[Git][NTPsec/ntpsec][jjy2] 11 commits: Updates to attic/cmac-timing and hmac-timing

Tue Sep 22 19:57:32 UTC 2026

Gary E. Miller pushed to branch jjy2 at NTPsec / ntpsec

Commits:
b592318e by Hal Murray at 2026-08-23T21:36:08-07:00
Updates to attic/cmac-timing and hmac-timing

- - - - -
a9e243fe by Hal Murray at 2026-08-23T21:36:08-07:00
Update NetBSD part of buildprep to python 3.14

- - - - -
ccee7465 by Hal Murray at 2026-08-31T12:03:47-07:00
Fix for #896

- - - - -
c594931a by Hal Murray at 2026-09-01T15:10:38-07:00
Add note for Alpine to HOWTO-OpenSSL

- - - - -
f9403285 by Hal Murray at 2026-09-01T16:05:49-07:00
Cleanup NTS-KE server

The internal calling sequence was pretty ugly, mostly due to
passing around arguments to low level routines could provide
error text that was printed by the top level routine so we
could limit things to one log message per connection.

This change adds a struct that holds "everything" so we only
need to pass around one parameter.

The code now passes all the tests in ntske-test from
  https://github.com/mlichvar/ntske-test

This cleanup was the result of chasing #892
The bug was a typo in unreleased code that I was testing.
It treated all unknown type codes as critical.
chrony is using one so that broke working with chrony.
  https://chrony-project.org/doc/spec/nts-compliant-128gcm.html

- - - - -
df83f3c4 by Hal Murray at 2026-09-14T18:05:38-07:00
Fix for #899

First bug:  The test for the length of CookiePlaceholders
matching the length of the cookie was broken.  It would
accept 0 length placeholders if they came before the real
cookie.

Second bug: There was no limit on CookiePlaceholders.
So if you sent a batch of CookiePlaceholders before
the real cookie, it would try to send back a batch
of cookies which may not fit.

- - - - -
c2777387 by Hal Murray at 2026-09-14T23:36:48-07:00
Fix derecation warning from OpenSSL 4.1.0-alpha1
   ASN1_STRING_length => ASN1_STRING_get_length

Also, turn on X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
which is used by my self-signed local testing.
I (and others?) probably need to find the option
to make this unnecessary.

- - - - -
7cc07938 by Hal Murray at 2026-09-15T01:59:29-07:00
Fix #895

- - - - -
55f28be1 by Hal Murray at 2026-09-15T11:01:01-07:00
Add HMAC support for shared key authentication

It's now one of the options for NIST's authenticated service.

- - - - -
98539e26 by Matt Selsky at 2026-09-18T02:32:23-04:00
CI: Remove debian oldoldstable aka buster aka debian 11

As per https://wiki.debian.org/DebianReleases, EOL LTS was 2026-08-31.  The
distribution was removed from the Debian repo servers and there are no more
security updates.

These CI changes remove some python2 test jobs, but python2 will be removed
fully soon enough so we won't take heroic measures to find another distribution
that carries python2.

- - - - -
2e4d5835 by Gary E. Miller at 2026-09-22T12:57:30-07:00
ntpd/refclock_jjy.c: Replace tabs. // comments

No functional changes.  Part 1 of 2 to fix several open issues.

- - - - -

28 changed files:

- − .dockerfiles/python2
- .gitlab-ci.yml
- .gitlab-docker-ci.yml
- .gitlab-opttest-ci.yml
- HOWTO-OpenSSL
- NEWS.adoc
- attic/cmac-timing.c
- + attic/hmac-timing.c
- attic/wscript
- buildprep
- docs/includes/ntp.keys-body.adoc
- include/ntp_auth.h
- include/ntpd.h
- include/nts.h
- libntp/authkeys.c
- libntp/authreadkeys.c
- libntp/macencrypt.c
- libntp/ssl_init.c
- ntpclients/ntpq.py
- ntpd/ntp_config.c
- ntpd/ntp_control.c
- ntpd/ntp_util.c
- ntpd/nts_client.c
- ntpd/nts_extens.c
- ntpd/nts_server.c
- ntpd/refclock_jjy.c
- tests/libntp/macencrypt.c
- tests/ntpd/nts_server.c

The diff was not included because it is too large.

View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/compare/ada2e3b04c2ceed98636f6c278e99a521833a180...2e4d583521a0a465c8d1650363c6a4b40da72055

-- 
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/compare/ada2e3b04c2ceed98636f6c278e99a521833a180...2e4d583521a0a465c8d1650363c6a4b40da72055
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20260922/b09b051b/attachment.htm>