Act nowcan affect a running system
RSA gains FIPS witnesses while AES-GCM and database defects are repaired
This edition is dominated by a broad RSA correctness, compliance and performance series: fixed-width encoding and stricter PKCS#1/PSS checks land before NIST DRBG use and FIPS 186-5 Miller-Rabin witness selection. AES-GCM partial-block handling, x86 carry propagation, ECC key validation, timer waits and several PostgreSQL/SQLite edge cases are also repaired. Users of the public TBigInt surface must account for one IsPrime signature change and several new methods.
TL;DR
- Land on build 2.4.17586 to take the complete RSA compliance and optimization sequence.
- TBigInt.IsPrime now accepts TAesPrngAbstract instead of PLecuyer; direct callers must migrate.
- RSA output is fixed-width and PKCS#1/PSS verification rejects non-canonical or malformed encodings.
- AES-GCM now handles partial AVX blocks and cloned/reset state correctly.
- PostgreSQL empty strings, BOOLINT reads and thread-safe connection teardown are corrected.
Upgrade advice
Use final build 2.4.17586. Recompile direct TBigInt.IsPrime callers with a TAesPrngAbstract argument, then retest RSA key generation, PKCS#1/PSS signing and verification, AES-GCM streaming with non-block-aligned chunks, PostgreSQL empty parameters and BOOLINT columns, SQLite backup failures and timer shutdown. x86/x64 and AArch64 cryptographic backends deserve cross-checks against known vectors.
35 of 35 entries · 35 commits upstream
1
Critical
x86 assembly propagates carries across big-integer blocks correctly
The x86 and x64 _xasmadd/_xasmsub loops preserve carry or borrow with BT before ADC/SBB when crossing unrolled block boundaries.
Fixes
mormot.crypt.core.asmx64+1
8ea03422+10-10
crypt: fixed _xasmadd/sub x86/x64 asm carry propagation
Impact
Certain operand patterns could previously produce wrong big-integer sums or differences, potentially corrupting RSA calculations on Intel backends.
Upgrade recommended
Upgrade Intel builds and rerun RSA known-answer tests that exercise long all-one carry chains.
2
High
RSA primality tests switch from L'Ecuyer state to a NIST DRBG
TBigInt.IsPrime replaces its optional PLecuyer parameter with TAesPrngAbstract. Internal prime generation now uses TAesPrng.Main for Miller-Rabin witnesses.
Breaking changes
mormot.crypt.rsa
9bce2b48+23-18
crypt: enhanced RSA compliance with NIST recommandations
Impact
Direct callers passing a PLecuyer pointer no longer compile; default callers silently move to the framework's AES-based DRBG on Delphi and FPC.
Migration required
Search for TBigInt.IsPrime calls with a third argument and pass a TAesPrngAbstract instance instead.
Public API
TBigInt.IsPrimesignature-changed — The third parameter is now TAesPrngAbstract instead of PLecuyer.
Units
3
High
RSA serialization and signature checks now enforce canonical widths
TBigInt.SaveFixed adds leading-zero padding, RSA operations reject values at or above the modulus, and PKCS#1/PSS paths emit and verify exact-width encodings with stricter salt and padding checks.
Security
mormot.crypt.rsa
b4a21003+99-33
crypt: ensure fixed-width RSA serialization
Impact
Delphi/FPC RSA ciphertexts and signatures keep their required modulus width, while malformed or non-canonical signatures that were previously tolerated are rejected.
Upgrade recommended
Retest PKCS#1 v1.5 and PSS interoperability against independent implementations and check stored signature widths.
Public API
TBigInt.SaveFixedadded — Exports an exact number of big-endian bytes with leading-zero padding.
Units
4
High
AES-GCM validates streaming order and preserves pending state
TAesGcm uses PtrUInt lengths, clones pending AVX blocks, rejects AAD added after ciphertext, validates the high-level AAD call, and fixes the tunnel tag destination.
Security
mormot.crypt.core+1
36e581ed+22-21
crypt: several fixes to TAesGcm
Impact
Streaming and cloned AES-GCM contexts authenticate the intended bytes; invalid AAD ordering now fails instead of producing a misleading tag.
Upgrade recommended
Upgrade AES-GCM and tunnel users; test cloned contexts, AAD ordering and non-block-aligned messages.
5
High
Miller-Rabin witnesses now follow FIPS 186-5 sampling
TBigInt.FillMillerRabinWitness uses rejection sampling across the candidate's full bit width, then maps accepted values into the FIPS 186-5 B.3.1 witness interval.
Security
mormot.crypt.rsa
319cd63e+19-18
crypt: RSA Miller-Rabin witness selection as described in FIPS 186-5 B.3.1
Impact
RSA prime testing no longer biases witnesses through a truncated modulus; Delphi and FPC key generation gain the final standards-compliance correction.
Upgrade recommended
Use build 2.4.17586 and rerun RSA generation plus independent primality checks.
Units
6
High
ECC loaders reject malformed and wrong-kind keys
PemDerRawToEcc validates compressed public-key prefixes, while DerParse rejects zero-length or oversized ASN.1 INTEGER values; regression tests prevent public/private key interchange.
Security
mormot.crypt.ecc+1
e3133b00+19-8
crypt: fixed #652 ECC key parsing and validation
Impact
Malformed DER and a private key presented as a public key no longer pass loading on Delphi/FPC cryptographic backends.
Upgrade recommended
Upgrade ECC users and add negative tests for truncated DER, oversized integers and swapped key kinds.
7
High
RSA prime rounds and PKCS padding checks are corrected
FipsMinIterations compares full bit counts, PKCS#1 unpadding now accepts any padding length of at least eight bytes, and PSS verification requires a signature exactly as wide as the modulus.
Security
mormot.crypt.rsa
c21e6cfa+6-6
crypt: several RSA fixes
Impact
RSA primality assurance and standards-compliant padding acceptance are corrected; malformed PSS lengths are rejected consistently.
Upgrade recommended
Upgrade RSA users and rerun padding, signature and generated-prime tests.
Units
8
High
Environment variables preserve empty values and restore absence
Environment caching gains an explicit initialized flag, SetSystemEnv always writes through, and ResetSystemEnv restores the cached value or unsets a name that was originally absent on Windows and POSIX.
Fixes
mormot.core.os+3
4fc7e59a+90-43
core: fixed #651 environment variables functions
Impact
An existing empty environment value is no longer mistaken for a missing cache, and temporary variables can be restored to their original absent state consistently.
Upgrade recommended
Retest SetSystemEnv and ResetSystemEnv with missing, empty and non-empty variables on Windows and POSIX.
Public API
SetSystemEnvbehaviour-changed — Always writes the requested value, including an empty string.ResetSystemEnvbehaviour-changed — Unsets variables that were absent when the cache was populated.
9
High
LDAP URI parsing distinguishes defaults from custom ports
TLdapClient URI parsing maps an absent no-scheme port to LDAP_PORT, preserves explicit ports and enables TLS when the effective port is LDAPS_PORT.
Fixes
mormot.net.ldap
c46549d6+21-7
net: fixed #653 LDAP port parsing
Impact
LDAP endpoints no longer accidentally inherit HTTP port 80 from generic URI parsing, and custom port selections remain effective.
Upgrade recommended
Verify host-only, ldap://, ldaps:// and explicit-port connection strings.
Units
10
High
Empty PostgreSQL parameters stay distinct from SQL NULL
TSqlDBPostgresStatement.BindParams points zero-length non-null strings at NULCHAR instead of passing a nil pointer to libpq.
Fixes
mormot.db.sql.postgres
9a90c009+7-3
db: fixed #658 TSqlDBPostgresStatement.BindParams with '' value
Impact
Binding '' no longer inserts SQL NULL, preventing silent data changes in PostgreSQL statements on Delphi and FPC.
Upgrade recommended
Upgrade PostgreSQL users and test inserts and updates that bind empty RawUtf8 or string values.
11
High
Timer shutdown waits the requested number of seconds
TSynBackgroundTimer.WaitUntilNotProcessing converts its timeout from seconds to milliseconds before passing it to SleepHiRes.
Fixes
mormot.core.threads
630707ac+3-3
core: fixed TSynBackgroundTimer.WaitUntilNotProcessing #660
Impact
The wait is no longer roughly one thousand times shorter than requested, reducing teardown races with active callbacks.
Upgrade recommended
Upgrade services that stop background timers under load and verify their shutdown latency.
Units
12
High
Thread-safe SQL pools destroy every allocated connection
TSqlDBConnectionPropertiesThreadSafe.Destroy iterates the actual connection array bounds instead of configuration minimum and maximum values.
Fixes
mormot.db.sql
db7c4721+3-3
db: fixed TSqlDBConnectionPropertiesThreadSafe.Destroy #657
Impact
Pool teardown avoids leaking initialized connections or indexing beyond the allocated array after configuration changes.
Upgrade recommended
Retest connection-pool reconfiguration and application shutdown under sanitizers or leak reporting.
Units
13
High
AES-GCM reset clears leftover partial-block length
TAesGcmEngine.Reset now sets state.blen to zero after an earlier operation ended with a non-complete block.
Fixes
mormot.crypt.core
e8367af5+3-2
crypt: fixed TAesGcmEngine.Reset after non-complete blocks
Impact
Reusing an AES-GCM engine no longer carries a stale byte offset into the next message and corrupts encryption or authentication.
Upgrade recommended
Upgrade reusable AES-GCM contexts and test consecutive messages with non-block-aligned lengths.
Units
14
High
Background timers mark work active before updating counters
TSynBackgroundTimer.EverySecond sets fProcessing before incrementing and invoking scheduled callbacks, closing the remaining WaitUntilNotProcessing race.
Fixes
mormot.core.threads
a0b02203+3-2
core: fix #660 part II
Impact
Shutdown code waiting for timer work no longer slips through the small window before the processing flag was set.
Upgrade recommended
Retest timer destruction while callbacks start or are already running.
Units
15
High
AVX AES-GCM accepts partial and truncated chunks
TAesGcmEngine buffers incomplete AAD and text blocks across calls, continues CTR bytes correctly, and makes AllowAvx default to true in Init.
New features
mormot.crypt.core
2d95c74a+128-27
crypt: allow partial/truncated AES-GCM encryption
Impact
AVX-capable Delphi/FPC builds can stream arbitrary chunk sizes instead of requiring complete blocks; omitted AllowAvx arguments now enable AVX.
Worth a look
Test one-byte through multi-block chunking and decide explicitly whether callers should pass AllowAvx false.
Public API
TAesGcmEngine.Initsignature-changed — AllowAvx now has a default value of true.
Units
16
Medium
Unknown command-line arguments name the correct token
TCommandLine.DetectUnknown reports the parsed fNames entry for an unknown argument rather than indexing the raw parameter list with the wrong offset.
Fixes
mormot.core.os
938a6bb1+12-3
core: fixed #654 unexpected command line argument reporting
Impact
Diagnostics identify the real unexpected option after switches and values have been parsed; argument acceptance is unchanged.
Units
17
Medium
LDAP keeps the parsed explicit port through connection setup
TLdapClient settings keep the URI-derived port when constructing the socket instead of falling back through a remaining default-port path.
Fixes
mormot.net.ldap
fa932d76+9-4
net: one leftover of #653
Impact
LDAP and LDAPS endpoints on custom ports connect to the configured service rather than the protocol default.
Upgrade recommended
Retest LDAP URIs with and without schemes on ports other than 389 and 636.
Units
18
Medium
PostgreSQL boolean integers return one for true
TSqlDBPostgresStatement.ColumnInt recognizes BOOLOID and maps the wire value 't' to 1 and other boolean text to 0.
Fixes
mormot.db.sql.postgres
c0bc6984+9-3
db: fixed #659 TSqlDBPostgresStatement.ColumnInt with BOOLINT value
Impact
Delphi/FPC code reading PostgreSQL boolean columns through ColumnInt now receives the expected numeric value.
Worth a look
Retest BOOLINT field mappings and queries that project boolean expressions as integers.
19
Medium
SQLite backup reports destination-open failures cleanly
BackupBackground catches exceptions raised while constructing the destination TSqlDatabase, releases partial state and returns false.
Fixes
mormot.db.raw.sqlite3
81dcd78a+7-3
db: fixed #655 backup destination creation failure
Impact
An unwritable or invalid backup destination no longer escapes as an unexpected constructor exception from the background backup API.
Worth a look
Test invalid paths and permission failures and ensure callers handle a false backup result.
20
Medium
AArch64 receives native big-integer arithmetic for RSA
New AArch64 assembly implements add, subtract, multiply and divide primitives, with mormot.defines and TBigInt dispatch wired to use them.
Performance
mormot.core.base+3
78fb3897+518-69
crypt: new aarch64 asm primitives for RSA computing
Impact
Delphi and FPC AArch64 RSA operations can use native optimized arithmetic; correctness depends on the new backend matching Pascal vectors.
Worth a look
Run the RSA and TBigInt test vectors on every supported AArch64 operating system.
21
Medium
Barrett reduction computes only the low limbs it needs
TBigInt.MultiplyLow is added and TRsaContext.BarrettReduction uses it to avoid building high limbs that are immediately discarded.
Performance
mormot.crypt.rsa
c12db49f+182-6
crypt: optimized RSA barret reduction implementation
Impact
RSA modular reduction allocates and multiplies less data, improving signing and private-key workloads without output changes.
Worth a look
Run TBigInt aliasing and RSA known-answer tests on each word size.
Public API
TBigInt.MultiplyLowadded — Multiplies only the requested low limb count and releases operands like Multiply.
Units
22
Medium
RSA prime search skips candidates with cheaper remainder updates
TBigInt.FillPrime keeps small-prime remainders while incrementing candidates and avoids repeating full divisions for every primality attempt.
Performance
mormot.crypt.rsa
2791c66f+127-15
crypt: huge performance boost of RSA generation
Impact
RSA key generation becomes substantially faster, especially on slower Delphi/FPC targets, without changing key formats.
Worth a look
Benchmark representative key sizes and confirm generated keys with an independent validator.
Units
23
Medium
RSA key generation computes its two primes on separate cores
TRsa.Generate runs p and q prime searches in two worker tasks, coordinates completion and preserves the existing timeout and cleanup paths.
Performance
mormot.crypt.rsa
0f2aa131+103-27
crypt: compute p/q RSA primes in parallel in two CPU cores
Impact
RSA key creation can use two CPU cores and complete faster; generated key formats and application calls are unchanged.
Worth a look
Benchmark key generation and confirm worker-thread limits in constrained services.
Units
24
Medium
RSA reduction switches to a precomputed Barrett reciprocal
TRsaContext precomputes Barrett constants for its moduli and Reduce uses multiplication and shifts instead of repeated division.
Performance
mormot.crypt.rsa
bcdff3ac+68-7
crypt: use Barret Reduction for TRsaContext.Reduce()
Impact
RSA signing and verification spend less time in modular reduction; serialized values and APIs are unchanged.
Worth a look
Compare RSA vectors before and after the reduction change on 32-bit and 64-bit targets.
Units
25
Medium
Delphi Intel builds use assembly cryptographic paths again
mormot.defines restores ASMINTELARM64 selection for Delphi x86 and x64 targets so the intended optimized primitives are compiled.
Compiler & platform
mormot.defines
b6fd1b2e+4-2
crypt: restore asm for Delphi Intel targets
Impact
Delphi Win32/Win64 cryptographic code regains assembly performance; FPC and non-Intel behavior is unchanged.
Worth a look
Rebuild Delphi Intel targets and run cryptographic vectors on both Win32 and Win64.
Units
26
Low
RSA modular powers start using a sliding window
TRsaContext.ModPower introduces a three-bit sliding window with precomputed odd powers, replacing the bit-by-bit multiply loop.
Performance
mormot.crypt.rsa
9b9e71e3+51-14
crypt: 3-bit sliding window for RSA ModPower
Impact
Private-exponent RSA operations need fewer multiplications; no migration or format change is required.
Units
27
Low
A base-two pretest rejects composite RSA candidates sooner
TBigInt.IsPrime performs one strong probable-prime test with witness 2 before allocating and running the requested random Miller-Rabin rounds.
Performance
mormot.crypt.rsa
5be3ad0c+46-18
crypt: faster TBigInt.IsPrime by using base-2 pretest
Impact
RSA generation discards many composite candidates more cheaply, improving key-generation time with no application change.
Units
28
Low
Barrett reduction avoids redundant RSA work
TRsaContext reuses precomputed modulus sizes and narrows temporary values in its optimized Barrett reduction path.
Performance
mormot.crypt.rsa
bc529ee6+36-17
crypt: optimized RSA Barret Reduction
Impact
RSA modular reduction performs less allocation and copying; application code and cryptographic output remain unchanged.
Units
29
Low
Big integers gain a dedicated squaring implementation
TBigInt.Square now computes diagonal and doubled cross-products directly instead of calling Multiply on a copy.
Performance
mormot.crypt.rsa
7be82719+39-4
crypt: dedicated TBigInt.Square method
Impact
RSA exponentiation performs faster squaring while preserving the TBigInt.Square contract for Delphi and FPC callers.
Public API
TBigInt.Squarebehaviour-changed — Uses a dedicated squaring algorithm instead of generic multiplication.
Units
30
Low
Pascal big-integer division by ten is tightened
TBigInt.IntDivMod10 rewrites its pure-Pascal quotient and remainder loop to reduce branches and repeated indexing.
Performance
mormot.crypt.rsa
dec4ec58+25-17
crypt: optimized TBigInt.IntDivMod10 pascal code
Impact
Decimal formatting of large integers becomes faster on backends without the assembly path; results are unchanged.
Units
31
Low
The common RSA exponent gets a dedicated fast path
TRsaContext detects exponent 65537 and uses a short fixed square-and-multiply sequence instead of the generic exponent loop.
Performance
mormot.crypt.rsa
4f07c5c3+16-12
crypt: optimize exponent common prime 65537
Impact
RSA public operations with exponent 65537 become faster on Delphi and FPC without API or output changes.
Units
32
Low
Exponent 65537 is computed with sixteen squares and one multiply
TRsaContext.ModPower recognizes exponent 65537 and executes its exact binary chain without allocating the generic sliding-window table.
Performance
mormot.crypt.rsa
d283eeda+17-2
crypt: optimized RSA for exponent=65537
Impact
RSA verification and encryption with the standard exponent get faster; behavior and public signatures do not change.
Units
33
Low
RSA modular powers use a four-bit sliding window
TRsaContext.ModPower expands its precomputed odd-power table from three to four bits and adjusts the scanning loop accordingly.
Performance
mormot.crypt.rsa
e1d2b232+6-6
crypt: use 4-bit sliding window for TRsaContext.ModPower
Impact
Large private-exponent RSA operations use fewer modular multiplications; callers and serialized results are unchanged.
Units
34
Low
Cryptographic core code is reorganized without behavior changes
mormot.crypt.core moves helper code and simplifies local declarations while preserving the same AES and hashing control flow.
Under the hood
mormot.crypt.core
4d9c5730+19-22
crypt: minor refactoring with no functional change
Impact
No impact on Delphi/FPC application code, public APIs or intended cryptographic results.
Units
35
Low
Decimal conversion code for big integers is cleaned up
TBigInt.IntDivMod10 consolidates local variables and loop structure without changing the division result or public method signature.
Under the hood
mormot.crypt.rsa
260dd9cb+9-14
crypt: minor TBigInt.IntDivMod10 refactoring/cleaning
Impact
No impact on Delphi/FPC application code; this is preparatory internal cleanup for later optimization.