| October 29th, 2004 |
| v0.99 -- Merged in the latest version of LTM which includes all of the recent bug fixes |
| -- Deprecated LTMSSE and removed it (to be replaced with TFM later on) |
| -- Stefan Arentz pointed out that mp_s_rmap should be extern |
| -- Kristian GjΓΈsteen pointed out that there are typos in the |
| "test" makefile and minor issues in Yarrow and Sober [just cosmetics really] |
| -- Matthew P. Cashdollar pointed out that "export" is a C++ keyword |
| so changed the PRNG api to use "pexport" and "pimport" |
| -- Updated "hashsum" demo so it builds ;-) |
| -- Added automatic support for x86-64 (will configure for 64-bit little endian automagically) |
| -- Zhi Chen pointed out a bug in rsa_exptmod which would leak memory on error. |
| -- Made hash functions "init" return an int. slight change to API ;-( |
| -- Added "CHC" mode which turns any cipher into a hash the other LTC functions can use |
| -- Added CHC mode stuff to demos such as tv_gen and hashsum |
| -- Added "makefile.shared" which builds and installs shared/static object copies |
| of the library. |
| -- Added DER for bignum support |
| -- RSA is now fully joy. rsa_export/rsa_import use PKCS #1 encodings and should be |
| compatible with other crypto libs that use the format. |
| -- Added support for x86-64 for the ROL/ROR macros |
| -- Changed the DLL and SO makefiles to optimize for speed, commented SMALL_CODE in |
| mycrypt_custom.h and added -DSMALL_CODE to the default makefile |
| -- Updated primality testing code so it does a minimum of 5 tests [of Miller-Rabin] |
| (AFAIK not a security fix, just warm fuzzies) |
| -- Minor updates to the OMAC code (additional __ARGCHK and removed printf from omac_test... oops!) |
| -- Update build and configuration info which was really really really out of date. (Chapter 14) |
| ++ Minor update, switch RSA to use the PKCS style CRT |
| |
| August 6th, 2004 |
| v0.98 -- Update to hmac_init to free all allocated memory on error |
| -- Update to PRNG API to fix import/export functions of Fortuna and Yarrow |
| -- Added test functions to PRNG api, RC4 now conforms ;-) [was a minor issue] |
| -- Added the SOBER-128 PRNG based off of code donated by Greg Rose. |
| -- Added Tech Note #4 [notes/tech0004.txt] |
| -- Changed RC4 back [due to request]. It will now XOR the output so you can use it like |
| a stream cipher easily. |
| -- Update Fortuna's export() to emit a hash of each pool. This means that the accumulated |
| entropy that was spread over all the pools isn't entirely lost when you export/import. |
| -- Zhi Chen suggested a comment for rsa_encrypt_key() to let users know [easily] that it was |
| PKCS #1 v2.0 padding. (updated other rsa_* functions) |
| -- Cleaned up Noekeon to remove unrolling [wasn't required, was messy and actually slower with GCC/ICC] |
| -- Updated RC4 so that when you feed it >256 bytes of entropy it quietly ignores additional |
| bytes. Also removed the % from the key setup to speed it up a bit. |
| -- Added cipher/hash/prng tests to x86_prof to help catch bugs while testing |
| -- Made the PRNG "done" return int, fixed sprng_done to not require prng* to be non-null |
| -- Spruced up mycrypt_custom.h to trap more errors and also help prevent LTMSSE from being defined |
| on non-i386 platforms by accident. |
| -- Added RSA/ECC/DH speed tests to x86_prof and cleaned it up to build with zero warnings |
| -- Changed Fortuna to count only entropy [not the 2 byte header] added to pool[0] into the |
| reseed mechanism. |
| -- Added "export_size" member to prng_descriptor tables so you can know in advance the size of |
| the exported state for any given PRNG. |
| -- Ported over patch on LTM 0.30 [not ready to release LTM 0.31] that fixes bug in mp_mul()/mp_div() |
| that used to result in negative zeroes when you multiplied zero by a negative integer. |
| (patch due to "Wolfgang Ehrhardt" <Wolfgang.Ehrhardt@munich.netsurf.de>) |
| -- Fixed rsa_*decrypt_key() and rsa_*verify_hash() to default to invalid "stat" or "res". This way |
| if any of the higher level functions fail [before you get to the padding] the result will be in |
| a known state]. Applied to both v2 and v1.5 padding helpers. |
| -- Added MACs to x86_prof |
| -- Fixed up "warnings" in x86_prof and tv_gen |
| -- Added a "profiled" target back [for GCC 3.4 and ICC v8]. Doesn't seem to help but might be worth |
| tinkering with. |
| -- Beefed up load/store test in demos/test |
| |
| ++ New note, in order to use the optimized LOAD/STORE macros your platform |
| must support unaligned 32/64 bit load/stores. The x86s support this |
| but some [ARM for instance] do not. If your platform cannot perform |
| unaligned operations you must use the endian neutral code which is safe for |
| any sort of platform. |
| |
| July 23rd, 2004 |
| v0.97b -- Added PKCS #1 v1.5 RSA encrypt/sign helpers (like rsa_sign_hash, etc...) |
| -- Added missing prng check to rsa_decrypt_key() [not critical as I don't use |
| descriptors directly in that function] |
| -- Merged in LTM-SSE, define LTMSSE before you build and you will get SSE2 optimized math ;-) |
| (roughly 3x faster on a P4 Northwood). By default it will compile as ISO C portable |
| code (when LTMSSE is undefined). |
| -- Fixed bug in ltc_tommath.h where I had the kara/toom cutoffs not marked as ``extern'' |
| Thanks to "Stefan Arentz" <stefan at organicnetwork.net> |
| -- Steven Dake <scd@broked.org> and Richard Amacker <ramacker@yahoo.com> submitted patches to |
| fix pkcs_5_2(). It now matches the output of another crypto library. Whoops... hehehe |
| -- Updated PRNG api. Added Fortuna PRNG to the list of supported PRNGs |
| -- Fixed up the descriptor tables since globals are automatically zero'ed on startup. |
| -- Changed RC4 to store it's output. If you want to encrypt with RC4 |
| you'll have to do the XOR yourself. |
| -- Fixed buffer overflows/overruns in the HMAC code. |
| |
| ++ API change for the PRNGs there now is a done() function per PRNG. You |
| should call it when you are done with a prng state. So far it's |
| not absolutely required (won't cause problems) but is a good idea to |
| start. |
| |
| |
| June 23rd, 2004 |
| v0.97a ++ Fixed several potentially crippling bugs... [read on] |
| -- Fixed bug in OAEP decoder that would incorrectly report |
| buffer overflows. [Zhi Chen] |
| -- Fixed headers which had various C++ missing [extern "C"]'s |
| -- Added "extern" to sha384_desc descriptor which I removed by mistake |
| -- Fixed bugs in ENDIAN_BIG macros using the wrong byte order [Matt Johnston] |
| -- Updated tiger.c and des.c to not shadow "round" which is intrinsic on |
| some C compilers. |
| -- Updated demos/test/rsa_test.c to test the RSA functionality better |
| ++ This update has been tested with GCC [v3.3.3], ICC [v8] and MSVC [v6+SP6] |
| all on a x86 P4 [GCC/ICC tested in Gentoo Linux, MSVC in WinXP] |
| ++ Outcome: The bug Zhi Chen pointed out has been fixed. So have the bugs |
| that Matt Johnston found. |
| |
| June 19th, 2004 |
| v0.97 -- Removed spurious unused files [arrg!] |
| -- Patched buffer overflow in tim_exptmod() |
| -- Fixed buffer overrun bug in pkcs_1_v15_es_decode() |
| -- Reduced stack usage in PKCS #1 v2.0 padding functions (by several KBs) |
| -- Removed useless extern's that were an artifact from the project start... ;-) |
| -- Replaced memcpy/memset with XMEMCPY and XMEMSET for greater flexibility |
| -- fixed bugs in hmac_done()/hmac_init()/[various others()] where I didn't trap errors |
| -- Reduced stack usage in OMAC/PMAC/HMAC/EAX/OCB/PKCS#5 by mallocing any significant sized |
| arrays (e.g. > 100 bytes or so). Only in non-critical functions (e.g. eax_init()) |
| -- "Zhi Chen" <zhi@massiveincorporated.com> pointed out that rsa_decrypt_key() requires |
| an incorrect output size (too large). Fixed. |
| -- Added a "pretty" target to the GCC makefile. Requires PERL. It is NEAT! |
| -- Minor updates to ch1 of the manual. |
| -- Cleaned up the indentation and added comments to rsa_make_key(), rsa_exptmod() and |
| rsa_verify_hash() |
| -- Updated makefile.icc so the "install" target would work ;-) |
| -- Removed demos/test.c [deprecated from demos/test/test.c] |
| -- Changed MAXBLOCKSIZE from 128 to 64 to reflect the true size... |
| |
| May 30th, 2004 |
| v0.96 -- Removed GF and Keyring code |
| -- Extended OAEP decoder to distinguish better [and use a more uniform API] |
| -- Changed PSS/OAEP API slightly to be more consistent with other PK functions (order of arguments) |
| -- rsa_exptmod() now pads with leading zeroes as per I2OSP. |
| -- added error checking to yarrow code |
| -- pointed out that tommath.h from this distro will overwrite tommath.h |
| from libtommath. I changed this to ltc_tommath.h to avoid any such problems. |
| -- Fixed bug in PSS encoder/decoder that didn't handle the MSB properly |
| -- refactored AES, now sports an "encrypt only" descriptor which uses half as much code space. |
| -- modded Yarrow to try and use refactored AES code and added WHIRLPOOL support (d'oh) ;-) |
| -- updated ECB, OCB and CBC decrypt functions to detect when "encrypt only" descriptor is used. |
| -- replaced old RSA code with new code that uses PKCS #1 v2.0 padding |
| -- replaced old test harness with new over-engineer'ed one in /demos/test/ |
| -- updated cbc/cfb/ofb/ctr code with setiv/getiv functions to change/read the IV without re-keying. |
| -- Added PKCS #1 v1.5 RSA encryption and signature padding routines |
| -- Added DER OID's to most hash descriptors (as many as I could find) |
| -- modded rsa_exptmod() to use timing-resilient tim_exptmod() when doing private key operations |
| added #define RSA_TIMING which can turn on/off this feature. |
| -- No more config.pl so please just read mycrypt_custom.h for build-time tweaks |
| -- Small update to rand_prime() |
| -- Updated sha1, md5 and sha256 so they are smaller when SMALL_CODE is defined. If you want speed though, |
| you're going to have to undefine SMALL_CODE ;-) |
| -- Worked over AES so that it's even smaller now [in both modes]. |
| |
| May 12th, 2004 |
| v0.95 -- Optimized AES and WHIRLPOOL for SMALL_CODE by taking advantage of the fact |
| the transforms are circulant. AES dropped 5KB and WHIRLPOOL dropped 13KB |
| using the default build options on the x86. |
| -- Updated eax so the eax_done() would clear the state [like hmac,pmac,ocb] when |
| CLEAN_STACK has been defined. |
| -- added LTC_TEST support to rmd160 |
| -- updates to mycrypt_pk.h |
| -- updated rand_prime() to faciliate making RSA composites |
| -- DSA/RSA now makes composites of the exact size desired. |
| -- Refactored quite a bit of the code, fewer functions per C file |
| -- cleaned up the makefiles to organize the objects logically |
| -- added ICC makefile along with "profiled" targets for both GNU and ICC compilers |
| -- Marked functions for removal before v1.00 see PLAN for more information |
| -- GCC 3.4.0 tested and seems to work |
| -- Added PKCS #5 support |
| -- Fixed typo in comment header of .C files ;-) |
| -- Added PKCS #1 OAEP and PSS support. |
| |
| Feb 20th, 2004 |
| v0.94 -- removed unused variables from ocb.c and fixed it to match known test vectors. |
| -- Added PMAC support, minor changes to OMAC/EAX code [I think....] |
| -- Teamed up with Brian Gladman. His code verifies against my vectors and my code |
| verifies against his test vectors. Hazaa for co-operation! |
| -- Various small changes (added missing ARGCHKs and cleaned up indentation) |
| -- Optimization to base64, removed unused variable "c" |
| -- Added base64 gen to demos/tv_gen.c |
| -- Fix to demos/x86_prof.c to correctly identify the i386 architecture... weird... |
| -- Fixed up all of the PK code by adding missing error checking, removed "res" variables, |
| shrunk some stack variables, removed non-required stack variables and added proper |
| error conversion from MPI to LTC codes. I also spotted a few "off by one" error |
| checking which could have been used to force the code to read past the end of |
| the buffer (in theory, haven't checked if it would work) by a few bytes. |
| -- Added checks to OUTPUT_BIGNUM so the *_export() functions cannot overflow the output and I |
| also modded it so it stores in the output provided to the function (that is not on |
| the local stack) which saves memory and time. |
| -- Made SAFER default to disabled for now (plans are to cleanhouse write an implementation later) |
| -- Added the 512-bit one-way hash WHIRLPOOL which clocks in at 138 cycles per byte on my |
| Athlon XP [for comparison, SHA-512 clocks in at 77 cycles per byte]. This code uses the |
| teams new sbox design (not the original NESSIE one). |
| |
| |
| Jan 25th, 2004 |
| v0.93 -- [note: deleted v0.93 changes by accident... recreating from memory...] |
| -- Fix to RC2 to not deference pointer before ARGCHK |
| -- Fix to NOEKEON to match published test vectors as well as cleaned up the code a bit |
| -- Optimized Twofish [down to 28 cycles/byte on my box] and Blowfish |
| -- Fix to OMAC to test cipher block size first [prevents wasting any time] |
| -- Added more OMAC test vectors |
| -- Added EAX Encrypt+Authenticate support |
| -- Fix to DSA to check return of a few LTM functions I forgot [mp_to_unsigned_bin] |
| -- Added common headers to all C files |
| -- CTR mode supports big and little [default] endian counters now. |
| -- fix to find_cipher_any() so that it can handle a fragmented cipher_descriptor table. |
| -- added find_hash_any() akin to find_cipher_any(). |
| -- Added EAX code to demos/tv_gen.c Hazaa! |
| -- Removed SONY defines and files from codebase. |
| -- Added OCB support [patents be damned] and to demos/tv_gen.c |
| -- Merge all of the INPUT/OUTPUT BIGNUM macros (less toc) into mycrypt_pk.h |
| -- Made appropriate changes to the debug string in crypt.c |
| |
| Dec 24th, 2003 |
| v0.92 -- Updated the config.pl script so the options have more details. |
| -- Updated demos/tv_gen to include RIPEMD hashes |
| -- Updated Twofish so when TWOFISH_ALL_TABLES is defined a pre-computed RS table |
| is included [speedup: slight, about 4k cycles on my Athlon]. |
| -- Re-wrote the twofish large key generation [the four 8x32 key dependent tables]. Now about twice as fast. |
| With both optimizations [e.g. TWOFISH_ALL_TABLES defined] a 128-bit Twofish key can now be scheduled |
| in 26,000 cycles on my Athlon XP [as opposed to 49,000 before] when optimized for size. |
| -- config.pl has been updated so rmd128.o and rmd160.o are objects included in the build [oops] |
| -- Andrew Mann found a bug in rsa_exptmod() which wouldn't indicate if the wrong type of key was specified |
| (e.g. not PK_PRIVATE or PK_PUBLIC) |
| -- Fixed up demos/x86_prof so it sorts the output now :-) |
| -- The project is now powered by radioactive rubber pants. |
| -- Fixed dh_encrypt_key() so if you pass it a hash with a smaller output than the input key it |
| will return CRYPT_INVALID_HASH [to match what ecc_encrypt_key() will do] |
| -- Merge the store/encrypt key part of ecc_encrypt_key() as per dh_encrypt_key() [can you guess what I'm upto?] |
| -- Massive updates to the prime generation code. I use the LTM random prime functions [and provide a nice |
| interface between the LTC PRNG's and the LTM generic prng prototype]. I also use a variable number of tests |
| depending on the input size. This nicely speeds up most prime generation/testing within the library. |
| -- Added SHA-224 to the list of hashes. |
| -- Made HMAC test vectors constant and static [takes ROM space instead of RAM] |
| -- This release was brought to you by the letter P which stands for Patent Infringement. |
| -- Added generic HASH_PROCESS macro to mycrypt_hash.h which simplifies the hash "process" functions |
| I also optimized the compression functions of all but MD2 to not perform input copies when avoidable. |
| -- Removed the division from the Blowfish setup function [dropped 3k cycles on my Athlon] |
| -- Added stack cleaning to rijndael, cast5 so now all ciphers have CLEAN_STACK code. |
| -- Added Skipjack to the list of ciphers [made appropriate changes to demos/test.c, demos/tv_gen.c and |
| demos/x86_prof.c] |
| -- Added mechanical testing to cipher test vector routines. Now it encrypts 1000 times, then decrypts and |
| compares. Any fault (e.g. bug in code, compiler) in the routines is likely to show through. Doesn't |
| stress test the key gen though... |
| -- Matt Johnson found a bug in the blowfish.c apparently I was out of my mind and put twofish defines in there |
| The code now builds with any config. Thanks. |
| -- Added OMAC1 Message Authentication Code support to the library. |
| -- Re-prototyped the hash "process" and "done" to prevent buffer overflows [which don't seem easy to exploit]. |
| Updated HMAC code to use them too. Hazaa! |
| -- Fixed bug in ECC code which wouldn't do an _ARGCHK on stat in ecc_verify_hash(). |
| -- Fixed [temp fix] bug in all PK where the OUTPUT_BIGNUM macros would not trap errors on the to_unsigned_bin |
| conversion [now returns CRYPT_MEM, will fix it up better later] |
| -- Added DSA to the list of supported PK algorithms. |
| -- Fixed up various ciphers to &255 the input key bytes where required [e.g. where used to index a table] to prevent |
| problems on platforms where CHAR_BIT != 8 |
| -- Merged in LibTomMath v0.28 |
| -- Updated demos/x86_prof.c to use Yarrow during the key sched testing [was horribly slow on platforms with blockable |
| /dev/random]. |
| -- Added OMAC/HMAC tests to demos/tv_gen and I now store the output of this in notes/ |
| -- Fixed a bug in config.pl that wouldn't have TWOFISH_TABLES defined by default (too many commas on the line) |
| -- Fixed bug in hmac_done(). Apparently FIPS-198 [HMAC] specifies that the output can be truncated. My code |
| would not support that (does now just like the new OMAC code). |
| -- Removed "hashsize" from hmac_state as it wasn't being used. |
| -- Made demos/test.c stop if OMAC or HMAC tests fail (instead of just printing a failed message and keep going). |
| -- Updated notes/tech0003.txt to take into account the existence of Skipjack [also I fixed a few typos]. |
| -- Slight changes to Noekeon, with SMALL_CODE undefined it uses a fully unrolled version. Dropped +10 cycles/byte |
| on my Athlon (35 cycles per byte or 410.4Mbit/sec at 1795Mhz) |
| -- Added _ARGCHK() calls to is_prime() for the two input pointers. |
| |
| Sept 25th, 2003 |
| v0.91 -- HMAC fix of 0.90 was incorrect for keys larger than the block size of the hash. |
| -- Added error CRYPT_FILE_NOTFOUND for the file [hmac/hash] routines. |
| -- Added RIPEMD hashes to the hashsum demo. |
| -- Added hashsum demo to MSVC makefile. |
| -- Added RMD160 to the x86_prof demo [oops] |
| -- Merged in LibTomMath-0.27 with a patch to mp_shrink() that will be in LibTomMath-0.28 |
| Fixes another potential memory leak. |
| |
| Sept 7th, 2003 |
| v0.90 -- new ROL/ROR for x86 GCC |
| -- Jochen Katz submitted a patch to the makefile to prevent "make" from making the .a library |
| when not required. |
| == By default the KR code is not enabled [it's only a demo anyways!] |
| -- changed the "buf" in ecc_make_key from 4KB to 128 bytes [since the largest key is 65 bytes] |
| -- hmac_done() now requires you pass it the size of the destination buffer to prevent |
| buffer overflows. (API CHANGE) |
| -- hmac/hash filebased routines now return CRYPT_NOP if NO_FILE is defined. |
| -- I've removed the primes from dh.c and replaced them with DR safe primes suitable for the default |
| configuration of LibTomMath. Check out these comparisons on a 1.3Ghz Athlon XP, optimized for size, |
| |
| 768-bit, 4 vs. 10 |
| 1024-bit, 8 vs. 18 |
| 1280-bit, 12 vs. 34 |
| 1536-bit, 20 vs. 56 |
| 1792-bit 28 vs. 88 |
| 2048-bit, 40 vs. 124 |
| 2560-bit, 71 vs. 234 |
| 3072-bit, 113 vs. 386 |
| 4096-bit, 283 vs. 916 |
| |
| Times are all in milliseconds for key generation. New primes times on the left. This makes the code binary |
| incompatible with previous releases. However, this addition is long overdue as LibTomMath has supported DR |
| reductions for quite some time. |
| -- Added RIPE-MD 128 and 160 to the list of supported hashes [10 in total]. |
| -- The project has been released as public domain. TDCAL no longer applies. |
| |
| July 15th, 2003 |
| v0.89 -- Fix a bug in bits.c which would prevent it from building with msvc |
| -- Merged in LibTomMath v0.24 [and I used the alloc/free macros this time!] |
| -- Removed the LTC version of next_prime() and replaced it with a call to the |
| mp_prime_next_prime() from LibTomMath |
| -- reverted bits.c to the 0.86 copy since the new one doesn't build in MSVC |
| or cygwin. |
| |
| Jul 10th, 2003 |
| v0.88 -- Sped up CAST5 key schedule for MSVC |
| -- added "ulong32" which allows people on 64-bit platforms to force the 32-bit tables in |
| ciphers like blowfish and AES to be 32-bits. E.g. when unsigned long is 64-bits. |
| -- Optimized the SAFER-SK64, SAFER-SK128, SAFER+, RC5 and RC6 key schedule [big time!] |
| -- Optimized SHA-1 and SHA-256 quite a bit too. |
| -- Fixed up the makefile to use -fomit-frame-pointer more liberally |
| -- Added tv_gen program which makes test vectors for ciphers/hashes |
| -- Merged in LibTomMath v0.22 |
| |
| Jun 19th, 2003 |
| v0.87 -- Many MSVC optimizations to the code base |
| -- Improved the AES and Twofish key schedule [faster, more constant time] |
| -- Tons of optimizations here and there. |
| |
| Jun 15th, 2003 |
| v0.86 -- Fixed up AES to workaround MSVC optimizer bug |
| -- Merged in fresh LTM base [based on v0.20] so there are no warnings with MSVC |
| -- Wrote x86_prof which will time the hashes and ciphers downto cycles per byte. |
| -- Fixed up demos/encrypt to remove serpent_desc from the list |
| -- Re-enabled MSVC optimizations w00t w00t |
| -- Replaced "errno" with "err" in all functions that had it so it wouldn't clash |
| with the global "errno" |
| -- Removed a set of unused variables from certain functions |
| -- Removed {#line 0 "..."} stuff from mpi.c to comply with ISO C :-) |
| |
| Jun 11th, 2003 |
| v0.85 -- Swapped in a new AES routine |
| -- Removed Serpent |
| -- Added TDCAL policy document |
| |
| Jun 1st, 2003 |
| v0.84 -- Removed a 4KB buffer from rsa_decrypt_key that wasn't being used no more |
| -- Fixed another potential buffer problem. Not an overflow but could cause the |
| PK import routines to read past the end of the buffer. |
| -- Optimized the ECC mulmod more by removing a if condition that will always be false |
| -- Optimized prime.c to not include a 2nd prime table, removed code from is_prime calls prime |
| test from LibTomMath now |
| -- Added LTC_TEST define which when defined will enable the test vector routines [see mycrypt_custom.h] |
| -- Removed ampi.o from the depends cuz it ain't no not working in *nix with it [routines are in mpi.c now]. |
| |
| |
| Mar 29th, 2003 |
| v0.83 -- Optimized the ecc_mulmod, it's faster and takes less heap/stack space |
| -- Fixed a free memory error in ecc_mulmod and del_point which would try to free NULL |
| -- Fixed two serious bugs in rsa_decrypt_key and rsa_verify_hash that would allow a trivialy |
| buffer overflow. |
| -- Fixed a bug in the hmac testing code if you don't register all the hashes it won't return |
| errors now. |
| |
| Mar 15th, 2003 |
| v0.82 -- Manual updated |
| -- Added MSVC makefile [back, actually its written from scratch to work with NMAKE] |
| -- Change to HMAC helper functions API to avoid buffer overflow [source changes] |
| -- the rsa_encrypt_key was supposed to reject key sizes out of bounds ... |
| same fix to the rsa_sign_hash |
| -- Added code to ensure that that chaining mode code (cfb/ofb/ctr/cbc) have valid |
| structures when being called. E.g. the indexes to the pad/ivs are not out of bounds |
| -- Cleaned up the DES code and simplified the core desfunc routine. |
| -- Simplified one of the boolean functions in MD4 |
| |
| Jan 16th, 2003 |
| v0.81 -- Merged in new makefile from Clay Culver and Mike Frysinger |
| -- Sped up the ECC mulmod() routine by making the word size adapt to the input. Saves a whopping 9 point |
| operations on 521-bit keys now (translates to about 8ms on my Athlon XP). I also now use barrett reduction |
| as much as possible. This sped the routine up quite a bit. |
| -- Fixed a huge flaw in ecc_verify_hash() where it would return CRYPT_OK on error... Now fixed. |
| -- Fixed up config.pl by fixing an invalid query and the file is saved in non-windows [e.g. not CR/LF] format |
| (fix due to Mika BostrΓΆm) |
| -- Merged in LibTomMath for kicks |
| -- Changed the build process so that by default "mycrypt_custom.h" is included and provided |
| The makefile doesn't include any build options anymore |
| -- Removed the PS2 and VC makefiles. |
| |
| Dec 16th, 2002 |
| v0.80 -- Found a change I made to the MPI that is questionable. Not quite a bug but definately not desired. Had todo |
| with the digit shifting. In v0.79 I simply truncated without zeroing. It didn't cause problems during my |
| testing but I fixed it up none the less. |
| -- Optimized s_mp_mul_dig() from MPI to do a minimal number of passes. |
| -- Fixed in rsa_exptmod() where I was getting the size of the result. Basically it accomplishes the same thing |
| but the fixed code is more readable. |
| -- Fixed slight bug in dh_sign_hash() where the random "k" value was 1 byte shorter than it should have been. I've |
| also made the #define FAST_PK speed up signatures as well. Essentially FAST_PK tells the DH sub-system to |
| limit any private exponent to 256-bits. Note that when FAST_PK is defined does not make the library |
| binary or source incompatible with a copy of the library with it undefined. |
| -- Removed the DSA code. If you want fast diffie-hellman just define FAST_PK :-) |
| -- Updated dh_sign_hash()/dh_verify_hash() to export "unsigned" bignums. Saves two bytes but is not binary |
| compatible with the previous release... sorry! I've performed the same fix to the ecc code as well. |
| -- Fixed up the PK code to remove all use of mp_toraw() and mp_read_raw() [get all the changes out of the way now] |
| -- Fixed a bug in the DH code where it missed trapping a few errors if they occurred. |
| -- Fixed a slight "its-not-a-bug-but-could-be-done-better" bug in the next_prime() function. Essentially it was |
| testing to ensure that in the loop that searches for the next candidate that the step never grows beyond |
| 65000. Should have been testing for MP_DIGIT_MAX |
| -- Spruced up the config.pl script. It now makes a header file "mycrypt_custom.h" which can be included *before* |
| you include mycrypt.h. This allows you to add libtomcrypt to a project without completely changing your make |
| system around. Note that you should use the makefile it writes to at least build the library initially. |
| -- Used splint to check alot of the code out. Tons of minor fixes and explicit casts added. |
| -- Also made all the internal functions of MPI are now static to avoid poluting the namespace |
| -- **Notice**: There are no planned future releases for at least a month from the this release date. |
| |
| Dec 14th, 2002 |
| v0.79 -- Change to PK code [binary and source]. I made it so you have to pass the buffer size to the *_decrypt_key and |
| *_verify_hash functions. This prevents malformed packets from performing buffer overflows. I've also trimmed |
| the packet header size [by 4 bytes]. |
| -- Made the test program halt on the first error it occurs. Also made it trap more errors than before. |
| -- Wrote the first chapter of my new book [DRAFT!], not in this package but check my website! |
| -- Included a perl script "config.pl" that will make "makefile.out" according to the users needs. |
| -- Added shell script to look for latest release |
| -- Merge DH and ECC key defines from mycrypt_cfg.h into the makefiles |
| -- updated the makefile to use BSD friendly archiving invokations |
| -- Changed the DH and ECC code to use base64 static key settings [e.g. the primes]. Dropped the code size by 3KB |
| and is ever-so-slightly faster than before. |
| -- added "mp_shrink" function to shrink the size of bignums. Specially useful for PK code :-) |
| -- Added new exptmod function that calculates a^b mod c with fewer multiplies then before [~20% for crypto |
| sized numbers]. Also added a "low mem" variant that doesn't use more than 20KB [upto 4096 bit nums] of |
| heap todo the calculation. Both are #define'able controlled |
| -- Added XREALLOC macro to provide realloc() functionality. |
| -- Added fix where in rsa_import() if you imported a public key or a non-optimized key it would free the mp_int's |
| not being used. |
| -- Fixed potential bug in the ECC code. Only would occur on platforms where char is not eight bits [which isn't |
| often!] |
| -- Fixed up the ECC point multiplication, its about 15% faster now |
| -- While I was at it [since the lib isn't binary backwards compatible anyways] I've fixed the PK export routines |
| so they export as "unsigned" types saving 1 byte per bignum outputted. Not a lot but heck why not. |
| |
| Nov 28th, 2002 |
| v0.78 -- Made the default ARGCHK macro a function call instead which reduced the code size from 264KB to 239KB. |
| -- Fixed a bug in the XTEA keysize function which called ARGCHK incorrectly. |
| -- Added Noekeon block cipher at 2,800 bytes of object code and 345Mbit/sec it is a welcome addition. |
| -- Made the KR code check if the other PK systems are included [provides error when building otherwise]. |
| -- Made "aes" an alias for Rijndael via a pre-processor macro. Now you can use "aes_ecb_encrypt", etc... :-) |
| Thanks to Jean-Luc Cooke for the "buzzword conformance" suggestion. |
| -- Removed the old PK code entirely (e.g. rsa_sign, dh_encrypt). The *_sign_hash and *_encrypt_key functions |
| are all that is to remain. |
| -- **NOTE** Changed the PK *_import (including the keyring) routine to accept a "inlen" parameter. This fixes a |
| bug where improperly made key packets could result in reading passed the end of the buffer. This means |
| the code is no longer source compatible but still binary compatible. |
| -- Fixed a few other minor bugs in the PK import code while I was at it. |
| |
| Nov 26th, 2002 |
| v0.77 -- Updated the XTEA code to use pre-computed keys. With optimizations for speed it achieves 222Mbit/sec |
| compared to the 121Mbit/sec before. It is 288 bytes bigger than before. |
| -- Cleaned up some of the ciphers and hashes (coding style, cosmetic changes) |
| -- Optimized AES slightly for 256-bit keys [only one if statement now, still two for 192-bit keys] |
| -- Removed most test cases from Blowfish, left three of them there. Makes it smaller and faster to test. |
| -- Changed the primality routines around. I now use 8 rounds of Rabin-Miller, I use 256 primes in the sieve |
| step and the "rand_prime" function uses a modified sieve that avoids alot of un-needed bignum work. |
| -- Fixed a bug in the ECC/DH signatures where the keys "setting" value was not checked for validity. This means |
| that a invalid value could have caused segfaults, etc... |
| -- **NOTE** Changed the way the ECC/DH export/import functions work. They are source but not binary compatible |
| with v0.76. Essentially insteading of exporting the setting index like before I export the key size. Now |
| if you ever re-configure which key settings are supported the lib will still be able to make use of your |
| keys. |
| -- Optimized Blowfish by inlining the round function, unrolling it for four rounds then using a for loop for the |
| rest. It achieves a rate of 425Mbit/sec with the new code compared to 314Mbit/sec before. The new blowfish |
| object file is 7,813 bytes compared to 8,663 before and is 850 bytes smaller. So the code is both smaller and |
| faster! |
| -- Optimized Twofish as well by inlining the round function. Gets ~400Mbit/sec compared to 280Mbit/sec before |
| and the code is only 78 bytes larger than the previous copy. |
| -- Removed SMALL_PRIME_TAB build option. I use the smaller table always. |
| -- Fixed some mistakes concerning prime generation in the manual. |
| -- [Note: sizes/speeds are for GCC 3.2 on an x86 Athlon XP @ 1.53Ghz] |
| |
| Nov 25th, 2002 |
| v0.76 -- Updated makefiles a bit more, use "-Os" instead of "-O2" to optimize for size. Got the lib |
| downto 265KB using GCC 3.2 on my x86 box. |
| -- Updated the SAFER+, Twofish and Rijndael test vector routine to use the table driven design. |
| -- Updated all other test vector routines to return as soon as an error is found |
| -- fixed a bug in the test program where errors in the hash test routines would not be reported |
| correctly. I found this by temporarily changing one of the bytes of the test vectors. All the |
| hashes check out [the demos/test.c would still have reported an error, just the wrong one]. |
| |
| |
| Nov 24th, 2002 |
| v0.75 -- Fixed a flaw in hash_filehandle, it should ARGCHK that the filehandle is not NULL |
| -- Fixed a bug where in hash_file if the call to hash_filehandle failed the open file would |
| not be closed. |
| -- Added more strict rules to build process, starting to weed out "oh this works in GCC" style code |
| In the next release "-Wconversion" will be enabled which will deal with all implicit casts. |
| |
| Nov 22nd, 2002 [later in the day] |
| v0.74 -- Wrote a small variant of SAFER+ which shaved 50KB off the size of the library on x86 platforms |
| -- Wrote a build option to remove the PK packet functions [keeps the encrypt_key/sign_hash functions] |
| -- Wrote a small variant of Rijndael (trimmed 13KB) |
| -- Trimmed the TIGER/192 hash function a bit |
| -- Overall the entire lib compiled is 295KB [down from 400KB before] |
| -- Fixed a few minor oversights in the MSVC makefile |
| |
| Nov 22nd, 2002 |
| v0.73 -- Fixed bug in RC4 code where it could only use 255 byte keys. |
| -- Fixed bug in yarrow code where it would allow cast5 or md2 to be used with it... |
| -- Removed the ecc compress/expand points from the global scope. Reduces namespace polution |
| -- Fixed bug where if you used the SPRNG you couldn't pass NULL as your prng_state which you should be |
| able todo since the SPRNG has no state... |
| -- Corrected some oversights in the manual and the examples... |
| -- By default the GF(2^W) math library is excluded from the build. The source is maintained because I wrote it |
| and like it :-). This way the built library is a tad smaller |
| -- the MSVC makefile will now build for a SPACE optimized library rather than TIME optimized. |
| |
| Nov 21th, 2002 |
| v0.72 -- Fixed bug in the prime testing. In the Miller-Rabin test I was raising the base to "N-1" not "r". |
| The math still worked out fine because in effect it was performing a Fermat test. Tested the new code and it |
| works properly |
| -- Fixed some of the code where it was still using the old error syntax |
| -- Sped up the RSA decrypt/sign routines |
| -- Optimized the ecc_shared_secret routine to not use so much stack |
| -- Fixed up the makefile to make releases where the version # is in the file name and directory it will unzip |
| to |
| |
| Nov 19th, 2002 |
| v0.71 -- HELP TOM. I need tuition for the January semester. Now I don't want to force donations [nor will I ever] |
| but I really need the help! See my website http://tom.iahu.ca/help_tom.html for more details. Please help |
| if you can! |
| -------------------------------------------------------------------------------------------------------------- |
| -- Officially the library is no longer supported in GCC 3.2 in windows [cygwin]. |
| In windows you can either use GCC 2.95.3 or try your luck with 3.2 It seems that |
| "-fomit-frame-pointer" is broken in the windows build [but not the linux x86 build???] |
| If you simply must use 3.2 then I suggest you limit the optimizations to simply "-O2" |
| -- Started new error handling API. Similar to the previous except there are more error codes than just |
| CRYPT_ERROR |
| -- Added my implementation of the MD2 hash function [despite the errors in the RFC I managed to get it right!] |
| -- Merged in more changes from Sky Schulz. I have to make mention here that he has been a tremendous help in |
| getting me motivated to make some much needed updates to the library! |
| -- Fixed one of the many mistakes in the manual as pointed out by Daniel Richards |
| -- Fixed a bug in the RC4 code [wasn't setting up the key correctly] |
| -- Added my implementation of the CAST5 [aka CAST-128] block cipher (conforms...) |
| -- Fixed numerous bugs in the PK code. Essentially I was "freeing" keys when the import failed. This is neither |
| required nor a good a idea [double free]. |
| -- Tom needs a job. |
| -- Fixed up the test harness as requested by Sky Schulz. Also modifed the timing routines to run for X seconds |
| and count # of ops performed. This is more suitable than say encrypting 10 million blocks on a slow processor |
| where it could take minutes! |
| -- Modified test programs hashsum/encrypt to use the new algorithms and error handling syntax |
| -- Removed the PKCS code since it was incomplete. In the future I plan on writing a "add-on" library that |
| provides PKCS support... |
| -- updated the config system so the #defines are in the makefiles instead of mycrypt_cfg.h |
| -- Willing to work on an hourly basis for 15$ CDN per hour. |
| -- updated the test program to not test ciphers not included |
| -- updated the makefile to make "rsa_sys.c" a dependency of rsa.o [helps develop the code...] |
| -- fixed numerous failures to detect buffer overflows [minor] in the PK code. |
| -- fixed the safer [64-bit block version] test routines which didn't check the returns of the setup |
| function |
| -- check out my CV at http://tom.iahu.ca/cv.html |
| -- removed the GBA makefile and code from demos/test.c [not a particularly useful demo...] |
| -- merged in rudimentary [for testing] PS2 RNG from Sky Schulz |
| -- merged in PS2 timer code [only shell included due to NDA reasons...] |
| -- updated HMAC code to return errors where possible |
| -- Thanks go to Sky Schulz who bought me a RegCode for TextPad [the official editor of libtomcrypt] |
| |
| Nov 12th, 2002 |
| v0.70 -- Updated so you can swap out the default malloc/calloc/free routines at build time with others. (Sky Schulz) |
| -- Sky Schulz contributed some code towards autodetecting the PS2 in mycrypt_cfg.h |
| -- Added PS2 makefile contributed by Sky Schulz [see a pattern forming?] |
| -- Added ability to have no FILE I/O functions at all (see makefile), Sky Schulz.... |
| -- Added support for substituting out the clock() function (Sky Schulz) |
| -- Fixed up makefile to include new headers in the HEADERS variable |
| -- Removed "coin.c" as its not really useful anyways |
| -- Removed many "debug" printfs that would show up on failures. Basically I wanted to ensure the only output |
| would be from the developer themselves. |
| -- Added "rc4.c" a RC4 implementation with a PRNG interface. Since RC4 isn't a block cipher it wouldn't work |
| too well as a block cipher. |
| -- Fixed ARGCHK macro usage when ARGTYPE=1 throughout the code |
| -- updated makefile to make subdirectory properly (Sku Schulz) |
| -- Started towards new API setup. Instead of checking for "== CRYPT_ERROR" you should check "!= CRYPT_OK" |
| In future releases functions will return things other than CRYPT_ERROR on error to give more useful |
| thread safe error reporting. The manual will be updated to reflect this. For this release all |
| errors are returned as CRYPT_ERROR (except as noted) but in future releases this will change. |
| -- Removed the zlib branch since its not really required anyways. Makes the package smaller |
| |
| Nov 11th, 2002 |
| v0.69 -- Added ARGCHK (see mycrypt_argchk.h) "arguement checking" to all functions that accept pointers |
| -- Note I forgot to change the CRYPT version tag in v0.68... fixed now. |
| |
| Nov 8th, 2002 |
| v0.68 -- Fixed flaw in kr_import/kr_export that wasted 4 bytes. Source but not binary compatible with v0.67 |
| -- Fixed bug in kr_find_name that used memcmp to match strings. Uses strncmp now. |
| -- kr_clear now sets the pointer to NULL to facilate debugging [e.g. using the keyring after clearing] |
| -- static functions in _write/_read in keyring.c now check the return of ctr_encrypt/ctr_decrypt. |
| -- Updated blowfish/rc2/rc5/rc6 keysize() function to not reject keys larger than the biggest key the |
| respective ciphers can use. |
| -- Fixed a bug in hashsum demo that would report the hash for files that don't exist! |
| |
| Oct 16th, 2002 |
| v0.67 -- Moved the function prototypes into files mycrypt_*.h. To "install" the lib just copy all the |
| header files "*.h" from the base of this project into your global include path. |
| -- Made the OFB/CFB/CTR functions use "unsigned long" for the length instead of "int" |
| -- Added keyring support for the PK functions |
| -- ***API CHANGE*** changed the ecc_make_key and dh_make_key to act more like rsa_make_key. Basically |
| move the first argument to the next to last. |
| -- Fixed bug in dh_test() that wouldn't test the primality of the order of the sub-group |
| -- replaced the primes in the DH code with new ones that are larger than the size they are |
| associated with. That is a 1024-bit DH key will have a 1025-bit prime as the modulus |
| -- cleaned up all the PK code, changed a bit of the API around [not source compatible with v0.66] |
| -- major editing of the manual, started Docer program |
| -- added 160 and 224 bit key settings for ECC. This makes the DH and ECC binary wise incompatible with v0.66 |
| -- Added an additional check for memory errors in is_prime() and cleaned up prime.c a bit |
| -- Removed ID_TAG from all files [meh, not a big fan...] |
| -- Removed unused variable from yarrow state and made AES/SHA256 the default cipher/hash combo |
| -- Fixed a bug in the Yarrow code that called prng_is_valid instead of cipher_is_valid from yarrow_start() |
| -- The ECB/CBC/OFB/CFB/CTR wrappers now check that the cipher is valid in the encrypt/decrypt calls |
| Returns int now instead of void. |
| |
| Sept 24th, 2002 |
| v0.66 -- Updated the /demos/test.c program to time the hashes correctly. Also it uses the yarrow PRNG for all of the |
| tests meaning its possible to run on RNG less platforms |
| -- Updated the /demos/hashsum.c program to hash from the standard input |
| -- Updated the RSA code to make keys a bit quicker [update by Wayne Scott] by not making both primes at the same |
| time. |
| -- Dan Kaminsky suggested some cleanups for the code and the MPI config |
| Code ships in unix LF format by default now too... will still build in MSVC and all... but if you want |
| to read the stuff you'll have to convert it |
| -- Changes to the manual to reflect new API [e.g. hash_memory/file have v0.65 prototypes]and some typos fixed |
| |
| Sept 20th, 2002 |
| v0.65 -- Wayne Scott (wscott@bitmover.com) made a few of suggestions to improve the library. Most |
| importantly he pointed out the math lib is not really required. He's also tested the lib on 18 |
| different platforms. According to him with only a few troubles [lack of /dev/random, etc] the |
| library worked as it was supposed to. You can find the list at |
| http://www.bitkeeper.com/Products.BitKeeper.Platforms.html |
| -- Updated the hash_file and hash_memory functions to keep track of the size of the output |
| -- Wayne Scott updated the demos/test.c file to use the SPRNG less and Yarrow more |
| -- Modified the mycrypt_cfg.h to autodetect x86-32 machines |
| |
| Sept 19th, 2002 |
| v0.64 -- wrote makefile for the GBA device [and hacked the demos/test.c file to support it conditionally] |
| -- Fixed error in PK (e.g. ECC, RSA, DH) import functions where I was clobbering the packet error messages |
| -- fixed more typos in the manual |
| -- removed all unused variables from the core library (ignore the ID_TAG stuff) |
| -- added "const char *crypt_build_settings" string which is a build time constant that gives a listing |
| of all the build time options. Useful for debugging since you can send that to me and I will know what |
| exactly you had set for the mycrypt_cfg.h file. |
| -- Added control over endianess. Out of the box it defaults to endianess neutral but you can trivially |
| configure the library for your platform. Using this I boosted RC5 from 660Mbit/sec to 785Mbit/sec on my |
| Athlon box. See "mycrypt_cfg.h" for more information. |
| |
| Sept 11th, 2002 |
| v0.63 -- Made hashsum demo output like the original md5sum program |
| -- Made additions to the examples in the manual (fixed them up a bunch) |
| -- Merged in the base64 code from Wayne Scott (wscott@bitmover.com) |
| |
| Aug 29th, 2002 |
| v0.62 -- Added the CLEAN_STACK functionality to several of the hashes I forgot to update. |
| |
| Aug 9th, 2002 |
| v0.61 -- Fixed a bug in the DES code [oops I read something wrong]. |
| |
| Aug 8th, 2002 |
| v0.60 -- Merged in DES code [and wrote 3DES-EDE code based on it] from Dobes V. |
| |
| Aug 7th, 2002 |
| v0.59 -- Fixed a "unsigned long long" bug that caused v0.58 not to build in MSVC. |
| -- Cleaned up a little in the makefile |
| -- added code that times the hash functions too in the test program |
| |
| Aug 3rd, 2002 |
| v0.58 -- Added more stack cleaning conditionals throughout the code. |
| -- corrected some CLEAR_STACK conditionals... should have been CLEAN_STACK |
| -- Simplified the RSA, DH and ECC encrypt() routines where they use CTR to encode the message |
| now they only make one call to ctr_encrypt()/ctr_decrypt(). |
| |
| Aug 2nd, 2002 |
| v0.57 -- Fixed a few errors messages in the SAFER code to actually report the correct cipher name. |
| -- rsa_encrypt() uses the "keysize()" method of the cipher being used to more accurately pick a |
| key size. By default rsa_encrypt() will choose to use a 256-bit key but the cipher can turn that |
| down if required. |
| -- The rsa_exptmod() function will now more reliably detect invalid inputs (e.g. greater than the modulus). |
| -- The padding method for RSA is more clearly documented. Namely if you want to encrypt/sign something of length |
| N then your modulus must be of length 1+3N. So to sign a message with say SHA-384 [48 bytes] you need a |
| 145 byte (1160 bits) modulus. This is all in the manual now. |
| -- Added build option CLEAN_STACK which will allow you to choose whether you want to clean the stack or not after every |
| cipher/hash call |
| -- Sped up the hash "process()" functions by not copying one byte at a time. |
| ++ (added just after I uploaded...) |
| MD4 process() now handles input buffers > 64 bytes |
| |
| Aug 1st, 2002 |
| v0.56 -- Cleaned up the comments in the Blowfish code. |
| -- Oh yeah, in v0.55 I made all of the descriptor elements constant. I just forgot to mention it. |
| -- fixed a couple of places where descriptor indexes were tested wrong. Not a huge bug but now its harder |
| to mess up. |
| -- Added the SAFER [64-bit block] ciphers K64, SK64, K128 and SK128 to the library. |
| -- Added the RC2 block cipher to the library. |
| -- Changed the SAFER define for the SAFER+ cipher to SAFERP so that the new SAFER [64-bit] ciphers |
| can use them with less confusion. |
| |
| July 29th, 2002 |
| v0.55 -- My god stupid Blowfish has yet again been fixed. I swear I hate that cipher. Next bug in it and boom its out of the |
| library. Use AES or something else cuz I really hate Blowfish at this stage.... |
| -- Partial PKCS support [hint DONT USE IT YET CUZ ITS UNTESTED!] |
| |
| July 19th, 2002 |
| v0.54 -- Blowfish now conforms to known test vectors. Silly bad coding tom! |
| -- RC5/RC6/Serpent all have more test vectors now [and they seemed to have been working before] |
| |
| July 18th, 2002 |
| v0.53 -- Added more test vectors to the blowfish code just for kicks [and they are const now too :-)] |
| -- added prng/hash/cipher is_valid functions and used them in all of the PK code so you can't enter the code |
| with an invalid index ever now. |
| -- Simplified the Yarrow code once again :-) |
| |
| July 12th, 2002 |
| v0.52 -- Fixed a bug in MD4 where the hash descriptor ID was the same as SHA-512. Now MD4 will work with |
| all the routines... |
| -- Fixed the comments in SHA-512 to be a bit more meaningful |
| -- In md4 I made the PADDING array const [again to store it in ROM] |
| -- in hash_file I switched the constant "512" to "sizeof(buf)" to be a bit safer |
| -- in SHA-1's test routine I fixed the string literal to say SHA-1 not sha1 |
| -- Fixed a logical error in the CTR code which would make it skip the first IV value. This means |
| the CTR code from v0.52 will be incompatible [binary wise] with previous releases but it makes more |
| sense this way. |
| -- Added {} braces for as many if/for/blocks of code I could find. My rule is that every for/if/while/do block |
| must have {} braces around it. |
| -- made the rounds table in saferp_setup const [again for the ROM think about the ROM!] |
| -- fixed RC5 since it no longer requires rc5 to be registered in the lib. It used to since the descriptors used to |
| be part of the table... |
| -- the packet.c code now makes crypt_error literal string errors when an error occurs |
| -- cleaned up the SAFER+ key schedule to be a bit easier to read. |
| -- fixed a huge bug in Twofish with the TWOFISH_SMALL define. Because I clean the stack now I had |
| changed the "g_func()" to be called indirectly. I forgot to actually return the return of the Twofish |
| g_func() function which caused it not to work... [does now :-)] |
| |
| July 11th, 2002 |
| v0.51 -- Fixed a bug in SHA512/384 code for multi-block messages. |
| -- Added more test vectors to the SHA384/512 and TIGER hash functions |
| -- cleaned up the hash done routines to make more sense |
| |
| July 10th, 2002 |
| v0.50 -- Fixed yarrow.c so that the cipher/hash used would be registered. Also fixed |
| a bug where the SAFER+ name was "safer" but should have been "safer+". |
| -- Added an element to the hash descriptors that gives the size of a block [sent into the compressor] |
| -- Cleaned up the support for HMAC's |
| -- Cleaned up the test vector routines to make the test vector data const. This means on some platforms it will be |
| placed in ROM not RAM now. |
| -- Added MD4 code submited by Dobes Vandermeer (dobes@smartt.com) |
| -- Added "burn_stack" function [idea taken from another source of crypto code]. The idea is if a function has |
| alot of variables it will clean up better. Functions like the ecb serpent and twofish code will now have their |
| stacks cleaned and the rest of the code is getting much more straightforward. |
| -- Added a hashing demo by Daniel Richards (kyhwana@world-net.co.nz) |
| -- I (Tom) modified some of the test vector routines to use more vectors ala Dobes style. |
| For example, the MD5/SHA1 code now uses all of the test vectors from the RFC/FIPS spec. |
| -- Fixed the register/unregister functions to properly report errors in crypt_error |
| -- Correctly updated yarrow code to remove a few unused variables. |
| -- Updated manual to fix a few erroneous examples. |
| -- Added section on Hash based Message Authentication Codes (HMAC) to the manual |
| |
| June 19th, 2002 |
| v0.46 -- Added in HMAC code from Dobes Vandermeer (dobes@smartt.com) |
| |
| June 8th, 2002 |
| v0.45 -- Fixed bug in rc5.c where if you called rc5_setup() before registering RC5 it would cause |
| undefined behaviour. |
| -- Fixed mycrypt_cfg.h to eliminate the 224 bit ECC key. |
| -- made the "default" makefile target have depends on mycrypt.h and mycrypt_cfg.h |
| |
| Apr 4th, 2002 |
| v0.44 -- Fixed bug in ecc.c::new_point() where if the initial malloc fails it would not catch it. |
| |
| Mar 22nd, 2002 |
| v0.43 -- Changed the ZLIB code over to the 1.1.4 code base to avoid the "double free" bug. |
| -- Updated the GCC makefile not to use -O3 or -funroll-loops |
| -- Version tag in mycrypt.h has been updated :-) |
| |
| Mar 10th, 2002 |
| v0.42 -- The RNG code can now use /dev/urandom before trying /dev/random (J. Klapste) |
| |
| Mar 3rd, 2002 |
| v0.41 -- Added support to link and use ciphers at compile time. This can greatly reduce the code size! |
| -- Added a demo to show off how small an application can get... 46kb! |
| -- Disastry pointed out that Blowfish is supposed to be high endian. |
| -- Made registry code for the PRNGs as well [now the smallest useable link is 43kb] |
| |
| Feb 11th, 2002 |
| v0.40 -- RSA signatures use [and check for] fixed padding scheme. |
| -- I'm developing in Linux now :-) |
| -- No more warnings from GCC 2.96 |
| |
| Feb 5th, 2002 |
| v0.39 -- Updated the XTEA code to work in accordance with the XTEA design |
| |
| January 24th, 2002 |
| v0.38 -- CFB and OFB modes can now handle blocks of variable size like the CTR code |
| -- Wrote a wrapper around the memory compress functions in Zlib that act like the functions |
| in the rest of my crypto lib |
| |
| January 23rd, 2002 |
| v0.37 -- Added support code so that if a hash size and key size for a cipher don't match up they will |
| use the next lower key supported. (mainly for the PK code). So you can now use SHA-1 with |
| Twofish, etc... |
| -- Added more options for Twofish. You can now tell it to use precomputed sboxes and MDS multiplications |
| This will speed up the TWOFISH_SMALL implementation by increasing the code size by 1024 bytes. |
| -- Fixed a bug in prime.c that would not use the correct table if you undefined SMALL_PRIME_TAB |
| -- Fixed all of the PK packet code to use the same header format [see packet.c]. This makes the PK code |
| binary wise incompatible with previous releases while the API has not changed at all. |
| |
| January 22nd, 2002 |
| v0.36 -- Corrections to the manual |
| -- Made a modification to Twofish which lets you build a "small ram" variant. It requires |
| about 190 bytes of ram for the key storage compared to the 4,200 bytes the normal |
| variant requires. |
| -- Reduced the stack space used in all of the PK routines. |
| |
| January 19th, 2002 |
| v0.35 -- If you removed the first hash or cipher from the library it wouldn't return an error if |
| you used an ID=0 [i.e blowfish or sha256] in any routine. Now it checks for that and will |
| return an error like it should |
| -- Merged in new routines from Clay Culver. These routines are for the PK code so you can easily |
| encode a symmetric key for multiple recipients. |
| -- Made the ecc and DH make_key() routines make secret keys of the same size as the keysize listed. |
| Originally I wanted to ensure that the keys were smaller than the order of the field used |
| However, the bias is so insignifcant using full sizes. For example, with a ECC-192 key the order |
| is about 2^191.99, so instead I rounded down and used a 184-bit secret key. Now I simply use a full 192-bit |
| key the code will work just the same except that some 192-bit keys will be duplicates which is not a big |
| deal since 1/2^192 is a very small bias! |
| -- Made the configuration a bit simpler and more exacting. You can for example now select which DH or ECC |
| key settings you wish to support without including the data for all other key settings. I put the #defines |
| in a new file called "mycrypt_cfg.h" |
| -- Configured "mpi-config.h" so its a bit more conservative with the memory required and code space used |
| -- Jason Klapste submitted bug fixes to the yarrow, hash and various other issues. The yarrow code will now |
| use what ever remaining hash/cipher combo is left [after you #undef them] at build time. He also suggested |
| a fix to remove unused structures from the symmetric_key and hash_state unions. |
| -- Made the CTR code handle variable length blocks better. It will buffer the encryption pad so you can |
| encrypt messages any size block at a time. |
| -- Simplified the yarrow code to take advantage of the new CTR code. |
| -- Added a 4096-bit DH key setting. That took me about 36 hours to find! |
| -- Changed the base64 routines to use a real base64 encoding scheme. |
| -- Added in DH and ECC "encrypt_key()" functions. They are still rather "beta"ish. |
| -- Added **Twofish** to the list of ciphers! |
| |
| January 18th, 2002 |
| v0.34 -- Added "sha512" to the list of hashes. Produces a 512-bit message digest. Note that with the current |
| padding with the rsa_sign() function you cannot use sha512 with a key less than 1536 bits for signatures. |
| -- Cleaned up the other hash functions to use the LOAD and STORE macros... |
| |
| January 17th, 2002 |
| v0.33 -- Made the lower limit on keysizes for RSA 1024 bits again because I realized that 768 bit keys wouldn't |
| work with the padding scheme and large symmetric keys. |
| -- Added information concerning the Zlib license to the manual |
| -- Added a 3072-bit key setting for the DH code. |
| -- Made the "find_xyz()" routines take "const char *" as per Clay Culver's suggestion. |
| -- Fixed an embarassing typo in the manual concerning the hashes. Thank's Clay for finding it! |
| -- Fixed rand_prime() so that it makes primes bigger than the setting you give. For example, |
| if you want a 1024-bit prime it would make a 1023-bit one. Now it ensures that the prime |
| it makes is always greater than 2^(8n) (n == bytes in prime). This doesn't have a huge |
| impact on security but I corrected it just the same. |
| -- Fixed the CTR routine to work on platforms where char != 8-bits |
| -- Fixed sha1/sha256/md5/blowfish to not assume "unsigned long == 32-bits", Basically any operation with carries |
| I "AND" with 0xFFFFFFFF. That forces only the lower 32-bits to have information in it. On x86 platforms |
| most compilers optimize out the AND operation since its a nop. |
| |
| January 16th, 2002 |
| v0.32 -- Made Rijndael's setup function fully static so it is thread safe |
| -- Svante Seleborg suggested a cosmetic style fixup for aes.c, |
| basically to remove some of the #defines to clean it up |
| -- Made the PK routines not export the ASCII version of the names of ciphers/hashes which makes |
| the PK message formats *incompatible* with previous releases. |
| -- Merge in Zlib :-) |
| |
| |
| January 15th, 2002 |
| v0.31 -- The RSA routines can now use CRT to speed up decryption/signatures. The routines are backwards |
| compatible with previous releases. |
| -- Fixed another bug that Svante Seleborg found. Basically you could buffer-overrun the |
| rsa_exptmod() function itself if you're not careful. That's fixed now. Fixed another bug in |
| rsa_exptmod() where if it knows the buffer you passed is too small it wouldn't free all used |
| memory. |
| -- improved the readability of the PK import/export functions |
| -- Added a fix to RSA.C by Clay Culver |
| -- Changed the CONST64 macro for MSVC to use the "unsigned __int64" type, e.g. "ui64" instead of "i64". |
| |
| January 14th, 2002 |
| v0.30 -- Major change to the Yarrow PRNG code, fixed a bug that Eugene Starokoltsev found. |
| Basically if you added entropy to the pool in small increments it could in fact |
| cancel out. Now I hash the pool with the new data which is way smarter. |
| |
| January 12th, 2002 |
| v0.29 -- Added MPI code written by Svante Seleborg to the library. This will make the PK code much |
| easier to follow and debug. Actually I've already fixed a memory leak in dh_shared_secret(). |
| -- Memory leaks found and correct in all three PK routines. The leaks would occur when a bignum |
| operation fails so it wouldn't normally turn up in the course of a program |
| -- Fixed bugs in dh_key_size and ecc_key_size which would return garbage for invalid key idx'es |
| |
| January 11th, 2002 |
| v0.28 -- Cleaned up some code so that it doesn't assume "char == 8bits". Mainly SAFER+ has been |
| changed. |
| -- ***HUGE*** changes in the PK code. I check all return values in the bignum code so if there |
| are errors [insufficient memory, etc..] it will be reported. This makes the code fairly more |
| robust and likely to catch any errors. |
| -- Updated the is_prime() function to use a new prototype [it can return errors now] and it also |
| does trial divisions against more primes before the Rabin Miller steps |
| -- Added OFB, CFB and ECB generic wrappers for the symmetric ciphers to round out the implementations. |
| -- Added Xtea to the list of ciphers, to the best of my ability I have verified this implementation. |
| I should note that there is not alot of concrete information about the cipher. "Ansi C" versions |
| I found did not address endianess and were not even portable!. This code is portable and to the |
| best of my knowledge implements the Xtea algorithm as per the [short] X-Tea paper. |
| -- Reformated the manual to include the **FULL** source code optimized to be pritable. |
| |
| January 9th, 2002 |
| v0.27 -- Changed the char constants to numerical values. It is backwards compatible and should work on |
| platforms where 'd' != 100 [for example]. |
| -- Made a change to rand_prime() which takes the input length as a signed type so you can pass |
| a negative len to get a "3 mod 4" style prime... oops |
| -- changed the MSVC makefile to build with a warning level of three, no warnings! |
| |
| January 8th, 2002 |
| v0.26 -- updated SHA-256 to use ROR() for a rotate so 64-bit machines won't corrupt |
| the output |
| -- Changed #include <> to #include "" for local .h files as per Richard Heathfields' suggestions. |
| -- Fixed bug in MPI [well bug in MSVC] that compiled code incorrectly in mp_set_int() |
| I added a work around that catches the error and continues normally. |
| |
| January 8th, 2002 |
| v0.25 -- Added a stupid define so MSVC 6.00 can build the library. |
| -- Big thanks to sci.crypt and "Ajay K. Agrawal" for helping me port this to MSVC |
| |
| January 7th, 2002 |
| v0.24 -- Sped up Blowfish by unrolling and removing the swaps. |
| -- Made the code comply with more traditional ANSI C standards |
| Should compile with MSVC with less errors |
| -- moved the demos and documentation into their own directories |
| so you can easily build the library with other tool chains |
| by compiling the files in the root |
| -- converted functions with length of outputs to use |
| "unsigned long" so 16-bit platforms will like this library more. |
| |
| January 5th, 2002 |
| v0.23 -- Fixed a small error in the MPI config it should build fine anywhere. |
| |
| January 4th, 2002 |
| v0.22 -- faster gf_mul() code |
| -- gf_shl() and gf_shr() are safe on 64-bit platforms now |
| -- Fixed an error in the hashes that Brian Gladman found. |
| Basically if the message has exactly 56 bytes left to be |
| compressed I handled them incorrectly. |
| |
| January 4th, 2002 |
| v0.21 -- sped up the ECC code by removing redundant divisions in the |
| point add and double routines. I also extract the bits more |
| efficiently in "ecc_mulmod()" now. |
| -- sped up [and documented] the rand_prime() function. Now it just |
| makes a random integer and increments by two until a prime is found |
| This is faster since it doesn't require alot of calls to the PRNG and |
| it doesn't require loading huge integers over and over. rand_prime() |
| can also make primes congruent to 3 mod 4 [i.e for a blum integer] |
| -- added a gf_sqrt() function that finds square roots in a GF(2^w) field |
| -- fixed a bug in gf_div() that would return the wrong results if the divisor had a greator |
| divisor than the dividend. |
| |
| January 4th, 2002 |
| v0.20 -- Added the fixed MPI back in so RSA and DH are much faster again |
| |
| v0.19 -- Updated the manual to reflect the fact that Brian Gladman wrote the AES and Serpent code. |
| -- DH, ECC and RSA signature/decryption functions check if the key is private |
| -- new DH signature/verification code works just like the RSA/ECC versions |
| |
| January 3rd, 2002 |
| v0.18 -- Added way more comments to each .C file |
| -- fixed a bug in cbc_decrypt(pt, ct, key) where pt == ct [i.e same buffer] |
| -- fixed RC5 so it reads the default rounds out of the cipher_descriptor table |
| -- cleaned up ecc_export() |
| -- Cleaned up dh_import() and ecc_import() which also perform more |
| error checking now |
| -- Fixed a serious flaw in rsa_import() with private keys. |
| |
| January 2nd, 2002 |
| v0.17 -- Fixed a bug in the random prime generator that fixes the wrong bits to one |
| -- ECC and DH code verify that the moduli and orders are in fact prime. That |
| slows down the test routines alot but what are you gonna do? |
| -- Fixed a huge bug in the mp_exptmod() function which incorrectly calculates g^x mod p for some |
| values of p. I replaced it with a slow function. Once the author of MPI fixes his faster routine |
| I will switch back. |
| |
| January 1st, 2002 [whoa new year!] |
| v0.16 -- Improved GF division code that is faster. |
| -- documented the GF code |
| |
| December 31st, 2001 |
| v0.15 -- A 1792-bit and 2048-bit DH setting was added. Took me all night to |
| find a 1792 and 2048-bit strong prime but what the heck |
| -- Library now has polynomial-basis GF(2^w) routines I wrote myself. Can be used to perform |
| ECC over GF(2^w) later on.... |
| -- Fixed a bug with the defines that allows it to build in windows |
| |
| December 30th, 2001 |
| v0.14 -- Fixed the xxx_encrypt() packet routines to make an IV of appropriate size |
| for the cipher used. It was defaulting to making a 256-bit IV... |
| -- base64_encode() now appends a NULL byte, um "duh" stupid mistake now fixed... |
| -- spell checked the manual again... :-) |
| |
| December 30th, 2001 |
| v0.13 -- Switching back to older copy of MPI since it works! arrg.. |
| -- Added sign/verify functions for ECC |
| -- all signature verification routines default to invalid signatures. |
| -- Changed all calls to memset to zeromem. Fixed up some buffer problems |
| in other routines. All calls to zeromem let the compiler determine the size |
| of the data to wipe. |
| |
| December 29th, 2001 |
| v0.12 -- Imported a new version of MPI [the bignum library] that should |
| be a bit more stable [if you want to write your own bignum |
| routines with the library that is...] |
| -- Manual has way more info |
| -- hash_file() clears stack now [like it should] |
| -- The artificial cap on the hash input size of 2^32 bits has been |
| removed. Basically I was too lazy todo 64-bit math before |
| [don't ask why... I can't remember]. Anyways the hashes |
| support the size of 2^64 bits [if you ever use that many bits in a message |
| that's just wierd...] |
| -- The hashes now wipe the "hash_state" after the digest is computed. This helps |
| prevent the internal state of the hash being leaked accidently [i.e stack problems] |
| |
| December 29th, 2001 |
| v0.11 -- Made #define's so you can trim the library down by removing |
| ciphers, hashs, modes of operation, prngs, and even PK algorithms |
| For example, the library with rijndael+ctr+sha1+ECC is 91KB compared |
| to the 246kb the full library takes. |
| -- Added ECC packet routines for encrypt/decrypt/sign/verify much akin to |
| the RSA packet routines. |
| -- ECC now compresses the public key, a ECC-192 public key takes 33 bytes |
| for example.... |
| |
| December 28th, 2001 |
| v0.10 -- going to restart the manual from scratch to make it more |
| clear and professional |
| -- Added ECC over Z/pZ. Basically provides as much as DH |
| except its faster since the numbers are smaller. For example, |
| A comparable 256-bit ECC key provides as much security as expected |
| from a DH key over 1024-bits. |
| -- Cleaned up the DH code to not export the symbol "sets[]" |
| -- Fixed a bug in the DH code that would not make the correct size |
| random string if you made the key short. For instance if you wanted |
| a 512-bit DH key it would make a 768-bit one but only make up 512-bits |
| for the exponent... now it makes the full 768 bits [or whatever the case |
| is] |
| -- Fixed another ***SERIOUS*** bug in the DH code that would default to 768-bit |
| keys by mistake. |
| |
| December 25th, 2001 |
| v0.09 -- Includes a demo program called file_crypt which shows off |
| how to use the library to make a command line tool which |
| allows the user to encode/decode a file with any |
| hash (on the passphrase) and cipher in CTR mode. |
| -- Switched everything to use typedef's now to clear up the code. |
| -- Added AES (128/192 and 256 bit key modes) |
| |
| December 24th, 2001 |
| v0.08 -- fixed a typo in the manual. MPI stores its bignums in |
| BIG endian not little. |
| -- Started adding a RNG to the library. Right now it tries |
| to open /dev/random and if that fails it uses either the |
| MS CSP or the clock drift RNG. It also allows callbacks |
| since the drift RNG is slow (about 3.5 bytes/sec) |
| -- the RNG can also automatically setup a PRNG as well now |
| |
| v0.07 -- Added basic DH routines sufficient to |
| negotiate shared secrets |
| [see the manual for a complete example!] |
| -- Fixed rsa_import to detect when the input |
| could be corrupt. |
| -- added more to the manual. |
| |
| December 22nd, 2001 |
| v0.06 -- Fixed some formatting errors in |
| the hash functions [just source code cleaning] |
| -- Fixed a typo in the error message for sha256 :-) |
| -- Fixed an error in base64_encode() that |
| would fail to catch all buffer overruns |
| -- Test program times the RSA and symmetric cipher |
| routines for kicks... |
| -- Added the "const" modifier to alot of routines to |
| clear up the purpose of each function. |
| -- Changed the name of the library to "TomCrypt" |
| following a suggestion from a sci.crypt reader.... |
| |
| v0.05 -- Fixed the ROL/ROR macro to be safe on platforms |
| where unsigned long is not 32-bits |
| -- I have added a bit more to the documentation |
| manual "crypt.pdf" provided. |
| -- I have added a makefile for LCC-Win32. It should be |
| easy to port to other LCC platforms by changing a few lines. |
| -- Ran a spell checker over the manual. |
| -- Changed the header and library from "crypt" to "mycrypt" to not |
| clash with the *nix package "crypt". |
| |
| v0.04 -- Fixed a bug in the RC5,RC6,Blowfish key schedules |
| where if the key was not a multiple of 4 bytes it would |
| not get loaded correctly. |
| |
| December 21st, 2001 |
| |
| v0.03 -- Added Serpent to the list of ciphers. |
| |
| v0.02 -- Changed RC5 to only allow 12 to 24 rounds |
| -- Added more to the manual. |
| |
| v0.01 -- We will call this the first version. |