Mailing List Archive

On Thu, 7 Aug 2008 01:19, lanas@securenet.net said:

> Export regulations makes it so that libcrypt has to be limited to
> 56-bit, to be included in a product. So, until there's another way of

Assuming you are in the US, that is not true. These restrictions have
been dropped several years ago. Except for some banned countries.

> ./configure --enable-ciphers="des rfc2268"
>
> I've seen that if RC2 is not included, then the build fails. It

I doubt that. rc2 is not different from the other ciphers.

> PASS: prime
> PASS: register
> Ohhhh jeeee: cipher 3 not found

Yhjis is CAST5. There might be a bug in the configure code. Check
whether USE_CAST5 is defined in config.h - it should not be defined with
your configure options.

Best would be to

grep USE_ config.h

to see what features are actually included.



Shalom-Salam,

Werner

--
Die Gedanken sind frei. Auschnahme regelt ein Bundeschgesetz.


_______________________________________________
Gcrypt-devel mailing list
Gcrypt-devel@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gcrypt-devel

Hallo,

> Assuming you are in the US, that is not true. These
> restrictions have been dropped several years ago. Except for
> some banned countries.

It's not the US. It's a more conservative country (regarding this)
located north of the US ;-)

>> ./configure --enable-ciphers="des rfc2268"
>> I've seen that if RC2 is not included, then the build fails. It

> I doubt that. rc2 is not different from the other ciphers.

You are right as far as I've verified the version that was used. It
was 1.2.3 so I upgraded to 1.4.1 before doing anything else new. The
problem was there in 1.2.3, but not in 1.4.1 now.

So now I'm using 1.4.1.

In a vague attempt at finding out the cause of the problem, I've also
added a printf() statement in:

cipher.c:

cipher_get_keylen (int algorithm)
{
[...]
ath_mutex_lock (&ciphers_registered_lock);
printf("Looking for algorithm: %d\n", algorithm);
[...]
}

The above will be shown in the results below.

So now I'm doing:

./configure --enable-ciphers="des"
make
make check

And the result is:

PASS: ac-schemes
PASS: ac-data
Looking for algorithm: 302
Looking for algorithm: 302
Looking for algorithm: 302
Looking for algorithm: 302
Looking for algorithm: 302
Looking for algorithm: 302
Looking for algorithm: 2
Looking for algorithm: 2
Looking for algorithm: 2
Looking for algorithm: 2
Looking for algorithm: 2
Looking for algorithm: 2
aes-cbc-cts, grcy_open_cipher failed: Invalid cipher algorithm
cbc-mac algo 7, grcy_open_cipher failed: Invalid cipher algorithm
aes-ctr, grcy_open_cipher failed: Invalid cipher algorithm
aes-cfb, grcy_open_cipher failed: Invalid cipher algorithm
aes-ofb, grcy_open_cipher failed: Invalid cipher algorithm
FAIL: basic

Further down we find the results of some tests:

ECB CBC
--------------- --------------- etc...
Looking for algorithm: 2
3DES 140ms 150ms 150ms 160ms
Looking for algorithm: 302
DES 60ms 60ms 60ms 60ms

And of course, the error is reported at the conclusion:

PASS: benchmark
========================================
1 of 16 tests failed
Please report to bug-libgcrypt@gnupg.org
========================================

make[2]: *** [check-TESTS] Error 1
make[2]: Leaving directory
`/data/debian386/rr1/dists/rr1/sandbox/libgcrypt11/libgcrypt11-1.4.1.rr1/tests'
make[1]: *** [check-am] Error 2
make[1]: Leaving directory
`/data/debian386/rr1/dists/rr1/sandbox/libgcrypt11/libgcrypt11-1.4.1.rr1/tests'
make: *** [check-recursive] Error 1

So this is one problem.

Now, since I do not want 3DES, I edit cipher.c to comment it out:

../cipher/cipher.c

#if USE_DES
{ &_gcry_cipher_spec_des, GCRY_CIPHER_DES },
/* { &_gcry_cipher_spec_tripledes, GCRY_CIPHER_3DES }, */
#endif

A grep on USE_CAST5, done after the configure step below,returns:

grep -r USE_CAST5 *
cipher/cipher.c:#if USE_CAST5
config.h:/* #undef USE_CAST5 */
config.h.in:#undef USE_CAST5
configure:#define USE_CAST5 1
configure.ac: AC_DEFINE(USE_CAST5, 1, [Defined if this module should be included])
tests/basic.c:#if USE_CAST5

And then I do:

make clean
./configure --enable-ciphers="des"
make
make check

(I probably do not need to reconfigure ...)

And then, we do not have the above error, but instead we have the Ohhh
jeee error:

PASS: ac-schemes
PASS: ac-data
Looking for algorithm: 302
Looking for algorithm: 302
Looking for algorithm: 302
Looking for algorithm: 302
Looking for algorithm: 302
Looking for algorithm: 302
Looking for algorithm: 2
Ohhhh jeeee: cipher 2 not found
/bin/sh: line 4: 24082 Aborted ${dir}$tst
FAIL: basic

ECB CBC
--------------- --------------- etc...
Looking for algorithm: 302
DES 60ms 60ms 60ms 70ms

And everything else passes OK, amd one error is reported at the end at
the conclusion.

I do not see why it tries to access algorithm # 2 even though it's
comment out of the definition. Could it be that a DES structure
implicitly makes a reference to 3DES even though it's, in this case,
not wanted ?

Let me know if I can be of any help.

Vielen dank für ihre Hilfe !

Tschüß.


_______________________________________________
Gcrypt-devel mailing list
Gcrypt-devel@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gcrypt-devel

On Fri, 8 Aug 2008 00:31, lanas@securenet.net said:

> ./configure --enable-ciphers="des"
> make
> make check

You may just do

cd tests
./basic --verbose

> I do not see why it tries to access algorithm # 2 even though it's
> comment out of the definition. Could it be that a DES structure

That is because tests/basic.c requires plain DES. grep for
GCRY_CIPHER_DES.



Salam-Shalom,

Werner


--
Die Gedanken sind frei. Auschnahme regelt ein Bundeschgesetz.


_______________________________________________
Gcrypt-devel mailing list
Gcrypt-devel@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gcrypt-devel

Le Vendredi, 08 Août 2008 10:13:03 +0200,
Werner Koch <wk@gnupg.org> a écrit :

> On Fri, 8 Aug 2008 00:31, lanas@securenet.net said:
>
> > ./configure --enable-ciphers="des"
> > make
> > make check
>
> You may just do
>
> cd tests
> ./basic --verbose
>
> > I do not see why it tries to access algorithm # 2 even though it's
> > comment out of the definition. Could it be that a DES structure
>
> That is because tests/basic.c requires plain DES. grep for
> GCRY_CIPHER_DES.

Thanks for pointing this out. Now I also comment out the 3DES component
of GCRY_CIPHER_DES in basic.c

libgcrypt-1.4.1/tests/basic.c:991
#if USE_DES
GCRY_CIPHER_DES,
/* GCRY_CIPHER_3DES, */
#endif

And I comment the following tests:

check_ciphers ();
// check_aes128_cbc_cts_cipher ();
// check_cbc_mac_cipher ();
// check_ctr_cipher ();
// check_cfb_cipher ();
// check_ofb_cipher ();
check_digests ();
check_hmac ();

And everything's seems fine. Well, as far as crippled crypto is
concerned ! ;-(

Tschüß.


_______________________________________________
Gcrypt-devel mailing list
Gcrypt-devel@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gcrypt-devel