Correct formatting of gcry_mac_get_algo_keylen documentation

* doc/gcrypt.texi: add braces near gcry_mac_get_algo_keylen
  documentation.

Use braces around unsigned int in gcry_mac_get_algo_keylen
documentation, otherwise texinfo breaks that and uses 'int' as a
function definition.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Fix typo in search_oid

* cipher/md.c (search_oid): Invert condition on oid comparison.

--
Function stricmp() returns 0 in case strings match, so proper condition
that checks for matching OID strings should be if (!stricmp(...))

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Fix macro conflict in NetBSD

* cipher/bithelp.h (bswap32): Rename to _gcry_bswap32.
(bswap64): Rename to _gcry_bswap64.
--

NetBSD provides system macros bswap32 and bswap64 which conflicts with
our macros.  Prefixing them with _gcry_ is easier than to come up with
a proper test.

GnuPG-bug-id: 1600
Signed-off-by: Werner Koch <wk@gnupg.org>
Update NEWS.

--
PBKDF2: Use gcry_md_reset to speed up calculation.

* cipher/kdf.c (_gcry_kdf_pkdf2): Use gcry_md_reset
to speed up calculation.
--

Current PBKDF2 implementation uses gcry_md_set_key in every iteration
which is extremely slow (even in comparison with other implementations).

Use gcry_md_reset instead and set key only once.

With this test program:

  char input[32000], salt[8], key[16];
  gcry_kdf_derive(input, sizeof(input), GCRY_KDF_PBKDF2,
                  gcry_md_map_name("sha1"),
                  salt, sizeof(salt), 100000, sizeof(key), key);

running time without patch:
  real    0m11.165s
  user    0m11.136s
  sys     0m0.000s

and with patch applied
  real    0m0.230s
  user    0m0.184s
  sys     0m0.024s

(The problem was found when cryptsetup started to use gcrypt internal PBKDF2
and for very long keyfiles unlocking time increased drastically.
See https://bugzilla.redhat.com/show_bug.cgi?id=1051733)

Signed-off-by: Milan Broz <gmazyland@gmail.com>
(cherry picked from commit 04cda6b7cc16f3f52c12d9d3e46c56701003496e)
md: Add Whirlpool bug emulation feature.

* src/gcrypt.h.in (GCRY_MD_FLAG_BUGEMU1): New.
* src/cipher-proto.h (gcry_md_init_t): Add arg FLAGS.  Change all code
to implement that flag.
* cipher/md.c (gcry_md_context):  Replace SECURE and FINALIZED by bit
field FLAGS.  Add flag BUGEMU1.  Change all users.
(md_open): Replace args SECURE and HMAC by FLAGS.  Init flags.bugemu1.
(_gcry_md_open): Add for GCRY_MD_FLAG_BUGEMU1.
(md_enable): Pass bugemu1 flag to the hash init function.
(_gcry_md_reset): Ditto.
--

This problem is for example exhibited in the Linux cryptsetup tool.
See https://bbs.archlinux.org/viewtopic.php?id=175737 .  It has
been tracked down by Milan Broz.

The suggested way of using the flag is:

  if (whirlpool_bug_assumed)
    {
#if GCRYPT_VERSION_NUMBER >= 0x010601
      err = gcry_md_open (&hd, GCRY_MD_WHIRLPOOL, GCRY_MD_FLAG_BUGEMU1)
      if (gpg_err_code (err) == GPG_ERR_INV_ARG)
         error ("Need at least Libggcrypt 1.6.1 for the fix");
      else
         {
            do_hash (hd);
            gcry_md_close (hd);
          }
#endif
    }

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 94030e44aaff805d754e368507f16dd51a531b72)

Reolved conflicts:
	NEWS
	cipher/whirlpool.c: Remove NBLOCKS arg from whirlpool_transform.
cipher: Fix commit 77f28793

* cipher/tiger.c (tiger_init): Add arg FLAGS.
(tiger1_init, tiger2_init): Ditto.

(cherry picked from commit dad06e4d1b835bac778b87090b1d3894b7535b14)
Support locking under Windows.

* src/ath.c: Add support for Windows.
* src/global.c (external_lock_test): New.
(_gcry_vcontrol): Call new function with formerly reserved code 61.

* tests/t-common.h: New. Taken from current libgpg-error.
* tests/t-lock.c: New.  Based on t-lock.c from libgpg-error.
* configure.ac (HAVE_PTHREAD): Set macro to 1 if defined.
(AC_CHECK_FUNCS): Check for flockfile.
* tests/Makefile.am (tests_bin): Add t-lock.
(noinst_HEADERS): Add t-common.h
(LDADD): Move value to ...
(default_ldadd): new.
(t_lock_LDADD): New.
--

1.6.0 misses locking for Windows and non ELF systems.  This patch
fixes the Windows case.

For 1.7 we will use the forthcoming gpgrt locking functions of
libgpg-error.  However, we don't want to to that for 1.6. and thus
implement W32 locking directly.  We further add a test feature for the
locking functions.

Signed-off-by: Werner Koch <wk@gnupg.org>
Truncate hash values for ECDSA signature scheme

* cipher/dsa-common (_gcry_dsa_normalize_hash): New. Truncate opaque
  mpis as required for DSA and ECDSA signature schemas.
* cipher/dsa.c (verify): Return gpg_err_code_t value from verify() to
  behave like the rest of internal sign/verify functions.
* cipher/dsa.c (sign, verify, dsa_verify): Factor out hash truncation.
* cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_sign): Factor out hash truncation.
* cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_verify):
  as required by ECDSA scheme, truncate hash values to bitlength of
  used curve.
* tests/pubkey.c (check_ecc_sample_key): add a testcase for hash
  truncation.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
(cherry picked from commit 9edcf1090e0485f9f383b6c54b18ea8ca3d4a225)
Check compiler features only for the relevant platform.

* mpi/config.links (mpi_cpu_arch): Always set for ARM.  Set for HPPA.
Set to "undefined" for unknown platforms.
(try_asm_modules): Act upon only after having detected the CPU.
* configure.ac: Move the call to config.links before the platform
specific compiler checks.  Check platform specific features only if
the platform is targeted.
--

There is no need to check x86 options if we are targeting ARM and vice
versa.  This may only introduce build problems.  With this patch the
summary output at the end of the compiler also shows more reasonable
messages.

Signed-off-by: Werner Koch <wk@gnupg.org>
Fix memory leaks in ecc code

* cipher/ecc-curves.c (_gcry_ecc_update_curve_param): Release passed mpi
  values.
* cipher/ecc.c (compute_keygrip): Fix potential memory leak in error
  path.
* cipher/ecc.c (_gcry_ecc_get_curve): Release temporary mpi.

--
==11657== 252 (80 direct, 172 indirect) bytes in 4 blocks are definitely lost in loss record 8 of 8
==11657==    at 0x4028A28: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==11657==    by 0x404178F: _gcry_private_malloc (stdmem.c:113)
==11657==    by 0x403CED1: do_malloc.constprop.4 (global.c:768)
==11657==    by 0x403DD01: _gcry_xmalloc (global.c:790)
==11657==    by 0x409EAE0: _gcry_mpi_alloc (mpiutil.c:84)
==11657==    by 0x409C4E4: _gcry_mpi_scan (mpicoder.c:466)
==11657==    by 0x404009C: _gcry_sexp_nth_mpi (sexp.c:796)
==11657==    by 0x40410B5: _gcry_sexp_vextract_param (sexp.c:2327)
==11657==    by 0x4041396: _gcry_sexp_extract_param (sexp.c:2378)
==11657==    by 0x407B895: compute_keygrip (ecc.c:1492)
==11657==    by 0x404BBE8: _gcry_pk_get_keygrip (pubkey.c:674)
==11657==    by 0x403B1BF: gcry_pk_get_keygrip (visibility.c:1056)

==16502== 144 (60 direct, 84 indirect) bytes in 3 blocks are definitely lost in loss record 3 of 7
==16502==    at 0x4028A28: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==16502==    by 0x404B4DE: _gcry_private_malloc (stdmem.c:113)
==16502==    by 0x404667B: do_malloc (global.c:768)
==16502==    by 0x40466E7: _gcry_malloc (global.c:790)
==16502==    by 0x4046A55: _gcry_xmalloc (global.c:944)
==16502==    by 0x40CD25B: _gcry_mpi_alloc (mpiutil.c:84)
==16502==    by 0x40CAC3E: _gcry_mpi_scan (mpicoder.c:548)
==16502==    by 0x40A72B2: scanval (ecc-curves.c:432)
==16502==    by 0x40A7B0D: _gcry_ecc_get_curve (ecc-curves.c:685)
==16502==    by 0x4058164: _gcry_pk_get_curve (pubkey.c:747)
==16502==    by 0x4043E14: gcry_pk_get_curve (visibility.c:1067)
==16502==    by 0x8048934: check_matching (curves.c:124)

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
(cherry picked from commit 6d87e6abdfb7552323a95401f14e6367398a3e5a)
Fix most of memory leaks in tests code

* tests/basic.c (check_ccm_cipher): Close cipher after use.
* tests/basic.c (check_one_cipher): Correct length of used buffer.
* tests/benchmark.c (cipher_bench): Use xcalloc to make buffer
  initialized.
* tests/keygen.c (check_ecc_keys): Release generated key.
* tests/t-mpi-point.c (context_param): Release mpi Q.
* tests/t-sexp.c (check_extract_param): Release extracted number.

--
The only remaining reported memory leak is one expected leak from
mpitests.c.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
(cherry picked from commit 5c150ece094bf0a504a111ce6c7b72e8d0b0457a)
tests: Pass -no-install to libtool

* tests/Makefile.am: add AM_LDFLAGS = -no-install

--
There is little point building tests with support for installation.
Passing -no-install stops libtool from building wrapper scripts,
thus allowing direct gdb/valgrind invocation on programs in tests/
subdirectory.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
(cherry picked from commit bf34bfa5c458ee5ece91f25e3b4194d768498ab6)
mpi: Minor fix for Atari-mint.

* mpi/config.links [m68k-atari-mint]: Do not assume 68020.  Suggested
by Alan Hourihane.
sexp: Fix broken gcry_sexp_nth.

* src/sexp.c (_gcry_sexp_nth): Return a valid S-expression for a data
element.
(NODE): Remove unused typedef.
(ST_HINT): Comment unused macro.

* tests/tsexp.c (bug_1594): New.
(main): Run new test.
--

Before 1.6.0 gcry_sexp_nth (list, 0) with a LIST of "(a (b 3:pqr) (c
3:456) (d 3:xyz))" returned the entire list.  1.6.0 instead returned
NULL.  However, this is also surprising and the expected value would
be "(a)".  This patch fixes this.

Somewhat related to that gcry_sexp_nth returned a broken list if
requesting index 1 of a list like "(n foo)".  It returned just the
"foo" but not as a list which is required by the S-expression specs.
Due to this patch the returned value is now "(foo)".

Thanks to Ludovic Courtès for pointing out these problems.

GnuPG-bug-id: 1594
(cherry picked from commit cbdc355415f83ed62da4f3618767eba54d7e6d37)

Resolved conflicts:
	tests/tsexp.c: Fix for renamed file in master.
Fix RSA Blinding.

* cipher/rsa.c (rsa_decrypt): Loop to get multiplicative inverse.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
(cherry picked from commit 121a90d8931944974054f7d94f63b7f89df87fa5)
tests: Remove non-portable format specifiers.

* tests/basic.c: Replace "%zi" by "%d" and casts.
Support non weak symbol pthread platforms.

* m4/lock.m4, m4/threadlib.m4: New.  From libgpg-error master.
* m4/Makefile.am (EXTRA_DIST): Add them.
* configure.ac (HAVE_PTHREAD): Remove test and ac_define.
(gl_LOCK): Do not use under Windows.
(LIBGCRYPT_CONFIG_LIBS): Add LIBTHREAD to support non-ELF pthread
systems.
* src/Makefile.am (dumpsexp_LDADD, mpicalc_LDADD, hmac256_LDADD)
(gcryptrnd_LDADD): Add LIBTHREAD.
* src/ath.c: Include pthread for any pthread version.
(ath_init, ath_install, ath_mutex_init, ath_mutex_destroy)
(ath_mutex_lock, ath_mutex_unlock): Support non-weak symbol pthread
systems.
* tests/Makefile.am (LDADD): Add LIBTHREAD.
* tests/t-lock.c: Replace HAVE_PTHREAD by USE_POSIX_THREADS
(run_test): Run only under W32 or pthread.
--

This has been tested on "AIX power-aix 1 7" using gcc 4.8.

Signed-off-by: Werner Koch <wk@gnupg.org>
Reserve control code for FIPS extensions.

* src/gcrypt.h.in (GCRYCTL_INACTIVATE_FIPS_FLAG): New.
(GCRYCTL_REACTIVATE_FIPS_FLAG): New.
* src/global.c (_gcry_vcontrol): Add them but return not_implemented.

(cherry picked from commit aea96a64fbc58a0b6f9f435e97e93294c6eb1052)
Release 1.6.1.

* configure.ac: Set LT version to C20/A0/R1.