crypto/ec/ecp_s390x_nistp.c

   1 /*
   2  * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdlib.h>
  11 #include <string.h>
  12 #include <openssl/err.h>
  13 #include <openssl/rand.h>
  14 #include "ec_local.h"
  15 #include "s390x_arch.h"
  16
  17 /* Size of parameter blocks */
  18 #define S390X_SIZE_PARAM                4096
  19
  20 /* Size of fields in parameter blocks */
  21 #define S390X_SIZE_P256                 32
  22 #define S390X_SIZE_P384                 48
  23 #define S390X_SIZE_P521                 80
  24
  25 /* Offsets of fields in PCC parameter blocks */
  26 #define S390X_OFF_RES_X(n)              (0 * n)
  27 #define S390X_OFF_RES_Y(n)              (1 * n)
  28 #define S390X_OFF_SRC_X(n)              (2 * n)
  29 #define S390X_OFF_SRC_Y(n)              (3 * n)
  30 #define S390X_OFF_SCALAR(n)             (4 * n)
  31
  32 /* Offsets of fields in KDSA parameter blocks */
  33 #define S390X_OFF_R(n)                  (0 * n)
  34 #define S390X_OFF_S(n)                  (1 * n)
  35 #define S390X_OFF_H(n)                  (2 * n)
  36 #define S390X_OFF_K(n)                  (3 * n)
  37 #define S390X_OFF_X(n)                  (3 * n)
  38 #define S390X_OFF_RN(n)                 (4 * n)
  39 #define S390X_OFF_Y(n)                  (4 * n)
  40
  41 static int ec_GFp_s390x_nistp_mul(const EC_GROUP *group, EC_POINT *r,
  42                                   const BIGNUM *scalar,
  43                                   size_t num, const EC_POINT *points[],
  44                                   const BIGNUM *scalars[],
  45                                   BN_CTX *ctx, unsigned int fc, int len)
  46 {
  47     unsigned char param[S390X_SIZE_PARAM];
  48     BIGNUM *x, *y;
  49     const EC_POINT *point_ptr = NULL;
  50     const BIGNUM *scalar_ptr = NULL;
  51     BN_CTX *new_ctx = NULL;
  52     int rc = -1;
  53
  54     if (ctx == NULL) {
  55         ctx = new_ctx = BN_CTX_new_ex(group->libctx);
  56         if (ctx == NULL)
  57             return 0;
  58     }
  59
  60     BN_CTX_start(ctx);
  61
  62     x = BN_CTX_get(ctx);
  63     y = BN_CTX_get(ctx);
  64     if (x == NULL || y == NULL) {
  65         rc = 0;
  66         goto ret;
  67     }
  68
  69     /*
  70      * Use PCC for EC keygen and ECDH key derivation:
  71      * scalar * generator and scalar * peer public key,
  72      * scalar in [0,order).
  73      */
  74     if ((scalar != NULL && num == 0 && BN_is_negative(scalar) == 0)
  75         || (scalar == NULL && num == 1 && BN_is_negative(scalars[0]) == 0)) {
  76
  77         if (num == 0) {
  78             point_ptr = EC_GROUP_get0_generator(group);
  79             scalar_ptr = scalar;
  80         } else {
  81             point_ptr = points[0];
  82             scalar_ptr = scalars[0];
  83         }
  84
  85         if (EC_POINT_is_at_infinity(group, point_ptr) == 1
  86             || BN_is_zero(scalar_ptr)) {
  87             rc = EC_POINT_set_to_infinity(group, r);
  88             goto ret;
  89         }
  90
  91         memset(&param, 0, sizeof(param));
  92
  93         if (group->meth->point_get_affine_coordinates(group, point_ptr,
  94                                                       x, y, ctx) != 1
  95             || BN_bn2binpad(x, param + S390X_OFF_SRC_X(len), len) == -1
  96             || BN_bn2binpad(y, param + S390X_OFF_SRC_Y(len), len) == -1
  97             || BN_bn2binpad(scalar_ptr,
  98                             param + S390X_OFF_SCALAR(len), len) == -1
  99             || s390x_pcc(fc, param) != 0
 100             || BN_bin2bn(param + S390X_OFF_RES_X(len), len, x) == NULL
 101             || BN_bin2bn(param + S390X_OFF_RES_Y(len), len, y) == NULL
 102             || group->meth->point_set_affine_coordinates(group, r,
 103                                                          x, y, ctx) != 1)
 104             goto ret;
 105
 106         rc = 1;
 107     }
 108
 109 ret:
 110     /* Otherwise use default. */
 111     if (rc == -1)
 112         rc = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
 113     OPENSSL_cleanse(param + S390X_OFF_SCALAR(len), len);
 114     BN_CTX_end(ctx);
 115     BN_CTX_free(new_ctx);
 116     return rc;
 117 }
 118
 119 static ECDSA_SIG *ecdsa_s390x_nistp_sign_sig(const unsigned char *dgst,
 120                                              int dgstlen,
 121                                              const BIGNUM *kinv,
 122                                              const BIGNUM *r,
 123                                              EC_KEY *eckey,
 124                                              unsigned int fc, int len)
 125 {
 126     unsigned char param[S390X_SIZE_PARAM];
 127     int ok = 0;
 128     BIGNUM *k;
 129     ECDSA_SIG *sig;
 130     const EC_GROUP *group;
 131     const BIGNUM *privkey;
 132     int off;
 133
 134     group = EC_KEY_get0_group(eckey);
 135     privkey = EC_KEY_get0_private_key(eckey);
 136     if (group == NULL || privkey == NULL) {
 137         ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, EC_R_MISSING_PARAMETERS);
 138         return NULL;
 139     }
 140
 141     if (!EC_KEY_can_sign(eckey)) {
 142         ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG,
 143               EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
 144         return NULL;
 145     }
 146
 147     k = BN_secure_new();
 148     sig = ECDSA_SIG_new();
 149     if (k == NULL || sig == NULL) {
 150         ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_MALLOC_FAILURE);
 151         goto ret;
 152     }
 153
 154     sig->r = BN_new();
 155     sig->s = BN_new();
 156     if (sig->r == NULL || sig->s == NULL) {
 157         ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_MALLOC_FAILURE);
 158         goto ret;
 159     }
 160
 161     memset(param, 0, sizeof(param));
 162     off = len - (dgstlen > len ? len : dgstlen);
 163     memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
 164
 165     if (BN_bn2binpad(privkey, param + S390X_OFF_K(len), len) == -1) {
 166         ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_BN_LIB);
 167         goto ret;
 168     }
 169
 170     if (r == NULL || kinv == NULL) {
 171         /*
 172          * Generate random k and copy to param param block. RAND_priv_bytes
 173          * is used instead of BN_priv_rand_range or BN_generate_dsa_nonce
 174          * because kdsa instruction constructs an in-range, invertible nonce
 175          * internally implementing counter-measures for RNG weakness.
 176          */
 177          if (RAND_priv_bytes(param + S390X_OFF_RN(len), len) != 1) {
 178              ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG,
 179                    EC_R_RANDOM_NUMBER_GENERATION_FAILED);
 180              goto ret;
 181          }
 182     } else {
 183         /* Reconstruct k = (k^-1)^-1. */
 184         if (ec_group_do_inverse_ord(group, k, kinv, NULL) == 0
 185             || BN_bn2binpad(k, param + S390X_OFF_RN(len), len) == -1) {
 186             ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_BN_LIB);
 187             goto ret;
 188         }
 189         /* Turns KDSA internal nonce-generation off. */
 190         fc |= S390X_KDSA_D;
 191     }
 192
 193     if (s390x_kdsa(fc, param, NULL, 0) != 0) {
 194         ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_ECDSA_LIB);
 195         goto ret;
 196     }
 197
 198     if (BN_bin2bn(param + S390X_OFF_R(len), len, sig->r) == NULL
 199         || BN_bin2bn(param + S390X_OFF_S(len), len, sig->s) == NULL) {
 200         ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_BN_LIB);
 201         goto ret;
 202     }
 203
 204     ok = 1;
 205 ret:
 206     OPENSSL_cleanse(param + S390X_OFF_K(len), 2 * len);
 207     if (ok != 1) {
 208         ECDSA_SIG_free(sig);
 209         sig = NULL;
 210     }
 211     BN_clear_free(k);
 212     return sig;
 213 }
 214
 215 static int ecdsa_s390x_nistp_verify_sig(const unsigned char *dgst, int dgstlen,
 216                                         const ECDSA_SIG *sig, EC_KEY *eckey,
 217                                         unsigned int fc, int len)
 218 {
 219     unsigned char param[S390X_SIZE_PARAM];
 220     int rc = -1;
 221     BN_CTX *ctx;
 222     BIGNUM *x, *y;
 223     const EC_GROUP *group;
 224     const EC_POINT *pubkey;
 225     int off;
 226
 227     group = EC_KEY_get0_group(eckey);
 228     pubkey = EC_KEY_get0_public_key(eckey);
 229     if (eckey == NULL || group == NULL || pubkey == NULL || sig == NULL) {
 230         ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, EC_R_MISSING_PARAMETERS);
 231         return -1;
 232     }
 233
 234     if (!EC_KEY_can_sign(eckey)) {
 235         ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG,
 236               EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
 237         return -1;
 238     }
 239
 240     ctx = BN_CTX_new_ex(group->libctx);
 241     if (ctx == NULL) {
 242         ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, ERR_R_MALLOC_FAILURE);
 243         return -1;
 244     }
 245
 246     BN_CTX_start(ctx);
 247
 248     x = BN_CTX_get(ctx);
 249     y = BN_CTX_get(ctx);
 250     if (x == NULL || y == NULL) {
 251         ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, ERR_R_MALLOC_FAILURE);
 252         goto ret;
 253     }
 254
 255     memset(param, 0, sizeof(param));
 256     off = len - (dgstlen > len ? len : dgstlen);
 257     memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
 258
 259     if (group->meth->point_get_affine_coordinates(group, pubkey,
 260                                                   x, y, ctx) != 1
 261         || BN_bn2binpad(sig->r, param + S390X_OFF_R(len), len) == -1
 262         || BN_bn2binpad(sig->s, param + S390X_OFF_S(len), len) == -1
 263         || BN_bn2binpad(x, param + S390X_OFF_X(len), len) == -1
 264         || BN_bn2binpad(y, param + S390X_OFF_Y(len), len) == -1) {
 265         ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, ERR_R_BN_LIB);
 266         goto ret;
 267     }
 268
 269     rc = s390x_kdsa(fc, param, NULL, 0) == 0 ? 1 : 0;
 270 ret:
 271     BN_CTX_end(ctx);
 272     BN_CTX_free(ctx);
 273     return rc;
 274 }
 275
 276 #define EC_GFP_S390X_NISTP_METHOD(bits)                                 \
 277                                                                         \
 278 static int ec_GFp_s390x_nistp##bits##_mul(const EC_GROUP *group,        \
 279                                           EC_POINT *r,                  \
 280                                           const BIGNUM *scalar,         \
 281                                           size_t num,                   \
 282                                           const EC_POINT *points[],     \
 283                                           const BIGNUM *scalars[],      \
 284                                           BN_CTX *ctx)                  \
 285 {                                                                       \
 286     return ec_GFp_s390x_nistp_mul(group, r, scalar, num, points,        \
 287                                   scalars, ctx,                         \
 288                                   S390X_SCALAR_MULTIPLY_P##bits,        \
 289                                   S390X_SIZE_P##bits);                  \
 290 }                                                                       \
 291                                                                         \
 292 static ECDSA_SIG *ecdsa_s390x_nistp##bits##_sign_sig(const unsigned     \
 293                                                      char *dgst,        \
 294                                                      int dgstlen,       \
 295                                                      const BIGNUM *kinv,\
 296                                                      const BIGNUM *r,   \
 297                                                      EC_KEY *eckey)     \
 298 {                                                                       \
 299     return ecdsa_s390x_nistp_sign_sig(dgst, dgstlen, kinv, r, eckey,    \
 300                                       S390X_ECDSA_SIGN_P##bits,         \
 301                                       S390X_SIZE_P##bits);              \
 302 }                                                                       \
 303                                                                         \
 304 static int ecdsa_s390x_nistp##bits##_verify_sig(const                   \
 305                                                 unsigned char *dgst,    \
 306                                                 int dgstlen,            \
 307                                                 const ECDSA_SIG *sig,   \
 308                                                 EC_KEY *eckey)          \
 309 {                                                                       \
 310     return ecdsa_s390x_nistp_verify_sig(dgst, dgstlen, sig, eckey,      \
 311                                         S390X_ECDSA_VERIFY_P##bits,     \
 312                                         S390X_SIZE_P##bits);            \
 313 }                                                                       \
 314                                                                         \
 315 const EC_METHOD *EC_GFp_s390x_nistp##bits##_method(void)                \
 316 {                                                                       \
 317     static const EC_METHOD EC_GFp_s390x_nistp##bits##_meth = {          \
 318         EC_FLAGS_DEFAULT_OCT,                                           \
 319         NID_X9_62_prime_field,                                          \
 320         ec_GFp_simple_group_init,                                       \
 321         ec_GFp_simple_group_finish,                                     \
 322         ec_GFp_simple_group_clear_finish,                               \
 323         ec_GFp_simple_group_copy,                                       \
 324         ec_GFp_simple_group_set_curve,                                  \
 325         ec_GFp_simple_group_get_curve,                                  \
 326         ec_GFp_simple_group_get_degree,                                 \
 327         ec_group_simple_order_bits,                                     \
 328         ec_GFp_simple_group_check_discriminant,                         \
 329         ec_GFp_simple_point_init,                                       \
 330         ec_GFp_simple_point_finish,                                     \
 331         ec_GFp_simple_point_clear_finish,                               \
 332         ec_GFp_simple_point_copy,                                       \
 333         ec_GFp_simple_point_set_to_infinity,                            \
 334         ec_GFp_simple_set_Jprojective_coordinates_GFp,                  \
 335         ec_GFp_simple_get_Jprojective_coordinates_GFp,                  \
 336         ec_GFp_simple_point_set_affine_coordinates,                     \
 337         ec_GFp_simple_point_get_affine_coordinates,                     \
 338         NULL, /* point_set_compressed_coordinates */                    \
 339         NULL, /* point2oct */                                           \
 340         NULL, /* oct2point */                                           \
 341         ec_GFp_simple_add,                                              \
 342         ec_GFp_simple_dbl,                                              \
 343         ec_GFp_simple_invert,                                           \
 344         ec_GFp_simple_is_at_infinity,                                   \
 345         ec_GFp_simple_is_on_curve,                                      \
 346         ec_GFp_simple_cmp,                                              \
 347         ec_GFp_simple_make_affine,                                      \
 348         ec_GFp_simple_points_make_affine,                               \
 349         ec_GFp_s390x_nistp##bits##_mul,                                 \
 350         NULL, /* precompute_mult */                                     \
 351         NULL, /* have_precompute_mult */                                \
 352         ec_GFp_simple_field_mul,                                        \
 353         ec_GFp_simple_field_sqr,                                        \
 354         NULL, /* field_div */                                           \
 355         ec_GFp_simple_field_inv,                                        \
 356         NULL, /* field_encode */                                        \
 357         NULL, /* field_decode */                                        \
 358         NULL, /* field_set_to_one */                                    \
 359         ec_key_simple_priv2oct,                                         \
 360         ec_key_simple_oct2priv,                                         \
 361         NULL, /* set_private */                                         \
 362         ec_key_simple_generate_key,                                     \
 363         ec_key_simple_check_key,                                        \
 364         ec_key_simple_generate_public_key,                              \
 365         NULL, /* keycopy */                                             \
 366         NULL, /* keyfinish */                                           \
 367         ecdh_simple_compute_key,                                        \
 368         ecdsa_simple_sign_setup,                                        \
 369         ecdsa_s390x_nistp##bits##_sign_sig,                             \
 370         ecdsa_s390x_nistp##bits##_verify_sig,                           \
 371         NULL, /* field_inverse_mod_ord */                               \
 372         ec_GFp_simple_blind_coordinates,                                \
 373         ec_GFp_simple_ladder_pre,                                       \
 374         ec_GFp_simple_ladder_step,                                      \
 375         ec_GFp_simple_ladder_post                                       \
 376     };                                                                  \
 377     static const EC_METHOD *ret;                                        \
 378                                                                         \
 379     if ((OPENSSL_s390xcap_P.pcc[1]                                      \
 380          & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P##bits))                 \
 381         && (OPENSSL_s390xcap_P.kdsa[0]                                  \
 382             & S390X_CAPBIT(S390X_ECDSA_VERIFY_P##bits))                 \
 383         && (OPENSSL_s390xcap_P.kdsa[0]                                  \
 384             & S390X_CAPBIT(S390X_ECDSA_SIGN_P##bits)))                  \
 385         ret = &EC_GFp_s390x_nistp##bits##_meth;                         \
 386     else                                                                \
 387         ret = EC_GFp_mont_method();                                     \
 388                                                                         \
 389     return ret;                                                         \
 390 }
 391
 392 EC_GFP_S390X_NISTP_METHOD(256)
 393 EC_GFP_S390X_NISTP_METHOD(384)
 394 EC_GFP_S390X_NISTP_METHOD(521)