397 lines · c
1// SPDX-License-Identifier: GPL-2.0+2/*3 * Copyright (c) 2021 IBM Corporation4 */5 6#include <linux/module.h>7#include <crypto/internal/akcipher.h>8#include <crypto/internal/ecc.h>9#include <crypto/akcipher.h>10#include <crypto/ecdh.h>11#include <linux/asn1_decoder.h>12#include <linux/scatterlist.h>13 14#include "ecdsasignature.asn1.h"15 16struct ecc_ctx {17 unsigned int curve_id;18 const struct ecc_curve *curve;19 20 bool pub_key_set;21 u64 x[ECC_MAX_DIGITS]; /* pub key x and y coordinates */22 u64 y[ECC_MAX_DIGITS];23 struct ecc_point pub_key;24};25 26struct ecdsa_signature_ctx {27 const struct ecc_curve *curve;28 u64 r[ECC_MAX_DIGITS];29 u64 s[ECC_MAX_DIGITS];30};31 32/*33 * Get the r and s components of a signature from the X509 certificate.34 */35static int ecdsa_get_signature_rs(u64 *dest, size_t hdrlen, unsigned char tag,36 const void *value, size_t vlen, unsigned int ndigits)37{38 size_t bufsize = ndigits * sizeof(u64);39 ssize_t diff = vlen - bufsize;40 const char *d = value;41 42 if (!value || !vlen)43 return -EINVAL;44 45 /* diff = 0: 'value' has exacly the right size46 * diff > 0: 'value' has too many bytes; one leading zero is allowed that47 * makes the value a positive integer; error on more48 * diff < 0: 'value' is missing leading zeros49 */50 if (diff > 0) {51 /* skip over leading zeros that make 'value' a positive int */52 if (*d == 0) {53 vlen -= 1;54 diff--;55 d++;56 }57 if (diff)58 return -EINVAL;59 }60 if (-diff >= bufsize)61 return -EINVAL;62 63 ecc_digits_from_bytes(d, vlen, dest, ndigits);64 65 return 0;66}67 68int ecdsa_get_signature_r(void *context, size_t hdrlen, unsigned char tag,69 const void *value, size_t vlen)70{71 struct ecdsa_signature_ctx *sig = context;72 73 return ecdsa_get_signature_rs(sig->r, hdrlen, tag, value, vlen,74 sig->curve->g.ndigits);75}76 77int ecdsa_get_signature_s(void *context, size_t hdrlen, unsigned char tag,78 const void *value, size_t vlen)79{80 struct ecdsa_signature_ctx *sig = context;81 82 return ecdsa_get_signature_rs(sig->s, hdrlen, tag, value, vlen,83 sig->curve->g.ndigits);84}85 86static int _ecdsa_verify(struct ecc_ctx *ctx, const u64 *hash, const u64 *r, const u64 *s)87{88 const struct ecc_curve *curve = ctx->curve;89 unsigned int ndigits = curve->g.ndigits;90 u64 s1[ECC_MAX_DIGITS];91 u64 u1[ECC_MAX_DIGITS];92 u64 u2[ECC_MAX_DIGITS];93 u64 x1[ECC_MAX_DIGITS];94 u64 y1[ECC_MAX_DIGITS];95 struct ecc_point res = ECC_POINT_INIT(x1, y1, ndigits);96 97 /* 0 < r < n and 0 < s < n */98 if (vli_is_zero(r, ndigits) || vli_cmp(r, curve->n, ndigits) >= 0 ||99 vli_is_zero(s, ndigits) || vli_cmp(s, curve->n, ndigits) >= 0)100 return -EBADMSG;101 102 /* hash is given */103 pr_devel("hash : %016llx %016llx ... %016llx\n",104 hash[ndigits - 1], hash[ndigits - 2], hash[0]);105 106 /* s1 = (s^-1) mod n */107 vli_mod_inv(s1, s, curve->n, ndigits);108 /* u1 = (hash * s1) mod n */109 vli_mod_mult_slow(u1, hash, s1, curve->n, ndigits);110 /* u2 = (r * s1) mod n */111 vli_mod_mult_slow(u2, r, s1, curve->n, ndigits);112 /* res = u1*G + u2 * pub_key */113 ecc_point_mult_shamir(&res, u1, &curve->g, u2, &ctx->pub_key, curve);114 115 /* res.x = res.x mod n (if res.x > order) */116 if (unlikely(vli_cmp(res.x, curve->n, ndigits) == 1))117 /* faster alternative for NIST p521, p384, p256 & p192 */118 vli_sub(res.x, res.x, curve->n, ndigits);119 120 if (!vli_cmp(res.x, r, ndigits))121 return 0;122 123 return -EKEYREJECTED;124}125 126/*127 * Verify an ECDSA signature.128 */129static int ecdsa_verify(struct akcipher_request *req)130{131 struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);132 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);133 size_t bufsize = ctx->curve->g.ndigits * sizeof(u64);134 struct ecdsa_signature_ctx sig_ctx = {135 .curve = ctx->curve,136 };137 u64 hash[ECC_MAX_DIGITS];138 unsigned char *buffer;139 int ret;140 141 if (unlikely(!ctx->pub_key_set))142 return -EINVAL;143 144 buffer = kmalloc(req->src_len + req->dst_len, GFP_KERNEL);145 if (!buffer)146 return -ENOMEM;147 148 sg_pcopy_to_buffer(req->src,149 sg_nents_for_len(req->src, req->src_len + req->dst_len),150 buffer, req->src_len + req->dst_len, 0);151 152 ret = asn1_ber_decoder(&ecdsasignature_decoder, &sig_ctx,153 buffer, req->src_len);154 if (ret < 0)155 goto error;156 157 if (bufsize > req->dst_len)158 bufsize = req->dst_len;159 160 ecc_digits_from_bytes(buffer + req->src_len, bufsize,161 hash, ctx->curve->g.ndigits);162 163 ret = _ecdsa_verify(ctx, hash, sig_ctx.r, sig_ctx.s);164 165error:166 kfree(buffer);167 168 return ret;169}170 171static int ecdsa_ecc_ctx_init(struct ecc_ctx *ctx, unsigned int curve_id)172{173 ctx->curve_id = curve_id;174 ctx->curve = ecc_get_curve(curve_id);175 if (!ctx->curve)176 return -EINVAL;177 178 return 0;179}180 181 182static void ecdsa_ecc_ctx_deinit(struct ecc_ctx *ctx)183{184 ctx->pub_key_set = false;185}186 187static int ecdsa_ecc_ctx_reset(struct ecc_ctx *ctx)188{189 unsigned int curve_id = ctx->curve_id;190 int ret;191 192 ecdsa_ecc_ctx_deinit(ctx);193 ret = ecdsa_ecc_ctx_init(ctx, curve_id);194 if (ret == 0)195 ctx->pub_key = ECC_POINT_INIT(ctx->x, ctx->y,196 ctx->curve->g.ndigits);197 return ret;198}199 200/*201 * Set the public ECC key as defined by RFC5480 section 2.2 "Subject Public202 * Key". Only the uncompressed format is supported.203 */204static int ecdsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsigned int keylen)205{206 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);207 unsigned int digitlen, ndigits;208 const unsigned char *d = key;209 int ret;210 211 ret = ecdsa_ecc_ctx_reset(ctx);212 if (ret < 0)213 return ret;214 215 if (keylen < 1 || ((keylen - 1) & 1) != 0)216 return -EINVAL;217 /* we only accept uncompressed format indicated by '4' */218 if (d[0] != 4)219 return -EINVAL;220 221 keylen--;222 digitlen = keylen >> 1;223 224 ndigits = DIV_ROUND_UP(digitlen, sizeof(u64));225 if (ndigits != ctx->curve->g.ndigits)226 return -EINVAL;227 228 d++;229 230 ecc_digits_from_bytes(d, digitlen, ctx->pub_key.x, ndigits);231 ecc_digits_from_bytes(&d[digitlen], digitlen, ctx->pub_key.y, ndigits);232 233 ret = ecc_is_pubkey_valid_full(ctx->curve, &ctx->pub_key);234 235 ctx->pub_key_set = ret == 0;236 237 return ret;238}239 240static void ecdsa_exit_tfm(struct crypto_akcipher *tfm)241{242 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);243 244 ecdsa_ecc_ctx_deinit(ctx);245}246 247static unsigned int ecdsa_max_size(struct crypto_akcipher *tfm)248{249 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);250 251 return DIV_ROUND_UP(ctx->curve->nbits, 8);252}253 254static int ecdsa_nist_p521_init_tfm(struct crypto_akcipher *tfm)255{256 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);257 258 return ecdsa_ecc_ctx_init(ctx, ECC_CURVE_NIST_P521);259}260 261static struct akcipher_alg ecdsa_nist_p521 = {262 .verify = ecdsa_verify,263 .set_pub_key = ecdsa_set_pub_key,264 .max_size = ecdsa_max_size,265 .init = ecdsa_nist_p521_init_tfm,266 .exit = ecdsa_exit_tfm,267 .base = {268 .cra_name = "ecdsa-nist-p521",269 .cra_driver_name = "ecdsa-nist-p521-generic",270 .cra_priority = 100,271 .cra_module = THIS_MODULE,272 .cra_ctxsize = sizeof(struct ecc_ctx),273 },274};275 276static int ecdsa_nist_p384_init_tfm(struct crypto_akcipher *tfm)277{278 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);279 280 return ecdsa_ecc_ctx_init(ctx, ECC_CURVE_NIST_P384);281}282 283static struct akcipher_alg ecdsa_nist_p384 = {284 .verify = ecdsa_verify,285 .set_pub_key = ecdsa_set_pub_key,286 .max_size = ecdsa_max_size,287 .init = ecdsa_nist_p384_init_tfm,288 .exit = ecdsa_exit_tfm,289 .base = {290 .cra_name = "ecdsa-nist-p384",291 .cra_driver_name = "ecdsa-nist-p384-generic",292 .cra_priority = 100,293 .cra_module = THIS_MODULE,294 .cra_ctxsize = sizeof(struct ecc_ctx),295 },296};297 298static int ecdsa_nist_p256_init_tfm(struct crypto_akcipher *tfm)299{300 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);301 302 return ecdsa_ecc_ctx_init(ctx, ECC_CURVE_NIST_P256);303}304 305static struct akcipher_alg ecdsa_nist_p256 = {306 .verify = ecdsa_verify,307 .set_pub_key = ecdsa_set_pub_key,308 .max_size = ecdsa_max_size,309 .init = ecdsa_nist_p256_init_tfm,310 .exit = ecdsa_exit_tfm,311 .base = {312 .cra_name = "ecdsa-nist-p256",313 .cra_driver_name = "ecdsa-nist-p256-generic",314 .cra_priority = 100,315 .cra_module = THIS_MODULE,316 .cra_ctxsize = sizeof(struct ecc_ctx),317 },318};319 320static int ecdsa_nist_p192_init_tfm(struct crypto_akcipher *tfm)321{322 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);323 324 return ecdsa_ecc_ctx_init(ctx, ECC_CURVE_NIST_P192);325}326 327static struct akcipher_alg ecdsa_nist_p192 = {328 .verify = ecdsa_verify,329 .set_pub_key = ecdsa_set_pub_key,330 .max_size = ecdsa_max_size,331 .init = ecdsa_nist_p192_init_tfm,332 .exit = ecdsa_exit_tfm,333 .base = {334 .cra_name = "ecdsa-nist-p192",335 .cra_driver_name = "ecdsa-nist-p192-generic",336 .cra_priority = 100,337 .cra_module = THIS_MODULE,338 .cra_ctxsize = sizeof(struct ecc_ctx),339 },340};341static bool ecdsa_nist_p192_registered;342 343static int __init ecdsa_init(void)344{345 int ret;346 347 /* NIST p192 may not be available in FIPS mode */348 ret = crypto_register_akcipher(&ecdsa_nist_p192);349 ecdsa_nist_p192_registered = ret == 0;350 351 ret = crypto_register_akcipher(&ecdsa_nist_p256);352 if (ret)353 goto nist_p256_error;354 355 ret = crypto_register_akcipher(&ecdsa_nist_p384);356 if (ret)357 goto nist_p384_error;358 359 ret = crypto_register_akcipher(&ecdsa_nist_p521);360 if (ret)361 goto nist_p521_error;362 363 return 0;364 365nist_p521_error:366 crypto_unregister_akcipher(&ecdsa_nist_p384);367 368nist_p384_error:369 crypto_unregister_akcipher(&ecdsa_nist_p256);370 371nist_p256_error:372 if (ecdsa_nist_p192_registered)373 crypto_unregister_akcipher(&ecdsa_nist_p192);374 return ret;375}376 377static void __exit ecdsa_exit(void)378{379 if (ecdsa_nist_p192_registered)380 crypto_unregister_akcipher(&ecdsa_nist_p192);381 crypto_unregister_akcipher(&ecdsa_nist_p256);382 crypto_unregister_akcipher(&ecdsa_nist_p384);383 crypto_unregister_akcipher(&ecdsa_nist_p521);384}385 386subsys_initcall(ecdsa_init);387module_exit(ecdsa_exit);388 389MODULE_LICENSE("GPL");390MODULE_AUTHOR("Stefan Berger <stefanb@linux.ibm.com>");391MODULE_DESCRIPTION("ECDSA generic algorithm");392MODULE_ALIAS_CRYPTO("ecdsa-nist-p192");393MODULE_ALIAS_CRYPTO("ecdsa-nist-p256");394MODULE_ALIAS_CRYPTO("ecdsa-nist-p384");395MODULE_ALIAS_CRYPTO("ecdsa-nist-p521");396MODULE_ALIAS_CRYPTO("ecdsa-generic");397