开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 3

_service:tar_scm:nettle.spec Changed

_service:tar_scm:0000-nettle-3.3-remove-ecc-testsuite.patch Changed

@@ -1,8 +1,8 @@
-From b519b23a141752043c9cc9182048c26d80d22af2 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <dueno@redhat.com>
-Date: Sun, 21 Mar 2021 11:09:51 +0100
-Subject: PATCH Remove secp192r1 and secp224r1 support
- 
+From dc6d8a471e38443803e102db560b4db43f5c4191 Mon Sep 17 00:00:00 2001
+From: han_hui_hui <hanhuihui5@huawei.com>
+Date: Fri, 1 Dec 2023 08:22:55 +0000
+Subject: PATCH 1
+
 ---
 eccdata.c | 67 +----------------------------------
 examples/ecc-benchmark.c | 2 --
@@ -12,12 +12,12 @@
 testsuite/ecdsa-verify-test.c | 28 ---------------
 testsuite/testutils.c | 20 -----------
 7 files changed, 1 insertion(+), 220 deletions(-)
- 
+
 diff --git a/eccdata.c b/eccdata.c
-index 1b4cb0b5..dc2be5f9 100644
+index 3f8e3f1..06afb20 100644
 --- a/eccdata.c
 +++ b/eccdata.c
-@@ -434,72 +434,7 @@ ecc_curve_init_str (struct ecc_curve *ecc, enum ecc_type type,
+@@ -435,72 +435,7 @@ ecc_curve_init_str (struct ecc_curve *ecc, enum ecc_type type,
 static void
 ecc_curve_init (struct ecc_curve *ecc, const char *curve)
 {
@@ -92,10 +92,10 @@
 ecc_curve_init_str (ecc, ECC_TYPE_WEIERSTRASS,
 			 /* p = 2^{256} - 2^{224} + 2^{192} + 2^{96} - 1 */
 diff --git a/examples/ecc-benchmark.c b/examples/ecc-benchmark.c
-index 3ab269c7..402744a0 100644
+index 7e857f8..0bffe7a 100644
 --- a/examples/ecc-benchmark.c
 +++ b/examples/ecc-benchmark.c
-@@ -307,8 +307,6 @@ bench_curve (const struct ecc_curve *ecc)
+@@ -314,8 +314,6 @@ bench_curve (const struct ecc_curve *ecc)
 }
 
 const struct ecc_curve * const curves = {
@@ -105,7 +105,7 @@
 &_nettle_secp_256r1,
 &_nettle_secp_384r1,
 diff --git a/examples/hogweed-benchmark.c b/examples/hogweed-benchmark.c
-index 3d008021..b8cf902c 100644
+index 3d00802..b8cf902 100644
 --- a/examples/hogweed-benchmark.c
 +++ b/examples/hogweed-benchmark.c
 @@ -412,23 +412,6 @@ bench_ecdsa_init (unsigned size)
@@ -133,7 +133,7 @@
 case 256:
 ecc = &_nettle_secp_256r1;
 diff --git a/testsuite/ecdh-test.c b/testsuite/ecdh-test.c
-index ff4f7233..2be26b19 100644
+index ff4f723..2be26b1 100644
 --- a/testsuite/ecdh-test.c
 +++ b/testsuite/ecdh-test.c
 @@ -159,46 +159,6 @@ test_public_key (const char *label, const struct ecc_curve *ecc,
@@ -184,10 +184,10 @@
 	 "94731533361265297353914491124013058635674217345912524033267198103710636378786",
 	 "22441589863306126152768848344973918725077248391248404659242620344938484650846",
 diff --git a/testsuite/ecdsa-sign-test.c b/testsuite/ecdsa-sign-test.c
-index 08a10a1d..0acd4e5c 100644
+index b8a100b..bc1ab7e 100644
 --- a/testsuite/ecdsa-sign-test.c
 +++ b/testsuite/ecdsa-sign-test.c
-@@ -58,53 +58,6 @@ test_ecdsa (const struct ecc_curve *ecc,
+@@ -64,19 +64,6 @@ test_ecdsa (const struct ecc_curve *ecc,
 void
 test_main (void)
 {
@@ -204,6 +204,13 @@
 -	 "3a41e1423b1853e8aa89747b1f987364"
 -	 "44705d6d6d8371ea1f578f2e"); /* s */
 -
+ /* Produce a signature where verify operation results in a point duplication. */
+ test_ecdsa (&_nettle_secp_256r1,
+ 	 "1", /* Private key */
+@@ -89,40 +76,6 @@ test_main (void)
+ 	 "53f097727a0e0dc284a0daa0da0ab77d"
+ 	 "5792ae67ed075d1f8d5bda0f853fa093"); /* s */
+ 
 - /* Test cases for the smaller groups, verified with a
 - proof-of-concept implementation done for Yubico AB. */
 - test_ecdsa (&_nettle_secp_192r1,
@@ -242,7 +249,7 @@
 test_ecdsa (&_nettle_secp_256r1,
 	 "DC51D386 6A15BACD E33D96F9 92FCA99D"
 diff --git a/testsuite/ecdsa-verify-test.c b/testsuite/ecdsa-verify-test.c
-index 8110c64d..71c0b5c0 100644
+index 8d52700..eb5449d 100644
 --- a/testsuite/ecdsa-verify-test.c
 +++ b/testsuite/ecdsa-verify-test.c
 @@ -81,34 +81,6 @@ test_ecdsa (const struct ecc_curve *ecc,
@@ -277,14 +284,14 @@
 -	 "952800792ed19341fdeeec047f2514f3b0f150d6066151fb", /* r */
 -	 "ec5971222014878b50d7a19d8954bc871e7e65b00b860ffb"); /* s */
 -
- /* From RFC 4754 */
- test_ecdsa (&_nettle_secp_256r1,
- 	 "2442A5CC 0ECD015F A3CA31DC 8E2BBC70"
+ /* Test case provided by Guido Vranken, from oss-fuzz. Triggers
+ point duplication in the verify operation by using private key =
+ 1 (public key = generator) and hash = r. */
 diff --git a/testsuite/testutils.c b/testsuite/testutils.c
-index 2c6cac40..fbf4974c 100644
+index 3420ae9..cadf8af 100644
 --- a/testsuite/testutils.c
 +++ b/testsuite/testutils.c
-@@ -1656,8 +1656,6 @@ test_dsa_key(const struct dsa_params *params,
+@@ -1915,8 +1915,6 @@ test_dsa_key(const struct dsa_params *params,
 }
 
 const struct ecc_curve * const ecc_curves = {
@@ -293,7 +300,7 @@
 &_nettle_secp_256r1,
 &_nettle_secp_384r1,
 &_nettle_secp_521r1,
-@@ -1714,24 +1712,6 @@ test_ecc_point (const struct ecc_curve *ecc,
+@@ -2041,24 +2039,6 @@ test_ecc_point (const struct ecc_curve *ecc,
 
 /* For each curve, the points g, 2 g, 3 g and 4 g */
 static const struct ecc_ref_point ecc_ref94 = {
@@ -319,4 +326,5 @@
 	"4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5" },
 { "7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978",
 -- 
-2.30.2
\ No newline at end of file
+2.33.0
+

_service Changed

_service:tar_scm:nettle-3.8.1.tar.gz/arcfour-crypt.c Deleted

@@ -1,61 +0,0 @@
-/* arcfour-crypt.c
-
- The arcfour/rc4 stream cipher.
-
- Copyright (C) 2001, 2004 Niels Möller
-
- This file is part of GNU Nettle.
-
- GNU Nettle is free software: you can redistribute it and/or
- modify it under the terms of either:
-
- * the GNU Lesser General Public License as published by the Free
- Software Foundation; either version 3 of the License, or (at your
- option) any later version.
-
- or
-
- * the GNU General Public License as published by the Free
- Software Foundation; either version 2 of the License, or (at your
- option) any later version.
-
- or both in parallel, as here.
-
- GNU Nettle is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- General Public License for more details.
-
- You should have received copies of the GNU General Public License and
- the GNU Lesser General Public License along with this program. If
- not, see http://www.gnu.org/licenses/.
-*/
-
-#if HAVE_CONFIG_H
-# include "config.h"
-#endif
-
-#include <assert.h>
-
-#include "arcfour.h"
-
-void
-arcfour_crypt(struct arcfour_ctx *ctx,
-	 size_t length, uint8_t *dst,
-	 const uint8_t *src)
-{
- register uint8_t i, j;
- register int si, sj;
-
- i = ctx->i; j = ctx->j;
- while(length--)
- {
- i++; i &= 0xff;
- si = ctx->Si;
- j += si; j &= 0xff;
- sj = ctx->Si = ctx->Sj;
- ctx->Sj = si;
- *dst++ = *src++ ^ ctx->S (si + sj) & 0xff ;
- }
- ctx->i = i; ctx->j = j;
-}

_service:tar_scm:nettle-3.8.1.tar.gz/arm/fat/sha256-compress-2.asm Deleted

@@ -1,37 +0,0 @@
-C arm/fat/sha256-compress-2.asm
-
-
-ifelse(`
-   Copyright (C) 2015 Niels Möller
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-')
-
-dnl PROLOGUE(_nettle_sha256_compress) picked up by configure
-
-define(`fat_transform', `$1_armv6')
-include_src(`arm/v6/sha256-compress.asm')

_service:tar_scm:nettle-3.8.1.tar.gz/arm/v6/sha256-compress.asm Deleted

@@ -1,222 +0,0 @@
-C arm/v6/sha256-compress.asm
-
-ifelse(`
- Copyright (C) 2013 Niels Möller
-
- This file is part of GNU Nettle.
-
- GNU Nettle is free software: you can redistribute it and/or
- modify it under the terms of either:
-
- * the GNU Lesser General Public License as published by the Free
- Software Foundation; either version 3 of the License, or (at your
- option) any later version.
-
- or
-
- * the GNU General Public License as published by the Free
- Software Foundation; either version 2 of the License, or (at your
- option) any later version.
-
- or both in parallel, as here.
-
- GNU Nettle is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- General Public License for more details.
-
- You should have received copies of the GNU General Public License and
- the GNU Lesser General Public License along with this program. If
- not, see http://www.gnu.org/licenses/.
-')
-
-	.file "sha256-compress.asm"
-	.arch armv6
-
-define(`STATE', `r0')
-define(`INPUT', `r1')
-define(`K', `r2')
-define(`SA', `r3')
-define(`SB', `r4')
-define(`SC', `r5')
-define(`SD', `r6')
-define(`SE', `r7')
-define(`SF', `r8')
-define(`SG', `r10')
-define(`SH', `r11')
-define(`T0', `r12')
-define(`T1', `r1')	C Overlap INPUT
-define(`COUNT', `r0')	C Overlap STATE
-define(`W', `r14')
-
-C Used for data load
-define(`I0', `r3')
-define(`I1', `r4')
-define(`I2', `r5')
-define(`I3', `r6')
-define(`I4', `r7')
-define(`DST', `r8')
-define(`SHIFT', `r10')
-define(`ILEFT', `r11')
-
-define(`EXPN', `
-	ldr	W, sp, #+eval(4*$1)
-	ldr	T0, sp, #+eval(4*(($1 + 14) % 16))
-	ror	T1, T0, #17
-	eor	T1, T1, T0, ror #19
-	eor	T1, T1, T0, lsr #10
-	add	W, W, T1
-	ldr	T0, sp, #+eval(4*(($1 + 9) % 16))
-	add	W, W, T0
-	ldr	T0, sp, #+eval(4*(($1 + 1) % 16))
-	ror	T1, T0, #7
-	eor	T1, T1, T0, ror #18
-	eor	T1, T1, T0, lsr #3
-	add	W, W, T1
-	str	W, sp, #+eval(4*$1)
-')
-
-C ROUND(A,B,C,D,E,F,G,H)
-C
-C H += S1(E) + Choice(E,F,G) + K + W
-C D += H
-C H += S0(A) + Majority(A,B,C)
-C
-C Where
-C
-C S1(E) = E<<<26 ^ E<<<21 ^ E<<<7
-C S0(A) = A<<<30 ^ A<<<19 ^ A<<<10
-C Choice (E, F, G) = G^(E&(F^G))
-C Majority (A,B,C) = (A&B) + (C&(A^B))
-	
-define(`ROUND', `
-	ror	T0, $5, #6
-	eor	T0, T0, $5, ror #11
-	eor	T0, T0, $5, ror #25
-	add	$8, $8, T0
-	eor	T0, $6, $7
-	and	T0, T0, $5
-	eor	T0, T0, $7
-	add	$8,$8, T0
-	ldr	T0, K, #+4
-	add	$8, $8, W
-	add	$8, $8, T0
-	add	$4, $4, $8
-	ror	T0, $1, #2
-	eor	T0, T0, $1, ror #13
-	eor	T0, T0, $1, ror #22
-	add	$8, $8, T0
-	and	T0, $1, $2
-	add	$8, $8, T0
-	eor	T0, $1, $2
-	and	T0, T0, $3
-	add	$8, $8, T0
-')
-
-define(`NOEXPN', `
-	ldr	W, sp, + $1
-	add	$1, $1, #4
-')
-	C void
-	C _nettle_sha256_compress(uint32_t *state, const uint8_t *input, const uint32_t *k)
-
-	.text
-	.align 2
-
-PROLOGUE(_nettle_sha256_compress)
-	push	{r4,r5,r6,r7,r8,r10,r11,r14}
-	sub	sp, sp, #68
-	str	STATE, sp, #+64
-
-	C Load data up front, since we don't have enough registers
-	C to load and shift on-the-fly
-	ands	SHIFT, INPUT, #3
-	and	INPUT, INPUT, $-4
-	ldr	I0, INPUT
-	addne	INPUT, INPUT, #4
-	lsl	SHIFT, SHIFT, #3
-	mov	T0, #0
-	movne	T0, #-1
-IF_LE(`	lsl	I1, T0, SHIFT')
-IF_BE(`	lsr	I1, T0, SHIFT')
-	uadd8	T0, T0, I1		C Sets APSR.GE bits
-	C on BE rotate right by 32-SHIFT bits
-	C because there is no rotate left
-IF_BE(`	rsb	SHIFT, SHIFT, #32')
-
-	mov	DST, sp
-	mov	ILEFT, #4
-.Lcopy:
-	ldm	INPUT!, {I1,I2,I3,I4}
-	sel	I0, I0, I1
-	ror	I0, I0, SHIFT
-IF_LE(`	rev	I0, I0')
-	sel	I1, I1, I2
-	ror	I1, I1, SHIFT
-IF_LE(`	rev	I1, I1')
-	sel	I2, I2, I3
-	ror	I2, I2, SHIFT
-IF_LE(`	rev	I2, I2')
-	sel	I3, I3, I4
-	ror	I3, I3, SHIFT
-IF_LE(`	rev	I3, I3')
-	subs	ILEFT, ILEFT, #1
-	stm	DST!, {I0,I1,I2,I3}
-	mov	I0, I4	
-	bne	.Lcopy
-	
-	ldm	STATE, {SA,SB,SC,SD,SE,SF,SG,SH}
-
-	mov	COUNT,#0
-
-.Loop1:
-	NOEXPN(COUNT) ROUND(SA,SB,SC,SD,SE,SF,SG,SH)
-	NOEXPN(COUNT) ROUND(SH,SA,SB,SC,SD,SE,SF,SG)
-	NOEXPN(COUNT) ROUND(SG,SH,SA,SB,SC,SD,SE,SF)
-	NOEXPN(COUNT) ROUND(SF,SG,SH,SA,SB,SC,SD,SE)
-	NOEXPN(COUNT) ROUND(SE,SF,SG,SH,SA,SB,SC,SD)
-	NOEXPN(COUNT) ROUND(SD,SE,SF,SG,SH,SA,SB,SC)
-	NOEXPN(COUNT) ROUND(SC,SD,SE,SF,SG,SH,SA,SB)
-	NOEXPN(COUNT) ROUND(SB,SC,SD,SE,SF,SG,SH,SA)
-	cmp	COUNT,#64
-	bne	.Loop1
-
-	mov	COUNT, #3
-.Loop2:
-	
-	EXPN( 0) ROUND(SA,SB,SC,SD,SE,SF,SG,SH)
-	EXPN( 1) ROUND(SH,SA,SB,SC,SD,SE,SF,SG)
-	EXPN( 2) ROUND(SG,SH,SA,SB,SC,SD,SE,SF)
-	EXPN( 3) ROUND(SF,SG,SH,SA,SB,SC,SD,SE)
-	EXPN( 4) ROUND(SE,SF,SG,SH,SA,SB,SC,SD)
-	EXPN( 5) ROUND(SD,SE,SF,SG,SH,SA,SB,SC)
-	EXPN( 6) ROUND(SC,SD,SE,SF,SG,SH,SA,SB)
-	EXPN( 7) ROUND(SB,SC,SD,SE,SF,SG,SH,SA)
-	EXPN( 8) ROUND(SA,SB,SC,SD,SE,SF,SG,SH)
-	EXPN( 9) ROUND(SH,SA,SB,SC,SD,SE,SF,SG)
-	EXPN(10) ROUND(SG,SH,SA,SB,SC,SD,SE,SF)
-	EXPN(11) ROUND(SF,SG,SH,SA,SB,SC,SD,SE)
-	EXPN(12) ROUND(SE,SF,SG,SH,SA,SB,SC,SD)

_service:tar_scm:nettle-3.8.1.tar.gz/arm64/crypto/sha256-compress.asm Deleted

@@ -1,225 +0,0 @@
-C arm64/crypto/sha256-compress.asm
-
-ifelse(`
-   Copyright (C) 2021 Mamone Tarsha
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-')
-
-C This implementation uses the SHA-256 instructions of Armv8 crypto
-C extension.
-C SHA256H: SHA256 hash update (part 1)
-C SHA256H2: SHA256 hash update (part 2)
-C SHA256SU0: SHA256 schedule update 0
-C SHA256SU1: SHA256 schedule update 1
-
-.file "sha256-compress.asm"
-.arch armv8-a+crypto
-
-.text
-
-C Register usage:
-
-define(`STATE', `x0')
-define(`INPUT', `x1')
-define(`K', `x2')
-
-define(`MSG0', `v0')
-define(`MSG1', `v1')
-define(`MSG2', `v2')
-define(`MSG3', `v3')
-define(`STATE0', `v4')
-define(`STATE1', `v5')
-define(`CONST', `v6')
-define(`TMP', `v7')
-define(`STATE0_SAVED', `v16')
-define(`STATE1_SAVED', `v17')
-
-C void 
-C _nettle_sha256_compress(uint32_t *state, const uint8_t *input, const uint32_t *k)
-
-PROLOGUE(_nettle_sha256_compress)
-    C Load state
-    ld1            {STATE0.4s,STATE1.4s},STATE
-
-    C Save state
-    mov            STATE0_SAVED.16b,STATE0.16b
-    mov            STATE1_SAVED.16b,STATE1.16b
-
-    C Load message
-    ld1            {MSG0.16b,MSG1.16b,MSG2.16b,MSG3.16b},INPUT
-    
-    C Reverse for little endian
-    rev32          MSG0.16b,MSG0.16b
-    rev32          MSG1.16b,MSG1.16b
-    rev32          MSG2.16b,MSG2.16b
-    rev32          MSG3.16b,MSG3.16b
-
-    C Rounds 0-3
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG0.4s,CONST.4s
-    sha256su0      MSG0.4s,MSG1.4s
-    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
-    sha256h2       QFP(STATE1),QFP(STATE0_SAVED),CONST.4s
-    sha256su1      MSG0.4s,MSG2.4s,MSG3.4s
-
-    C Rounds 4-7
-    mov            TMP.16b,STATE0.16b
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG1.4s,CONST.4s
-    sha256su0      MSG1.4s,MSG2.4s
-    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
-    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
-    sha256su1      MSG1.4s,MSG3.4s,MSG0.4s
-
-    C Rounds 8-11
-    mov            TMP.16b,STATE0.16b
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG2.4s,CONST.4s
-    sha256su0      MSG2.4s,MSG3.4s
-    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
-    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
-    sha256su1      MSG2.4s,MSG0.4s,MSG1.4s
-
-    C Rounds 12-15
-    mov            TMP.16b,STATE0.16b
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG3.4s,CONST.4s
-    sha256su0      MSG3.4s,MSG0.4s
-    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
-    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
-    sha256su1      MSG3.4s,MSG1.4s,MSG2.4s
-
-    C Rounds 16-19
-    mov            TMP.16b,STATE0.16b
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG0.4s,CONST.4s
-    sha256su0      MSG0.4s,MSG1.4s
-    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
-    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
-    sha256su1      MSG0.4s,MSG2.4s,MSG3.4s
-
-    C Rounds 20-23
-    mov            TMP.16b,STATE0.16b
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG1.4s,CONST.4s
-    sha256su0      MSG1.4s,MSG2.4s
-    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
-    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
-    sha256su1      MSG1.4s,MSG3.4s,MSG0.4s
-
-    C Rounds 24-27
-    mov            TMP.16b,STATE0.16b
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG2.4s,CONST.4s
-    sha256su0      MSG2.4s,MSG3.4s
-    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
-    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
-    sha256su1      MSG2.4s,MSG0.4s,MSG1.4s
-
-    C Rounds 28-31
-    mov            TMP.16b,STATE0.16b
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG3.4s,CONST.4s
-    sha256su0      MSG3.4s,MSG0.4s
-    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
-    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
-    sha256su1      MSG3.4s,MSG1.4s,MSG2.4s
-
-    C Rounds 32-35
-    mov            TMP.16b,STATE0.16b
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG0.4s,CONST.4s
-    sha256su0      MSG0.4s,MSG1.4s
-    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
-    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
-    sha256su1      MSG0.4s,MSG2.4s,MSG3.4s
-
-    C Rounds 36-39
-    mov            TMP.16b,STATE0.16b
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG1.4s,CONST.4s
-    sha256su0      MSG1.4s,MSG2.4s
-    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
-    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
-    sha256su1      MSG1.4s,MSG3.4s,MSG0.4s
-
-    C Rounds 40-43
-    mov            TMP.16b,STATE0.16b
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG2.4s,CONST.4s
-    sha256su0      MSG2.4s,MSG3.4s
-    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
-    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
-    sha256su1      MSG2.4s,MSG0.4s,MSG1.4s
-
-    C Rounds 44-47
-    mov            TMP.16b,STATE0.16b
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG3.4s,CONST.4s
-    sha256su0      MSG3.4s,MSG0.4s
-    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
-    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
-    sha256su1      MSG3.4s,MSG1.4s,MSG2.4s
-
-    C Rounds 48-51
-    mov            TMP.16b,STATE0.16b
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG0.4s,CONST.4s
-    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
-    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
-
-    C Rounds 52-55
-    mov            TMP.16b,STATE0.16b
-    ld1            {CONST.4s},K,#16
-    add            CONST.4s,MSG1.4s,CONST.4s

_service:tar_scm:nettle-3.8.1.tar.gz/arm64/fat/sha256-compress-2.asm Deleted

@@ -1,37 +0,0 @@
-C arm64/fat/sha256-compress-2.asm
-
-
-ifelse(`
-   Copyright (C) 2021 Mamone Tarsha
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-')
-
-dnl PROLOGUE(_nettle_sha256_compress) picked up by configure
-
-define(`fat_transform', `$1_arm64')
-include_src(`arm64/crypto/sha256-compress.asm')

_service:tar_scm:nettle-3.8.1.tar.gz/gcmdata.c Deleted

@@ -1,84 +0,0 @@
-/* gcmdata.c
-
- Galois counter mode, specified by NIST,
- http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
-
- Generation of fixed multiplication tables.
-
- Copyright (C) 2011 Niels Möller
-
- This file is part of GNU Nettle.
-
- GNU Nettle is free software: you can redistribute it and/or
- modify it under the terms of either:
-
- * the GNU Lesser General Public License as published by the Free
- Software Foundation; either version 3 of the License, or (at your
- option) any later version.
-
- or
-
- * the GNU General Public License as published by the Free
- Software Foundation; either version 2 of the License, or (at your
- option) any later version.
-
- or both in parallel, as here.
-
- GNU Nettle is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- General Public License for more details.
-
- You should have received copies of the GNU General Public License and
- the GNU Lesser General Public License along with this program. If
- not, see http://www.gnu.org/licenses/.
-*/
-
-#include <stdio.h>
-#include <stdlib.h>
-
-#define GHASH_POLYNOMIAL 0xE1
-
-
-/* When x is shifted out over the block edge, add multiples of the
- defining polynomial to eliminate each bit. */
-static unsigned
-reduce(unsigned x)
-{
- unsigned p = GHASH_POLYNOMIAL << 1;
- unsigned y = 0;
- for (; x; x >>= 1, p <<= 1)
- if (x & 1)
- y ^= p;
- return y;
-}
-
-int
-main(int argc, char **argv)
-{
- unsigned i;
- printf("4-bit table:\n");
- 
- for (i = 0; i<16; i++)
- {
- unsigned x;
- if (i && !(i%8))
-	printf("\n");
-
- x = reduce(i << 4);
- printf("W(%02x,%02x),", x >> 8, x & 0xff);
- }
- printf("\n\n");
- printf("8-bit table:\n");
- for (i = 0; i<256; i++)
- {
- unsigned x;
- if (i && !(i%8))
-	printf("\n");
-
- x = reduce(i);
- printf("W(%02x,%02x),", x >> 8, x & 0xff);
- }
- printf("\n");
- return EXIT_SUCCESS;
-}

_service:tar_scm:nettle-3.8.1.tar.gz/s390x/fat/sha256-compress-2.asm Deleted

@@ -1,36 +0,0 @@
-C s390x/fat/sha256-compress-2.asm
-
-ifelse(`
-   Copyright (C) 2021 Mamone Tarsha
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-')
-
-dnl PROLOGUE(_nettle_sha256_compress) picked up by configure
-
-define(`fat_transform', `$1_s390x')
-include_src(`s390x/msa_x1/sha256-compress.asm')

_service:tar_scm:nettle-3.8.1.tar.gz/s390x/msa_x1/sha256-compress.asm Deleted

@@ -1,80 +0,0 @@
-C s390x/msa_x1/sha256-compress.asm
-
-ifelse(`
-   Copyright (C) 2021 Mamone Tarsha
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-')
-
-C KIMD (COMPUTE INTERMEDIATE MESSAGE DIGEST) is specefied in
-C "z/Architecture Principles of Operation SA22-7832-12" as follows:
-C A function specified by the function code in general register 0 is performed.
-C General register 1 contains the logical address of the leftmost byte of the parameter block in storage.
-C the second operand is processed as specified by the function code using an initial chaining value in
-C the parameter block, and the result replaces the chaining value.
-
-C This implementation uses KIMD-SHA-256 function.
-C The parameter block used for the KIMD-SHA-256 function has the following format:
-C *----------------------------------------------*
-C |                 H0 (4 bytes)                 |
-C |----------------------------------------------|
-C |                 H1 (4 bytes)                 |
-C |----------------------------------------------|
-C |                 H2 (4 bytes)                 |
-C |----------------------------------------------|
-C |                 H3 (4 bytes)                 |
-C |----------------------------------------------|
-C |                 H4 (4 bytes)                 |
-C |----------------------------------------------|
-C |                 H5 (4 bytes)                 |
-C |----------------------------------------------|
-C |                 H6 (4 bytes)                 |
-C |----------------------------------------------|
-C |                 H7 (4 bytes)                 |
-C *----------------------------------------------*
-
-.file "sha256-compress.asm"
-
-.text
-
-C SHA function code
-define(`SHA256_FUNCTION_CODE', `2')
-C Size of block
-define(`SHA256_BLOCK_SIZE', `64')
-
-C void 
-C _nettle_sha256_compress(uint32_t *state, const uint8_t *input,
-C                         const uint32_t *k)
-
-PROLOGUE(_nettle_sha256_compress)
-    lghi           %r0,SHA256_FUNCTION_CODE      C SHA-256 Function Code
-    lgr            %r1,%r2
-    lgr            %r4,%r3
-    lghi           %r5,SHA256_BLOCK_SIZE
-1:  .long   0xb93e0004                           C kimd %r0,%r4. perform KIMD-SHA operation on data
-    brc            1,1b
-    br             RA
-EPILOGUE(_nettle_sha256_compress)

_service:tar_scm:nettle-3.8.1.tar.gz/sec-tabselect.c Deleted

@@ -1,62 +0,0 @@
-/* sec-tabselect.c
-
- Copyright (C) 2013 Niels Möller
-
- This file is part of GNU Nettle.
-
- GNU Nettle is free software: you can redistribute it and/or
- modify it under the terms of either:
-
- * the GNU Lesser General Public License as published by the Free
- Software Foundation; either version 3 of the License, or (at your
- option) any later version.
-
- or
-
- * the GNU General Public License as published by the Free
- Software Foundation; either version 2 of the License, or (at your
- option) any later version.
-
- or both in parallel, as here.
-
- GNU Nettle is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- General Public License for more details.
-
- You should have received copies of the GNU General Public License and
- the GNU Lesser General Public License along with this program. If
- not, see http://www.gnu.org/licenses/.
-*/
-
-/* Development of Nettle's ECC support was funded by the .SE Internet Fund. */
-
-#if HAVE_CONFIG_H
-# include "config.h"
-#endif
-
-#include <assert.h>
-
-#include "ecc-internal.h"
-
-/* Copy the k'th element of the table out tn elements, each of size
- rn. Always read complete table. Similar to gmp's mpn_tabselect. */
-/* FIXME: Should we need to volatile declare anything? */
-void
-sec_tabselect (mp_limb_t *rp, mp_size_t rn,
-	 const mp_limb_t *table, unsigned tn,
-	 unsigned k)
-{
- const mp_limb_t *end = table + tn * rn;
- const mp_limb_t *p;
- mp_size_t i;
- 
- assert (k < tn);
- mpn_zero (rp, rn);
- for (p = table; p < end; p += rn, k--)
- {
- mp_limb_t mask = - (mp_limb_t) (k == 0);
- for (i = 0; i < rn; i++)
-	rpi += mask & pi;
- }
-}

_service:tar_scm:nettle-3.8.1.tar.gz/sha256-compress.c Deleted

@@ -1,200 +0,0 @@
-/* sha256-compress.c
-
- The compression function of the sha256 hash function.
-
- Copyright (C) 2001, 2010 Niels Möller
-
- This file is part of GNU Nettle.
-
- GNU Nettle is free software: you can redistribute it and/or
- modify it under the terms of either:
-
- * the GNU Lesser General Public License as published by the Free
- Software Foundation; either version 3 of the License, or (at your
- option) any later version.
-
- or
-
- * the GNU General Public License as published by the Free
- Software Foundation; either version 2 of the License, or (at your
- option) any later version.
-
- or both in parallel, as here.
-
- GNU Nettle is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- General Public License for more details.
-
- You should have received copies of the GNU General Public License and
- the GNU Lesser General Public License along with this program. If
- not, see http://www.gnu.org/licenses/.
-*/
-
-#if HAVE_CONFIG_H
-# include "config.h"
-#endif
-
-#ifndef SHA256_DEBUG
-# define SHA256_DEBUG 0
-#endif
-
-#if SHA256_DEBUG
-# include <stdio.h>
-# define DEBUG(i) \
- fprintf(stderr, "%2d: %8x %8x %8x %8x %8x %8x %8x %8x\n", \
-	 i, A, B, C, D ,E, F, G, H)
-#else
-# define DEBUG(i)
-#endif
-
-#include <assert.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "sha2.h"
-#include "sha2-internal.h"
-
-#include "macros.h"
-
-/* A block, treated as a sequence of 32-bit words. */
-#define SHA256_DATA_LENGTH 16
-
-/* The SHA256 functions. The Choice function is the same as the SHA1
- function f1, and the majority function is the same as the SHA1 f3
- function. They can be optimized to save one boolean operation each
- - thanks to Rich Schroeppel, rcs@cs.arizona.edu for discovering
- this */
-
-/* #define Choice(x,y,z) ( ( (x) & (y) ) | ( ~(x) & (z) ) ) */
-#define Choice(x,y,z) ( (z) ^ ( (x) & ( (y) ^ (z) ) ) ) 
-/* #define Majority(x,y,z) ( ((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)) ) */
-#define Majority(x,y,z) ( ((x) & (y)) ^ ((z) & ((x) ^ (y))) )
-
-#define S0(x) (ROTL32(30,(x)) ^ ROTL32(19,(x)) ^ ROTL32(10,(x))) 
-#define S1(x) (ROTL32(26,(x)) ^ ROTL32(21,(x)) ^ ROTL32(7,(x)))
-
-#define s0(x) (ROTL32(25,(x)) ^ ROTL32(14,(x)) ^ ((x) >> 3))
-#define s1(x) (ROTL32(15,(x)) ^ ROTL32(13,(x)) ^ ((x) >> 10))
-
-/* The initial expanding function. The hash function is defined over an
- 64-word expanded input array W, where the first 16 are copies of the input
- data, and the remaining 64 are defined by
-
- W t = s1(Wt-2) + Wt-7 + s0(Wi-15) + Wi-16
-
- This implementation generates these values on the fly in a circular
- buffer - thanks to Colin Plumb, colin@nyx10.cs.du.edu for this
- optimization.
-*/
-
-#define EXPAND(W,i) \
-( W(i) & 15 += (s1(W((i)-2) & 15) + W((i)-7) & 15 + s0(W((i)-15) & 15)) )
-
-/* The prototype SHA sub-round. The fundamental sub-round is:
-
- T1 = h + S1(e) + Choice(e,f,g) + Kt + Wt
-	T2 = S0(a) + Majority(a,b,c)
-	a' = T1+T2
-	b' = a
-	c' = b
-	d' = c
-	e' = d + T1
-	f' = e
-	g' = f
-	h' = g
-
- but this is implemented by unrolling the loop 8 times and renaming
- the variables
- ( h, a, b, c, d, e, f, g ) = ( a, b, c, d, e, f, g, h ) each
- iteration. */
-
-/* It's crucial that DATA is only used once, as that argument will
- * have side effects. */
-#define ROUND(a,b,c,d,e,f,g,h,k,data) do {	\
- h += S1(e) + Choice(e,f,g) + k + data;	\
- d += h;					\
- h += S0(a) + Majority(a,b,c);		\
- } while (0)
-
-/* For fat builds */
-#if HAVE_NATIVE_sha256_compress
-void
-_nettle_sha256_compress_c(uint32_t *state, const uint8_t *input, const uint32_t *k);
-#define _nettle_sha256_compress _nettle_sha256_compress_c
-#endif
-
-void
-_nettle_sha256_compress(uint32_t *state, const uint8_t *input, const uint32_t *k)
-{
- uint32_t dataSHA256_DATA_LENGTH;
- uint32_t A, B, C, D, E, F, G, H; /* Local vars */
- unsigned i;
- uint32_t *d;
-
- for (i = 0; i < SHA256_DATA_LENGTH; i++, input+= 4)
- {
- datai = READ_UINT32(input);
- }
-
- /* Set up first buffer and local data buffer */
- A = state0;
- B = state1;
- C = state2;
- D = state3;
- E = state4;
- F = state5;
- G = state6;
- H = state7;
- 
- /* Heavy mangling */
- /* First 16 subrounds that act on the original data */
-
- DEBUG(-1);
- for (i = 0, d = data; i<16; i+=8, k += 8, d+= 8)
- {
- ROUND(A, B, C, D, E, F, G, H, k0, d0); DEBUG(i);
- ROUND(H, A, B, C, D, E, F, G, k1, d1); DEBUG(i+1);
- ROUND(G, H, A, B, C, D, E, F, k2, d2);
- ROUND(F, G, H, A, B, C, D, E, k3, d3);
- ROUND(E, F, G, H, A, B, C, D, k4, d4);
- ROUND(D, E, F, G, H, A, B, C, k5, d5);
- ROUND(C, D, E, F, G, H, A, B, k6, d6); DEBUG(i+6);
- ROUND(B, C, D, E, F, G, H, A, k7, d7); DEBUG(i+7);
- }
- 
- for (; i<64; i += 16, k+= 16)
- {
- ROUND(A, B, C, D, E, F, G, H, k 0, EXPAND(data, 0)); DEBUG(i);
- ROUND(H, A, B, C, D, E, F, G, k 1, EXPAND(data, 1)); DEBUG(i+1);
- ROUND(G, H, A, B, C, D, E, F, k 2, EXPAND(data, 2)); DEBUG(i+2);
- ROUND(F, G, H, A, B, C, D, E, k 3, EXPAND(data, 3)); DEBUG(i+3);
- ROUND(E, F, G, H, A, B, C, D, k 4, EXPAND(data, 4)); DEBUG(i+4);
- ROUND(D, E, F, G, H, A, B, C, k 5, EXPAND(data, 5)); DEBUG(i+5);
- ROUND(C, D, E, F, G, H, A, B, k 6, EXPAND(data, 6)); DEBUG(i+6);
- ROUND(B, C, D, E, F, G, H, A, k 7, EXPAND(data, 7)); DEBUG(i+7);
- ROUND(A, B, C, D, E, F, G, H, k 8, EXPAND(data, 8)); DEBUG(i+8);
- ROUND(H, A, B, C, D, E, F, G, k 9, EXPAND(data, 9)); DEBUG(i+9);
- ROUND(G, H, A, B, C, D, E, F, k10, EXPAND(data, 10)); DEBUG(i+10);
- ROUND(F, G, H, A, B, C, D, E, k11, EXPAND(data, 11)); DEBUG(i+11);
- ROUND(E, F, G, H, A, B, C, D, k12, EXPAND(data, 12)); DEBUG(i+12);
- ROUND(D, E, F, G, H, A, B, C, k13, EXPAND(data, 13)); DEBUG(i+13);
- ROUND(C, D, E, F, G, H, A, B, k14, EXPAND(data, 14)); DEBUG(i+14);
- ROUND(B, C, D, E, F, G, H, A, k15, EXPAND(data, 15)); DEBUG(i+15);
- }
-
- /* Update state */
- state0 += A;
- state1 += B;
- state2 += C;
- state3 += D;
- state4 += E;
- state5 += F;
- state6 += G;
- state7 += H;
-#if SHA256_DEBUG
- fprintf(stderr, "99: %8x %8x %8x %8x %8x %8x %8x %8x\n",
-	 state0, state1, state2, state3,
-	 state4, state5, state6, state7);
-#endif

_service:tar_scm:nettle-3.8.1.tar.gz/sparc32/arcfour-crypt.asm Deleted

@@ -1,242 +0,0 @@
-C sparc32/arcfour-crypt.asm
-
-ifelse(`
-   Copyright (C) 2002, 2005 Niels Möller
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-')
-
-C	Define to YES, to enable the complex code to special case SRC
-C	and DST with compatible alignment.
-	
-define(`WITH_ALIGN', `YES')
-
-C	Registers
-
-define(`CTX',	`%i0')
-define(`LENGTH',`%i1')
-define(`DST',	`%i2')
-define(`SRC',	`%i3')
-
-define(`I1',	`%i4')
-define(`I2',	`%i5')
-define(`J',	`%g1')
-define(`SI',	`%g2')
-define(`SJ',	`%g3')
-define(`TMP',	`%o0')
-define(`TMP2',	`%o1')
-define(`N',	`%o2')
-define(`DATA',	`%o3')
-
-C	Computes the next byte of the key stream. As input, i must
-C	already point to the index for the current access, the index
-C	for the next access is stored in ni. The resulting key byte is
-C	stored in res.
-C	ARCFOUR_BYTE(i, ni, res)
-define(`ARCFOUR_BYTE', `
-	ldub	CTX + $1, SI
-	add	$1, 1, $2
-	add	J, SI, J
-	and	J, 0xff, J
-	ldub	CTX + J, SJ
-	and	$2, 0xff, $2
-	stb	SI, CTX + J
-	add	SI, SJ, SI
-	and	SI, 0xff, SI
-	stb	SJ, CTX + $1
-	ldub	CTX + SI, $3
-')dnl
-			
-C	FIXME: Consider using the callers window
-define(`FRAME_SIZE', 104)
-
-	.file "arcfour-crypt.asm"
-
-	C arcfour_crypt(struct arcfour_ctx *ctx,
-	C               size_t length, uint8_t *dst,
-	C               const uint8_t *src)
-
-	.section	".text"
-	.align 16
-	.proc	020
-	
-PROLOGUE(nettle_arcfour_crypt)
-
-	save	%sp, -FRAME_SIZE, %sp
-	cmp	LENGTH, 0
-	be	.Lend
-	nop
-	
-	C	Load both I and J
-	lduh	CTX + ARCFOUR_I, I1
-	and	I1, 0xff, J
-	srl	I1, 8, I1
-
-	C	We want an even address for DST
-	andcc	DST, 1, %g0
-	add	I1, 1 ,I1
-	beq	.Laligned2
-	and	I1, 0xff, I1
-
-	mov	I1, I2
-	ldub	SRC, DATA
-	ARCFOUR_BYTE(I2, I1, TMP)
-	subcc	LENGTH, 1, LENGTH
-	add	SRC, 1, SRC
-	xor	DATA, TMP, DATA
-	stb	DATA, DST
-	beq	.Ldone
-	add	DST, 1, DST
-
-.Laligned2:
-
-	cmp	LENGTH, 2
-	blu	.Lfinal1
-	C	Harmless delay slot instruction	
-	andcc	DST, 2, %g0
-	beq	.Laligned4
-	nop
-
-	ldub	SRC, DATA
-	ARCFOUR_BYTE(I1, I2, TMP)
-	ldub	SRC + 1, TMP2
-	add	SRC, 2, SRC
-	xor	DATA, TMP, DATA
-	sll	DATA, 8, DATA	
-
-	ARCFOUR_BYTE(I2, I1, TMP)
-	xor	TMP2, TMP, TMP
-	subcc	LENGTH, 2, LENGTH
-	or	DATA, TMP, DATA
-
-	sth	DATA, DST
-	beq	.Ldone
-	add	DST, 2, DST
-	
-.Laligned4:
-	cmp	LENGTH, 4
-	blu	.Lfinal2
-	C	Harmless delay slot instruction
-	srl	LENGTH, 2, N
-	
-.Loop:
-	C	Main loop, with aligned writes
-	
-	C	FIXME: Could check if SRC is aligned, and
-	C	use 32-bit reads in that case.
-
-	ldub	SRC, DATA
-	ARCFOUR_BYTE(I1, I2, TMP)
-	ldub	SRC + 1, TMP2
-	xor	TMP, DATA, DATA
-	sll	DATA, 8, DATA
-
-	ARCFOUR_BYTE(I2, I1, TMP)
-	xor	TMP2, TMP, TMP
-	ldub	SRC + 2, TMP2
-	or	TMP, DATA, DATA
-	sll	DATA, 8, DATA
-
-	ARCFOUR_BYTE(I1, I2, TMP)
-	xor	TMP2, TMP, TMP
-	ldub	SRC + 3, TMP2
-	or	TMP, DATA, DATA
-	sll	DATA, 8, DATA
-
-	ARCFOUR_BYTE(I2, I1, TMP)
-	xor	TMP2, TMP, TMP
-	or	TMP, DATA, DATA
-	subcc	N, 1, N
-	add	SRC, 4, SRC
-	st	DATA, DST
-	bne	.Loop
-	add	DST, 4, DST
-	
-	andcc	LENGTH, 3, LENGTH
-	beq	.Ldone
-	nop
-
-.Lfinal2:
-	C	DST address must be 2-aligned
-	cmp	LENGTH, 2
-	blu	.Lfinal1
-	nop
-
-	ldub	SRC, DATA
-	ARCFOUR_BYTE(I1, I2, TMP)
-	ldub	SRC + 1, TMP2
-	add	SRC, 2, SRC
-	xor	DATA, TMP, DATA
-	sll	DATA, 8, DATA	
-
-	ARCFOUR_BYTE(I2, I1, TMP)
-	xor	TMP2, TMP, TMP
-	or	DATA, TMP, DATA
-

_service:tar_scm:nettle-3.8.1.tar.gz/sparc64/arcfour-crypt.asm Deleted

@@ -1,229 +0,0 @@
-C sparc64/arcfour-crypt.asm
-
-ifelse(`
-   Copyright (C) 2002, 2005 Niels Möller
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-')
-
-C	Define to YES, to enable the complex code to special case SRC
-C	and DST with compatible alignment.
-	
-define(`WITH_ALIGN', `YES')
-
-C	Registers
-
-define(`CTX',	`%i0')
-define(`LENGTH',`%i1')
-define(`DST',	`%i2')
-define(`SRC',	`%i3')
-
-define(`I1',	`%i4')
-define(`I2',	`%i5')
-define(`J',	`%g1')
-define(`SI',	`%g2')
-define(`SJ',	`%g3')
-define(`TMP',	`%o0')
-define(`TMP2',	`%o1')
-define(`N',	`%o2')
-define(`DATA',	`%o3')
-
-C	Computes the next byte of the key stream. As input, i must
-C	already point to the index for the current access, the index
-C	for the next access is stored in ni. The resulting key byte is
-C	stored in res.
-C	ARCFOUR_BYTE(i, ni, res)
-define(`ARCFOUR_BYTE', `
-	ldub	CTX + $1, SI
-	add	$1, 1, $2
-	add	J, SI, J
-	and	J, 0xff, J
-	ldub	CTX + J, SJ
-	and	$2, 0xff, $2
-	stb	SI, CTX + J
-	add	SI, SJ, SI
-	and	SI, 0xff, SI
-	stb	SJ, CTX + $1
-	ldub	CTX + SI, $3
-')dnl
-			
-define(`FRAME_SIZE', 192)
-
-	.file "arcfour-crypt.asm"
-
-	C arcfour_crypt(struct arcfour_ctx *ctx,
-	C               size_t length, uint8_t *dst,
-	C               const uint8_t *src)
-
-	.section	".text"
-	.align 16
-	.proc	020
-	
-PROLOGUE(nettle_arcfour_crypt)
-
-	save	%sp, -FRAME_SIZE, %sp
-	cmp	LENGTH, 0
-	be	.Lend
-	nop
-	
-	C	Load both I and J
-	lduh	CTX + ARCFOUR_I, I1
-	and	I1, 0xff, J
-	srl	I1, 8, I1
-
-	C	We want an even address for DST
-	andcc	DST, 1, %g0
-	add	I1, 1 ,I1
-	beq	.Laligned2
-	and	I1, 0xff, I1
-
-	mov	I1, I2
-	ldub	SRC, DATA
-	ARCFOUR_BYTE(I2, I1, TMP)
-	subcc	LENGTH, 1, LENGTH
-	add	SRC, 1, SRC
-	xor	DATA, TMP, DATA
-	stb	DATA, DST
-	beq	.Ldone
-	add	DST, 1, DST
-
-.Laligned2:
-
-	cmp	LENGTH, 2
-	blu	.Lfinal1
-	C	Harmless delay slot instruction	
-	andcc	DST, 2, %g0
-	beq	.Laligned4
-	nop
-
-	ldub	SRC, DATA
-	ARCFOUR_BYTE(I1, I2, TMP)
-	ldub	SRC + 1, TMP2
-	add	SRC, 2, SRC
-	xor	DATA, TMP, DATA
-	sll	DATA, 8, DATA	
-
-	ARCFOUR_BYTE(I2, I1, TMP)
-	xor	TMP2, TMP, TMP
-	subcc	LENGTH, 2, LENGTH
-	or	DATA, TMP, DATA
-
-	sth	DATA, DST
-	beq	.Ldone
-	add	DST, 2, DST
-	
-.Laligned4:
-	cmp	LENGTH, 4
-	blu	.Lfinal2
-	C	Harmless delay slot instruction
-	srl	LENGTH, 2, N
-	
-.Loop:
-	C	Main loop, with aligned writes
-	
-	C	FIXME: Could check if SRC is aligned, and
-	C	use 32-bit reads in that case.
-
-	ldub	SRC, DATA
-	ARCFOUR_BYTE(I1, I2, TMP)
-	ldub	SRC + 1, TMP2
-	xor	TMP, DATA, DATA
-	sll	DATA, 8, DATA
-
-	ARCFOUR_BYTE(I2, I1, TMP)
-	xor	TMP2, TMP, TMP
-	ldub	SRC + 2, TMP2
-	or	TMP, DATA, DATA
-	sll	DATA, 8, DATA
-
-	ARCFOUR_BYTE(I1, I2, TMP)
-	xor	TMP2, TMP, TMP
-	ldub	SRC + 3, TMP2
-	or	TMP, DATA, DATA
-	sll	DATA, 8, DATA
-
-	ARCFOUR_BYTE(I2, I1, TMP)
-	xor	TMP2, TMP, TMP
-	or	TMP, DATA, DATA
-	subcc	N, 1, N
-	add	SRC, 4, SRC
-	st	DATA, DST
-	bne	.Loop
-	add	DST, 4, DST
-	
-	andcc	LENGTH, 3, LENGTH
-	beq	.Ldone
-	nop
-
-.Lfinal2:
-	C	DST address must be 2-aligned
-	cmp	LENGTH, 2
-	blu	.Lfinal1
-	nop
-
-	ldub	SRC, DATA
-	ARCFOUR_BYTE(I1, I2, TMP)
-	ldub	SRC + 1, TMP2
-	add	SRC, 2, SRC
-	xor	DATA, TMP, DATA
-	sll	DATA, 8, DATA	
-
-	ARCFOUR_BYTE(I2, I1, TMP)
-	xor	TMP2, TMP, TMP
-	or	DATA, TMP, DATA
-
-	sth	DATA, DST

_service:tar_scm:nettle-3.8.1.tar.gz/testsuite/siv-test.c Deleted

@@ -1,375 +0,0 @@
-/* siv-test.c
-
-   Self-test and vectors for AES-SIV mode ciphers
-
-   Copyright (C) 2018 Nikos Mavrogiannopoulos
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-*/
-
-/* The
- * test vectors have been collected from the following standards:
- *  RFC5297
- */
-
-#include "testutils.h"
-#include "aes.h"
-#include "nettle-types.h"
-#include "siv-cmac.h"
-#include "knuth-lfib.h"
-
-/* AEAD ciphers */
-typedef void
-nettle_encrypt_message_func(void *ctx,
-			    size_t nlength, const uint8_t *nonce,
-			    size_t alength, const uint8_t *adata,
-			    size_t clength, uint8_t *dst, const uint8_t *src);
-
-typedef int
-nettle_decrypt_message_func(void *ctx,
-			    size_t nlength, const uint8_t *nonce,
-			    size_t alength, const uint8_t *adata,
-			    size_t mlength, uint8_t *dst, const uint8_t *src);
-
-static void
-test_compare_results(const char *name,
-        const struct tstring *adata,
-        /* Expected results. */
-        const struct tstring *e_clear,
-	const struct tstring *e_cipher,
-        /* Actual results. */
-        const void *clear,
-        const void *cipher)
-{
-  if (!MEMEQ(e_cipher->length, e_cipher->data, cipher))
-    {
-      fprintf(stderr, "%s: encryption failed\nAdata: ", name);
-      tstring_print_hex(adata);
-      fprintf(stderr, "\nInput: ");
-      tstring_print_hex(e_clear);
-      fprintf(stderr, "\nOutput: ");
-      print_hex(e_cipher->length, cipher);
-      fprintf(stderr, "\nExpected:");
-      tstring_print_hex(e_cipher);
-      fprintf(stderr, "\n");
-      FAIL();
-    }
-  if (!MEMEQ(e_clear->length, e_clear->data, clear))
-    {
-      fprintf(stderr, "%s decrypt failed:\nAdata:", name);
-      tstring_print_hex(adata);
-      fprintf(stderr, "\nInput: ");
-      tstring_print_hex(e_cipher);
-      fprintf(stderr, "\nOutput: ");
-      print_hex(e_clear->length, clear);
-      fprintf(stderr, "\nExpected:");
-      tstring_print_hex(e_clear);
-      fprintf(stderr, "\n");
-      FAIL();
-    }
-} /* test_compare_results */
-
-static void
-test_cipher_siv(const char *name,
-		nettle_set_key_func *siv_set_key,
-		nettle_encrypt_message_func *siv_encrypt,
-		nettle_decrypt_message_func *siv_decrypt,
-		size_t context_size, size_t key_size,
-		const struct tstring *key,
-		const struct tstring *nonce,
-		const struct tstring *authdata,
-		const struct tstring *cleartext,
-		const struct tstring *ciphertext)
-{
-  void *ctx = xalloc(context_size);
-  uint8_t *en_data;
-  uint8_t *de_data;
-  int ret;
-
-  ASSERT (key->length == key_size);
-  ASSERT (cleartext->length + SIV_DIGEST_SIZE == ciphertext->length);
-
-  de_data = xalloc(cleartext->length);
-  en_data = xalloc(ciphertext->length);
-
-  /* Ensure we get the same answers using the all-in-one API. */
-  memset(de_data, 0, cleartext->length);
-  memset(en_data, 0, ciphertext->length);
-
-  siv_set_key(ctx, key->data);
-  siv_encrypt(ctx, nonce->length, nonce->data,
-	      authdata->length, authdata->data,
-	      ciphertext->length, en_data, cleartext->data);
-
-  ret = siv_decrypt(ctx, nonce->length, nonce->data,
-		    authdata->length, authdata->data,
-		    cleartext->length, de_data, ciphertext->data);
-
-  if (ret != 1)
-    {
-      fprintf(stderr, "siv_decrypt_message failed to validate message\n");
-      FAIL();
-    }
-  test_compare_results(name, authdata,
-		       cleartext, ciphertext, de_data, en_data);
-
-  /* Ensure that we can detect corrupted message or tag data. */
-  en_data0 ^= 1;
-  ret = siv_decrypt(ctx, nonce->length, nonce->data,
-	            authdata->length, authdata->data,
-		    cleartext->length, de_data, en_data);
-  if (ret != 0)
-    {
-      fprintf(stderr, "siv_decrypt_message failed to detect corrupted message\n");
-      FAIL();
-    }
-
-  /* Ensure we can detect corrupted adata. */
-  if (authdata->length) {
-    en_data0 ^= 1;
-    ret = siv_decrypt(ctx, nonce->length, nonce->data,
-		      authdata->length-1, authdata->data,
-		      cleartext->length, de_data, en_data);
-    if (ret != 0)
-      {
-	fprintf(stderr, "siv_decrypt_message failed to detect corrupted message\n");
-	FAIL();
-      }
-  }
-
-  free(ctx);
-  free(en_data);
-  free(de_data);
-}
-
-#define test_siv_aes128(name, key, nonce, authdata, cleartext, ciphertext) \
-  test_cipher_siv(name, (nettle_set_key_func*)siv_cmac_aes128_set_key,	\
-		  (nettle_encrypt_message_func*)siv_cmac_aes128_encrypt_message, \
-		  (nettle_decrypt_message_func*)siv_cmac_aes128_decrypt_message, \
-		  sizeof(struct siv_cmac_aes128_ctx), SIV_CMAC_AES128_KEY_SIZE, \
-		  key, nonce, authdata, cleartext, ciphertext)
-
-#define test_siv_aes256(name, key, nonce, authdata, cleartext, ciphertext) \
-  test_cipher_siv(name, (nettle_set_key_func*)siv_cmac_aes256_set_key,	\
-		  (nettle_encrypt_message_func*)siv_cmac_aes256_encrypt_message, \
-		  (nettle_decrypt_message_func*)siv_cmac_aes256_decrypt_message, \
-		  sizeof(struct siv_cmac_aes256_ctx), SIV_CMAC_AES256_KEY_SIZE, \
-		  key, nonce, authdata, cleartext, ciphertext)
-
-void
-test_main(void)
-{
-  /* The following tests were checked for interoperability against libaes_siv */
-
-  /*
-   * Example with small nonce, no AD and no plaintext
-   */
-  test_siv_aes128("SIV_CMAC_AES128",
-		  SHEX("fffefdfc fbfaf9f8 f7f6f5f4 f3f2f1f0"
-		       "f0f1f2f3 f4f5f6f7 f8f9fafb fcfdfeff"),
-		  SHEX("01"),
-		  SHEX(""),
-		  SHEX(""),
-		  SHEX("c696f84f df92aba3 c31c23d5 f2087513"));
-  /*
-   * Example with small nonce, no AD and plaintext

_service:tar_scm:nettle-3.8.1.tar.gz/texinfo.tex Deleted

@@ -1,9287 +0,0 @@
-% texinfo.tex -- TeX macros to handle Texinfo files.
-%
-% Load plain if necessary, i.e., if running under initex.
-\expandafter\ifx\csname fmtname\endcsname\relax\input plain\fi
-%
-\def\texinfoversion{2009-03-22.17}
-%
-% Copyright 1985, 1986, 1988, 1990, 1991, 1992, 1993, 1994, 1995,
-% 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006,
-% 2007, 2008, 2009 Free Software Foundation, Inc.
-%
-% This texinfo.tex file is free software: you can redistribute it and/or
-% modify it under the terms of the GNU General Public License as
-% published by the Free Software Foundation, either version 3 of the
-% License, or (at your option) any later version.
-%
-% This texinfo.tex file is distributed in the hope that it will be
-% useful, but WITHOUT ANY WARRANTY; without even the implied warranty
-% of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-% General Public License for more details.
-%
-% You should have received a copy of the GNU General Public License
-% along with this program. If not, see <http://www.gnu.org/licenses/>.
-%
-% As a special exception, when this file is read by TeX when processing
-% a Texinfo source document, you may use the result without
-% restriction. (This has been our intent since Texinfo was invented.)
-%
-% Please try the latest version of texinfo.tex before submitting bug
-% reports; you can get the latest version from:
-% http://www.gnu.org/software/texinfo/ (the Texinfo home page), or
-% ftp://tug.org/tex/texinfo.tex
-% (and all CTAN mirrors, see http://www.ctan.org).
-% The texinfo.tex in any given distribution could well be out
-% of date, so if that's what you're using, please check.
-%
-% Send bug reports to bug-texinfo@gnu.org. Please include including a
-% complete document in each bug report with which we can reproduce the
-% problem. Patches are, of course, greatly appreciated.
-%
-% To process a Texinfo manual with TeX, it's most reliable to use the
-% texi2dvi shell script that comes with the distribution. For a simple
-% manual foo.texi, however, you can get away with this:
-% tex foo.texi
-% texindex foo.??
-% tex foo.texi
-% tex foo.texi
-% dvips foo.dvi -o # or whatever; this makes foo.ps.
-% The extra TeX runs get the cross-reference information correct.
-% Sometimes one run after texindex suffices, and sometimes you need more
-% than two; texi2dvi does it as many times as necessary.
-%
-% It is possible to adapt texinfo.tex for other languages, to some
-% extent. You can get the existing language-specific files from the
-% full Texinfo distribution.
-%
-% The GNU Texinfo home page is http://www.gnu.org/software/texinfo.
-
-
-\message{Loading texinfo version \texinfoversion:}
-
-% If in a .fmt file, print the version number
-% and turn on active characters that we couldn't do earlier because
-% they might have appeared in the input file name.
-\everyjob{\message{Texinfo version \texinfoversion}%
- \catcode`+=\active \catcode`\_=\active}
-
-
-\chardef\other=12
-
-% We never want plain's \outer definition of \+ in Texinfo.
-% For @tex, we can use \tabalign.
-\let\+ = \relax
-
-% Save some plain tex macros whose names we will redefine.
-\let\ptexb=\b
-\let\ptexbullet=\bullet
-\let\ptexc=\c
-\let\ptexcomma=\,
-\let\ptexdot=\.
-\let\ptexdots=\dots
-\let\ptexend=\end
-\let\ptexequiv=\equiv
-\let\ptexexclam=\!
-\let\ptexfootnote=\footnote
-\let\ptexgtr=>
-\let\ptexhat=^
-\let\ptexi=\i
-\let\ptexindent=\indent
-\let\ptexinsert=\insert
-\let\ptexlbrace=\{
-\let\ptexless=<
-\let\ptexnewwrite\newwrite
-\let\ptexnoindent=\noindent
-\let\ptexplus=+
-\let\ptexrbrace=\}
-\let\ptexslash=\/
-\let\ptexstar=\*
-\let\ptext=\t
-\let\ptextop=\top
-{\catcode`\'=\active
-\global\let\ptexquoteright'}% Math-mode def from plain.tex.
-\let\ptexraggedright=\raggedright
-
-% If this character appears in an error message or help string, it
-% starts a new line in the output.
-\newlinechar = `^^J
-
-% Use TeX 3.0's \inputlineno to get the line number, for better error
-% messages, but if we're using an old version of TeX, don't do anything.
-%
-\ifx\inputlineno\thisisundefined
- \let\linenumber = \empty % Pre-3.0.
-\else
- \def\linenumber{l.\the\inputlineno:\space}
-\fi
-
-% Set up fixed words for English if not already set.
-\ifx\putwordAppendix\undefined \gdef\putwordAppendix{Appendix}\fi
-\ifx\putwordChapter\undefined \gdef\putwordChapter{Chapter}\fi
-\ifx\putwordfile\undefined \gdef\putwordfile{file}\fi
-\ifx\putwordin\undefined \gdef\putwordin{in}\fi
-\ifx\putwordIndexIsEmpty\undefined \gdef\putwordIndexIsEmpty{(Index is empty)}\fi
-\ifx\putwordIndexNonexistent\undefined \gdef\putwordIndexNonexistent{(Index is nonexistent)}\fi
-\ifx\putwordInfo\undefined \gdef\putwordInfo{Info}\fi
-\ifx\putwordInstanceVariableof\undefined \gdef\putwordInstanceVariableof{Instance Variable of}\fi
-\ifx\putwordMethodon\undefined \gdef\putwordMethodon{Method on}\fi
-\ifx\putwordNoTitle\undefined \gdef\putwordNoTitle{No Title}\fi
-\ifx\putwordof\undefined \gdef\putwordof{of}\fi
-\ifx\putwordon\undefined \gdef\putwordon{on}\fi
-\ifx\putwordpage\undefined \gdef\putwordpage{page}\fi
-\ifx\putwordsection\undefined \gdef\putwordsection{section}\fi
-\ifx\putwordSection\undefined \gdef\putwordSection{Section}\fi
-\ifx\putwordsee\undefined \gdef\putwordsee{see}\fi
-\ifx\putwordSee\undefined \gdef\putwordSee{See}\fi
-\ifx\putwordShortTOC\undefined \gdef\putwordShortTOC{Short Contents}\fi
-\ifx\putwordTOC\undefined \gdef\putwordTOC{Table of Contents}\fi
-%
-\ifx\putwordMJan\undefined \gdef\putwordMJan{January}\fi
-\ifx\putwordMFeb\undefined \gdef\putwordMFeb{February}\fi
-\ifx\putwordMMar\undefined \gdef\putwordMMar{March}\fi
-\ifx\putwordMApr\undefined \gdef\putwordMApr{April}\fi
-\ifx\putwordMMay\undefined \gdef\putwordMMay{May}\fi
-\ifx\putwordMJun\undefined \gdef\putwordMJun{June}\fi
-\ifx\putwordMJul\undefined \gdef\putwordMJul{July}\fi
-\ifx\putwordMAug\undefined \gdef\putwordMAug{August}\fi
-\ifx\putwordMSep\undefined \gdef\putwordMSep{September}\fi
-\ifx\putwordMOct\undefined \gdef\putwordMOct{October}\fi
-\ifx\putwordMNov\undefined \gdef\putwordMNov{November}\fi
-\ifx\putwordMDec\undefined \gdef\putwordMDec{December}\fi
-%
-\ifx\putwordDefmac\undefined \gdef\putwordDefmac{Macro}\fi
-\ifx\putwordDefspec\undefined \gdef\putwordDefspec{Special Form}\fi
-\ifx\putwordDefvar\undefined \gdef\putwordDefvar{Variable}\fi
-\ifx\putwordDefopt\undefined \gdef\putwordDefopt{User Option}\fi
-\ifx\putwordDeffunc\undefined \gdef\putwordDeffunc{Function}\fi
-
-% Since the category of space is not known, we have to be careful.
-\chardef\spacecat = 10
-\def\spaceisspace{\catcode`\ =\spacecat}
-
-% sometimes characters are active, so we need control sequences.
-\chardef\colonChar = `\:
-\chardef\commaChar = `\,
-\chardef\dashChar = `\-
-\chardef\dotChar = `\.
-\chardef\exclamChar= `\!
-\chardef\lquoteChar= `\`
-\chardef\questChar = `\?
-\chardef\rquoteChar= `\'
-\chardef\semiChar = `\;
-\chardef\underChar = `\_
-
-% Ignore a token.
-%
-\def\gobble#1{}
-
-% The following is used inside several \edef's.
-\def\makecsname#1{\expandafter\noexpand\csname#1\endcsname}
-
-% Hyphenation fixes.
-\hyphenation{
- Flor-i-da Ghost-script Ghost-view Mac-OS Post-Script
- ap-pen-dix bit-map bit-maps
- data-base data-bases eshell fall-ing half-way long-est man-u-script
- man-u-scripts mini-buf-fer mini-buf-fers over-view par-a-digm
- par-a-digms rath-er rec-tan-gu-lar ro-bot-ics se-vere-ly set-up spa-ces
- spell-ing spell-ings
- stand-alone strong-est time-stamp time-stamps which-ever white-space
- wide-spread wrap-around
-}
-
-% Margin to add to right of even pages, to left of odd pages.
-\newdimen\bindingoffset
-\newdimen\normaloffset
-\newdimen\pagewidth \newdimen\pageheight
-
-% For a final copy, take out the rectangles
-% that mark overfull boxes (in case you have decided

_service:tar_scm:nettle-3.8.1.tar.gz/x86/arcfour-crypt.asm Deleted

@@ -1,125 +0,0 @@
-C x86/arcfour-crypt.asm
-
-ifelse(`
-   Copyright (C) 2004, Niels Möller
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-')
-
-	.file "arcfour-crypt.asm"
-
-	C arcfour_crypt(struct arcfour_ctx *ctx,
-	C               size_t length, uint8_t *dst,
-	C               const uint8_t *src)
-	.text
-	ALIGN(16)
-PROLOGUE(nettle_arcfour_crypt)
-	C save all registers that need to be saved
-	pushl	%ebx		C  12(%esp)
-	pushl	%ebp		C  8(%esp)
-	pushl	%esi		C  4(%esp)
-	pushl	%edi		C  0(%esp)
-
-C Input arguments:
-	C ctx = 20(%esp)
-	C length = 24(%esp)
-	C dst = 28(%esp)
-	C src = 32(%esp)
-C Register usage:
-	C %ebp = ctx
-	C %esi = src
-	C %edi = dst
-	C %edx = loop counter
-	C %eax = i
-	C %ebx = j
-	C %cl  = si
-	C %ch  = sj
-
-	movl	24(%esp), %edx		C  length
-	movl	20(%esp), %ebp		C  ctx
-	movl	28(%esp), %edi		C  dst
-	movl	32(%esp), %esi		C  src
-
-	lea	(%edx, %edi), %edi
-	lea	(%edx, %esi), %esi
-	negl	%edx
-	jnc	.Lend
-	
-	movzbl  ARCFOUR_I (%ebp), %eax	C  i
-	movzbl  ARCFOUR_J (%ebp), %ebx	C  j
-
-	incb	%al
-	sarl	$1, %edx
-	jc	.Lloop_odd
-	
-	ALIGN(16)
-.Lloop:
-	movb	(%ebp, %eax), %cl	C  si.
-	addb    %cl, %bl
-	movb    (%ebp, %ebx), %ch	C  sj
-	movb    %ch, (%ebp, %eax)	C  Si = sj
-	incl	%eax
-	movzbl	%al, %eax
-	movb	%cl, (%ebp, %ebx)	C  Sj = si
-	addb    %ch, %cl
-	movzbl  %cl, %ecx		C  Clear, so it can be used
-					C  for indexing.
-	movb    (%ebp, %ecx), %cl
-	xorb    (%esi, %edx, 2), %cl
-	movb    %cl, (%edi, %edx, 2)
-
-	C FIXME: Could exchange cl and ch in the second half
-	C and try to interleave instructions better.
-.Lloop_odd:
-	movb	(%ebp, %eax), %cl	C  si.
-	addb    %cl, %bl
-	movb    (%ebp, %ebx), %ch	C  sj
-	movb    %ch, (%ebp, %eax)	C  Si = sj
-	incl	%eax
-	movzbl	%al, %eax
-	movb	%cl, (%ebp, %ebx)	C  Sj = si
-	addb    %ch, %cl
-	movzbl  %cl, %ecx		C  Clear, so it can be used
-					C  for indexing.
-	movb    (%ebp, %ecx), %cl
-	xorb    1(%esi, %edx, 2), %cl
-	incl    %edx
-	movb    %cl, -1(%edi, %edx, 2)
-
-	jnz	.Lloop
-
-C .Lloop_done:
-	decb	%al
-	movb	%al, ARCFOUR_I (%ebp)		C  Store the new i and j.
-	movb	%bl, ARCFOUR_J (%ebp)
-.Lend:
-	popl	%edi
-	popl	%esi
-	popl	%ebp
-	popl	%ebx
-	ret
-EPILOGUE(nettle_arcfour_crypt)

_service:tar_scm:nettle-3.8.1.tar.gz/x86_64/fat/sha256-compress-2.asm Deleted

@@ -1,34 +0,0 @@
-C x86_64/fat/sha256-compress-2.asm
-
-ifelse(`
-   Copyright (C) 2018 Niels Möller
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-')
-
-define(`fat_transform', `$1_sha_ni')
-include_src(`x86_64/sha_ni/sha256-compress.asm')

_service:tar_scm:nettle-3.8.1.tar.gz/x86_64/fat/sha256-compress.asm Deleted

@@ -1,34 +0,0 @@
-C x86_64/fat/sha256-compress.asm
-
-ifelse(`
-   Copyright (C) 2018 Niels Möller
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-')
-
-define(`fat_transform', `$1_x86_64')
-include_src(`x86_64/sha256-compress.asm')

_service:tar_scm:nettle-3.8.1.tar.gz/x86_64/sha256-compress.asm Deleted

@@ -1,210 +0,0 @@
-C x86_64/sha256-compress.asm
-
-ifelse(`
- Copyright (C) 2013 Niels Möller
-
- This file is part of GNU Nettle.
-
- GNU Nettle is free software: you can redistribute it and/or
- modify it under the terms of either:
-
- * the GNU Lesser General Public License as published by the Free
- Software Foundation; either version 3 of the License, or (at your
- option) any later version.
-
- or
-
- * the GNU General Public License as published by the Free
- Software Foundation; either version 2 of the License, or (at your
- option) any later version.
-
- or both in parallel, as here.
-
- GNU Nettle is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- General Public License for more details.
-
- You should have received copies of the GNU General Public License and
- the GNU Lesser General Public License along with this program. If
- not, see http://www.gnu.org/licenses/.
-')
-
-	.file "sha256-compress.asm"
-define(`STATE', `%rdi')
-define(`INPUT', `%rsi')
-define(`K', `%rdx')
-define(`SA', `%eax')
-define(`SB', `%ebx')
-define(`SC', `%ecx')
-define(`SD', `%r8d')
-define(`SE', `%r9d')
-define(`SF', `%r10d')
-define(`SG', `%r11d')
-define(`SH', `%r12d')
-define(`T0', `%r13d')
-define(`T1', `%edi')	C Overlap STATE
-define(`COUNT', `%r14')
-define(`W', `%r15d')
-
-define(`EXPN', `
-	movl	OFFSET($1)(%rsp), W
-	movl	OFFSET(eval(($1 + 14) % 16))(%rsp), T0
-	movl	T0, T1
-	shrl	`$'10, T0
-	roll	`$'13, T1
-	xorl	T1, T0
-	roll	`$'2, T1
-	xorl	T1, T0
-	addl	T0, W
-	movl	OFFSET(eval(($1 + 1) % 16))(%rsp), T0
-	movl	T0, T1
-	shrl	`$'3, T0
-	roll	`$'14, T1
-	xorl	T1, T0
-	roll	`$'11, T1
-	xorl	T1, T0
-	addl	T0, W
-	addl	OFFSET(eval(($1 + 9) % 16))(%rsp), W
-	movl	W, OFFSET($1)(%rsp)
-')
-
-C ROUND(A,B,C,D,E,F,G,H,K)
-C
-C H += S1(E) + Choice(E,F,G) + K + W
-C D += H
-C H += S0(A) + Majority(A,B,C)
-C
-C Where
-C
-C S1(E) = E<<<26 ^ E<<<21 ^ E<<<7
-C S0(A) = A<<<30 ^ A<<<19 ^ A<<<10
-C Choice (E, F, G) = G^(E&(F^G))
-C Majority (A,B,C) = (A&B) + (C&(A^B))
-
-define(`ROUND', `
-	movl	$5, T0
-	movl	$5, T1
-	roll	`$'7, T0
-	roll	`$'21, T1
-	xorl	T0, T1
-	roll	`$'19, T0
-	xorl	T0, T1
-	addl	W, $8
-	addl	T1, $8
-	movl	$7, T0
-	xorl	$6, T0
-	andl	$5, T0
-	xorl	$7, T0
-	addl	OFFSET($9)(K,COUNT,4), $8
-	addl	T0, $8
-	addl	$8, $4
-
-	movl	$1, T0
-	movl	$1, T1
-	roll	`$'10, T0
-	roll	`$'19, T1
-	xorl	T0, T1
-	roll	`$'20, T0
-	xorl	T0, T1
-	addl	T1, $8
-	movl	$1, T0
-	movl	$1, T1
-	andl	$2, T0
-	xorl	$2, T1
-	addl	T0, $8
-	andl	$3, T1
-	addl	T1, $8
-')
-
-define(`NOEXPN', `
-	movl	OFFSET($1)(INPUT, COUNT, 4), W
-	bswapl	W
-	movl	W, OFFSET($1)(%rsp, COUNT, 4)
-')
-
-	C void
-	C _nettle_sha256_compress(uint32_t *state, const uint8_t *input, const uint32_t *k)
-
-	.text
-	ALIGN(16)
-
-PROLOGUE(_nettle_sha256_compress)
-	W64_ENTRY(3, 0)
-
-	sub	$120, %rsp
-	mov	%rbx, 64(%rsp)
-	mov	STATE, 72(%rsp)	C Save state, to free a register
-	mov	%rbp, 80(%rsp)
-	mov	%r12, 88(%rsp)
-	mov	%r13, 96(%rsp)
-	mov	%r14, 104(%rsp)
-	mov	%r15, 112(%rsp)
-
-	movl	(STATE), SA
-	movl	4(STATE), SB
-	movl	8(STATE), SC
-	movl	12(STATE), SD
-	movl	16(STATE), SE
-	movl	20(STATE), SF
-	movl	24(STATE), SG
-	movl	28(STATE), SH
-	xor	COUNT, COUNT
-	ALIGN(16)
-
-.Loop1:
-	NOEXPN(0) ROUND(SA,SB,SC,SD,SE,SF,SG,SH,0)
-	NOEXPN(1) ROUND(SH,SA,SB,SC,SD,SE,SF,SG,1)
-	NOEXPN(2) ROUND(SG,SH,SA,SB,SC,SD,SE,SF,2)
-	NOEXPN(3) ROUND(SF,SG,SH,SA,SB,SC,SD,SE,3)
-	NOEXPN(4) ROUND(SE,SF,SG,SH,SA,SB,SC,SD,4)
-	NOEXPN(5) ROUND(SD,SE,SF,SG,SH,SA,SB,SC,5)
-	NOEXPN(6) ROUND(SC,SD,SE,SF,SG,SH,SA,SB,6)
-	NOEXPN(7) ROUND(SB,SC,SD,SE,SF,SG,SH,SA,7)
-	add	$8, COUNT
-	cmp	$16, COUNT
-	jne	.Loop1
-
-.Loop2:
-	EXPN( 0) ROUND(SA,SB,SC,SD,SE,SF,SG,SH,0)
-	EXPN( 1) ROUND(SH,SA,SB,SC,SD,SE,SF,SG,1)
-	EXPN( 2) ROUND(SG,SH,SA,SB,SC,SD,SE,SF,2)
-	EXPN( 3) ROUND(SF,SG,SH,SA,SB,SC,SD,SE,3)
-	EXPN( 4) ROUND(SE,SF,SG,SH,SA,SB,SC,SD,4)
-	EXPN( 5) ROUND(SD,SE,SF,SG,SH,SA,SB,SC,5)
-	EXPN( 6) ROUND(SC,SD,SE,SF,SG,SH,SA,SB,6)
-	EXPN( 7) ROUND(SB,SC,SD,SE,SF,SG,SH,SA,7)
-	EXPN( 8) ROUND(SA,SB,SC,SD,SE,SF,SG,SH,8)
-	EXPN( 9) ROUND(SH,SA,SB,SC,SD,SE,SF,SG,9)
-	EXPN(10) ROUND(SG,SH,SA,SB,SC,SD,SE,SF,10)
-	EXPN(11) ROUND(SF,SG,SH,SA,SB,SC,SD,SE,11)
-	EXPN(12) ROUND(SE,SF,SG,SH,SA,SB,SC,SD,12)
-	EXPN(13) ROUND(SD,SE,SF,SG,SH,SA,SB,SC,13)
-	EXPN(14) ROUND(SC,SD,SE,SF,SG,SH,SA,SB,14)
-	EXPN(15) ROUND(SB,SC,SD,SE,SF,SG,SH,SA,15)
-	add	$16, COUNT
-	cmp	$64, COUNT
-	jne	.Loop2
-
-	mov	72(%rsp), STATE
-
-	addl	SA, (STATE)
-	addl	SB, 4(STATE)
-	addl	SC, 8(STATE)
-	addl	SD, 12(STATE)
-	addl	SE, 16(STATE)
-	addl	SF, 20(STATE)
-	addl	SG, 24(STATE)
-	addl	SH, 28(STATE)
-

_service:tar_scm:nettle-3.8.1.tar.gz/x86_64/sha_ni/sha256-compress.asm Deleted

@@ -1,175 +0,0 @@
-C x86_64/sha_ni/sha256-compress.asm
-
-ifelse(`
-   Copyright (C) 2018 Niels Möller
-
-   This file is part of GNU Nettle.
-
-   GNU Nettle is free software: you can redistribute it and/or
-   modify it under the terms of either:
-
-     * the GNU Lesser General Public License as published by the Free
-       Software Foundation; either version 3 of the License, or (at your
-       option) any later version.
-
-   or
-
-     * the GNU General Public License as published by the Free
-       Software Foundation; either version 2 of the License, or (at your
-       option) any later version.
-
-   or both in parallel, as here.
-
-   GNU Nettle is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   General Public License for more details.
-
-   You should have received copies of the GNU General Public License and
-   the GNU Lesser General Public License along with this program.  If
-   not, see http://www.gnu.org/licenses/.
-')
-
-	.file "sha256-compress.asm"
-define(`STATE', `%rdi')
-define(`INPUT', `%rsi')
-define(`K', `%rdx')
-
-define(`MSGK',`%xmm0')	C Implicit operand of sha256rnds2
-define(`MSG0',`%xmm1')
-define(`MSG1',`%xmm2')
-define(`MSG2',`%xmm3')
-define(`MSG3',`%xmm4')
-define(`ABEF',`%xmm5')
-define(`CDGH',`%xmm6')
-define(`ABEF_ORIG',`%xmm7')
-define(`CDGH_ORIG', `%xmm8')
-define(`SWAP_MASK',`%xmm9')
-define(`TMP', `%xmm9')	C Overlaps SWAP_MASK
-
-C QROUND(M0, M1, M2, M3, R)
-define(`QROUND', `
-	movdqa	eval($5*4)(K), MSGK
-	paddd	$1, MSGK
-	sha256rnds2 ABEF, CDGH
-	pshufd	`$'0xe, MSGK, MSGK
-	sha256rnds2 CDGH, ABEF
-	movdqa	$1, TMP
-	palignr	`$'4, $4, TMP
-	paddd	TMP, $2
-	sha256msg2 $1, $2
-	sha256msg1 $1, $4
-	')
-
-C FIXME: Do something more clever, taking the pshufd into account.
-C TRANSPOSE(ABCD, EFGH, scratch) --> untouched, ABEF, CDGH
-define(`TRANSPOSE', `
-	movdqa	$2, $3
-	punpckhqdq $1, $2
-	punpcklqdq $1, $3
-')
-
-	C void
-	C _nettle_sha256_compress(uint32_t *state, const uint8_t *input, const uint32_t *k)
-
-	.text
-	ALIGN(16)
-.Lswap_mask:
-	.byte 3,2,1,0,7,6,5,4,11,10,9,8,15,14,13,12
-PROLOGUE(_nettle_sha256_compress)
-	W64_ENTRY(3, 10)
-	movups	(STATE), TMP
-	movups	16(STATE), ABEF
-
-	pshufd	$0x1b, TMP, TMP
-	pshufd	$0x1b, ABEF, ABEF
-
-	TRANSPOSE(TMP, ABEF, CDGH)
-
-	movdqa	.Lswap_mask(%rip), SWAP_MASK
-
-	movdqa	ABEF, ABEF_ORIG
-	movdqa	CDGH, CDGH_ORIG
-
-	movups	(INPUT), MSG0
-	pshufb	SWAP_MASK, MSG0
-
-	movdqa	(K), MSGK
-	paddd	MSG0, MSGK
-	sha256rnds2 ABEF, CDGH		C Round 0-1
-	pshufd	$0xe, MSGK, MSGK
-	sha256rnds2 CDGH, ABEF		C Round 2-3
-
-	movups	16(INPUT), MSG1
-	pshufb	SWAP_MASK, MSG1
-
-	movdqa	16(K), MSGK
-	paddd	MSG1, MSGK
-	sha256rnds2 ABEF, CDGH		C Round 4-5
-	pshufd	$0xe, MSGK, MSGK
-	sha256rnds2 CDGH, ABEF		C Round 6-7
-	sha256msg1 MSG1, MSG0
-
-	movups	32(INPUT), MSG2
-	pshufb	SWAP_MASK, MSG2
-
-	movdqa	32(K), MSGK
-	paddd	MSG2, MSGK
-	sha256rnds2 ABEF, CDGH		C Round 8-9
-	pshufd	$0xe, MSGK, MSGK
-	sha256rnds2 CDGH, ABEF		C Round 10-11
-	sha256msg1 MSG2, MSG1
-
-	movups	48(INPUT), MSG3
-	pshufb	SWAP_MASK, MSG3
-
-	QROUND(MSG3, MSG0, MSG1, MSG2, 12)	C Round 12-15
-	QROUND(MSG0, MSG1, MSG2, MSG3, 16)
-	QROUND(MSG1, MSG2, MSG3, MSG0, 20)
-	QROUND(MSG2, MSG3, MSG0, MSG1, 24)
-	QROUND(MSG3, MSG0, MSG1, MSG2, 28)
-	QROUND(MSG0, MSG1, MSG2, MSG3, 32)
-	QROUND(MSG1, MSG2, MSG3, MSG0, 36)
-	QROUND(MSG2, MSG3, MSG0, MSG1, 40)
-	QROUND(MSG3, MSG0, MSG1, MSG2, 44)
-	QROUND(MSG0, MSG1, MSG2, MSG3, 48)
-
-	movdqa	208(K), MSGK
-	paddd	MSG1, MSGK
-	sha256rnds2 ABEF, CDGH		C Round 52-53
-	pshufd	$0xe, MSGK, MSGK
-	sha256rnds2 CDGH, ABEF		C Round 54-55
-	movdqa	MSG1, TMP
-	palignr	$4, MSG0, TMP
-	paddd	TMP, MSG2
-	sha256msg2 MSG1, MSG2
-
-	movdqa	224(K), MSGK
-	paddd	MSG2, MSGK
-	sha256rnds2 ABEF, CDGH		C Round 56-57
-	pshufd	$0xe, MSGK, MSGK
-	sha256rnds2 CDGH, ABEF		C Round 58-59
-	movdqa	MSG2, TMP
-	palignr	$4, MSG1, TMP
-	paddd	TMP, MSG3
-	sha256msg2 MSG2, MSG3
-
-	movdqa	240(K), MSGK
-	paddd	MSG3, MSGK
-	sha256rnds2 ABEF, CDGH		C Round 60-61
-	pshufd	$0xe, MSGK, MSGK
-	sha256rnds2 CDGH, ABEF		C Round 62-63
-
-	paddd ABEF_ORIG, ABEF
-	paddd CDGH_ORIG, CDGH
-
-	TRANSPOSE(ABEF, CDGH, TMP)
-
-	pshufd	$0x1b, CDGH, CDGH
-	pshufd	$0x1b, TMP, TMP
-	movups	CDGH, 0(STATE)
-	movups	TMP, 16(STATE)
-
-	W64_EXIT(3, 10)
-	ret
-EPILOGUE(_nettle_sha256_compress)

_service:tar_scm:nettle-3.8.1.tar.gz/AUTHORS -> _service:tar_scm:nettle-3.9.1.tar.gz/AUTHORS Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ChangeLog -> _service:tar_scm:nettle-3.9.1.tar.gz/ChangeLog Changed

@@ -1,10 +1,464 @@
+2023-06-01 Niels Möller <nisse@lysator.liu.se>
+
+	* Released Nettle-3.9.1.
+
+2023-05-26 Niels Möller <nisse@lysator.liu.se>
+
+	* configure.ac: Bump package version, to 3.9.1.
+	(LIBNETTLE_MINOR): Bump minor number, to 8.8.
+	(LIBHOGWEED_MINOR): Bump minor number, to 6.8.
+
+2023-05-19 Niels Möller <nisse@lysator.liu.se>
+
+	From Jussi Kivilinna:
+	* ocb.c (ocb_crypt_n): Fix broken loop logic.
+	* testsuite/ocb-test.c (test_main): Add test vector from libgcrypt,
+	with larger message, to exercise above loop.
+
+2023-05-16 Niels Möller <nisse@lysator.liu.se>
+
+	* x86_64/ghash-update.asm: Use separate unaligned load
+	instructions (movups) to load the tabulated values, since they are
+	only 8-byte aligned and pand memory operands require 16-byte
+	alignment.
+
+2023-05-15 Niels Möller <nisse@lysator.liu.se>
+
+	* eccdata.c (output_bignum_redc): Add missing mpz_clear, reported
+	by Noah Watkins.
+	(output_digits): Delete a gratuitous mpz_init.
+
+2023-05-14 Niels Möller <nisse@lysator.liu.se>
+
+	* Released nettle-3.9.
+
+2023-05-12 Niels Möller <nisse@lysator.liu.se>
+
+	* texinfo.tex: Delete unused file.
+
+	Copy files from https://git.savannah.gnu.org/cgit/gnulib.git/plain/build-aux/
+	* install-sh: Update to 2020-11-14.01 version.
+	* config.guess: Update to 2023-01-01 version.
+	* config.sub: Update to 2023-01-21 version.
+
+2023-05-10 Niels Möller <nisse@lysator.liu.se>
+
+	Fix compile error in --disable-public-key configuration.
+	* testsuite/sha1-test.c: Add missing include of sha1.h.
+	* testsuite/sha256-test.c: Add missing include of sha2.h.
+
+2023-05-07 Niels Möller <nisse@lysator.liu.se>
+
+	* configure.ac: Bump package version, to 3.9.
+	(LIBNETTLE_MINOR): Bump minor number, to 8.7 (8.6 was used for
+	Nettle-3.8.1).
+	(LIBHOGWEED_MINOR): Bump minor number, to 6.7.
+
+2023-04-25 Niels Möller <nisse@lysator.liu.se>
+
+	Rework tests of SIV message functions.
+	* testsuite/siv-gcm-test.c (nettle_encrypt_message_func)
+	(nettle_decrypt_message_func): Delete typedefs.
+	(test_compare_results, test_cipher_siv_gcm): Delete functions.
+	(test_siv_gcm_aes128, test_siv_gcm_aes256): Delete macros.
+	(siv_gcm_aes128, siv_gcm_aes256): New algorithm structs.
+	(test_main): Use test_aead_message.
+
+	* testsuite/siv-cmac-test.c (nettle_encrypt_message_func)
+	(nettle_decrypt_message_func): Delete typedefs.
+	(test_compare_results, test_cipher_siv): Delete functions.
+	(test_siv_aes128, test_siv_aes256): Delete macros.
+	(siv_cmac_aes128, siv_cmac_aes256): New algorithm structs.
+	(test_main): Use test_aead_message.
+
+2023-04-24 Niels Möller <nisse@lysator.liu.se>
+
+	Rework tests of OCB message functions.
+	* testsuite/testutils.c (test_aead_message): New function, for
+	testing AEAD message functions.
+	* testsuite/testutils.h (nettle_encrypt_message_func)
+	(nettle_decrypt_message_func): New typedefs.
+	(struct nettle_aead_message): New struct.
+	* testsuite/ocb-test.c (nettle_encrypt_message_func)
+	(nettle_decrypt_message_func): Deleted typedefs.
+	(test_compare_results): Deleted function.
+	(test_ocb_aes128): Deleted macro.
+	(struct ocb_aes128_message_key): New struct.
+	(ocb_aes128_set_encrypt_key_wrapper)
+	(ocb_aes128_set_decrypt_key_wrapper)
+	(ocb_aes128_encrypt_message_wrapper)
+	(ocb_aes128_decrypt_message_wrapper): New wrapper functions, using
+	above ocb_aes128_message_key for both encrypt and decrypt, and a
+	fix tag length of 16 octets.
+	(ocb_aes128_message): New algorithm struct, with above wrappers.
+	(test_main): Use test_aead_message.
+
+2023-04-23 Niels Möller <nisse@lysator.liu.se>
+
+	* testsuite/siv-cmac-test.c: Renamed file, from...
+	* testsuite/siv-test.c: ... old name.
+
+2023-04-13 Niels Möller <nisse@lysator.liu.se>
+
+	* ghash-update.c (gcm_gf_mul): Rewrite to avoid side-channel
+	leakage. Now processes the message bits one at a time, using
+	tabulated values of the key premultiplied by appropriate powers of
+	x, so that the table is accessed in a fixed sequential order.
+	Performance penalty, on x86_64, is roughly 3 times.
+	(shift_table): Deleted table.
+	(gcm_gf_shift_8): Deleted function.
+	* ghash-set-key.c (_ghash_set_key): Rewrite table generation.
+	* gcmdata.c: Deleted.
+	* Makefile.in: Delete references to gcmdata.
+
+	* x86_64/ghash-update.asm: Rewritten, similar side-channel silent
+	method as the C implementation, with same table layout, but using
+	sse2 instructions.
+
+	* testsuite/gcm-test.c (test_ghash_internal): Add valgrind
+	annotations, to verify that the ghash implementation makes no
+	data-dependent branches or memory accesses.
+
+	* examples/nettle-benchmark.c (bench_ghash_update): New function.
+
+2023-04-03 Niels Möller <nisse@lysator.liu.se>
+
+	From Mamone Tarsha:
+	* x86_64/pclmul/ghash-update.asm: New loop to process two blocks
+	at a time.
+	* x86_64/pclmul/ghash-set-key.asm: Likewise.
+
+2023-03-25 Niels Möller <nisse@lysator.liu.se>
+
+	* ocb.h (OCB_MAX_NONCE_SIZE): New constant.
+
+2023-02-16 Niels Möller <nisse@lysator.liu.se>
+
+	* x86_64/sha256-compress-n.asm: Fix incorrect w64 setup. Report
+	and fix from Gisle Vanem.
+
+2023-02-08 Niels Möller <nisse@lysator.liu.se>
+
+	* examples/nettle-benchmark.c (main): Benchmark ocb_aes128.
+
+2023-02-07 Niels Möller <nisse@lysator.liu.se>
+
+	Implement OCB mode. RFC 7253.
+	* block-internal.h (block16_set): New function.
+
+	* ocb.c (ocb_set_key, ocb_set_nonce, ocb_update, ocb_encrypt)
+	(ocb_decrypt, ocb_encrypt_message, ocb_decrypt_message): New
+	public functions.
+	(MEM_ROTATE_RIGHT, MEM_MASK): New macros.
+	(extract, update_offset, pad_block, ocb_fill_n, ocb_crypt_n)
+	(ocb_checksum_n): New helper functions.
+	* ocb-aes128.c (ocb_aes128_set_encrypt_key)
+	(ocb_aes128_set_decrypt_key, ocb_aes128_set_nonce)
+	(ocb_aes128_update, ocb_aes128_encrypt, ocb_aes128_decrypt)
+	(ocb_aes128_digest, ocb_aes128_encrypt_message)
+	(ocb_aes128_decrypt_message): New file, new functions.
+	* ocb.h: Declare ocb functions.
+	(struct ocb_key): New struct.
+	(struct ocb_ctx): New struct.
+	(struct ocb_aes128_encrypt_key): New struct.
+	* Makefile.in (nettle_SOURCES): Add ocb.c ocb-aes128.c.
+	(HEADERS): Add ocb.h.
+
+	* nettle-internal.c (nettle_ocb_aes128)
+	(ocb_aes128_set_encrypt_key_wrapper)
+	(ocb_aes128_set_decrypt_key_wrapper)
+	(ocb_aes128_set_nonce_wrapper, ocb_aes128_update_wrapper)
+	(ocb_aes128_encrypt_wrapper, ocb_aes128_decrypt_wrapper)
+	(ocb_aes128_digest_wrapper): New aead algorithm, and
+	related wrapper functions.
+	* nettle-internal.h (OCB_NONCE_SIZE): New constant.
+	(struct ocb_aes128_ctx): New struct.
+
+	* testsuite/ocb-test.c: New tests.
+	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Add ocb-test.c.
+
+2023-02-06 Niels Möller <nisse@lysator.liu.se>
+
+	* testsuite/testutils.c (test_aead): Always use set_nonce function
+	pointer if non-NULL, test varying alignment, output the unexpected
+	data when test fails.
+
+2022-12-05 Niels Möller <nisse@lysator.liu.se>
+
+	* xts-aes128.c (xts_aes128_encrypt_message)
+	(xts_aes128_decrypt_message): const-declare the xts_key argument.
+	* xts-aes256.c (xts_aes256_encrypt_message)
+	(xts_aes256_decrypt_message): Likewise.
+
+2022-11-09 Niels Möller <nisse@lysator.liu.se>
+
+	From Mamone Tarsha:
+	* powerpc64/p9/poly1305-blocks.asm: New file, multi-block radix
+	2^44 implementation. Benchmarked to give a speedup of 3.2 times on
+	Power9.
+	* powerpc64/p9/poly1305.m4 (DEFINES_BLOCK_R64, BLOCK_R64): New

_service:tar_scm:nettle-3.8.1.tar.gz/Makefile.in -> _service:tar_scm:nettle-3.9.1.tar.gz/Makefile.in Changed

@@ -81,8 +81,10 @@
 		 aes256-set-encrypt-key.c aes256-set-decrypt-key.c \
 		 aes256-meta.c \
 		 nist-keywrap.c \
-		 arcfour.c arcfour-crypt.c \
+		 arcfour.c \
 		 arctwo.c arctwo-meta.c blowfish.c blowfish-bcrypt.c \
+		 balloon.c balloon-sha1.c balloon-sha256.c \
+		 balloon-sha384.c balloon-sha512.c \
 		 base16-encode.c base16-decode.c base16-meta.c \
 		 base64-encode.c base64-decode.c base64-meta.c \
 		 base64url-encode.c base64url-decode.c base64url-meta.c \
@@ -100,18 +102,22 @@
 		 cbc.c cbc-aes128-encrypt.c cbc-aes192-encrypt.c cbc-aes256-encrypt.c \
 		 ccm.c ccm-aes128.c ccm-aes192.c ccm-aes256.c cfb.c \
 		 siv-cmac.c siv-cmac-aes128.c siv-cmac-aes256.c \
+		 siv-gcm.c siv-gcm-aes128.c siv-gcm-aes256.c \
 		 cnd-memcpy.c \
 		 chacha-crypt.c chacha-core-internal.c \
 		 chacha-poly1305.c chacha-poly1305-meta.c \
 		 chacha-set-key.c chacha-set-nonce.c \
 		 ctr.c ctr16.c des.c des3.c \
 		 eax.c eax-aes128.c eax-aes128-meta.c \
-		 ghash-set-key.c ghash-update.c gcm.c gcm-aes.c \
+		 ghash-set-key.c ghash-update.c \
+		 siv-ghash-set-key.c siv-ghash-update.c \
+		 gcm.c gcm-aes.c \
 		 gcm-aes128.c gcm-aes128-meta.c \
 		 gcm-aes192.c gcm-aes192-meta.c \
 		 gcm-aes256.c gcm-aes256-meta.c \
 		 gcm-camellia128.c gcm-camellia128-meta.c \
 		 gcm-camellia256.c gcm-camellia256-meta.c \
+		 gcm-sm4.c gcm-sm4-meta.c \
 		 cmac.c cmac64.c cmac-aes128.c cmac-aes256.c cmac-des3.c \
 		 cmac-aes128-meta.c cmac-aes256-meta.c cmac-des3-meta.c \
 		 gost28147.c gosthash94.c gosthash94-meta.c \
@@ -128,9 +134,10 @@
 		 nettle-lookup-hash.c \
 		 nettle-meta-aeads.c nettle-meta-armors.c \
 		 nettle-meta-ciphers.c nettle-meta-hashes.c nettle-meta-macs.c \
+		 ocb.c ocb-aes128.c \
 		 pbkdf2.c pbkdf2-hmac-gosthash94.c pbkdf2-hmac-sha1.c \
 		 pbkdf2-hmac-sha256.c pbkdf2-hmac-sha384.c pbkdf2-hmac-sha512.c \
-		 poly1305-aes.c poly1305-internal.c \
+		 poly1305-aes.c poly1305-internal.c poly1305-update.c \
 		 realloc.c \
 		 ripemd160.c ripemd160-compress.c ripemd160-meta.c \
 		 salsa20-core-internal.c salsa20-crypt-internal.c \
@@ -138,7 +145,7 @@
 		 salsa20-set-nonce.c \
 		 salsa20-128-set-key.c salsa20-256-set-key.c \
 		 sha1.c sha1-compress.c sha1-meta.c \
-		 sha256.c sha256-compress.c sha224-meta.c sha256-meta.c \
+		 sha256.c sha256-compress-n.c sha224-meta.c sha256-meta.c \
 		 sha512.c sha512-compress.c sha384-meta.c sha512-meta.c \
 		 sha512-224-meta.c sha512-256-meta.c \
 		 sha3.c sha3-permute.c \
@@ -150,6 +157,7 @@
 		 serpent-meta.c \
 		 streebog.c streebog-meta.c \
 		 twofish.c twofish-meta.c \
+		 sm4.c sm4-meta.c \
 		 umac-nh.c umac-nh-n.c umac-l2.c umac-l3.c \
 		 umac-poly64.c umac-poly128.c umac-set-key.c \
 		 umac32.c umac64.c umac96.c umac128.c \
@@ -187,7 +195,7 @@
 		 dsa2sexp.c sexp2dsa.c \
 		 pgp-encode.c rsa2openpgp.c \
 		 der-iterator.c der2rsa.c der2dsa.c \
-		 sec-add-1.c sec-sub-1.c sec-tabselect.c \
+		 sec-add-1.c sec-sub-1.c \
 		 gmp-glue.c cnd-copy.c \
 		 ecc-mod.c ecc-mod-inv.c \
 		 ecc-mod-arith.c ecc-pp1-redc.c ecc-pm1-redc.c \
@@ -196,7 +204,7 @@
 		 ecc-secp192r1.c ecc-secp224r1.c ecc-secp256r1.c \
 		 ecc-secp384r1.c ecc-secp521r1.c \
 		 ecc-size.c ecc-j-to-a.c ecc-a-to-j.c \
-		 ecc-dup-jj.c ecc-add-jja.c ecc-add-jjj.c \
+		 ecc-dup-jj.c ecc-add-jja.c ecc-add-jjj.c ecc-nonsec-add-jjj.c \
 		 ecc-eh-to-a.c \
 		 ecc-dup-eh.c ecc-add-eh.c ecc-add-ehh.c \
 		 ecc-dup-th.c ecc-add-th.c ecc-add-thh.c \
@@ -218,7 +226,7 @@
 
 OPT_SOURCES = fat-arm.c fat-arm64.c fat-ppc.c fat-s390x.c fat-x86_64.c mini-gmp.c
 
-HEADERS = aes.h arcfour.h arctwo.h asn1.h blowfish.h \
+HEADERS = aes.h arcfour.h arctwo.h asn1.h blowfish.h balloon.h \
 	 base16.h base64.h bignum.h buffer.h camellia.h cast128.h \
 	 cbc.h ccm.h cfb.h chacha.h chacha-poly1305.h ctr.h \
 	 curve25519.h curve448.h des.h dsa.h dsa-compat.h eax.h \
@@ -226,15 +234,15 @@
 	 gcm.h gostdsa.h gosthash94.h hmac.h \
 	 knuth-lfib.h hkdf.h \
 	 macros.h \
-	 cmac.h siv-cmac.h \
+	 cmac.h siv-cmac.h siv-gcm.h \
 	 md2.h md4.h \
 	 md5.h md5-compat.h \
 	 memops.h memxor.h \
 	 nettle-meta.h nettle-types.h \
-	 pbkdf2.h \
+	 ocb.h pbkdf2.h \
 	 pgp.h pkcs1.h pss.h pss-mgf1.h realloc.h ripemd160.h rsa.h \
-	 salsa20.h sexp.h \
-	 serpent.h sha.h sha1.h sha2.h sha3.h sm3.h streebog.h twofish.h \
+	 salsa20.h sexp.h serpent.h \
+	 sha.h sha1.h sha2.h sha3.h sm3.h sm4.h streebog.h twofish.h \
 	 umac.h yarrow.h xts.h poly1305.h nist-keywrap.h
 
 INSTALL_HEADERS = $(HEADERS) version.h @IF_MINI_GMP@ mini-gmp.h
@@ -242,7 +250,7 @@
 SOURCES = $(nettle_SOURCES) $(hogweed_SOURCES) \
 	 $(getopt_SOURCES) $(internal_SOURCES) \
 	 $(OPT_SOURCES) \
-	 aesdata.c desdata.c twofishdata.c shadata.c gcmdata.c eccdata.c
+	 aesdata.c desdata.c twofishdata.c shadata.c eccdata.c
 
 # NOTE: This list must include all source files, with no duplicates,
 # independently of which source files are included in the build.
@@ -251,16 +259,17 @@
 	aclocal.m4 configure.ac \
 	configure stamp-h.in version.h.in \
 	libnettle.map.in libhogweed.map.in \
-	config.guess config.sub install-sh texinfo.tex \
+	config.guess config.sub install-sh \
 	config.h.in config.m4.in config.make.in	Makefile.in \
 	README CONTRIBUTING.md AUTHORS COPYING.LESSERv3 COPYINGv2 COPYINGv3 \
 	INSTALL NEWS ChangeLog \
 	nettle.pc.in hogweed.pc.in \
 	desdata.stamp $(des_headers) descore.README \
-	aes-internal.h block-internal.h blowfish-internal.h camellia-internal.h \
+	aes-internal.h block-internal.h blowfish-internal.h bswap-internal.h \
+	camellia-internal.h \
 	ghash-internal.h gost28147-internal.h poly1305-internal.h \
 	serpent-internal.h cast128_sboxes.h desinfo.h desCode.h \
-	ripemd160-internal.h sha2-internal.h \
+	ripemd160-internal.h md-internal.h sha2-internal.h \
 	memxor-internal.h nettle-internal.h nettle-write.h \
 	ctr-internal.h chacha-internal.h sha3-internal.h \
 	salsa20-internal.h umac-internal.h hogweed-internal.h \
@@ -290,7 +299,7 @@
 
 %.$(OBJEXT): %.asm $(srcdir)/m4-utils.m4 $(srcdir)/asm.m4 config.m4 machine.m4
 	$(M4) $(srcdir)/m4-utils.m4 $(srcdir)/asm.m4 config.m4 machine.m4 $< >$*.s
-	$(COMPILE) -c $*.s
+	$(COMPILE) $(ASM_FLAGS) -c $*.s
 
 %.$(OBJEXT): %.c
 	$(COMPILE) -c $< \
@@ -607,7 +616,7 @@
 		x86_64 x86_64/aesni x86_64/sha_ni x86_64/pclmul x86_64/fat \
 		arm arm/neon arm/v6 arm/fat \
 		arm64 arm64/crypto arm64/fat \
-		powerpc64 powerpc64/p7 powerpc64/p8 powerpc64/fat \
+		powerpc64 powerpc64/p7 powerpc64/p8 powerpc64/p9 powerpc64/fat \
 		s390x s390x/vf s390x/msa s390x/msa_x1 s390x/msa_x2 s390x/msa_x4 s390x/fat ; do \
 	 mkdir "$(distdir)/$$d" ; \
 	 find "$(srcdir)/$$d" -maxdepth 1 '(' -name '*.asm' -o -name '*.m4' -o -name README ')' \
@@ -674,7 +683,6 @@
 		desdata$(EXEEXT_FOR_BUILD) \
 		twofishdata$(EXEEXT_FOR_BUILD) \
 		shadata$(EXEEXT_FOR_BUILD) \
-		gcmdata$(EXEEXT_FOR_BUILD) \
 		eccdata$(EXEEXT_FOR_BUILD) eccdata.stamp
 	-rm -rf .lib libnettle.stamp libhogweed.stamp

_service:tar_scm:nettle-3.8.1.tar.gz/NEWS -> _service:tar_scm:nettle-3.9.1.tar.gz/NEWS Changed

@@ -1,3 +1,114 @@
+NEWS for the Nettle 3.9.1 release
+
+	This is a bugfix release, fixing a few bugs reported for
+	Nettle-3.9. The bug in the new OCB code may be exploitable for
+	denial of service or worse, since triggering it leads to
+	memory corruption. Upgrading from Nettle-3.9 to the new
+	version is strongly recommended.
+
+	The new version is intended to be fully source and binary
+	compatible with Nettle-3.6. The shared library names are
+	libnettle.so.8.8 and libhogweed.so.6.8, with sonames
+	libnettle.so.8 and libhogweed.so.6.
+
+	Bug fixes:
+
+	* Fix OCB loop for processing messages of size 272 bytes or
+	  larger. Reported and fixed by Jussi Kivilinna.
+
+	* Fix alignment bug in the new x86_64 non-pclmul assembly
+	  implementation of ghash. Reported by Henrik Grubbström.
+
+	* Fix build-time memory leak in eccdata. Reported by Noah
+	  Watkins.
+
+NEWS for the Nettle 3.9 release
+
+	This release includes bug fixes, several new features, a few
+	performance improvements, and one performance regression
+	affecting GCM on certain platforms.
+
+	The new version is intended to be fully source and binary
+	compatible with Nettle-3.6. The shared library names are
+	libnettle.so.8.7 and libhogweed.so.6.7, with sonames
+	libnettle.so.8 and libhogweed.so.6.
+
+	This release includes a rewrite of the C implementation of
+	GHASH (dating from 2011), as well as the plain x86_64 assembly
+	version, to use precomputed tables in a different way, with
+	tables always accessed in the same sequential manner.
+
+	This should make Nettle's GHASH implementation side-channel
+	silent on all platforms, but considerably slower on platforms
+	without carry-less mul instructions. E.g., benchmarks of the C
+	implementation on x86_64 showed a slowdown of 3 times.
+
+	Bug fixes:
+
+	* Fix bug in ecdsa and gostdsa signature verify operation, for
+	  the unlikely corner case that point addition really is point
+	  duplication.
+
+	* Fix for chacha on Power7, nettle's assembly used an
+	  instruction only available on later processors. Fixed by
+	  Mamone Tarsha.
+
+	* GHASH implementation should now be side-channel silent on
+	  all architectures.
+
+	* A few portability fixes for *BSD.
+
+	New features:
+
+	* Support for the SM4 block cipher, contributed by Tianjia
+          Zhang.
+
+	* Support for the Balloon password hash, contributed by Zoltan
+          Fridrich.
+
+	* Support for SIV-GCM authenticated encryption mode,
+          contributed by Daiki Ueno.
+
+	* Support for OCB authenticated encryption mode.
+
+	* New exported functions md5_compress, sha1_compress,
+	  sha256_compress, sha512_compress, based on patches from
+	  Corentin Labbe.
+
+	Optimizations:
+
+	* Improved sha256 performance, in particular for x86_64 and
+	  s390x.
+
+	* Use GMP's mpn_sec_tabselect, which is implemented in
+	  assembly on many platforms, and delete the similar nettle
+	  function. Gives a modest speedup to all ecc operations.
+
+	* Faster poly1305 for x86_64 and ppc64. New ppc code
+	  contributed by Mamone Tarsha.
+
+	Miscellaneous:
+
+	* New ASM_FLAGS variable recognized by configure.
+
+	* Delete all arcfour assembly code. Affects 32-bit x86, 32-bit
+	  and 64-bit sparc.
+
+	Known issues:
+
+	* Version 6.2.1 of GNU GMP (the most recent GMP release as of
+	  this writing) has a known issue for MacOS on 64-bit ARM: GMP
+	  assembly files use the reserved x18 register. On this
+	  platform it is recommended to use a GMP snapshot where this
+	  bug is fixed, and upgrade to a later GMP release when one
+	  becomes available.
+
+	* Also on MacOS, Nettle's testsuite may still break due to
+	  DYLD_LIBRARY_PATH being discarded under some circumstances.
+	  As a workaround, use
+
+	  make check EMULATOR='env DYLD_LIBRARY_PATH=$(TEST_SHLIB_DIR)'
+
 NEWS for the Nettle 3.8.1 release
 
 	This is a bugfix release, fixing a few portability issues

_service:tar_scm:nettle-3.8.1.tar.gz/aclocal.m4 -> _service:tar_scm:nettle-3.9.1.tar.gz/aclocal.m4 Changed

@@ -10,6 +10,7 @@
 	bsdi4.*)	CCPIC="-fPIC" ;;
 	bsdi*)		CCPIC="" ;;
 	darwin*)	CCPIC="-fPIC" ;;
+	freebsd*|netbsd*|openbsd*)	CCPIC="-fPIC" ;;
 	# Could also use -fpic, depending on the number of symbol references
 	solaris*)	CCPIC="-fPIC" ;;
 	cygwin*)	CCPIC="" ;;
@@ -21,7 +22,7 @@
 	darwin*)	CCPIC="-fPIC" ;;
 irix*)		CCPIC="-share" ;;
 	hpux*)		CCPIC="+z"; ;;
-	*freebsd*)	CCPIC="-fpic" ;;
+	freebsd*|netbsd*|openbsd*)	CCPIC="-fPIC" ;;
 	sco*|sysv4.*)	CCPIC="-KPIC -dy -Bdynamic" ;;
 	solaris*)	CCPIC="-KPIC -Bdynamic" ;;
 	winnt*)		CCPIC="-shared" ;;
@@ -301,7 +302,7 @@
 cat >conftest.s <<EOF
 $1
 EOF
-gmp_assemble="$CC $CFLAGS $CPPFLAGS -c conftest.s >conftest.out 2>&1"
+gmp_assemble="$CC $CFLAGS $CPPFLAGS $ASM_FLAGS -c conftest.s >conftest.out 2>&1"
 if AC_TRY_EVAL(gmp_assemble); then
 cat conftest.out >&AC_FD_CC
 ifelse($2,,:,$2)
@@ -562,7 +563,7 @@
 dnl in "r6", or as plain "6". The latter is standard, but NeXT, Rhapsody,
 dnl and MacOS-X require the "r" forms.
 dnl
-dnl See also mpn/powerpc32/powerpc-defs.m4 which uses the result of this
+dnl See also powerpc64/machine.m4 which uses the result of this
 dnl test.
 
 AC_DEFUN(GMP_ASM_POWERPC_R_REGISTERS,

_service:tar_scm:nettle-3.8.1.tar.gz/arcfour.c -> _service:tar_scm:nettle-3.9.1.tar.gz/arcfour.c Changed

_service:tar_scm:nettle-3.9.1.tar.gz/arm/fat/sha256-compress-n-2.asm Added

@@ -0,0 +1,37 @@
+C arm/fat/sha256-compress-n-2.asm
+
+
+ifelse(`
+   Copyright (C) 2015 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+')
+
+dnl PROLOGUE(_nettle_sha256_compress_n) picked up by configure
+
+define(`fat_transform', `$1_armv6')
+include_src(`arm/v6/sha256-compress-n.asm')

_service:tar_scm:nettle-3.9.1.tar.gz/arm/v6/sha256-compress-n.asm Added

@@ -0,0 +1,266 @@
+C arm/v6/sha256-compress-n.asm
+
+ifelse(`
+ Copyright (C) 2013, 2022 Niels Möller
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+')
+
+	.file "sha256-compress-n.asm"
+	.arch armv6
+
+define(`STATE', `r0')
+define(`K', `r1')
+define(`BLOCKS', `r2')
+define(`INPUT', `r3')
+define(`SA', `r2')	C Overlap BLOCKS
+define(`SB', `r4')
+define(`SC', `r5')
+define(`SD', `r6')
+define(`SE', `r7')
+define(`SF', `r8')
+define(`SG', `r10')
+define(`SH', `r11')
+define(`T0', `r12')
+define(`T1', `r3')	C Overlap INPUT
+define(`COUNT', `r0')	C Overlap STATE
+define(`W', `r14')
+
+C Used for data load. Must not clobber STATE (r0), K (r1) or INPUT (r3)
+define(`I0', `r2')
+define(`I1', `r4')
+define(`I2', `r5')
+define(`I3', `r6')
+define(`I4', `r7')
+define(`DST', `r8')
+define(`SHIFT', `r10')
+define(`ILEFT', `r11')
+
+define(`EXPN', `
+	ldr	W, sp, #+eval(4*$1)
+	ldr	T0, sp, #+eval(4*(($1 + 14) % 16))
+	ror	T1, T0, #17
+	eor	T1, T1, T0, ror #19
+	eor	T1, T1, T0, lsr #10
+	add	W, W, T1
+	ldr	T0, sp, #+eval(4*(($1 + 9) % 16))
+	add	W, W, T0
+	ldr	T0, sp, #+eval(4*(($1 + 1) % 16))
+	ror	T1, T0, #7
+	eor	T1, T1, T0, ror #18
+	eor	T1, T1, T0, lsr #3
+	add	W, W, T1
+	str	W, sp, #+eval(4*$1)
+')
+
+C ROUND(A,B,C,D,E,F,G,H)
+C
+C H += S1(E) + Choice(E,F,G) + K + W
+C D += H
+C H += S0(A) + Majority(A,B,C)
+C
+C Where
+C
+C S1(E) = E<<<26 ^ E<<<21 ^ E<<<7
+C S0(A) = A<<<30 ^ A<<<19 ^ A<<<10
+C Choice (E, F, G) = G^(E&(F^G))
+C Majority (A,B,C) = (A&B) + (C&(A^B))
+
+define(`ROUND', `
+	ror	T0, $5, #6
+	eor	T0, T0, $5, ror #11
+	eor	T0, T0, $5, ror #25
+	add	$8, $8, T0
+	eor	T0, $6, $7
+	and	T0, T0, $5
+	eor	T0, T0, $7
+	add	$8,$8, T0
+	ldr	T0, K, #+4
+	add	$8, $8, W
+	add	$8, $8, T0
+	add	$4, $4, $8
+	ror	T0, $1, #2
+	eor	T0, T0, $1, ror #13
+	eor	T0, T0, $1, ror #22
+	add	$8, $8, T0
+	and	T0, $1, $2
+	add	$8, $8, T0
+	eor	T0, $1, $2
+	and	T0, T0, $3
+	add	$8, $8, T0
+')
+
+define(`NOEXPN', `
+	ldr	W, sp, + $1
+	add	$1, $1, #4
+')
+	.text
+	.align 2
+
+define(`SHIFT_OFFSET', 64)
+define(`INPUT_OFFSET', 68)
+define(`I0_OFFSET', 72)
+define(`STATE_OFFSET', 76)
+define(`K_OFFSET', 80)
+define(`BLOCKS_OFFSET', 84)
+
+	C const uint8_t *
+	C _nettle_sha256_compress_n(uint32_t *state, const uint32_t *k,
+	C size_t blocks, const uint8_t *input)
+
+PROLOGUE(_nettle_sha256_compress_n)
+	cmp	BLOCKS, #0
+	bne	.Lwork
+
+	mov	r0, INPUT
+	bx lr
+
+.Lwork:
+	C Also save STATE (r0), K (r1) and BLOCKS (r2)
+	push	{r0,r1,r2,r4,r5,r6,r7,r8,r10,r11,r12,r14}
+	sub	sp, sp, #STATE_OFFSET
+
+	C Load data up front, since we don't have enough registers
+	C to load and shift on-the-fly
+	ands	SHIFT, INPUT, #3
+	and	INPUT, INPUT, $-4
+	ldr	I0, INPUT
+	addne	INPUT, INPUT, #4
+	lsl	SHIFT, SHIFT, #3
+	mov	T0, #0
+	movne	T0, #-1
+IF_LE(`	lsl	I1, T0, SHIFT')
+IF_BE(`	lsr	I1, T0, SHIFT')
+	uadd8	T0, T0, I1		C Sets APSR.GE bits
+	C on BE rotate right by 32-SHIFT bits
+	C because there is no rotate left
+IF_BE(`	rsb	SHIFT, SHIFT, #32')
+
+	str	SHIFT, sp, #SHIFT_OFFSET
+
+.Loop_block:
+	mov	DST, sp
+	mov	ILEFT, #4
+.Lcopy:
+	ldm	INPUT!, {I1,I2,I3,I4}
+	sel	I0, I0, I1
+	ror	I0, I0, SHIFT
+IF_LE(`	rev	I0, I0')
+	sel	I1, I1, I2
+	ror	I1, I1, SHIFT
+IF_LE(`	rev	I1, I1')
+	sel	I2, I2, I3
+	ror	I2, I2, SHIFT
+IF_LE(`	rev	I2, I2')
+	sel	I3, I3, I4
+	ror	I3, I3, SHIFT
+IF_LE(`	rev	I3, I3')
+	subs	ILEFT, ILEFT, #1
+	stm	DST!, {I0,I1,I2,I3}
+	mov	I0, I4	
+	bne	.Lcopy
+
+	str	INPUT, sp, #INPUT_OFFSET
+	str	I0, sp, #I0_OFFSET
+
+	C Process block, with input at sp, expanded on the fly
+
+	ldm	STATE, {SA,SB,SC,SD,SE,SF,SG,SH}
+
+	mov	COUNT,#0
+
+.Loop1:
+	NOEXPN(COUNT) ROUND(SA,SB,SC,SD,SE,SF,SG,SH)
+	NOEXPN(COUNT) ROUND(SH,SA,SB,SC,SD,SE,SF,SG)
+	NOEXPN(COUNT) ROUND(SG,SH,SA,SB,SC,SD,SE,SF)

_service:tar_scm:nettle-3.9.1.tar.gz/arm64/crypto/sha256-compress-n.asm Added

@@ -0,0 +1,234 @@
+C arm64/crypto/sha256-compress-n.asm
+
+ifelse(`
+   Copyright (C) 2021 Mamone Tarsha
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+')
+
+C This implementation uses the SHA-256 instructions of Armv8 crypto
+C extension.
+C SHA256H: SHA256 hash update (part 1)
+C SHA256H2: SHA256 hash update (part 2)
+C SHA256SU0: SHA256 schedule update 0
+C SHA256SU1: SHA256 schedule update 1
+
+.file "sha256-compress-n.asm"
+.arch armv8-a+crypto
+
+.text
+
+C Register usage:
+
+define(`STATE', `x0')
+define(`K', `x1')
+define(`BLOCKS', `x2')
+define(`INPUT', `x3')
+
+define(`MSG0', `v0')
+define(`MSG1', `v1')
+define(`MSG2', `v2')
+define(`MSG3', `v3')
+define(`STATE0', `v4')
+define(`STATE1', `v5')
+define(`CONST', `v6')
+define(`TMP', `v7')
+define(`STATE0_SAVED', `v16')
+define(`STATE1_SAVED', `v17')
+
+C const uint8_t *
+C _nettle_sha256_compress_n(uint32_t *state, const uint32_t *k,
+C                           size_t blocks, const uint8_t *input)
+
+PROLOGUE(_nettle_sha256_compress_n)
+    cbz            BLOCKS, .Lend
+
+    C Load state
+    ld1            {STATE0.4s,STATE1.4s},STATE
+
+.Loop:
+    C Save state
+    mov            STATE0_SAVED.16b,STATE0.16b
+    mov            STATE1_SAVED.16b,STATE1.16b
+
+    C Load message
+    ld1            {MSG0.16b,MSG1.16b,MSG2.16b,MSG3.16b},INPUT,#64
+    
+    C Reverse for little endian
+    rev32          MSG0.16b,MSG0.16b
+    rev32          MSG1.16b,MSG1.16b
+    rev32          MSG2.16b,MSG2.16b
+    rev32          MSG3.16b,MSG3.16b
+
+    C Rounds 0-3
+    ld1            {CONST.4s},K,#16
+    add            CONST.4s,MSG0.4s,CONST.4s
+    sha256su0      MSG0.4s,MSG1.4s
+    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
+    sha256h2       QFP(STATE1),QFP(STATE0_SAVED),CONST.4s
+    sha256su1      MSG0.4s,MSG2.4s,MSG3.4s
+
+    C Rounds 4-7
+    mov            TMP.16b,STATE0.16b
+    ld1            {CONST.4s},K,#16
+    add            CONST.4s,MSG1.4s,CONST.4s
+    sha256su0      MSG1.4s,MSG2.4s
+    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
+    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
+    sha256su1      MSG1.4s,MSG3.4s,MSG0.4s
+
+    C Rounds 8-11
+    mov            TMP.16b,STATE0.16b
+    ld1            {CONST.4s},K,#16
+    add            CONST.4s,MSG2.4s,CONST.4s
+    sha256su0      MSG2.4s,MSG3.4s
+    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
+    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
+    sha256su1      MSG2.4s,MSG0.4s,MSG1.4s
+
+    C Rounds 12-15
+    mov            TMP.16b,STATE0.16b
+    ld1            {CONST.4s},K,#16
+    add            CONST.4s,MSG3.4s,CONST.4s
+    sha256su0      MSG3.4s,MSG0.4s
+    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
+    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
+    sha256su1      MSG3.4s,MSG1.4s,MSG2.4s
+
+    C Rounds 16-19
+    mov            TMP.16b,STATE0.16b
+    ld1            {CONST.4s},K,#16
+    add            CONST.4s,MSG0.4s,CONST.4s
+    sha256su0      MSG0.4s,MSG1.4s
+    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
+    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
+    sha256su1      MSG0.4s,MSG2.4s,MSG3.4s
+
+    C Rounds 20-23
+    mov            TMP.16b,STATE0.16b
+    ld1            {CONST.4s},K,#16
+    add            CONST.4s,MSG1.4s,CONST.4s
+    sha256su0      MSG1.4s,MSG2.4s
+    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
+    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
+    sha256su1      MSG1.4s,MSG3.4s,MSG0.4s
+
+    C Rounds 24-27
+    mov            TMP.16b,STATE0.16b
+    ld1            {CONST.4s},K,#16
+    add            CONST.4s,MSG2.4s,CONST.4s
+    sha256su0      MSG2.4s,MSG3.4s
+    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
+    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
+    sha256su1      MSG2.4s,MSG0.4s,MSG1.4s
+
+    C Rounds 28-31
+    mov            TMP.16b,STATE0.16b
+    ld1            {CONST.4s},K,#16
+    add            CONST.4s,MSG3.4s,CONST.4s
+    sha256su0      MSG3.4s,MSG0.4s
+    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
+    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
+    sha256su1      MSG3.4s,MSG1.4s,MSG2.4s
+
+    C Rounds 32-35
+    mov            TMP.16b,STATE0.16b
+    ld1            {CONST.4s},K,#16
+    add            CONST.4s,MSG0.4s,CONST.4s
+    sha256su0      MSG0.4s,MSG1.4s
+    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
+    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
+    sha256su1      MSG0.4s,MSG2.4s,MSG3.4s
+
+    C Rounds 36-39
+    mov            TMP.16b,STATE0.16b
+    ld1            {CONST.4s},K,#16
+    add            CONST.4s,MSG1.4s,CONST.4s
+    sha256su0      MSG1.4s,MSG2.4s
+    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
+    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
+    sha256su1      MSG1.4s,MSG3.4s,MSG0.4s
+
+    C Rounds 40-43
+    mov            TMP.16b,STATE0.16b
+    ld1            {CONST.4s},K,#16
+    add            CONST.4s,MSG2.4s,CONST.4s
+    sha256su0      MSG2.4s,MSG3.4s
+    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
+    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
+    sha256su1      MSG2.4s,MSG0.4s,MSG1.4s
+
+    C Rounds 44-47
+    mov            TMP.16b,STATE0.16b
+    ld1            {CONST.4s},K,#16
+    add            CONST.4s,MSG3.4s,CONST.4s
+    sha256su0      MSG3.4s,MSG0.4s
+    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
+    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s
+    sha256su1      MSG3.4s,MSG1.4s,MSG2.4s
+
+    C Rounds 48-51
+    mov            TMP.16b,STATE0.16b
+    ld1            {CONST.4s},K,#16
+    add            CONST.4s,MSG0.4s,CONST.4s
+    sha256h        QFP(STATE0),QFP(STATE1),CONST.4s
+    sha256h2       QFP(STATE1),QFP(TMP),CONST.4s

_service:tar_scm:nettle-3.9.1.tar.gz/arm64/fat/sha256-compress-n-2.asm Added

@@ -0,0 +1,37 @@
+C arm64/fat/sha256-compress-n-2.asm
+
+
+ifelse(`
+   Copyright (C) 2021 Mamone Tarsha
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+')
+
+dnl PROLOGUE(_nettle_sha256_compress_n) picked up by configure
+
+define(`fat_transform', `$1_arm64')
+include_src(`arm64/crypto/sha256-compress-n.asm')

_service:tar_scm:nettle-3.8.1.tar.gz/asm.m4 -> _service:tar_scm:nettle-3.9.1.tar.gz/asm.m4 Changed

_service:tar_scm:nettle-3.9.1.tar.gz/balloon-sha1.c Added

@@ -0,0 +1,55 @@
+/* balloon-sha1.c
+
+   Balloon password-hashing algorithm.
+
+   Copyright (C) 2022 Zoltan Fridrich
+   Copyright (C) 2022 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "balloon.h"
+#include "sha1.h"
+
+void
+balloon_sha1(size_t s_cost, size_t t_cost,
+             size_t passwd_length, const uint8_t *passwd,
+             size_t salt_length, const uint8_t *salt,
+             uint8_t *scratch, uint8_t *dst)
+{
+  struct sha1_ctx ctx;
+  sha1_init(&ctx);
+  balloon(&ctx,
+          (nettle_hash_update_func*)sha1_update,
+          (nettle_hash_digest_func*)sha1_digest,
+          SHA1_DIGEST_SIZE, s_cost, t_cost,
+          passwd_length, passwd, salt_length, salt, scratch, dst);
+}

_service:tar_scm:nettle-3.9.1.tar.gz/balloon-sha256.c Added

@@ -0,0 +1,55 @@
+/* balloon-sha256.c
+
+   Balloon password-hashing algorithm.
+
+   Copyright (C) 2022 Zoltan Fridrich
+   Copyright (C) 2022 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "balloon.h"
+#include "sha2.h"
+
+void
+balloon_sha256(size_t s_cost, size_t t_cost,
+               size_t passwd_length, const uint8_t *passwd,
+               size_t salt_length, const uint8_t *salt,
+               uint8_t *scratch, uint8_t *dst)
+{
+  struct sha256_ctx ctx;
+  sha256_init(&ctx);
+  balloon(&ctx,
+          (nettle_hash_update_func*)sha256_update,
+          (nettle_hash_digest_func*)sha256_digest,
+          SHA256_DIGEST_SIZE, s_cost, t_cost,
+          passwd_length, passwd, salt_length, salt, scratch, dst);
+}

_service:tar_scm:nettle-3.9.1.tar.gz/balloon-sha384.c Added

@@ -0,0 +1,55 @@
+/* balloon-sha384.c
+
+   Balloon password-hashing algorithm.
+
+   Copyright (C) 2022 Zoltan Fridrich
+   Copyright (C) 2022 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "balloon.h"
+#include "sha2.h"
+
+void
+balloon_sha384(size_t s_cost, size_t t_cost,
+               size_t passwd_length, const uint8_t *passwd,
+               size_t salt_length, const uint8_t *salt,
+               uint8_t *scratch, uint8_t *dst)
+{
+  struct sha384_ctx ctx;
+  sha384_init(&ctx);
+  balloon(&ctx,
+          (nettle_hash_update_func*)sha384_update,
+          (nettle_hash_digest_func*)sha384_digest,
+          SHA384_DIGEST_SIZE, s_cost, t_cost,
+          passwd_length, passwd, salt_length, salt, scratch, dst);
+}

_service:tar_scm:nettle-3.9.1.tar.gz/balloon-sha512.c Added

@@ -0,0 +1,55 @@
+/* balloon-sha512.c
+
+   Balloon password-hashing algorithm.
+
+   Copyright (C) 2022 Zoltan Fridrich
+   Copyright (C) 2022 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "balloon.h"
+#include "sha2.h"
+
+void
+balloon_sha512(size_t s_cost, size_t t_cost,
+               size_t passwd_length, const uint8_t *passwd,
+               size_t salt_length, const uint8_t *salt,
+               uint8_t *scratch, uint8_t *dst)
+{
+  struct sha512_ctx ctx;
+  sha512_init(&ctx);
+  balloon(&ctx,
+          (nettle_hash_update_func*)sha512_update,
+          (nettle_hash_digest_func*)sha512_digest,
+          SHA512_DIGEST_SIZE, s_cost, t_cost,
+          passwd_length, passwd, salt_length, salt, scratch, dst);
+}

_service:tar_scm:nettle-3.9.1.tar.gz/balloon.c Added

@@ -0,0 +1,149 @@
+/* balloon.c
+
+ Balloon password-hashing algorithm.
+
+ Copyright (C) 2022 Zoltan Fridrich
+ Copyright (C) 2022 Red Hat, Inc.
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+/* For a description of the algorithm, see:
+ * Boneh, D., Corrigan-Gibbs, H., Schechter, S. (2017, May 12). Balloon Hashing:
+ * A Memory-Hard Function Providing Provable Protection Against Sequential Attacks.
+ * Retrieved Sep 1, 2022, from https://eprint.iacr.org/2016/027.pdf
+ */
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <string.h>
+
+#include "balloon.h"
+#include "macros.h"
+
+#define DELTA 3
+
+static void
+hash(void *ctx,
+ nettle_hash_update_func *update,
+ nettle_hash_digest_func *digest,
+ size_t digest_size,
+ uint64_t cnt,
+ size_t a_len, const uint8_t *a,
+ size_t b_len, const uint8_t *b,
+ uint8_t *dst)
+{
+ uint8_t tmp8;
+ LE_WRITE_UINT64(tmp, cnt);
+ update(ctx, sizeof(tmp), tmp);
+ if (a && a_len)
+ update(ctx, a_len, a);
+ if (b && b_len)
+ update(ctx, b_len, b);
+ digest(ctx, digest_size, dst);
+}
+
+static void
+hash_ints(void *ctx,
+ nettle_hash_update_func *update,
+ nettle_hash_digest_func *digest,
+ size_t digest_size,
+ uint64_t i, uint64_t j, uint64_t k,
+ uint8_t *dst)
+{
+ uint8_t tmp24;
+ LE_WRITE_UINT64(tmp, i);
+ LE_WRITE_UINT64(tmp + 8, j);
+ LE_WRITE_UINT64(tmp + 16, k);
+ update(ctx, sizeof(tmp), tmp);
+ digest(ctx, digest_size, dst);
+}
+
+/* Takes length bytes long big number stored
+ * in little endian format and computes modulus
+ */
+static size_t
+block_to_int(size_t length, const uint8_t *block, size_t mod)
+{
+ size_t i = length, r = 0;
+ while (i--)
+ {
+ r = (r << 8) + blocki;
+ r %= mod;
+ }
+ return r;
+}
+
+void
+balloon(void *hash_ctx,
+ nettle_hash_update_func *update,
+ nettle_hash_digest_func *digest,
+ size_t digest_size, size_t s_cost, size_t t_cost,
+ size_t passwd_length, const uint8_t *passwd,
+ size_t salt_length, const uint8_t *salt,
+ uint8_t *scratch, uint8_t *dst)
+{
+ const size_t BS = digest_size;
+ uint8_t *block = scratch;
+ uint8_t *buf = scratch + BS;
+ size_t i, j, k, cnt = 0;
+
+ hash(hash_ctx, update, digest, digest_size,
+ cnt++, passwd_length, passwd, salt_length, salt, buf);
+ for (i = 1; i < s_cost; ++i)
+ hash(hash_ctx, update, digest, digest_size,
+ cnt++, BS, buf + (i - 1) * BS, 0, NULL, buf + i * BS);
+
+ for (i = 0; i < t_cost; ++i)
+ {
+ for (j = 0; j < s_cost; ++j)
+ {
+ hash(hash_ctx, update, digest, digest_size,
+ cnt++, BS, buf + (j ? j - 1 : s_cost - 1) * BS,
+ BS, buf + j * BS, buf + j * BS);
+ for (k = 0; k < DELTA; ++k)
+ {
+ hash_ints(hash_ctx, update, digest, digest_size, i, j, k, block);
+ hash(hash_ctx, update, digest, digest_size,
+ cnt++, salt_length, salt, BS, block, block);
+ hash(hash_ctx, update, digest, digest_size,
+ cnt++, BS, buf + j * BS,
+ BS, buf + block_to_int(BS, block, s_cost) * BS,
+ buf + j * BS);
+ }
+ }
+ }
+ memcpy(dst, buf + (s_cost - 1) * BS, BS);
+}
+
+size_t
+balloon_itch(size_t digest_size, size_t s_cost)
+{
+ return (s_cost + 1) * digest_size;
+}

_service:tar_scm:nettle-3.9.1.tar.gz/balloon.h Added

@@ -0,0 +1,98 @@
+/* balloon.h
+
+   Balloon password-hashing algorithm.
+
+   Copyright (C) 2022 Zoltan Fridrich
+   Copyright (C) 2022 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+/* For a description of the algorithm, see:
+ * Boneh, D., Corrigan-Gibbs, H., Schechter, S. (2017, May 12). Balloon Hashing:
+ * A Memory-Hard Function Providing Provable Protection Against Sequential Attacks.
+ * Retrieved Sep 1, 2022, from https://eprint.iacr.org/2016/027.pdf
+ */
+
+#ifndef NETTLE_BALLOON_H_INCLUDED
+#define NETTLE_BALLOON_H_INCLUDED
+
+#include "nettle-types.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Name mangling */
+#define balloon nettle_balloon
+#define balloon_itch nettle_balloon_itch
+#define balloon_sha1 nettle_balloon_sha1
+#define balloon_sha256 nettle_balloon_sha256
+#define balloon_sha384 nettle_balloon_sha384
+#define balloon_sha512 nettle_balloon_sha512
+
+void
+balloon(void *hash_ctx,
+        nettle_hash_update_func *update,
+        nettle_hash_digest_func *digest,
+        size_t digest_size, size_t s_cost, size_t t_cost,
+        size_t passwd_length, const uint8_t *passwd,
+        size_t salt_length, const uint8_t *salt,
+        uint8_t *scratch, uint8_t *dst);
+
+size_t
+balloon_itch(size_t digest_size, size_t s_cost);
+
+void
+balloon_sha1(size_t s_cost, size_t t_cost,
+             size_t passwd_length, const uint8_t *passwd,
+             size_t salt_length, const uint8_t *salt,
+             uint8_t *scratch, uint8_t *dst);
+
+void
+balloon_sha256(size_t s_cost, size_t t_cost,
+               size_t passwd_length, const uint8_t *passwd,
+               size_t salt_length, const uint8_t *salt,
+               uint8_t *scratch, uint8_t *dst);
+
+void
+balloon_sha384(size_t s_cost, size_t t_cost,
+               size_t passwd_length, const uint8_t *passwd,
+               size_t salt_length, const uint8_t *salt,
+               uint8_t *scratch, uint8_t *dst);
+
+void
+balloon_sha512(size_t s_cost, size_t t_cost,
+               size_t passwd_length, const uint8_t *passwd,
+               size_t salt_length, const uint8_t *salt,
+               uint8_t *scratch, uint8_t *dst);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* NETTLE_BALLOON_H_INCLUDED */

_service:tar_scm:nettle-3.8.1.tar.gz/block-internal.h -> _service:tar_scm:nettle-3.9.1.tar.gz/block-internal.h Changed

_service:tar_scm:nettle-3.8.1.tar.gz/blowfish-bcrypt.c -> _service:tar_scm:nettle-3.9.1.tar.gz/blowfish-bcrypt.c Changed

@@ -42,7 +42,7 @@
 #include "blowfish.h"
 #include "blowfish-internal.h"
 #include "base64.h"
-
+#include "bswap-internal.h"
 #include "macros.h"
 
 #define CRYPTPLEN 7
@@ -149,16 +149,16 @@
 0x64657253, 0x63727944, 0x6F756274
 };
 
-static void swap32(uint32_t *x, int count)
+#if WORDS_BIGENDIAN
+#define bswap32_if_le(x, n)
+#else
+static void bswap32_if_le (uint32_t *x, unsigned n)
 {
-#if !WORDS_BIGENDIAN
- do {
- uint32_t tmp = *x;
- tmp = (tmp << 16) | (tmp >> 16);
- *x++ = ((tmp & 0x00FF00FF) << 8) | ((tmp >> 8) & 0x00FF00FF);
- } while (--count);
-#endif
+ unsigned i;
+ for (i = 0; i < n; i++)
+ xi = nettle_bswap32 (xi);
 }
+#endif
 
 static void set_xkey(size_t lenkey, const uint8_t *key,
 bf_key expanded, bf_key initial,
@@ -340,7 +340,7 @@
 else if (lenscheme < HASHOFFSET)
 return 0;
 memcpy(psalt, data.binary.salt, BLOWFISH_BCRYPT_BINSALT_SIZE);
- swap32(data.binary.salt, 4);
+ bswap32_if_le (data.binary.salt, 4);
 
 if (log2rounds < minlog2rounds || log2rounds > 31)
 return 0;
@@ -445,7 +445,7 @@
 dst = (uint8_t*)
 encode_radix64((char*) dst, BLOWFISH_BCRYPT_BINSALT_SIZE, psalt) - 1;
 
- swap32(data.binary.output, 6);
+ bswap32_if_le (data.binary.output, 6);
 /* This has to be bug-compatible with the original implementation, so
 only encode 23 of the 24 bytes. */
 encode_radix64((char*) dst, 23, (uint8_t *) data.binary.output);

_service:tar_scm:nettle-3.9.1.tar.gz/bswap-internal.h Added

@@ -0,0 +1,77 @@
+/* bswap-internal.h
+
+ Copyright (C) 2022 Niels Möller
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#ifndef NETTLE_BSWAP_INTERNAL_H_INCLUDED
+#define NETTLE_BSWAP_INTERNAL_H_INCLUDED
+
+#include "nettle-types.h"
+
+/* Note that these definitions depend config.h, which should be
+ included first. */
+
+#if HAVE_BUILTIN_BSWAP64
+#define nettle_bswap64 __builtin_bswap64
+/* Assume bswap32 is also available. */
+#define nettle_bswap32 __builtin_bswap32
+#else
+static inline uint64_t
+nettle_bswap64 (uint64_t x)
+{
+ x = (x >> 32) | (x << 32);
+ x = ((x >> 16) & UINT64_C (0xffff0000ffff))
+ | ((x & UINT64_C (0xffff0000ffff)) << 16);
+ x = ((x >> 8) & UINT64_C (0xff00ff00ff00ff))
+ | ((x & UINT64_C (0xff00ff00ff00ff)) << 8);
+ return x;
+}
+
+static inline uint32_t
+nettle_bswap32 (uint32_t x)
+{
+ x = (x << 16) | (x >> 16);
+ x = ((x & 0x00FF00FF) << 8) | ((x >> 8) & 0x00FF00FF);
+ return x;
+}
+#endif
+
+#if WORDS_BIGENDIAN
+#define bswap64_if_le(x) (x)
+#else
+#define bswap64_if_le nettle_bswap64
+#endif
+
+#if WORDS_BIGENDIAN
+#define bswap64_if_be nettle_bswap64
+#else
+#define bswap64_if_be(x) (x)
+#endif
+
+#endif /* NETTLE_BSWAP_INTERNAL_H_INCLUDED */

_service:tar_scm:nettle-3.8.1.tar.gz/ccm.h -> _service:tar_scm:nettle-3.9.1.tar.gz/ccm.h Changed

_service:tar_scm:nettle-3.8.1.tar.gz/chacha-poly1305.c -> _service:tar_scm:nettle-3.9.1.tar.gz/chacha-poly1305.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/config.guess -> _service:tar_scm:nettle-3.9.1.tar.gz/config.guess Changed

@@ -1,10 +1,10 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
-#   Copyright 1992-2022 Free Software Foundation, Inc.
+#   Copyright 1992-2023 Free Software Foundation, Inc.
 
 # shellcheck disable=SC2006,SC2268 # see below for rationale
 
-timestamp='2022-05-08'
+timestamp='2023-01-01'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -60,7 +60,7 @@
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright 1992-2022 Free Software Foundation, Inc.
+Copyright 1992-2023 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -966,6 +966,12 @@
 	GNU_REL=`echo "$UNAME_RELEASE" | sed -e 's/-(.*//'`
 	GUESS=$UNAME_MACHINE-unknown-$GNU_SYS$GNU_REL-$LIBC
 	;;
+    x86_64:Mmanagarm:*:*|i?86:Mmanagarm:*:*)
+	GUESS="$UNAME_MACHINE-pc-managarm-mlibc"
+	;;
+    *:Mmanagarm:*:*)
+	GUESS="$UNAME_MACHINE-unknown-managarm-mlibc"
+	;;
     *:Minix:*:*)
 	GUESS=$UNAME_MACHINE-unknown-minix
 	;;
@@ -1036,7 +1042,7 @@
     k1om:Linux:*:*)
 	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
 	;;
-    loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*)
+    loongarch32:Linux:*:* | loongarch64:Linux:*:*)
 	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
 	;;
     m32r*:Linux:*:*)
@@ -1378,8 +1384,11 @@
     BePC:Haiku:*:*)	# Haiku running on Intel PC compatible.
 	GUESS=i586-pc-haiku
 	;;
-    x86_64:Haiku:*:*)
-	GUESS=x86_64-unknown-haiku
+    ppc:Haiku:*:*)	# Haiku running on Apple PowerPC
+	GUESS=powerpc-apple-haiku
+	;;
+    *:Haiku:*:*)	# Haiku modern gcc (not bound by BeOS compat)
+	GUESS=$UNAME_MACHINE-unknown-haiku
 	;;
     SX-4:SUPER-UX:*:*)
 	GUESS=sx4-nec-superux$UNAME_RELEASE

_service:tar_scm:nettle-3.8.1.tar.gz/config.h.in -> _service:tar_scm:nettle-3.9.1.tar.gz/config.h.in Changed

_service:tar_scm:nettle-3.8.1.tar.gz/config.make.in -> _service:tar_scm:nettle-3.9.1.tar.gz/config.make.in Changed

_service:tar_scm:nettle-3.8.1.tar.gz/config.sub -> _service:tar_scm:nettle-3.9.1.tar.gz/config.sub Changed

_service:tar_scm:nettle-3.8.1.tar.gz/configure -> _service:tar_scm:nettle-3.9.1.tar.gz/configure Changed

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for nettle 3.8.1.
+# Generated by GNU Autoconf 2.69 for nettle 3.9.1.
 #
 # Report bugs to <nettle-bugs@lists.lysator.liu.se>.
 #
@@ -580,12 +580,12 @@
 # Identity of this package.
 PACKAGE_NAME='nettle'
 PACKAGE_TARNAME='nettle'
-PACKAGE_VERSION='3.8.1'
-PACKAGE_STRING='nettle 3.8.1'
+PACKAGE_VERSION='3.9.1'
+PACKAGE_STRING='nettle 3.9.1'
 PACKAGE_BUGREPORT='nettle-bugs@lists.lysator.liu.se'
 PACKAGE_URL=''
 
-ac_unique_file="arcfour.c"
+ac_unique_file="nettle-types.h"
 # Factoring default headers for most tests.
 ac_includes_default="\
 #include <stdio.h>
@@ -709,6 +709,7 @@
 CC
 HOGWEED_EXTRA_SYMBOLS
 NETTLE_USE_MINI_GMP
+ASM_FLAGS
 host_os
 host_vendor
 host_cpu
@@ -779,6 +780,7 @@
 enable_x86_pclmul
 enable_power_crypto_ext
 enable_power_altivec
+enable_power9
 enable_s390x_vf
 enable_s390x_msa
 enable_mini_gmp
@@ -788,6 +790,7 @@
 ac_precious_vars='build_alias
 host_alias
 target_alias
+ASM_FLAGS
 CC
 CFLAGS
 LDFLAGS
@@ -1348,7 +1351,7 @@
 # Omit some internal or obsolete options to make the list less imposing.
 # This message is too long to be a string in the A/UX 3.1 sh.
 cat <<_ACEOF
-\`configure' configures nettle 3.8.1 to adapt to many kinds of systems.
+\`configure' configures nettle 3.9.1 to adapt to many kinds of systems.
 
 Usage: $0 OPTION... VAR=VALUE...
 
@@ -1414,7 +1417,7 @@
 
 if test -n "$ac_init_help"; then
 case $ac_init_help in
- short | recursive ) echo "Configuration of nettle 3.8.1:";;
+ short | recursive ) echo "Configuration of nettle 3.9.1:";;
 esac
 cat <<\_ACEOF
 
@@ -1442,6 +1445,7 @@
 Enable POWER crypto extensions. (default=no)
 --enable-power-altivec Enable POWER altivec and vsx extensions.
 (default=no)
+ --enable-power9 Enable POWER ISA v3.0. (default=no)
 --enable-s390x-vf Enable vector facility on z/Architecture.
 (default=no)
 --enable-s390x-msa Enable message-security assist extensions on
@@ -1463,6 +1467,7 @@
 libraries
 
 Some influential environment variables:
+ ASM_FLAGS Extra flags for processing assembly source files
 CC C compiler command
 CFLAGS C compiler flags
 LDFLAGS linker flags, e.g. -L<lib dir> if you have libraries in a
@@ -1542,7 +1547,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
 cat <<\_ACEOF
-nettle configure 3.8.1
+nettle configure 3.9.1
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2186,7 +2191,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by nettle $as_me 3.8.1, which was
+It was created by nettle $as_me 3.9.1, which was
 generated by GNU Autoconf 2.69. Invocation command line was
 
 $ $0 $@
@@ -2571,10 +2576,10 @@
 
 
 LIBNETTLE_MAJOR=8
-LIBNETTLE_MINOR=6
+LIBNETTLE_MINOR=8
 
 LIBHOGWEED_MAJOR=6
-LIBHOGWEED_MINOR=6
+LIBHOGWEED_MINOR=8
 
 MAJOR_VERSION=`echo $PACKAGE_VERSION | sed 's/^$^.*$\..*/\1/'`
 MINOR_VERSION=`echo $PACKAGE_VERSION | sed 's/^^.*\.$0-9*$.*/\1/'`
@@ -2808,6 +2813,14 @@
 fi
 
 
+# Check whether --enable-power9 was given.
+if test "${enable_power9+set}" = set; then :
+ enableval=$enable_power9;
+else
+ enable_power9=no
+fi
+
+
 # Check whether --enable-s390x-vf was given.
 if test "${enable_s390x_vf+set}" = set; then :
 enableval=$enable_s390x_vf;
@@ -2832,6 +2845,8 @@
 fi
 
 
+
+
 if test "x$enable_mini_gmp" = xyes ; then
 NETTLE_USE_MINI_GMP=1
 HOGWEED_EXTRA_SYMBOLS="mpz_*;gmp_*;mpn_*;mp_*;"
@@ -6451,11 +6466,11 @@
 fi
 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 ;;
- *mips*)
+ *mips64*)
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 
-#if defined(__sgi) && defined(__LP64__)
+#if defined(__mips64) || defined(__mips64__) || (defined(__sgi) && defined(__LP64__))
 #error 64-bit mips
 #endif
 
@@ -6708,7 +6723,7 @@
 	vmlal.u32	q1, d0, d1
 
 EOF
-gmp_assemble="$CC $CFLAGS $CPPFLAGS -c conftest.s >conftest.out 2>&1"
+gmp_assemble="$CC $CFLAGS $CPPFLAGS $ASM_FLAGS -c conftest.s >conftest.out 2>&1"
 if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$gmp_assemble\""; } >&5
 (eval $gmp_assemble) 2>&5
 ac_status=$?
@@ -6781,7 +6796,7 @@
 	$gmp_cv_asm_text
 	mtctr	r6
 EOF
-gmp_assemble="$CC $CFLAGS $CPPFLAGS -c conftest.s >conftest.out 2>&1"
+gmp_assemble="$CC $CFLAGS $CPPFLAGS $ASM_FLAGS -c conftest.s >conftest.out 2>&1"
 if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$gmp_assemble\""; } >&5
 (eval $gmp_assemble) 2>&5
 ac_status=$?
@@ -6797,7 +6812,7 @@
 	.text
 	mtctr	6
 EOF
-gmp_assemble="$CC $CFLAGS $CPPFLAGS -c conftest.s >conftest.out 2>&1"
+gmp_assemble="$CC $CFLAGS $CPPFLAGS $ASM_FLAGS -c conftest.s >conftest.out 2>&1"
 if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$gmp_assemble\""; } >&5
 (eval $gmp_assemble) 2>&5
 ac_status=$?
@@ -6825,9 +6840,12 @@
 	if test "x$enable_fat" = xyes ; then
 	 asm_path="powerpc64/fat $asm_path"
 	 OPT_NETTLE_SOURCES="fat-ppc.c $OPT_NETTLE_SOURCES"
-	 FAT_TEST_LIST="none crypto_ext altivec"
+	 FAT_TEST_LIST="none crypto_ext altivec power9"
 	else
-	 if test "$enable_power_crypto_ext" = yes ; then
+	 if test "$enable_power9" = yes ; then
+	 asm_path="powerpc64/p9 $asm_path"
+	 fi
+ if test "$enable_power_crypto_ext" = yes ; then
 asm_path="powerpc64/p8 $asm_path"
 	 fi
 	 if test "$enable_power_altivec" = yes ; then
@@ -6870,14 +6888,14 @@
 		aes256-encrypt.asm aes256-decrypt.asm \
 		cbc-aes128-encrypt.asm cbc-aes192-encrypt.asm \
 		cbc-aes256-encrypt.asm \
-		arcfour-crypt.asm camellia-crypt-internal.asm \
+		camellia-crypt-internal.asm \
 		md5-compress.asm memxor.asm memxor3.asm \

_service:tar_scm:nettle-3.8.1.tar.gz/configure.ac -> _service:tar_scm:nettle-3.9.1.tar.gz/configure.ac Changed

@@ -2,19 +2,19 @@
 
 dnl Process this file with autoconf to produce a configure script.
 
-AC_INIT(nettle, 3.8.1, nettle-bugs@lists.lysator.liu.se)
+AC_INIT(nettle, 3.9.1, nettle-bugs@lists.lysator.liu.se)
 AC_PREREQ(2.61)
-AC_CONFIG_SRCDIR(arcfour.c)
+AC_CONFIG_SRCDIR(nettle-types.h)
 # Needed to stop autoconf from looking for files in parent directories.
 AC_CONFIG_AUX_DIR(.)
 
 AC_CONFIG_HEADER(config.h)
 
 LIBNETTLE_MAJOR=8
-LIBNETTLE_MINOR=6
+LIBNETTLE_MINOR=8
 
 LIBHOGWEED_MAJOR=6
-LIBHOGWEED_MINOR=6
+LIBHOGWEED_MINOR=8
 
 dnl Note double square brackets, for extra m4 quoting.
 MAJOR_VERSION=`echo $PACKAGE_VERSION | sed 's/^$^.*$\..*/\1/'`
@@ -105,6 +105,10 @@
   AC_HELP_STRING(--enable-power-altivec, Enable POWER altivec and vsx extensions. (default=no)),,
   enable_altivec=no)
 
+AC_ARG_ENABLE(power9,
+  AC_HELP_STRING(--enable-power9, Enable POWER ISA v3.0. (default=no)),,
+  enable_power9=no)
+
 AC_ARG_ENABLE(s390x-vf,
   AC_HELP_STRING(--enable-s390x-vf, Enable vector facility on z/Architecture. (default=no)),,
   enable_s390x_vf=no)
@@ -117,6 +121,8 @@
   AC_HELP_STRING(--enable-mini-gmp, Enable mini-gmp, used instead of libgmp.),,
   enable_mini_gmp=no)
 
+AC_ARG_VAR(ASM_FLAGS, Extra flags for processing assembly source files)
+
 if test "x$enable_mini_gmp" = xyes ; then
   NETTLE_USE_MINI_GMP=1
   HOGWEED_EXTRA_SYMBOLS="mpz_*;gmp_*;mpn_*;mp_*;"
@@ -341,9 +347,9 @@
       ABI=64
     )
     ;;
-  *mips*)
+  *mips64*)
     AC_TRY_COMPILE(
-#if defined(__sgi) && defined(__LP64__)
+#if defined(__mips64) || defined(__mips64__) || (defined(__sgi) && defined(__LP64__))
 #error 64-bit mips
 #endif
     , , 
@@ -539,9 +545,12 @@
 	if test "x$enable_fat" = xyes ; then
 	  asm_path="powerpc64/fat $asm_path"
 	  OPT_NETTLE_SOURCES="fat-ppc.c $OPT_NETTLE_SOURCES"
-	  FAT_TEST_LIST="none crypto_ext altivec"
+	  FAT_TEST_LIST="none crypto_ext altivec power9"
 	else
-	  if test "$enable_power_crypto_ext" = yes ; then
+	  if test "$enable_power9" = yes ; then
+	    asm_path="powerpc64/p9 $asm_path"
+	  fi
+    if test "$enable_power_crypto_ext" = yes ; then
             asm_path="powerpc64/p8 $asm_path"
 	  fi
 	  if test "$enable_power_altivec" = yes ; then
@@ -584,14 +593,14 @@
 		aes256-encrypt.asm aes256-decrypt.asm \
 		cbc-aes128-encrypt.asm cbc-aes192-encrypt.asm \
 		cbc-aes256-encrypt.asm \
-		arcfour-crypt.asm camellia-crypt-internal.asm \
+		camellia-crypt-internal.asm \
 		md5-compress.asm memxor.asm memxor3.asm \
 		ghash-set-key.asm ghash-update.asm \
 		poly1305-internal.asm \
 		chacha-core-internal.asm \
 		salsa20-crypt.asm salsa20-core-internal.asm \
 		serpent-encrypt.asm serpent-decrypt.asm \
-		sha1-compress.asm sha256-compress.asm sha512-compress.asm \
+		sha1-compress.asm sha256-compress-n.asm sha512-compress.asm \
 		sha3-permute.asm umac-nh.asm umac-nh-n.asm machine.m4"
 
 # Assembler files which generate additional object files if they are used.
@@ -605,9 +614,10 @@
   aes256-encrypt-2.asm aes256-decrypt-2.asm \
   cbc-aes128-encrypt-2.asm cbc-aes192-encrypt-2.asm cbc-aes256-encrypt-2.asm \
   chacha-2core.asm chacha-3core.asm chacha-4core.asm chacha-core-internal-2.asm \
+  poly1305-blocks.asm poly1305-internal-2.asm \
   ghash-set-key-2.asm ghash-update-2.asm \
   salsa20-2core.asm salsa20-core-internal-2.asm \
-  sha1-compress-2.asm sha256-compress-2.asm \
+  sha1-compress-2.asm sha256-compress-n-2.asm \
   sha3-permute-2.asm sha512-compress-2.asm \
   umac-nh-n-2.asm umac-nh-2.asm"
 
@@ -751,13 +761,18 @@
 #undef HAVE_NATIVE_ecc_secp384r1_redc
 #undef HAVE_NATIVE_ecc_secp521r1_modp
 #undef HAVE_NATIVE_ecc_secp521r1_redc
+#undef HAVE_NATIVE_poly1305_set_key
+#undef HAVE_NATIVE_poly1305_block
+#undef HAVE_NATIVE_poly1305_digest
+#undef HAVE_NATIVE_poly1305_blocks
+#undef HAVE_NATIVE_fat_poly1305_blocks
 #undef HAVE_NATIVE_ghash_set_key
 #undef HAVE_NATIVE_ghash_update
 #undef HAVE_NATIVE_salsa20_core
 #undef HAVE_NATIVE_salsa20_2core
 #undef HAVE_NATIVE_fat_salsa20_2core
 #undef HAVE_NATIVE_sha1_compress
-#undef HAVE_NATIVE_sha256_compress
+#undef HAVE_NATIVE_sha256_compress_n
 #undef HAVE_NATIVE_sha512_compress
 #undef HAVE_NATIVE_sha3_permute
 #undef HAVE_NATIVE_umac_nh
@@ -817,6 +832,22 @@
     LIBHOGWEED_LIBS='-Wl,--no-whole-archive $(LIBS) libnettle.dll.a'
     IF_DLL=''
     ;;
+  midipix*)
+    if test "x$ABI" = x64 ; then
+        W64_ABI=yes
+    fi
+    LIBNETTLE_FORLINK=libnettle.so
+    LIBNETTLE_SONAME='$(LIBNETTLE_FORLINK).$(LIBNETTLE_MAJOR)'
+    LIBNETTLE_FILE='$(LIBNETTLE_SONAME).$(LIBNETTLE_MINOR)'
+    LIBNETTLE_LINK='$(CC) $(CFLAGS) $(LDFLAGS) -shared -Wl,--out-dsolib=libnettle.lib.a -Wl,-soname=$(LIBNETTLE_SONAME)'
+    LIBNETTLE_LIBS=''
+
+    LIBHOGWEED_FORLINK=libhogweed.so
+    LIBHOGWEED_SONAME='$(LIBHOGWEED_FORLINK).$(LIBHOGWEED_MAJOR)'
+    LIBHOGWEED_FILE='$(LIBHOGWEED_SONAME).$(LIBHOGWEED_MINOR)'
+    LIBHOGWEED_LINK='$(CC) $(CFLAGS) $(LDFLAGS) -shared -Wl,--out-dsolib=libhogweed.lib.a -Wl,-soname=$(LIBHOGWEED_SONAME)'
+    LIBHOGWEED_LIBS='$(LIBS) .lib/libnettle.so.8'
+    ;;
   darwin*)
     LIBNETTLE_FORLINK=libnettle.dylib
     LIBNETTLE_SONAME='libnettle.$(LIBNETTLE_MAJOR).dylib'

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-curve25519.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-curve25519.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-curve448.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-curve448.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-ecdsa-sign.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-ecdsa-sign.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-ecdsa-verify.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-ecdsa-verify.c Changed

@@ -53,8 +53,8 @@
 mp_size_t
 ecc_ecdsa_verify_itch (const struct ecc_curve *ecc)
 {
-  /* Largest storage need is for the ecc->mul call. */
-  return 5*ecc->p.size + ecc->mul_itch;
+  /* Largest storage need is for the ecc_mul_a call. */
+  return 5*ecc->p.size + ECC_MUL_A_ITCH (ecc->p.size);
 }
 
 /* FIXME: Use faster primitives, not requiring side-channel silence. */
@@ -107,35 +107,23 @@
   /* u2 = r / s, P2 = u2 * Y */
   ecc_mod_mul_canonical (&ecc->q, u2, rp, sinv, u2);
 
-   /* Total storage: 5*ecc->p.size + ecc->mul_itch */
-  ecc->mul (ecc, P2, u2, pp, u2 + ecc->p.size);
+   /* Total storage: 5*ecc->p.size + ECC_MUL_A_ITCH */
+  ecc_mul_a (ecc, P2, u2, pp, u2 + ecc->p.size);
 
   /* u = 0 can happen only if h = 0 or h = q, which is extremely
      unlikely. */
   if (!mpn_zero_p (u1, ecc->p.size))
     {
-      /* Total storage: 7*ecc->p.size + ecc->mul_g_itch (ecc->p.size) */
-      ecc->mul_g (ecc, P1, u1, P1 + 3*ecc->p.size);
-
-      /* NOTE: ecc_add_jjj and/or ecc_j_to_a will produce garbage in
-	 case u1 G = +/- u2 V. However, anyone who gets his or her
-	 hands on a signature where this happens during verification,
-	 can also get the private key as z = +/- u1 / u_2 (mod q). And
-	 then it doesn't matter very much if verification of
-	 signatures with that key succeeds or fails.
-
-	 u1 G = - u2 V can never happen for a correctly generated
-	 signature, since it implies k = 0.
-
-	 u1 G = u2 V is possible, if we are unlucky enough to get h /
-	 s_1 = z. Hitting that is about as unlikely as finding the
-	 private key by guessing.
-       */
-      /* Total storage: 6*ecc->p.size + ecc->add_hhh_itch */
-      ecc->add_hhh (ecc, P2, P2, P1, P1 + 3*ecc->p.size);
+      /* Total storage: 7*ecc->p.size + ECC_MUL_G_ITCH */
+      ecc_mul_g (ecc, P1, u1, P1 + 3*ecc->p.size);
+
+      /* Total storage: 6*ecc->p.size + ECC_ADD_JJJ_ITCH */
+      if (!ecc_nonsec_add_jjj (ecc, P2, P2, P1, P1 + 3*ecc->p.size))
+	/* Infinity point, not a valid signature. */
+	return 0;
     }
   /* x coordinate only, modulo q */
-  ecc->h_to_a (ecc, 2, P1, P2, P1 + 3*ecc->p.size);
+  ecc_j_to_a (ecc, 2, P1, P2, P1 + 3*ecc->p.size);
 
   return (mpn_cmp (rp, P1, ecc->p.size) == 0);
 #undef P2

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-gost-gc256b.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-gost-gc256b.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-gost-gc512a.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-gost-gc512a.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-gostdsa-sign.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-gostdsa-sign.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-gostdsa-verify.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-gostdsa-verify.c Changed

@@ -52,8 +52,8 @@
 mp_size_t
 ecc_gostdsa_verify_itch (const struct ecc_curve *ecc)
 {
-  /* Largest storage need is for the ecc->mul call. */
-  return 5*ecc->p.size + ecc->mul_itch;
+  /* Largest storage need is for the ecc_mul_a call. */
+  return 5*ecc->p.size + ECC_MUL_A_ITCH (ecc->p.size);
 }
 
 /* FIXME: Use faster primitives, not requiring side-channel silence. */
@@ -108,17 +108,18 @@
   mpn_sub_n (hp, ecc->q.m, rp, ecc->p.size);
   ecc_mod_mul_canonical (&ecc->q, z2, hp, vp, z2);
 
-   /* Total storage: 5*ecc->p.size + ecc->mul_itch */
-  ecc->mul (ecc, P2, z2, pp, z2 + ecc->p.size);
+   /* Total storage: 5*ecc->p.size + ECC_MUL_A_ITCH */
+  ecc_mul_a (ecc, P2, z2, pp, z2 + ecc->p.size);
 
-  /* Total storage: 7*ecc->p.size + ecc->mul_g_itch (ecc->p.size) */
-  ecc->mul_g (ecc, P1, z1, P1 + 3*ecc->p.size);
+  /* Total storage: 7*ecc->p.size + ECC_MUL_G_ITCH */
+  ecc_mul_g (ecc, P1, z1, P1 + 3*ecc->p.size);
 
-  /* Total storage: 6*ecc->p.size + ecc->add_hhh_itch */
-  ecc->add_hhh (ecc, P1, P1, P2, P1 + 3*ecc->p.size);
+  /* Total storage: 6*ecc->p.size + ECC_ADD_JJJ_ITCH */
+  if (!ecc_nonsec_add_jjj (ecc, P1, P1, P2, P1 + 3*ecc->p.size))
+    return 0;
 
   /* x coordinate only, modulo q */
-  ecc->h_to_a (ecc, 2, P2, P1, P1 + 3*ecc->p.size);
+  ecc_j_to_a (ecc, 2, P2, P1, P1 + 3*ecc->p.size);
 
   return (mpn_cmp (rp, P2, ecc->p.size) == 0);
 #undef P2

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-internal.h -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-internal.h Changed

@@ -66,6 +66,7 @@
 #define ecc_dup_jj _nettle_ecc_dup_jj
 #define ecc_add_jja _nettle_ecc_add_jja
 #define ecc_add_jjj _nettle_ecc_add_jjj
+#define ecc_nonsec_add_jjj _nettle_ecc_nonsec_add_jjj
 #define ecc_dup_eh _nettle_ecc_dup_eh
 #define ecc_add_eh _nettle_ecc_add_eh
 #define ecc_add_ehh _nettle_ecc_add_ehh
@@ -80,7 +81,6 @@
 #define cnd_copy _nettle_cnd_copy
 #define sec_add_1 _nettle_sec_add_1
 #define sec_sub_1 _nettle_sec_sub_1
-#define sec_tabselect _nettle_sec_tabselect
 #define sec_modinv _nettle_sec_modinv
 #define curve25519_eh_to_x _nettle_curve25519_eh_to_x
 #define curve448_eh_to_x _nettle_curve448_eh_to_x
@@ -174,8 +174,14 @@
 /* B^size mod m. Expected to have at least 32 leading zeros
 (equality for secp_256r1). */
 const mp_limb_t *B;
- /* 2^{bit_size} - m, same value as above, but shifted. */
+ /* 2^{bit_size} - m. When different from B above, for numbers of
+ interest, usually B has trailing zeros and this is B shifted
+ right. */
 const mp_limb_t *B_shifted;
+ /* For ecc_mod_sub: B^size - 2m, if that doesn't underflow.
+ Otherwise, same as B */
+ const mp_limb_t *Bm2m;
+
 /* m +/- 1, for redc, excluding redc_size low limbs. */
 const mp_limb_t *redc_mpm1;
 /* (m+1)/2 */
@@ -258,6 +264,8 @@
 void
 ecc_mod_add (const struct ecc_modulo *m, mp_limb_t *rp,
 	 const mp_limb_t *ap, const mp_limb_t *bp);
+
+/* If inputs are in the range 0 <= a, b < 2m, then so is the output. */
 void
 ecc_mod_sub (const struct ecc_modulo *m, mp_limb_t *rp,
 	 const mp_limb_t *ap, const mp_limb_t *bp);
@@ -382,6 +390,14 @@
 	 mp_limb_t *r, const mp_limb_t *p, const mp_limb_t *q,
 	 mp_limb_t *scratch);
 
+/* Variant that handles the checks for the special cases P = ±Q.
+ Returns 1 on success, 0 if result is infinite. Not side-channel
+ silent, so must not be used with secret inputs. */
+int
+ecc_nonsec_add_jjj (const struct ecc_curve *ecc,
+		 mp_limb_t *r, const mp_limb_t *p, const mp_limb_t *q,
+		 mp_limb_t *scratch);
+
 /* Point doubling on a twisted Edwards curve, with homogeneous
 cooordinates. */
 void
@@ -458,11 +474,6 @@
 sec_sub_1 (mp_limb_t *rp, mp_limb_t *ap, mp_size_t n, mp_limb_t b);
 
 void
-sec_tabselect (mp_limb_t *rp, mp_size_t rn,
-	 const mp_limb_t *table, unsigned tn,
-	 unsigned k);
-
-void
 curve25519_eh_to_x (mp_limb_t *xp, const mp_limb_t *p,
 		 mp_limb_t *scratch);

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-mod-arith.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-mod-arith.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-mul-a-eh.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-mul-a-eh.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-mul-a.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-mul-a.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-mul-g-eh.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-mul-g-eh.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-mul-g.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-mul-g.c Changed

_service:tar_scm:nettle-3.9.1.tar.gz/ecc-nonsec-add-jjj.c Added

@@ -0,0 +1,162 @@
+/* ecc-non-sec-add-jjj.c
+
+ Copyright (C) 2013, 2022 Niels Möller
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+/* Development of Nettle's ECC support was funded by the .SE Internet Fund. */
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "ecc.h"
+#include "ecc-internal.h"
+
+/* Similar to ecc_add_jjj, but checks if x coordinates are equal (H =
+ 0) below, and if so, performs doubling if also y coordinates are
+ equal, or returns 0 (failure) indicating that the result is the
+ infinity point. */
+int
+ecc_nonsec_add_jjj (const struct ecc_curve *ecc,
+		 mp_limb_t *r, const mp_limb_t *p, const mp_limb_t *q,
+		 mp_limb_t *scratch)
+{
+#define x1 p
+#define y1 (p + ecc->p.size)
+#define z1 (p + 2*ecc->p.size)
+
+#define x2 q
+#define y2 (q + ecc->p.size)
+#define z2 (q + 2*ecc->p.size)
+
+#define x3 r
+#define y3 (r + ecc->p.size)
+#define z3 (r + 2*ecc->p.size)
+ /* Formulas, from djb,
+ http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl:
+
+ Computation		Operation	Live variables
+
+ Z1Z1 = Z1^2		sqr		Z1Z1
+ Z2Z2 = Z2^2		sqr		Z1Z1, Z2Z2
+ U1 = X1*Z2Z2		mul		Z1Z1, Z2Z2, U1
+ U2 = X2*Z1Z1		mul		Z1Z1, Z2Z2, U1, U2
+ H = U2-U1					Z1Z1, Z2Z2, U1, H
+ Z3 = ((Z1+Z2)^2-Z1Z1-Z2Z2)*H sqr, mul	Z1Z1, Z2Z2, U1, H
+ S1 = Y1*Z2*Z2Z2		mul, mul	Z1Z1, U1, H, S1
+ S2 = Y2*Z1*Z1Z1		mul, mul	U1, H, S1, S2
+ W = 2*(S2-S1)	(djb: r)		U1, H, S1, W
+ I = (2*H)^2		sqr		U1, H, S1, W, I
+ J = H*I			mul		U1, S1, W, J, V
+ V = U1*I			mul		S1, W, J, V
+ X3 = W^2-J-2*V		sqr		S1, W, J, V
+ Y3 = W*(V-X3)-2*S1*J	mul, mul
+ */
+
+#define h scratch
+#define z1z1 (scratch + ecc->p.size)
+#define z2z2 z1z1
+#define z1z2 (scratch + 2*ecc->p.size)
+
+#define w (scratch + ecc->p.size)
+#define i (scratch + 2*ecc->p.size)
+#define j h
+#define v i
+
+#define tp (scratch + 3*ecc->p.size)
+
+ ecc_mod_sqr (&ecc->p, z2z2, z2, tp);		/* z2z2 */
+ /* Store u1 at x3 */
+ ecc_mod_mul (&ecc->p, x3, x1, z2z2, tp);	/* z2z2 */
+
+ ecc_mod_add (&ecc->p, z1z2, z1, z2);		/* z2z2, z1z2 */
+ ecc_mod_sqr (&ecc->p, z1z2, z1z2, tp);
+ ecc_mod_sub (&ecc->p, z1z2, z1z2, z2z2);	/* z2z2, z1z2 */
+
+ /* Do s1 early, store at y3 */
+ ecc_mod_mul (&ecc->p, z2z2, z2z2, z2, tp);	/* z2z2, z1z2 */
+ ecc_mod_mul (&ecc->p, y3, z2z2, y1, tp);	/* z1z2 */
+
+ ecc_mod_sqr (&ecc->p, z1z1, z1, tp);		/* z1z1, z1z2 */
+ ecc_mod_sub (&ecc->p, z1z2, z1z2, z1z1);
+ ecc_mod_mul (&ecc->p, h, x2, z1z1, tp);	/* z1z1, z1z2, h */
+ ecc_mod_sub (&ecc->p, h, h, x3);
+
+ /* z1^3 */
+ ecc_mod_mul (&ecc->p, z1z1, z1z1, z1, tp);
+
+ /* z3 <-- h z1 z2 delayed until now, since that may clobber z1. */
+ ecc_mod_mul (&ecc->p, z3, z1z2, h, tp);	/* z1z1, h */
+ /* w = 2 (s2 - s1) */
+ ecc_mod_mul (&ecc->p, w, z1z1, y2, tp);	/* h, w */
+ ecc_mod_sub (&ecc->p, w, w, y3);
+
+ /* Note that use of ecc_mod_zero_p depends 0 <= h,w < 2p. */
+ if (ecc_mod_zero_p (&ecc->p, h))
+ {
+ /* X1 == X2 */
+ if (ecc_mod_zero_p (&ecc->p, w)) {
+	/* Y1 == Y2. Do point duplication. Note that q input is
+	 unclobbered, and that scratch need is smaller. Implies some
+	 unnecessary recomputation, but performance it not so
+	 important for this very unlikely corner case. */
+	ecc_dup_jj (ecc, r, q, scratch);
+	return 1;
+ }
+
+ /* We must have Y1 == -Y2, and then the result is the infinity
+	 point, */
+ mpn_zero (r, 3*ecc->p.size);
+ return 0;
+ }
+ ecc_mod_add (&ecc->p, w, w, w);
+
+ /* i = (2h)^2 */
+ ecc_mod_add (&ecc->p, i, h, h);		/* h, w, i */
+ ecc_mod_sqr (&ecc->p, i, i, tp);
+
+ /* j and h can overlap */
+ ecc_mod_mul (&ecc->p, j, h, i, tp);		/* j, w, i */
+
+ /* v and i can overlap */
+ ecc_mod_mul (&ecc->p, v, x3, i, tp);		/* j, w, v */
+
+ /* x3 <-- w^2 - j - 2v */
+ ecc_mod_sqr (&ecc->p, x3, w, tp);
+ ecc_mod_sub (&ecc->p, x3, x3, j);
+ ecc_mod_submul_1 (&ecc->p, x3, v, 2);
+
+ /* y3 <-- w (v - x3) - 2 s1 j */
+ ecc_mod_mul (&ecc->p, j, j, y3, tp);
+ ecc_mod_sub (&ecc->p, v, v, x3);
+ ecc_mod_mul (&ecc->p, y3, v, w, tp);
+ ecc_mod_submul_1 (&ecc->p, y3, j, 2);
+
+ return 1;
+}

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-secp192r1.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-secp192r1.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-secp224r1.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-secp224r1.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-secp256r1.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-secp256r1.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-secp384r1.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-secp384r1.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ecc-secp521r1.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ecc-secp521r1.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/eccdata.c -> _service:tar_scm:nettle-3.9.1.tar.gz/eccdata.c Changed

@@ -71,6 +71,7 @@
 
 /* Prime */
 mpz_t p;
+ /* Curve constant */
 mpz_t b;
 
 /* Curve order */
@@ -626,15 +627,15 @@
 
 	 x^2 + y^2 = 1 + (121665/121666) x^2 y^2 (mod p).
 
-	 -x^2 + y^2 = 1 - (121665/121666) x^2 y^2, with p = 2^{255} - 19.
+	 But instead of using this curve, we use a twisted curve, following RFC 7748,
+
+	 -x^2 + y^2 = 1 - (121665/121666) x^2 y^2 (mod p)
+
+ (this is possible because -1 is a square modulo p).
 
 	 The generator is
 	 x = 0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a
 y = 0x6666666666666666666666666666666666666666666666666666666666666658
-
-	 Also birationally equivalent to the curve25519 Montgomery curve,
-
-	 y^2 = x^3 + 486662 x^2 + x (mod p)
 */
 ecc_curve_init_str (ecc, ECC_TYPE_TWISTED_EDWARDS,
 			 "7fffffffffffffffffffffffffffffff"
@@ -1073,7 +1074,7 @@
 unsigned i;
 const char *suffix;
 
- mpz_init (t);
+ mpz_init_set (t, x);
 mpz_init (mask);
 mpz_init (limb);
 
@@ -1082,8 +1083,6 @@
 
 suffix = bits_per_limb > 32 ? "ULL" : "UL";
 
- mpz_init_set (t, x);
-
 for (i = 0; i < size; i++)
 {
 if ( (i % 8) == 0)
@@ -1119,6 +1118,7 @@
 mpz_mul_2exp (t, x, size * bits_per_limb);
 mpz_mod (t, t, p);
 output_bignum (name, t, size, bits_per_limb);
+ mpz_clear (t);
 }
 
 static void
@@ -1151,98 +1151,99 @@
 mpz_clear (t);
 }
 
-static unsigned
-output_modulo (const char *name, const mpz_t x,
-	 unsigned size, unsigned bits_per_limb)
+static void
+string_toupper (char *buf, size_t size, const char *s)
 {
- mpz_t mod;
- unsigned bits;
-
- mpz_init (mod);
-
- mpz_setbit (mod, bits_per_limb * size);
- mpz_mod (mod, mod, x);
-
- bits = mpz_sizeinbase (mod, 2);
- output_bignum (name, mod, size, bits_per_limb);
- 
- mpz_clear (mod);
- return bits;
+ size_t i;
+ for (i = 0; i < size; i++)
+ {
+ bufi = toupper ((int)si);
+ if (!bufi)
+	return;
+ }
+ fprintf (stderr, "string '%s' too large for buffer of size %u.\n",
+	 s, (unsigned) size);
+ abort();
 }
 
 static void
-output_curve (const struct ecc_curve *ecc, unsigned bits_per_limb)
+output_modulo (const char *name, const mpz_t x,
+	 unsigned size, unsigned bits_per_limb)
 {
- unsigned limb_size = (ecc->bit_size + bits_per_limb - 1)/bits_per_limb;
- unsigned i;
- unsigned bits;
- int redc_limbs;
+ unsigned bit_size;
+ int shift;
+ char buf20;
 mpz_t t;
- mpz_t z;
 
- mpz_init (t);
- mpz_init (z);
+ snprintf (buf, sizeof (buf), "ecc_%s", name);
+ output_bignum (buf, x, size, bits_per_limb);
 
- printf ("/* For NULL. */\n#include <stddef.h>\n");
+ mpz_init (t);
 
- printf ("#define ECC_LIMB_SIZE %u\n", limb_size);
- printf ("#define ECC_PIPPENGER_K %u\n", ecc->pippenger_k);
- printf ("#define ECC_PIPPENGER_C %u\n", ecc->pippenger_c);
+ mpz_setbit (t, bits_per_limb * size);
+ mpz_mod (t, t, x);
 
- output_bignum ("ecc_p", ecc->p, limb_size, bits_per_limb);
- output_bignum ("ecc_b", ecc->b, limb_size, bits_per_limb);
- output_bignum ("ecc_q", ecc->q, limb_size, bits_per_limb);
+ snprintf (buf, sizeof (buf), "ecc_Bmod%s", name);
+ output_bignum (buf, t, size, bits_per_limb);
 
- bits = output_modulo ("ecc_Bmodp", ecc->p, limb_size, bits_per_limb);
- printf ("#define ECC_BMODP_SIZE %u\n",
-	 (bits + bits_per_limb - 1) / bits_per_limb);
- bits = output_modulo ("ecc_Bmodq", ecc->q, limb_size, bits_per_limb);
- printf ("#define ECC_BMODQ_SIZE %u\n",
-	 (bits + bits_per_limb - 1) / bits_per_limb);
- bits = mpz_sizeinbase (ecc->q, 2);
- if (bits < ecc->bit_size)
+ string_toupper (buf, sizeof (buf), name);
+ printf ("#define ECC_BMOD%s_SIZE %u\n", buf,
+	 (unsigned) ((mpz_sizeinbase (t, 2) + bits_per_limb - 1)
+		 / bits_per_limb));
+
+ bit_size = mpz_sizeinbase (x, 2);
+
+ shift = size * bits_per_limb - bit_size;
+ assert (shift >= 0);
+ if (shift > 0)
 {
- /* for curve25519, with q = 2^k + q', with a much smaller q' */
- unsigned mbits;
- unsigned shift;
+ mpz_set_ui (t, 0);
+ mpz_setbit (t, size * bits_per_limb);
+ mpz_submul_ui (t, x, 2);
 
- /* Shift to align the one bit at B */
- shift = bits_per_limb * limb_size + 1 - bits;
- 
- mpz_set (t, ecc->q);
- mpz_clrbit (t, bits-1);
- mbits = mpz_sizeinbase (t, 2);
+ snprintf (buf, sizeof (buf), "ecc_Bm2%s", name);
+ output_bignum (buf, t, size, bits_per_limb);
 
- /* The shifted value must be a limb smaller than q. */
- if (mbits + shift + bits_per_limb <= bits)
+ if (bit_size == 253)
 	{
+	 /* For curve25519, with q = 2^k + q', with a much smaller q' */
+	 unsigned mbits;
+	 unsigned shift;
+
+	 /* Shift to align the one bit at B */
+	 shift = bits_per_limb * size + 1 - bit_size;
+
+	 mpz_set (t, x);
+	 mpz_clrbit (t, bit_size-1);
+	 mbits = mpz_sizeinbase (t, 2);
+
+	 /* The shifted value must be a limb smaller than q. */
+	 assert (mbits + shift + bits_per_limb <= bit_size);
+
 	 /* q of the form 2^k + q', with q' a limb smaller */
 	 mpz_mul_2exp (t, t, shift);
-	 output_bignum ("ecc_mBmodq_shifted", t, limb_size, bits_per_limb);
-	}
- }
+	 snprintf (buf, sizeof (buf), "ecc_mBmod%s_shifted", name);
 
- if (ecc->bit_size < limb_size * bits_per_limb)
- {
- int shift;
+	 output_bignum (buf, t, size, bits_per_limb);
+	}
+ else
+	{
+	 mpz_set_ui (t, 0);
+	 mpz_setbit (t, bit_size);
+	 mpz_sub (t, t, x);
 
- mpz_set_ui (t, 0);
- mpz_setbit (t, ecc->bit_size);
- mpz_sub (t, t, ecc->p); 
- output_bignum ("ecc_Bmodp_shifted", t, limb_size, bits_per_limb);

_service:tar_scm:nettle-3.8.1.tar.gz/examples/ecc-benchmark.c -> _service:tar_scm:nettle-3.9.1.tar.gz/examples/ecc-benchmark.c Changed

@@ -159,11 +159,17 @@
 }
 
 static void
-bench_modinv (void *p)
+bench_pinv (void *p)
 {
 struct ecc_ctx *ctx = (struct ecc_ctx *) p;
 ctx->ecc->p.invert (&ctx->ecc->p, ctx->rp, ctx->ap, ctx->tp);
 }
+static void
+bench_qinv (void *p)
+{
+ struct ecc_ctx *ctx = (struct ecc_ctx *) p;
+ ctx->ecc->q.invert (&ctx->ecc->p, ctx->rp, ctx->ap, ctx->tp);
+}
 
 #if !NETTLE_USE_MINI_GMP
 static void
@@ -239,7 +245,7 @@
 bench_curve (const struct ecc_curve *ecc)
 {
 struct ecc_ctx ctx; 
- double modp, reduce, modq, modinv, modinv_gcd, modinv_powm,
+ double modp, reduce, modq, pinv, qinv, modinv_gcd, modinv_powm,
 dup_hh, add_hh, add_hhh,
 mul_g, mul_a;
 
@@ -277,7 +283,8 @@
 
 modq = time_function (bench_modq, &ctx);
 
- modinv = time_function (bench_modinv, &ctx);
+ pinv = time_function (bench_pinv, &ctx);
+ qinv = time_function (bench_qinv, &ctx);
 #if !NETTLE_USE_MINI_GMP
 modinv_gcd = time_function (bench_modinv_gcd, &ctx);
 #else
@@ -299,9 +306,9 @@
 free (ctx.bp);
 free (ctx.tp);
 
- printf ("%4d %6.4f %6.4f %6.4f %6.2f %6.3f %6.2f %6.3f %6.3f %6.3f %6.1f %6.1f\n",
+ printf ("%4d %6.4f %6.4f %6.4f %6.2f %6.2f %6.3f %6.2f %6.3f %6.3f %6.3f %6.1f %6.1f\n",
 	 ecc->p.bit_size, 1e6 * modp, 1e6 * reduce, 1e6 * modq,
-	 1e6 * modinv, 1e6 * modinv_gcd, 1e6 * modinv_powm,
+	 1e6 * pinv, 1e6 * qinv, 1e6 * modinv_gcd, 1e6 * modinv_powm,
 	 1e6 * dup_hh, 1e6 * add_hh, 1e6 * add_hhh,
 	 1e6 * mul_g, 1e6 * mul_a);
 }
@@ -326,8 +333,8 @@
 unsigned i;
 
 time_init();
- printf ("%4s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s (us)\n",
-	 "size", "modp", "reduce", "modq", "modinv", "mi_gcd", "mi_pow",
+ printf ("%4s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s %6s (us)\n",
+	 "size", "modp", "reduce", "modq", "pinv", "qinv", "mi_gcd", "mi_pow",
 	 "dup_hh", "add_hh", "ad_hhh",
 	 "mul_g", "mul_a");
 for (i = 0; i < numberof (curves); i++)

_service:tar_scm:nettle-3.8.1.tar.gz/examples/nettle-benchmark.c -> _service:tar_scm:nettle-3.9.1.tar.gz/examples/nettle-benchmark.c Changed

@@ -56,6 +56,7 @@
 #include "des.h"
 #include "eax.h"
 #include "gcm.h"
+#include "ghash-internal.h"
 #include "memxor.h"
 #include "salsa20.h"
 #include "salsa20-internal.h"
@@ -63,6 +64,7 @@
 #include "sha1.h"
 #include "sha2.h"
 #include "sha3.h"
+#include "sm4.h"
 #include "twofish.h"
 #include "umac.h"
 #include "cmac.h"
@@ -874,10 +876,22 @@
   TIME_CYCLES (t, sha3_permute (&state));
   printf("sha3_permute: %.2f cycles (%.2f / round)\n", t, t / 24.0);
 }
+static void
+bench_ghash_update(void)
+{
+  struct gcm_key key;
+  union nettle_block16 state;
+  const uint8_t data160;
+  double t;
+
+  TIME_CYCLES (t, _ghash_update (&key, &state, 10, data));
+  printf("ghash_update: %.2f cycles / block\n", t / 10.0);
+}
 #else
 #define bench_sha1_compress()
 #define bench_salsa20_core()
 #define bench_sha3_permute()
+#define bench_ghash_update()
 #endif
 
 #if WITH_OPENSSL
@@ -926,6 +940,7 @@
       &nettle_des3,
       &nettle_serpent256,
       &nettle_twofish128, &nettle_twofish192, &nettle_twofish256,
+      &nettle_sm4,
       NULL
     };
 
@@ -947,6 +962,7 @@
       &nettle_gcm_camellia256,
       &nettle_eax_aes128,
       &nettle_chacha_poly1305,
+      &nettle_ocb_aes128,
       NULL
     };
 
@@ -983,6 +999,7 @@
   bench_sha1_compress();
   bench_salsa20_core();
   bench_sha3_permute();
+  bench_ghash_update();
   printf("\n");
 
   header();

_service:tar_scm:nettle-3.8.1.tar.gz/fat-arm.c -> _service:tar_scm:nettle-3.9.1.tar.gz/fat-arm.c Changed

@@ -153,9 +153,9 @@
 DECLARE_FAT_FUNC_VAR(sha1_compress, sha1_compress_func, c)
 DECLARE_FAT_FUNC_VAR(sha1_compress, sha1_compress_func, armv6)
 
-DECLARE_FAT_FUNC(_nettle_sha256_compress, sha256_compress_func)
-DECLARE_FAT_FUNC_VAR(sha256_compress, sha256_compress_func, c)
-DECLARE_FAT_FUNC_VAR(sha256_compress, sha256_compress_func, armv6)
+DECLARE_FAT_FUNC(_nettle_sha256_compress_n, sha256_compress_n_func)
+DECLARE_FAT_FUNC_VAR(sha256_compress_n, sha256_compress_n_func, c)
+DECLARE_FAT_FUNC_VAR(sha256_compress_n, sha256_compress_n_func, armv6)
 
 DECLARE_FAT_FUNC(_nettle_sha512_compress, sha512_compress_func)
 DECLARE_FAT_FUNC_VAR(sha512_compress, sha512_compress_func, c)
@@ -202,7 +202,7 @@
       _nettle_aes_encrypt_vec = _nettle_aes_encrypt_armv6;
       _nettle_aes_decrypt_vec = _nettle_aes_decrypt_armv6;
       nettle_sha1_compress_vec = _nettle_sha1_compress_armv6;
-      _nettle_sha256_compress_vec = _nettle_sha256_compress_armv6;
+      _nettle_sha256_compress_n_vec = _nettle_sha256_compress_n_armv6;
     }
   else
     {
@@ -211,7 +211,7 @@
       _nettle_aes_encrypt_vec = _nettle_aes_encrypt_arm;
       _nettle_aes_decrypt_vec = _nettle_aes_decrypt_arm;
       nettle_sha1_compress_vec = _nettle_sha1_compress_c;
-      _nettle_sha256_compress_vec = _nettle_sha256_compress_c;
+      _nettle_sha256_compress_n_vec = _nettle_sha256_compress_n_c;
     }
   if (features.have_neon)
     {
@@ -263,9 +263,10 @@
 		(uint32_t *state, const uint8_t *input),
 		(state, input))
 
-DEFINE_FAT_FUNC(_nettle_sha256_compress, void,
-		(uint32_t *state, const uint8_t *input, const uint32_t *k),
-		(state, input, k))
+DEFINE_FAT_FUNC(_nettle_sha256_compress_n, const uint8_t *,
+		(uint32_t *state, const uint32_t *k,
+		 size_t blocks, const uint8_t *input),
+		(state, k, blocks, input))
 
 DEFINE_FAT_FUNC(_nettle_sha512_compress, void,
 		(uint64_t *state, const uint8_t *input, const uint64_t *k),

_service:tar_scm:nettle-3.8.1.tar.gz/fat-arm64.c -> _service:tar_scm:nettle-3.9.1.tar.gz/fat-arm64.c Changed

@@ -178,9 +178,9 @@
 DECLARE_FAT_FUNC_VAR(sha1_compress, sha1_compress_func, c)
 DECLARE_FAT_FUNC_VAR(sha1_compress, sha1_compress_func, arm64)
 
-DECLARE_FAT_FUNC(_nettle_sha256_compress, sha256_compress_func)
-DECLARE_FAT_FUNC_VAR(sha256_compress, sha256_compress_func, c)
-DECLARE_FAT_FUNC_VAR(sha256_compress, sha256_compress_func, arm64)
+DECLARE_FAT_FUNC(_nettle_sha256_compress_n, sha256_compress_n_func)
+DECLARE_FAT_FUNC_VAR(sha256_compress_n, sha256_compress_n_func, c)
+DECLARE_FAT_FUNC_VAR(sha256_compress_n, sha256_compress_n_func, arm64)
 
 static void CONSTRUCTOR
 fat_init (void)
@@ -250,11 +250,11 @@
     {
       if (verbose)
 	fprintf (stderr, "libnettle: enabling hardware-accelerated sha256 compress code.\n");
-      _nettle_sha256_compress_vec = _nettle_sha256_compress_arm64;
+      _nettle_sha256_compress_n_vec = _nettle_sha256_compress_n_arm64;
     }
   else
     {
-      _nettle_sha256_compress_vec = _nettle_sha256_compress_c;
+      _nettle_sha256_compress_n_vec = _nettle_sha256_compress_n_c;
     }
 }
 
@@ -297,6 +297,7 @@
 		(uint32_t *state, const uint8_t *input),
 		(state, input))
 
-DEFINE_FAT_FUNC(_nettle_sha256_compress, void,
-		(uint32_t *state, const uint8_t *input, const uint32_t *k),
-		(state, input, k))
+DEFINE_FAT_FUNC(_nettle_sha256_compress_n, const uint8_t *,
+		(uint32_t *state, const uint32_t *k,
+		 size_t blocks, const uint8_t *input),
+		(state, k, blocks, input))

_service:tar_scm:nettle-3.8.1.tar.gz/fat-ppc.c -> _service:tar_scm:nettle-3.9.1.tar.gz/fat-ppc.c Changed

@@ -65,6 +65,7 @@
 #include "aes-internal.h"
 #include "chacha-internal.h"
 #include "ghash-internal.h"
+#include "poly1305.h"
 #include "fat-setup.h"
 
 /* Defines from arch/powerpc/include/uapi/asm/cputable.h in Linux kernel */
@@ -77,11 +78,15 @@
 #ifndef PPC_FEATURE2_VEC_CRYPTO
 #define PPC_FEATURE2_VEC_CRYPTO 0x02000000
 #endif
+#ifndef PPC_FEATURE2_ARCH_3_00
+#define PPC_FEATURE2_ARCH_3_00 0x00800000
+#endif
 
 struct ppc_features
 {
   int have_crypto_ext;
   int have_altivec;
+  int have_power9;
 };
 
 #define MATCH(s, slen, literal, llen) \
@@ -93,6 +98,7 @@
   const char *s;
   features->have_crypto_ext = 0;
   features->have_altivec = 0;
+  features->have_power9 = 0;
 
   s = secure_getenv (ENV_OVERRIDE);
   if (s)
@@ -105,6 +111,8 @@
 	  features->have_crypto_ext = 1;
 	else if (MATCH(s, length, "altivec", 7))
 	  features->have_altivec = 1;
+  else if (MATCH(s, length, "power9", 6))
+	  features->have_power9 = 1;
 	if (!sep)
 	  break;
 	s = sep + 1;
@@ -136,6 +144,9 @@
       features->have_crypto_ext
 	= ((hwcap2 & PPC_FEATURE2_VEC_CRYPTO) == PPC_FEATURE2_VEC_CRYPTO);
 
+      features->have_power9
+	= ((hwcap2 & PPC_FEATURE2_ARCH_3_00) == PPC_FEATURE2_ARCH_3_00);
+
       /* We also need VSX instructions, mainly for load and store. */
       features->have_altivec
 	= ((hwcap & (PPC_FEATURE_HAS_ALTIVEC | PPC_FEATURE_HAS_VSX))
@@ -172,6 +183,23 @@
 DECLARE_FAT_FUNC_VAR(chacha_crypt32, chacha_crypt_func, 1core)
 DECLARE_FAT_FUNC_VAR(chacha_crypt32, chacha_crypt_func, 3core)
 
+DECLARE_FAT_FUNC(_nettle_poly1305_set_key, poly1305_set_key_func)
+DECLARE_FAT_FUNC_VAR(poly1305_set_key, poly1305_set_key_func, c)
+DECLARE_FAT_FUNC_VAR(poly1305_set_key, poly1305_set_key_func, ppc64)
+
+DECLARE_FAT_FUNC(_nettle_poly1305_block, poly1305_block_func)
+DECLARE_FAT_FUNC_VAR(poly1305_block, poly1305_block_func, c)
+DECLARE_FAT_FUNC_VAR(poly1305_block, poly1305_block_func, ppc64)
+
+DECLARE_FAT_FUNC(_nettle_poly1305_digest, poly1305_digest_func)
+DECLARE_FAT_FUNC_VAR(poly1305_digest, poly1305_digest_func, c)
+DECLARE_FAT_FUNC_VAR(poly1305_digest, poly1305_digest_func, ppc64)
+
+DECLARE_FAT_FUNC(_nettle_poly1305_blocks, poly1305_blocks_func)
+DECLARE_FAT_FUNC_VAR(poly1305_blocks, poly1305_blocks_func, c)
+DECLARE_FAT_FUNC_VAR(poly1305_blocks, poly1305_blocks_func, ppc64)
+
+
 static void CONSTRUCTOR
 fat_init (void)
 {
@@ -220,6 +248,23 @@
       nettle_chacha_crypt_vec = _nettle_chacha_crypt_1core;
       nettle_chacha_crypt32_vec = _nettle_chacha_crypt32_1core;
     }
+
+  if (features.have_power9)
+    {
+      if (verbose)
+	fprintf (stderr, "libnettle: enabling arch 3.00 code.\n");
+      _nettle_poly1305_set_key_vec = _nettle_poly1305_set_key_ppc64;
+    _nettle_poly1305_block_vec = _nettle_poly1305_block_ppc64;
+    _nettle_poly1305_digest_vec = _nettle_poly1305_digest_ppc64;
+    _nettle_poly1305_blocks_vec = _nettle_poly1305_blocks_ppc64;
+    }
+  else
+    {
+      _nettle_poly1305_set_key_vec = _nettle_poly1305_set_key_c;
+    _nettle_poly1305_block_vec = _nettle_poly1305_block_c;
+    _nettle_poly1305_digest_vec = _nettle_poly1305_digest_c;
+    _nettle_poly1305_blocks_vec = _nettle_poly1305_blocks_c;
+    }
 }
 
 DEFINE_FAT_FUNC(_nettle_aes_encrypt, void,
@@ -261,3 +306,25 @@
 		 uint8_t *dst,
 		 const uint8_t *src),
 		(ctx, length, dst, src))
+
+DEFINE_FAT_FUNC(_nettle_poly1305_set_key, void,
+		(struct poly1305_ctx *ctx,
+     const uint8_t *key),
+		(ctx, key))
+
+DEFINE_FAT_FUNC(_nettle_poly1305_block, void,
+		(struct poly1305_ctx *ctx,
+     const uint8_t *m,
+     unsigned high),
+		(ctx, m, high))
+
+DEFINE_FAT_FUNC(_nettle_poly1305_digest, void,
+		(struct poly1305_ctx *ctx,
+     union nettle_block16 *s),
+		(ctx, s))
+
+DEFINE_FAT_FUNC(_nettle_poly1305_blocks, const uint8_t *,
+		(struct poly1305_ctx *ctx,
+     size_t blocks,
+		 const uint8_t *m),
+		(ctx, blocks, m))

_service:tar_scm:nettle-3.8.1.tar.gz/fat-s390x.c -> _service:tar_scm:nettle-3.9.1.tar.gz/fat-s390x.c Changed

@@ -254,9 +254,9 @@
 DECLARE_FAT_FUNC_VAR(sha1_compress, sha1_compress_func, c)
 DECLARE_FAT_FUNC_VAR(sha1_compress, sha1_compress_func, s390x)
 
-DECLARE_FAT_FUNC(_nettle_sha256_compress, sha256_compress_func)
-DECLARE_FAT_FUNC_VAR(sha256_compress, sha256_compress_func, c)
-DECLARE_FAT_FUNC_VAR(sha256_compress, sha256_compress_func, s390x)
+DECLARE_FAT_FUNC(_nettle_sha256_compress_n, sha256_compress_n_func)
+DECLARE_FAT_FUNC_VAR(sha256_compress_n, sha256_compress_n_func, c)
+DECLARE_FAT_FUNC_VAR(sha256_compress_n, sha256_compress_n_func, s390x)
 
 DECLARE_FAT_FUNC(_nettle_sha512_compress, sha512_compress_func)
 DECLARE_FAT_FUNC_VAR(sha512_compress, sha512_compress_func, c)
@@ -398,11 +398,11 @@
   {
     if (verbose)
       fprintf (stderr, "libnettle: enabling hardware accelerated SHA256 compress code.\n");
-    _nettle_sha256_compress_vec = _nettle_sha256_compress_s390x;
+    _nettle_sha256_compress_n_vec = _nettle_sha256_compress_n_s390x;
   }
   else
   {
-    _nettle_sha256_compress_vec = _nettle_sha256_compress_c;
+    _nettle_sha256_compress_n_vec = _nettle_sha256_compress_n_c;
   }
 
   /* SHA512 */
@@ -495,9 +495,10 @@
 		(state, input))
 
 /* SHA256 */
-DEFINE_FAT_FUNC(_nettle_sha256_compress, void,
-		(uint32_t *state, const uint8_t *input, const uint32_t *k),
-		(state, input, k))
+DEFINE_FAT_FUNC(_nettle_sha256_compress_n, const uint8_t *,
+		(uint32_t *state, const uint32_t *k,
+		 size_t blocks, const uint8_t *input),
+		(state, k, blocks, input))
 
 /* SHA512 */
 DEFINE_FAT_FUNC(_nettle_sha512_compress, void,

_service:tar_scm:nettle-3.8.1.tar.gz/fat-setup.h -> _service:tar_scm:nettle-3.9.1.tar.gz/fat-setup.h Changed

@@ -178,7 +178,9 @@
 				 const uint8_t *src);
 
 typedef void sha1_compress_func(uint32_t *state, const uint8_t *input);
-typedef void sha256_compress_func(uint32_t *state, const uint8_t *input, const uint32_t *k);
+typedef const uint8_t *
+sha256_compress_n_func(uint32_t *state, const uint32_t *k,
+		       size_t blocks, const uint8_t *input);
 
 struct sha3_state;
 typedef void sha3_permute_func (struct sha3_state *state);
@@ -196,6 +198,14 @@
 			       uint8_t *dst,
 			       const uint8_t *src);
 
+struct poly1305_ctx;
+typedef void poly1305_set_key_func(struct poly1305_ctx *ctx, const uint8_t *key);
+typedef void poly1305_digest_func(struct poly1305_ctx *ctx, union nettle_block16 *s);
+typedef void poly1305_block_func(struct poly1305_ctx *ctx, const uint8_t *m,
+			     unsigned high);
+typedef const uint8_t * poly1305_blocks_func(struct poly1305_ctx *ctx, size_t blocks,
+			     const uint8_t *m);
+
 struct aes128_ctx;
 typedef void aes128_set_key_func (struct aes128_ctx *ctx, const uint8_t *key);
 typedef void aes128_invert_key_func (struct aes128_ctx *dst, const struct aes128_ctx *src);

_service:tar_scm:nettle-3.8.1.tar.gz/fat-x86_64.c -> _service:tar_scm:nettle-3.9.1.tar.gz/fat-x86_64.c Changed

@@ -155,9 +155,9 @@
 DECLARE_FAT_FUNC_VAR(sha1_compress, sha1_compress_func, x86_64)
 DECLARE_FAT_FUNC_VAR(sha1_compress, sha1_compress_func, sha_ni)
 
-DECLARE_FAT_FUNC(_nettle_sha256_compress, sha256_compress_func)
-DECLARE_FAT_FUNC_VAR(sha256_compress, sha256_compress_func, x86_64)
-DECLARE_FAT_FUNC_VAR(sha256_compress, sha256_compress_func, sha_ni)
+DECLARE_FAT_FUNC(_nettle_sha256_compress_n, sha256_compress_n_func)
+DECLARE_FAT_FUNC_VAR(sha256_compress_n, sha256_compress_n_func, x86_64)
+DECLARE_FAT_FUNC_VAR(sha256_compress_n, sha256_compress_n_func, sha_ni)
 
 DECLARE_FAT_FUNC(_nettle_ghash_set_key, ghash_set_key_func)
 DECLARE_FAT_FUNC_VAR(ghash_set_key, ghash_set_key_func, c)
@@ -228,14 +228,14 @@
       if (verbose)
 	fprintf (stderr, "libnettle: using sha_ni instructions.\n");
       nettle_sha1_compress_vec = _nettle_sha1_compress_sha_ni;
-      _nettle_sha256_compress_vec = _nettle_sha256_compress_sha_ni;
+      _nettle_sha256_compress_n_vec = _nettle_sha256_compress_n_sha_ni;
     }
   else
     {
       if (verbose)
 	fprintf (stderr, "libnettle: not using sha_ni instructions.\n");
       nettle_sha1_compress_vec = _nettle_sha1_compress_x86_64;
-      _nettle_sha256_compress_vec = _nettle_sha256_compress_x86_64;
+      _nettle_sha256_compress_n_vec = _nettle_sha256_compress_n_x86_64;
     }
 
   if (features.have_pclmul)
@@ -315,9 +315,10 @@
 		(uint32_t *state, const uint8_t *input),
 		(state, input))
 
-DEFINE_FAT_FUNC(_nettle_sha256_compress, void,
-		(uint32_t *state, const uint8_t *input, const uint32_t *k),
-		(state, input, k))
+DEFINE_FAT_FUNC(_nettle_sha256_compress_n, const uint8_t *,
+		(uint32_t *state, const uint32_t *k,
+		 size_t blocks, const uint8_t *input),
+		(state, k, blocks, input))
 
 DEFINE_FAT_FUNC(_nettle_ghash_set_key, void,
 		(struct gcm_key *ctx, const union nettle_block16 *key),

_service:tar_scm:nettle-3.9.1.tar.gz/gcm-sm4-meta.c Added

@@ -0,0 +1,60 @@
+/* gcm-sm4-meta.c
+
+ Copyright (C) 2022 Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+
+#include "nettle-meta.h"
+
+#include "gcm.h"
+
+static nettle_set_key_func gcm_sm4_set_nonce_wrapper;
+static void
+gcm_sm4_set_nonce_wrapper (void *ctx, const uint8_t *nonce)
+{
+ gcm_sm4_set_iv (ctx, GCM_IV_SIZE, nonce);
+}
+
+const struct nettle_aead nettle_gcm_sm4 =
+ { "gcm_sm4", sizeof(struct gcm_sm4_ctx),
+ GCM_BLOCK_SIZE, SM4_KEY_SIZE,
+ GCM_IV_SIZE, GCM_DIGEST_SIZE,
+ (nettle_set_key_func *) gcm_sm4_set_key,
+ (nettle_set_key_func *) gcm_sm4_set_key,
+ gcm_sm4_set_nonce_wrapper,
+ (nettle_hash_update_func *) gcm_sm4_update,
+ (nettle_crypt_func *) gcm_sm4_encrypt,
+ (nettle_crypt_func *) gcm_sm4_decrypt,
+ (nettle_hash_digest_func *) gcm_sm4_digest,
+ };

_service:tar_scm:nettle-3.9.1.tar.gz/gcm-sm4.c Added

@@ -0,0 +1,81 @@
+/* gcm-sm4.c
+
+ Galois counter mode using SM4 as the underlying cipher.
+
+ Copyright (C) 2022 Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+
+#include "gcm.h"
+
+void
+gcm_sm4_set_key(struct gcm_sm4_ctx *ctx, const uint8_t *key)
+{
+ GCM_SET_KEY(ctx, sm4_set_encrypt_key, sm4_crypt, key);
+}
+
+void
+gcm_sm4_set_iv(struct gcm_sm4_ctx *ctx,
+	 size_t length, const uint8_t *iv)
+{
+ GCM_SET_IV (ctx, length, iv);
+}
+
+void
+gcm_sm4_update(struct gcm_sm4_ctx *ctx,
+	 size_t length, const uint8_t *data)
+{
+ GCM_UPDATE (ctx, length, data);
+}
+
+void
+gcm_sm4_encrypt(struct gcm_sm4_ctx *ctx,
+		size_t length, uint8_t *dst, const uint8_t *src)
+{
+ GCM_ENCRYPT(ctx, sm4_crypt, length, dst, src);
+}
+
+void
+gcm_sm4_decrypt(struct gcm_sm4_ctx *ctx,
+		size_t length, uint8_t *dst, const uint8_t *src)
+{
+ GCM_DECRYPT(ctx, sm4_crypt, length, dst, src);
+}
+
+void
+gcm_sm4_digest(struct gcm_sm4_ctx *ctx,
+	 size_t length, uint8_t *digest)
+{
+ GCM_DIGEST(ctx, sm4_crypt, length, digest);
+}

_service:tar_scm:nettle-3.8.1.tar.gz/gcm.c -> _service:tar_scm:nettle-3.9.1.tar.gz/gcm.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/gcm.h -> _service:tar_scm:nettle-3.9.1.tar.gz/gcm.h Changed

@@ -40,6 +40,7 @@
 
 #include "aes.h"
 #include "camellia.h"
+#include "sm4.h"
 
 #ifdef __cplusplus
 extern "C" {
@@ -95,6 +96,13 @@
 #define gcm_camellia256_decrypt nettle_gcm_camellia256_decrypt
 #define gcm_camellia256_digest nettle_gcm_camellia256_digest
 
+#define gcm_sm4_set_key nettle_gcm_sm4_set_key
+#define gcm_sm4_set_iv nettle_gcm_sm4_set_iv
+#define gcm_sm4_update nettle_gcm_sm4_update
+#define gcm_sm4_encrypt nettle_gcm_sm4_encrypt
+#define gcm_sm4_decrypt nettle_gcm_sm4_decrypt
+#define gcm_sm4_digest nettle_gcm_sm4_digest
+
 #define GCM_BLOCK_SIZE 16
 #define GCM_IV_SIZE (GCM_BLOCK_SIZE - 4)
 #define GCM_DIGEST_SIZE 16
@@ -322,7 +330,22 @@
 void gcm_camellia256_digest(struct gcm_camellia256_ctx *ctx,
 			    size_t length, uint8_t *digest);
 
-  
+
+struct gcm_sm4_ctx GCM_CTX(struct sm4_ctx);
+
+void gcm_sm4_set_key(struct gcm_sm4_ctx *ctx, const uint8_t *key);
+void gcm_sm4_set_iv(struct gcm_sm4_ctx *ctx,
+		    size_t length, const uint8_t *iv);
+void gcm_sm4_update(struct gcm_sm4_ctx *ctx,
+		    size_t length, const uint8_t *data);
+void gcm_sm4_encrypt(struct gcm_sm4_ctx *ctx,
+		     size_t length, uint8_t *dst, const uint8_t *src);
+void gcm_sm4_decrypt(struct gcm_sm4_ctx *ctx,
+		     size_t length, uint8_t *dst, const uint8_t *src);
+void gcm_sm4_digest(struct gcm_sm4_ctx *ctx,
+		    size_t length, uint8_t *digest);
+
+
 #ifdef __cplusplus
 }
 #endif

_service:tar_scm:nettle-3.8.1.tar.gz/getopt.c -> _service:tar_scm:nettle-3.9.1.tar.gz/getopt.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ghash-internal.h -> _service:tar_scm:nettle-3.9.1.tar.gz/ghash-internal.h Changed

_service:tar_scm:nettle-3.8.1.tar.gz/ghash-set-key.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ghash-set-key.c Changed

@@ -51,25 +51,46 @@
 #define _nettle_ghash_set_key _nettle_ghash_set_key_c
 #endif
 
+#if GCM_TABLE_BITS < 7
+# error Unsupported table size.
+#endif
+
 /* Implements a lookup table for processors without carryless-mul
 instruction. */
 void
 _ghash_set_key (struct gcm_key *ctx, const union nettle_block16 *key)
 {
- /* Middle element if GCM_TABLE_BITS > 0, otherwise the first
- element */
- unsigned i = (1<<GCM_TABLE_BITS)/2;
- block16_zero (&ctx->h0);
- ctx->hi = *key;
-
- /* Algorithm 3 from the gcm paper. First do powers of two, then do
- the rest by adding. */
- while (i /= 2)
- block16_mulx_ghash (&ctx->hi, &ctx->h2*i);
- for (i = 2; i < 1<<GCM_TABLE_BITS; i *= 2)
- {
- unsigned j;
- for (j = 1; j < i; j++)
-	block16_xor3 (&ctx->hi+j, &ctx->hi, &ctx->hj);
- }
+ /* Table elements hold the key, premultiplied by all needed powers
+ of x. Element ordering follows the order bits are processed in
+ _ghash_update, alternating u640 and u641 bits, starting from
+ the least significant end. In the gcm bit order, bits (left to
+ right) correspond to x powers (the numbers) like
+
+ |0...7|8...15|...|56...63|64...71|72...79|...|120...127|
+
+ where | indicates the byte boundaries. On little endian, these
+ bits are in u64 like
+
+ u640: | 56...63 48...55 40...47 32...39 24...31 16...23 8...15 0...7|
+ u641: |120...127 112...129 104...111 96...103 88...95 80...87 72...79 64...71|
+
+ With big-endian, we instead get
+
+ u640: |0...63|
+ u641: |64...127|
+ */
+#if WORDS_BIGENDIAN
+# define INDEX_PERMUTE 63
+#else
+# define INDEX_PERMUTE 7
+#endif
+ unsigned i;
+
+ block16_set (&ctx->h2*INDEX_PERMUTE, key);
+ for (i = 1; i < 64; i++)
+ block16_mulx_ghash(&ctx->h2*(i ^ INDEX_PERMUTE), &ctx->h2*((i-1) ^ INDEX_PERMUTE));
+
+ block16_mulx_ghash(&ctx->h2*INDEX_PERMUTE + 1, &ctx->h2*(63^INDEX_PERMUTE));
+ for (i = 1; i < 64; i++)
+ block16_mulx_ghash(&ctx->h2*(i ^ INDEX_PERMUTE)+1, &ctx->h2*((i-1) ^ INDEX_PERMUTE)+1);
 }

_service:tar_scm:nettle-3.8.1.tar.gz/ghash-update.c -> _service:tar_scm:nettle-3.9.1.tar.gz/ghash-update.c Changed

@@ -44,7 +44,7 @@
 #include "ghash-internal.h"
 #include "block-internal.h"
 
-#if GCM_TABLE_BITS != 8
+#if GCM_TABLE_BITS < 7
 # error Unsupported table size.
 #endif
 
@@ -54,83 +54,26 @@
 _nettle_ghash_update_c (const struct gcm_key *ctx, union nettle_block16 *state,
 			size_t blocks, const uint8_t *data);
 #define _nettle_ghash_update _nettle_ghash_update_c
-
-#endif
-#if WORDS_BIGENDIAN
-# define W(left,right) (0x##left##right)
-#else
-# define W(left,right) (0x##right##left)
 #endif
 
-static const uint16_t
-shift_table0x100 = {
- W(00,00),W(01,c2),W(03,84),W(02,46),W(07,08),W(06,ca),W(04,8c),W(05,4e),
- W(0e,10),W(0f,d2),W(0d,94),W(0c,56),W(09,18),W(08,da),W(0a,9c),W(0b,5e),
- W(1c,20),W(1d,e2),W(1f,a4),W(1e,66),W(1b,28),W(1a,ea),W(18,ac),W(19,6e),
- W(12,30),W(13,f2),W(11,b4),W(10,76),W(15,38),W(14,fa),W(16,bc),W(17,7e),
- W(38,40),W(39,82),W(3b,c4),W(3a,06),W(3f,48),W(3e,8a),W(3c,cc),W(3d,0e),
- W(36,50),W(37,92),W(35,d4),W(34,16),W(31,58),W(30,9a),W(32,dc),W(33,1e),
- W(24,60),W(25,a2),W(27,e4),W(26,26),W(23,68),W(22,aa),W(20,ec),W(21,2e),
- W(2a,70),W(2b,b2),W(29,f4),W(28,36),W(2d,78),W(2c,ba),W(2e,fc),W(2f,3e),
- W(70,80),W(71,42),W(73,04),W(72,c6),W(77,88),W(76,4a),W(74,0c),W(75,ce),
- W(7e,90),W(7f,52),W(7d,14),W(7c,d6),W(79,98),W(78,5a),W(7a,1c),W(7b,de),
- W(6c,a0),W(6d,62),W(6f,24),W(6e,e6),W(6b,a8),W(6a,6a),W(68,2c),W(69,ee),
- W(62,b0),W(63,72),W(61,34),W(60,f6),W(65,b8),W(64,7a),W(66,3c),W(67,fe),
- W(48,c0),W(49,02),W(4b,44),W(4a,86),W(4f,c8),W(4e,0a),W(4c,4c),W(4d,8e),
- W(46,d0),W(47,12),W(45,54),W(44,96),W(41,d8),W(40,1a),W(42,5c),W(43,9e),
- W(54,e0),W(55,22),W(57,64),W(56,a6),W(53,e8),W(52,2a),W(50,6c),W(51,ae),
- W(5a,f0),W(5b,32),W(59,74),W(58,b6),W(5d,f8),W(5c,3a),W(5e,7c),W(5f,be),
- W(e1,00),W(e0,c2),W(e2,84),W(e3,46),W(e6,08),W(e7,ca),W(e5,8c),W(e4,4e),
- W(ef,10),W(ee,d2),W(ec,94),W(ed,56),W(e8,18),W(e9,da),W(eb,9c),W(ea,5e),
- W(fd,20),W(fc,e2),W(fe,a4),W(ff,66),W(fa,28),W(fb,ea),W(f9,ac),W(f8,6e),
- W(f3,30),W(f2,f2),W(f0,b4),W(f1,76),W(f4,38),W(f5,fa),W(f7,bc),W(f6,7e),
- W(d9,40),W(d8,82),W(da,c4),W(db,06),W(de,48),W(df,8a),W(dd,cc),W(dc,0e),
- W(d7,50),W(d6,92),W(d4,d4),W(d5,16),W(d0,58),W(d1,9a),W(d3,dc),W(d2,1e),
- W(c5,60),W(c4,a2),W(c6,e4),W(c7,26),W(c2,68),W(c3,aa),W(c1,ec),W(c0,2e),
- W(cb,70),W(ca,b2),W(c8,f4),W(c9,36),W(cc,78),W(cd,ba),W(cf,fc),W(ce,3e),
- W(91,80),W(90,42),W(92,04),W(93,c6),W(96,88),W(97,4a),W(95,0c),W(94,ce),
- W(9f,90),W(9e,52),W(9c,14),W(9d,d6),W(98,98),W(99,5a),W(9b,1c),W(9a,de),
- W(8d,a0),W(8c,62),W(8e,24),W(8f,e6),W(8a,a8),W(8b,6a),W(89,2c),W(88,ee),
- W(83,b0),W(82,72),W(80,34),W(81,f6),W(84,b8),W(85,7a),W(87,3c),W(86,fe),
- W(a9,c0),W(a8,02),W(aa,44),W(ab,86),W(ae,c8),W(af,0a),W(ad,4c),W(ac,8e),
- W(a7,d0),W(a6,12),W(a4,54),W(a5,96),W(a0,d8),W(a1,1a),W(a3,5c),W(a2,9e),
- W(b5,e0),W(b4,22),W(b6,64),W(b7,a6),W(b2,e8),W(b3,2a),W(b1,6c),W(b0,ae),
- W(bb,f0),W(ba,32),W(b8,74),W(b9,b6),W(bc,f8),W(bd,3a),W(bf,7c),W(be,be),
-};
-#undef W
-
-static void
-gcm_gf_shift_8(union nettle_block16 *x)
-{
- uint64_t reduce;
-
- /* Shift uses big-endian representation. */
-#if WORDS_BIGENDIAN
- reduce = shift_tablex->u641 & 0xff;
- x->u641 = (x->u641 >> 8) | ((x->u640 & 0xff) << 56);
- x->u640 = (x->u640 >> 8) ^ (reduce << 48);
-#else /* ! WORDS_BIGENDIAN */
- reduce = shift_table(x->u641 >> 56) & 0xff;
- x->u641 = (x->u641 << 8) | (x->u640 >> 56);
- x->u640 = (x->u640 << 8) ^ reduce;
-#endif /* ! WORDS_BIGENDIAN */
-}
-
 static void
 gcm_gf_mul (union nettle_block16 *x, const union nettle_block16 *table)
 {
- union nettle_block16 Z;
+ uint64_t x0 = x->u640;
+ uint64_t x1 = x->u641;
+ uint64_t r0 = 0;
+ uint64_t r1 = 0;
 unsigned i;
-
- Z = tablex->bGCM_BLOCK_SIZE-1;
-
- for (i = GCM_BLOCK_SIZE-2; i > 0; i--)
+ for (i = 0; i < 64; i++, x0 >>= 1, x1 >>= 1)
 {
- gcm_gf_shift_8(&Z);
- block16_xor(&Z, &tablex->bi);
+ uint64_t m0 = -(x0 & 1);
+ uint64_t m1 = -(x1 & 1);
+ r0 ^= m0 & table2*i.u640;
+ r1 ^= m0 & table2*i.u641;
+ r0 ^= m1 & table2*i+1.u640;
+ r1 ^= m1 & table2*i+1.u641;
 }
- gcm_gf_shift_8(&Z);
- block16_xor3(x, &Z, &tablex->b0);
+ x->u640 = r0; x->u641 = r1;
 }
 
 const uint8_t *

_service:tar_scm:nettle-3.8.1.tar.gz/gmp-glue.c -> _service:tar_scm:nettle-3.9.1.tar.gz/gmp-glue.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/gmp-glue.h -> _service:tar_scm:nettle-3.9.1.tar.gz/gmp-glue.h Changed

_service:tar_scm:nettle-3.8.1.tar.gz/hmac.c -> _service:tar_scm:nettle-3.9.1.tar.gz/hmac.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/install-sh -> _service:tar_scm:nettle-3.9.1.tar.gz/install-sh Changed

@@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2006-10-14.15
+scriptversion=2020-11-14.01; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -35,57 +35,62 @@
 # FSF changes to this file are in the public domain.
 #
 # Calling this script install-sh is preferred over install.sh, to prevent
-# `make' implicit rules from creating a file called install from it
+# 'make' implicit rules from creating a file called install from it
 # when there is no Makefile.
 #
 # This script is compatible with the BSD install script, but was written
 # from scratch.
 
+tab='	'
 nl='
 '
-IFS=" ""	$nl"
+IFS=" $tab$nl"
 
-# set DOITPROG to echo to test this script
+# Set DOITPROG to "echo" to test this script.
 
-# Don't use :- since 4.3BSD and earlier shells don't like it.
-doit="${DOITPROG-}"
-if test -z "$doit"; then
-  doit_exec=exec
-else
-  doit_exec=$doit
-fi
+doit=${DOITPROG-}
+doit_exec=${doit:-exec}
 
 # Put in absolute file names if you don't have them in your path;
 # or use environment vars.
 
-mvprog="${MVPROG-mv}"
-cpprog="${CPPROG-cp}"
-chmodprog="${CHMODPROG-chmod}"
-chownprog="${CHOWNPROG-chown}"
-chgrpprog="${CHGRPPROG-chgrp}"
-stripprog="${STRIPPROG-strip}"
-rmprog="${RMPROG-rm}"
-mkdirprog="${MKDIRPROG-mkdir}"
+chgrpprog=${CHGRPPROG-chgrp}
+chmodprog=${CHMODPROG-chmod}
+chownprog=${CHOWNPROG-chown}
+cmpprog=${CMPPROG-cmp}
+cpprog=${CPPROG-cp}
+mkdirprog=${MKDIRPROG-mkdir}
+mvprog=${MVPROG-mv}
+rmprog=${RMPROG-rm}
+stripprog=${STRIPPROG-strip}
 
-posix_glob=
 posix_mkdir=
 
 # Desired mode of installed file.
 mode=0755
 
+# Create dirs (including intermediate dirs) using mode 755.
+# This is like GNU 'install' as of coreutils 8.32 (2020).
+mkdir_umask=22
+
+backupsuffix=
+chgrpcmd=
 chmodcmd=$chmodprog
 chowncmd=
-chgrpcmd=
-stripcmd=
+mvcmd=$mvprog
 rmcmd="$rmprog -f"
-mvcmd="$mvprog"
+stripcmd=
+
 src=
 dst=
 dir_arg=
-dstarg=
-no_target_directory=
+dst_arg=
+
+copy_on_change=false
+is_target_a_directory=possibly
 
-usage="Usage: $0 OPTION... -T SRCFILE DSTFILE
+usage="\
+Usage: $0 OPTION... -T SRCFILE DSTFILE
    or: $0 OPTION... SRCFILES... DIRECTORY
    or: $0 OPTION... -t DIRECTORY SRCFILES...
    or: $0 OPTION... -d DIRECTORIES...
@@ -95,91 +100,116 @@
 In the 4th, create DIRECTORIES.
 
 Options:
--c         (ignored)
--d         create directories instead of installing files.
--g GROUP   $chgrpprog installed files to GROUP.
--m MODE    $chmodprog installed files to MODE.
--o USER    $chownprog installed files to USER.
--s         $stripprog installed files.
--t DIRECTORY  install into DIRECTORY.
--T         report an error if DSTFILE is a directory.
---help     display this help and exit.
---version  display version info and exit.
+     --help     display this help and exit.
+     --version  display version info and exit.
+
+  -c            (ignored)
+  -C            install only if different (preserve data modification time)
+  -d            create directories instead of installing files.
+  -g GROUP      $chgrpprog installed files to GROUP.
+  -m MODE       $chmodprog installed files to MODE.
+  -o USER       $chownprog installed files to USER.
+  -p            pass -p to $cpprog.
+  -s            $stripprog installed files.
+  -S SUFFIX     attempt to back up existing files, with suffix SUFFIX.
+  -t DIRECTORY  install into DIRECTORY.
+  -T            report an error if DSTFILE is a directory.
 
 Environment variables override the default commands:
-  CHGRPPROG CHMODPROG CHOWNPROG CPPROG MKDIRPROG MVPROG RMPROG STRIPPROG
+  CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG
+  RMPROG STRIPPROG
+
+By default, rm is invoked with -f; when overridden with RMPROG,
+it's up to you to specify -f if you want it.
+
+If -S is not specified, no backups are attempted.
+
+Email bug reports to bug-automake@gnu.org.
+Automake home page: https://www.gnu.org/software/automake/
 "
 
 while test $# -ne 0; do
   case $1 in
-    -c) shift
-        continue;;
+    -c) ;;
+
+    -C) copy_on_change=true;;
 
-    -d) dir_arg=true
-        shift
-        continue;;
+    -d) dir_arg=true;;
 
     -g) chgrpcmd="$chgrpprog $2"
-        shift
-        shift
-        continue;;
+        shift;;
 
     --help) echo "$usage"; exit $?;;
 
     -m) mode=$2
-        shift
-        shift
-	case $mode in
-	  *' '* | *'	'* | *'
-'*	  | *'*'* | *'?'* | *''*)
-	    echo "$0: invalid mode: $mode" >&2
-	    exit 1;;
-	esac
-        continue;;
+        case $mode in
+          *' '* | *"$tab"* | *"$nl"* | *'*'* | *'?'* | *''*)
+            echo "$0: invalid mode: $mode" >&2
+            exit 1;;
+        esac
+        shift;;
 
     -o) chowncmd="$chownprog $2"
-        shift
-        shift
-        continue;;
+        shift;;
 
-    -s) stripcmd=$stripprog
-        shift
-        continue;;
+    -p) cpprog="$cpprog -p";;
 
-    -t) dstarg=$2
-	shift
-	shift
-	continue;;
+    -s) stripcmd=$stripprog;;
 
-    -T) no_target_directory=true
-	shift
-	continue;;
+    -S) backupsuffix="$2"
+        shift;;

_service:tar_scm:nettle-3.9.1.tar.gz/md-internal.h Added

@@ -0,0 +1,70 @@
+/* md-internal.h
+
+ Copyright (C) 2001, 2010, 2022 Niels Möller
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#ifndef NETTLE_MD_INTERNAL_H_INCLUDED
+#define NETTLE_MD_INTERNAL_H_INCLUDED
+
+#include <string.h>
+
+/* Internal helper macros for Merkle-Damgård hash functions. Assumes the context
+ structs includes the following fields:
+
+ uint8_t block...;		// Buffer holding one block
+ unsigned int index;		// Index into block
+*/
+
+#define MD_FILL_OR_RETURN(ctx, length, data)			\
+ do {								\
+ unsigned __md_left = sizeof((ctx)->block) - (ctx)->index;	\
+ if ((length) < __md_left)					\
+ {								\
+	memcpy((ctx)->block + (ctx)->index, (data), (length));	\
+	(ctx)->index += (length);				\
+	return;							\
+ }								\
+ memcpy((ctx)->block + (ctx)->index, (data), __md_left);	\
+ (data) += __md_left;					\
+ (length) -= __md_left;					\
+ } while(0)
+
+#define MD_FILL_OR_RETURN_INDEX(block_size, block, index, length, data)	\
+ do {									\
+ unsigned __md_left = (block_size) - (index);			\
+ if ((length) < __md_left)						\
+ {									\
+	memcpy(block + (index), (data), (length));			\
+	return (index) + (length);					\
+ }									\
+ memcpy((block) + (index), (data), __md_left);			\
+ (data) += __md_left;						\
+ (length) -= __md_left;						\
+ } while(0)
+#endif /* NETTLE_MD_INTERNAL_H_INCLUDED */

_service:tar_scm:nettle-3.8.1.tar.gz/md5.h -> _service:tar_scm:nettle-3.9.1.tar.gz/md5.h Changed

_service:tar_scm:nettle-3.8.1.tar.gz/nettle-internal.c -> _service:tar_scm:nettle-3.9.1.tar.gz/nettle-internal.c Changed

@@ -248,3 +248,63 @@
   NULL,
   NULL,
 };
+
+static void
+ocb_aes128_set_encrypt_key_wrapper (struct ocb_aes128_ctx *ctx, const uint8_t *key)
+{
+  ocb_aes128_set_encrypt_key(&ctx->key, key);
+}
+
+static void
+ocb_aes128_set_decrypt_key_wrapper (struct ocb_aes128_ctx *ctx, const uint8_t *key)
+{
+  ocb_aes128_set_decrypt_key(&ctx->key, &ctx->decrypt, key);
+}
+
+static void
+ocb_aes128_set_nonce_wrapper (struct ocb_aes128_ctx *ctx, const uint8_t *nonce)
+{
+  ocb_aes128_set_nonce (&ctx->ocb, &ctx->key,
+			OCB_DIGEST_SIZE, OCB_NONCE_SIZE, nonce);
+}
+
+static void
+ocb_aes128_update_wrapper (struct ocb_aes128_ctx *ctx,
+			   size_t length, const uint8_t *data)
+{
+  ocb_aes128_update (&ctx->ocb, &ctx->key, length, data);
+}
+
+static void
+ocb_aes128_encrypt_wrapper (struct ocb_aes128_ctx *ctx,
+			    size_t length, uint8_t *dst, const uint8_t *src)
+{
+  ocb_aes128_encrypt (&ctx->ocb, &ctx->key, length, dst, src);
+}
+
+static void
+ocb_aes128_decrypt_wrapper (struct ocb_aes128_ctx *ctx,
+			    size_t length, uint8_t *dst, const uint8_t *src)
+{
+  ocb_aes128_decrypt (&ctx->ocb, &ctx->key, &ctx->decrypt, length, dst, src);
+}
+
+static void
+ocb_aes128_digest_wrapper (struct ocb_aes128_ctx *ctx, size_t length, uint8_t *digest)
+{
+  ocb_aes128_digest (&ctx->ocb, &ctx->key, length, digest);
+}
+
+const struct nettle_aead
+nettle_ocb_aes128 =
+  { "ocb_aes128", sizeof(struct ocb_aes128_ctx),
+    OCB_BLOCK_SIZE, AES128_KEY_SIZE,
+    OCB_NONCE_SIZE, OCB_DIGEST_SIZE,
+    (nettle_set_key_func *) ocb_aes128_set_encrypt_key_wrapper,
+    (nettle_set_key_func *) ocb_aes128_set_decrypt_key_wrapper,
+    (nettle_set_key_func *) ocb_aes128_set_nonce_wrapper,
+    (nettle_hash_update_func *) ocb_aes128_update_wrapper,
+    (nettle_crypt_func *) ocb_aes128_encrypt_wrapper,
+    (nettle_crypt_func *) ocb_aes128_decrypt_wrapper,
+    (nettle_hash_digest_func *) ocb_aes128_digest_wrapper
+  };

_service:tar_scm:nettle-3.8.1.tar.gz/nettle-internal.h -> _service:tar_scm:nettle-3.9.1.tar.gz/nettle-internal.h Changed

@@ -36,8 +36,12 @@
 #define NETTLE_INTERNAL_H_INCLUDED
 
 #include <assert.h>
+/* Needed for alloca on bsd systems. */
+#include <stdlib.h>
 
 #include "nettle-meta.h"
+#include "ocb.h"
+#include "aes.h"
 
 /* For definition of NETTLE_MAX_HASH_CONTEXT_SIZE. */
 #include "sha3.h"
@@ -72,12 +76,13 @@
 do { assert((size_t)(size) <= (sizeof(name))); } while (0)
 #endif 
 
-/* Arbitrary limits which apply to systems that don't have alloca */
-#define NETTLE_MAX_HASH_BLOCK_SIZE 128
+/* Limits that apply to systems that don't have alloca */
+#define NETTLE_MAX_HASH_BLOCK_SIZE 144 /* For sha3_224*/
 #define NETTLE_MAX_HASH_DIGEST_SIZE 64
 #define NETTLE_MAX_HASH_CONTEXT_SIZE (sizeof(struct sha3_224_ctx))
 #define NETTLE_MAX_SEXP_ASSOC 17
 #define NETTLE_MAX_CIPHER_BLOCK_SIZE 32
+#define NETTLE_MAX_CIPHER_KEY_SIZE 32
 
 /* Doesn't quite fit with the other algorithms, because of the weak
 * keys. Weak keys are not reported, the functions will simply crash
@@ -124,4 +129,17 @@
 
 extern const struct nettle_hash * const _nettle_hashes;
 
+/* OCB-declarations to be moved to a public header file, once it's
+ settled which nonce and tag sizes to use. */
+#define OCB_NONCE_SIZE 12
+
+struct ocb_aes128_ctx
+{
+ struct ocb_ctx ocb;
+ struct ocb_aes128_encrypt_key key;
+ struct aes128_ctx decrypt;
+};
+
+extern const struct nettle_aead nettle_ocb_aes128;
+
 #endif /* NETTLE_INTERNAL_H_INCLUDED */

_service:tar_scm:nettle-3.8.1.tar.gz/nettle-meta-aeads.c -> _service:tar_scm:nettle-3.9.1.tar.gz/nettle-meta-aeads.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/nettle-meta-ciphers.c -> _service:tar_scm:nettle-3.9.1.tar.gz/nettle-meta-ciphers.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/nettle-meta.h -> _service:tar_scm:nettle-3.9.1.tar.gz/nettle-meta.h Changed

_service:tar_scm:nettle-3.8.1.tar.gz/nettle.html -> _service:tar_scm:nettle-3.9.1.tar.gz/nettle.html Changed

@@ -1,9 +1,9 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <html>
-<!-- This manual is for the Nettle library (version 3.4), a
+<!-- This manual is for the Nettle library (version 3.9), a
 low-level cryptographic library.
 
-Originally written 2001 by Niels Möller, updated 2017.
+Originally written 2001 by Niels Möller, updated 2023.
 
 This manual is placed in the public domain. You may freely copy it, in
 whole or in part, with or without modification. Attribution is
@@ -112,8 +112,9 @@
 <li><a id="toc-DES3-1" href="#DES3">7.2.9 DES3</a></li>
 <li><a id="toc-Salsa20-1" href="#Salsa20">7.2.10 Salsa20</a></li>
 <li><a id="toc-Serpent-1" href="#Serpent">7.2.11 Serpent</a></li>
- <li><a id="toc-Twofish-1" href="#Twofish">7.2.12 Twofish</a></li>
- <li><a id="toc-The-struct-nettle_005fcipher-abstraction" href="#nettle_005fcipher-abstraction">7.2.13 The <code>struct nettle_cipher</code> abstraction</a></li>
+ <li><a id="toc-SM4-1" href="#SM4">7.2.12 SM4</a></li>
+ <li><a id="toc-Twofish-1" href="#Twofish">7.2.13 Twofish</a></li>
+ <li><a id="toc-The-struct-nettle_005fcipher-abstraction" href="#nettle_005fcipher-abstraction">7.2.14 The <code>struct nettle_cipher</code> abstraction</a></li>
 </ul></li>
 <li><a id="toc-Cipher-modes-1" href="#Cipher-modes">7.3 Cipher modes</a>
 <ul class="no-bullet">
@@ -144,6 +145,7 @@
 <li><a id="toc-GCM-helper-macros" href="#GCM-helper-macros">7.4.2.2 <acronym>GCM</acronym> helper macros</a></li>
 <li><a id="toc-GCM_002dAES-interface" href="#GCM_002dAES-interface">7.4.2.3 <acronym>GCM</acronym>-<acronym>AES</acronym> interface</a></li>
 <li><a id="toc-GCM_002dCamellia-interface" href="#GCM_002dCamellia-interface">7.4.2.4 <acronym>GCM</acronym>-Camellia interface</a></li>
+ <li><a id="toc-GCM_002dSM4-interface" href="#GCM_002dSM4-interface">7.4.2.5 <acronym>GCM</acronym>-SM4 interface</a></li>
 </ul></li>
 <li><a id="toc-Counter-with-CBC_002dMAC-mode" href="#CCM">7.4.3 Counter with CBC-MAC mode</a>
 <ul class="no-bullet">
@@ -152,12 +154,22 @@
 <li><a id="toc-CCM_002dAES-interface" href="#CCM_002dAES-interface">7.4.3.3 <acronym>CCM</acronym>-<acronym>AES</acronym> interface</a></li>
 </ul></li>
 <li><a id="toc-ChaCha_002dPoly1305-1" href="#ChaCha_002dPoly1305">7.4.4 ChaCha-Poly1305</a></li>
- <li><a id="toc-Synthetic-Initialization-Vector-AEAD" href="#SIV_002dCMAC">7.4.5 Synthetic Initialization Vector AEAD</a>
+ <li><a id="toc-OCB-_0028Offset-Code-Book_0029-Mode" href="#OCB">7.4.5 <acronym>OCB</acronym> (Offset Code Book) Mode</a>
 <ul class="no-bullet">
 <li><a id="toc-General-interface" href="#General-interface">7.4.5.1 General interface</a></li>
- <li><a id="toc-SIV_002dCMAC_002dAES-interface" href="#SIV_002dCMAC_002dAES-interface">7.4.5.2 <acronym>SIV-CMAC</acronym>-<acronym>AES</acronym> interface</a></li>
+ <li><a id="toc-OCB_002dAES-interface" href="#OCB_002dAES-interface">7.4.5.2 <acronym>OCB-AES</acronym> interface</a></li>
 </ul></li>
- <li><a id="toc-The-struct-nettle_005faead-abstraction" href="#nettle_005faead-abstraction">7.4.6 The <code>struct nettle_aead</code> abstraction</a></li>
+ <li><a id="toc-Synthetic-Initialization-Vector-AEAD" href="#SIV_002dCMAC">7.4.6 Synthetic Initialization Vector AEAD</a>
+ <ul class="no-bullet">
+ <li><a id="toc-General-interface-1" href="#General-interface-1">7.4.6.1 General interface</a></li>
+ <li><a id="toc-SIV_002dCMAC_002dAES-interface" href="#SIV_002dCMAC_002dAES-interface">7.4.6.2 <acronym>SIV-CMAC</acronym>-<acronym>AES</acronym> interface</a></li>
+ </ul></li>
+ <li><a id="toc-SIV_002dGCM-1" href="#SIV_002dGCM">7.4.7 SIV-GCM</a>
+ <ul class="no-bullet">
+ <li><a id="toc-General-interface-2" href="#General-interface-2">7.4.7.1 General interface</a></li>
+ <li><a id="toc-SIV_002dGCM_002dAES-interface" href="#SIV_002dGCM_002dAES-interface">7.4.7.2 <acronym>SIV-GCM</acronym>-<acronym>AES</acronym> interface</a></li>
+ </ul></li>
+ <li><a id="toc-The-struct-nettle_005faead-abstraction" href="#nettle_005faead-abstraction">7.4.8 The <code>struct nettle_aead</code> abstraction</a></li>
 </ul></li>
 <li><a id="toc-Keyed-Hash-Functions" href="#Keyed-hash-functions">7.5 Keyed Hash Functions</a>
 <ul class="no-bullet">
@@ -185,6 +197,14 @@
 <li><a id="toc-PBKDF2_002dHMAC_002dSHA384" href="#PBKDF2_002dHMAC_002dSHA384">7.6.3.3 <acronym>PBKDF2-HMAC-SHA384</acronym></a></li>
 <li><a id="toc-PBKDF2_002dHMAC_002dSHA512" href="#PBKDF2_002dHMAC_002dSHA512">7.6.3.4 <acronym>PBKDF2-HMAC-SHA512</acronym></a></li>
 </ul></li>
+ <li><a id="toc-BALLOON" href="#BALLOON">7.6.4 <acronym>BALLOON</acronym></a></li>
+ <li><a id="toc-Concrete-BALLOON-functions" href="#Concrete-BALLOON-functions">7.6.5 Concrete <acronym>BALLOON</acronym> functions</a>
+ <ul class="no-bullet">
+ <li><a id="toc-BALLOON_002dSHA1" href="#BALLOON_002dSHA1">7.6.5.1 <acronym>BALLOON-SHA1</acronym></a></li>
+ <li><a id="toc-BALLOON_002dSHA256" href="#BALLOON_002dSHA256">7.6.5.2 <acronym>BALLOON-SHA256</acronym></a></li>
+ <li><a id="toc-BALLOON_002dSHA384" href="#BALLOON_002dSHA384">7.6.5.3 <acronym>BALLOON-SHA384</acronym></a></li>
+ <li><a id="toc-BALLOON_002dSHA512" href="#BALLOON_002dSHA512">7.6.5.4 <acronym>BALLOON-SHA512</acronym></a></li>
+ </ul></li>
 </ul></li>
 <li><a id="toc-Public_002dkey-algorithms-1" href="#Public_002dkey-algorithms">7.7 Public-key algorithms</a>
 <ul class="no-bullet">
@@ -231,10 +251,10 @@
 can use the library directly from your C programs, or write or use an
 object-oriented wrapper for your favorite language or application.
 
-This manual is for the Nettle library (version 3.4), a
+This manual is for the Nettle library (version 3.9), a
 low-level cryptographic library.
 
-Originally written 2001 by Niels Möller, updated 2017.
+Originally written 2001 by Niels Möller, updated 2023.
 
 <blockquote>
 This manual is placed in the public domain. You may freely copy it, in
@@ -329,6 +349,8 @@
 </td></tr>
 <tr><td align="left" valign="top">&bull; <a href="#Serpent">Serpent</a></td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 </td></tr>
+<tr><td align="left" valign="top">&bull; <a href="#SM4">SM4</a></td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
+</td></tr>
 <tr><td align="left" valign="top">&bull; <a href="#Twofish">Twofish</a></td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 </td></tr>
 <tr><td align="left" valign="top">&bull; <a href="#nettle_005fcipher-abstraction">nettle_cipher abstraction</a></td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
@@ -357,8 +379,12 @@
 </td></tr>
 <tr><td align="left" valign="top">&bull; <a href="#ChaCha_002dPoly1305">ChaCha-Poly1305</a></td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 </td></tr>
+<tr><td align="left" valign="top">&bull; <a href="#OCB">OCB</a></td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
+</td></tr>
 <tr><td align="left" valign="top">&bull; <a href="#SIV_002dCMAC">SIV-CMAC</a></td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 </td></tr>
+<tr><td align="left" valign="top">&bull; <a href="#SIV_002dGCM">SIV-GCM</a></td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
+</td></tr>
 <tr><td align="left" valign="top">&bull; <a href="#nettle_005faead-abstraction">nettle_aead abstraction</a></td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 </td></tr>
 <tr><th colspan="3" align="left" valign="top"><pre class="menu-comment">
@@ -790,6 +816,15 @@
 <code>sha256_init</code>.
 </dd></dl>
 
+<dl>
+<dt id="index-sha256_005fcompress">Function: void sha256_compress (const uint32_t *<var>state</var>, uint8_t *<var>input</var>)</dt>
+<dd>Perform a raw SHA256 compress on SHA256_BLOCK_SIZE bytes from<var>input</var>
+using <var>state</var> as IV (an array of 8 uint32_t). The output is stored in <var>state</var>.
+This function provides access to the underlying compression function,
+for the rare applications that need that (e.g., using different IV from
+standard SHA256).
+</dd></dl>
+
 Earlier versions of nettle defined SHA256 in the header file
 <samp>&lt;nettle/sha.h&gt;</samp>, which is now deprecated, but kept for
 compatibility.
@@ -882,6 +917,15 @@
 <code>sha512_init</code>.
 </dd></dl>
 
+<dl>
+<dt id="index-sha512_005fcompress">Function: void sha512_compress (const uint64_t *<var>state</var>, uint8_t *<var>input</var>)</dt>
+<dd>Perform a raw SHA512 compress on SHA512_BLOCK_SIZE bytes from
+<var>input</var> using <var>state</var> as IV (an array of 8 uint64_t). The output is stored in <var>state</var>.
+This function provides access to the underlying compression function,
+for the rare applications that need that (e.g., using different IV from
+standard SHA512).
+</dd></dl>
+
 <h4 class="subsubsection">7.1.1.4 <acronym>SHA384 and other variants of SHA512</acronym></h4>
 
 Several variants of SHA512 have been defined, with a different initial
@@ -1353,6 +1397,15 @@
 <code>md5_init</code>.
 </dd></dl>
 
+<dl>
+<dt id="index-md5_005fcompress">Function: void md5_compress (const uint32_t *<var>state</var>, uint8_t *<var>input</var>)</dt>
+<dd>Perform a raw MD5 compress on MD5_BLOCK_SIZE bytes from <var>input</var>
+using <var>state</var> as IV (an array of 4 uint32_t). The output is stored in <var>state</var>.
+This function provides access to the underlying compression function,
+for the rare applications that need that (e.g., using different IV from
+standard MD5).
+</dd></dl>
+
 The normal way to use MD5 is to call the functions in order: First
 <code>md5_init</code>, then <code>md5_update</code> zero or more times, and finally
 <code>md5_digest</code>. After <code>md5_digest</code>, the context is reset to
@@ -1531,6 +1584,14 @@
 <code>sha1_init</code>.
 </dd></dl>
 
+<dl>
+<dt id="index-sha1_005fcompress">Function: void sha1_compress (const uint32_t *<var>state</var>, uint8_t *<var>input</var>)</dt>
+<dd>Perform a raw SHA1 compress on SHA1_BLOCK_SIZE bytes from <var>input</var>
+using <var>state</var> as IV (an array of 5 uint32_t). The output is stored in <var>state</var>.
+This function provides access to the underlying compression function,
+for the rare applications that need that (e.g., using different IV from
+standard SHA1).
+</dd></dl>
 
 <h4 class="subsubsection">7.1.3.6 <acronym>GOSTHASH94 and GOSTHASH94CP</acronym></h4>
 
@@ -1772,6 +1833,8 @@
 </td></tr>
 <tr><td align="left" valign="top">&bull; <a href="#Serpent">Serpent</a></td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 </td></tr>
+<tr><td align="left" valign="top">&bull; <a href="#SM4">SM4</a></td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
+</td></tr>
 <tr><td align="left" valign="top">&bull; <a href="#Twofish">Twofish</a></td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 </td></tr>
 <tr><td align="left" valign="top">&bull; <a href="#nettle_005fcipher-abstraction">nettle_cipher abstraction</a></td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
@@ -1883,15 +1946,23 @@
 
 
 
-ARCFOUR is a stream cipher, also known under the trade marked name RC4,
-and it is one of the fastest ciphers around. A problem is that the key
-setup of ARCFOUR is quite weak, you should never use keys with
-structure, keys that are ordinary passwords, or sequences of keys like
-&ldquo;secret:1&rdquo;, &ldquo;secret:2&rdquo;, .... If you have keys that don&rsquo;t look
-like random bit strings, and you want to use ARCFOUR, always hash the
-key before feeding it to ARCFOUR. Furthermore, the initial bytes of the
-generated key stream leak information about the key; for this reason, it
-is recommended to discard the first 512 bytes of the key stream.
+ARCFOUR is a historic stream cipher, also known under the trade marked
+name RC4, and was a widely used fast stream cipher.
+
+We do not recommend the use of ARCFOUR; the Nettle implementation is
+provided primarily for interoperability with existing applications and
+standards.
+

_service:tar_scm:nettle-3.8.1.tar.gz/nettle.info -> _service:tar_scm:nettle-3.9.1.tar.gz/nettle.info Changed

@@ -1,10 +1,10 @@
 This is nettle.info, produced by makeinfo version 6.7 from
 nettle.texinfo.
 
-This manual is for the Nettle library (version 3.4), a low-level
+This manual is for the Nettle library (version 3.9), a low-level
 cryptographic library.
 
- Originally written 2001 by Niels Möller, updated 2017.
+ Originally written 2001 by Niels Möller, updated 2023.
 
 This manual is placed in the public domain. You may freely copy
 it, in whole or in part, with or without modification. Attribution
@@ -24,10 +24,10 @@
 can use the library directly from your C programs, or write or use an
 object-oriented wrapper for your favorite language or application.
 
- This manual is for the Nettle library (version 3.4), a low-level
+ This manual is for the Nettle library (version 3.9), a low-level
 cryptographic library.
 
- Originally written 2001 by Niels Möller, updated 2017.
+ Originally written 2001 by Niels Möller, updated 2023.
 
 This manual is placed in the public domain. You may freely copy
 it, in whole or in part, with or without modification. Attribution
@@ -82,6 +82,7 @@
 * DES3::
 * Salsa20::
 * Serpent::
+* SM4::
 * Twofish::
 * nettle_cipher abstraction::
 
@@ -98,7 +99,9 @@
 * GCM::
 * CCM::
 * ChaCha-Poly1305::
+* OCB::
 * SIV-CMAC::
+* SIV-GCM::
 * nettle_aead abstraction::
 
 Keyed Hash Functions
@@ -460,6 +463,14 @@
 This function also resets the context in the same way as
 ‘sha256_init’.
 
+ -- Function: void sha256_compress (const uint32_t *STATE, uint8_t
+ *INPUT)
+ Perform a raw SHA256 compress on SHA256_BLOCK_SIZE bytes fromINPUT
+ using STATE as IV (an array of 8 uint32_t). The output is stored
+ in STATE. This function provides access to the underlying
+ compression function, for the rare applications that need that
+ (e.g., using different IV from standard SHA256).
+
 Earlier versions of nettle defined SHA256 in the header file
 ‘<nettle/sha.h>’, which is now deprecated, but kept for compatibility.
 
@@ -531,6 +542,14 @@
 This function also resets the context in the same way as
 ‘sha512_init’.
 
+ -- Function: void sha512_compress (const uint64_t *STATE, uint8_t
+ *INPUT)
+ Perform a raw SHA512 compress on SHA512_BLOCK_SIZE bytes from INPUT
+ using STATE as IV (an array of 8 uint64_t). The output is stored
+ in STATE. This function provides access to the underlying
+ compression function, for the rare applications that need that
+ (e.g., using different IV from standard SHA512).
+
 7.1.1.4 SHA384 and other variants of SHA512
 ...........................................
 
@@ -920,6 +939,13 @@
 This function also resets the context in the same way as
 ‘md5_init’.
 
+ -- Function: void md5_compress (const uint32_t *STATE, uint8_t *INPUT)
+ Perform a raw MD5 compress on MD5_BLOCK_SIZE bytes from INPUT using
+ STATE as IV (an array of 4 uint32_t). The output is stored in
+ STATE. This function provides access to the underlying compression
+ function, for the rare applications that need that (e.g., using
+ different IV from standard MD5).
+
 The normal way to use MD5 is to call the functions in order: First
 ‘md5_init’, then ‘md5_update’ zero or more times, and finally
 ‘md5_digest’. After ‘md5_digest’, the context is reset to its initial
@@ -1058,6 +1084,13 @@
 This function also resets the context in the same way as
 ‘sha1_init’.
 
+ -- Function: void sha1_compress (const uint32_t *STATE, uint8_t *INPUT)
+ Perform a raw SHA1 compress on SHA1_BLOCK_SIZE bytes from INPUT
+ using STATE as IV (an array of 5 uint32_t). The output is stored
+ in STATE. This function provides access to the underlying
+ compression function, for the rare applications that need that
+ (e.g., using different IV from standard SHA1).
+
 7.1.3.6 GOSTHASH94 and GOSTHASH94CP
 ...................................
 
@@ -1255,6 +1288,7 @@
 * DES3::
 * Salsa20::
 * Serpent::
+* SM4::
 * Twofish::
 * nettle_cipher abstraction::
 
@@ -1360,15 +1394,23 @@
 7.2.2 Arcfour
 -------------
 
-ARCFOUR is a stream cipher, also known under the trade marked name RC4,
-and it is one of the fastest ciphers around. A problem is that the key
-setup of ARCFOUR is quite weak, you should never use keys with
-structure, keys that are ordinary passwords, or sequences of keys like
-“secret:1”, “secret:2”, .... If you have keys that don’t look like
-random bit strings, and you want to use ARCFOUR, always hash the key
-before feeding it to ARCFOUR. Furthermore, the initial bytes of the
-generated key stream leak information about the key; for this reason, it
-is recommended to discard the first 512 bytes of the key stream.
+ARCFOUR is a historic stream cipher, also known under the trade marked
+name RC4, and was a widely used fast stream cipher.
+
+ We do not recommend the use of ARCFOUR; the Nettle implementation is
+provided primarily for interoperability with existing applications and
+standards.
+
+ One problem is that the key setup of ARCFOUR is quite weak, you
+should never use keys with structure, keys that are ordinary passwords,
+or sequences of keys like “secret:1”, “secret:2”, .... If you have keys
+that don’t look like random bit strings, and you want to use ARCFOUR,
+always hash the key before feeding it to ARCFOUR.
+
+ Another problem is that the output is distinguishable from random
+data, and that the initial bytes of the generated key stream leak
+information about the key; for this reason, it was sometimes recommended
+to discard the first 512, 768 or 1024 bytes of the key stream.
 
 /* A more robust key setup function for ARCFOUR */
 void
@@ -2030,7 +2072,7 @@
 to 12 rounds.
 
 &#x1f;
-File: nettle.info, Node: Serpent, Next: Twofish, Prev: Salsa20, Up: Cipher functions
+File: nettle.info, Node: Serpent, Next: SM4, Prev: Salsa20, Up: Cipher functions
 
 7.2.11 Serpent
 --------------
@@ -2072,9 +2114,44 @@
 Analogous to ‘serpent_encrypt’
 
 &#x1f;
-File: nettle.info, Node: Twofish, Next: nettle_cipher abstraction, Prev: Serpent, Up: Cipher functions
+File: nettle.info, Node: SM4, Next: Twofish, Prev: Serpent, Up: Cipher functions
+
+7.2.12 SM4
+----------
+
+SM4 is a block cipher standard adopted by the government of the People’s
+Republic of China, and it was issued by the State Cryptography
+Administration on March 21, 2012. The standard is GM/T 0002-2012 "SM4
+block cipher algorithm". Nettle defines it in ‘<nettle/sm4.h>’.
+
+ -- Context struct: struct sm4_ctx
+
+ -- Constant: SM4_BLOCK_SIZE
+ The SM4 block-size, 16.
+
+ -- Constant: SM4_KEY_SIZE
+ Default SM4 key size, 16.
+
+ -- Function: void sm4_set_encrypt_key (struct sm4_ctx *CTX, const
+ uint8_t *KEY)
+ Initialize the cipher. The function is used for encryption.
+
+ -- Function: void sm4_set_decrypt_key (struct sm4_ctx *CTX, const
+ uint8_t *KEY)
+ Initialize the cipher. The function is used for decryption.
+
+ -- Function: void sm4_crypt (const struct sm4_ctx *CTX, size_t LENGTH,
+ uint8_t *DST, const uint8_t *SRC)
+ Cryption function. LENGTH must be an integral multiple of the
+ block size. If it is more than one block, the data is processed in
+ ECB mode. ‘src’ and ‘dst’ may be equal, but they must not overlap
+ in any other way. The same function is used for both encryption
+ and decryption.
+
+&#x1f;
+File: nettle.info, Node: Twofish, Next: nettle_cipher abstraction, Prev: SM4, Up: Cipher functions
 
-7.2.12 Twofish
+7.2.13 Twofish
 --------------
 
 Another AES finalist, this one designed by Bruce Schneier and others.
@@ -2113,7 +2190,7 @@

_service:tar_scm:nettle-3.8.1.tar.gz/nettle.pdf -> _service:tar_scm:nettle-3.9.1.tar.gz/nettle.pdf Changed

_service:tar_scm:nettle-3.8.1.tar.gz/nettle.texinfo -> _service:tar_scm:nettle-3.9.1.tar.gz/nettle.texinfo Changed

@@ -8,14 +8,14 @@
 @syncodeindex tp cp
 @c %**end of header
 
-@set UPDATED-FOR 3.4
+@set UPDATED-FOR 3.9
 @set AUTHOR Niels Möller
 
 @copying
 This manual is for the Nettle library (version @value{UPDATED-FOR}), a
 low-level cryptographic library.
 
-Originally written 2001 by @value{AUTHOR}, updated 2017.
+Originally written 2001 by @value{AUTHOR}, updated 2023.
 
 @quotation
 This manual is placed in the public domain. You may freely copy it, in
@@ -105,6 +105,7 @@
 * DES3::
 * Salsa20::
 * Serpent::
+* SM4::
 * Twofish::
 * nettle_cipher abstraction::
 
@@ -121,7 +122,9 @@
 * GCM::
 * CCM::
 * ChaCha-Poly1305::
+* OCB::
 * SIV-CMAC::
+* SIV-GCM::
 * nettle_aead abstraction::
 
 Keyed Hash Functions
@@ -442,6 +445,14 @@
 @code{sha256_init}.
 @end deftypefun
 
+@deftypefun void sha256_compress (const uint32_t *@var{state}, uint8_t *@var{input})
+Perform a raw SHA256 compress on SHA256_BLOCK_SIZE bytes from@var{input}
+using @var{state} as IV (an array of 8 uint32_t). The output is stored in @var{state}.
+This function provides access to the underlying compression function,
+for the rare applications that need that (e.g., using different IV from
+standard SHA256).
+@end deftypefun
+
 Earlier versions of nettle defined SHA256 in the header file
 @file{<nettle/sha.h>}, which is now deprecated, but kept for
 compatibility.
@@ -522,6 +533,14 @@
 @code{sha512_init}.
 @end deftypefun
 
+@deftypefun void sha512_compress (const uint64_t *@var{state}, uint8_t *@var{input})
+Perform a raw SHA512 compress on SHA512_BLOCK_SIZE bytes from
+@var{input} using @var{state} as IV (an array of 8 uint64_t). The output is stored in @var{state}.
+This function provides access to the underlying compression function,
+for the rare applications that need that (e.g., using different IV from
+standard SHA512).
+@end deftypefun
+
 @subsubsection @acronym{SHA384 and other variants of SHA512}
 
 Several variants of SHA512 have been defined, with a different initial
@@ -929,6 +948,14 @@
 @code{md5_init}.
 @end deftypefun
 
+@deftypefun void md5_compress (const uint32_t *@var{state}, uint8_t *@var{input})
+Perform a raw MD5 compress on MD5_BLOCK_SIZE bytes from @var{input}
+using @var{state} as IV (an array of 4 uint32_t). The output is stored in @var{state}.
+This function provides access to the underlying compression function,
+for the rare applications that need that (e.g., using different IV from
+standard MD5).
+@end deftypefun
+
 The normal way to use MD5 is to call the functions in order: First
 @code{md5_init}, then @code{md5_update} zero or more times, and finally
 @code{md5_digest}. After @code{md5_digest}, the context is reset to
@@ -1083,6 +1110,13 @@
 @code{sha1_init}.
 @end deftypefun
 
+@deftypefun void sha1_compress (const uint32_t *@var{state}, uint8_t *@var{input})
+Perform a raw SHA1 compress on SHA1_BLOCK_SIZE bytes from @var{input}
+using @var{state} as IV (an array of 5 uint32_t). The output is stored in @var{state}.
+This function provides access to the underlying compression function,
+for the rare applications that need that (e.g., using different IV from
+standard SHA1).
+@end deftypefun
 
 @subsubsection @acronym{GOSTHASH94 and GOSTHASH94CP}
 @cindex GOST hash
@@ -1292,6 +1326,7 @@
 * DES3::
 * Salsa20::
 * Serpent::
+* SM4::
 * Twofish::
 * nettle_cipher abstraction::
 @end menu
@@ -1384,15 +1419,23 @@
 @cindex Arcfour
 @cindex RC4
 
-ARCFOUR is a stream cipher, also known under the trade marked name RC4,
-and it is one of the fastest ciphers around. A problem is that the key
-setup of ARCFOUR is quite weak, you should never use keys with
-structure, keys that are ordinary passwords, or sequences of keys like
-``secret:1'', ``secret:2'', @enddots{}. If you have keys that don't look
-like random bit strings, and you want to use ARCFOUR, always hash the
-key before feeding it to ARCFOUR. Furthermore, the initial bytes of the
-generated key stream leak information about the key; for this reason, it
-is recommended to discard the first 512 bytes of the key stream.
+ARCFOUR is a historic stream cipher, also known under the trade marked
+name RC4, and was a widely used fast stream cipher.
+
+We do not recommend the use of ARCFOUR; the Nettle implementation is
+provided primarily for interoperability with existing applications and
+standards.
+
+One problem is that the key setup of ARCFOUR is quite weak, you should
+never use keys with structure, keys that are ordinary passwords, or
+sequences of keys like ``secret:1'', ``secret:2'', @enddots{}. If you
+have keys that don't look like random bit strings, and you want to use
+ARCFOUR, always hash the key before feeding it to ARCFOUR.
+
+Another problem is that the output is distinguishable from random data,
+and that the initial bytes of the generated key stream leak information
+about the key; for this reason, it was sometimes recommended to discard
+the first 512, 768 or 1024 bytes of the key stream.
 
 @example
 /* A more robust key setup function for ARCFOUR */
@@ -2114,6 +2157,42 @@
 Analogous to @code{serpent_encrypt}
 @end deftypefun
 
+@node SM4
+@subsection SM4
+@cindex SM4
+
+SM4 is a block cipher standard adopted by the government of the People's
+Republic of China, and it was issued by the State Cryptography Administration
+on March 21, 2012. The standard is GM/T 0002-2012 "SM4 block cipher algorithm".
+Nettle defines it in @file{<nettle/sm4.h>}.
+
+@deftp {Context struct} {struct sm4_ctx}
+@end deftp
+
+@defvr Constant SM4_BLOCK_SIZE
+The SM4 block-size, 16.
+@end defvr
+
+@defvr Constant SM4_KEY_SIZE
+Default SM4 key size, 16.
+@end defvr
+
+@deftypefun void sm4_set_encrypt_key (struct sm4_ctx *@var{ctx}, const uint8_t *@var{key})
+Initialize the cipher. The function is used for encryption.
+@end deftypefun
+
+@deftypefun void sm4_set_decrypt_key (struct sm4_ctx *@var{ctx}, const uint8_t *@var{key})
+Initialize the cipher. The function is used for decryption.
+@end deftypefun
+
+@deftypefun void sm4_crypt (const struct sm4_ctx *@var{ctx}, size_t @var{length}, uint8_t *@var{dst}, const uint8_t *@var{src})
+Cryption function. @var{length} must be an integral multiple of the
+block size. If it is more than one block, the data is processed in ECB
+mode. @code{src} and @code{dst} may be equal, but they must not overlap
+in any other way. The same function is used for both encryption and
+decryption.
+@end deftypefun
+
 @node Twofish
 @subsection Twofish
 @cindex Twofish
@@ -2810,7 +2889,9 @@
 * GCM::
 * CCM::
 * ChaCha-Poly1305::
+* OCB::
 * SIV-CMAC::
+* SIV-GCM::
 * nettle_aead abstraction::
 @end menu
 
@@ -3227,6 +3308,44 @@
 value, only the first @var{length} octets of the digest are written.
 @end deftypefun
 
+@subsubsection @acronym{GCM}-SM4 interface
+
+The following functions implement the case of @acronym{GCM} using
+SM4 as the underlying cipher.
+
+@deftp {Context struct} {struct gcm_sm4_ctx}
+Context structs, defined using @code{GCM_CTX}.
+@end deftp

_service:tar_scm:nettle-3.8.1.tar.gz/nist-keywrap.c -> _service:tar_scm:nettle-3.9.1.tar.gz/nist-keywrap.c Changed

@@ -44,24 +44,7 @@
 #include "nist-keywrap.h"
 #include "memops.h"
 #include "macros.h"
-
-#if WORDS_BIGENDIAN
-#define bswap_if_le(x) (x)
-#elif HAVE_BUILTIN_BSWAP64
-#define bswap_if_le(x) (__builtin_bswap64 (x))
-#else
-static uint64_t
-bswap_if_le (uint64_t x)
-{
- x = ((x >> 32) & UINT64_C (0xffffffff))
- | ((x & UINT64_C (0xffffffff)) << 32);
- x = ((x >> 16) & UINT64_C (0xffff0000ffff))
- | ((x & UINT64_C (0xffff0000ffff)) << 16);
- x = ((x >> 8) & UINT64_C (0xff00ff00ff00ff))
- | ((x & UINT64_C (0xff00ff00ff00ff)) << 8);
- return x;
-}
-#endif
+#include "bswap-internal.h"
 
 void
 nist_keywrap16 (const void *ctx, nettle_cipher_func *encrypt,
@@ -94,7 +77,7 @@
 	 encrypt (ctx, 16, B.b, I.b);
 
 	 /* A = MSB(64, B) ^ t where t = (n*j)+i */
-	 A.u64 = B.u640 ^ bswap_if_le ((n * j) + (i + 1));
+	 A.u64 = B.u640 ^ bswap64_if_le ((n * j) + (i + 1));
 
 	 /* Ri = LSB(64, B) */
 	 memcpy (R + (i * 8), B.b + 8, 8);
@@ -129,7 +112,7 @@
 for (i = n - 1; i >= 0; i--)
 	{
 	 /* B = AES-1(K, (A ^ t) | Ri) where t = n*j+i */
-	 I.u640 = A.u64 ^ bswap_if_le ((n * j) + (i + 1));
+	 I.u640 = A.u64 ^ bswap64_if_le ((n * j) + (i + 1));
 	 memcpy (I.b + 8, R + (i * 8), 8);
 	 decrypt (ctx, 16, B.b, I.b);

_service:tar_scm:nettle-3.9.1.tar.gz/ocb-aes128.c Added

@@ -0,0 +1,118 @@
+/* ocb-aes128.c
+
+   Copyright (C) 2022 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "ocb.h"
+
+void
+ocb_aes128_set_encrypt_key (struct ocb_aes128_encrypt_key *ocb_key, const uint8_t *key)
+{
+  aes128_set_encrypt_key (&ocb_key->encrypt, key);
+  ocb_set_key (&ocb_key->ocb, &ocb_key->encrypt, (nettle_cipher_func *) aes128_encrypt);
+}
+
+void
+ocb_aes128_set_decrypt_key (struct ocb_aes128_encrypt_key *ocb_key, struct aes128_ctx *decrypt,
+			    const uint8_t *key)
+{
+  ocb_aes128_set_encrypt_key (ocb_key, key);
+  aes128_invert_key (decrypt, &ocb_key->encrypt);
+}
+
+void
+ocb_aes128_set_nonce (struct ocb_ctx *ctx, const struct ocb_aes128_encrypt_key *key,
+		      size_t tag_length, size_t nonce_length, const uint8_t *nonce)
+{
+  ocb_set_nonce (ctx, &key->encrypt, (nettle_cipher_func *) aes128_encrypt,
+		 tag_length, nonce_length, nonce);
+}
+
+void
+ocb_aes128_update (struct ocb_ctx *ctx, const struct ocb_aes128_encrypt_key *key,
+		   size_t length, const uint8_t *data)
+{
+  ocb_update (ctx, &key->ocb, &key->encrypt, (nettle_cipher_func *) aes128_encrypt,
+	      length, data);
+}
+
+void
+ocb_aes128_encrypt(struct ocb_ctx *ctx, const struct ocb_aes128_encrypt_key *key,
+		   size_t length, uint8_t *dst, const uint8_t *src)
+{
+  ocb_encrypt (ctx, &key->ocb, &key->encrypt, (nettle_cipher_func *) aes128_encrypt,
+	       length, dst, src);
+}
+
+void
+ocb_aes128_decrypt(struct ocb_ctx *ctx, const struct ocb_aes128_encrypt_key *key,
+		   const struct aes128_ctx *decrypt,
+		   size_t length, uint8_t *dst, const uint8_t *src)
+{
+  ocb_decrypt (ctx, &key->ocb, &key->encrypt, (nettle_cipher_func *) aes128_encrypt,
+	       decrypt, (nettle_cipher_func *) aes128_decrypt,
+	       length, dst, src);
+}
+
+void
+ocb_aes128_digest(struct ocb_ctx *ctx, const struct ocb_aes128_encrypt_key *key,
+		  size_t length, uint8_t *digest)
+{
+  ocb_digest (ctx, &key->ocb, &key->encrypt, (nettle_cipher_func *) aes128_encrypt,
+	      length, digest);
+}
+
+void
+ocb_aes128_encrypt_message (const struct ocb_aes128_encrypt_key *key,
+			    size_t nlength, const uint8_t *nonce,
+			    size_t alength, const uint8_t *adata,
+			    size_t tlength,
+			    size_t clength, uint8_t *dst, const uint8_t *src)
+{
+  ocb_encrypt_message (&key->ocb, &key->encrypt, (nettle_cipher_func *) aes128_encrypt,
+		       nlength, nonce, alength, adata, tlength, clength, dst, src);
+}
+
+int
+ocb_aes128_decrypt_message (const struct ocb_aes128_encrypt_key *key,
+			    const struct aes128_ctx *decrypt,
+			    size_t nlength, const uint8_t *nonce,
+			    size_t alength, const uint8_t *adata,
+			    size_t tlength,
+			    size_t mlength, uint8_t *dst, const uint8_t *src)
+{
+  return ocb_decrypt_message (&key->ocb, &key->encrypt, (nettle_cipher_func *) aes128_encrypt,
+			      &decrypt, (nettle_cipher_func *) aes128_decrypt,
+			      nlength, nonce, alength, adata,
+			      tlength, mlength, dst, src);
+}

_service:tar_scm:nettle-3.9.1.tar.gz/ocb.c Added

@@ -0,0 +1,432 @@
+/* ocb.c
+
+ OCB AEAD mode, RFC 7253
+
+ Copyright (C) 2021 Niels Möller
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <string.h>
+
+#include "ocb.h"
+#include "block-internal.h"
+#include "bswap-internal.h"
+#include "memops.h"
+
+#define OCB_MAX_BLOCKS 16
+
+/* Returns 64 bits from the concatenation (u0, u1), starting from bit offset. */
+static inline uint64_t
+extract(uint64_t u0, uint64_t u1, unsigned offset)
+{
+ if (offset == 0)
+ return u0;
+ u0 = bswap64_if_le(u0);
+ u1 = bswap64_if_le(u1);
+ return bswap64_if_le((u0 << offset) | (u1 >> (64 - offset)));
+}
+
+void
+ocb_set_key (struct ocb_key *key, const void *cipher, nettle_cipher_func *f)
+{
+ static const union nettle_block16 zero_block;
+ f (cipher, OCB_BLOCK_SIZE, key->L0.b, zero_block.b);
+ block16_mulx_be (&key->L1, &key->L0);
+ block16_mulx_be (&key->L2, &key->L1);
+}
+
+/* Add x^k L2, where k is the number of trailing zero bits in i. */
+static void
+update_offset(const struct ocb_key *key,
+	 union nettle_block16 *offset, size_t i)
+{
+ if (i & 1)
+ block16_xor (offset, &key->L2);
+ else
+ {
+ assert (i > 0);
+ union nettle_block16 diff;
+ block16_mulx_be (&diff, &key->L2);
+ for (i >>= 1; !(i&1); i >>= 1)
+	block16_mulx_be (&diff, &diff);
+
+ block16_xor (offset, &diff);
+ }
+}
+
+static void
+pad_block (union nettle_block16 *block, size_t length, const uint8_t *data)
+{
+ memcpy (block->b, data, length);
+ block->blength = 0x80;
+ memset (block->b + length + 1, 0, OCB_BLOCK_SIZE - 1 - length);
+}
+
+void
+ocb_set_nonce (struct ocb_ctx *ctx,
+	 const void *cipher, nettle_cipher_func *f,
+	 size_t tag_length,
+	 size_t nonce_length, const uint8_t *nonce)
+{
+ union nettle_block16 top;
+ uint64_t stretch;
+
+ unsigned bottom;
+ assert (nonce_length < 16);
+ assert (tag_length > 0);
+ assert (tag_length <= 16);
+
+ /* Bit size, or zero for tag_length == 16 */
+ top.b0 = (tag_length & 15) << 4;
+ memset (top.b + 1, 0, 15 - nonce_length);
+ top.b15 - nonce_length |= 1;
+ memcpy (top.b + 16 - nonce_length, nonce, nonce_length);
+ bottom = top.b15 & 0x3f;
+ top.b15 &= 0xc0;
+
+ f (cipher, OCB_BLOCK_SIZE, top.b, top.b);
+
+ stretch = top.u640;
+#if WORDS_BIGENDIAN
+ stretch ^= (top.u640 << 8) | (top.u641 >> 56);
+#else
+ stretch ^= (top.u640 >> 8) | (top.u641 << 56);
+#endif
+
+ ctx->initial.u640 = extract(top.u640, top.u641, bottom);
+ ctx->initial.u641 = extract(top.u641, stretch, bottom);
+ ctx->sum.u640 = ctx->sum.u641 = 0;
+ ctx->checksum.u640 = ctx->checksum.u641 = 0;
+
+ ctx->data_count = ctx->message_count = 0;
+}
+
+static void
+ocb_fill_n (const struct ocb_key *key,
+	 union nettle_block16 *offset, size_t count,
+	 size_t n, union nettle_block16 *o)
+{
+ assert (n > 0);
+ union nettle_block16 *prev;
+ if (count & 1)
+ prev = offset;
+ else
+ {
+ /* Do a single block to align block count. */
+ count++; /* Always odd. */
+ block16_xor (offset, &key->L2);
+ block16_set (&o0, offset);
+ prev = o;
+ n--; o++;
+ }
+
+ for (; n >= 2; n -= 2, o += 2)
+ {
+ size_t i;
+ count += 2; /* Always odd. */
+
+ /* Based on trailing zeros of ctx->message_count - 1, the
+ initial shift below discards a one bit. */
+ block16_mulx_be (&o0, &key->L2);
+ for (i = count >> 1; !(i&1); i >>= 1)
+	block16_mulx_be (&o0, &o0);
+
+ block16_xor (&o0, prev);
+ block16_xor3 (&o1, &o0, &key->L2);
+ prev = &o1;
+ }
+ block16_set(offset, prev);
+
+ if (n > 0)
+ {
+ update_offset (key, offset, ++count);
+ block16_set (o, offset);
+ }
+}
+
+void
+ocb_update (struct ocb_ctx *ctx, const struct ocb_key *key,
+	 const void *cipher, nettle_cipher_func *f,
+	 size_t length, const uint8_t *data)
+{
+ union nettle_block16 blockOCB_MAX_BLOCKS;
+ size_t n = length / OCB_BLOCK_SIZE;
+ assert (ctx->message_count == 0);
+
+ if (ctx->data_count == 0)
+ ctx->offset.u640 = ctx->offset.u641 = 0;
+
+ while (n > 0)
+ {
+ size_t size, i;
+ size_t blocks = (n <= OCB_MAX_BLOCKS) ? n
+	: OCB_MAX_BLOCKS - 1 + (ctx->data_count & 1);
+
+ ocb_fill_n (key, &ctx->offset, ctx->data_count, blocks, block);
+ ctx->data_count += blocks;
+
+ size = blocks * OCB_BLOCK_SIZE;
+ memxor (block0.b, data, size);
+ f (cipher, size, block0.b, block0.b);

_service:tar_scm:nettle-3.9.1.tar.gz/ocb.h Added

@@ -0,0 +1,189 @@
+/* ocb.h
+
+   OCB AEAD mode, RFC 7253
+
+   Copyright (C) 2021 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#ifndef NETTLE_OCB_H_INCLUDED
+#define NETTLE_OCB_H_INCLUDED
+
+#include "nettle-types.h"
+#include "aes.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Name mangling */
+#define ocb_set_key nettle_ocb_set_key
+#define ocb_set_nonce nettle_ocb_set_nonce
+#define ocb_update nettle_ocb_update
+#define ocb_encrypt nettle_ocb_encrypt
+#define ocb_decrypt nettle_ocb_decrypt
+#define ocb_digest nettle_ocb_digest
+#define ocb_encrypt_message nettle_ocb_encrypt_message
+#define ocb_decrypt_message nettle_ocb_decrypt_message
+#define ocb_aes128_set_encrypt_key nettle_ocb_aes128_set_encrypt_key
+#define ocb_aes128_set_decrypt_key nettle_ocb_aes128_set_decrypt_key
+#define ocb_aes128_set_nonce nettle_ocb_aes128_set_nonce
+#define ocb_aes128_update nettle_ocb_aes128_update
+#define ocb_aes128_encrypt nettle_ocb_aes128_encrypt
+#define ocb_aes128_decrypt nettle_ocb_aes128_decrypt
+#define ocb_aes128_digest nettle_ocb_aes128_digest
+#define ocb_aes128_encrypt_message nettle_ocb_aes128_encrypt_message
+#define ocb_aes128_decrypt_message nettle_ocb_aes128_decrypt_message
+
+#define OCB_BLOCK_SIZE 16
+#define OCB_DIGEST_SIZE 16
+#define OCB_MAX_NONCE_SIZE 15
+
+struct ocb_key {
+  /* L_*, L_$ and L_0, and one reserved entry */
+  union nettle_block16 L4;
+};
+
+struct ocb_ctx {
+  /* Initial offset, Offset_0 in the spec. */
+  union nettle_block16 initial;
+  /* Offset, updated per block. */
+  union nettle_block16 offset;
+  /* Authentication for the associated data */
+  union nettle_block16 sum;
+  /* Authentication for the message */
+  union nettle_block16 checksum;
+  /* Count of processed blocks. */
+  size_t data_count;
+  size_t message_count;
+};
+
+void
+ocb_set_key (struct ocb_key *key, const void *cipher, nettle_cipher_func *f);
+
+void
+ocb_set_nonce (struct ocb_ctx *ctx,
+	       const void *cipher, nettle_cipher_func *f,
+	       size_t tag_length, size_t nonce_length, const uint8_t *nonce);
+
+void
+ocb_update (struct ocb_ctx *ctx, const struct ocb_key *key,
+	    const void *cipher, nettle_cipher_func *f,
+	    size_t length, const uint8_t *data);
+
+void
+ocb_encrypt (struct ocb_ctx *ctx, const struct ocb_key *key,
+	     const void *cipher, nettle_cipher_func *f,
+	     size_t length, uint8_t *dst, const uint8_t *src);
+
+void
+ocb_decrypt (struct ocb_ctx *ctx, const struct ocb_key *key,
+	     const void *encrypt_ctx, nettle_cipher_func *encrypt,
+	     const void *decrypt_ctx, nettle_cipher_func *decrypt,
+	     size_t length, uint8_t *dst, const uint8_t *src);
+
+void
+ocb_digest (const struct ocb_ctx *ctx, const struct ocb_key *key,
+	    const void *cipher, nettle_cipher_func *f,
+	    size_t length, uint8_t *digest);
+
+
+void
+ocb_encrypt_message (const struct ocb_key *ocb_key,
+		     const void *cipher, nettle_cipher_func *f,
+		     size_t nlength, const uint8_t *nonce,
+		     size_t alength, const uint8_t *adata,
+		     size_t tlength,
+		     size_t clength, uint8_t *dst, const uint8_t *src);
+
+int
+ocb_decrypt_message (const struct ocb_key *ocb_key,
+		     const void *encrypt_ctx, nettle_cipher_func *encrypt,
+		     const void *decrypt_ctx, nettle_cipher_func *decrypt,
+		     size_t nlength, const uint8_t *nonce,
+		     size_t alength, const uint8_t *adata,
+		     size_t tlength,
+		     size_t mlength, uint8_t *dst, const uint8_t *src);
+
+/* OCB-AES */
+/* This struct represents an expanded key for ocb-aes encryption. For
+   decryption, a separate decryption context is needed as well. */
+struct ocb_aes128_encrypt_key
+{
+  struct ocb_key ocb;
+  struct aes128_ctx encrypt;
+};
+
+void
+ocb_aes128_set_encrypt_key (struct ocb_aes128_encrypt_key *ocb, const uint8_t *key);
+
+void
+ocb_aes128_set_decrypt_key (struct ocb_aes128_encrypt_key *ocb, struct aes128_ctx *decrypt,
+			    const uint8_t *key);
+
+void
+ocb_aes128_set_nonce (struct ocb_ctx *ctx, const struct ocb_aes128_encrypt_key *key,
+		      size_t tag_length, size_t nonce_length, const uint8_t *nonce);
+
+void
+ocb_aes128_update (struct ocb_ctx *ctx, const struct ocb_aes128_encrypt_key *key,
+		   size_t length, const uint8_t *data);
+
+void
+ocb_aes128_encrypt(struct ocb_ctx *ctx, const struct ocb_aes128_encrypt_key *key,
+		   size_t length, uint8_t *dst, const uint8_t *src);
+
+void
+ocb_aes128_decrypt(struct ocb_ctx *ctx, const struct ocb_aes128_encrypt_key *key,
+		   const struct aes128_ctx *decrypt,
+		   size_t length, uint8_t *dst, const uint8_t *src);
+
+void
+ocb_aes128_digest(struct ocb_ctx *ctx, const struct ocb_aes128_encrypt_key *key,
+		  size_t length, uint8_t *digest);
+
+void
+ocb_aes128_encrypt_message (const struct ocb_aes128_encrypt_key *key,
+			    size_t nlength, const uint8_t *nonce,
+			    size_t alength, const uint8_t *adata,
+			    size_t tlength,
+			    size_t clength, uint8_t *dst, const uint8_t *src);
+
+int
+ocb_aes128_decrypt_message (const struct ocb_aes128_encrypt_key *key,
+			    const struct aes128_ctx *decrypt,
+			    size_t nlength, const uint8_t *nonce,
+			    size_t alength, const uint8_t *adata,
+			    size_t tlength,
+			    size_t mlength, uint8_t *dst, const uint8_t *src);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* NETTLE_OCB_H_INCLUDED */

_service:tar_scm:nettle-3.8.1.tar.gz/poly1305-aes.c -> _service:tar_scm:nettle-3.9.1.tar.gz/poly1305-aes.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/poly1305-internal.c -> _service:tar_scm:nettle-3.9.1.tar.gz/poly1305-internal.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/poly1305-internal.h -> _service:tar_scm:nettle-3.9.1.tar.gz/poly1305-internal.h Changed

_service:tar_scm:nettle-3.9.1.tar.gz/poly1305-update.c Added

@@ -0,0 +1,78 @@
+/* poly1305-update.c
+
+   Copyright (C) 2022 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "poly1305.h"
+#include "poly1305-internal.h"
+#include "md-internal.h"
+
+#if HAVE_NATIVE_fat_poly1305_blocks
+const uint8_t *
+_nettle_poly1305_blocks_c(struct poly1305_ctx *ctx,
+			   size_t blocks, const uint8_t *m);
+
+const uint8_t *
+_nettle_poly1305_blocks_c(struct poly1305_ctx *ctx,
+			   size_t blocks, const uint8_t *m)
+{
+  for (; blocks; blocks--, m += POLY1305_BLOCK_SIZE)
+    _nettle_poly1305_block(ctx, m, 1);
+  return m;
+}
+#endif
+
+unsigned
+_nettle_poly1305_update (struct poly1305_ctx *ctx,
+			 uint8_t *block, unsigned index,
+			 size_t length, const uint8_t *m)
+{
+  if (index > 0)
+    {
+      /* Try to fill partial block */
+      MD_FILL_OR_RETURN_INDEX (POLY1305_BLOCK_SIZE, block, index,
+			       length, m);
+      _nettle_poly1305_block(ctx, block, 1);
+    }
+#if HAVE_NATIVE_poly1305_blocks
+  m = _nettle_poly1305_blocks (ctx, length >> 4, m);
+  length &= 15;
+#else
+  for (; length >= POLY1305_BLOCK_SIZE;
+       length -= POLY1305_BLOCK_SIZE, m += POLY1305_BLOCK_SIZE)
+    _nettle_poly1305_block (ctx, m, 1);
+#endif
+
+  memcpy (block, m, length);
+  return length;
+}

_service:tar_scm:nettle-3.9.1.tar.gz/powerpc64/fat/poly1305-blocks.asm Added

@@ -0,0 +1,38 @@
+C powerpc64/fat/poly1305-blocks.asm
+
+ifelse(`
+   Copyright (C) 2022 Mamone Tarsha
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+')
+
+dnl picked up by configure
+dnl PROLOGUE(_nettle_poly1305_blocks)
+dnl PROLOGUE(_nettle_fat_poly1305_blocks)
+
+define(`fat_transform', `$1_ppc64')
+include_src(`powerpc64/p9/poly1305-blocks.asm')

_service:tar_scm:nettle-3.9.1.tar.gz/powerpc64/fat/poly1305-internal-2.asm Added

@@ -0,0 +1,39 @@
+C powerpc64/fat/poly1305-internal-2.asm
+
+ifelse(`
+   Copyright (C) 2022 Mamone Tarsha
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+')
+
+dnl picked up by configure
+dnl PROLOGUE(_nettle_poly1305_set_key)
+dnl PROLOGUE(_nettle_poly1305_block)
+dnl PROLOGUE(_nettle_poly1305_digest)
+
+define(`fat_transform', `$1_ppc64')
+include_src(`powerpc64/p9/poly1305-internal.asm')

_service:tar_scm:nettle-3.8.1.tar.gz/powerpc64/machine.m4 -> _service:tar_scm:nettle-3.9.1.tar.gz/powerpc64/machine.m4 Changed

_service:tar_scm:nettle-3.8.1.tar.gz/powerpc64/p7/chacha-2core.asm -> _service:tar_scm:nettle-3.9.1.tar.gz/powerpc64/p7/chacha-2core.asm Changed

@@ -60,6 +60,9 @@
 
 define(`T0', `v17')
 
+define(`EW_MASK', `v18')
+define(`OW_MASK', `v19')
+
 	.text
 	C _chacha_2core(uint32_t *dst, const uint32_t *src, unsigned rounds)
 
@@ -78,6 +81,9 @@
 	vor	Y3, Y3, X1
 
 .Lshared_entry:
+	DATA_LOAD_VEC(EW_MASK,.even_word_mask,r6)
+	DATA_LOAD_VEC(OW_MASK,.odd_word_mask,r6)
+	
 	vadduwm	Y3, Y3, X3
 
 	li	r6, 0x10	C set up some...
@@ -92,14 +98,14 @@
 	vor	S3, X3, X3
 	vor	S3p1, Y3, Y3
 
-	vmrgow	Y0, X0, X0	C  1  1  3  3
-	vmrgew	X0, X0, X0	C  0  0  2  2
-	vmrgow	Y1, X1, X1	C  5  5  7  7
-	vmrgew	X1, X1, X1	C  4  4  6  6
-	vmrgow	Y2, X2, X2	C  9  9 11 11
-	vmrgew	X2, X2, X2	C  8  8 10 10
-	vmrgow	Y3, X3, S3p1	C 13 13 15 15
-	vmrgew	X3, X3, S3p1	C 12 12 14 14
+	vperm	Y0, X0, X0, OW_MASK	C  1  1  3  3
+	vperm	X0, X0, X0, EW_MASK	C  0  0  2  2
+	vperm	Y1, X1, X1, OW_MASK	C  5  5  7  7
+	vperm	X1, X1, X1, EW_MASK	C  4  4  6  6
+	vperm	Y2, X2, X2, OW_MASK	C  9  9 11 11
+	vperm	X2, X2, X2, EW_MASK	C  8  8 10 10
+	vperm	Y3, X3, S3p1, OW_MASK	C 13 13 15 15
+	vperm	X3, X3, S3p1, EW_MASK	C 12 12 14 14
 
 	vspltisw ROT16, -16	C -16 instead of 16 actually works!
 	vspltisw ROT12, 12
@@ -189,17 +195,17 @@
 
 	bdnz	.Loop
 
-	vmrgew	T0, X0, Y0
-	vmrgow	Y0, X0, Y0
+	vperm	T0, X0, Y0, EW_MASK
+	vperm	Y0, X0, Y0, OW_MASK
 
-	vmrgew	X0, X1, Y1
-	vmrgow	Y1, X1, Y1
+	vperm	X0, X1, Y1, EW_MASK
+	vperm	Y1, X1, Y1, OW_MASK
 
-	vmrgew	X1, X2, Y2
-	vmrgow	Y2, X2, Y2
+	vperm	X1, X2, Y2, EW_MASK
+	vperm	Y2, X2, Y2, OW_MASK
 
-	vmrgew	X2, X3, Y3
-	vmrgow	Y3, X3, Y3
+	vperm	X2, X3, Y3, EW_MASK
+	vperm	Y3, X3, Y3, OW_MASK
 
 	vadduwm T0, T0, S0
 	vadduwm Y0, Y0, S0
@@ -251,6 +257,15 @@
 	b	.Lshared_entry
 EPILOGUE(_nettle_chacha_2core32)
 
+.rodata
+.align 4
+.even_word_mask:
+IF_LE(`.byte 27,26,25,24,11,10,9,8,19,18,17,16,3,2,1,0')
+IF_BE(`.byte 0,1,2,3,16,17,18,19,8,9,10,11,24,25,26,27')
+.odd_word_mask:
+IF_LE(`.byte 31,30,29,28,15,14,13,12,23,22,21,20,7,6,5,4')
+IF_BE(`.byte 4,5,6,7,20,21,22,23,12,13,14,15,28,29,30,31')
+
 divert(-1)
 define core2state
 p/x $vs32.v4_int32

_service:tar_scm:nettle-3.9.1.tar.gz/powerpc64/p9 Added

_service:tar_scm:nettle-3.9.1.tar.gz/powerpc64/p9/poly1305-blocks.asm Added

@@ -0,0 +1,434 @@
+C powerpc64/p9/poly1305-blocks.asm
+
+ifelse(`
+   Copyright (C) 2013, 2022 Niels Möller
+   Copyright (C) 2022 Mamone Tarsha
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+')
+
+include_src(`powerpc64/p9/poly1305.m4')
+
+C Register usage:
+
+define(`SP', `r1')
+define(`TOCP', `r2')
+
+C Argments
+define(`CTX', `r3')
+define(`BLOCKS', `r4')
+define(`DATA', `r5')
+
+define(`PADBYTE', `r6') C Padding byte register
+
+define(`DEFINES_BLOCK_R44', `
+	define(`R0', `v0')
+	define(`R1', `v1')
+	define(`R2', `v2')
+	define(`S1', `v3')
+	define(`S2', `v4')
+	define(`H0', `v5')
+	define(`H1', `v6')
+	define(`H2', `v7')
+
+	define(`R3', `v8')
+	define(`R4', `v9')
+	define(`R5', `v10')
+	define(`S4', `v11')
+	define(`S5', `v12')
+
+	define(`T0', `v13')
+	define(`T1', `v14')
+	define(`T2', `v15')
+	define(`T3', `v16')
+	define(`T4', `v17')
+	define(`T5', `v18')
+	define(`TMP', `v19')
+	define(`TMP2', `v20')
+
+	define(`ZERO', `v21')
+	define(`MASK44', `v22')
+	define(`MASK42L', `v23')
+	define(`MASK44L', `v24')
+	define(`T4PAD', `v25')
+	define(`D40', `v26')
+	define(`D20', `v27')
+	define(`D24', `v28')
+	define(`D44', `v29')
+	define(`D2', `v30')
+	define(`D4', `v31')
+	')
+
+C Compute S_1 = 20 * R_1 and S_2 = 20 * R_2
+C COMPUTE_S(S1, S2, R1, R2)
+define(`COMPUTE_S', `
+	vsld		$1, $3, D2
+	vsld		$2, $4, D2
+	vaddudm		$1, $1, $3
+	vaddudm		$2, $2, $4
+	vsld		$1, $1, D2
+	vsld		$2, $2, D2
+	')
+
+C Convert two-part radix 2^64 to three-part radix 2^44 of four blocks
+C R64_TO_R44_4B(VR0, VR1, VR2, VR3, VR4, VR5)
+define(`R64_TO_R44_4B', `
+	vsrd		$3, $2, D24
+	vsrd		$6, $5, D24
+	vsrd		TMP, $1, D44
+	vsrd		TMP2, $4, D44
+	vsld		$2, $2, D20
+	vsld		$5, $5, D20
+	vor			$2, $2, TMP
+	vor			$5, $5, TMP2
+	vand		$1, $1, MASK44
+	vand		$4, $4, MASK44
+	vand		$2, $2, MASK44
+	vand		$5, $5, MASK44
+	')
+
+C T_0 = R_0 H_0 + S_2 H_1 + S_1 H_2
+C T_1 = R_1 H_0 + R_0 H_1 + S_2 H_2
+C T_2 = R_2 H_0 + R_1 H_1 + R_0 H_2
+C MUL(T0, T1, T2, H0, H1, H2)
+define(`MUL', `
+	vmsumudm	$1, $4, R0, ZERO
+	vmsumudm	$2, $4, R1, ZERO
+	vmsumudm	$3, $4, R2, ZERO
+
+	vmsumudm	$1, $5, S2, $1
+	vmsumudm	$2, $5, R0, $2
+	vmsumudm	$3, $5, R1, $3
+
+	vmsumudm	$1, $6, S1, $1
+	vmsumudm	$2, $6, S2, $2
+	vmsumudm	$3, $6, R0, $3
+	')
+
+C Apply aforenamed equations on four-blocks
+C Each two successive blocks are interleaved horizontally
+C MUL_4B(T0, T1, T2, H0, H1, H2, H3, H4, H5)
+define(`MUL_4B', `
+	vmsumudm	$1, $7, R0, ZERO
+	vmsumudm	$2, $7, R1, ZERO
+	vmsumudm	$3, $7, R2, ZERO
+
+	vmsumudm	$1, $8, S2, $1
+	vmsumudm	$2, $8, R0, $2
+	vmsumudm	$3, $8, R1, $3
+
+	vmsumudm	$1, $9, S1, $1
+	vmsumudm	$2, $9, S2, $2
+	vmsumudm	$3, $9, R0, $3
+
+	vmsumudm	$1, $4, R3, $1
+	vmsumudm	$2, $4, R4, $2
+	vmsumudm	$3, $4, R5, $3
+
+	vmsumudm	$1, $5, S5, $1
+	vmsumudm	$2, $5, R3, $2
+	vmsumudm	$3, $5, R4, $3
+
+	vmsumudm	$1, $6, S4, $1
+	vmsumudm	$2, $6, S5, $2
+	vmsumudm	$3, $6, R3, $3
+	')
+
+C Reduction phase of two interleaved chains
+C RED(H0, H1, H2, T0, T1, T2)
+define(`RED', `
+	vand		$1, $4, MASK44L
+	vsro		$4, $4, D40
+	vsrd		$4, $4, D4
+	vadduqm		$5, $5, $4
+	vand		$2, $5, MASK44L
+	vsro		$5, $5, D40
+	vsrd		$5, $5, D4
+	vadduqm		$6, $6, $5
+	vand		$3, $6, MASK42L
+	vsro		$6, $6, D40
+	vsrd		$6, $6, D2
+	vadduqm		$1, $1, $6
+	vsld		$6, $6, D2
+	vadduqm		$1, $1, $6
+	vsrd		TMP, $1, D44
+	vand		$1, $1, MASK44L
+	vadduqm		$2, $2, TMP
+	')
+
+.text
+
+C void _nettle_poly1305_blocks(struct poly1305_ctx *ctx,
+C 				size_t length, const uint8_t *data)
+define(`FUNC_ALIGN', `5')
+PROLOGUE(_nettle_poly1305_blocks)
+	C Save non-volatile vector registers
+	std		r31,-8(SP)
+	stxv	VSR(v31),-32(SP)
+	stxv	VSR(v30),-48(SP)
+	stxv	VSR(v29),-64(SP)
+	stxv	VSR(v28),-80(SP)
+	stxv	VSR(v27),-96(SP)
+	stxv	VSR(v26),-112(SP)
+	stxv	VSR(v25),-128(SP)
+	stxv	VSR(v24),-144(SP)
+	stxv	VSR(v23),-160(SP)
+	stxv	VSR(v22),-176(SP)

_service:tar_scm:nettle-3.9.1.tar.gz/powerpc64/p9/poly1305-internal.asm Added

@@ -0,0 +1,170 @@
+C powerpc64/p9/poly1305-internal.asm
+
+ifelse(`
+   Copyright (C) 2013, 2022 Niels Möller
+   Copyright (C) 2022 Mamone Tarsha
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+')
+
+include_src(`powerpc64/p9/poly1305.m4')
+
+C Register usage:
+
+define(`SP', `r1')
+define(`TOCP', `r2')
+
+C Argments
+define(`CTX', `r3')
+define(`DATA', `r4')
+define(`PADBYTE', `r5') C Padding byte register
+
+.text
+
+C _poly1305_set_key(struct poly1305_ctx *ctx, const uint8_t key16)
+define(`FUNC_ALIGN', `5')
+PROLOGUE(_nettle_poly1305_set_key)
+	li			r9, 0
+	addis		r5, TOCP, .key_mask@got@ha
+	ld			r5, .key_mask@got@l(r5)
+	ld			r8, 0(r5)
+	ori			r7, r8, 3
+
+	C Load R_0 and R_1
+IF_LE(`
+	ld			r5, 0(r4)
+	ld			r6, 8(r4)
+')
+IF_BE(`
+	ldbrx		r5, 0, r4
+	addi		r4, r4, 8
+	ldbrx		r6, 0, r4
+')
+	and			r5, r5, r7        C R_0 &= 0x0FFFFFFC0FFFFFFF
+	and			r6, r6, r8        C R_1 &= 0x0FFFFFFC0FFFFFFC
+
+	srdi		r10, r6, 2
+	sldi		r7, r5, 2
+	sldi		r8, r10, 2
+	add			r7, r7, r5
+	add			r8, r8, r10
+
+	C Store key
+	std			r5, P1305_R0 (r3)
+	std			r6, P1305_R1 (r3)
+	std			r7, P1305_S0 (r3)
+	std			r8, P1305_S1 (r3)
+	C Reset state
+	std			r9, P1305_H0 (r3)
+	std			r9, P1305_H1 (r3)
+	std			r9, P1305_H2 (r3)
+
+	blr
+EPILOGUE(_nettle_poly1305_set_key)
+
+C void _nettle_poly1305_block(struct poly1305_ctx *ctx, const uint8_t *m, unsigned m128)
+define(`FUNC_ALIGN', `5')
+PROLOGUE(_nettle_poly1305_block)
+	ld			r6, P1305_H0 (CTX)
+	ld			r7, P1305_H1 (CTX)
+	ld			r8, P1305_H2 (CTX)
+
+	BLOCK_R64(CTX,DATA,PADBYTE,r6,v0)
+
+	li			r10, P1305_H1
+	xxswapd		VSR(v0), VSR(v0)
+	xxswapd		VSR(v1), VSR(v1)
+	stxsd		v0, P1305_H0 (CTX)
+	stxvd2x		VSR(v1), r10, CTX
+
+	blr
+EPILOGUE(_nettle_poly1305_block)
+
+C _poly1305_digest (struct poly1305_ctx *ctx, uint8_t *s)
+define(`FUNC_ALIGN', `5')
+PROLOGUE(_nettle_poly1305_digest)
+	C Load current state
+	ld			r5, P1305_H0 (r3)
+	ld			r6, P1305_H1 (r3)
+	ld			r7, P1305_H2 (r3)
+
+	C Fold high part of H2
+	li			r10, 0
+	srdi		r9, r7, 2
+	sldi		r8, r9, 2
+	add			r8, r8, r9
+	andi.		r7, r7, 3
+	addc		r5, r5, r8
+	adde		r6, r6, r10
+	adde		r7, r7, r10
+
+	C Add 5 to state, save result if it carries
+	li			r8, 5
+	li			r9, 0
+	li			r10, -4
+	addc		r8, r8, r5
+	adde		r9, r9, r6
+	adde.		r10, r10, r7
+	iseleq		r5, r8, r5
+	iseleq		r6, r9, r6
+
+	C Load digest
+IF_LE(`
+	ld			r7, 0(r4)
+	ld			r8, 8(r4)
+')
+IF_BE(`
+	li			r10, 8
+	ldbrx		r7, 0, r4
+	ldbrx		r8, r10, r4
+')
+
+	C Add hash to digest
+	addc		r5, r5, r7
+	adde		r6, r6, r8
+
+	C Store digest
+IF_LE(`
+	std			r5, 0(r4)
+	std			r6, 8(r4)
+')
+IF_BE(`
+	stdbrx		r5, 0, r4
+	stdbrx		r6, r10, r4
+')
+	C Reset hash
+	li			r9, 0
+	std			r9, P1305_H0 (r3)
+	std			r9, P1305_H1 (r3)
+	std			r9, P1305_H2 (r3)
+
+	blr
+EPILOGUE(_nettle_poly1305_digest)
+
+.rodata
+.align 3
+.key_mask:
+.quad 0x0FFFFFFC0FFFFFFC

_service:tar_scm:nettle-3.9.1.tar.gz/powerpc64/p9/poly1305.m4 Added

@@ -0,0 +1,102 @@
+C Threshold of processing multiple blocks in parallel
+C of a multiple of 4
+define(`POLY1305_BLOCK_THRESHOLD', `12')
+
+C DEFINES_BLOCK_R64(GPR0, VR0)
+define(`DEFINES_BLOCK_R64', `
+	define(`H0', `$1')
+	define(`H1', `INC_GPR($1,1)')
+	define(`H2', `INC_GPR($1,2)')
+
+	define(`T0', `INC_GPR($1,3)')
+	define(`T1', `INC_GPR($1,4)')
+	define(`T2', `H2')
+	define(`T2A', `INC_GPR($1,3)')
+	define(`T2S', `INC_GPR($1,4)')
+	define(`RZ', `H0')
+	define(`IDX', `INC_GPR($1,4)')
+
+	define(`F0', `$2')
+	define(`F1', `INC_VR($2,1)')
+
+	define(`ZERO', `INC_VR($2,2)')
+	define(`F0S', `INC_VR($2,3)')
+	define(`F11', `INC_VR($2,4)')
+	define(`T', `INC_VR($2,5)')
+
+	define(`R', `INC_VR($2,6)')
+	define(`S', `INC_VR($2,7)')
+
+	define(`T00', `INC_VR($2,8)')
+	define(`T10', `INC_VR($2,9)')
+	define(`T11', `INC_VR($2,10)')
+	define(`MU0', `INC_VR($2,11)')
+	define(`MU1', `INC_VR($2,12)')
+	')
+
+C CTX is the address of context where key and pre-computed values are stored
+C DATA is the address of input block
+C PADBYTE is padding byte for input block
+C GPR0 is the starting register of sequential general-purpose registers
+C used in the macro of following layout
+C GPR0, GPR1, GPR2 are inputs representing the previous state radix 2^64
+C GPR3, GPR4 are temporary registers
+C VR0 is the starting register of sequential vector resigers used in
+C the macro of following layout
+C VR0, VR1 are outputs representing the result state radix 2^64 sorted as follows
+C (low 64-bit of VR0) + (low 64-bit of VR1) + (high 64-bit of VR1)
+C VR2..VR12 are temporary registers
+C BLOCK_R64(CTX, DATA, PADBYTE, GPR0, VR0)
+define(`BLOCK_R64', `
+	DEFINES_BLOCK_R64($4,$5)
+	C Load 128-bit input block
+IF_LE(`
+	ld			T0, 0($2)
+	ld			T1, 8($2)
+')
+IF_BE(`
+	li			IDX, 8
+	ldbrx		T1, IDX, $2
+	ldbrx		T0, 0, $2
+')
+	C Combine state with input block, latter is padded to 17-bytes
+	C by low-order byte of PADBYTE register
+	addc		T0, T0, H0
+	adde		T1, T1, H1
+	adde		T2, $3, H2
+
+	mtvsrdd		VSR(T), T0, T1
+
+	C Load key and pre-computed values
+	li			IDX, 16
+	lxvd2x		VSR(R), 0, $1
+	lxvd2x		VSR(S), IDX, $1
+
+	andi.		T2A, T2, 3
+	srdi		T2S, T2, 2
+
+	li			RZ, 0
+	vxor		ZERO, ZERO, ZERO
+
+	xxpermdi	VSR(MU0), VSR(R), VSR(S), 0b01
+	xxswapd		VSR(MU1), VSR(R)
+
+	mtvsrdd		VSR(T11), 0, T2A
+	mtvsrdd		VSR(T00), T2S, RZ
+	mtvsrdd		VSR(T10), 0, T2
+
+	C Multiply key by combined state and block
+	vmsumudm	F0, T, MU0, ZERO
+	vmsumudm	F1, T, MU1, ZERO
+	vmsumudm	F11, T11, MU1, ZERO
+
+	vmsumudm	F0, T00, S, F0
+	vmsumudm	F1, T10, MU0, F1
+
+	C Product addition
+	xxmrgld		VSR(F11), VSR(F11), VSR(ZERO)
+	vadduqm		F1, F1, F11
+
+	xxmrghd		VSR(F0S), VSR(ZERO), VSR(F0)
+	vadduqm		F1, F1, F0S
+	')

_service:tar_scm:nettle-3.9.1.tar.gz/s390x/fat/sha256-compress-n-2.asm Added

@@ -0,0 +1,36 @@
+C s390x/fat/sha256-compress-n-2.asm
+
+ifelse(`
+   Copyright (C) 2021 Mamone Tarsha
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+')
+
+dnl PROLOGUE(_nettle_sha256_compress_n) picked up by configure
+
+define(`fat_transform', `$1_s390x')
+include_src(`s390x/msa_x1/sha256-compress-n.asm')

_service:tar_scm:nettle-3.9.1.tar.gz/s390x/msa_x1/sha256-compress-n.asm Added

@@ -0,0 +1,78 @@
+C s390x/msa_x1/sha256-compress-n.asm
+
+ifelse(`
+   Copyright (C) 2021, 2022 Mamone Tarsha, Niels Möller
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+')
+
+C KIMD (COMPUTE INTERMEDIATE MESSAGE DIGEST) is specefied in
+C "z/Architecture Principles of Operation SA22-7832-12" as follows:
+C A function specified by the function code in general register 0 is performed.
+C General register 1 contains the logical address of the leftmost byte of the parameter block in storage.
+C the second operand is processed as specified by the function code using an initial chaining value in
+C the parameter block, and the result replaces the chaining value.
+
+C This implementation uses KIMD-SHA-256 function.
+C The parameter block used for the KIMD-SHA-256 function has the following format:
+C *----------------------------------------------*
+C |                 H0 (4 bytes)                 |
+C |----------------------------------------------|
+C |                 H1 (4 bytes)                 |
+C |----------------------------------------------|
+C |                 H2 (4 bytes)                 |
+C |----------------------------------------------|
+C |                 H3 (4 bytes)                 |
+C |----------------------------------------------|
+C |                 H4 (4 bytes)                 |
+C |----------------------------------------------|
+C |                 H5 (4 bytes)                 |
+C |----------------------------------------------|
+C |                 H6 (4 bytes)                 |
+C |----------------------------------------------|
+C |                 H7 (4 bytes)                 |
+C *----------------------------------------------*
+
+.file "sha256-compress-n.asm"
+
+.text
+
+C SHA function code
+define(`SHA256_FUNCTION_CODE', `2')
+
+C const uint8_t *
+C _nettle_sha256_compress_n(uint32_t *state, const uint32_t *k,
+C			    size_t blocks, const uint8_t *input)
+
+PROLOGUE(_nettle_sha256_compress_n)
+    lghi           %r0,SHA256_FUNCTION_CODE      C SHA-256 Function Code
+    lgr            %r1,%r2
+    lgr            %r2, %r5
+    sllg	   %r3, %r4, 6                   C 64 * block size
+1:  .long   0xb93e0002                           C kimd %r0,%r2. perform KIMD-SHA operation on data
+    brc            1,1b
+    br             RA
+EPILOGUE(_nettle_sha256_compress_n)

_service:tar_scm:nettle-3.8.1.tar.gz/sha1.h -> _service:tar_scm:nettle-3.9.1.tar.gz/sha1.h Changed

_service:tar_scm:nettle-3.8.1.tar.gz/sha2-internal.h -> _service:tar_scm:nettle-3.9.1.tar.gz/sha2-internal.h Changed

_service:tar_scm:nettle-3.8.1.tar.gz/sha2.h -> _service:tar_scm:nettle-3.9.1.tar.gz/sha2.h Changed

@@ -46,11 +46,13 @@
 #define sha256_init nettle_sha256_init
 #define sha256_update nettle_sha256_update
 #define sha256_digest nettle_sha256_digest
+#define sha256_compress nettle_sha256_compress
 #define sha384_init nettle_sha384_init
 #define sha384_digest nettle_sha384_digest
 #define sha512_init nettle_sha512_init
 #define sha512_update nettle_sha512_update
 #define sha512_digest nettle_sha512_digest
+#define sha512_compress nettle_sha512_compress
 #define sha512_224_init   nettle_sha512_224_init
 #define sha512_224_digest nettle_sha512_224_digest
 #define sha512_256_init   nettle_sha512_256_init
@@ -91,6 +93,8 @@
 	      size_t length,
 	      uint8_t *digest);
 
+void
+sha256_compress(uint32_t *state, const uint8_t *input);
 
 /* SHA224, a truncated SHA256 with different initial state. */
 
@@ -138,6 +142,8 @@
 	      size_t length,
 	      uint8_t *digest);
 
+void
+sha512_compress(uint64_t *state, const uint8_t *input);
 
 /* SHA384, a truncated SHA512 with different initial state. */
 
@@ -186,7 +192,7 @@
 sha512_256_digest(struct sha512_256_ctx *ctx,
                   size_t length,
                   uint8_t *digest);
-  
+
 #ifdef __cplusplus
 }
 #endif

_service:tar_scm:nettle-3.9.1.tar.gz/sha256-compress-n.c Added

@@ -0,0 +1,206 @@
+/* sha256-compress-n.c
+
+ The compression function of the sha256 hash function.
+
+ Copyright (C) 2001, 2010, 2022 Niels Möller
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#ifndef SHA256_DEBUG
+# define SHA256_DEBUG 0
+#endif
+
+#if SHA256_DEBUG
+# include <stdio.h>
+# define DEBUG(i) \
+ fprintf(stderr, "%2d: %8x %8x %8x %8x %8x %8x %8x %8x\n", \
+	 i, A, B, C, D ,E, F, G, H)
+#else
+# define DEBUG(i)
+#endif
+
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "sha2.h"
+#include "sha2-internal.h"
+
+#include "macros.h"
+
+/* A block, treated as a sequence of 32-bit words. */
+#define SHA256_DATA_LENGTH 16
+
+/* The SHA256 functions. The Choice function is the same as the SHA1
+ function f1, and the majority function is the same as the SHA1 f3
+ function. They can be optimized to save one boolean operation each
+ - thanks to Rich Schroeppel, rcs@cs.arizona.edu for discovering
+ this */
+
+/* #define Choice(x,y,z) ( ( (x) & (y) ) | ( ~(x) & (z) ) ) */
+#define Choice(x,y,z) ( (z) ^ ( (x) & ( (y) ^ (z) ) ) ) 
+/* #define Majority(x,y,z) ( ((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)) ) */
+#define Majority(x,y,z) ( ((x) & (y)) ^ ((z) & ((x) ^ (y))) )
+
+#define S0(x) (ROTL32(30,(x)) ^ ROTL32(19,(x)) ^ ROTL32(10,(x))) 
+#define S1(x) (ROTL32(26,(x)) ^ ROTL32(21,(x)) ^ ROTL32(7,(x)))
+
+#define s0(x) (ROTL32(25,(x)) ^ ROTL32(14,(x)) ^ ((x) >> 3))
+#define s1(x) (ROTL32(15,(x)) ^ ROTL32(13,(x)) ^ ((x) >> 10))
+
+/* The initial expanding function. The hash function is defined over an
+ 64-word expanded input array W, where the first 16 are copies of the input
+ data, and the remaining 64 are defined by
+
+ W t = s1(Wt-2) + Wt-7 + s0(Wi-15) + Wi-16
+
+ This implementation generates these values on the fly in a circular
+ buffer - thanks to Colin Plumb, colin@nyx10.cs.du.edu for this
+ optimization.
+*/
+
+#define EXPAND(W,i) \
+( W(i) & 15 += (s1(W((i)-2) & 15) + W((i)-7) & 15 + s0(W((i)-15) & 15)) )
+
+/* The prototype SHA sub-round. The fundamental sub-round is:
+
+ T1 = h + S1(e) + Choice(e,f,g) + Kt + Wt
+	T2 = S0(a) + Majority(a,b,c)
+	a' = T1+T2
+	b' = a
+	c' = b
+	d' = c
+	e' = d + T1
+	f' = e
+	g' = f
+	h' = g
+
+ but this is implemented by unrolling the loop 8 times and renaming
+ the variables
+ ( h, a, b, c, d, e, f, g ) = ( a, b, c, d, e, f, g, h ) each
+ iteration. */
+
+/* It's crucial that DATA is only used once, as that argument will
+ * have side effects. */
+#define ROUND(a,b,c,d,e,f,g,h,k,data) do {	\
+ h += S1(e) + Choice(e,f,g) + k + data;	\
+ d += h;					\
+ h += S0(a) + Majority(a,b,c);		\
+ } while (0)
+
+/* For fat builds */
+#if HAVE_NATIVE_sha256_compress_n
+const uint8_t *
+_nettle_sha256_compress_n_c(uint32_t *state, const uint32_t *table,
+			 size_t blocks, const uint8_t *input);
+#define _nettle_sha256_compress_n _nettle_sha256_compress_n_c
+#endif
+
+const uint8_t *
+_nettle_sha256_compress_n(uint32_t *state, const uint32_t *table,
+			 size_t blocks, const uint8_t *input)
+{
+ uint32_t A, B, C, D, E, F, G, H; /* Local vars */
+
+ A = state0;
+ B = state1;
+ C = state2;
+ D = state3;
+ E = state4;
+ F = state5;
+ G = state6;
+ H = state7;
+
+ for (; blocks > 0; blocks--)
+ {
+ uint32_t dataSHA256_DATA_LENGTH;
+ unsigned i;
+ const uint32_t *k;
+ uint32_t *d;
+ for (i = 0; i < SHA256_DATA_LENGTH; i++, input+= 4)
+	{
+	 datai = READ_UINT32(input);
+	}
+
+ /* Heavy mangling */
+ /* First 16 subrounds that act on the original data */
+
+ DEBUG(-1);
+ for (i = 0, d = data, k = table; i<16; i+=8, k += 8, d+= 8)
+	{
+	 ROUND(A, B, C, D, E, F, G, H, k0, d0); DEBUG(i);
+	 ROUND(H, A, B, C, D, E, F, G, k1, d1); DEBUG(i+1);
+	 ROUND(G, H, A, B, C, D, E, F, k2, d2);
+	 ROUND(F, G, H, A, B, C, D, E, k3, d3);
+	 ROUND(E, F, G, H, A, B, C, D, k4, d4);
+	 ROUND(D, E, F, G, H, A, B, C, k5, d5);
+	 ROUND(C, D, E, F, G, H, A, B, k6, d6); DEBUG(i+6);
+	 ROUND(B, C, D, E, F, G, H, A, k7, d7); DEBUG(i+7);
+	}
+ 
+ for (; i<64; i += 16, k+= 16)
+	{
+	 ROUND(A, B, C, D, E, F, G, H, k 0, EXPAND(data, 0)); DEBUG(i);
+	 ROUND(H, A, B, C, D, E, F, G, k 1, EXPAND(data, 1)); DEBUG(i+1);
+	 ROUND(G, H, A, B, C, D, E, F, k 2, EXPAND(data, 2)); DEBUG(i+2);
+	 ROUND(F, G, H, A, B, C, D, E, k 3, EXPAND(data, 3)); DEBUG(i+3);
+	 ROUND(E, F, G, H, A, B, C, D, k 4, EXPAND(data, 4)); DEBUG(i+4);
+	 ROUND(D, E, F, G, H, A, B, C, k 5, EXPAND(data, 5)); DEBUG(i+5);
+	 ROUND(C, D, E, F, G, H, A, B, k 6, EXPAND(data, 6)); DEBUG(i+6);
+	 ROUND(B, C, D, E, F, G, H, A, k 7, EXPAND(data, 7)); DEBUG(i+7);
+	 ROUND(A, B, C, D, E, F, G, H, k 8, EXPAND(data, 8)); DEBUG(i+8);
+	 ROUND(H, A, B, C, D, E, F, G, k 9, EXPAND(data, 9)); DEBUG(i+9);
+	 ROUND(G, H, A, B, C, D, E, F, k10, EXPAND(data, 10)); DEBUG(i+10);
+	 ROUND(F, G, H, A, B, C, D, E, k11, EXPAND(data, 11)); DEBUG(i+11);
+	 ROUND(E, F, G, H, A, B, C, D, k12, EXPAND(data, 12)); DEBUG(i+12);
+	 ROUND(D, E, F, G, H, A, B, C, k13, EXPAND(data, 13)); DEBUG(i+13);
+	 ROUND(C, D, E, F, G, H, A, B, k14, EXPAND(data, 14)); DEBUG(i+14);
+	 ROUND(B, C, D, E, F, G, H, A, k15, EXPAND(data, 15)); DEBUG(i+15);
+	}
+
+ /* Update state */
+ state0 = A = state0 + A;
+ state1 = B = state1 + B;
+ state2 = C = state2 + C;
+ state3 = D = state3 + D;
+ state4 = E = state4 + E;
+ state5 = F = state5 + F;
+ state6 = G = state6 + G;
+ state7 = H = state7 + H;
+#if SHA256_DEBUG

_service:tar_scm:nettle-3.8.1.tar.gz/sha256.c -> _service:tar_scm:nettle-3.9.1.tar.gz/sha256.c Changed

@@ -46,6 +46,7 @@
 #include "sha2-internal.h"
 
 #include "macros.h"
+#include "md-internal.h"
 #include "nettle-write.h"
 
 /* Generated by the shadata program. */
@@ -70,7 +71,13 @@
   0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL, 
 };
 
-#define COMPRESS(ctx, data) (_nettle_sha256_compress((ctx)->state, (data), K))
+void
+sha256_compress(uint32_t *state, const uint8_t *input)
+{
+  _nettle_sha256_compress_n(state, K, 1, input);
+}
+
+#define COMPRESS(ctx, data) (sha256_compress((ctx)->state, (data)))
 
 /* Initialize the SHA values */
 
@@ -97,7 +104,22 @@
 sha256_update(struct sha256_ctx *ctx,
 	      size_t length, const uint8_t *data)
 {
-  MD_UPDATE (ctx, length, data, COMPRESS, ctx->count++);
+  size_t blocks;
+  if (ctx->index > 0)
+    {
+      /* Try to fill partial block */
+      MD_FILL_OR_RETURN (ctx, length, data);
+      sha256_compress (ctx->state, ctx->block);
+      ctx->count++;
+    }
+
+  blocks = length >> 6;
+  data = _nettle_sha256_compress_n (ctx->state, K, blocks, data);
+  ctx->count += blocks;
+  length &= 63;
+
+  memcpy (ctx->block, data, length);
+  ctx->index = length;
 }
 
 static void
@@ -118,7 +140,7 @@
      big-endian format, and will be converted back by the compression
      function. It's probably not worth the effort to fix this. */
   WRITE_UINT64(ctx->block + (SHA256_BLOCK_SIZE - 8), bit_count);
-  COMPRESS(ctx, ctx->block);
+  sha256_compress(ctx->state, ctx->block);
 
   _nettle_write_be32(length, digest, ctx->state);
 }

_service:tar_scm:nettle-3.8.1.tar.gz/sha512.c -> _service:tar_scm:nettle-3.9.1.tar.gz/sha512.c Changed

_service:tar_scm:nettle-3.9.1.tar.gz/siv-gcm-aes128.c Added

@@ -0,0 +1,65 @@
+/* siv-gcm-aes128.c
+
+   AES-GCM-SIV, RFC8452
+
+   Copyright (C) 2022 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "nettle-meta.h"
+#include "siv-gcm.h"
+
+void
+siv_gcm_aes128_encrypt_message (const struct aes128_ctx *ctx,
+				size_t nlength, const uint8_t *nonce,
+				size_t alength, const uint8_t *adata,
+				size_t clength, uint8_t *dst, const uint8_t *src)
+{
+  struct aes128_ctx ctr_ctx;
+  siv_gcm_encrypt_message (&nettle_aes128, ctx, &ctr_ctx,
+			   nlength, nonce,
+			   alength, adata,
+			   clength, dst, src);
+}
+
+int
+siv_gcm_aes128_decrypt_message (const struct aes128_ctx *ctx,
+				size_t nlength, const uint8_t *nonce,
+				size_t alength, const uint8_t *adata,
+				size_t mlength, uint8_t *dst, const uint8_t *src)
+{
+  struct aes128_ctx ctr_ctx;
+  return siv_gcm_decrypt_message (&nettle_aes128, ctx, &ctr_ctx,
+				  nlength, nonce,
+				  alength, adata,
+				  mlength, dst, src);
+}

_service:tar_scm:nettle-3.9.1.tar.gz/siv-gcm-aes256.c Added

@@ -0,0 +1,65 @@
+/* siv-gcm-aes256.c
+
+   AES-GCM-SIV, RFC8452
+
+   Copyright (C) 2022 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "nettle-meta.h"
+#include "siv-gcm.h"
+
+void
+siv_gcm_aes256_encrypt_message (const struct aes256_ctx *ctx,
+				size_t nlength, const uint8_t *nonce,
+				size_t alength, const uint8_t *adata,
+				size_t clength, uint8_t *dst, const uint8_t *src)
+{
+  struct aes256_ctx ctr_ctx;
+  siv_gcm_encrypt_message (&nettle_aes256, ctx, &ctr_ctx,
+			   nlength, nonce,
+			   alength, adata,
+			   clength, dst, src);
+}
+
+int
+siv_gcm_aes256_decrypt_message (const struct aes256_ctx *ctx,
+				size_t nlength, const uint8_t *nonce,
+				size_t alength, const uint8_t *adata,
+				size_t mlength, uint8_t *dst, const uint8_t *src)
+{
+  struct aes256_ctx ctr_ctx;
+  return siv_gcm_decrypt_message (&nettle_aes256, ctx, &ctr_ctx,
+				  nlength, nonce,
+				  alength, adata,
+				  mlength, dst, src);
+}

_service:tar_scm:nettle-3.9.1.tar.gz/siv-gcm.c Added

@@ -0,0 +1,229 @@
+/* siv-gcm.c
+
+ AES-GCM-SIV, RFC8452
+
+ Copyright (C) 2022 Red Hat, Inc.
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "siv-gcm.h"
+#include "ghash-internal.h"
+#include "block-internal.h"
+#include "nettle-internal.h"
+#include "macros.h"
+#include "memops.h"
+#include "ctr-internal.h"
+#include <string.h>
+
+#define MIN(a,b) (((a) < (b)) ? (a) : (b))
+
+static void
+siv_gcm_derive_keys (const void *ctx,
+		 nettle_cipher_func *f,
+		 size_t key_size,
+		 size_t nlength, const uint8_t *nonce,
+		 union nettle_block16 *auth_key,
+		 uint8_t *encryption_key)
+{
+ union nettle_block16 block;
+ union nettle_block16 out;
+ size_t i;
+
+ block16_zero (&block);
+ memcpy (block.b + 4, nonce, MIN(nlength, SIV_GCM_NONCE_SIZE));
+
+ f (ctx, SIV_GCM_BLOCK_SIZE, out.b, block.b);
+ auth_key->u640 = out.u640;
+
+ block.b0 = 1;
+ f (ctx, SIV_GCM_BLOCK_SIZE, out.b, block.b);
+ auth_key->u641 = out.u640;
+
+ assert (key_size % 8 == 0 && key_size / 8 + 2 <= UINT8_MAX);
+
+ for (i = 0; i < key_size; i += 8)
+ {
+ block.b0++;
+ f (ctx, SIV_GCM_BLOCK_SIZE, out.b, block.b);
+ memcpy (encryption_key + i, out.b, 8);
+ }
+}
+
+static nettle_fill16_func siv_gcm_fill;
+
+static void
+siv_gcm_fill(uint8_t *ctr, size_t blocks, union nettle_block16 *buffer)
+{
+ uint32_t c;
+
+ c = LE_READ_UINT32(ctr);
+
+ for (; blocks-- > 0; buffer++, c++)
+ {
+ memcpy(buffer->b + 4, ctr + 4, SIV_GCM_BLOCK_SIZE - 4);
+ LE_WRITE_UINT32(buffer->b, c);
+ }
+
+ LE_WRITE_UINT32(ctr, c);
+}
+
+static void
+siv_ghash_pad_update (struct gcm_key *ctx,
+		 union nettle_block16 *state,
+		 size_t length, const uint8_t *data)
+{
+ size_t blocks;
+
+ blocks = length / SIV_GCM_BLOCK_SIZE;
+ if (blocks > 0)
+ {
+ data = _siv_ghash_update (ctx, state, blocks, data);
+ length &= 0xf;
+ }
+ if (length > 0)
+ {
+ uint8_t blockSIV_GCM_BLOCK_SIZE;
+
+ memset (block + length, 0, SIV_GCM_BLOCK_SIZE - length);
+ memcpy (block, data, length);
+ _siv_ghash_update (ctx, state, 1, block);
+ }
+}
+
+static void
+siv_gcm_authenticate (const void *ctx,
+		 const struct nettle_cipher *nc,
+		 const union nettle_block16 *authentication_key,
+		 const uint8_t *nonce,
+		 size_t alength, const uint8_t *adata,
+		 size_t mlength, const uint8_t *mdata,
+		 uint8_t *tag)
+{
+ union nettle_block16 state;
+ struct gcm_key siv_ghash_key;
+ union nettle_block16 block;
+
+ _siv_ghash_set_key (&siv_ghash_key, authentication_key);
+
+ block16_zero (&state);
+ siv_ghash_pad_update (&siv_ghash_key, &state, alength, adata);
+ siv_ghash_pad_update (&siv_ghash_key, &state, mlength, mdata);
+
+ block.u640 = bswap64_if_be (alength * 8);
+ block.u641 = bswap64_if_be (mlength * 8);
+
+ _siv_ghash_update (&siv_ghash_key, &state, 1, block.b);
+ block16_bswap (&state, &state);
+
+ memxor (state.b, nonce, SIV_GCM_NONCE_SIZE);
+ state.b15 &= 0x7f;
+ nc->encrypt (ctx, SIV_GCM_BLOCK_SIZE, tag, state.b);
+}
+
+void
+siv_gcm_encrypt_message (const struct nettle_cipher *nc,
+			 const void *ctx,
+			 void *ctr_ctx,
+			 size_t nlength, const uint8_t *nonce,
+			 size_t alength, const uint8_t *adata,
+			 size_t clength, uint8_t *dst, const uint8_t *src)
+{
+ union nettle_block16 authentication_key;
+ TMP_DECL(encryption_key, uint8_t, NETTLE_MAX_CIPHER_KEY_SIZE);
+ uint8_t ctrSIV_GCM_DIGEST_SIZE;
+ uint8_t *tag = dst + clength - SIV_GCM_BLOCK_SIZE;
+
+ assert (clength >= SIV_GCM_DIGEST_SIZE);
+ assert (nlength == SIV_GCM_NONCE_SIZE);
+
+ TMP_ALLOC(encryption_key, nc->key_size);
+ siv_gcm_derive_keys (ctx, nc->encrypt, nc->key_size, nlength, nonce,
+		 &authentication_key, encryption_key);
+
+ /* Calculate authentication tag. */
+ nc->set_encrypt_key (ctr_ctx, encryption_key);
+
+ siv_gcm_authenticate (ctr_ctx, nc,
+			&authentication_key,
+			nonce, alength, adata,
+			clength - SIV_GCM_BLOCK_SIZE, src,
+			tag);
+
+ /* Encrypt the plaintext. */
+
+ /* The initial counter block is the tag with the most significant
+ bit of the last byte set to one. */
+ memcpy (ctr, tag, SIV_GCM_DIGEST_SIZE);
+ ctr15 |= 0x80;
+ _nettle_ctr_crypt16 (ctr_ctx, nc->encrypt, siv_gcm_fill, ctr,
+		 clength - SIV_GCM_BLOCK_SIZE, dst, src);
+}
+
+int
+siv_gcm_decrypt_message (const struct nettle_cipher *nc,
+			 const void *ctx,
+			 void *ctr_ctx,
+			 size_t nlength, const uint8_t *nonce,
+			 size_t alength, const uint8_t *adata,
+			 size_t mlength, uint8_t *dst, const uint8_t *src)
+{
+ union nettle_block16 authentication_key;

_service:tar_scm:nettle-3.9.1.tar.gz/siv-gcm.h Added

@@ -0,0 +1,107 @@
+/* siv-gcm.h
+
+   AES-GCM-SIV, RFC8452
+
+   Copyright (C) 2022 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#ifndef NETTLE_SIV_GCM_H_INCLUDED
+#define NETTLE_SIV_GCM_H_INCLUDED
+
+#include "nettle-types.h"
+#include "nettle-meta.h"
+#include "aes.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Name mangling */
+#define siv_gcm_encrypt_message nettle_siv_gcm_encrypt_message
+#define siv_gcm_decrypt_message nettle_siv_gcm_decrypt_message
+#define siv_gcm_aes128_encrypt_message nettle_siv_gcm_aes128_encrypt_message
+#define siv_gcm_aes128_decrypt_message nettle_siv_gcm_aes128_decrypt_message
+#define siv_gcm_aes256_encrypt_message nettle_siv_gcm_aes256_encrypt_message
+#define siv_gcm_aes256_decrypt_message nettle_siv_gcm_aes256_decrypt_message
+
+/* For AES-GCM-SIV, the block size of the underlying cipher shall be 128 bits. */
+#define SIV_GCM_BLOCK_SIZE 16
+#define SIV_GCM_DIGEST_SIZE 16
+#define SIV_GCM_NONCE_SIZE 12
+
+/* Generic interface.  NC must be a block cipher with 128-bit block
+   size, and keysize that is a multiple of 64 bits, such as AES-128 or
+   AES-256.  */
+void
+siv_gcm_encrypt_message (const struct nettle_cipher *nc,
+			 const void *ctx,
+			 void *ctr_ctx,
+			 size_t nlength, const uint8_t *nonce,
+			 size_t alength, const uint8_t *adata,
+			 size_t clength, uint8_t *dst, const uint8_t *src);
+
+int
+siv_gcm_decrypt_message (const struct nettle_cipher *nc,
+			 const void *ctx,
+			 void *ctr_ctx,
+			 size_t nlength, const uint8_t *nonce,
+			 size_t alength, const uint8_t *adata,
+			 size_t mlength, uint8_t *dst, const uint8_t *src);
+
+/* AEAD_AES_128_GCM_SIV */
+void
+siv_gcm_aes128_encrypt_message (const struct aes128_ctx *ctx,
+				size_t nlength, const uint8_t *nonce,
+				size_t alength, const uint8_t *adata,
+				size_t clength, uint8_t *dst, const uint8_t *src);
+
+int
+siv_gcm_aes128_decrypt_message (const struct aes128_ctx *ctx,
+				size_t nlength, const uint8_t *nonce,
+				size_t alength, const uint8_t *adata,
+				size_t mlength, uint8_t *dst, const uint8_t *src);
+
+/* AEAD_AES_256_GCM_SIV */
+void
+siv_gcm_aes256_encrypt_message (const struct aes256_ctx *ctx,
+				size_t nlength, const uint8_t *nonce,
+				size_t alength, const uint8_t *adata,
+				size_t clength, uint8_t *dst, const uint8_t *src);
+
+int
+siv_gcm_aes256_decrypt_message (const struct aes256_ctx *ctx,
+				size_t nlength, const uint8_t *nonce,
+				size_t alength, const uint8_t *adata,
+				size_t mlength, uint8_t *dst, const uint8_t *src);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* NETTLE_SIV_H_INCLUDED */

_service:tar_scm:nettle-3.9.1.tar.gz/siv-ghash-set-key.c Added

@@ -0,0 +1,52 @@
+/* siv-ghash-set-key.c
+
+   POLYVAL implementation for AES-GCM-SIV, based on GHASH
+
+   Copyright (C) 2011 Katholieke Universiteit Leuven
+   Copyright (C) 2011, 2013, 2018, 2022 Niels Möller
+   Copyright (C) 2018, 2022 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "ghash-internal.h"
+#include "block-internal.h"
+
+void
+_siv_ghash_set_key (struct gcm_key *ctx, const union nettle_block16 *key)
+{
+  union nettle_block16 h;
+
+  block16_bswap (&h, key);
+  block16_mulx_ghash (&h, &h);
+
+  _ghash_set_key (ctx, &h);
+}

_service:tar_scm:nettle-3.9.1.tar.gz/siv-ghash-update.c Added

@@ -0,0 +1,65 @@
+/* siv-ghash-update.c
+
+   POLYVAL implementation for AES-GCM-SIV, based on GHASH
+
+   Copyright (C) 2011 Katholieke Universiteit Leuven
+   Copyright (C) 2011, 2013, 2018, 2022 Niels Möller
+   Copyright (C) 2018, 2022 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "ghash-internal.h"
+#include "block-internal.h"
+#include "macros.h"
+
+const uint8_t *
+_siv_ghash_update (const struct gcm_key *ctx, union nettle_block16 *state,
+		 size_t blocks, const uint8_t *data)
+{
+  for (; blocks-- > 0; data += GCM_BLOCK_SIZE)
+    {
+      union nettle_block16 b;
+
+#if WORDS_BIGENDIAN
+      b.u641 = LE_READ_UINT64(data);
+      b.u640 = LE_READ_UINT64(data + 8);
+#else
+      b.u641 = READ_UINT64(data);
+      b.u640 = READ_UINT64(data + 8);
+#endif
+
+      _ghash_update (ctx, state, 1, b.b);
+    }
+
+  return data;
+}
+

_service:tar_scm:nettle-3.9.1.tar.gz/sm4-meta.c Added

@@ -0,0 +1,49 @@
+/* sm4-meta.c
+
+ Copyright (C) 2022 Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "nettle-meta.h"
+
+#include "sm4.h"
+
+const struct nettle_cipher nettle_sm4 = {
+ "sm4",
+ sizeof(struct sm4_ctx),
+ SM4_BLOCK_SIZE,
+ SM4_KEY_SIZE,
+ (nettle_set_key_func *) sm4_set_encrypt_key,
+ (nettle_set_key_func *) sm4_set_decrypt_key,
+ (nettle_cipher_func *) sm4_crypt,
+ (nettle_cipher_func *) sm4_crypt
+};

_service:tar_scm:nettle-3.9.1.tar.gz/sm4.c Added

@@ -0,0 +1,223 @@
+/* sm4.c
+
+ Copyright (C) 2022 Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+#include <string.h>
+
+#include "sm4.h"
+
+#include "macros.h"
+
+
+static const uint32_t fk4 =
+{
+ 0xa3b1bac6, 0x56aa3350, 0x677d9197, 0xb27022dc
+};
+
+static const uint32_t ck32 =
+{
+ 0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
+ 0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
+ 0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
+ 0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
+ 0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
+ 0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
+ 0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
+ 0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
+};
+
+static const uint8_t sbox256 =
+{
+ 0xd6, 0x90, 0xe9, 0xfe, 0xcc, 0xe1, 0x3d, 0xb7,
+ 0x16, 0xb6, 0x14, 0xc2, 0x28, 0xfb, 0x2c, 0x05,
+ 0x2b, 0x67, 0x9a, 0x76, 0x2a, 0xbe, 0x04, 0xc3,
+ 0xaa, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
+ 0x9c, 0x42, 0x50, 0xf4, 0x91, 0xef, 0x98, 0x7a,
+ 0x33, 0x54, 0x0b, 0x43, 0xed, 0xcf, 0xac, 0x62,
+ 0xe4, 0xb3, 0x1c, 0xa9, 0xc9, 0x08, 0xe8, 0x95,
+ 0x80, 0xdf, 0x94, 0xfa, 0x75, 0x8f, 0x3f, 0xa6,
+ 0x47, 0x07, 0xa7, 0xfc, 0xf3, 0x73, 0x17, 0xba,
+ 0x83, 0x59, 0x3c, 0x19, 0xe6, 0x85, 0x4f, 0xa8,
+ 0x68, 0x6b, 0x81, 0xb2, 0x71, 0x64, 0xda, 0x8b,
+ 0xf8, 0xeb, 0x0f, 0x4b, 0x70, 0x56, 0x9d, 0x35,
+ 0x1e, 0x24, 0x0e, 0x5e, 0x63, 0x58, 0xd1, 0xa2,
+ 0x25, 0x22, 0x7c, 0x3b, 0x01, 0x21, 0x78, 0x87,
+ 0xd4, 0x00, 0x46, 0x57, 0x9f, 0xd3, 0x27, 0x52,
+ 0x4c, 0x36, 0x02, 0xe7, 0xa0, 0xc4, 0xc8, 0x9e,
+ 0xea, 0xbf, 0x8a, 0xd2, 0x40, 0xc7, 0x38, 0xb5,
+ 0xa3, 0xf7, 0xf2, 0xce, 0xf9, 0x61, 0x15, 0xa1,
+ 0xe0, 0xae, 0x5d, 0xa4, 0x9b, 0x34, 0x1a, 0x55,
+ 0xad, 0x93, 0x32, 0x30, 0xf5, 0x8c, 0xb1, 0xe3,
+ 0x1d, 0xf6, 0xe2, 0x2e, 0x82, 0x66, 0xca, 0x60,
+ 0xc0, 0x29, 0x23, 0xab, 0x0d, 0x53, 0x4e, 0x6f,
+ 0xd5, 0xdb, 0x37, 0x45, 0xde, 0xfd, 0x8e, 0x2f,
+ 0x03, 0xff, 0x6a, 0x72, 0x6d, 0x6c, 0x5b, 0x51,
+ 0x8d, 0x1b, 0xaf, 0x92, 0xbb, 0xdd, 0xbc, 0x7f,
+ 0x11, 0xd9, 0x5c, 0x41, 0x1f, 0x10, 0x5a, 0xd8,
+ 0x0a, 0xc1, 0x31, 0x88, 0xa5, 0xcd, 0x7b, 0xbd,
+ 0x2d, 0x74, 0xd0, 0x12, 0xb8, 0xe5, 0xb4, 0xb0,
+ 0x89, 0x69, 0x97, 0x4a, 0x0c, 0x96, 0x77, 0x7e,
+ 0x65, 0xb9, 0xf1, 0x09, 0xc5, 0x6e, 0xc6, 0x84,
+ 0x18, 0xf0, 0x7d, 0xec, 0x3a, 0xdc, 0x4d, 0x20,
+ 0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48
+};
+
+static uint32_t
+sm4_t_non_lin_sub(uint32_t x)
+{
+ uint32_t out;
+
+ out = (uint32_t)sboxx & 0xff;
+ out |= (uint32_t)sbox(x >> 8) & 0xff << 8;
+ out |= (uint32_t)sbox(x >> 16) & 0xff << 16;
+ out |= (uint32_t)sbox(x >> 24) & 0xff << 24;
+
+ return out;
+}
+
+static uint32_t
+sm4_key_lin_sub(uint32_t x)
+{
+ return x ^ ROTL32(13, x) ^ ROTL32(23, x);
+}
+
+static uint32_t
+sm4_enc_lin_sub(uint32_t x)
+{
+ return x ^ ROTL32(2, x) ^ ROTL32(10, x) ^ ROTL32(18, x) ^ ROTL32(24, x);
+}
+
+static uint32_t
+sm4_key_sub(uint32_t x)
+{
+ return sm4_key_lin_sub(sm4_t_non_lin_sub(x));
+}
+
+static uint32_t
+sm4_enc_sub(uint32_t x)
+{
+ return sm4_enc_lin_sub(sm4_t_non_lin_sub(x));
+}
+
+static uint32_t
+sm4_round(uint32_t x0, uint32_t x1, uint32_t x2, uint32_t x3, uint32_t rk)
+{
+ return x0 ^ sm4_enc_sub(x1 ^ x2 ^ x3 ^ rk);
+}
+
+static void
+sm4_set_key(struct sm4_ctx *ctx, const uint8_t *key, int encrypt)
+{
+ uint32_t rk0, rk1, rk2, rk3;
+ unsigned i;
+
+ rk0 = READ_UINT32(key + 0) ^ fk0;
+ rk1 = READ_UINT32(key + 4) ^ fk1;
+ rk2 = READ_UINT32(key + 8) ^ fk2;
+ rk3 = READ_UINT32(key + 12) ^ fk3;
+
+ for (i = 0; i < 32; i += 4)
+ {
+ rk0 ^= sm4_key_sub(rk1 ^ rk2 ^ rk3 ^ cki + 0);
+ rk1 ^= sm4_key_sub(rk2 ^ rk3 ^ rk0 ^ cki + 1);
+ rk2 ^= sm4_key_sub(rk3 ^ rk0 ^ rk1 ^ cki + 2);
+ rk3 ^= sm4_key_sub(rk0 ^ rk1 ^ rk2 ^ cki + 3);
+
+ if (encrypt)
+ {
+ ctx->rkeyi + 0 = rk0;
+ ctx->rkeyi + 1 = rk1;
+ ctx->rkeyi + 2 = rk2;
+ ctx->rkeyi + 3 = rk3;
+ }
+ else
+ {
+ ctx->rkey31 - 0 - i = rk0;
+ ctx->rkey31 - 1 - i = rk1;
+ ctx->rkey31 - 2 - i = rk2;
+ ctx->rkey31 - 3 - i = rk3;
+ }
+ }
+}
+
+void
+sm4_set_encrypt_key(struct sm4_ctx *ctx, const uint8_t *key)
+{
+ sm4_set_key(ctx, key, 1);
+}
+
+void
+sm4_set_decrypt_key(struct sm4_ctx *ctx, const uint8_t *key)
+{
+ sm4_set_key(ctx, key, 0);
+}
+
+void
+sm4_crypt(const struct sm4_ctx *context,
+	 size_t length,
+	 uint8_t *dst,
+	 const uint8_t *src)
+{
+ const uint32_t *rk = context->rkey;
+
+ assert( !(length % SM4_BLOCK_SIZE) );
+
+ for ( ; length; length -= SM4_BLOCK_SIZE)
+ {
+ uint32_t x0, x1, x2, x3;

_service:tar_scm:nettle-3.9.1.tar.gz/sm4.h Added

@@ -0,0 +1,69 @@
+/* sm4.h
+
+ Copyright (C) 2022 Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#ifndef NETTLE_SM4_H_INCLUDED
+#define NETTLE_SM4_H_INCLUDED
+
+#include "nettle-types.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Name mangling */
+#define sm4_set_encrypt_key nettle_sm4_set_encrypt_key
+#define sm4_set_decrypt_key nettle_sm4_set_decrypt_key
+#define sm4_crypt nettle_sm4_crypt
+
+#define SM4_BLOCK_SIZE 16
+#define SM4_KEY_SIZE 16
+
+struct sm4_ctx
+{
+ uint32_t rkey32;
+};
+
+void
+sm4_set_encrypt_key(struct sm4_ctx *ctx, const uint8_t *key);
+
+void
+sm4_set_decrypt_key(struct sm4_ctx *ctx, const uint8_t *key);
+
+void
+sm4_crypt(const struct sm4_ctx *context,
+	 size_t length, uint8_t *dst,
+	 const uint8_t *src);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* NETTLE_SM4_H_INCLUDED */

_service:tar_scm:nettle-3.8.1.tar.gz/testsuite/Makefile.in -> _service:tar_scm:nettle-3.9.1.tar.gz/testsuite/Makefile.in Changed

@@ -11,7 +11,7 @@
 PRE_LDFLAGS = -L..
 
 TS_NETTLE_SOURCES = aes-test.c aes-keywrap-test.c arcfour-test.c arctwo-test.c \
-		    blowfish-test.c bcrypt-test.c cast128-test.c \
+		    balloon-test.c blowfish-test.c bcrypt-test.c cast128-test.c \
 	            base16-test.c base64-test.c \
 		    camellia-test.c chacha-test.c \
 		    cnd-memcpy-test.c \
@@ -24,11 +24,11 @@
 		    sha384-test.c sha512-test.c sha512-224-test.c sha512-256-test.c \
 		    sha3-permute-test.c sha3-224-test.c sha3-256-test.c \
 		    sha3-384-test.c sha3-512-test.c \
-		    shake256-test.c streebog-test.c sm3-test.c \
+		    shake256-test.c streebog-test.c sm3-test.c sm4-test.c \
 		    serpent-test.c twofish-test.c version-test.c \
 		    knuth-lfib-test.c \
 		    cbc-test.c cfb-test.c ctr-test.c gcm-test.c eax-test.c ccm-test.c \
-		    cmac-test.c siv-test.c \
+		    cmac-test.c ocb-test.c siv-cmac-test.c siv-gcm-test.c \
 		    poly1305-test.c chacha-poly1305-test.c \
 		    hmac-test.c umac-test.c \
 		    meta-hash-test.c meta-cipher-test.c\
@@ -47,8 +47,8 @@
 		     rsa-compute-root-test.c \
 		     dsa-test.c dsa-keygen-test.c \
 		     curve25519-dh-test.c curve448-dh-test.c \
-		     ecc-mod-test.c ecc-modinv-test.c ecc-redc-test.c \
-		     ecc-sqrt-test.c \
+		     ecc-mod-arith-test.c ecc-mod-test.c ecc-modinv-test.c \
+		     ecc-redc-test.c ecc-sqrt-test.c \
 		     ecc-dup-test.c ecc-add-test.c \
 		     ecc-mul-g-test.c ecc-mul-a-test.c \
 		     ecdsa-sign-test.c ecdsa-verify-test.c \

_service:tar_scm:nettle-3.9.1.tar.gz/testsuite/balloon-test.c Added

@@ -0,0 +1,135 @@
+/* balloon-test.c
+
+ Copyright (C) 2022 Zoltan Fridrich
+ Copyright (C) 2022 Red Hat, Inc.
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#include "testutils.h"
+#include "balloon.h"
+
+static void
+test_balloon(const struct nettle_hash *alg,
+ size_t password_len, const char *password,
+ size_t salt_len, const char *salt,
+ unsigned s_cost, unsigned t_cost,
+ const struct tstring *expected)
+{
+ void *ctx = xalloc(alg->context_size);
+ uint8_t *buf = xalloc(balloon_itch(alg->digest_size, s_cost));
+
+ alg->init(ctx);
+ balloon(ctx, alg->update, alg->digest, alg->digest_size,
+ s_cost, t_cost, password_len, (const uint8_t *)password,
+ salt_len, (const uint8_t *)salt, buf, buf);
+
+ if (!MEMEQ(alg->digest_size, buf, expected->data))
+ {
+ fprintf(stderr, "test_balloon: result doesn't match the expectation:");
+ fprintf(stderr, "\nOutput: ");
+ print_hex(alg->digest_size, buf);
+ fprintf(stderr, "\nExpected:");
+ tstring_print_hex(expected);
+ fprintf(stderr, "\n");
+ FAIL();
+ }
+
+ free(ctx);
+ free(buf);
+}
+
+static void
+test_balloon_sha(const struct nettle_hash *alg,
+ size_t password_len, const char *password,
+ size_t salt_len, const char *salt,
+ unsigned s_cost, unsigned t_cost,
+ const struct tstring *expected)
+{
+ uint8_t *buf = xalloc(balloon_itch(alg->digest_size, s_cost));
+
+ if (alg == &nettle_sha1)
+ balloon_sha1(s_cost, t_cost, password_len, (const uint8_t *)password,
+ salt_len, (const uint8_t *)salt, buf, buf);
+ else if (alg == &nettle_sha256)
+ balloon_sha256(s_cost, t_cost, password_len, (const uint8_t *)password,
+ salt_len, (const uint8_t *)salt, buf, buf);
+ else if (alg == &nettle_sha384)
+ balloon_sha384(s_cost, t_cost, password_len, (const uint8_t *)password,
+ salt_len, (const uint8_t *)salt, buf, buf);
+ else if (alg == &nettle_sha512)
+ balloon_sha512(s_cost, t_cost, password_len, (const uint8_t *)password,
+ salt_len, (const uint8_t *)salt, buf, buf);
+ else
+ {
+ fprintf(stderr, "test_balloon_sha: bad test\n");
+ FAIL();
+ }
+
+ if (!MEMEQ(alg->digest_size, buf, expected->data))
+ {
+ fprintf(stderr, "test_balloon_sha: result doesn't match the expectation:");
+ fprintf(stderr, "\nOutput: ");
+ print_hex(alg->digest_size, buf);
+ fprintf(stderr, "\nExpected:");
+ tstring_print_hex(expected);
+ fprintf(stderr, "\n");
+ FAIL();
+ }
+
+ free(buf);
+}
+
+/* Test vectors are taken from:
+ * <https://github.com/nachonavarro/balloon-hashing>
+ * <https://github.com/RustCrypto/password-hashes/tree/master/balloon-hash>
+ */
+void
+test_main(void)
+{
+ test_balloon(&nettle_sha256, 8, "hunter42", 11, "examplesalt", 1024, 3,
+ SHEX("716043dff777b44aa7b88dcbab12c078abecfac9d289c5b5195967aa63440dfb"));
+ test_balloon(&nettle_sha256, 0, "", 4, "salt", 3, 3,
+ SHEX("5f02f8206f9cd212485c6bdf85527b698956701ad0852106f94b94ee94577378"));
+ test_balloon(&nettle_sha256, 8, "password", 0, "", 3, 3,
+ SHEX("20aa99d7fe3f4df4bd98c655c5480ec98b143107a331fd491deda885c4d6a6cc"));
+ test_balloon(&nettle_sha256, 1, "", 1, "", 3, 3,
+ SHEX("4fc7e302ffa29ae0eac31166cee7a552d1d71135f4e0da66486fb68a749b73a4"));
+ test_balloon(&nettle_sha256, 8, "password", 4, "salt", 1, 1,
+ SHEX("eefda4a8a75b461fa389c1dcfaf3e9dfacbc26f81f22e6f280d15cc18c417545"));
+
+ test_balloon_sha(&nettle_sha1, 8, "password", 4, "salt", 3, 3,
+ SHEX("99393c091fdd3136f85864099ec49a439dcacc21"));
+ test_balloon_sha(&nettle_sha256, 8, "password", 4, "salt", 3, 3,
+ SHEX("a4df347f5a312e8b2b14c32164f61a81758c807f1bdcda44f4930e2b80ab2154"));
+ test_balloon_sha(&nettle_sha384, 8, "password", 4, "salt", 3, 3,
+ SHEX("78da235f7d0f84aba98b50a432fa6c8f7f3ecb7ea0858cfb316c7e5356aae6c8"
+ "d7e7b3924c54c4ed71a3d0d68cb0ad68"));
+ test_balloon_sha(&nettle_sha512, 8, "password", 4, "salt", 3, 3,
+ SHEX("9baf289dfa42990f4b189d96d4ede0f2610ba71fb644169427829d696f6866d8"
+ "7af41eb68f9e14fd4b1f1a7ce4832f1ed6117c16e8eae753f9e1d054a7c0a7eb"));
+}

_service:tar_scm:nettle-3.8.1.tar.gz/testsuite/ecc-add-test.c -> _service:tar_scm:nettle-3.9.1.tar.gz/testsuite/ecc-add-test.c Changed

@@ -19,6 +19,24 @@
 
       test_ecc_get_g (i, g);
 
+      ecc->dup (ecc, g2, g, scratch);
+      test_ecc_mul_h (i, 2, g2);
+
+      ecc->add_hhh (ecc, g3, g, g2, scratch);
+      test_ecc_mul_h (i, 3, g3);
+
+      ecc->add_hhh (ecc, g3, g2, g, scratch);
+      test_ecc_mul_h (i, 3, g3);
+
+      ecc->add_hhh (ecc, p, g, g3, scratch);
+      test_ecc_mul_h (i, 4, p);
+
+      ecc->add_hhh (ecc, p, g3, g, scratch);
+      test_ecc_mul_h (i, 4, p);
+
+      ecc->dup (ecc, p, g2, scratch);
+      test_ecc_mul_h (i, 4, p);
+
       if (ecc->p.bit_size == 255 || ecc->p.bit_size == 448)
 	{
 	  mp_limb_t *z = xalloc_limbs (ecc_size_j (ecc));
@@ -49,24 +67,20 @@
 
 	  free (z);
 	}
+      else
+	{
+	  ASSERT (ecc_nonsec_add_jjj (ecc, g2, g, g, scratch));
+	  test_ecc_mul_h (i, 2, g2);
 
-      ecc->dup (ecc, g2, g, scratch);
-      test_ecc_mul_h (i, 2, g2);
-
-      ecc->add_hhh (ecc, g3, g, g2, scratch);
-      test_ecc_mul_h (i, 3, g3);
-
-      ecc->add_hhh (ecc, g3, g2, g, scratch);
-      test_ecc_mul_h (i, 3, g3);
-
-      ecc->add_hhh (ecc, p, g, g3, scratch);
-      test_ecc_mul_h (i, 4, p);
+	  ASSERT (ecc_nonsec_add_jjj (ecc, g3, g2, g, scratch));
+	  test_ecc_mul_h (i, 3, g3);
 
-      ecc->add_hhh (ecc, p, g3, g, scratch);
-      test_ecc_mul_h (i, 4, p);
+	  ASSERT (ecc_nonsec_add_jjj (ecc, p, g, g3, scratch));
+	  test_ecc_mul_h (i, 4, p);
 
-      ecc->dup (ecc, p, g2, scratch);
-      test_ecc_mul_h (i, 4, p);
+	  ASSERT (ecc_nonsec_add_jjj (ecc, p, g2, g2, scratch));
+	  test_ecc_mul_h (i, 4, p);
+	}
 
       free (g);
       free (g2);

_service:tar_scm:nettle-3.9.1.tar.gz/testsuite/ecc-mod-arith-test.c Added

@@ -0,0 +1,160 @@
+#include "testutils.h"
+
+#define MAX_SIZE (1 + 521 / GMP_NUMB_BITS)
+#define COUNT 50000
+
+static void
+test_add(const char *name,
+	 const struct ecc_modulo *m,
+	 const mpz_t az, const mpz_t bz)
+{
+ mp_limb_t aMAX_SIZE;
+ mp_limb_t bMAX_SIZE;
+ mp_limb_t tMAX_SIZE;
+ mpz_t mz;
+ mpz_t tz;
+ mpz_t ref;
+
+ mpz_init (ref);
+ mpz_add (ref, az, bz);
+ mpz_mod (ref, ref, mpz_roinit_n (mz, m->m, m->size));
+
+ mpz_limbs_copy (a, az, m->size);
+ mpz_limbs_copy (b, bz, m->size);
+ ecc_mod_add (m, t, a, b);
+
+ if (!mpz_congruent_p (ref, mpz_roinit_n (tz, t, m->size), mz))
+ {
+ fprintf (stderr, "ecc_mod_add %s failed: bit_size = %u\n",
+	 name, m->bit_size);
+
+ fprintf (stderr, "a = ");
+ mpn_out_str (stderr, 16, a, m->size);
+ fprintf (stderr, "\nb = ");
+ mpn_out_str (stderr, 16, b, m->size);
+ fprintf (stderr, "\nt = ");
+ mpn_out_str (stderr, 16, t, m->size);
+ fprintf (stderr, " (bad)\nref = ");
+ mpz_out_str (stderr, 16, ref);
+ fprintf (stderr, "\n");
+ abort ();
+ }
+ mpz_clear (ref);
+}
+
+static void
+test_sub(const char *name,
+	 const struct ecc_modulo *m,
+	 /* If range is non-null, check that 0 <= r < range. */
+	 const mp_limb_t *range,
+	 const mpz_t az, const mpz_t bz)
+{
+ mp_limb_t aMAX_SIZE;
+ mp_limb_t bMAX_SIZE;
+ mp_limb_t tMAX_SIZE;
+ mpz_t mz;
+ mpz_t tz;
+ mpz_t ref;
+
+ mpz_init (ref);
+ mpz_sub (ref, az, bz);
+ mpz_mod (ref, ref, mpz_roinit_n (mz, m->m, m->size));
+
+ mpz_limbs_copy (a, az, m->size);
+ mpz_limbs_copy (b, bz, m->size);
+ ecc_mod_sub (m, t, a, b);
+
+ if (!mpz_congruent_p (ref, mpz_roinit_n (tz, t, m->size), mz))
+ {
+ fprintf (stderr, "ecc_mod_sub %s failed: bit_size = %u\n",
+	 name, m->bit_size);
+
+ fprintf (stderr, "a = ");
+ mpn_out_str (stderr, 16, a, m->size);
+ fprintf (stderr, "\nb = ");
+ mpn_out_str (stderr, 16, b, m->size);
+ fprintf (stderr, "\nt = ");
+ mpn_out_str (stderr, 16, t, m->size);
+ fprintf (stderr, " (bad)\nref = ");
+ mpz_out_str (stderr, 16, ref);
+ fprintf (stderr, "\n");
+ abort ();
+ }
+
+ if (range && mpn_cmp (t, range, m->size) >= 0)
+ {
+ fprintf (stderr, "ecc_mod_sub %s out of range: bit_size = %u\n",
+	 name, m->bit_size);
+
+ fprintf (stderr, "a = ");
+ mpn_out_str (stderr, 16, a, m->size);
+ fprintf (stderr, "\nb = ");
+ mpn_out_str (stderr, 16, b, m->size);
+ fprintf (stderr, "\nt = ");
+ mpn_out_str (stderr, 16, t, m->size);
+ fprintf (stderr, " \nrange = ");
+ mpn_out_str (stderr, 16, range, m->size);
+ fprintf (stderr, "\n");
+ abort ();
+ }
+ mpz_clear (ref);
+}
+
+static void
+test_modulo (gmp_randstate_t rands, const char *name,
+	 const struct ecc_modulo *m, unsigned count)
+{
+ mpz_t a, b;
+ unsigned j;
+
+ mpz_init (a);
+ mpz_init (b);
+
+ for (j = 0; j < count; j++)
+ {
+ if (j & 1)
+	{
+	 mpz_rrandomb (a, rands, m->size * GMP_NUMB_BITS);
+	 mpz_rrandomb (b, rands, m->size * GMP_NUMB_BITS);
+	}
+ else
+	{
+	 mpz_urandomb (a, rands, m->size * GMP_NUMB_BITS);
+	 mpz_urandomb (b, rands, m->size * GMP_NUMB_BITS);
+	}
+ test_add (name, m, a, b);
+ test_sub (name, m, NULL, a, b);
+ }
+ if (m->bit_size < m->size * GMP_NUMB_BITS)
+ {
+ mp_limb_t two_pMAX_SIZE;
+ mpn_lshift (two_p, m->m, m->size, 1);
+ mpz_t range;
+ mpz_roinit_n (range, two_p, m->size);
+ mpz_urandomm (a, rands, range);
+ mpz_urandomm (b, rands, range);
+ test_sub (name, m, two_p, a, b);
+ }
+ mpz_clear (a);
+ mpz_clear (b);
+}
+
+void
+test_main (void)
+{
+ gmp_randstate_t rands;
+ unsigned count = COUNT;
+ unsigned i;
+
+ gmp_randinit_default (rands);
+
+ if (test_randomize(rands))
+ count *= 20;
+
+ for (i = 0; ecc_curvesi; i++)
+ {
+ test_modulo (rands, "p", &ecc_curvesi->p, count);
+ test_modulo (rands, "q", &ecc_curvesi->q, count);
+ }
+ gmp_randclear (rands);
+}

_service:tar_scm:nettle-3.8.1.tar.gz/testsuite/ecdsa-sign-test.c -> _service:tar_scm:nettle-3.9.1.tar.gz/testsuite/ecdsa-sign-test.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/testsuite/ecdsa-verify-test.c -> _service:tar_scm:nettle-3.9.1.tar.gz/testsuite/ecdsa-verify-test.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/testsuite/gcm-test.c -> _service:tar_scm:nettle-3.9.1.tar.gz/testsuite/gcm-test.c Changed

@@ -6,6 +6,13 @@
 #include "gcm.h"
 #include "ghash-internal.h"
 
+#if HAVE_VALGRIND_MEMCHECK_H
+# include <valgrind/memcheck.h>
+#else
+# define VALGRIND_MAKE_MEM_UNDEFINED(p, n)
+# define VALGRIND_MAKE_MEM_DEFINED(p, n)
+#endif
+
 static void
 test_gcm_hash (const struct tstring *msg, const struct tstring *ref)
 {
@@ -42,11 +49,19 @@
 struct gcm_key gcm_key;
 union nettle_block16 state;
 
+ /* Use VALGRIND_MAKE_MEM_DEFINED to mark inputs as "undefined", to
+ get valgrind to warn about any branches or memory accesses
+ depending on secret data. */
 memcpy (state.b, key->data, GCM_BLOCK_SIZE);
+ VALGRIND_MAKE_MEM_UNDEFINED (&state, sizeof(state));
 _ghash_set_key (&gcm_key, &state);
 
 memcpy (state.b, iv->data, GCM_BLOCK_SIZE);
+ VALGRIND_MAKE_MEM_UNDEFINED (&state, sizeof(state));
+ VALGRIND_MAKE_MEM_UNDEFINED (message->data, message->length);
 _ghash_update (&gcm_key, &state, message->length / GCM_BLOCK_SIZE, message->data);
+ VALGRIND_MAKE_MEM_DEFINED (&state, sizeof(state));
+ VALGRIND_MAKE_MEM_DEFINED (message->data, message->length);
 if (!MEMEQ(GCM_BLOCK_SIZE, state.b, digest->data))
 {
 fprintf (stderr, "gcm_hash (internal) failed\n");
@@ -577,6 +592,24 @@
 		 "16aedbf5a0de6a57 a637b39b"),	/* iv */
 	 SHEX("5791883f822013f8bd136fc36fb9946b"));	/* tag */
 
+ /*
+ * GCM-SM4 Test Vectors from
+ * https://datatracker.ietf.org/doc/html/rfc8998
+ */
+ test_aead(&nettle_gcm_sm4, NULL,
+	 SHEX("0123456789ABCDEFFEDCBA9876543210"),
+	 SHEX("FEEDFACEDEADBEEFFEEDFACEDEADBEEFABADDAD2"),
+	 SHEX("AAAAAAAAAAAAAAAABBBBBBBBBBBBBBBB"
+	 "CCCCCCCCCCCCCCCCDDDDDDDDDDDDDDDD"
+	 "EEEEEEEEEEEEEEEEFFFFFFFFFFFFFFFF"
+	 "EEEEEEEEEEEEEEEEAAAAAAAAAAAAAAAA"),
+	 SHEX("17F399F08C67D5EE19D0DC9969C4BB7D"
+	 "5FD46FD3756489069157B282BB200735"
+	 "D82710CA5C22F0CCFA7CBF93D496AC15"
+	 "A56834CBCF98C397B4024A2691233B8D"),
+	 SHEX("00001234567800000000ABCD"),
+	 SHEX("83DE3541E4C2B58177E065A9BF7B62EC"));
+
 /* Test gcm_hash, with varying message size, keys and iv all zero.
 Not compared to any other implementation. */
 test_gcm_hash (SDATA("a"),

_service:tar_scm:nettle-3.8.1.tar.gz/testsuite/meta-aead-test.c -> _service:tar_scm:nettle-3.9.1.tar.gz/testsuite/meta-aead-test.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/testsuite/meta-cipher-test.c -> _service:tar_scm:nettle-3.9.1.tar.gz/testsuite/meta-cipher-test.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/testsuite/meta-hash-test.c -> _service:tar_scm:nettle-3.9.1.tar.gz/testsuite/meta-hash-test.c Changed

_service:tar_scm:nettle-3.9.1.tar.gz/testsuite/ocb-test.c Added

@@ -0,0 +1,405 @@
+#include "testutils.h"
+#include "nettle-internal.h"
+
+struct ocb_aes128_message_key
+{
+  struct ocb_aes128_encrypt_key encrypt_key;
+  struct aes128_ctx decrypt_key;
+};
+
+static void
+ocb_aes128_set_encrypt_key_wrapper (struct ocb_aes128_message_key *key,
+				    const uint8_t *aes_key)
+{
+  ocb_aes128_set_encrypt_key (&key->encrypt_key, aes_key);
+}
+static void
+ocb_aes128_set_decrypt_key_wrapper (struct ocb_aes128_message_key *key,
+				    const uint8_t *aes_key)
+{
+  ocb_aes128_set_decrypt_key (&key->encrypt_key, &key->decrypt_key, aes_key);
+}
+static void
+ocb_aes128_encrypt_message_wrapper (const struct ocb_aes128_message_key *key,
+				    size_t nlength, const uint8_t *nonce,
+				    size_t alength, const uint8_t *adata,
+				    size_t clength, uint8_t *dst, const uint8_t *src)
+{
+  ocb_aes128_encrypt_message (&key->encrypt_key, nlength, nonce, alength, adata,
+			      OCB_DIGEST_SIZE, clength, dst, src);
+}
+static int
+ocb_aes128_decrypt_message_wrapper (const struct ocb_aes128_message_key *key,
+				    size_t nlength, const uint8_t *nonce,
+				    size_t alength, const uint8_t *adata,
+				    size_t mlength, uint8_t *dst, const uint8_t *src)
+{
+  return ocb_aes128_decrypt_message (&key->encrypt_key, &key->decrypt_key,
+				     nlength, nonce, alength, adata,
+				     OCB_DIGEST_SIZE, mlength, dst, src);
+}
+
+static const struct nettle_aead_message
+ocb_aes128_message = {
+  "ocb_aes128",
+  sizeof(struct ocb_aes128_message_key),
+  AES128_KEY_SIZE,
+  OCB_DIGEST_SIZE,
+  1, /* Supports in-place operation. */
+  (nettle_set_key_func*) ocb_aes128_set_encrypt_key_wrapper,
+  (nettle_set_key_func*) ocb_aes128_set_decrypt_key_wrapper,
+  (nettle_encrypt_message_func*) ocb_aes128_encrypt_message_wrapper,
+  (nettle_decrypt_message_func*) ocb_aes128_decrypt_message_wrapper,
+};
+
+/* For 96-bit tag */
+static void
+set_nonce_tag96 (struct ocb_aes128_ctx *ctx, size_t length, const uint8_t *nonce)
+{
+  assert (length == OCB_NONCE_SIZE);
+  ocb_aes128_set_nonce (&ctx->ocb, &ctx->key,
+			12, OCB_NONCE_SIZE, nonce);
+}
+
+void
+test_main(void)
+{
+  /* From RFC 7253 */
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX(""), /* auth data */
+	    SHEX(""), /* plaintext */
+	    SHEX(""), /* ciphertext */
+	    SHEX("BBAA99887766554433221100"), /* nonce */
+	    SHEX("785407BFFFC8AD9EDCC5520AC9111EE6")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX("0001020304050607"), /* auth data */
+	    SHEX("0001020304050607"), /* plaintext */
+	    SHEX("6820B3657B6F615A"), /* ciphertext */
+	    SHEX("BBAA99887766554433221101"), /* nonce */
+	    SHEX("5725BDA0D3B4EB3A257C9AF1F8F03009")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX("0001020304050607"), /* auth data */
+	    SHEX(""), /* plaintext */
+	    SHEX(""), /* ciphertext */
+	    SHEX("BBAA99887766554433221102"), /* nonce */
+	    SHEX("81017F8203F081277152FADE694A0A00")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX(""), /* auth data */
+	    SHEX("0001020304050607"), /* plaintext */
+	    SHEX("45DD69F8F5AAE724"), /* ciphertext */
+	    SHEX("BBAA99887766554433221103"), /* nonce */
+	    SHEX("14054CD1F35D82760B2CD00D2F99BFA9")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* auth data */
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* plaintext */
+	    SHEX("571D535B60B277188BE5147170A9A22C"), /* ciphertext */
+	    SHEX("BBAA99887766554433221104"), /* nonce */
+	    SHEX("3AD7A4FF3835B8C5701C1CCEC8FC3358")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* auth data */
+	    SHEX(""), /* plaintext */
+	    SHEX(""), /* ciphertext */
+	    SHEX("BBAA99887766554433221105"), /* nonce */
+	    SHEX("8CF761B6902EF764462AD86498CA6B97")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX(""), /* auth data */
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* plaintext */
+	    SHEX("5CE88EC2E0692706A915C00AEB8B2396"), /* ciphertext */
+	    SHEX("BBAA99887766554433221106"), /* nonce */
+	    SHEX("F40E1C743F52436BDF06D8FA1ECA343D")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX("000102030405060708090A0B0C0D0E0F1011121314151617"), /* auth data */
+	    SHEX("000102030405060708090A0B0C0D0E0F1011121314151617"), /* plaintext */
+	    SHEX("1CA2207308C87C010756104D8840CE1952F09673A448A122"), /* ciphertext */
+	    SHEX("BBAA99887766554433221107"), /* nonce */
+	    SHEX("C92C62241051F57356D7F3C90BB0E07F")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX("000102030405060708090A0B0C0D0E0F1011121314151617"), /* auth data */
+	    SHEX(""), /* plaintext */
+	    SHEX(""), /* ciphertext */
+	    SHEX("BBAA99887766554433221108"), /* nonce */
+	    SHEX("6DC225A071FC1B9F7C69F93B0F1E10DE")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX(""), /* auth data */
+	    SHEX("000102030405060708090A0B0C0D0E0F1011121314151617"), /* plaintext */
+	    SHEX("221BD0DE7FA6FE993ECCD769460A0AF2D6CDED0C395B1C3C"), /* ciphertext */
+	    SHEX("BBAA99887766554433221109"), /* nonce */
+	    SHEX("E725F32494B9F914D85C0B1EB38357FF")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX("000102030405060708090A0B0C0D0E0F1011121314151617"
+		 "18191A1B1C1D1E1F"), /* auth data */
+	    SHEX("000102030405060708090A0B0C0D0E0F1011121314151617"
+		 "18191A1B1C1D1E1F"), /* plaintext */
+	    SHEX("BD6F6C496201C69296C11EFD138A467ABD3C707924B964DE"
+		 "AFFC40319AF5A485"), /* ciphertext */
+	    SHEX("BBAA9988776655443322110A"), /* nonce */
+	    SHEX("40FBBA186C5553C68AD9F592A79A4240")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX("000102030405060708090A0B0C0D0E0F1011121314151617"
+		 "18191A1B1C1D1E1F"), /* auth data */
+	    SHEX(""), /* plaintext */
+	    SHEX(""), /* ciphertext */
+	    SHEX("BBAA9988776655443322110B"), /* nonce */
+	    SHEX("FE80690BEE8A485D11F32965BC9D2A32")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX(""), /* auth data */
+	    SHEX("000102030405060708090A0B0C0D0E0F1011121314151617"
+		 "18191A1B1C1D1E1F"), /* plaintext */
+	    SHEX("2942BFC773BDA23CABC6ACFD9BFD5835BD300F0973792EF4"
+		 "6040C53F1432BCDF"), /* ciphertext */
+	    SHEX("BBAA9988776655443322110C"), /* nonce */
+	    SHEX("B5E1DDE3BC18A5F840B52E653444D5DF")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX("000102030405060708090A0B0C0D0E0F1011121314151617"
+		 "18191A1B1C1D1E1F2021222324252627"), /* auth data */
+	    SHEX("000102030405060708090A0B0C0D0E0F1011121314151617"
+		 "18191A1B1C1D1E1F2021222324252627"), /* plaintext */
+	    SHEX("D5CA91748410C1751FF8A2F618255B68A0A12E093FF45460"
+		 "6E59F9C1D0DDC54B65E8628E568BAD7A"), /* ciphertext */
+	    SHEX("BBAA9988776655443322110D"), /* nonce */
+	    SHEX("ED07BA06A4A69483A7035490C5769E60")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */
+	    SHEX("000102030405060708090A0B0C0D0E0F1011121314151617"
+		 "18191A1B1C1D1E1F2021222324252627"), /* auth data */
+	    SHEX(""), /* plaintext */
+	    SHEX(""), /* ciphertext */
+	    SHEX("BBAA9988776655443322110E"), /* nonce */
+	    SHEX("C5CD9D1850C141E358649994EE701B68")); /* tag */
+
+  test_aead(&nettle_ocb_aes128, NULL,
+	    SHEX("000102030405060708090A0B0C0D0E0F"), /* key */

_service:tar_scm:nettle-3.8.1.tar.gz/testsuite/sha1-test.c -> _service:tar_scm:nettle-3.9.1.tar.gz/testsuite/sha1-test.c Changed

@@ -1,8 +1,61 @@
 #include "testutils.h"
 
+#include "nettle-write.h"
+#include "sha1.h"
+
+/* Test compression only. */
+static void
+test_sha1_compress(const struct tstring *input,
+		 const struct tstring *expected) {
+ size_t split;
+
+ ASSERT (input->length % SHA1_BLOCK_SIZE == 0);
+ ASSERT (expected->length == SHA1_DIGEST_SIZE);
+
+ for (split = 0; split <= input->length; split += SHA1_BLOCK_SIZE)
+ {
+ struct sha1_ctx ctx;
+ uint8_t digestSHA1_DIGEST_SIZE;
+ sha1_init (&ctx);
+ sha1_update (&ctx, split, input->data);
+ sha1_update (&ctx, input->length - split, input->data + split);
+
+ _nettle_write_be32 (SHA1_DIGEST_SIZE, digest, ctx.state);
+ if (!MEMEQ (SHA1_DIGEST_SIZE, digest, expected->data)) {
+	fprintf (stderr, "sha1_compress failed: length %u, split %u \nInput:",
+		 (unsigned) input->length, (unsigned) split);
+	tstring_print_hex (input);
+	fprintf (stderr, "\nOutput: ");
+	print_hex (SHA1_DIGEST_SIZE, digest);
+	fprintf(stdout, "\nExpected:\n");
+	tstring_print_hex (expected);
+	fprintf (stderr, "\n");
+	abort ();
+ }
+ }
+}
+
 void
 test_main(void)
 {
+ /* Initial state */
+ test_sha1_compress (SDATA(""),
+		 SHEX("67452301efcdab89 98badcfe10325476"
+			 "c3d2e1f0"));
+
+ /* Single block compressed */
+ test_sha1_compress (SDATA("0123456789abcdefghijklmnopqrstuv"
+			 "wxyzABCDEFGHIJKLMNOPQRSTUVWXYZZY"),
+		 SHEX("005cf6fb02d9a17e f77d0b8eac9da60c"
+			 "08ecaf1c"));
+ /* Two blocks compressed */
+ test_sha1_compress (SDATA("0123456789abcdefghijklmnopqrstuv"
+			 "wxyzABCDEFGHIJKLMNOPQRSTUVWXYZZY"
+			 "ABCDEFGHIJKLMNOPQRSTUVWXYZ012345"
+			 "6789abcdefghijklmnopqrstuvwxyzzy"),
+		 SHEX("3e0dd3db30fc4e45 c17a97f0c431f07b"
+			 "6b4a5cc5"));
+
 test_hash(&nettle_sha1, SDATA(""),
 	 SHEX("DA39A3EE5E6B4B0D 3255BFEF95601890 AFD80709"));

_service:tar_scm:nettle-3.8.1.tar.gz/testsuite/sha256-test.c -> _service:tar_scm:nettle-3.9.1.tar.gz/testsuite/sha256-test.c Changed

@@ -1,8 +1,61 @@
 #include "testutils.h"
 
+#include "nettle-write.h"
+#include "sha2.h"
+
+/* Test compression only. */
+static void
+test_sha256_compress(const struct tstring *input,
+		 const struct tstring *expected) {
+ size_t split;
+ ASSERT (input->length % SHA256_BLOCK_SIZE == 0);
+ ASSERT (expected->length == SHA256_DIGEST_SIZE);
+
+ for (split = 0; split <= input->length; split += SHA256_BLOCK_SIZE)
+ {
+ struct sha256_ctx ctx;
+ uint8_t digestSHA256_DIGEST_SIZE;
+
+ sha256_init (&ctx);
+ sha256_update (&ctx, split, input->data);
+ sha256_update (&ctx, input->length - split, input->data + split);
+
+ _nettle_write_be32 (SHA256_DIGEST_SIZE, digest, ctx.state);
+ if (!MEMEQ (SHA256_DIGEST_SIZE, digest, expected->data)) {
+	fprintf (stderr, "sha256_compress failed: length %u, split %u\nInput:",
+		 (unsigned) input->length, (unsigned) split);
+	tstring_print_hex (input);
+	fprintf (stderr, "\nOutput: ");
+	print_hex (SHA256_DIGEST_SIZE, digest);
+	fprintf(stdout, "\nExpected:\n");
+	tstring_print_hex (expected);
+	fprintf (stderr, "\n");
+	abort ();
+ }
+ }
+}
+
 void
 test_main(void)
 {
+ /* Initial state */
+ test_sha256_compress (SDATA(""),
+			SHEX("6a09e667 bb67ae85 3c6ef372 a54ff53a"
+			 "510e527f 9b05688c 1f83d9ab 5be0cd19"));
+
+ /* Single block compressed */
+ test_sha256_compress (SDATA("0123456789abcdefghijklmnopqrstuv"
+			 "wxyzABCDEFGHIJKLMNOPQRSTUVWXYZZY"),
+			SHEX("932558b453a68273 4daf0008efb6b5e5"
+			 "32808baaf92bc749 2ac377107618ac67"));
+ /* Two blocks compressed */
+ test_sha256_compress (SDATA("0123456789abcdefghijklmnopqrstuv"
+			 "wxyzABCDEFGHIJKLMNOPQRSTUVWXYZZY"
+			 "ABCDEFGHIJKLMNOPQRSTUVWXYZ012345"
+			 "6789abcdefghijklmnopqrstuvwxyzzy"),
+			SHEX("d82038b1732bbe97 94b879b41f98e9fc"
+			 "2777fd8ab76737f5 60919c4fe1366c8e"));
+
 /* From FIPS180-2 */
 test_hash(&nettle_sha256, SDATA("abc"),
 	 SHEX("ba7816bf8f01cfea 414140de5dae2223"

_service:tar_scm:nettle-3.9.1.tar.gz/testsuite/siv-cmac-test.c Added

@@ -0,0 +1,257 @@
+/* siv-cmac-test.c
+
+ Self-test and vectors for AES-SIV-CMAC mode ciphers
+
+ Copyright (C) 2018 Nikos Mavrogiannopoulos
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+*/
+
+#include "testutils.h"
+#include "aes.h"
+#include "nettle-types.h"
+#include "siv-cmac.h"
+
+static const struct nettle_aead_message
+siv_cmac_aes128 = {
+ "siv_cmac_aes128",
+ sizeof(struct siv_cmac_aes128_ctx),
+ SIV_CMAC_AES128_KEY_SIZE,
+ SIV_DIGEST_SIZE,
+ 0, /* No in-place operation. */
+ (nettle_set_key_func*) siv_cmac_aes128_set_key,
+ (nettle_set_key_func*) siv_cmac_aes128_set_key,
+ (nettle_encrypt_message_func*) siv_cmac_aes128_encrypt_message,
+ (nettle_decrypt_message_func*) siv_cmac_aes128_decrypt_message,
+};
+
+static const struct nettle_aead_message
+siv_cmac_aes256 = {
+ "siv_cmac_aes256",
+ sizeof(struct siv_cmac_aes256_ctx),
+ SIV_CMAC_AES256_KEY_SIZE,
+ SIV_DIGEST_SIZE,
+ 0, /* No in-place operation. */
+ (nettle_set_key_func*) siv_cmac_aes256_set_key,
+ (nettle_set_key_func*) siv_cmac_aes256_set_key,
+ (nettle_encrypt_message_func*) siv_cmac_aes256_encrypt_message,
+ (nettle_decrypt_message_func*) siv_cmac_aes256_decrypt_message,
+};
+
+void
+test_main(void)
+{
+ /* The following tests were checked for interoperability against libaes_siv */
+
+ /*
+ * Example with small nonce, no AD and no plaintext
+ */
+ test_aead_message(&siv_cmac_aes128,
+		 SHEX("fffefdfc fbfaf9f8 f7f6f5f4 f3f2f1f0"
+		 "f0f1f2f3 f4f5f6f7 f8f9fafb fcfdfeff"),
+		 SHEX("01"),
+		 SHEX(""),
+		 SHEX(""),
+		 SHEX("c696f84f df92aba3 c31c23d5 f2087513"));
+ /*
+ * Example with small nonce, no AD and plaintext
+ */
+ test_aead_message(&siv_cmac_aes128,
+		 SHEX("fffefdfc fbfaf9f8 f7f6f5f4 f3f2f1f0"
+		 "f0f1f2f3 f4f5f6f7 f8f9fafb fcfdfeff"),
+		 SHEX("02"),
+		 SHEX(""),
+		 SHEX("00112233 44556677 8899aabb ccddeeff"),
+		 SHEX("5027b101 589747b8 865a9790 d3fd51d7"
+		 "1f259d40 5bfa260b 9ba1d60a a287fd0b"));
+
+ /*
+ * Example with length < 16
+ */
+ test_aead_message(&siv_cmac_aes128,
+		 SHEX("fffefdfc fbfaf9f8 f7f6f5f4 f3f2f1f0"
+		 "f0f1f2f3 f4f5f6f7 f8f9fafb fcfdfeff"),
+		 SHEX("02"),
+		 SHEX("10111213 14151617 18191a1b 1c1d1e1f"
+		 "20212223 24252627"),
+		 SHEX("11223344 55667788 99aabbcc ddee"),
+		 SHEX("7300cd9b 3f514a44 ed660db6 14157f59"
+		 "f0382e23 ae0e6e62 27a03dd3 2619"));
+
+ /*
+ * Example with length > 16
+ */
+ test_aead_message(&siv_cmac_aes128,
+		 SHEX("7f7e7d7c 7b7a7978 77767574 73727170"
+		 "40414243 44454647 48494a4b 4c4d4e4f"),
+		 SHEX("020304"),
+		 SHEX("00112233 44556677 8899aabb ccddeeff"
+		 "deaddada deaddada ffeeddcc bbaa9988"
+		 "77665544 33221100"),
+		 SHEX("74686973 20697320 736f6d65 20706c61"
+		 "696e7465 78742074 6f20656e 63727970"
+		 "74207573 696e6720 5349562d 414553"),
+		 SHEX("f1dba33d e5b3369e 883f67b6 fc823cee"
+		 "a4ffb87f dba97c89 44a62325 f133b4e0"
+		 "1ca55276 e2261c1a 1d1d4248 d1da30ba"
+		 "52b9c8d7 955d65c8 d2ce6eb7 e367d0"));
+
+ /*
+ * Example with single AAD, length > 16
+ */
+ test_aead_message(&siv_cmac_aes128,
+		 SHEX("7f7e7d7c 7b7a7978 77767574 73727170"
+		 "40414243 44454647 48494a4b 4c4d4e4f"),
+		 SHEX("09f91102 9d74e35b d84156c5 635688c0"),
+		 SHEX("00112233 44556677 8899aabb ccddeeff"
+		 "deaddada deaddada ffeeddcc bbaa9988"
+		 "77665544 33221100"),
+		 SHEX("74686973 20697320 736f6d65 20706c61"
+		 "696e7465 78742074 6f20656e 63727970"
+		 "74207573 696e6720 5349562d 414553"),
+		 SHEX("85825e22 e90cf2dd da2c548d c7c1b631"
+		 "0dcdaca0 cebf9dc6 cb90583f 5bf1506e"
+		 "02cd4883 2b00e4e5 98b2b22a 53e6199d"
+		 "4df0c166 6a35a043 3b250dc1 34d776"));
+
+ /*
+ * Example with single AAD, length < 16
+ */
+ test_aead_message(&siv_cmac_aes128,
+		 SHEX("7f7e7d7c 7b7a7978 77767574 73727170"
+		 "40414243 44454647 48494a4b 4c4d4e4f"),
+		 SHEX("09f91102 9d74e35b d84156c5 635688c0"),
+		 SHEX("00112233 44556677 8899aabb ccddeeff"
+		 "deaddada deaddada ffeeddcc bbaa9988"
+		 "77665544 33221100"),
+		 SHEX("11223344 55667788 99aabbcc ddee"),
+		 SHEX("15f83882 14bdc94e 3ec4c7c3 69863746"
+		 "cd72d317 4b20a1e4 a0894fb7 cd78"));
+
+ /* AES-SIV-CMAC-512 (AES-256) from dchest/siv repo
+ */
+ test_aead_message(&siv_cmac_aes256,
+		 SHEX("fffefdfc fbfaf9f8 f7f6f5f4 f3f2f1f0"
+		 "6f6e6d6c 6b6a6968 67666564 63626160"
+		 "f0f1f2f3 f4f5f6f7 f8f9fafb fcfdfeff"
+		 "00010203 04050607 08090a0b 0c0d0e0f"),
+		 SHEX("02"),
+		 SHEX("10111213 14151617 18191a1b 1c1d1e1f"
+		 "20212223 24252627"),
+		 SHEX("11223344 55667788 99aabbcc ddee"),
+		 SHEX("6f740b42 1e2972d8 5e76189e 99842843"
+		 "ad9e6ff1 4ea97c32 ab315e67 464c"));
+
+
+ /* AES-SIV-CMAC-512 (AES-256)
+ */
+ test_aead_message(&siv_cmac_aes256,
+		 SHEX("c27df2fd aec35d4a 2a412a50 c3e8c47d"
+		 "2d568e91 a38e5414 8abdc0b6 e86caf87"
+		 "695c0a8a df4c5f8e b2c6c8b1 36529864"
+		 "f3b84b3a e8e3676c e760c461 f3a13e83"),
+		 SHEX("02"),
+		 SHEX("10111213 14151617 18191a1b 1c1d1e1f"
+		 "20212223 24252627"),
+		 SHEX("11223344 55667788 99aabbcc ddee"),
+		 SHEX("c3366ef8 92911eac 3d17f29a 37d4ebad"
+		 "ddc1219e bbde06d1 ee893e55 a39f"));
+
+ /*
+ * Example with length > 16
+ */
+ test_aead_message(&siv_cmac_aes256,
+		 SHEX("c27df2fd aec35d4a 2a412a50 c3e8c47d"
+		 "2d568e91 a38e5414 8abdc0b6 e86caf87"
+		 "695c0a8a df4c5f8e b2c6c8b1 36529864"
+		 "f3b84b3a e8e3676c e760c461 f3a13e83"),
+		 SHEX("02"),
+		 SHEX("00112233 44556677 8899aabb ccddeeff"
+		 "deaddada deaddada ffeeddcc bbaa9988"
+		 "77665544 33221100"),
+		 SHEX("74686973 20697320 736f6d65 20706c61"
+		 "696e7465 78742074 6f20656e 63727970"
+		 "74207573 696e6720 5349562d 414553"),
+		 SHEX("bbe4751a 549d2fce 410c2efd e0df4d13"

_service:tar_scm:nettle-3.9.1.tar.gz/testsuite/siv-gcm-test.c Added

@@ -0,0 +1,620 @@
+/* siv-gcm-test.c
+
+   Self-test and vectors for AES-GCM-SIV mode ciphers
+
+   Copyright (C) 2022 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+/* The test vectors have been collected from the following standards:
+ * RFC8452
+ */
+
+#include "testutils.h"
+#include "ghash-internal.h"
+#include "block-internal.h"
+#include "aes.h"
+#include "siv-gcm.h"
+
+
+static const struct nettle_aead_message
+siv_gcm_aes128 = {
+  "siv_gcm_aes128",
+  sizeof(struct aes128_ctx),
+  AES128_KEY_SIZE,
+  SIV_GCM_DIGEST_SIZE,
+  1, /* Supports in-place operation. */
+  (nettle_set_key_func*) aes128_set_encrypt_key,
+  (nettle_set_key_func*) aes128_set_encrypt_key,
+  (nettle_encrypt_message_func*) siv_gcm_aes128_encrypt_message,
+  (nettle_decrypt_message_func*) siv_gcm_aes128_decrypt_message,
+};
+
+static const struct nettle_aead_message
+siv_gcm_aes256 = {
+  "siv_gcm_aes256",
+  sizeof(struct aes256_ctx),
+  AES256_KEY_SIZE,
+  SIV_GCM_DIGEST_SIZE,
+  1, /* Supports in-place operation. */
+  (nettle_set_key_func*) aes256_set_encrypt_key,
+  (nettle_set_key_func*) aes256_set_encrypt_key,
+  (nettle_encrypt_message_func*) siv_gcm_aes256_encrypt_message,
+  (nettle_decrypt_message_func*) siv_gcm_aes256_decrypt_message,
+};
+
+static void
+test_polyval_internal (const struct tstring *key,
+		       const struct tstring *message,
+		       const struct tstring *digest)
+{
+  ASSERT (key->length == GCM_BLOCK_SIZE);
+  ASSERT (message->length % GCM_BLOCK_SIZE == 0);
+  ASSERT (digest->length == GCM_BLOCK_SIZE);
+  struct gcm_key gcm_key;
+  union nettle_block16 state;
+
+  memcpy (state.b, key->data, GCM_BLOCK_SIZE);
+  _siv_ghash_set_key (&gcm_key, &state);
+
+  block16_zero (&state);
+  _siv_ghash_update (&gcm_key, &state, message->length / GCM_BLOCK_SIZE, message->data);
+  block16_bswap (&state, &state);
+
+  if (!MEMEQ(GCM_BLOCK_SIZE, state.b, digest->data))
+    {
+      fprintf (stderr, "POLYVAL failed\n");
+      fprintf (stderr, "Key: ");
+      tstring_print_hex (key);
+      fprintf (stderr, "\nMessage: ");
+      tstring_print_hex (message);
+      fprintf (stderr, "\nOutput: ");
+      print_hex (GCM_BLOCK_SIZE, state.b);
+      fprintf (stderr, "\nExpected:");
+      tstring_print_hex (digest);
+      fprintf (stderr, "\n");
+      FAIL();
+    }
+}
+
+void
+test_main(void)
+{
+  /* RFC8452, Appendix A.  */
+  test_polyval_internal (SHEX("25629347589242761d31f826ba4b757b"),
+			 SHEX("4f4f95668c83dfb6401762bb2d01a262"
+			      "d1a24ddd2721d006bbe45f20d3c9f362"),
+			 SHEX("f7a3b47b846119fae5b7866cf5e5b77e"));
+
+  /* RFC8452, Appendix C.1.  */
+  test_aead_message(&siv_gcm_aes128,
+		       SHEX("01000000000000000000000000000000"),
+		       SHEX("030000000000000000000000"),
+		       SHEX(""),
+		       SHEX(""),
+		       SHEX("dc20e2d83f25705bb49e439eca56de25"));
+
+  test_aead_message(&siv_gcm_aes128,
+		       SHEX("01000000000000000000000000000000"),
+		       SHEX("030000000000000000000000"),
+		       SHEX(""),
+		       SHEX("0100000000000000"),
+		       SHEX("b5d839330ac7b786578782fff6013b81"
+			    "5b287c22493a364c"));
+
+  test_aead_message(&siv_gcm_aes128,
+		       SHEX("01000000000000000000000000000000"),
+		       SHEX("030000000000000000000000"),
+		       SHEX(""),
+		       SHEX("010000000000000000000000"),
+		       SHEX("7323ea61d05932260047d942a4978db3"
+			    "57391a0bc4fdec8b0d106639"));
+
+  test_aead_message(&siv_gcm_aes128,
+		       SHEX("01000000000000000000000000000000"),
+		       SHEX("030000000000000000000000"),
+		       SHEX(""),
+		       SHEX("01000000000000000000000000000000"),
+		       SHEX("743f7c8077ab25f8624e2e948579cf77"
+			    "303aaf90f6fe21199c6068577437a0c4"));
+
+  test_aead_message(&siv_gcm_aes128,
+		       SHEX("01000000000000000000000000000000"),
+		       SHEX("030000000000000000000000"),
+		       SHEX(""),
+		       SHEX("01000000000000000000000000000000"
+			    "02000000000000000000000000000000"),
+		       SHEX("84e07e62ba83a6585417245d7ec413a9"
+			    "fe427d6315c09b57ce45f2e3936a9445"
+			    "1a8e45dcd4578c667cd86847bf6155ff"));
+
+  test_aead_message(&siv_gcm_aes128,
+		       SHEX("01000000000000000000000000000000"),
+		       SHEX("030000000000000000000000"),
+		       SHEX(""),
+		       SHEX("01000000000000000000000000000000"
+		            "02000000000000000000000000000000"
+		            "03000000000000000000000000000000"),
+		       SHEX("3fd24ce1f5a67b75bf2351f181a475c7"
+		            "b800a5b4d3dcf70106b1eea82fa1d64d"
+		            "f42bf7226122fa92e17a40eeaac1201b"
+		            "5e6e311dbf395d35b0fe39c2714388f8"));
+
+  test_aead_message(&siv_gcm_aes128,
+		       SHEX("01000000000000000000000000000000"),
+		       SHEX("030000000000000000000000"),
+		       SHEX(""),
+		       SHEX("01000000000000000000000000000000"
+		            "02000000000000000000000000000000"
+		            "03000000000000000000000000000000"
+		            "04000000000000000000000000000000"),
+		       SHEX("2433668f1058190f6d43e360f4f35cd8"
+		            "e475127cfca7028ea8ab5c20f7ab2af0"
+		            "2516a2bdcbc08d521be37ff28c152bba"
+		            "36697f25b4cd169c6590d1dd39566d3f"
+		            "8a263dd317aa88d56bdf3936dba75bb8"));
+
+  test_aead_message(&siv_gcm_aes128,
+		       SHEX("01000000000000000000000000000000"),
+		       SHEX("030000000000000000000000"),
+		       SHEX("01"),
+		       SHEX("0200000000000000"),
+		       SHEX("1e6daba35669f4273b0a1a2560969cdf"
+		            "790d99759abd1508"));
+
+  test_aead_message(&siv_gcm_aes128,
+		       SHEX("01000000000000000000000000000000"),
+		       SHEX("030000000000000000000000"),
+		       SHEX("01"),
+		       SHEX("020000000000000000000000"),
+		       SHEX("296c7889fd99f41917f4462008299c51"
+		            "02745aaa3a0c469fad9e075a"));
+
+  test_aead_message(&siv_gcm_aes128,
+		       SHEX("01000000000000000000000000000000"),

_service:tar_scm:nettle-3.9.1.tar.gz/testsuite/sm4-test.c Added

_service:tar_scm:nettle-3.8.1.tar.gz/testsuite/testutils.c -> _service:tar_scm:nettle-3.9.1.tar.gz/testsuite/testutils.c Changed

@@ -798,91 +798,266 @@
 	 const struct tstring *digest)
 {
 void *ctx = xalloc(aead->context_size);
- uint8_t *data;
- uint8_t *buffer = xalloc(aead->digest_size);
- size_t offset;
+ uint8_t *in, *out;
+ uint8_t *buffer;
+ unsigned in_align;
 
 ASSERT (cleartext->length == ciphertext->length);
-
 ASSERT (key->length == aead->key_size);
-
- data = xalloc(cleartext->length);
-
 ASSERT(aead->block_size > 0);
 
- for (offset = 0; offset <= cleartext->length; offset += aead->block_size)
- {
- /* encryption */
- aead->set_encrypt_key(ctx, key->data);
-
- if (nonce->length != aead->nonce_size)
-	{
-	 ASSERT (set_nonce);
-	 set_nonce (ctx, nonce->length, nonce->data);
-	}
- else
-	aead->set_nonce(ctx, nonce->data);
-
- if (aead->update && authtext->length)
-	aead->update(ctx, authtext->length, authtext->data);
-
- if (offset > 0)
-	aead->encrypt(ctx, offset, data, cleartext->data);
+ buffer = xalloc(aead->digest_size);
+ in = xalloc(cleartext->length + aead->block_size - 1);
+ out = xalloc(cleartext->length + aead->block_size - 1);
 
- if (offset < cleartext->length)
-	aead->encrypt(ctx, cleartext->length - offset,
-		 data + offset, cleartext->data + offset);
-
- if (digest)
-	{
-	 ASSERT (digest->length <= aead->digest_size);
-	 memset(buffer, 0, aead->digest_size);
-	 aead->digest(ctx, digest->length, buffer);
-	 ASSERT(MEMEQ(digest->length, buffer, digest->data));
-	}
- else
-	ASSERT(!aead->digest);
-
- ASSERT(MEMEQ(cleartext->length, data, ciphertext->data));
-
- /* decryption */
- if (aead->set_decrypt_key)
+ for (in_align = 0; in_align < aead->block_size; in_align++)
+ {
+ /* Different alignment, but don't try all combinations. */
+ unsigned out_align = 3*in_align % aead->block_size;
+ size_t offset;
+ memcpy (in + in_align, cleartext->data, cleartext->length);
+ for (offset = 0; offset <= cleartext->length; offset += aead->block_size)
 	{
-	 aead->set_decrypt_key(ctx, key->data);
+	 /* encryption */
+	 aead->set_encrypt_key(ctx, key->data);
 
-	 if (nonce->length != aead->nonce_size)
-	 {
-	 ASSERT (set_nonce);
+	 if (set_nonce)
 	 set_nonce (ctx, nonce->length, nonce->data);
-	 }
 	 else
-	 aead->set_nonce(ctx, nonce->data);
-
+	 {
+	 assert (nonce->length == aead->nonce_size);
+	 aead->set_nonce(ctx, nonce->data);
+	 }
 	 if (aead->update && authtext->length)
 	 aead->update(ctx, authtext->length, authtext->data);
 
 	 if (offset > 0)
-	 aead->decrypt (ctx, offset, data, data);
+	 aead->encrypt(ctx, offset, out + out_align, in + in_align);
 
 	 if (offset < cleartext->length)
-	 aead->decrypt(ctx, cleartext->length - offset,
-			 data + offset, data + offset);
+	 aead->encrypt(ctx, cleartext->length - offset,
+			 out + out_align + offset, in + in_align + offset);
 
+	 if (!MEMEQ(cleartext->length, out + out_align, ciphertext->data))
+	 {
+	 fprintf(stderr, "aead->encrypt failed (offset = %u):\nclear: ",
+		 (unsigned) offset);
+	 tstring_print_hex(cleartext);
+	 fprintf(stderr, " got: ");
+	 print_hex(cleartext->length, out + out_align);
+	 fprintf(stderr, " exp: ");
+	 tstring_print_hex(ciphertext);
+	 FAIL();
+	 }
 	 if (digest)
 	 {
+	 ASSERT (digest->length <= aead->digest_size);
 	 memset(buffer, 0, aead->digest_size);
 	 aead->digest(ctx, digest->length, buffer);
-	 ASSERT(MEMEQ(digest->length, buffer, digest->data));
+	 if (!MEMEQ(digest->length, buffer, digest->data))
+		{
+		 fprintf(stderr, "aead->digest failed (offset = %u):\n got: ",
+			 (unsigned) offset);
+		 print_hex(digest->length, buffer);
+		 fprintf(stderr, " exp: ");
+		 tstring_print_hex(digest);
+		 FAIL();
+		}
+	 }
+	 else
+	 ASSERT(!aead->digest);
+
+	 /* decryption */
+	 if (aead->set_decrypt_key)
+	 {
+	 aead->set_decrypt_key(ctx, key->data);
+
+	 if (set_nonce)
+		set_nonce (ctx, nonce->length, nonce->data);
+	 else
+		{
+		 assert (nonce->length == aead->nonce_size);
+		 aead->set_nonce(ctx, nonce->data);
+		}
+
+	 if (aead->update && authtext->length)
+		aead->update(ctx, authtext->length, authtext->data);
+
+	 if (offset > 0)
+		aead->decrypt (ctx, offset, out + out_align, out + out_align);
+
+	 if (offset < cleartext->length)
+		aead->decrypt(ctx, cleartext->length - offset,
+			 out + out_align + offset, out + out_align + offset);
+
+	 ASSERT(MEMEQ(cleartext->length, out + out_align, cleartext->data));
+
+	 if (digest)
+		{
+		 memset(buffer, 0, aead->digest_size);
+		 aead->digest(ctx, digest->length, buffer);
+		 ASSERT(MEMEQ(digest->length, buffer, digest->data));
+		}
 	 }
-	 ASSERT(MEMEQ(cleartext->length, data, cleartext->data));
 	}
 }
 free(ctx);
- free(data);
+ free(in);
+ free(out);
 free(buffer);
 }
 
 void
+test_aead_message (const struct nettle_aead_message *aead,
+		 const struct tstring *key,
+		 const struct tstring *nonce,
+		 const struct tstring *adata,
+		 const struct tstring *clear,
+		 const struct tstring *cipher)
+{
+ void *ctx = xalloc (aead->context_size);
+ uint8_t *buf = xalloc (cipher->length + 1);
+ uint8_t *copy = xalloc (cipher->length);
+
+ static const uint8_t nul = 0;
+ int res;
+
+ ASSERT (key->length == aead->key_size);
+ ASSERT (cipher->length > clear->length);
+ ASSERT (cipher->length - clear->length == aead->digest_size);
+
+ aead->set_encrypt_key (ctx, key->data);
+ bufcipher->length = 0xae;
+ aead->encrypt (ctx,
+		 nonce->length, nonce->data,
+		 adata->length, adata->data,
+		 cipher->length, buf, clear->data);
+ if (!MEMEQ (cipher->length, cipher->data, buf))
+ {
+ fprintf(stderr, "aead->encrypt (message) failed:\n got: ");
+ print_hex (cipher->length, buf);
+ fprintf (stderr, " exp: ");
+ tstring_print_hex (cipher);

_service:tar_scm:nettle-3.8.1.tar.gz/testsuite/testutils.h -> _service:tar_scm:nettle-3.9.1.tar.gz/testsuite/testutils.h Changed

@@ -37,9 +37,6 @@
 
 #include "nettle-meta.h"
 
-/* Forward declare */
-struct nettle_aead;
-
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -82,7 +79,31 @@
 
 extern int verbose;
 
-/* Test functions deallocate their inputs when finished.*/
+typedef void
+nettle_encrypt_message_func(void *ctx,
+			    size_t nlength, const uint8_t *nonce,
+			    size_t alength, const uint8_t *adata,
+			    size_t clength, uint8_t *dst, const uint8_t *src);
+
+typedef int
+nettle_decrypt_message_func(void *ctx,
+			    size_t nlength, const uint8_t *nonce,
+			    size_t alength, const uint8_t *adata,
+			    size_t mlength, uint8_t *dst, const uint8_t *src);
+
+struct nettle_aead_message
+{
+  const char *name;
+  unsigned context_size;
+  unsigned key_size;
+  unsigned digest_size;
+  int supports_inplace;
+  nettle_set_key_func *set_encrypt_key;
+  nettle_set_key_func *set_decrypt_key;
+  nettle_encrypt_message_func *encrypt;
+  nettle_decrypt_message_func *decrypt;
+};
+
 void
 test_cipher(const struct nettle_cipher *cipher,
 	    const struct tstring *key,
@@ -134,6 +155,14 @@
 	  const struct tstring *digest);
 
 void
+test_aead_message(const struct nettle_aead_message *aead,
+		  const struct tstring *key,
+		  const struct tstring *adata,
+		  const struct tstring *nonce,
+		  const struct tstring *clear,
+		  const struct tstring *cipher);
+
+void
 test_hash(const struct nettle_hash *hash,
 	  const struct tstring *msg,
 	  const struct tstring *digest);
@@ -164,8 +193,10 @@
 void gmp_randinit_default (struct knuth_lfib_ctx *ctx);
 #define gmp_randclear(state)
 void mpz_urandomb (mpz_t r, struct knuth_lfib_ctx *ctx, mp_bitcnt_t bits);
+void mpz_urandomm (mpz_t r, struct knuth_lfib_ctx *ctx, const mpz_t n);
 /* This is cheating */
 #define mpz_rrandomb mpz_urandomb
+#define mpz_rrandomm mpz_urandomm
 static inline int
 test_randomize (gmp_randstate_t rands UNUSED) { return 0; }
 #else /* !NETTLE_USE_MINI_GMP */

_service:tar_scm:nettle-3.8.1.tar.gz/x86_64/aesni/cbc-aes128-encrypt.asm -> _service:tar_scm:nettle-3.9.1.tar.gz/x86_64/aesni/cbc-aes128-encrypt.asm Changed

_service:tar_scm:nettle-3.8.1.tar.gz/x86_64/aesni/cbc-aes192-encrypt.asm -> _service:tar_scm:nettle-3.9.1.tar.gz/x86_64/aesni/cbc-aes192-encrypt.asm Changed

_service:tar_scm:nettle-3.8.1.tar.gz/x86_64/aesni/cbc-aes256-encrypt.asm -> _service:tar_scm:nettle-3.9.1.tar.gz/x86_64/aesni/cbc-aes256-encrypt.asm Changed

_service:tar_scm:nettle-3.8.1.tar.gz/x86_64/ecc-secp192r1-modp.asm -> _service:tar_scm:nettle-3.9.1.tar.gz/x86_64/ecc-secp192r1-modp.asm Changed

_service:tar_scm:nettle-3.8.1.tar.gz/x86_64/ecc-secp224r1-modp.asm -> _service:tar_scm:nettle-3.9.1.tar.gz/x86_64/ecc-secp224r1-modp.asm Changed

_service:tar_scm:nettle-3.9.1.tar.gz/x86_64/fat/sha256-compress-n-2.asm Added

@@ -0,0 +1,34 @@
+C x86_64/fat/sha256-compress-n-2.asm
+
+ifelse(`
+   Copyright (C) 2018 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+')
+
+define(`fat_transform', `$1_sha_ni')
+include_src(`x86_64/sha_ni/sha256-compress-n.asm')

_service:tar_scm:nettle-3.9.1.tar.gz/x86_64/fat/sha256-compress-n.asm Added

@@ -0,0 +1,34 @@
+C x86_64/fat/sha256-compress-n.asm
+
+ifelse(`
+   Copyright (C) 2018 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+')
+
+define(`fat_transform', `$1_x86_64')
+include_src(`x86_64/sha256-compress-n.asm')

_service:tar_scm:nettle-3.8.1.tar.gz/x86_64/ghash-update.asm -> _service:tar_scm:nettle-3.9.1.tar.gz/x86_64/ghash-update.asm Changed

@@ -36,15 +36,16 @@
 define(`XP', `%rsi')
 define(`BLOCKS', `%rdx')
 define(`SRC', `%rcx')
-define(`X0', `%rax')
-define(`X1', `%rbx')
-define(`CNT', `%ebp')
-define(`T0', `%r8')
-define(`T1', `%r9')
-define(`T2', `%r10')
-define(`Z0', `%r11')
-define(`Z1', `%r12')
-define(`SHIFT_TABLE', `%r13')
+define(`CNT', `%rax')
+define(`KEY32', `%r8')
+define(`X', `%xmm0')
+define(`R', `%xmm1')
+define(`M0', `%xmm2')
+define(`M1', `%xmm3')
+define(`M2', `%xmm4')
+define(`M3', `%xmm5')
+define(`T0', `%xmm6')
+define(`T1', `%xmm7')
 
 	.file "ghash-update.asm"
 
@@ -55,150 +56,58 @@
 	.text
 	ALIGN(16)
 PROLOGUE(_nettle_ghash_update)
-	W64_ENTRY(4, 0)
-	push	%rbx
-	push	%rbp
-	push	%r12
-	push	%r13
+	W64_ENTRY(4, 8)
 	sub	$1, BLOCKS
-	lea	.Lshift_table(%rip), SHIFT_TABLE
-	mov	(XP), X0
-	mov	8(XP), X1
+	movups	(XP), X
 	jc	.Ldone
-ALIGN(16)
-.Lblock_loop:
-
-	xor (SRC), X0
-	xor 8(SRC), X1
-
-.Lblock_mul:
-	rol	$8, X1
-	movzbl	LREG(X1), XREG(T1)
-	shl	$4, T1
-	mov	(KEY, T1), Z0
-	mov	8(KEY, T1), Z1
-
-	C shift Z1, Z0, transforming
-	C +-----------------------+-----------------------+
-	C |15 14 13 12 11 10 09 08|07 06 05 04 03 02 01 00|
-	C +-----------------------+-----------------------+
-	C into
-	C +-----------------------+-----------------------+
-	C |14 13 12 11 10 09 08 07|06 05 04 03 02 01 00   |
-	C +-----------------------+-----------------+-----+
-	C                               xor         |T15|
-	C                                           +-----+
-
-	mov	$7, CNT
+	C Table offset corresponding to 32 bits.
+	lea	1024(KEY), KEY32
 
 ALIGN(16)
-.Loop_X1:
-	mov	Z1, T1
-	shr	$56, T1
-	shl	$8, Z1
-	mov	Z0, T0
-	shl	$8, Z0
-	shr	$56, T0
-	movzwl	(SHIFT_TABLE, T1, 2), XREG(T1)
-	xor	T1, Z0
-	rol	$8, X1
-	movzbl	LREG(X1), XREG(T2)
-	shl	$4, T2
-	xor	(KEY, T2), Z0
-	add	T0, Z1
-	xor	8(KEY, T2), Z1
-	decl	CNT
-	jne	.Loop_X1
-
-	mov	$7, CNT
-
+.Lblock_loop:
+	C Unaligned input
+	movups	(SRC), M0
+	pxor	M0, X
+	pxor	R, R
+	mov	$992, CNT
 ALIGN(16)
-.Loop_X0:
-	mov	Z1, T1
-	shr	$56, T1
-	shl	$8, Z1
-	mov	Z0, T0
-	shl	$8, Z0
-	shr	$56, T0
-	movzwl	(SHIFT_TABLE, T1, 2), XREG(T1)
-	xor	T1, Z0
-	rol	$8, X0
-	movzbl	LREG(X0), XREG(T2)
-	shl	$4, T2
-	xor	(KEY, T2), Z0
-	add	T0, Z1
-	xor	8(KEY, T2), Z1
-	decl	CNT
-	jne	.Loop_X0
-
-	mov	Z1, T1
-	shr	$56, T1
-	shl	$8, Z1
-	mov	Z0, T0
-	shl	$8, Z0
-	shr	$56, T0
-	movzwl	(SHIFT_TABLE, T1, 2), XREG(T1)
-	xor	T1, Z0
-	rol	$8, X0
-	movzbl	LREG(X0), XREG(T2)
-	shl	$4, T2
-	mov	(KEY, T2), X0
-	xor	Z0, X0
-	add	T0, Z1
-	mov	8(KEY, T2), X1
-	xor	Z1, X1
+.Loop_bit:
+	movdqa	X, M3
+	psrad	$31, M3
+	pshufd	$0x00, M3, M0
+	pshufd	$0x55, M3, M1
+	pshufd	$0xaa, M3, M2
+	pshufd	$0xff, M3, M3
+	pslld	$1, X
+	C Tabulated values are only 8-byte aligned, and therefore
+	C can't be used as memory operands to pand. It would be nice
+	C if we could force 16-byte alignment on nettle_block16, using
+	C C11 alignas.
+	movups	(KEY, CNT), T0
+	movups	(KEY32, CNT), T1
+	pand	T0, M0
+	pand	T1, M1
+	movups	16(KEY, CNT), T0
+	movups	16(KEY32, CNT), T1
+	pand	T0, M2
+	pand	T1, M3
+	pxor	M0, M1
+	pxor	M2, M3
+	pxor	M1, R
+	pxor	M3, R
+
+	sub	$32, CNT
+	jnc	.Loop_bit
+
+	movaps	R, X
 
 	add	$16, SRC
 	sub	$1, BLOCKS
 	jnc	.Lblock_loop
 
 .Ldone:
-	mov	X0, (XP)
-	mov	X1, 8(XP)
+	movups	X, (XP)
 	mov	SRC, %rax
-	pop	%r13
-	pop	%r12
-	pop	%rbp
-	pop	%rbx
-	W64_EXIT(4, 0)
+	W64_EXIT(4, 8)
 	ret
 EPILOGUE(_nettle_ghash_update)
-
-define(`W', `0x$2$1')
-	RODATA
-	ALIGN(2)
-C NOTE: Sun/Oracle assembler doesn't support ".short".
-C Using ".value" seems more portable.
-.Lshift_table:
-.value W(00,00),W(01,c2),W(03,84),W(02,46),W(07,08),W(06,ca),W(04,8c),W(05,4e)
-.value W(0e,10),W(0f,d2),W(0d,94),W(0c,56),W(09,18),W(08,da),W(0a,9c),W(0b,5e)
-.value W(1c,20),W(1d,e2),W(1f,a4),W(1e,66),W(1b,28),W(1a,ea),W(18,ac),W(19,6e)
-.value W(12,30),W(13,f2),W(11,b4),W(10,76),W(15,38),W(14,fa),W(16,bc),W(17,7e)
-.value W(38,40),W(39,82),W(3b,c4),W(3a,06),W(3f,48),W(3e,8a),W(3c,cc),W(3d,0e)
-.value W(36,50),W(37,92),W(35,d4),W(34,16),W(31,58),W(30,9a),W(32,dc),W(33,1e)
-.value W(24,60),W(25,a2),W(27,e4),W(26,26),W(23,68),W(22,aa),W(20,ec),W(21,2e)
-.value W(2a,70),W(2b,b2),W(29,f4),W(28,36),W(2d,78),W(2c,ba),W(2e,fc),W(2f,3e)
-.value W(70,80),W(71,42),W(73,04),W(72,c6),W(77,88),W(76,4a),W(74,0c),W(75,ce)
-.value W(7e,90),W(7f,52),W(7d,14),W(7c,d6),W(79,98),W(78,5a),W(7a,1c),W(7b,de)
-.value W(6c,a0),W(6d,62),W(6f,24),W(6e,e6),W(6b,a8),W(6a,6a),W(68,2c),W(69,ee)
-.value W(62,b0),W(63,72),W(61,34),W(60,f6),W(65,b8),W(64,7a),W(66,3c),W(67,fe)
-.value W(48,c0),W(49,02),W(4b,44),W(4a,86),W(4f,c8),W(4e,0a),W(4c,4c),W(4d,8e)
-.value W(46,d0),W(47,12),W(45,54),W(44,96),W(41,d8),W(40,1a),W(42,5c),W(43,9e)

_service:tar_scm:nettle-3.8.1.tar.gz/x86_64/pclmul/ghash-set-key.asm -> _service:tar_scm:nettle-3.9.1.tar.gz/x86_64/pclmul/ghash-set-key.asm Changed

@@ -2,6 +2,7 @@
 
 ifelse(`
    Copyright (C) 2022 Niels Möller
+   Copyright (C) 2023 Mamone Tarsha
 
    This file is part of GNU Nettle.
 
@@ -39,12 +40,15 @@
 define(`H', `%xmm2')
 define(`D', `%xmm3')
 define(`T', `%xmm4')
-define(`MASK', `%xmm5')
+define(`R', `%xmm5')
+define(`M', `%xmm6')
+define(`F', `%xmm7')
+define(`MASK', `%xmm7')
 
     C void _ghash_set_key (struct gcm_key *ctx, const union nettle_block16 *key)
 
 PROLOGUE(_nettle_ghash_set_key)
-	W64_ENTRY(2, 6)
+	W64_ENTRY(2, 8)
 	movdqa	.Lpolynomial(%rip), P
 	movdqa	.Lbswap(%rip), BSWAP
 	movups	(KEY), H
@@ -63,11 +67,35 @@
 	movups	H, (CTX)
 
 	C Set D = x^{-64} H = {H0, H1} + P1 H0
+	movdqa	H, T
+	pshufd	$0x4e, H, D	C Swap H0, H1
+	pclmullqhqdq P, T
+	pxor	T, D
+	movups	D, 16(CTX)
+
+	movdqa		H, M
+	movdqa		H, F
+	movdqa		H, T
+	pclmulhqlqdq	H, T	C H0 * M1
+	pclmulhqhqdq	H, M	C H1 * M1
+	pclmullqlqdq	D, F 	C D0 * M0
+	pclmullqhqdq	D, H	C D1 * M0
+	pxor		T, F
+	pxor		M, H
+
+	pshufd		$0x4e, F, T		C Swap halves of F
+	pxor		T, H
+	pclmullqhqdq	P, F
+	pxor		F, H
+	movups	H, 32(CTX)
+
+	C Set D2 = x^{-64} H^2 = {H0, H1} + P1 H0
 	pshufd	$0x4e, H, D	C Swap H0, H1
 	pclmullqhqdq P, H
 	pxor	H, D
-	movups	D, 16(CTX)
-	W64_EXIT(2, 6)
+	movups	D, 48(CTX)
+
+	W64_EXIT(2, 8)
 	ret
 EPILOGUE(_nettle_ghash_set_key)

_service:tar_scm:nettle-3.8.1.tar.gz/x86_64/pclmul/ghash-update.asm -> _service:tar_scm:nettle-3.9.1.tar.gz/x86_64/pclmul/ghash-update.asm Changed

@@ -2,6 +2,7 @@
 
 ifelse(`
    Copyright (C) 2022 Niels Möller
+   Copyright (C) 2023 Mamone Tarsha
 
    This file is part of GNU Nettle.
 
@@ -41,11 +42,16 @@
 define(`BSWAP', `%xmm1')
 define(`H', `%xmm2')
 define(`D', `%xmm3')
-define(`T', `%xmm4')
-
-define(`R', `%xmm5')
-define(`M', `%xmm6')
-define(`F', `%xmm7')
+define(`H2', `%xmm4')
+define(`D2', `%xmm5')
+define(`T', `%xmm6')
+define(`R', `%xmm7')
+define(`M', `%xmm8')
+define(`F', `%xmm9')
+define(`T2', `%xmm10')
+define(`R2', `%xmm11')
+define(`M2', `%xmm12')
+define(`F2', `%xmm13')
 
 C Use pclmulqdq, doing one 64x64 --> 127 bit carry-less multiplication,
 C with source operands being selected from the halves of two 128-bit registers.
@@ -80,21 +86,66 @@
 	C				size_t blocks, const uint8_t *data)
 
 PROLOGUE(_nettle_ghash_update)
-	W64_ENTRY(4, 8)
+	W64_ENTRY(4, 14)
 	movdqa		.Lpolynomial(%rip), P
 	movdqa		.Lbswap(%rip), BSWAP
 	movups		(CTX), H
 	movups		16(CTX), D
+	movups		32(CTX), H2
+	movups		48(CTX), D2
 	movups		(X), R
 	pshufb		BSWAP, R
 
-	sub		$1, BLOCKS
-	jc		.Ldone
+	mov		BLOCKS, %rax
+	shr		$1, %rax
+	jz		.L1_block
 
 .Loop:
 	movups		(DATA), M
 	pshufb		BSWAP, M
-.Lblock:
+	pxor		M, R
+	movdqa		R, M
+	movdqa		R, F
+	movdqa		R, T
+	pclmullqlqdq	D2, F 	C {D^2}0 * M1_0
+	pclmullqhqdq	D2, R	C {D^2}1 * M1_0
+	pclmulhqlqdq	H2, T	C {H^2}0 * M1_1
+	pclmulhqhqdq	H2, M	C {H^2}1 * M1_1
+	
+
+	movups		16(DATA), M2
+	pshufb		BSWAP, M2
+	movdqa		M2, R2
+	movdqa		M2, F2
+	movdqa		M2, T2
+	pclmullqlqdq	D, F2 	C D0 * M2_0
+	pclmullqhqdq	D, R2	C D1 * M2_0
+	pclmulhqlqdq	H, T2	C H0 * M2_1
+	pclmulhqhqdq	H, M2	C H1 * M2_1
+
+	pxor		T, F
+	pxor		M, R
+	pxor		T2, F2
+	pxor		M2, R2
+
+	pxor		F2, F
+	pxor		R2, R
+
+	pshufd		$0x4e, F, T		C Swap halves of F
+	pxor		T, R
+	pclmullqhqdq	P, F
+	pxor		F, R
+
+	add		$32, DATA
+	dec		%rax
+	jnz		.Loop
+
+.L1_block:
+	test		$1, BLOCKS
+	jz		.Ldone
+
+	movups		(DATA), M
+	pshufb		BSWAP, M
 	pxor		M, R
 	movdqa		R, M
 	movdqa		R, F
@@ -112,14 +163,12 @@
 	pxor		F, R
 
 	add		$16, DATA
-	sub		$1, BLOCKS
-	jnc		.Loop
 
 .Ldone:
 	pshufb		BSWAP, R
 	movups		R, (X)
 	mov		DATA, %rax
-	W64_EXIT(4, 8)
+	W64_EXIT(4, 14)
 	ret
 EPILOGUE(_nettle_ghash_update)

_service:tar_scm:nettle-3.9.1.tar.gz/x86_64/poly1305-blocks.asm Added

@@ -0,0 +1,128 @@
+C x86_64/poly1305-blocks.asm
+
+ifelse(`
+   Copyright (C) 2022 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+')
+
+	.file "poly1305-blocks.asm"
+
+define(`CTX', `%rdi') C First argument to all functions
+define(`BLOCKS', `%rsi')
+define(`MP_PARAM', `%rdx')	C Moved to MP, to not collide with mul instruction.
+
+define(`MP', `%r8')		C May clobber, both with unix and windows conventions.
+define(`T0', `%rbx')
+define(`T1', `%rcx')
+define(`H0', `%rbp')
+define(`H1', `%r9')
+define(`H2', `%r10')
+define(`F0', `%r11')
+define(`F1', `%r12')
+
+C const uint8_t *
+C _nettle_poly1305_blocks (struct poly1305_ctx *ctx, size_t blocks, const uint8_t *m)
+
+PROLOGUE(_nettle_poly1305_blocks)
+	W64_ENTRY(3, 0)
+	mov	MP_PARAM, MP
+	test	BLOCKS, BLOCKS
+	jz	.Lend
+
+	push 	%rbx
+	push 	%rbp
+	push	%r12
+	mov	P1305_H0 (CTX), H0
+	mov	P1305_H1 (CTX), H1
+	mov	P1305_H2 (CTX), H2
+	ALIGN(16)
+.Loop:
+	mov	(MP), T0
+	mov	8(MP), T1
+	add	$16, MP
+
+	add	H0, T0
+	adc	H1, T1
+	adc	$1, H2
+
+	mov	P1305_R1 (CTX), %rax
+	mul	T0			C R1*T0
+	mov	%rax, F0
+	mov	%rdx, F1
+
+	mov	T0, %rax		C Last use of T0 input
+	mov	P1305_R0 (CTX), T0
+	mul	T0			C R0*T0
+	mov	%rax, H0
+	mov	%rdx, H1
+
+	mov	T1, %rax
+	mul	T0			C R0*T1
+	add	%rax, F0
+	adc	%rdx, F1
+
+	mov	P1305_S1 (CTX), T0
+	mov	T1, %rax		C Last use of T1 input
+	mul	T0			C S1*T1
+	add	%rax, H0
+	adc	%rdx, H1
+
+	mov	H2, %rax
+	mul	T0			C S1*H2
+	add	%rax, F0
+	adc	%rdx, F1
+
+	mov	H2, T0
+	and	$3, H2
+
+	shr	$2, T0
+	mov	P1305_S0 (CTX), %rax
+	mul	T0			C S0*(H2 >> 2)
+	add	%rax, H0
+	adc	%rdx, H1
+
+	imul	P1305_R0 (CTX), H2	C R0*(H2 & 3)
+	add 	F0, H1
+	adc	F1, H2
+
+	dec	BLOCKS
+	jnz	.Loop
+
+	mov	H0, P1305_H0 (CTX)
+	mov	H1, P1305_H1 (CTX)
+	mov	H2, P1305_H2 (CTX)
+
+	pop	%r12
+	pop	%rbp
+	pop 	%rbx
+
+.Lend:
+	mov	MP, %rax
+	W64_EXIT(3, 0)
+	ret
+EPILOGUE(_nettle_poly1305_blocks)

_service:tar_scm:nettle-3.8.1.tar.gz/x86_64/poly1305-internal.asm -> _service:tar_scm:nettle-3.9.1.tar.gz/x86_64/poly1305-internal.asm Changed

_service:tar_scm:nettle-3.9.1.tar.gz/x86_64/sha256-compress-n.asm Added

@@ -0,0 +1,233 @@
+C x86_64/sha256-compress-n.asm
+
+ifelse(`
+ Copyright (C) 2013, 2022 Niels Möller
+
+ This file is part of GNU Nettle.
+
+ GNU Nettle is free software: you can redistribute it and/or
+ modify it under the terms of either:
+
+ * the GNU Lesser General Public License as published by the Free
+ Software Foundation; either version 3 of the License, or (at your
+ option) any later version.
+
+ or
+
+ * the GNU General Public License as published by the Free
+ Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+
+ or both in parallel, as here.
+
+ GNU Nettle is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ General Public License for more details.
+
+ You should have received copies of the GNU General Public License and
+ the GNU Lesser General Public License along with this program. If
+ not, see http://www.gnu.org/licenses/.
+')
+
+	.file "sha256-compress-n.asm"
+define(`STATE', `%rdi')
+define(`K', `%rsi')
+define(`BLOCKS', `%rdx')
+define(`INPUT', `%rcx')
+define(`STATE_SAVED', `64(%rsp)')
+
+define(`SA', `%eax')
+define(`SB', `%ebx')
+define(`SC', `%ebp')
+define(`SD', `%r8d')
+define(`SE', `%r9d')
+define(`SF', `%r10d')
+define(`SG', `%r11d')
+define(`SH', `%r12d')
+define(`T0', `%r13d')
+define(`T1', `%r14d')
+define(`COUNT', `%rdi')	C Overlap STATE
+define(`W', `%r15d')
+
+define(`EXPN', `
+	movl	OFFSET($1)(%rsp), W
+	movl	OFFSET(eval(($1 + 14) % 16))(%rsp), T0
+	movl	T0, T1
+	shrl	`$'10, T0
+	roll	`$'13, T1
+	xorl	T1, T0
+	roll	`$'2, T1
+	xorl	T1, T0
+	addl	T0, W
+	movl	OFFSET(eval(($1 + 1) % 16))(%rsp), T0
+	movl	T0, T1
+	shrl	`$'3, T0
+	roll	`$'14, T1
+	xorl	T1, T0
+	roll	`$'11, T1
+	xorl	T1, T0
+	addl	T0, W
+	addl	OFFSET(eval(($1 + 9) % 16))(%rsp), W
+	movl	W, OFFSET($1)(%rsp)
+')
+
+C ROUND(A,B,C,D,E,F,G,H,K)
+C
+C H += S1(E) + Choice(E,F,G) + K + W
+C D += H
+C H += S0(A) + Majority(A,B,C)
+C
+C Where
+C
+C S1(E) = E<<<26 ^ E<<<21 ^ E<<<7
+C S0(A) = A<<<30 ^ A<<<19 ^ A<<<10
+C Choice (E, F, G) = G^(E&(F^G))
+C Majority (A,B,C) = (A&B) + (C&(A^B))
+
+define(`ROUND', `
+	movl	$5, T0
+	movl	$5, T1
+	roll	`$'7, T0
+	roll	`$'21, T1
+	xorl	T0, T1
+	roll	`$'19, T0
+	xorl	T0, T1
+	addl	W, $8
+	addl	T1, $8
+	movl	$7, T0
+	xorl	$6, T0
+	andl	$5, T0
+	xorl	$7, T0
+	addl	OFFSET($9)(K,COUNT,4), $8
+	addl	T0, $8
+	addl	$8, $4
+
+	movl	$1, T0
+	movl	$1, T1
+	roll	`$'10, T0
+	roll	`$'19, T1
+	xorl	T0, T1
+	roll	`$'20, T0
+	xorl	T0, T1
+	addl	T1, $8
+	movl	$1, T0
+	movl	$1, T1
+	andl	$2, T0
+	xorl	$2, T1
+	addl	T0, $8
+	andl	$3, T1
+	addl	T1, $8
+')
+
+define(`NOEXPN', `
+	movl	OFFSET($1)(INPUT, COUNT, 4), W
+	bswapl	W
+	movl	W, OFFSET($1)(%rsp, COUNT, 4)
+')
+
+	C const uint8_t *
+	C _nettle_sha256_compress_n(uint32_t *state, const uint32_t *k,
+	C size_t blocks, const uint8_t *input)
+
+	.text
+	ALIGN(16)
+
+PROLOGUE(_nettle_sha256_compress_n)
+	W64_ENTRY(4, 0)
+	test	BLOCKS, BLOCKS
+	jz	.Lend
+
+	sub	$120, %rsp
+	mov	STATE, STATE_SAVED	C Save state, to free a register
+	mov	%rbx, 72(%rsp)
+	mov	%rbp, 80(%rsp)
+	mov	%r12, 88(%rsp)
+	mov	%r13, 96(%rsp)
+	mov	%r14, 104(%rsp)
+	mov	%r15, 112(%rsp)
+
+	movl	(STATE), SA
+	movl	4(STATE), SB
+	movl	8(STATE), SC
+	movl	12(STATE), SD
+	movl	16(STATE), SE
+	movl	20(STATE), SF
+	movl	24(STATE), SG
+	movl	28(STATE), SH
+
+.Loop_block:
+	xorl	XREG(COUNT), XREG(COUNT)
+	ALIGN(16)
+
+.Loop1:
+	NOEXPN(0) ROUND(SA,SB,SC,SD,SE,SF,SG,SH,0)
+	NOEXPN(1) ROUND(SH,SA,SB,SC,SD,SE,SF,SG,1)
+	NOEXPN(2) ROUND(SG,SH,SA,SB,SC,SD,SE,SF,2)
+	NOEXPN(3) ROUND(SF,SG,SH,SA,SB,SC,SD,SE,3)
+	NOEXPN(4) ROUND(SE,SF,SG,SH,SA,SB,SC,SD,4)
+	NOEXPN(5) ROUND(SD,SE,SF,SG,SH,SA,SB,SC,5)
+	NOEXPN(6) ROUND(SC,SD,SE,SF,SG,SH,SA,SB,6)
+	NOEXPN(7) ROUND(SB,SC,SD,SE,SF,SG,SH,SA,7)
+	addl	$8, XREG(COUNT)
+	cmpl	$16, XREG(COUNT)
+	jne	.Loop1
+
+.Loop2:
+	EXPN( 0) ROUND(SA,SB,SC,SD,SE,SF,SG,SH,0)
+	EXPN( 1) ROUND(SH,SA,SB,SC,SD,SE,SF,SG,1)
+	EXPN( 2) ROUND(SG,SH,SA,SB,SC,SD,SE,SF,2)
+	EXPN( 3) ROUND(SF,SG,SH,SA,SB,SC,SD,SE,3)
+	EXPN( 4) ROUND(SE,SF,SG,SH,SA,SB,SC,SD,4)
+	EXPN( 5) ROUND(SD,SE,SF,SG,SH,SA,SB,SC,5)
+	EXPN( 6) ROUND(SC,SD,SE,SF,SG,SH,SA,SB,6)
+	EXPN( 7) ROUND(SB,SC,SD,SE,SF,SG,SH,SA,7)
+	EXPN( 8) ROUND(SA,SB,SC,SD,SE,SF,SG,SH,8)
+	EXPN( 9) ROUND(SH,SA,SB,SC,SD,SE,SF,SG,9)
+	EXPN(10) ROUND(SG,SH,SA,SB,SC,SD,SE,SF,10)
+	EXPN(11) ROUND(SF,SG,SH,SA,SB,SC,SD,SE,11)
+	EXPN(12) ROUND(SE,SF,SG,SH,SA,SB,SC,SD,12)
+	EXPN(13) ROUND(SD,SE,SF,SG,SH,SA,SB,SC,13)
+	EXPN(14) ROUND(SC,SD,SE,SF,SG,SH,SA,SB,14)
+	EXPN(15) ROUND(SB,SC,SD,SE,SF,SG,SH,SA,15)
+	addl	$16, XREG(COUNT)
+	cmpl	$64, XREG(COUNT)
+	jne	.Loop2
+
+	mov	STATE_SAVED, STATE
+
+	addl	(STATE), SA

_service:tar_scm:nettle-3.9.1.tar.gz/x86_64/sha_ni/sha256-compress-n.asm Added

@@ -0,0 +1,187 @@
+C x86_64/sha_ni/sha256-compress-n.asm
+
+ifelse(`
+   Copyright (C) 2018, 2022 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+')
+
+	.file "sha256-compress-n.asm"
+define(`STATE', `%rdi')
+define(`K', `%rsi')
+define(`BLOCKS', `%rdx')
+define(`INPUT', `%rcx')
+
+define(`MSGK',`%xmm0')	C Implicit operand of sha256rnds2
+define(`MSG0',`%xmm1')
+define(`MSG1',`%xmm2')
+define(`MSG2',`%xmm3')
+define(`MSG3',`%xmm4')
+define(`ABEF',`%xmm5')
+define(`CDGH',`%xmm6')
+define(`ABEF_ORIG',`%xmm7')
+define(`CDGH_ORIG', `%xmm8')
+define(`SWAP_MASK',`%xmm9')
+define(`TMP', `%xmm10')
+
+C QROUND(M0, M1, M2, M3, R)
+define(`QROUND', `
+	movdqa	eval($5*4)(K), MSGK
+	paddd	$1, MSGK
+	sha256rnds2 ABEF, CDGH
+	pshufd	`$'0xe, MSGK, MSGK
+	sha256rnds2 CDGH, ABEF
+	movdqa	$1, TMP
+	palignr	`$'4, $4, TMP
+	paddd	TMP, $2
+	sha256msg2 $1, $2
+	sha256msg1 $1, $4
+	')
+
+C FIXME: Do something more clever, taking the pshufd into account.
+C TRANSPOSE(ABCD, EFGH, scratch) --> untouched, ABEF, CDGH
+define(`TRANSPOSE', `
+	movdqa	$2, $3
+	punpckhqdq $1, $2
+	punpcklqdq $1, $3
+')
+
+	C const uint8_t *
+	C _nettle_sha256_compress_n(uint32_t *state, const uint32_t *k,
+	C                           size_t blocks, const uint8_t *input)
+
+	.text
+	ALIGN(16)
+.Lswap_mask:
+	.byte 3,2,1,0,7,6,5,4,11,10,9,8,15,14,13,12
+PROLOGUE(_nettle_sha256_compress_n)
+	W64_ENTRY(4, 11)
+	test	BLOCKS, BLOCKS
+	jz	.Lend
+
+	movups	(STATE), TMP
+	movups	16(STATE), ABEF
+
+	pshufd	$0x1b, TMP, TMP
+	pshufd	$0x1b, ABEF, ABEF
+
+	TRANSPOSE(TMP, ABEF, CDGH)
+
+	movdqa	.Lswap_mask(%rip), SWAP_MASK
+
+.Loop:
+	movups	(INPUT), MSG0
+	pshufb	SWAP_MASK, MSG0
+
+	movdqa	ABEF, ABEF_ORIG
+	movdqa	CDGH, CDGH_ORIG
+
+	movdqa	(K), MSGK
+	paddd	MSG0, MSGK
+	sha256rnds2 ABEF, CDGH		C Round 0-1
+	pshufd	$0xe, MSGK, MSGK
+	sha256rnds2 CDGH, ABEF		C Round 2-3
+
+	movups	16(INPUT), MSG1
+	pshufb	SWAP_MASK, MSG1
+
+	movdqa	16(K), MSGK
+	paddd	MSG1, MSGK
+	sha256rnds2 ABEF, CDGH		C Round 4-5
+	pshufd	$0xe, MSGK, MSGK
+	sha256rnds2 CDGH, ABEF		C Round 6-7
+	sha256msg1 MSG1, MSG0
+
+	movups	32(INPUT), MSG2
+	pshufb	SWAP_MASK, MSG2
+
+	movdqa	32(K), MSGK
+	paddd	MSG2, MSGK
+	sha256rnds2 ABEF, CDGH		C Round 8-9
+	pshufd	$0xe, MSGK, MSGK
+	sha256rnds2 CDGH, ABEF		C Round 10-11
+	sha256msg1 MSG2, MSG1
+
+	movups	48(INPUT), MSG3
+	pshufb	SWAP_MASK, MSG3
+
+	QROUND(MSG3, MSG0, MSG1, MSG2, 12)	C Round 12-15
+	QROUND(MSG0, MSG1, MSG2, MSG3, 16)
+	QROUND(MSG1, MSG2, MSG3, MSG0, 20)
+	QROUND(MSG2, MSG3, MSG0, MSG1, 24)
+	QROUND(MSG3, MSG0, MSG1, MSG2, 28)
+	QROUND(MSG0, MSG1, MSG2, MSG3, 32)
+	QROUND(MSG1, MSG2, MSG3, MSG0, 36)
+	QROUND(MSG2, MSG3, MSG0, MSG1, 40)
+	QROUND(MSG3, MSG0, MSG1, MSG2, 44)
+	QROUND(MSG0, MSG1, MSG2, MSG3, 48)
+
+	movdqa	208(K), MSGK
+	paddd	MSG1, MSGK
+	sha256rnds2 ABEF, CDGH		C Round 52-53
+	pshufd	$0xe, MSGK, MSGK
+	sha256rnds2 CDGH, ABEF		C Round 54-55
+	movdqa	MSG1, TMP
+	palignr	$4, MSG0, TMP
+	paddd	TMP, MSG2
+	sha256msg2 MSG1, MSG2
+
+	movdqa	224(K), MSGK
+	paddd	MSG2, MSGK
+	sha256rnds2 ABEF, CDGH		C Round 56-57
+	pshufd	$0xe, MSGK, MSGK
+	sha256rnds2 CDGH, ABEF		C Round 58-59
+	movdqa	MSG2, TMP
+	palignr	$4, MSG1, TMP
+	paddd	TMP, MSG3
+	sha256msg2 MSG2, MSG3
+
+	movdqa	240(K), MSGK
+	paddd	MSG3, MSGK
+	sha256rnds2 ABEF, CDGH		C Round 60-61
+	pshufd	$0xe, MSGK, MSGK
+	sha256rnds2 CDGH, ABEF		C Round 62-63
+
+	paddd ABEF_ORIG, ABEF
+	paddd CDGH_ORIG, CDGH
+
+	add	$64, INPUT
+	dec	BLOCKS
+	jnz	.Loop
+
+	TRANSPOSE(ABEF, CDGH, TMP)
+
+	pshufd	$0x1b, CDGH, CDGH
+	pshufd	$0x1b, TMP, TMP
+	movups	CDGH, 0(STATE)
+	movups	TMP, 16(STATE)
+
+.Lend:
+	mov	INPUT, %rax
+	W64_EXIT(4, 11)
+	ret
+EPILOGUE(_nettle_sha256_compress_n)

_service:tar_scm:nettle-3.8.1.tar.gz/xts-aes128.c -> _service:tar_scm:nettle-3.9.1.tar.gz/xts-aes128.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/xts-aes256.c -> _service:tar_scm:nettle-3.9.1.tar.gz/xts-aes256.c Changed

_service:tar_scm:nettle-3.8.1.tar.gz/xts.h -> _service:tar_scm:nettle-3.9.1.tar.gz/xts.h Changed

@@ -83,12 +83,12 @@
                            const uint8_t *key);
 
 void
-xts_aes128_encrypt_message(struct xts_aes128_key *xtskey,
+xts_aes128_encrypt_message(const struct xts_aes128_key *xtskey,
                            const uint8_t *tweak, size_t length,
                            uint8_t *dst, const uint8_t *src);
 
 void
-xts_aes128_decrypt_message(struct xts_aes128_key *xts_key,
+xts_aes128_decrypt_message(const struct xts_aes128_key *xts_key,
                            const uint8_t *tweak, size_t length,
                            uint8_t *dst, const uint8_t *src);
 
@@ -107,12 +107,12 @@
                            const uint8_t *key);
 
 void
-xts_aes256_encrypt_message(struct xts_aes256_key *xts_key,
+xts_aes256_encrypt_message(const struct xts_aes256_key *xts_key,
                            const uint8_t *tweak, size_t length,
                            uint8_t *dst, const uint8_t *src);
 
 void
-xts_aes256_decrypt_message(struct xts_aes256_key *xts_key,
+xts_aes256_decrypt_message(const struct xts_aes256_key *xts_key,
                            const uint8_t *tweak, size_t length,
                            uint8_t *dst, const uint8_t *src);