Mercurial > dropbear
view changes @ 16:09ab3354aa21 libtomcrypt
propagate of e8bea23df30f9f46c647d06db3b223427b4e3604 and b0b6b4a8843b94d9f049cb5ffe0b1ae91ec1bf8b from branch 'au.asn.ucc.matt.ltc-orig' to 'au.asn.ucc.matt.ltc-db'
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Tue, 15 Jun 2004 14:27:14 +0000 |
| parents | 6362d3854bb4 |
| children | 5d99163f7e32 |
line wrap: on
line source
May 30th, 2004 v0.96 -- Removed GF and Keyring code -- Extended OAEP decoder to distinguish better [and use a more uniform API] -- Changed PSS/OAEP API slightly to be more consistent with other PK functions (order of arguments) -- rsa_exptmod() now pads with leading zeroes as per I2OSP. -- added error checking to yarrow code -- Mike Frysinger pointed out that tommath.h from this distro will overwrite tommath.h from libtommath. I changed this to ltc_tommath.h to avoid any such problems. -- Fixed bug in PSS encoder/decoder that didn't handle the MSB properly -- refactored AES, now sports an "encrypt only" descriptor which uses half as much code space. -- modded Yarrow to try and use refactored AES code and added WHIRLPOOL support (d'oh) ;-) -- updated ECB, OCB and CBC decrypt functions to detect when "encrypt only" descriptor is used. -- replaced old RSA code with new code that uses PKCS #1 v2.0 padding -- replaced old test harness with new over-engineer'ed one in /demos/test/ -- updated cbc/cfb/ofb/ctr code with setiv/getiv functions to change/read the IV without re-keying. -- Added PKCS #1 v1.5 RSA encryption and signature padding routines -- Added DER OID's to most hash descriptors (as many as I could find) -- modded rsa_exptmod() to use timing-resilient tim_exptmod() when doing private key operations added #define RSA_TIMING which can turn on/off this feature. -- No more config.pl so please just read mycrypt_custom.h for build-time tweaks -- Small update to rand_prime() -- Updated sha1, md5 and sha256 so they are smaller when SMALL_CODE is defined. If you want speed though, you're going to have to undefine SMALL_CODE ;-) -- Worked over AES so that it's even smaller now [in both modes]. May 12th, 2004 v0.95 -- Optimized AES and WHIRLPOOL for SMALL_CODE by taking advantage of the fact the transforms are circulant. AES dropped 5KB and WHIRLPOOL dropped 13KB using the default build options on the x86. -- Updated eax so the eax_done() would clear the state [like hmac,pmac,ocb] when CLEAN_STACK has been defined. -- added LTC_TEST support to rmd160 -- updates to mycrypt_pk.h -- updated rand_prime() to faciliate making RSA composites -- DSA/RSA now makes composites of the exact size desired. -- Refactored quite a bit of the code, fewer functions per C file -- cleaned up the makefiles to organize the objects logically -- added ICC makefile along with "profiled" targets for both GNU and ICC compilers -- Marked functions for removal before v1.00 see PLAN for more information -- GCC 3.4.0 tested and seems to work -- Added PKCS #5 support -- Fixed typo in comment header of .C files ;-) -- Added PKCS #1 OAEP and PSS support. Feb 20th, 2004 v0.94 -- removed unused variables from ocb.c and fixed it to match known test vectors. -- Added PMAC support, minor changes to OMAC/EAX code [I think....] -- Teamed up with Brian Gladman. His code verifies against my vectors and my code verifies against his test vectors. Hazaa for co-operation! -- Various small changes (added missing ARGCHKs and cleaned up indentation) -- Optimization to base64, removed unused variable "c" -- Added base64 gen to demos/tv_gen.c -- Fix to demos/x86_prof.c to correctly identify the i386 architecture... weird... -- Fixed up all of the PK code by adding missing error checking, removed "res" variables, shrunk some stack variables, removed non-required stack variables and added proper error conversion from MPI to LTC codes. I also spotted a few "off by one" error checking which could have been used to force the code to read past the end of the buffer (in theory, haven't checked if it would work) by a few bytes. -- Added checks to OUTPUT_BIGNUM so the *_export() functions cannot overflow the output and I also modded it so it stores in the output provided to the function (that is not on the local stack) which saves memory and time. -- Made SAFER default to disabled for now (plans are to cleanhouse write an implementation later) -- Added the 512-bit one-way hash WHIRLPOOL which clocks in at 138 cycles per byte on my Athlon XP [for comparison, SHA-512 clocks in at 77 cycles per byte]. This code uses the teams new sbox design (not the original NESSIE one). Jan 25th, 2004 v0.93 -- [note: deleted v0.93 changes by accident... recreating from memory...] -- Fix to RC2 to not deference pointer before ARGCHK -- Fix to NOEKEON to match published test vectors as well as cleaned up the code a bit -- Optimized Twofish [down to 28 cycles/byte on my box] and Blowfish -- Fix to OMAC to test cipher block size first [prevents wasting any time] -- Added more OMAC test vectors -- Added EAX Encrypt+Authenticate support -- Fix to DSA to check return of a few LTM functions I forgot [mp_to_unsigned_bin] -- Added common headers to all C files -- CTR mode supports big and little [default] endian counters now. -- fix to find_cipher_any() so that it can handle a fragmented cipher_descriptor table. -- added find_hash_any() akin to find_cipher_any(). -- Added EAX code to demos/tv_gen.c Hazaa! -- Removed SONY defines and files from codebase. -- Added OCB support [patents be damned] and to demos/tv_gen.c -- Merge all of the INPUT/OUTPUT BIGNUM macros (less toc) into mycrypt_pk.h -- Made appropriate changes to the debug string in crypt.c Dec 24th, 2003 v0.92 -- Updated the config.pl script so the options have more details. -- Updated demos/tv_gen to include RIPEMD hashes -- Updated Twofish so when TWOFISH_ALL_TABLES is defined a pre-computed RS table is included [speedup: slight, about 4k cycles on my Athlon]. -- Re-wrote the twofish large key generation [the four 8x32 key dependent tables]. Now about twice as fast. With both optimizations [e.g. TWOFISH_ALL_TABLES defined] a 128-bit Twofish key can now be scheduled in 26,000 cycles on my Athlon XP [as opposed to 49,000 before] when optimized for size. -- config.pl has been updated so rmd128.o and rmd160.o are objects included in the build [oops] -- Andrew Mann found a bug in rsa_exptmod() which wouldn't indicate if the wrong type of key was specified (e.g. not PK_PRIVATE or PK_PUBLIC) -- Fixed up demos/x86_prof so it sorts the output now :-) -- The project is now powered by radioactive rubber pants. -- Fixed dh_encrypt_key() so if you pass it a hash with a smaller output than the input key it will return CRYPT_INVALID_HASH [to match what ecc_encrypt_key() will do] -- Merge the store/encrypt key part of ecc_encrypt_key() as per dh_encrypt_key() [can you guess what I'm upto?] -- Massive updates to the prime generation code. I use the LTM random prime functions [and provide a nice interface between the LTC PRNG's and the LTM generic prng prototype]. I also use a variable number of tests depending on the input size. This nicely speeds up most prime generation/testing within the library. -- Added SHA-224 to the list of hashes. -- Made HMAC test vectors constant and static [takes ROM space instead of RAM] -- This release was brought to you by the letter P which stands for Patent Infringement. -- Added generic HASH_PROCESS macro to mycrypt_hash.h which simplifies the hash "process" functions I also optimized the compression functions of all but MD2 to not perform input copies when avoidable. -- Removed the division from the Blowfish setup function [dropped 3k cycles on my Athlon] -- Added stack cleaning to rijndael, cast5 so now all ciphers have CLEAN_STACK code. -- Added Skipjack to the list of ciphers [made appropriate changes to demos/test.c, demos/tv_gen.c and demos/x86_prof.c] -- Added mechanical testing to cipher test vector routines. Now it encrypts 1000 times, then decrypts and compares. Any fault (e.g. bug in code, compiler) in the routines is likely to show through. Doesn't stress test the key gen though... -- Matt Johnson found a bug in the blowfish.c apparently I was out of my mind and put twofish defines in there The code now builds with any config. Thanks. -- Added OMAC1 Message Authentication Code support to the library. -- Re-prototyped the hash "process" and "done" to prevent buffer overflows [which don't seem easy to exploit]. Updated HMAC code to use them too. Hazaa! -- Fixed bug in ECC code which wouldn't do an _ARGCHK on stat in ecc_verify_hash(). -- Fixed [temp fix] bug in all PK where the OUTPUT_BIGNUM macros would not trap errors on the to_unsigned_bin conversion [now returns CRYPT_MEM, will fix it up better later] -- Added DSA to the list of supported PK algorithms. -- Fixed up various ciphers to &255 the input key bytes where required [e.g. where used to index a table] to prevent problems on platforms where CHAR_BIT != 8 -- Merged in LibTomMath v0.28 -- Updated demos/x86_prof.c to use Yarrow during the key sched testing [was horribly slow on platforms with blockable /dev/random]. -- Added OMAC/HMAC tests to demos/tv_gen and I now store the output of this in notes/ -- Fixed a bug in config.pl that wouldn't have TWOFISH_TABLES defined by default (too many commas on the line) -- Fixed bug in hmac_done(). Apparently FIPS-198 [HMAC] specifies that the output can be truncated. My code would not support that (does now just like the new OMAC code). -- Removed "hashsize" from hmac_state as it wasn't being used. -- Made demos/test.c stop if OMAC or HMAC tests fail (instead of just printing a failed message and keep going). -- Updated notes/tech0003.txt to take into account the existence of Skipjack [also I fixed a few typos]. -- Slight changes to Noekeon, with SMALL_CODE undefined it uses a fully unrolled version. Dropped +10 cycles/byte on my Athlon (35 cycles per byte or 410.4Mbit/sec at 1795Mhz) -- Added _ARGCHK() calls to is_prime() for the two input pointers. Sept 25th, 2003 v0.91 -- HMAC fix of 0.90 was incorrect for keys larger than the block size of the hash. -- Added error CRYPT_FILE_NOTFOUND for the file [hmac/hash] routines. -- Added RIPEMD hashes to the hashsum demo. -- Added hashsum demo to MSVC makefile. -- Added RMD160 to the x86_prof demo [oops] -- Merged in LibTomMath-0.27 with a patch to mp_shrink() that will be in LibTomMath-0.28 Fixes another potential memory leak. Sept 7th, 2003 v0.90 -- new ROL/ROR for x86 GCC -- Jochen Katz submitted a patch to the makefile to prevent "make" from making the .a library when not required. == By default the KR code is not enabled [it's only a demo anyways!] -- changed the "buf" in ecc_make_key from 4KB to 128 bytes [since the largest key is 65 bytes] -- hmac_done() now requires you pass it the size of the destination buffer to prevent buffer overflows. (API CHANGE) -- hmac/hash filebased routines now return CRYPT_NOP if NO_FILE is defined. -- I've removed the primes from dh.c and replaced them with DR safe primes suitable for the default configuration of LibTomMath. Check out these comparisons on a 1.3Ghz Athlon XP, optimized for size, 768-bit, 4 vs. 10 1024-bit, 8 vs. 18 1280-bit, 12 vs. 34 1536-bit, 20 vs. 56 1792-bit 28 vs. 88 2048-bit, 40 vs. 124 2560-bit, 71 vs. 234 3072-bit, 113 vs. 386 4096-bit, 283 vs. 916 Times are all in milliseconds for key generation. New primes times on the left. This makes the code binary incompatible with previous releases. However, this addition is long overdue as LibTomMath has supported DR reductions for quite some time. -- Added RIPE-MD 128 and 160 to the list of supported hashes [10 in total]. -- The project has been released as public domain. TDCAL no longer applies. July 15th, 2003 v0.89 -- Fix a bug in bits.c which would prevent it from building with msvc -- Merged in LibTomMath v0.24 [and I used the alloc/free macros this time!] -- Removed the LTC version of next_prime() and replaced it with a call to the mp_prime_next_prime() from LibTomMath -- reverted bits.c to the 0.86 copy since the new one doesn't build in MSVC or cygwin. Jul 10th, 2003 v0.88 -- Sped up CAST5 key schedule for MSVC -- added "ulong32" which allows people on 64-bit platforms to force the 32-bit tables in ciphers like blowfish and AES to be 32-bits. E.g. when unsigned long is 64-bits. -- Optimized the SAFER-SK64, SAFER-SK128, SAFER+, RC5 and RC6 key schedule [big time!] -- Optimized SHA-1 and SHA-256 quite a bit too. -- Fixed up the makefile to use -fomit-frame-pointer more liberally -- Added tv_gen program which makes test vectors for ciphers/hashes -- Merged in LibTomMath v0.22 Jun 19th, 2003 v0.87 -- Many MSVC optimizations to the code base -- Improved the AES and Twofish key schedule [faster, more constant time] -- Tons of optimizations here and there. Jun 15th, 2003 v0.86 -- Fixed up AES to workaround MSVC optimizer bug -- Merged in fresh LTM base [based on v0.20] so there are no warnings with MSVC -- Wrote x86_prof which will time the hashes and ciphers downto cycles per byte. -- Fixed up demos/encrypt to remove serpent_desc from the list -- Re-enabled MSVC optimizations w00t w00t -- Replaced "errno" with "err" in all functions that had it so it wouldn't clash with the global "errno" -- Removed a set of unused variables from certain functions -- Removed {#line 0 "..."} stuff from mpi.c to comply with ISO C :-) Jun 11th, 2003 v0.85 -- Swapped in a new AES routine -- Removed Serpent -- Added TDCAL policy document Jun 1st, 2003 v0.84 -- Removed a 4KB buffer from rsa_decrypt_key that wasn't being used no more -- Fixed another potential buffer problem. Not an overflow but could cause the PK import routines to read past the end of the buffer. -- Optimized the ECC mulmod more by removing a if condition that will always be false -- Optimized prime.c to not include a 2nd prime table, removed code from is_prime calls prime test from LibTomMath now -- Added LTC_TEST define which when defined will enable the test vector routines [see mycrypt_custom.h] -- Removed ampi.o from the depends cuz it ain't no not working in *nix with it [routines are in mpi.c now]. Mar 29th, 2003 v0.83 -- Optimized the ecc_mulmod, it's faster and takes less heap/stack space -- Fixed a free memory error in ecc_mulmod and del_point which would try to free NULL -- Fixed two serious bugs in rsa_decrypt_key and rsa_verify_hash that would allow a trivialy buffer overflow. -- Fixed a bug in the hmac testing code if you don't register all the hashes it won't return errors now. Mar 15th, 2003 v0.82 -- Manual updated -- Added MSVC makefile [back, actually its written from scratch to work with NMAKE] -- Change to HMAC helper functions API to avoid buffer overflow [source changes] -- the rsa_encrypt_key was supposed to reject key sizes out of bounds ... same fix to the rsa_sign_hash -- Added code to ensure that that chaining mode code (cfb/ofb/ctr/cbc) have valid structures when being called. E.g. the indexes to the pad/ivs are not out of bounds -- Cleaned up the DES code and simplified the core desfunc routine. -- Simplified one of the boolean functions in MD4 Jan 16th, 2003 v0.81 -- Merged in new makefile from Clay Culver and Mike Frysinger -- Sped up the ECC mulmod() routine by making the word size adapt to the input. Saves a whopping 9 point operations on 521-bit keys now (translates to about 8ms on my Athlon XP). I also now use barrett reduction as much as possible. This sped the routine up quite a bit. -- Fixed a huge flaw in ecc_verify_hash() where it would return CRYPT_OK on error... Now fixed. -- Fixed up config.pl by fixing an invalid query and the file is saved in non-windows [e.g. not CR/LF] format (fix due to Mika Bostr�m) -- Merged in LibTomMath for kicks -- Changed the build process so that by default "mycrypt_custom.h" is included and provided The makefile doesn't include any build options anymore -- Removed the PS2 and VC makefiles. Dec 16th, 2002 v0.80 -- Found a change I made to the MPI that is questionable. Not quite a bug but definately not desired. Had todo with the digit shifting. In v0.79 I simply truncated without zeroing. It didn't cause problems during my testing but I fixed it up none the less. -- Optimized s_mp_mul_dig() from MPI to do a minimal number of passes. -- Fixed in rsa_exptmod() where I was getting the size of the result. Basically it accomplishes the same thing but the fixed code is more readable. -- Fixed slight bug in dh_sign_hash() where the random "k" value was 1 byte shorter than it should have been. I've also made the #define FAST_PK speed up signatures as well. Essentially FAST_PK tells the DH sub-system to limit any private exponent to 256-bits. Note that when FAST_PK is defined does not make the library binary or source incompatible with a copy of the library with it undefined. -- Removed the DSA code. If you want fast diffie-hellman just define FAST_PK :-) -- Updated dh_sign_hash()/dh_verify_hash() to export "unsigned" bignums. Saves two bytes but is not binary compatible with the previous release... sorry! I've performed the same fix to the ecc code as well. -- Fixed up the PK code to remove all use of mp_toraw() and mp_read_raw() [get all the changes out of the way now] -- Fixed a bug in the DH code where it missed trapping a few errors if they occurred. -- Fixed a slight "its-not-a-bug-but-could-be-done-better" bug in the next_prime() function. Essentially it was testing to ensure that in the loop that searches for the next candidate that the step never grows beyond 65000. Should have been testing for MP_DIGIT_MAX -- Spruced up the config.pl script. It now makes a header file "mycrypt_custom.h" which can be included *before* you include mycrypt.h. This allows you to add libtomcrypt to a project without completely changing your make system around. Note that you should use the makefile it writes to at least build the library initially. -- Used splint to check alot of the code out. Tons of minor fixes and explicit casts added. -- Also made all the internal functions of MPI are now static to avoid poluting the namespace -- **Notice**: There are no planned future releases for at least a month from the this release date. Dec 14th, 2002 v0.79 -- Change to PK code [binary and source]. I made it so you have to pass the buffer size to the *_decrypt_key and *_verify_hash functions. This prevents malformed packets from performing buffer overflows. I've also trimmed the packet header size [by 4 bytes]. -- Made the test program halt on the first error it occurs. Also made it trap more errors than before. -- Wrote the first chapter of my new book [DRAFT!], not in this package but check my website! -- Included a perl script "config.pl" that will make "makefile.out" according to the users needs. -- Added shell script to look for latest release -- Merge DH and ECC key defines from mycrypt_cfg.h into the makefiles -- updated the makefile to use BSD friendly archiving invokations -- Changed the DH and ECC code to use base64 static key settings [e.g. the primes]. Dropped the code size by 3KB and is ever-so-slightly faster than before. -- added "mp_shrink" function to shrink the size of bignums. Specially useful for PK code :-) -- Added new exptmod function that calculates a^b mod c with fewer multiplies then before [~20% for crypto sized numbers]. Also added a "low mem" variant that doesn't use more than 20KB [upto 4096 bit nums] of heap todo the calculation. Both are #define'able controlled -- Added XREALLOC macro to provide realloc() functionality. -- Added fix where in rsa_import() if you imported a public key or a non-optimized key it would free the mp_int's not being used. -- Fixed potential bug in the ECC code. Only would occur on platforms where char is not eight bits [which isn't often!] -- Fixed up the ECC point multiplication, its about 15% faster now -- While I was at it [since the lib isn't binary backwards compatible anyways] I've fixed the PK export routines so they export as "unsigned" types saving 1 byte per bignum outputted. Not a lot but heck why not. Nov 28th, 2002 v0.78 -- Made the default ARGCHK macro a function call instead which reduced the code size from 264KB to 239KB. -- Fixed a bug in the XTEA keysize function which called ARGCHK incorrectly. -- Added Noekeon block cipher at 2,800 bytes of object code and 345Mbit/sec it is a welcome addition. -- Made the KR code check if the other PK systems are included [provides error when building otherwise]. -- Made "aes" an alias for Rijndael via a pre-processor macro. Now you can use "aes_ecb_encrypt", etc... :-) Thanks to Jean-Luc Cooke for the "buzzword conformance" suggestion. -- Removed the old PK code entirely (e.g. rsa_sign, dh_encrypt). The *_sign_hash and *_encrypt_key functions are all that is to remain. -- **NOTE** Changed the PK *_import (including the keyring) routine to accept a "inlen" parameter. This fixes a bug where improperly made key packets could result in reading passed the end of the buffer. This means the code is no longer source compatible but still binary compatible. -- Fixed a few other minor bugs in the PK import code while I was at it. Nov 26th, 2002 v0.77 -- Updated the XTEA code to use pre-computed keys. With optimizations for speed it achieves 222Mbit/sec compared to the 121Mbit/sec before. It is 288 bytes bigger than before. -- Cleaned up some of the ciphers and hashes (coding style, cosmetic changes) -- Optimized AES slightly for 256-bit keys [only one if statement now, still two for 192-bit keys] -- Removed most test cases from Blowfish, left three of them there. Makes it smaller and faster to test. -- Changed the primality routines around. I now use 8 rounds of Rabin-Miller, I use 256 primes in the sieve step and the "rand_prime" function uses a modified sieve that avoids alot of un-needed bignum work. -- Fixed a bug in the ECC/DH signatures where the keys "setting" value was not checked for validity. This means that a invalid value could have caused segfaults, etc... -- **NOTE** Changed the way the ECC/DH export/import functions work. They are source but not binary compatible with v0.76. Essentially insteading of exporting the setting index like before I export the key size. Now if you ever re-configure which key settings are supported the lib will still be able to make use of your keys. -- Optimized Blowfish by inlining the round function, unrolling it for four rounds then using a for loop for the rest. It achieves a rate of 425Mbit/sec with the new code compared to 314Mbit/sec before. The new blowfish object file is 7,813 bytes compared to 8,663 before and is 850 bytes smaller. So the code is both smaller and faster! -- Optimized Twofish as well by inlining the round function. Gets ~400Mbit/sec compared to 280Mbit/sec before and the code is only 78 bytes larger than the previous copy. -- Removed SMALL_PRIME_TAB build option. I use the smaller table always. -- Fixed some mistakes concerning prime generation in the manual. -- [Note: sizes/speeds are for GCC 3.2 on an x86 Athlon XP @ 1.53Ghz] Nov 25th, 2002 v0.76 -- Updated makefiles a bit more, use "-Os" instead of "-O2" to optimize for size. Got the lib downto 265KB using GCC 3.2 on my x86 box. -- Updated the SAFER+, Twofish and Rijndael test vector routine to use the table driven design. -- Updated all other test vector routines to return as soon as an error is found -- fixed a bug in the test program where errors in the hash test routines would not be reported correctly. I found this by temporarily changing one of the bytes of the test vectors. All the hashes check out [the demos/test.c would still have reported an error, just the wrong one]. Nov 24th, 2002 v0.75 -- Fixed a flaw in hash_filehandle, it should ARGCHK that the filehandle is not NULL -- Fixed a bug where in hash_file if the call to hash_filehandle failed the open file would not be closed. -- Added more strict rules to build process, starting to weed out "oh this works in GCC" style code In the next release "-Wconversion" will be enabled which will deal with all implicit casts. Nov 22nd, 2002 [later in the day] v0.74 -- Wrote a small variant of SAFER+ which shaved 50KB off the size of the library on x86 platforms -- Wrote a build option to remove the PK packet functions [keeps the encrypt_key/sign_hash functions] -- Wrote a small variant of Rijndael (trimmed 13KB) -- Trimmed the TIGER/192 hash function a bit -- Overall the entire lib compiled is 295KB [down from 400KB before] -- Fixed a few minor oversights in the MSVC makefile Nov 22nd, 2002 v0.73 -- Fixed bug in RC4 code where it could only use 255 byte keys. -- Fixed bug in yarrow code where it would allow cast5 or md2 to be used with it... -- Removed the ecc compress/expand points from the global scope. Reduces namespace polution -- Fixed bug where if you used the SPRNG you couldn't pass NULL as your prng_state which you should be able todo since the SPRNG has no state... -- Corrected some oversights in the manual and the examples... -- By default the GF(2^W) math library is excluded from the build. The source is maintained because I wrote it and like it :-). This way the built library is a tad smaller -- the MSVC makefile will now build for a SPACE optimized library rather than TIME optimized. Nov 21th, 2002 v0.72 -- Fixed bug in the prime testing. In the Miller-Rabin test I was raising the base to "N-1" not "r". The math still worked out fine because in effect it was performing a Fermat test. Tested the new code and it works properly -- Fixed some of the code where it was still using the old error syntax -- Sped up the RSA decrypt/sign routines -- Optimized the ecc_shared_secret routine to not use so much stack -- Fixed up the makefile to make releases where the version # is in the file name and directory it will unzip to Nov 19th, 2002 v0.71 -- HELP TOM. I need tuition for the January semester. Now I don't want to force donations [nor will I ever] but I really need the help! See my website http://tom.iahu.ca/help_tom.html for more details. Please help if you can! -------------------------------------------------------------------------------------------------------------- -- Officially the library is no longer supported in GCC 3.2 in windows [cygwin]. In windows you can either use GCC 2.95.3 or try your luck with 3.2 It seems that "-fomit-frame-pointer" is broken in the windows build [but not the linux x86 build???] If you simply must use 3.2 then I suggest you limit the optimizations to simply "-O2" -- Started new error handling API. Similar to the previous except there are more error codes than just CRYPT_ERROR -- Added my implementation of the MD2 hash function [despite the errors in the RFC I managed to get it right!] -- Merged in more changes from Sky Schulz. I have to make mention here that he has been a tremendous help in getting me motivated to make some much needed updates to the library! -- Fixed one of the many mistakes in the manual as pointed out by Daniel Richards -- Fixed a bug in the RC4 code [wasn't setting up the key correctly] -- Added my implementation of the CAST5 [aka CAST-128] block cipher (conforms...) -- Fixed numerous bugs in the PK code. Essentially I was "freeing" keys when the import failed. This is neither required nor a good a idea [double free]. -- Tom needs a job. -- Fixed up the test harness as requested by Sky Schulz. Also modifed the timing routines to run for X seconds and count # of ops performed. This is more suitable than say encrypting 10 million blocks on a slow processor where it could take minutes! -- Modified test programs hashsum/encrypt to use the new algorithms and error handling syntax -- Removed the PKCS code since it was incomplete. In the future I plan on writing a "add-on" library that provides PKCS support... -- updated the config system so the #defines are in the makefiles instead of mycrypt_cfg.h -- Willing to work on an hourly basis for 15$ CDN per hour. -- updated the test program to not test ciphers not included -- updated the makefile to make "rsa_sys.c" a dependency of rsa.o [helps develop the code...] -- fixed numerous failures to detect buffer overflows [minor] in the PK code. -- fixed the safer [64-bit block version] test routines which didn't check the returns of the setup function -- check out my CV at http://tom.iahu.ca/cv.html -- removed the GBA makefile and code from demos/test.c [not a particularly useful demo...] -- merged in rudimentary [for testing] PS2 RNG from Sky Schulz -- merged in PS2 timer code [only shell included due to NDA reasons...] -- updated HMAC code to return errors where possible -- Thanks go to Sky Schulz who bought me a RegCode for TextPad [the official editor of libtomcrypt] Nov 12th, 2002 v0.70 -- Updated so you can swap out the default malloc/calloc/free routines at build time with others. (Sky Schulz) -- Sky Schulz contributed some code towards autodetecting the PS2 in mycrypt_cfg.h -- Added PS2 makefile contributed by Sky Schulz [see a pattern forming?] -- Added ability to have no FILE I/O functions at all (see makefile), Sky Schulz.... -- Added support for substituting out the clock() function (Sky Schulz) -- Fixed up makefile to include new headers in the HEADERS variable -- Removed "coin.c" as its not really useful anyways -- Removed many "debug" printfs that would show up on failures. Basically I wanted to ensure the only output would be from the developer themselves. -- Added "rc4.c" a RC4 implementation with a PRNG interface. Since RC4 isn't a block cipher it wouldn't work too well as a block cipher. -- Fixed ARGCHK macro usage when ARGTYPE=1 throughout the code -- updated makefile to make subdirectory properly (Sku Schulz) -- Started towards new API setup. Instead of checking for "== CRYPT_ERROR" you should check "!= CRYPT_OK" In future releases functions will return things other than CRYPT_ERROR on error to give more useful thread safe error reporting. The manual will be updated to reflect this. For this release all errors are returned as CRYPT_ERROR (except as noted) but in future releases this will change. -- Removed the zlib branch since its not really required anyways. Makes the package smaller Nov 11th, 2002 v0.69 -- Added ARGCHK (see mycrypt_argchk.h) "arguement checking" to all functions that accept pointers -- Note I forgot to change the CRYPT version tag in v0.68... fixed now. Nov 8th, 2002 v0.68 -- Fixed flaw in kr_import/kr_export that wasted 4 bytes. Source but not binary compatible with v0.67 -- Fixed bug in kr_find_name that used memcmp to match strings. Uses strncmp now. -- kr_clear now sets the pointer to NULL to facilate debugging [e.g. using the keyring after clearing] -- static functions in _write/_read in keyring.c now check the return of ctr_encrypt/ctr_decrypt. -- Updated blowfish/rc2/rc5/rc6 keysize() function to not reject keys larger than the biggest key the respective ciphers can use. -- Fixed a bug in hashsum demo that would report the hash for files that don't exist! Oct 16th, 2002 v0.67 -- Moved the function prototypes into files mycrypt_*.h. To "install" the lib just copy all the header files "*.h" from the base of this project into your global include path. -- Made the OFB/CFB/CTR functions use "unsigned long" for the length instead of "int" -- Added keyring support for the PK functions -- ***API CHANGE*** changed the ecc_make_key and dh_make_key to act more like rsa_make_key. Basically move the first argument to the next to last. -- Fixed bug in dh_test() that wouldn't test the primality of the order of the sub-group -- replaced the primes in the DH code with new ones that are larger than the size they are associated with. That is a 1024-bit DH key will have a 1025-bit prime as the modulus -- cleaned up all the PK code, changed a bit of the API around [not source compatible with v0.66] -- major editing of the manual, started Docer program -- added 160 and 224 bit key settings for ECC. This makes the DH and ECC binary wise incompatible with v0.66 -- Added an additional check for memory errors in is_prime() and cleaned up prime.c a bit -- Removed ID_TAG from all files [meh, not a big fan...] -- Removed unused variable from yarrow state and made AES/SHA256 the default cipher/hash combo -- Fixed a bug in the Yarrow code that called prng_is_valid instead of cipher_is_valid from yarrow_start() -- The ECB/CBC/OFB/CFB/CTR wrappers now check that the cipher is valid in the encrypt/decrypt calls Returns int now instead of void. Sept 24th, 2002 v0.66 -- Updated the /demos/test.c program to time the hashes correctly. Also it uses the yarrow PRNG for all of the tests meaning its possible to run on RNG less platforms -- Updated the /demos/hashsum.c program to hash from the standard input -- Updated the RSA code to make keys a bit quicker [update by Wayne Scott] by not making both primes at the same time. -- Dan Kaminsky suggested some cleanups for the code and the MPI config Code ships in unix LF format by default now too... will still build in MSVC and all... but if you want to read the stuff you'll have to convert it -- Changes to the manual to reflect new API [e.g. hash_memory/file have v0.65 prototypes]and some typos fixed Sept 20th, 2002 v0.65 -- Wayne Scott ([email protected]) made a few of suggestions to improve the library. Most importantly he pointed out the math lib is not really required. He's also tested the lib on 18 different platforms. According to him with only a few troubles [lack of /dev/random, etc] the library worked as it was supposed to. You can find the list at http://www.bitkeeper.com/Products.BitKeeper.Platforms.html -- Updated the hash_file and hash_memory functions to keep track of the size of the output -- Wayne Scott updated the demos/test.c file to use the SPRNG less and Yarrow more -- Modified the mycrypt_cfg.h to autodetect x86-32 machines Sept 19th, 2002 v0.64 -- wrote makefile for the GBA device [and hacked the demos/test.c file to support it conditionally] -- Fixed error in PK (e.g. ECC, RSA, DH) import functions where I was clobbering the packet error messages -- fixed more typos in the manual -- removed all unused variables from the core library (ignore the ID_TAG stuff) -- added "const char *crypt_build_settings" string which is a build time constant that gives a listing of all the build time options. Useful for debugging since you can send that to me and I will know what exactly you had set for the mycrypt_cfg.h file. -- Added control over endianess. Out of the box it defaults to endianess neutral but you can trivially configure the library for your platform. Using this I boosted RC5 from 660Mbit/sec to 785Mbit/sec on my Athlon box. See "mycrypt_cfg.h" for more information. Sept 11th, 2002 v0.63 -- Made hashsum demo output like the original md5sum program -- Made additions to the examples in the manual (fixed them up a bunch) -- Merged in the base64 code from Wayne Scott ([email protected]) Aug 29th, 2002 v0.62 -- Added the CLEAN_STACK functionality to several of the hashes I forgot to update. Aug 9th, 2002 v0.61 -- Fixed a bug in the DES code [oops I read something wrong]. Aug 8th, 2002 v0.60 -- Merged in DES code [and wrote 3DES-EDE code based on it] from Dobes V. Aug 7th, 2002 v0.59 -- Fixed a "unsigned long long" bug that caused v0.58 not to build in MSVC. -- Cleaned up a little in the makefile -- added code that times the hash functions too in the test program Aug 3rd, 2002 v0.58 -- Added more stack cleaning conditionals throughout the code. -- corrected some CLEAR_STACK conditionals... should have been CLEAN_STACK -- Simplified the RSA, DH and ECC encrypt() routines where they use CTR to encode the message now they only make one call to ctr_encrypt()/ctr_decrypt(). Aug 2nd, 2002 v0.57 -- Fixed a few errors messages in the SAFER code to actually report the correct cipher name. -- rsa_encrypt() uses the "keysize()" method of the cipher being used to more accurately pick a key size. By default rsa_encrypt() will choose to use a 256-bit key but the cipher can turn that down if required. -- The rsa_exptmod() function will now more reliably detect invalid inputs (e.g. greater than the modulus). -- The padding method for RSA is more clearly documented. Namely if you want to encrypt/sign something of length N then your modulus must be of length 1+3N. So to sign a message with say SHA-384 [48 bytes] you need a 145 byte (1160 bits) modulus. This is all in the manual now. -- Added build option CLEAN_STACK which will allow you to choose whether you want to clean the stack or not after every cipher/hash call -- Sped up the hash "process()" functions by not copying one byte at a time. ++ (added just after I uploaded...) MD4 process() now handles input buffers > 64 bytes Aug 1st, 2002 v0.56 -- Cleaned up the comments in the Blowfish code. -- Oh yeah, in v0.55 I made all of the descriptor elements constant. I just forgot to mention it. -- fixed a couple of places where descriptor indexes were tested wrong. Not a huge bug but now its harder to mess up. -- Added the SAFER [64-bit block] ciphers K64, SK64, K128 and SK128 to the library. -- Added the RC2 block cipher to the library. -- Changed the SAFER define for the SAFER+ cipher to SAFERP so that the new SAFER [64-bit] ciphers can use them with less confusion. July 29th, 2002 v0.55 -- My god stupid Blowfish has yet again been fixed. I swear I hate that cipher. Next bug in it and boom its out of the library. Use AES or something else cuz I really hate Blowfish at this stage.... -- Partial PKCS support [hint DONT USE IT YET CUZ ITS UNTESTED!] July 19th, 2002 v0.54 -- Blowfish now conforms to known test vectors. Silly bad coding tom! -- RC5/RC6/Serpent all have more test vectors now [and they seemed to have been working before] July 18th, 2002 v0.53 -- Added more test vectors to the blowfish code just for kicks [and they are const now too :-)] -- added prng/hash/cipher is_valid functions and used them in all of the PK code so you can't enter the code with an invalid index ever now. -- Simplified the Yarrow code once again :-) July 12th, 2002 v0.52 -- Fixed a bug in MD4 where the hash descriptor ID was the same as SHA-512. Now MD4 will work with all the routines... -- Fixed the comments in SHA-512 to be a bit more meaningful -- In md4 I made the PADDING array const [again to store it in ROM] -- in hash_file I switched the constant "512" to "sizeof(buf)" to be a bit safer -- in SHA-1's test routine I fixed the string literal to say SHA-1 not sha1 -- Fixed a logical error in the CTR code which would make it skip the first IV value. This means the CTR code from v0.52 will be incompatible [binary wise] with previous releases but it makes more sense this way. -- Added {} braces for as many if/for/blocks of code I could find. My rule is that every for/if/while/do block must have {} braces around it. -- made the rounds table in saferp_setup const [again for the ROM think about the ROM!] -- fixed RC5 since it no longer requires rc5 to be registered in the lib. It used to since the descriptors used to be part of the table... -- the packet.c code now makes crypt_error literal string errors when an error occurs -- cleaned up the SAFER+ key schedule to be a bit easier to read. -- fixed a huge bug in Twofish with the TWOFISH_SMALL define. Because I clean the stack now I had changed the "g_func()" to be called indirectly. I forgot to actually return the return of the Twofish g_func() function which caused it not to work... [does now :-)] July 11th, 2002 v0.51 -- Fixed a bug in SHA512/384 code for multi-block messages. -- Added more test vectors to the SHA384/512 and TIGER hash functions -- cleaned up the hash done routines to make more sense July 10th, 2002 v0.50 -- Fixed yarrow.c so that the cipher/hash used would be registered. Also fixed a bug where the SAFER+ name was "safer" but should have been "safer+". -- Added an element to the hash descriptors that gives the size of a block [sent into the compressor] -- Cleaned up the support for HMAC's -- Cleaned up the test vector routines to make the test vector data const. This means on some platforms it will be placed in ROM not RAM now. -- Added MD4 code submited by Dobes Vandermeer ([email protected]) -- Added "burn_stack" function [idea taken from another source of crypto code]. The idea is if a function has alot of variables it will clean up better. Functions like the ecb serpent and twofish code will now have their stacks cleaned and the rest of the code is getting much more straightforward. -- Added a hashing demo by Daniel Richards ([email protected]) -- I (Tom) modified some of the test vector routines to use more vectors ala Dobes style. For example, the MD5/SHA1 code now uses all of the test vectors from the RFC/FIPS spec. -- Fixed the register/unregister functions to properly report errors in crypt_error -- Correctly updated yarrow code to remove a few unused variables. -- Updated manual to fix a few erroneous examples. -- Added section on Hash based Message Authentication Codes (HMAC) to the manual June 19th, 2002 v0.46 -- Added in HMAC code from Dobes Vandermeer ([email protected]) June 8th, 2002 v0.45 -- Fixed bug in rc5.c where if you called rc5_setup() before registering RC5 it would cause undefined behaviour. -- Fixed mycrypt_cfg.h to eliminate the 224 bit ECC key. -- made the "default" makefile target have depends on mycrypt.h and mycrypt_cfg.h Apr 4th, 2002 v0.44 -- Fixed bug in ecc.c::new_point() where if the initial malloc fails it would not catch it. Mar 22nd, 2002 v0.43 -- Changed the ZLIB code over to the 1.1.4 code base to avoid the "double free" bug. -- Updated the GCC makefile not to use -O3 or -funroll-loops -- Version tag in mycrypt.h has been updated :-) Mar 10th, 2002 v0.42 -- The RNG code can now use /dev/urandom before trying /dev/random (J. Klapste) Mar 3rd, 2002 v0.41 -- Added support to link and use ciphers at compile time. This can greatly reduce the code size! -- Added a demo to show off how small an application can get... 46kb! -- Disastry pointed out that Blowfish is supposed to be high endian. -- Made registry code for the PRNGs as well [now the smallest useable link is 43kb] Feb 11th, 2002 v0.40 -- RSA signatures use [and check for] fixed padding scheme. -- I'm developing in Linux now :-) -- No more warnings from GCC 2.96 Feb 5th, 2002 v0.39 -- Updated the XTEA code to work in accordance with the XTEA design January 24th, 2002 v0.38 -- CFB and OFB modes can now handle blocks of variable size like the CTR code -- Wrote a wrapper around the memory compress functions in Zlib that act like the functions in the rest of my crypto lib January 23rd, 2002 v0.37 -- Added support code so that if a hash size and key size for a cipher don't match up they will use the next lower key supported. (mainly for the PK code). So you can now use SHA-1 with Twofish, etc... -- Added more options for Twofish. You can now tell it to use precomputed sboxes and MDS multiplications This will speed up the TWOFISH_SMALL implementation by increasing the code size by 1024 bytes. -- Fixed a bug in prime.c that would not use the correct table if you undefined SMALL_PRIME_TAB -- Fixed all of the PK packet code to use the same header format [see packet.c]. This makes the PK code binary wise incompatible with previous releases while the API has not changed at all. January 22nd, 2002 v0.36 -- Corrections to the manual -- Made a modification to Twofish which lets you build a "small ram" variant. It requires about 190 bytes of ram for the key storage compared to the 4,200 bytes the normal variant requires. -- Reduced the stack space used in all of the PK routines. January 19th, 2002 v0.35 -- If you removed the first hash or cipher from the library it wouldn't return an error if you used an ID=0 [i.e blowfish or sha256] in any routine. Now it checks for that and will return an error like it should -- Merged in new routines from Clay Culver. These routines are for the PK code so you can easily encode a symmetric key for multiple recipients. -- Made the ecc and DH make_key() routines make secret keys of the same size as the keysize listed. Originally I wanted to ensure that the keys were smaller than the order of the field used However, the bias is so insignifcant using full sizes. For example, with a ECC-192 key the order is about 2^191.99, so instead I rounded down and used a 184-bit secret key. Now I simply use a full 192-bit key the code will work just the same except that some 192-bit keys will be duplicates which is not a big deal since 1/2^192 is a very small bias! -- Made the configuration a bit simpler and more exacting. You can for example now select which DH or ECC key settings you wish to support without including the data for all other key settings. I put the #defines in a new file called "mycrypt_cfg.h" -- Configured "mpi-config.h" so its a bit more conservative with the memory required and code space used -- Jason Klapste submitted bug fixes to the yarrow, hash and various other issues. The yarrow code will now use what ever remaining hash/cipher combo is left [after you #undef them] at build time. He also suggested a fix to remove unused structures from the symmetric_key and hash_state unions. -- Made the CTR code handle variable length blocks better. It will buffer the encryption pad so you can encrypt messages any size block at a time. -- Simplified the yarrow code to take advantage of the new CTR code. -- Added a 4096-bit DH key setting. That took me about 36 hours to find! -- Changed the base64 routines to use a real base64 encoding scheme. -- Added in DH and ECC "encrypt_key()" functions. They are still rather "beta"ish. -- Added **Twofish** to the list of ciphers! January 18th, 2002 v0.34 -- Added "sha512" to the list of hashes. Produces a 512-bit message digest. Note that with the current padding with the rsa_sign() function you cannot use sha512 with a key less than 1536 bits for signatures. -- Cleaned up the other hash functions to use the LOAD and STORE macros... January 17th, 2002 v0.33 -- Made the lower limit on keysizes for RSA 1024 bits again because I realized that 768 bit keys wouldn't work with the padding scheme and large symmetric keys. -- Added information concerning the Zlib license to the manual -- Added a 3072-bit key setting for the DH code. -- Made the "find_xyz()" routines take "const char *" as per Clay Culver's suggestion. -- Fixed an embarassing typo in the manual concerning the hashes. Thank's Clay for finding it! -- Fixed rand_prime() so that it makes primes bigger than the setting you give. For example, if you want a 1024-bit prime it would make a 1023-bit one. Now it ensures that the prime it makes is always greater than 2^(8n) (n == bytes in prime). This doesn't have a huge impact on security but I corrected it just the same. -- Fixed the CTR routine to work on platforms where char != 8-bits -- Fixed sha1/sha256/md5/blowfish to not assume "unsigned long == 32-bits", Basically any operation with carries I "AND" with 0xFFFFFFFF. That forces only the lower 32-bits to have information in it. On x86 platforms most compilers optimize out the AND operation since its a nop. January 16th, 2002 v0.32 -- Made Rijndael's setup function fully static so it is thread safe -- Svante Seleborg suggested a cosmetic style fixup for aes.c, basically to remove some of the #defines to clean it up -- Made the PK routines not export the ASCII version of the names of ciphers/hashes which makes the PK message formats *incompatible* with previous releases. -- Merge in Zlib :-) January 15th, 2002 v0.31 -- The RSA routines can now use CRT to speed up decryption/signatures. The routines are backwards compatible with previous releases. -- Fixed another bug that Svante Seleborg found. Basically you could buffer-overrun the rsa_exptmod() function itself if you're not careful. That's fixed now. Fixed another bug in rsa_exptmod() where if it knows the buffer you passed is too small it wouldn't free all used memory. -- improved the readability of the PK import/export functions -- Added a fix to RSA.C by Clay Culver -- Changed the CONST64 macro for MSVC to use the "unsigned __int64" type, e.g. "ui64" instead of "i64". January 14th, 2002 v0.30 -- Major change to the Yarrow PRNG code, fixed a bug that Eugene Starokoltsev found. Basically if you added entropy to the pool in small increments it could in fact cancel out. Now I hash the pool with the new data which is way smarter. January 12th, 2002 v0.29 -- Added MPI code written by Svante Seleborg to the library. This will make the PK code much easier to follow and debug. Actually I've already fixed a memory leak in dh_shared_secret(). -- Memory leaks found and correct in all three PK routines. The leaks would occur when a bignum operation fails so it wouldn't normally turn up in the course of a program -- Fixed bugs in dh_key_size and ecc_key_size which would return garbage for invalid key idx'es January 11th, 2002 v0.28 -- Cleaned up some code so that it doesn't assume "char == 8bits". Mainly SAFER+ has been changed. -- ***HUGE*** changes in the PK code. I check all return values in the bignum code so if there are errors [insufficient memory, etc..] it will be reported. This makes the code fairly more robust and likely to catch any errors. -- Updated the is_prime() function to use a new prototype [it can return errors now] and it also does trial divisions against more primes before the Rabin Miller steps -- Added OFB, CFB and ECB generic wrappers for the symmetric ciphers to round out the implementations. -- Added Xtea to the list of ciphers, to the best of my ability I have verified this implementation. I should note that there is not alot of concrete information about the cipher. "Ansi C" versions I found did not address endianess and were not even portable!. This code is portable and to the best of my knowledge implements the Xtea algorithm as per the [short] X-Tea paper. -- Reformated the manual to include the **FULL** source code optimized to be pritable. January 9th, 2002 v0.27 -- Changed the char constants to numerical values. It is backwards compatible and should work on platforms where 'd' != 100 [for example]. -- Made a change to rand_prime() which takes the input length as a signed type so you can pass a negative len to get a "3 mod 4" style prime... oops -- changed the MSVC makefile to build with a warning level of three, no warnings! January 8th, 2002 v0.26 -- updated SHA-256 to use ROR() for a rotate so 64-bit machines won't corrupt the output -- Changed #include <> to #include "" for local .h files as per Richard Heathfields' suggestions. -- Fixed bug in MPI [well bug in MSVC] that compiled code incorrectly in mp_set_int() I added a work around that catches the error and continues normally. January 8th, 2002 v0.25 -- Added a stupid define so MSVC 6.00 can build the library. -- Big thanks to sci.crypt and "Ajay K. Agrawal" for helping me port this to MSVC January 7th, 2002 v0.24 -- Sped up Blowfish by unrolling and removing the swaps. -- Made the code comply with more traditional ANSI C standards Should compile with MSVC with less errors -- moved the demos and documentation into their own directories so you can easily build the library with other tool chains by compiling the files in the root -- converted functions with length of outputs to use "unsigned long" so 16-bit platforms will like this library more. January 5th, 2002 v0.23 -- Fixed a small error in the MPI config it should build fine anywhere. January 4th, 2002 v0.22 -- faster gf_mul() code -- gf_shl() and gf_shr() are safe on 64-bit platforms now -- Fixed an error in the hashes that Brian Gladman found. Basically if the message has exactly 56 bytes left to be compressed I handled them incorrectly. January 4th, 2002 v0.21 -- sped up the ECC code by removing redundant divisions in the point add and double routines. I also extract the bits more efficiently in "ecc_mulmod()" now. -- sped up [and documented] the rand_prime() function. Now it just makes a random integer and increments by two until a prime is found This is faster since it doesn't require alot of calls to the PRNG and it doesn't require loading huge integers over and over. rand_prime() can also make primes congruent to 3 mod 4 [i.e for a blum integer] -- added a gf_sqrt() function that finds square roots in a GF(2^w) field -- fixed a bug in gf_div() that would return the wrong results if the divisor had a greator divisor than the dividend. January 4th, 2002 v0.20 -- Added the fixed MPI back in so RSA and DH are much faster again v0.19 -- Updated the manual to reflect the fact that Brian Gladman wrote the AES and Serpent code. -- DH, ECC and RSA signature/decryption functions check if the key is private -- new DH signature/verification code works just like the RSA/ECC versions January 3rd, 2002 v0.18 -- Added way more comments to each .C file -- fixed a bug in cbc_decrypt(pt, ct, key) where pt == ct [i.e same buffer] -- fixed RC5 so it reads the default rounds out of the cipher_descriptor table -- cleaned up ecc_export() -- Cleaned up dh_import() and ecc_import() which also perform more error checking now -- Fixed a serious flaw in rsa_import() with private keys. January 2nd, 2002 v0.17 -- Fixed a bug in the random prime generator that fixes the wrong bits to one -- ECC and DH code verify that the moduli and orders are in fact prime. That slows down the test routines alot but what are you gonna do? -- Fixed a huge bug in the mp_exptmod() function which incorrectly calculates g^x mod p for some values of p. I replaced it with a slow function. Once the author of MPI fixes his faster routine I will switch back. January 1st, 2002 [whoa new year!] v0.16 -- Improved GF division code that is faster. -- documented the GF code December 31st, 2001 v0.15 -- A 1792-bit and 2048-bit DH setting was added. Took me all night to find a 1792 and 2048-bit strong prime but what the heck -- Library now has polynomial-basis GF(2^w) routines I wrote myself. Can be used to perform ECC over GF(2^w) later on.... -- Fixed a bug with the defines that allows it to build in windows December 30th, 2001 v0.14 -- Fixed the xxx_encrypt() packet routines to make an IV of appropriate size for the cipher used. It was defaulting to making a 256-bit IV... -- base64_encode() now appends a NULL byte, um "duh" stupid mistake now fixed... -- spell checked the manual again... :-) December 30th, 2001 v0.13 -- Switching back to older copy of MPI since it works! arrg.. -- Added sign/verify functions for ECC -- all signature verification routines default to invalid signatures. -- Changed all calls to memset to zeromem. Fixed up some buffer problems in other routines. All calls to zeromem let the compiler determine the size of the data to wipe. December 29th, 2001 v0.12 -- Imported a new version of MPI [the bignum library] that should be a bit more stable [if you want to write your own bignum routines with the library that is...] -- Manual has way more info -- hash_file() clears stack now [like it should] -- The artificial cap on the hash input size of 2^32 bits has been removed. Basically I was too lazy todo 64-bit math before [don't ask why... I can't remember]. Anyways the hashes support the size of 2^64 bits [if you ever use that many bits in a message that's just wierd...] -- The hashes now wipe the "hash_state" after the digest is computed. This helps prevent the internal state of the hash being leaked accidently [i.e stack problems] December 29th, 2001 v0.11 -- Made #define's so you can trim the library down by removing ciphers, hashs, modes of operation, prngs, and even PK algorithms For example, the library with rijndael+ctr+sha1+ECC is 91KB compared to the 246kb the full library takes. -- Added ECC packet routines for encrypt/decrypt/sign/verify much akin to the RSA packet routines. -- ECC now compresses the public key, a ECC-192 public key takes 33 bytes for example.... December 28th, 2001 v0.10 -- going to restart the manual from scratch to make it more clear and professional -- Added ECC over Z/pZ. Basically provides as much as DH except its faster since the numbers are smaller. For example, A comparable 256-bit ECC key provides as much security as expected from a DH key over 1024-bits. -- Cleaned up the DH code to not export the symbol "sets[]" -- Fixed a bug in the DH code that would not make the correct size random string if you made the key short. For instance if you wanted a 512-bit DH key it would make a 768-bit one but only make up 512-bits for the exponent... now it makes the full 768 bits [or whatever the case is] -- Fixed another ***SERIOUS*** bug in the DH code that would default to 768-bit keys by mistake. December 25th, 2001 v0.09 -- Includes a demo program called file_crypt which shows off how to use the library to make a command line tool which allows the user to encode/decode a file with any hash (on the passphrase) and cipher in CTR mode. -- Switched everything to use typedef's now to clear up the code. -- Added AES (128/192 and 256 bit key modes) December 24th, 2001 v0.08 -- fixed a typo in the manual. MPI stores its bignums in BIG endian not little. -- Started adding a RNG to the library. Right now it tries to open /dev/random and if that fails it uses either the MS CSP or the clock drift RNG. It also allows callbacks since the drift RNG is slow (about 3.5 bytes/sec) -- the RNG can also automatically setup a PRNG as well now v0.07 -- Added basic DH routines sufficient to negotiate shared secrets [see the manual for a complete example!] -- Fixed rsa_import to detect when the input could be corrupt. -- added more to the manual. December 22nd, 2001 v0.06 -- Fixed some formatting errors in the hash functions [just source code cleaning] -- Fixed a typo in the error message for sha256 :-) -- Fixed an error in base64_encode() that would fail to catch all buffer overruns -- Test program times the RSA and symmetric cipher routines for kicks... -- Added the "const" modifier to alot of routines to clear up the purpose of each function. -- Changed the name of the library to "TomCrypt" following a suggestion from a sci.crypt reader.... v0.05 -- Fixed the ROL/ROR macro to be safe on platforms where unsigned long is not 32-bits -- I have added a bit more to the documentation manual "crypt.pdf" provided. -- I have added a makefile for LCC-Win32. It should be easy to port to other LCC platforms by changing a few lines. -- Ran a spell checker over the manual. -- Changed the header and library from "crypt" to "mycrypt" to not clash with the *nix package "crypt". v0.04 -- Fixed a bug in the RC5,RC6,Blowfish key schedules where if the key was not a multiple of 4 bytes it would not get loaded correctly. December 21st, 2001 v0.03 -- Added Serpent to the list of ciphers. v0.02 -- Changed RC5 to only allow 12 to 24 rounds -- Added more to the manual. v0.01 -- We will call this the first version.