aboutsummaryrefslogtreecommitdiffstats
path: root/cipher (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Do not use C99 feature.Dario Niedermann2017-11-101-3/+4
| | | | | | | | | * cipher/rsa.c (secret): Move var decl to the beginning. -- Trivial patch; ChangeLog written by wk. Signed-off-by: Werner Koch <[email protected]>
* rsa: Reduce secmem pressure.NIIBE Yutaka2017-07-071-1/+8
| | | | | | * cipher/rsa.c (secret): Don't keep secmem. Signed-off-by: NIIBE Yutaka <[email protected]>
* rsa: Allow different build directory.NIIBE Yutaka2017-07-072-2/+2
| | | | | | | * cipher/Makefile.am (AM_CPPFLAGS): Add mpi dirs. * cipher/rsa.c: Change include file. Signed-off-by: NIIBE Yutaka <[email protected]>
* rsa: Add exponent blinding.Marcus Brinkmann2017-07-071-4/+29
| | | | | | | | | | | * cipher/rsa.c (secret_core_crt): Blind secret D with randomized nonce R for mpi_powm computation. -- Backport of libgcrypt 8725c99ffa41778f382ca97233183bcd687bb0ce. Signed-off-by: Marcus Brinkmann <[email protected]>
* random: Hash continuous areas in the csprng pool.Werner Koch2016-08-171-8/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * cipher/random.c (mix_pool): Store the first hash at the end of the pool. -- This fixes a long standing bug (since 1998) in Libgcrypt and GnuPG. An attacker who obtains 580 bytes of the random number from the standard RNG can trivially predict the next 20 bytes of output. This bug does not affect the default generation of keys because running gpg for key creation creates at most 2 keys from the pool: For a single 4096 bit RSA key 512 byte of random are required and thus for the second key (encryption subkey), 20 bytes could be predicted from the the first key. However, the security of an OpenPGP key depends on the primary key (which was generated first) and thus the 20 predictable bytes should not be a problem. For the default key length of 2048 bit nothing will be predictable. For the former default of DSA+Elgamal key it is complicate to give an answer: For 2048 bit keys a pool of 30 non-secret candidate primes of about 300 bits each are first created. This reads at least 1140 bytes from the pool and thus parts could be predicted. At some point a 256 bit secret is read from the pool; which in the worst case might be partly predictable. The bug was found and reported by Felix Dörre and Vladimir Klebanov, Karlsruhe Institute of Technology. A paper describing the problem in detail will shortly be published. CVE-id: CVE-2016-6313 Signed-off-by: Werner Koch <[email protected]>
* cipher: Improve readability by using a macro.Werner Koch2016-08-171-2/+2
| | | | | | * cipher/random.c (mix_pool): Use DIGESTLEN instead of 20. Signed-off-by: Werner Koch <[email protected]>
* Clean up "allow to"Daniel Kahn Gillmor2016-08-042-3/+3
| | | | | | | | | | | | | | | * README, cipher/cipher.c, cipher/pubkey.c, doc/gpg.texi: replace "allow to" with clearer text In standard English, the normal construction is "${XXX} allows ${YYY} to" -- that is, the subject (${XXX}) of the sentence is allowing the object (${YYY}) to do something. When the object is missing, the phrasing sounds awkward, even if the object is implied by context. There's almost always a better construction that isn't as awkward. These changes should make the language a bit clearer. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* Fix spelling: "occured" should be "occurred"Daniel Kahn Gillmor2016-08-041-1/+1
| | | | | | | | * checks/armor.test, cipher/des.c, g10/ccid-driver.c, g10/pkclist.c, util/regcomp.c, util/regex_internal.c: correct the spelling of "occured" to "occurred" Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* Fix possible sign extension problem with newer compilers.Werner Koch2016-02-015-41/+41
| | | | | | | | | | | | | | | | | | | | * cipher/des.c (READ_64BIT_DATA): Cast to u32 before shifting by 24. * cipher/blowfish.c (do_encrypt_block): Ditto. (do_decrypt_block): Ditto. * cipher/camellia.c (CAMELLIA_RR8): Ditto. * cipher/cast5.c (do_encrypt_block): Ditto. (do_decrypt_block): Ditto. (do_cast_setkey): Ditto. * cipher/twofish.c (INPACK): Ditto. * util/iobuf.c (block_filter): Ditto. -- For cipher/des.c Reported-by: Balint Reczey <[email protected]> See commit 57af33d9e7c9b20b413b96882e670e75a67a5e65 for details. Signed-off-by: Werner Koch <[email protected]>
* Fix possible AIX problem with sysconf in rndunix.Werner Koch2016-01-151-3/+12
| | | | | | | | | | | | | * cipher/rndunix.c [HAVE_STDINT_H]: Include stdint.h. (start_gatherer): Detect misbehaving sysconf. -- See GnuPG-bug-id: 1778 for the reason of this patch. There is no concrete bug report but this chnage should not harm. Signed-off-by: Werner Koch <[email protected]>
* Obsolete option --no-sig-create-check.Werner Koch2015-09-011-1/+12
| | | | | | | | | * cipher/rsa.c (rsa_sign): Verify after sign. * g10/gpg.c (opts): Make --no-sig-create-check a NOP. * g10/options.h (opt): Remove field "no_sig_create_check". * g10/sign.c (do_sign): Do check only for DSA. Signed-off-by: Werner Koch <[email protected]>
* Add convenience function to hash a buffer.Werner Koch2015-02-261-1/+18
| | | | | | * cipher/sha1.c (sha1_hash_buffer): New. Signed-off-by: Werner Koch <[email protected]>
* Use ciphertext blinding for Elgamal decryption.Werner Koch2015-02-111-14/+49
| | | | | | | | | | | | | | | | | | | * cipher/elgamal.c (USE_BLINDING): New. (decrypt): Rewrite to use ciphertext blinding. -- CVE-id: CVE-2014-3591 As a countermeasure to a new side-channel attacks on sliding windows exponentiation we blind the ciphertext for Elgamal decryption. This is similar to what we are doing with RSA. Unfortunately, the performance impact of Elgamal blinding is quite noticeable: For a 3072 bit Elgamal key the decryption used to take 13ms; with the blinding it takes 24ms. This has been measured using time(1), calling gpg with a 100 byte message, and having gpg modified to run the pubkey_decrypt function 100 times and finally scale the result (using an i5-2410M CPU @ 2.30GHz TP 220).
* Fix a problem with select and high fds.Werner Koch2015-01-192-15/+22
| | | | | | | | | | | | | | | | | | | | | * cipher/rndlinux.c (rndlinux_gather_random): Check fd before using FD_SET. -- If on systems where the maximum number of fds may be dynamically configured to a value of FD_MAXSIZE or higher and the RNG is first used after more than FD_SETSIZE-1 descriptors are in use, we disable the progress messages from the RNG. A better solution would be too use poll but that requires more tests. The same problem exists in rndunix.c - however this rng is only used on old Unices and I assume that they don't feature dynamically configured maximum fd sizes. (from Libgcrypt commit 9487099071af4478d2882e633a0ade805801d6fa) This may fix GnuPG-bug-id: 1818
* Fix strict-alias warnings for rijndael.cWerner Koch2014-08-201-19/+19
| | | | | | | * cipher/rijndael.c (do_setkey, prepare_decryption): Use u32_a_t cast. -- This extends commit 0ad1458f827c7602ef7f1a4652af05641fd02b62
* Normalize the MPIs used as input to secret key functions.Werner Koch2013-12-033-6/+25
| | | | | | | | | | | | | | | | | | | * cipher/rsa.c (secret): Normalize the INPUT. (rsa_decrypt): Pass reduced data to secret. * cipher/elgamal.c (decrypt): Normalize A and B. * cipher/dsa.c (sign): Normalize HASH. -- mpi_normalize is in general not required because extra leading zeroes do not harm the computation. However, adding extra all zero limbs or padding with multiples of N may be useful in side-channel attacks. In particular they are used by the acoustic crypt-analysis. This is an extra pre-caution which alone would not be sufficient to mitigate the described attack. CVE-id: CVE-2013-4576 Signed-off-by: Werner Koch <[email protected]>
* Use blinding for the RSA secret operation.Werner Koch2013-12-033-17/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * cipher/random.c (randomize_mpi): New. * g10/gpgv.c (randomize_mpi): New stub. * cipher/rsa.c (USE_BLINDING): Define macro. (secret): Implement blinding. -- GPG 1.x has never used any protection against timing attacks on the RSA secret operation. The rationale for this has been that there was no way to mount a remote timing attack on GnuPG. With the turning up of Acoustic Cryptanalysis (http://cs.tau.ac.il/~tromer/acoustic) this assumption no longer holds true and thus we need to do do something about it. Blinding seems to be a suitable mitigation to the threat of key extraction. It does not help against distinguishing used keys, though. Note that GPG 2.x uses Libgcrypt which does blinding by default. The performance penalty is negligible: Modifying the core pubkey_sign or pubkey_decrypt function to run 100 times in a loop, the entire execution times for signing or decrypting a small message using a 4K RSA key on a Thinkpad X220 are Without blinding: 5.2s (8.9s) With blinding: 5.6s (9.3s) The numbers in parentheses give the values without the recently implemented k-ary exponentiation code. Thus for the next release the user will actually experience faster signing and decryption. A drawback of blinding is that we need random numbers even for decryption (albeit at low quality). Signed-off-by: Werner Koch <[email protected]> CVE-id: CVE-2013-4576
* Fix idea.c for big endian CPUs.Werner Koch2013-01-111-7/+7
| | | | | | * cipher/idea.c: Replace use of WORDS_BIGENDIAN by BIG_ENDIAN_HOST. -- GnuPG-bug-id: 1461
* Support the not anymore patented IDEA cipher algorithm.Werner Koch2012-11-083-188/+414
| | | | | | | | | | | | | | | | | | | | | | | | * cipher/idea.c: New. Take from Libgcrypt master and adjust for direct use in GnuPG. * cipher/idea-stub.c: Remove. * cipher/Makefile.am: Add idea.c and remove idea-stub.c rules. * configure.ac: Remove idea-stub code. * g10/gpg.c (check_permissions): Remove code path for ITEM==2. (main): Make --load-extension a dummy option. * g10/keygen.c (keygen_set_std_prefs): Include IDEA only in PGP2 compatibility mode. * g10/misc.c (idea_cipher_warn): Remove. Also remove all callers. * g10/seckey-cert.c (do_check): Remove emitting of STATUS_RSA_OR_IDEA. * g10/status.c (get_status_string): Remove STATUS_RSA_OR_IDEA. * g10/status.h (STATUS_RSA_OR_IDEA): Remove. -- To keep the number of actually used algorithms low, we support IDEA only in a basically read-only way (unless --pgp2 is used during key generation). It does not make sense to suggest the use of this old 64 bit blocksize algorithm. However, there is old data available where it might be helpful to have IDEA available.
* Fix usage of dlerror to conform to POSIX.Werner Koch2012-11-071-6/+8
| | | | | | | | | * cipher/idea-stub.c: Clear last error before dlsym. -- This is required for NetBSD. Reported-by: Thomas Klausner
* Improve handling of random_seed read errors.Werner Koch2012-11-071-1/+25
| | | | | | | | | | | * cipher/random.c (read_seed_file): Distinguish between errors and short reads. -- This should help to avoid program aborts due to races. Nevertheless a better and cross-platform locking would be a more solid solution. GnuPG-bug-id: 1439
* Remove trailing white space from one fileWerner Koch2012-11-071-10/+10
| | | | --
* Fix typos in comments.Werner Koch2012-01-242-3/+3
| | | | | -- Fixes provided by Gilles Espinasse.
* Typo fixes and comment re-formatting.Werner Koch2012-01-121-5/+6
|
* Use gcc pragmas to suppress some warnings.Werner Koch2012-01-101-11/+15
| | | | | | | | | * configure.ac (AH_BOTTOM): Add GNUPG_GCC_VERSION macro. * util/estream-printf.c (pr_float): Use new gcc pragma to ignore a warning about a non-literal format. * util/miscutil.c (asctimestamp): Ditto. * cipher/md.c (md_stop_debug): Use new gcc pragme to ignore a warning * about a set but unused variable.
* Rename all ChangeLog files to ChangeLog-2011.Werner Koch2011-12-021-2/+9
| | | | * ChangeLog: New file.
* Removed some set but unused vars.Werner Koch2011-08-092-12/+19
|
* Fix aliasing problem.Werner Koch2011-08-091-1035/+1043
|
* Add a minor feature for w32.gnupg-1.4.11Werner Koch2010-10-182-3/+14
|
* The rest of the VMS changes.Werner Koch2010-09-281-0/+2
|
* Minor changes to help the VMS portWerner Koch2010-09-282-3/+60
|
* Minor fixesWerner Koch2010-08-311-0/+4
|
* Revert that last stupid setuid detection fix.Werner Koch2008-07-172-2/+2
|
* Add Camellia-192.David Shaw2008-04-173-4/+43
|
* Improved AES performance.Werner Koch2008-03-224-240/+369
|
* Updated ZH po file.Werner Koch2007-12-122-0/+14
| | | | | | Allow de/encryption using legacy type 20 keys. Updated config.{sub,guess}
* Allow decryption using type 20 key.Werner Koch2007-12-112-0/+11
|
* Add 128-bit variant of Camellia.David Shaw2007-11-293-13/+53
|
* * sha256.c (sha224_get_info): 4880 has an error in the SHA-224 OID andDavid Shaw2007-11-282-2/+7
| | | | | we inherited it. Fixing.
* Switched to GPLv3.Werner Koch2007-10-2340-153/+80
| | | | | Updated gettext.
* Add an extra warning for Camellia.Werner Koch2007-07-093-2/+8
| | | | | | Minor W32 fix Address change.
* Add Camellia. Do not enable this if you are not doing interopDavid Shaw2007-06-137-4/+1727
| | | | | | | testing. It is not (yet) legal OpenPGP, is not interop tested yet (obviously), and it's a great way to lose your data. Just don't do it.
* Removed the use of g10defs.h.Werner Koch2006-12-116-27/+48
| | | | | | This required some code cleanups and the introduction of a few accessor ducntions in mpi.
* Preparing an RCWerner Koch2006-11-292-1/+6
|
* * rsa.c (generate): Use e=65537 for new RSA keys.David Shaw2006-06-282-13/+13
|
* (generate): Tweak to allow keys larger than 1024 bits. Enforce that the qDavid Shaw2006-04-202-1/+4
| | | | | size doesn't end between byte boundaries.
* The plumbing necessary to create DSA keys with variable sized q.David Shaw2006-04-202-9/+28
| | | | | Not yet used (q==160).
* Add SHA-224 supportDavid Shaw2006-04-204-5/+83
|
* * blowfish.c, md5.c, rmd160.c, sha1.c, sha256.c, sha512.c: Revert previousDavid Shaw2006-03-207-13/+18
| | | | | change. It's now all done in configure.
* * blowfish.c, md5.c, rmd160.c, sha1.c, sha256.c, sha512.c: Use '#if'David Shaw2006-03-207-13/+21
| | | | | | | rather than '#ifdef' BIG_ENDIAN_HOST. Harmless as we explicitly define BIG_ENDIAN_HOST to 1 when we need it, but needed for OSX fat builds when we define BIG_ENDIAN_HOST to another macro.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-16 07:46:17 +0000