ecc: Refactor low-level access functions.

* mpi/ec.c (point_copy): Move to cipher/ecc-curves.c.
(ec_get_reset): Rename to _gcry_mpi_ec_get_reset and make global.
(_gcry_mpi_ec_get_mpi): Factor most code out to _gcry_ecc_get_mpi.
(_gcry_mpi_ec_get_point): Factor most code out to _gcry_ecc_get_point.
(_gcry_mpi_ec_set_mpi): Factor most code out to _gcry_ecc_set_mpi.
(_gcry_mpi_ec_set_point): Factor most code out to _gcry_ecc_set_point.
* cipher/ecc-curves.c (_gcry_ecc_get_mpi): New.
(_gcry_ecc_get_point, _gcry_ecc_set_mpi, _gcry_ecc_set_point): New.
* cipher/ecc-misc.c (_gcry_ecc_compute_public): New.

Signed-off-by: Werner Koch <wk@gnupg.org>
mpicalc: Add statement to compute the number of bits.

* src/mpicalc.c (do_nbits): New.
(main): Add statement 'b'.

Signed-off-by: Werner Koch <wk@gnupg.org>
ecc: Allow the name "q@eddsa" to get/set the public key.

* cipher/ecc-curves.c (_gcry_ecc_get_mpi): Support "q@eddsa".
(_gcry_ecc_set_mpi): Support "q".
* cipher/ecc.c (eddsa_encodepoint): Rename to ...
(_gcry_ecc_eddsa_encodepoint): this and make global.  Remove arg
MINLEN and take from context.
(eddsa_decodepoint): Rename to
(_gcry_ecc_eddsa_decodepoint): this and make global. Remove arg LEN
and take from context.
(sign_eddsa, verify_eddsa): Take B from context.
(ecc_sign, ecc_verify): Add hack to set DIALECT.
(_gcry_pk_ecc_get_sexp): Use _gcry_ecc_compute_public.  Handle EdDSA.
* src/ec-context.h (mpi_ec_ctx_s): Add field NBITS.
* mpi/ec.c (ec_p_init): Init NBITS.
* tests/t-mpi-point.c (test_curve): Add Ed25519.
(sample_ed25519_q): New.
(context_param): Check new sample key.
(hex2buffer, hex2mpiopa): New.
(cmp_mpihex): Take care of opaque MPIs.

Signed-off-by: Werner Koch <wk@gnupg.org>
sexp: Improve printing of data with a leading zero.

* src/sexp.c (suitable_encoding): Detect leading zero byte.
mpi: Change not yet used _gcry_mpi_set_opaque_copy.

* mpi/mpiutil.c (_gcry_mpi_set_opaque_copy): Change prototype.
(_gcry_mpi_get_opaque_copy): Take care of gcry_malloc failure.
Make libgcrypt build with Clang on i386

* cipher/longlong.h [__i386__] (add_ssaaaa, sub_ddmmss)
(umul_ppmm, udiv_qrnnd): Do not cast asm output to USItype.
--

Clang defines __GNUC__ even when it's not GCC compatible. As result Clang
enables GCC-only assembly code in mpi/longlong.h and fails to build.

However, since changes to make libgcrypt build with Clang are smallish, and
changes do not cause problems with GCC, patch just does them.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
Add logging functions to the API.

* src/gcrypt.h.in (_GCRY_GCC_ATTR_PRINTF): New.
(gcry_log_debug, gcry_log_debughex, gcry_log_debugmpi): New.
(gcry_log_debugpnt, gcry_log_debugsxp): New.
* src/visibility.c (gcry_log_debug): New.
(gcry_log_debughex, gcry_log_debugmpi, gcry_log_debugpnt): New.
(gcry_log_debugsxp): New.
* src/libgcrypt.def, src/libgcrypt.vers: Add new functions.
* src/misc.c (_gcry_logv): Make public.
(_gcry_log_printsxp): New.
* src/g10lib.h (log_printsxp): New macro.
--

For debugging applications it is often required to dump certain data
structures.  Libgcrypt uses several internal functions for this.  To
avoid re-implementing everything in the caller, we now provide access
to some of those functions.

Signed-off-by: Werner Koch <wk@gnupg.org>
whirlpool: do bitcount calculation in finalization part

* cipher/whirlpool.c (whirlpool_context_t): Remove 'length', add
'nblocks'.
(whirlpool_add): Update 'nblocks' instead of 'length', and add early
return at one spot.
(whirlpool_write): Check for 'nblocks' overflow.
(whirlpool_final): Convert 'nblocks' to bit-counter, and use
whirlpool_write instead of whirlpool_add.
--

Currently Whirlpool uses large 256 bit counter that is increased in the
'write' function. However, we could to bit counter calculation as is
done in all the rest hash algorithms; use 64-bit block counter that is
converted to bit counter in finalization function. This change does
limit amount of bytes Whirlpool can process before overflowing bit counter.
With 256-bit counter, overflow happens after ~1.3e67 gigabytes. With 64-bit
block counter, overflow happens just after ~1.1e12 gigabytes. Patch keeps
the old behaviour of halting if counter overflows.

Main benefit for this patch is that after this change, we can use the
_gcry_md_block_write helper for Whirlpool too.

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
whirlpool: add stack burning after transform

* cipher/whirlpool.c (whirlpool_transform): Return burn stack depth.
(whirlpool_add): Do burn_stack.
--

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
Make Whirlpool use the _gcry_md_block_write helper

* cipher/whirlpool.c (whirlpool_context_t): Add 'bctx', remove
'buffer', 'count' and 'nblocks'.
(whirlpool_init): Initialize 'bctx'.
(whirlpool_transform): Adjust context argument type and burn stack
depth.
(whirlpool_add): Remove.
(whirlpool_write): Use _gcry_md_block_write.
(whirlpool_final, whirlpool_read): Adjust for 'bctx' usage.
--

Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
log: Try to print s-expressions in a more compact format.

* src/misc.c (count_closing_parens): New.
(_gcry_log_printsxp): Use new function.
* mpi/ec.c (_gcry_mpi_point_log): Take care of a NULL point.

Signed-off-by: Werner Koch <wk@gnupg.org>
ecc: Fix recomputing of Q for Ed25519.

* cipher/ecc-misc.c (reverse_buffer): New.
(_gcry_ecc_compute_public): Add ED255519 specific code.
* cipher/ecc.c (sign_eddsa): Allocate DIGEST in secure memory.  Get
rid of HASH_D.
* tests/t-mpi-point.c (context_param): Test recomputing of Q for
Ed25519.

Signed-off-by: Werner Koch <wk@gnupg.org>
ecc: Prepare for future Ed25519 optimization.

* mpi/ec-ed25519.c: New but empty file.
* mpi/ec-internal.h: New.
* mpi/ec.c: Include ec-internal.h.
(ec_mod): New.
(ec_addm): Use ec_mod.
(ec_mulm): Remove commented code.  Use ec_mod.
(ec_subm): Call simple sub.
(ec_pow2): Use ec_mulm.
(ec_mul2): New.
(dup_point_weierstrass): Use ec_mul2.
(dup_point_twistededwards): Add special case for a == -1.  Use
ec_mul2.
(add_points_weierstrass): Use ec_mul2.
(add_points_twistededwards): Add special case for a == -1.
(_gcry_mpi_ec_curve_point): Ditto.
(ec_p_init): Add hack to test Barrett functions.
* src/ec-context.h (mpi_ec_ctx_s): Add P_BARRETT.

* mpi/mpi-mod.c (_gcry_mpi_mod_barrett): Fix sign problem.

Signed-off-by: Werner Koch <wk@gnupg.org>
ecc: Use faster b parameter for Ed25519.

* cipher/ecc-curves.c (domain_parms): Replace b.
* tests/t-mpi-point.c (test_curve): Ditto.
--

This change has been suggested by NIIBE Yutaka:

  Here,

    0x98412DFC9311D490018C7338BF8688861767FF8FF5B2BEBE27548A14B235EC8FEDA4

  is: (121666^-1 mod q)*121665.

  (121666^-1) * 121665 mod q is:

    0x2DFC9311D490018C7338BF8688861767FF8FF5B2BEBE27548A14B235ECA6874A

  While it works for both, I think that shorter is better.

Signed-off-by: Werner Koch <wk@gnupg.org>
cipher: Add support for 128-bit keys in RC2

* cipher/rfc2268.c (oids_rfc2268_128): New
(_gcry_cipher_spec_rfc2268_128): New.
* cipher/cipher.c (cipher_table_entry): Add GCRY_CIPHER_RFC2268_128.
--

This patch adds support for decrypting (and encrypting) using 128-bit
keys using the RC2 algorithm.

Signed-off-by: Peter Wu <lekensteyn@gmail.com>

Actually this is merely enabling that extra ID for 128 bit RFC2268.
We should have used one id for that algorithm only, because a second
identifier merely for having the OID in the code is a bad idea.  My
initial fault and thus I better apply this patch to make the id not
entirely useless.  -wk
mpi: Fix gcry_mpi_neg.

* mpi/mpiutil.c (_gcry_mpi_neg): Copy U to W.

Signed-off-by: Werner Koch <wk@gnupg.org>
cipher: Simplify the cipher dispatcher cipher.c.

* src/gcrypt-module.h (gcry_cipher_spec_t):  Move to ...
* src/cipher-proto.h (gcry_cipher_spec_t): here.  Merge with
cipher_extra_spec_t.  Add fields ALGO and FLAGS.  Set these fields in
all cipher modules.
* cipher/cipher.c: Change most code to replace the former module
system by a simpler system to gain information about the algorithms.
(disable_pubkey_algo): Simplified.  Not anymore thread-safe, though.

* cipher/md.c (_gcry_md_selftest): Use correct structure.  Not a real
problem because both define the same function as their first field.

* cipher/pubkey.c (_gcry_pk_selftest): Take care of the disabled flag.

Signed-off-by: Werner Koch <wk@gnupg.org>
md: Simplify the message digest dispatcher md.c.

* src/gcrypt-module.h (gcry_md_spec_t):  Move to ...
* src/cipher-proto.h: here.  Merge with md_extra_spec_t.  Add fields
ALGO and FLAGS.  Set these fields in all digest modules.
* cipher/md.c: Change most code to replace the former module
system by a simpler system to gain information about the algorithms.

Signed-off-by: Werner Koch <wk@gnupg.org>
Fix missing prototype warning in visibility.c

* src/ec-context.h (_gcry_mpi_ec_new): Move prototype to mpi.h.
Remove last remains of the former module system.

* src/gcrypt-module.h, src/module.c: Remove.
* src/visibility.h: Do not include gcrypt-module.h.
* src/g10lib.h: Remove all prototypes from module.c
(gcry_module): Remove.
* cipher/cipher-internal.h (gcry_cipher_handle): Remove unused field.

Signed-off-by: Werner Koch <wk@gnupg.org>