From dragonheart at gentoo.org Tue Nov 4 06:41:43 2008 From: dragonheart at gentoo.org (Daniel Black) Date: Tue, 4 Nov 2008 16:41:43 +1100 Subject: [PATCH] optional test code building Message-ID: <200811041641.47742.dragonheart@gentoo.org> Gcrypt Dev folks, Diego protested[1] and blogged[2] not to build examples or tests when distributors make code. To facilitate this an example[3] was suggested and I modeled something similar so that disto maintainers can optionally turn off the building of test code (unless they plan to use it). Is the attached patch or indead the general concept acceptable? [1] https://bugs.gentoo.org/show_bug.cgi?id=226287 [2] http://blog.flameeyes.eu/2008/06/11/please-dont-build-your-examples-by-default [3] http://git.flameeyes.eu/?p=others/0pointer/libdaemon.git;a=commitdiff;h=a301690be6581e23a39813444b2904addcb26ab7 -- Daniel Black Gentoo Foundation -------------- next part -------------- A non-text attachment was scrubbed... Name: libgcrypt-svn-opt-disable-test.patch Type: text/x-diff Size: 1603 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 197 bytes Desc: This is a digitally signed message part. URL: From wk at gnupg.org Wed Nov 5 19:47:21 2008 From: wk at gnupg.org (Werner Koch) Date: Wed, 05 Nov 2008 19:47:21 +0100 Subject: Important fix for HMAC-SHA-384/512 Message-ID: <87iqr2row6.fsf@wheatstone.g10code.de> Hi! a bug has in found in the HMAC computation when using a key size of 64 to 128 bytes with SHA-384 or SHA-512. The result is a wrong HMAC value. Given that such key seizes are not very common, it should not give any real world problems but it needs to be fixed anyway. The fix below is for libgcrypt 1.4.3 but it should apply to all 1.4 versions. Salam-Shalom, Werner * Fixed HMAC for SHA-384 and SHA-512 with keys longer than 64 bytes. --- orig/libgcrypt-1.4.3/cipher/md.c 2008-09-12 15:43:52.000000000 +0200 +++ libgcrypt-1.4.3/cipher/md.c 2008-11-05 19:52:32.000000000 +0100 @@ -834,7 +834,7 @@ prepare_macpads( gcry_md_hd_t hd, const if ( !algo ) return GPG_ERR_DIGEST_ALGO; /* i.e. no algo enabled */ - if ( keylen > 64 ) + if ( keylen > hd->ctx->macpads_Bsize ) { helpkey = gcry_malloc_secure ( md_digest_length( algo ) ); if ( !helpkey ) @@ -842,7 +842,7 @@ prepare_macpads( gcry_md_hd_t hd, const gcry_md_hash_buffer ( algo, helpkey, key, keylen ); key = helpkey; keylen = md_digest_length( algo ); - gcry_assert ( keylen <= 64 ); + gcry_assert ( keylen <= hd->ctx->macpads_Bsize ); } memset ( hd->ctx->macpads, 0, 2*(hd->ctx->macpads_Bsize) ); -- Die Gedanken sind frei. Auschnahme regelt ein Bundeschgesetz. From dragonheart at gentoo.org Thu Nov 6 09:12:29 2008 From: dragonheart at gentoo.org (Daniel Black) Date: Thu, 6 Nov 2008 19:12:29 +1100 Subject: Important fix for HMAC-SHA-384/512 - gcrypt-1.4.0 and earlier versions Message-ID: <200811061912.32173.dragonheart@gentoo.org> Thanks for the notice Werner slight difference in assert statements for 1.4.0 versions as attached -- Daniel Black Gentoo Foundation -------------- next part -------------- A non-text attachment was scrubbed... Name: libgcrypt-1.4.0-HMAC-SHA-384-512.patch Type: text/x-diff Size: 668 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 197 bytes Desc: This is a digitally signed message part. URL: From nmav at gnutls.org Sat Nov 29 09:21:22 2008 From: nmav at gnutls.org (Nikos Mavrogiannopoulos) Date: Sat, 29 Nov 2008 10:21:22 +0200 Subject: [Help-gnutls] Alternate random device for certtool In-Reply-To: References: <87vdu9qdtt.fsf@squeak.fifthhorseman.net> <87y6z5m2c8.fsf@squeak.fifthhorseman.net> Message-ID: <4930FB82.2090603@gnutls.org> Teran McKinney wrote: > I am using libgcrypt 1.4.3, and I'm quite cetain that all of Gnutls' > libraries are up to date. Could this possibly a bug with not building > without Linux capabilities support? I have been testing with Arch > Linux, and more so, my fork of Arch Linux, Icadyptes. I noticed that > libgpg-error was out of date (1.6 instead of 1.7), so I updated it and > rebuilt libgcrypt; this had no effect. I CC to gcrypt-devel since this might be gcrypt related. Could it be that newer versions from 1.4.1 ignore the control: gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0); I upgraded to gcrypt 1.4.4 and I notice the same delay, and strace shows that /dev/random is being used even with this flag. output from gcrypt 1.4.1: nmav at crystal:~/cvs/gnutls/src$ time strace certtool -p --outfile /dev/null 2>&1 | grep random access("/dev/random", R_OK) = 0 access("/dev/urandom", R_OK) = 0 open("/dev/urandom", O_RDONLY) = 4 real 0m1.220s user 0m1.136s sys 0m0.028s output from gcrypt 1.4.4: access("/dev/random", R_OK) = 0 access("/dev/urandom", R_OK) = 0 open("/dev/urandom", O_RDONLY) = 4 open("/dev/random", O_RDONLY) = 5 real 0m29.867s user 0m0.016s sys 0m0.016s regards, Nikos