158 lines · c
1// SPDX-License-Identifier: GPL-2.02 3/*4 * SP800-108 Key-derivation function5 *6 * Copyright (C) 2021, Stephan Mueller <smueller@chronox.de>7 */8 9#include <linux/fips.h>10#include <linux/module.h>11#include <crypto/kdf_sp800108.h>12#include <crypto/internal/kdf_selftest.h>13 14/*15 * SP800-108 CTR KDF implementation16 */17int crypto_kdf108_ctr_generate(struct crypto_shash *kmd,18 const struct kvec *info, unsigned int info_nvec,19 u8 *dst, unsigned int dlen)20{21 SHASH_DESC_ON_STACK(desc, kmd);22 __be32 counter = cpu_to_be32(1);23 const unsigned int h = crypto_shash_digestsize(kmd), dlen_orig = dlen;24 unsigned int i;25 int err = 0;26 u8 *dst_orig = dst;27 28 desc->tfm = kmd;29 30 while (dlen) {31 err = crypto_shash_init(desc);32 if (err)33 goto out;34 35 err = crypto_shash_update(desc, (u8 *)&counter, sizeof(__be32));36 if (err)37 goto out;38 39 for (i = 0; i < info_nvec; i++) {40 err = crypto_shash_update(desc, info[i].iov_base,41 info[i].iov_len);42 if (err)43 goto out;44 }45 46 if (dlen < h) {47 u8 tmpbuffer[HASH_MAX_DIGESTSIZE];48 49 err = crypto_shash_final(desc, tmpbuffer);50 if (err)51 goto out;52 memcpy(dst, tmpbuffer, dlen);53 memzero_explicit(tmpbuffer, h);54 goto out;55 }56 57 err = crypto_shash_final(desc, dst);58 if (err)59 goto out;60 61 dlen -= h;62 dst += h;63 counter = cpu_to_be32(be32_to_cpu(counter) + 1);64 }65 66out:67 if (err)68 memzero_explicit(dst_orig, dlen_orig);69 shash_desc_zero(desc);70 return err;71}72EXPORT_SYMBOL(crypto_kdf108_ctr_generate);73 74/*75 * The seeding of the KDF76 */77int crypto_kdf108_setkey(struct crypto_shash *kmd,78 const u8 *key, size_t keylen,79 const u8 *ikm, size_t ikmlen)80{81 unsigned int ds = crypto_shash_digestsize(kmd);82 83 /* SP800-108 does not support IKM */84 if (ikm || ikmlen)85 return -EINVAL;86 87 /* Check according to SP800-108 section 7.2 */88 if (ds > keylen)89 return -EINVAL;90 91 /* Set the key for the MAC used for the KDF. */92 return crypto_shash_setkey(kmd, key, keylen);93}94EXPORT_SYMBOL(crypto_kdf108_setkey);95 96/*97 * Test vector obtained from98 * http://csrc.nist.gov/groups/STM/cavp/documents/KBKDF800-108/CounterMode.zip99 */100static const struct kdf_testvec kdf_ctr_hmac_sha256_tv_template[] = {101 {102 .key = "\xdd\x1d\x91\xb7\xd9\x0b\x2b\xd3"103 "\x13\x85\x33\xce\x92\xb2\x72\xfb"104 "\xf8\xa3\x69\x31\x6a\xef\xe2\x42"105 "\xe6\x59\xcc\x0a\xe2\x38\xaf\xe0",106 .keylen = 32,107 .ikm = NULL,108 .ikmlen = 0,109 .info = {110 .iov_base = "\x01\x32\x2b\x96\xb3\x0a\xcd\x19"111 "\x79\x79\x44\x4e\x46\x8e\x1c\x5c"112 "\x68\x59\xbf\x1b\x1c\xf9\x51\xb7"113 "\xe7\x25\x30\x3e\x23\x7e\x46\xb8"114 "\x64\xa1\x45\xfa\xb2\x5e\x51\x7b"115 "\x08\xf8\x68\x3d\x03\x15\xbb\x29"116 "\x11\xd8\x0a\x0e\x8a\xba\x17\xf3"117 "\xb4\x13\xfa\xac",118 .iov_len = 60119 },120 .expected = "\x10\x62\x13\x42\xbf\xb0\xfd\x40"121 "\x04\x6c\x0e\x29\xf2\xcf\xdb\xf0",122 .expectedlen = 16123 }124};125 126static int __init crypto_kdf108_init(void)127{128 int ret;129 130 if (IS_ENABLED(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS))131 return 0;132 133 ret = kdf_test(&kdf_ctr_hmac_sha256_tv_template[0], "hmac(sha256)",134 crypto_kdf108_setkey, crypto_kdf108_ctr_generate);135 if (ret) {136 if (fips_enabled)137 panic("alg: self-tests for CTR-KDF (hmac(sha256)) failed (rc=%d)\n",138 ret);139 140 WARN(1,141 "alg: self-tests for CTR-KDF (hmac(sha256)) failed (rc=%d)\n",142 ret);143 } else if (fips_enabled) {144 pr_info("alg: self-tests for CTR-KDF (hmac(sha256)) passed\n");145 }146 147 return ret;148}149 150static void __exit crypto_kdf108_exit(void) { }151 152module_init(crypto_kdf108_init);153module_exit(crypto_kdf108_exit);154 155MODULE_LICENSE("GPL v2");156MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");157MODULE_DESCRIPTION("Key Derivation Function conformant to SP800-108");158