Leancrypto Version 1.9.0

Code

Changes 1.9.0

  • GCM: fix edge case in initialization of memory

  • GCM: add maximum decryption size check mirroring encryption

  • Fix some locations with improper return code handling

  • Rust: Fix lifetime issue

  • Hash: use 64 bit value for message digest size tracking

  • Harden S309/X86/ARM CPU entropy source collector

  • Fixes for OpenIndiana

  • Simplify SHA-3 operation

  • Fixes to make leancrypto work on: Solaris, Cygwin, RHEL9 (RHEL8 linker has a bug? RHEL7 does not offer meson), FreeBSD, NetBSD, OpenBSD, Dragonfly BSD, Arch Linux and add github workflow to continuously test them

  • Add support for native Windows (x86_64, ARMv8) with MSVC using clang-cl (the MSVC compiler is not supported as the assembler structure is different and I am not going to support multiple ASM structures).

  • Windows: fix parallel compilation of the assembler code that is compiled once per ML-KEM / ML-DSA parameter set - clang-cl placed the preprocessed intermediate of all of them into the same file.

  • Windows: fix linking against the shared library - the import libraries referenced a non-existing DLL name and the exported data symbols were neither marked as DATA nor declared with __declspec(dllimport).

  • Windows: fix SHA-3 / SHAKE / cSHAKE acceleration - the assembler implementations were handed over to the glue code as function pointers that did not carry the SysV ABI, i.e. the indirect calls were issued with the ABI of the host.

  • Windows: fix SHA-2 acceleration - the AVX2 and SHA-NI implementations were neither declared nor handed over to the glue code with the SysV ABI.

  • Add ABI information with version.lds: Also change the soname to include the minor version as its modification implies an ABI change

  • ABI change: lc_x509_cert_get_keyusage and lc_x509_cert_oid_to_eku

  • ASN.1: fix potential memory leaks in ASN.1 in error code paths

  • ASN.1: make pathlen verification completely consistent with RFC5280 sectoin 4.2.1.9

  • Seeded RNG: add support for multiple instances with automatic selection of DRNG instance based on current CPU

  • Seeded RNG: initialization now seeds the DRNG with 512 bits of data in one RNG seed invocation to make implementation 100% compliant with SP800-90C

  • Linux: when enabling the secure execution support, the L1D cache flush is NOT enabled by default any more as it is a heavy performance drag. If you need it, you MUST enable it with lc_init(LC_INIT_LINUX_L1D_FLUSH)

  • ChaCha20: During the development of version 1.8.0, the counter size was reduced to 32 bits to be compliant to RFC7539 and to cover the Wycheproof test vectors. However, that caused a regression for users that want to utilize ChaCha20 with a 64 bit counter. To alleviate the regression and yet comply with RFC7539, leancrypto now implements lc_chacha20_64 which provides the ChaCha20 with 64 bit IV handling. Every else is identical for both ChaCha20 implementations.

  • Status listing is now JSON to allow easier technical parsing

  • bug fix: lc_memcmp_secure returns negative error on string mismatch to align its return code with the rest of leancrypto (reported by Conner Webber)

  • bug fix: GCM contains a buffer overflow potentially writing zeros beyond a caller buffer upon GCM decrypt with an oversized tag length (reported by Conner Webber)

  • bug fix: Treat XDRBG initially seeded only after all seeding steps are successful (reported by Conner Webber)