pub_key[3], sec_key[3]; int p_sizes[3] = { 1024, 2048, 3072 }; int q_sizes[3] = { 160, 224, 256 }; gcry_sexp_t data; gcry_sexp_t sig; int i, j; err = gcry_sexp_sscan (pub_key+0, NULL, sample_public_dsa_key_1024, strlen (sample_public_dsa_key_1024)); if (!err) err = gcry_sexp_sscan (sec_key+0, NULL, sample_private_dsa_key_1024, strlen (sample_private_dsa_key_1024)); if (!err) err = gcry_sexp_sscan (pub_key+1, NULL, sample_public_dsa_key_2048, strlen (sample_public_dsa_key_2048)); if (!err) err = gcry_sexp_sscan (sec_key+1, NULL, sample_private_dsa_key_2048, strlen (sample_private_dsa_key_2048)); if (!err) err = gcry_sexp_sscan (pub_key+2, NULL, sample_public_dsa_key_3072, strlen (sample_public_dsa_key_3072)); if (!err) err = gcry_sexp_sscan (sec_key+2, NULL, sample_private_dsa_key_3072, strlen (sample_private_dsa_key_3072)); if (err) { fprintf (stderr, PGM ": converting sample keys failed: %s\n", gcry_strerror (err)); exit (1); } if (print_header) printf ("Algorithm generate %4d*sign %4d*verify\n" "------------------------------------------------\n", iterations, iterations ); for (i=0; i < DIM (q_sizes); i++) { gcry_mpi_t x; x = gcry_mpi_new (q_sizes[i]); gcry_mpi_randomize (x, q_sizes[i], GCRY_WEAK_RANDOM); err = gcry_sexp_build (&data, NULL, "(data (flags raw) (value %m))", x); gcry_mpi_release (x); if (err) { fprintf (stderr, PGM ": converting data failed: %s\n", gcry_strerror (err)); exit (1); } printf ("DSA %d/%d -", p_sizes[i], q_sizes[i]); fflush (stdout); start_timer (); for (j=0; j < iterations; j++) { err = gcry_pk_sign (&sig, data, sec_key[i]); if (err) { putchar ('\n'); fprintf (stderr, PGM ": signing failed: %s\n", gpg_strerror (err)); exit (1); } } stop_timer (); printf (" %s", elapsed_time ()); fflush (stdout); start_timer (); for (j=0; j < iterations; j++) { err = gcry_pk_verify (sig, data, pub_key[i]); if (err) { putchar ('\n'); fprintf (stderr, PGM ": verify failed: %s\n", gpg_strerror (err)); exit (1); } } stop_timer (); printf (" %s\n", elapsed_time ()); fflush (stdout); gcry_sexp_release (sig); gcry_sexp_release (data); } for (i=0; i < DIM (q_sizes); i++) { gcry_sexp_release (sec_key[i]); gcry_sexp_release (pub_key[i]); } } static void ecc_bench (int iterations, int print_header) { #if USE_ECC gpg_error_t err; int p_sizes[] = { 192, 224, 256, 384, 521 }; int testno; if (print_header) printf ("Algorithm generate %4d*sign %4d*verify\n" "------------------------------------------------\n", iterations, iterations ); for (testno=0; testno < DIM (p_sizes); testno++) { gcry_sexp_t key_spec, key_pair, pub_key, sec_key; gcry_mpi_t x; gcry_sexp_t data; gcry_sexp_t sig = NULL; int count; printf ("ECDSA %3d bit ", p_sizes[testno]); fflush (stdout); err = gcry_sexp_build (&key_spec, NULL, "(genkey (ECDSA (nbits %d)))", p_sizes[testno]); if (err) die ("creating S-expression failed: %s\n", gcry_strerror (err)); start_timer (); err = gcry_pk_genkey (&key_pair, key_spec); if (err) die ("creating %d bit ECC key failed: %s\n", p_sizes[testno], gcry_strerror (err)); pub_key = gcry_sexp_find_token (key_pair, "public-key", 0); if (! pub_key) die ("public part missing in key\n"); sec_key = gcry_sexp_find_token (key_pair, "private-key", 0); if (! sec_key) die ("private part missing in key\n"); gcry_sexp_release (key_pair); gcry_sexp_release (key_spec); stop_timer (); printf (" %s", elapsed_time ()); fflush (stdout); x = gcry_mpi_new (p_sizes[testno]); gcry_mpi_randomize (x, p_sizes[testno], GCRY_WEAK_RANDOM); err = gcry_sexp_build (&data, NULL, "(data (flags raw) (value %m))", x); gcry_mpi_release (x); if (err) die ("converting data failed: %s\n", gcry_strerror (err)); start_timer (); for (count=0; count < iterations; count++) { gcry_sexp_release (sig); err = gcry_pk_sign (&sig, data, sec_key); if (err) die ("signing failed: %s\n", gpg_strerror (err)); } stop_timer (); printf (" %s", elapsed_time ()); fflush (stdout); start_timer (); for (count=0; count < iterations; count++) { err = gcry_pk_verify (sig, data, pub_key); if (err) { putchar ('\n'); show_sexp ("seckey:\n", sec_key); show_sexp ("data:\n", data); show_sexp ("sig:\n", sig); die ("verify failed: %s\n", gpg_strerror (err)); } } stop_timer (); printf (" %s\n", elapsed_time ()); fflush (stdout); gcry_sexp_release (sig); gcry_sexp_release (data); gcry_sexp_release (sec_key); gcry_sexp_release (pub_key); } #endif /*USE_ECC*/ } static void do_powm ( const char *n_str, const char *e_str, const char *m_str) { gcry_mpi_t e, n, msg, cip; gcry_error_t err; int i; err = gcry_mpi_scan (&n, GCRYMPI_FMT_HEX, n_str, 0, 0); if (err) BUG (); err = gcry_mpi_scan (&e, GCRYMPI_FMT_HEX, e_str, 0, 0); if (err) BUG (); err = gcry_mpi_scan (&msg, GCRYMPI_FMT_HEX, m_str, 0, 0); if (err) BUG (); cip = gcry_mpi_new (0); start_timer (); for (i=0; i < 1000; i++) gcry_mpi_powm (cip, msg, e, n); stop_timer (); printf (" %s", elapsed_time ()); fflush (stdout); /* { */ /* char *buf; */ /* if (gcry_mpi_aprint (GCRYMPI_FMT_HEX, (void**)&buf, NULL, cip)) */ /* BUG (); */ /* printf ("result: %s\n", buf); */ /* gcry_free (buf); */ /* } */ gcry_mpi_release (cip); gcry_mpi_release (msg); gcry_mpi_release (n); gcry_mpi_release (e); } static void mpi_bench (void) { printf ("%-10s", "powm"); fflush (stdout); do_powm ( "20A94417D4D5EF2B2DA99165C7DC87DADB3979B72961AF90D09D59BA24CB9A10166FDCCC9C659F2B9626EC23F3FA425F564A072BA941B03FA81767CC289E4", "29", "B870187A323F1ECD5B8A0B4249507335A1C4CE8394F38FD76B08C78A42C58F6EA136ACF90DFE8603697B1694A3D81114D6117AC1811979C51C4DD013D52F8" ); do_powm ( "20A94417D4D5EF2B2DA99165C7DC87DADB3979B72961AF90D09D59BA24CB9A10166FDCCC9C659F2B9626EC23F3FA425F564A072BA941B03FA81767CC289E41071F0246879A442658FBD18C1771571E7073EEEB2160BA0CBFB3404D627069A6CFBD53867AD2D9D40231648000787B5C84176B4336144644AE71A403CA40716", "29", "B870187A323F1ECD5B8A0B4249507335A1C4CE8394F38FD76B08C78A42C58F6EA136ACF90DFE8603697B1694A3D81114D6117AC1811979C51C4DD013D52F8FC4EE4BB446B83E48ABED7DB81CBF5E81DE4759E8D68AC985846D999F96B0D8A80E5C69D272C766AB8A23B40D50A4FA889FBC2BD2624222D8EB297F4BAEF8593847" ); do_powm ( "20A94417D4D5EF2B2DA99165C7DC87DADB3979B72961AF90D09D59BA24CB9A10166FDCCC9C659F2B9626EC23F3FA425F564A072BA941B03FA81767CC289E41071F0246879A442658FBD18C1771571E7073EEEB2160BA0CBFB3404D627069A6CFBD53867AD2D9D40231648000787B5C84176B4336144644AE71A403CA4071620A94417D4D5EF2B2DA99165C7DC87DADB3979B72961AF90D09D59BA24CB9A10166FDCCC9C659F2B9626EC23F3FA425F564A072BA941B03FA81767CC289E41071F0246879A442658FBD18C1771571E7073EEEB2160BA0CBFB3404D627069A6CFBD53867AD2D9D40231648000787B5C84176B4336144644AE71A403CA40716", "29", "B870187A323F1ECD5B8A0B4249507335A1C4CE8394F38FD76B08C78A42C58F6EA136ACF90DFE8603697B1694A3D81114D6117AC1811979C51C4DD013D52F8FC4EE4BB446B83E48ABED7DB81CBF5E81DE4759E8D68AC985846D999F96B0D8A80E5C69D272C766AB8A23B40D50A4FA889FBC2BD2624222D8EB297F4BAEF8593847B870187A323F1ECD5B8A0B4249507335A1C4CE8394F38FD76B08C78A42C58F6EA136ACF90DFE8603697B1694A3D81114D6117AC1811979C51C4DD013D52F8FC4EE4BB446B83E48ABED7DB81CBF5E81DE4759E8D68AC985846D999F96B0D8A80E5C69D272C766AB8A23B40D50A4FA889FBC2BD2624222D8EB297F4BAEF8593847" ); putchar ('\n'); } int main( int argc, char **argv ) { int last_argc = -1; int no_blinding = 0; int use_random_daemon = 0; if (argc) { argc--; argv++; } while (argc && last_argc != argc ) { last_argc = argc; if (!strcmp (*argv, "--")) { argc--; argv++; break; } else if (!strcmp (*argv, "--help")) { fputs ("usage: benchmark " "[md|cipher|random|mpi|rsa|dsa|ecc [algonames]]\n", stdout); exit (0); } else if (!strcmp (*argv, "--verbose")) { verbose++; argc--; argv++; } else if (!strcmp (*argv, "--use-random-daemon")) { use_random_daemon = 1; argc--; argv++; } else if (!strcmp (*argv, "--no-blinding")) { no_blinding = 1; argc--; argv++; } else if (!strcmp (*argv, "--large-buffers")) { large_buffers = 1; argc--; argv++; } else if (!strcmp (*argv, "--cipher-repetition")) { argc--; argv++; if (argc) { cipher_repetitions = atoi(*argv); argc--; argv++; } } else if (!strcmp (*argv, "--fips")) { argc--; argv++; /* This command needs to be called before gcry_check_version. */ gcry_control (GCRYCTL_FORCE_FIPS_MODE, 0); } } gcry_control (GCRYCTL_SET_VERBOSITY, (int)verbose); if (!gcry_check_version (GCRYPT_VERSION)) { fprintf (stderr, PGM ": version mismatch\n"); exit (1); } - if (!gcry_fips_mode_active ()) + if (gcry_fips_mode_active ()) + in_fips_mode = 1; + else gcry_control (GCRYCTL_DISABLE_SECMEM, 0); if (use_random_daemon) gcry_control (GCRYCTL_USE_RANDOM_DAEMON, 1); gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0); if (cipher_repetitions < 1) cipher_repetitions = 1; if ( !argc ) { gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0); md_bench (NULL); putchar ('\n'); cipher_bench (NULL); putchar ('\n'); rsa_bench (100, 1, no_blinding); dsa_bench (100, 0); ecc_bench (100, 0); putchar ('\n'); mpi_bench (); putchar ('\n'); random_bench (0); } else if ( !strcmp (*argv, "random") || !strcmp (*argv, "strongrandom")) { if (argc == 1) random_bench ((**argv == 's')); else if (argc == 2) { gcry_control (GCRYCTL_SET_RANDOM_SEED_FILE, argv[1]); random_bench ((**argv == 's')); gcry_control (GCRYCTL_UPDATE_RANDOM_SEED_FILE); } else fputs ("usage: benchmark [strong]random [seedfile]\n", stdout); } else if ( !strcmp (*argv, "md")) { if (argc == 1) md_bench (NULL); else for (argc--, argv++; argc; argc--, argv++) md_bench ( *argv ); } else if ( !strcmp (*argv, "cipher")) { if (argc == 1) cipher_bench (NULL); else for (argc--, argv++; argc; argc--, argv++) cipher_bench ( *argv ); } else if ( !strcmp (*argv, "mpi")) { mpi_bench (); } else if ( !strcmp (*argv, "rsa")) { gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0); rsa_bench (100, 1, no_blinding); } else if ( !strcmp (*argv, "dsa")) { gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0); dsa_bench (100, 1); } else if ( !strcmp (*argv, "ecc")) { gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0); ecc_bench (100, 1); } else { fprintf (stderr, PGM ": bad arguments\n"); return 1; } + + + if (in_fips_mode && !gcry_fips_mode_active ()) + fprintf (stderr, PGM ": FIPS mode is not anymore active\n"); return 0; }