ecc: Make a macro shorter.

* src/mpi.h (MPI_EC_TWISTEDEDWARDS): Rename to MPI_EC_EDWARDS.  CHnage
all users.
* cipher/ecc-curves.c (domain_parms): Add parameters for Curve3617 as
comment.
* mpi/ec.c (dup_point_twistededwards): Rename to dup_point_edwards.
(add_points_twistededwards): Rename to add_points_edwards.

Signed-off-by: Werner Koch <wk@gnupg.org>
Correct formatting of gcry_mac_get_algo_keylen documentation

* doc/gcrypt.texi: add braces near gcry_mac_get_algo_keylen
  documentation.

Use braces around unsigned int in gcry_mac_get_algo_keylen
documentation, otherwise texinfo breaks that and uses 'int' as a
function definition.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Add a function to retrieve algorithm used by MAC handler

* cipher/mac.c (_gcry_mac_get_algo): New function, returns used algo.
* src/visibility.c (gcry_mac_get_algo): New wrapper.
* src/visibility.h: Hanlde gcry_mac_get_algo.
* src/gcrypt-int.h (_gcry_mac_get_algo): New.
* src/gcrypt.h.in (gcry_mac_get_algo): New.
* src/libgcrypt.def (gcry_mac_get_algo): New.
* src/libgcrypt.vers (gcry_mac_get_algo): New.
* doc/gcrypt.texi: Document gcry_mac_get_algo.
* tests/basic.c (check_one_mac): Verify gcry_mac_get_algo.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Add MD2-HMAC calculation support

* src/gcrypt.h.in (GCRY_MAC_HMAC_MD2): New.
* cipher/mac-hmac.c: Support GCRY_MAC_HMAC_MD2.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Fix typo in search_oid

* cipher/md.c (search_oid): Invert condition on oid comparison.

--
Function stricmp() returns 0 in case strings match, so proper condition
that checks for matching OID strings should be if (!stricmp(...))

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Add GOST R 34.10-2001 curves per RFC4357

* cipher/ecc-curves.c (domain_parms): Add 3 curves defined in rfc4357.
* cipher/ecc-curves.c (curve_aliases): Add OID and Xch aliases for GOST
  curves.
* tests/curves.c (N_CURVES): Update value.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Add GOST R 34.10-2012 curves proposed by TC26

* cipher/ecc-curves.c (domain_parmss): Add two GOST R 34.10-2012 curves
  proposed/pending to standardization by TC26 (Russian cryptography
  technical comitee).
* cipher/ecc-curves.c (curve_alias): Add OID aliases.
* tests/curves.c: Increase N_CURVES.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Truncate hash values for ECDSA signature scheme

* cipher/dsa-common (_gcry_dsa_normalize_hash): New. Truncate opaque
  mpis as required for DSA and ECDSA signature schemas.
* cipher/dsa.c (verify): Return gpg_err_code_t value from verify() to
  behave like the rest of internal sign/verify functions.
* cipher/dsa.c (sign, verify, dsa_verify): Factor out hash truncation.
* cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_sign): Factor out hash truncation.
* cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_verify):
  as required by ECDSA scheme, truncate hash values to bitlength of
  used curve.
* tests/pubkey.c (check_ecc_sample_key): add a testcase for hash
  truncation.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Update NEWS.

--
Use internal malloc function in fips.c

* src/fips.c (check_binary_integrity): s/gcry_malloc/xtrymalloc/.
--

This fixes a build problem with ENABLE_HMAC_BINARY_CHECK.

Reported-by: Michal Vyskocil.
Fix macro conflict in NetBSD

* cipher/bithelp.h (bswap32): Rename to _gcry_bswap32.
(bswap64): Rename to _gcry_bswap64.
--

NetBSD provides system macros bswap32 and bswap64 which conflicts with
our macros.  Prefixing them with _gcry_ is easier than to come up with
a proper test.

GnuPG-bug-id: 1600
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 36214bfa8f612cd2faa4de217d1a12a8b5faadbf)
Add DCO entry for Milan Broz.

--
PBKDF2: Use gcry_md_reset to speed up calculation.

* cipher/kdf.c (_gcry_kdf_pkdf2): Use gcry_md_reset
to speed up calculation.
--

Current PBKDF2 implementation uses gcry_md_set_key in every iteration
which is extremely slow (even in comparison with other implementations).

Use gcry_md_reset instead and set key only once.

With this test program:

  char input[32000], salt[8], key[16];
  gcry_kdf_derive(input, sizeof(input), GCRY_KDF_PBKDF2,
                  gcry_md_map_name("sha1"),
                  salt, sizeof(salt), 100000, sizeof(key), key);

running time without patch:
  real    0m11.165s
  user    0m11.136s
  sys     0m0.000s

and with patch applied
  real    0m0.230s
  user    0m0.184s
  sys     0m0.024s

(The problem was found when cryptsetup started to use gcrypt internal PBKDF2
and for very long keyfiles unlocking time increased drastically.
See https://bugzilla.redhat.com/show_bug.cgi?id=1051733)

Signed-off-by: Milan Broz <gmazyland@gmail.com>
ecc: Fix _gcry_mpi_ec_p_new to allow secp256k1.

* mpi/ec.c (_gcry_mpi_ec_p_new): Remove checking a!=0.
* tests/t-mpi-point.c (context_alloc): Remove two spurious tests.

--

It is no problem when a==0.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
Replace ath based mutexes by gpgrt based locks.

* configure.ac (NEED_GPG_ERROR_VERSION): Require 1.13.
(gl_LOCK): Remove.
* src/ath.c, src/ath.h: Remove.  Remove from all files.  Replace all
mutexes by gpgrt based statically initialized locks.
* src/global.c (global_init): Remove ath_init.
(_gcry_vcontrol): Make ath install a dummy function.
(print_config): Remove threads info line.

* doc/gcrypt.texi: Simplify the multi-thread related documentation.
--

The current code does only work on ELF systems with weak symbol
support.  In particular no locks were used under Windows.  With the
new gpgrt_lock functions from the soon to be released libgpg-error
1.13 we have a better portable scheme which also allows for static
initialized mutexes.

Signed-off-by: Werner Koch <wk@gnupg.org>
Actually check for uint64_t.

* configure.ac: Check size of uint64_t and the UINT64_C macro.
--

configure.ac used $ac_cv_sizeof_uint64_t but never set this variable.
Due to the availability of long long on all platforms supporting
uint64_t this was not a real problem.  Found while remove the
corresponding test from gnupg.

Signed-off-by: Werner Koch <wk@gnupg.org>
md: Add Whirlpool bug emulation feature.

* src/gcrypt.h.in (GCRY_MD_FLAG_BUGEMU1): New.
* src/cipher-proto.h (gcry_md_init_t): Add arg FLAGS.  Change all code
to implement that flag.
* cipher/md.c (gcry_md_context):  Replace SECURE and FINALIZED by bit
field FLAGS.  Add flag BUGEMU1.  Change all users.
(md_open): Replace args SECURE and HMAC by FLAGS.  Init flags.bugemu1.
(_gcry_md_open): Add for GCRY_MD_FLAG_BUGEMU1.
(md_enable): Pass bugemu1 flag to the hash init function.
(_gcry_md_reset): Ditto.
--

This problem is for example exhibited in the Linux cryptsetup tool.
See https://bbs.archlinux.org/viewtopic.php?id=175737 .  It has be
been tracked down by Milan Broz.

The suggested way of using the flag is:

  if (whirlpool_bug_assumed)
    {
#if GCRYPT_VERSION_NUMBER >= 0x010601
      err = gcry_md_open (&hd, GCRY_MD_WHIRLPOOL, GCRY_MD_FLAG_BUGEMU1)
      if (gpg_err_code (err) == GPG_ERR_INV_ARG)
         error ("Need at least Libggcrypt 1.6.1 for the fix");
      else
         {
            do_hash (hd);
            gcry_md_close (hd);
          }
#endif
    }

Signed-off-by: Werner Koch <wk@gnupg.org>
tests: Rename tsexp.c

* tests/tsexp.c: Rename to t-sexp.c

Signed-off-by: Werner Koch <wk@gnupg.org>
cipher: Fix commit 94030e44

* cipher/tiger.c (tiger_init): Add arg FLAGS.
(tiger1_init, tiger2_init): Ditto.
Support building using the latest mingw-w64 toolchain.

* acinclude.m4 (GNUPG_SYS_SYMBOL_UNDERSCORE): Change mingw detection.
--

This patch is related to Debian-bug-id 730271 for GnuPG 1.4:

   From: Stephen Kitt <skitt@debian.org>

      All MinGW targets require underscores when linking. This patch fixes
      acinclude.m4 and the resulting configure so they don't limit the use
      of underscores to the old mingw32msvc targets.

Signed-off-by: Werner Koch <wk@gnupg.org>