[thirdparty/openssl.git] / crypto / ec / ecp_s390x_nistp.c

/*
 * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

/*
 * EC_METHOD low level APIs are deprecated for public use, but still ok for
 * internal use.
 */
#include "internal/deprecated.h"

#include <stdlib.h>
#include <string.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include "ec_local.h"
#include "s390x_arch.h"

/* Size of parameter blocks */
#define S390X_SIZE_PARAM                4096

/* Size of fields in parameter blocks */
#define S390X_SIZE_P256                 32
#define S390X_SIZE_P384                 48
#define S390X_SIZE_P521                 80

/* Offsets of fields in PCC parameter blocks */
#define S390X_OFF_RES_X(n)              (0 * n)
#define S390X_OFF_RES_Y(n)              (1 * n)
#define S390X_OFF_SRC_X(n)              (2 * n)
#define S390X_OFF_SRC_Y(n)              (3 * n)
#define S390X_OFF_SCALAR(n)             (4 * n)

/* Offsets of fields in KDSA parameter blocks */
#define S390X_OFF_R(n)                  (0 * n)
#define S390X_OFF_S(n)                  (1 * n)
#define S390X_OFF_H(n)                  (2 * n)
#define S390X_OFF_K(n)                  (3 * n)
#define S390X_OFF_X(n)                  (3 * n)
#define S390X_OFF_RN(n)                 (4 * n)
#define S390X_OFF_Y(n)                  (4 * n)

static int ec_GFp_s390x_nistp_mul(const EC_GROUP *group, EC_POINT *r,
                                  const BIGNUM *scalar,
                                  size_t num, const EC_POINT *points[],
                                  const BIGNUM *scalars[],
                                  BN_CTX *ctx, unsigned int fc, int len)
{
    unsigned char param[S390X_SIZE_PARAM];
    BIGNUM *x, *y;
    const EC_POINT *point_ptr = NULL;
    const BIGNUM *scalar_ptr = NULL;
    BN_CTX *new_ctx = NULL;
    int rc = -1;

    if (ctx == NULL) {
        ctx = new_ctx = BN_CTX_new_ex(group->libctx);
        if (ctx == NULL)
            return 0;
    }

    BN_CTX_start(ctx);

    x = BN_CTX_get(ctx);
    y = BN_CTX_get(ctx);
    if (x == NULL || y == NULL) {
        rc = 0;
        goto ret;
    }

    /*
     * Use PCC for EC keygen and ECDH key derivation:
     * scalar * generator and scalar * peer public key,
     * scalar in [0,order).
     */
    if ((scalar != NULL && num == 0 && BN_is_negative(scalar) == 0)
        || (scalar == NULL && num == 1 && BN_is_negative(scalars[0]) == 0)) {

        if (num == 0) {
            point_ptr = EC_GROUP_get0_generator(group);
            scalar_ptr = scalar;
        } else {
            point_ptr = points[0];
            scalar_ptr = scalars[0];
        }

        if (EC_POINT_is_at_infinity(group, point_ptr) == 1
            || BN_is_zero(scalar_ptr)) {
            rc = EC_POINT_set_to_infinity(group, r);
            goto ret;
        }

        memset(&param, 0, sizeof(param));

        if (group->meth->point_get_affine_coordinates(group, point_ptr,
                                                      x, y, ctx) != 1
            || BN_bn2binpad(x, param + S390X_OFF_SRC_X(len), len) == -1
            || BN_bn2binpad(y, param + S390X_OFF_SRC_Y(len), len) == -1
            || BN_bn2binpad(scalar_ptr,
                            param + S390X_OFF_SCALAR(len), len) == -1
            || s390x_pcc(fc, param) != 0
            || BN_bin2bn(param + S390X_OFF_RES_X(len), len, x) == NULL
            || BN_bin2bn(param + S390X_OFF_RES_Y(len), len, y) == NULL
            || group->meth->point_set_affine_coordinates(group, r,
                                                         x, y, ctx) != 1)
            goto ret;

        rc = 1;
    }

ret:
    /* Otherwise use default. */
    if (rc == -1)
        rc = ossl_ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
    OPENSSL_cleanse(param + S390X_OFF_SCALAR(len), len);
    BN_CTX_end(ctx);
    BN_CTX_free(new_ctx);
    return rc;
}

static ECDSA_SIG *ecdsa_s390x_nistp_sign_sig(const unsigned char *dgst,
                                             int dgstlen,
                                             const BIGNUM *kinv,
                                             const BIGNUM *r,
                                             EC_KEY *eckey,
                                             unsigned int fc, int len)
{
    unsigned char param[S390X_SIZE_PARAM];
    int ok = 0;
    BIGNUM *k;
    ECDSA_SIG *sig;
    const EC_GROUP *group;
    const BIGNUM *privkey;
    int off;

    group = EC_KEY_get0_group(eckey);
    privkey = EC_KEY_get0_private_key(eckey);
    if (group == NULL || privkey == NULL) {
        ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS);
        return NULL;
    }

    if (!EC_KEY_can_sign(eckey)) {
        ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
        return NULL;
    }

    k = BN_secure_new();
    sig = ECDSA_SIG_new();
    if (k == NULL || sig == NULL) {
        ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
        goto ret;
    }

    sig->r = BN_new();
    sig->s = BN_new();
    if (sig->r == NULL || sig->s == NULL) {
        ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
        goto ret;
    }

    memset(param, 0, sizeof(param));
    off = len - (dgstlen > len ? len : dgstlen);
    memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);

    if (BN_bn2binpad(privkey, param + S390X_OFF_K(len), len) == -1) {
        ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
        goto ret;
    }

    if (r == NULL || kinv == NULL) {
        if (len < 0) {
            ERR_raise(ERR_LIB_EC, EC_R_INVALID_LENGTH);
            goto ret;
        }
        /*
         * Generate random k and copy to param param block. RAND_priv_bytes_ex
         * is used instead of BN_priv_rand_range or BN_generate_dsa_nonce
         * because kdsa instruction constructs an in-range, invertible nonce
         * internally implementing counter-measures for RNG weakness.
         */
         if (RAND_priv_bytes_ex(eckey->libctx, param + S390X_OFF_RN(len),
                                (size_t)len, 0) != 1) {
             ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED);
             goto ret;
         }
    } else {
        /* Reconstruct k = (k^-1)^-1. */
        if (ossl_ec_group_do_inverse_ord(group, k, kinv, NULL) == 0
            || BN_bn2binpad(k, param + S390X_OFF_RN(len), len) == -1) {
            ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
            goto ret;
        }
        /* Turns KDSA internal nonce-generation off. */
        fc |= S390X_KDSA_D;
    }

    if (s390x_kdsa(fc, param, NULL, 0) != 0) {
        ERR_raise(ERR_LIB_EC, ERR_R_ECDSA_LIB);
        goto ret;
    }

    if (BN_bin2bn(param + S390X_OFF_R(len), len, sig->r) == NULL
        || BN_bin2bn(param + S390X_OFF_S(len), len, sig->s) == NULL) {
        ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
        goto ret;
    }

    ok = 1;
ret:
    OPENSSL_cleanse(param + S390X_OFF_K(len), 2 * len);
    if (ok != 1) {
        ECDSA_SIG_free(sig);
        sig = NULL;
    }
    BN_clear_free(k);
    return sig;
}

static int ecdsa_s390x_nistp_verify_sig(const unsigned char *dgst, int dgstlen,
                                        const ECDSA_SIG *sig, EC_KEY *eckey,
                                        unsigned int fc, int len)
{
    unsigned char param[S390X_SIZE_PARAM];
    int rc = -1;
    BN_CTX *ctx;
    BIGNUM *x, *y;
    const EC_GROUP *group;
    const EC_POINT *pubkey;
    int off;

    group = EC_KEY_get0_group(eckey);
    pubkey = EC_KEY_get0_public_key(eckey);
    if (eckey == NULL || group == NULL || pubkey == NULL || sig == NULL) {
        ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS);
        return -1;
    }

    if (!EC_KEY_can_sign(eckey)) {
        ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
        return -1;
    }

    ctx = BN_CTX_new_ex(group->libctx);
    if (ctx == NULL) {
        ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
        return -1;
    }

    BN_CTX_start(ctx);

    x = BN_CTX_get(ctx);
    y = BN_CTX_get(ctx);
    if (x == NULL || y == NULL) {
        ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
        goto ret;
    }

    memset(param, 0, sizeof(param));
    off = len - (dgstlen > len ? len : dgstlen);
    memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);

    if (group->meth->point_get_affine_coordinates(group, pubkey,
                                                  x, y, ctx) != 1
        || BN_bn2binpad(sig->r, param + S390X_OFF_R(len), len) == -1
        || BN_bn2binpad(sig->s, param + S390X_OFF_S(len), len) == -1
        || BN_bn2binpad(x, param + S390X_OFF_X(len), len) == -1
        || BN_bn2binpad(y, param + S390X_OFF_Y(len), len) == -1) {
        ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
        goto ret;
    }

    rc = s390x_kdsa(fc, param, NULL, 0) == 0 ? 1 : 0;
ret:
    BN_CTX_end(ctx);
    BN_CTX_free(ctx);
    return rc;
}

#define EC_GFP_S390X_NISTP_METHOD(bits)                                 \
                                                                        \
static int ec_GFp_s390x_nistp##bits##_mul(const EC_GROUP *group,        \
                                          EC_POINT *r,                  \
                                          const BIGNUM *scalar,         \
                                          size_t num,                   \
                                          const EC_POINT *points[],     \
                                          const BIGNUM *scalars[],      \
                                          BN_CTX *ctx)                  \
{                                                                       \
    return ec_GFp_s390x_nistp_mul(group, r, scalar, num, points,        \
                                  scalars, ctx,                         \
                                  S390X_SCALAR_MULTIPLY_P##bits,        \
                                  S390X_SIZE_P##bits);                  \
}                                                                       \
                                                                        \
static ECDSA_SIG *ecdsa_s390x_nistp##bits##_sign_sig(const unsigned     \
                                                     char *dgst,        \
                                                     int dgstlen,       \
                                                     const BIGNUM *kinv,\
                                                     const BIGNUM *r,   \
                                                     EC_KEY *eckey)     \
{                                                                       \
    return ecdsa_s390x_nistp_sign_sig(dgst, dgstlen, kinv, r, eckey,    \
                                      S390X_ECDSA_SIGN_P##bits,         \
                                      S390X_SIZE_P##bits);              \
}                                                                       \
                                                                        \
static int ecdsa_s390x_nistp##bits##_verify_sig(const                   \
                                                unsigned char *dgst,    \
                                                int dgstlen,            \
                                                const ECDSA_SIG *sig,   \
                                                EC_KEY *eckey)          \
{                                                                       \
    return ecdsa_s390x_nistp_verify_sig(dgst, dgstlen, sig, eckey,      \
                                        S390X_ECDSA_VERIFY_P##bits,     \
                                        S390X_SIZE_P##bits);            \
}                                                                       \
                                                                        \
const EC_METHOD *EC_GFp_s390x_nistp##bits##_method(void)                \
{                                                                       \
    static const EC_METHOD EC_GFp_s390x_nistp##bits##_meth = {          \
        EC_FLAGS_DEFAULT_OCT,                                           \
        NID_X9_62_prime_field,                                          \
        ossl_ec_GFp_simple_group_init,                                  \
        ossl_ec_GFp_simple_group_finish,                                \
        ossl_ec_GFp_simple_group_clear_finish,                          \
        ossl_ec_GFp_simple_group_copy,                                  \
        ossl_ec_GFp_simple_group_set_curve,                             \
        ossl_ec_GFp_simple_group_get_curve,                             \
        ossl_ec_GFp_simple_group_get_degree,                            \
        ossl_ec_group_simple_order_bits,                                \
        ossl_ec_GFp_simple_group_check_discriminant,                    \
        ossl_ec_GFp_simple_point_init,                                  \
        ossl_ec_GFp_simple_point_finish,                                \
        ossl_ec_GFp_simple_point_clear_finish,                          \
        ossl_ec_GFp_simple_point_copy,                                  \
        ossl_ec_GFp_simple_point_set_to_infinity,                       \
        ossl_ec_GFp_simple_point_set_affine_coordinates,                \
        ossl_ec_GFp_simple_point_get_affine_coordinates,                \
        NULL, /* point_set_compressed_coordinates */                    \
        NULL, /* point2oct */                                           \
        NULL, /* oct2point */                                           \
        ossl_ec_GFp_simple_add,                                         \
        ossl_ec_GFp_simple_dbl,                                         \
        ossl_ec_GFp_simple_invert,                                      \
        ossl_ec_GFp_simple_is_at_infinity,                              \
        ossl_ec_GFp_simple_is_on_curve,                                 \
        ossl_ec_GFp_simple_cmp,                                         \
        ossl_ec_GFp_simple_make_affine,                                 \
        ossl_ec_GFp_simple_points_make_affine,                          \
        ec_GFp_s390x_nistp##bits##_mul,                                 \
        NULL, /* precompute_mult */                                     \
        NULL, /* have_precompute_mult */                                \
        ossl_ec_GFp_simple_field_mul,                                   \
        ossl_ec_GFp_simple_field_sqr,                                   \
        NULL, /* field_div */                                           \
        ossl_ec_GFp_simple_field_inv,                                   \
        NULL, /* field_encode */                                        \
        NULL, /* field_decode */                                        \
        NULL, /* field_set_to_one */                                    \
        ossl_ec_key_simple_priv2oct,                                    \
        ossl_ec_key_simple_oct2priv,                                    \
        NULL, /* set_private */                                         \
        ossl_ec_key_simple_generate_key,                                \
        ossl_ec_key_simple_check_key,                                   \
        ossl_ec_key_simple_generate_public_key,                         \
        NULL, /* keycopy */                                             \
        NULL, /* keyfinish */                                           \
        ossl_ecdh_simple_compute_key,                                   \
        ossl_ecdsa_simple_sign_setup,                                   \
        ecdsa_s390x_nistp##bits##_sign_sig,                             \
        ecdsa_s390x_nistp##bits##_verify_sig,                           \
        NULL, /* field_inverse_mod_ord */                               \
        ossl_ec_GFp_simple_blind_coordinates,                           \
        ossl_ec_GFp_simple_ladder_pre,                                  \
        ossl_ec_GFp_simple_ladder_step,                                 \
        ossl_ec_GFp_simple_ladder_post                                  \
    };                                                                  \
    static const EC_METHOD *ret;                                        \
                                                                        \
    if ((OPENSSL_s390xcap_P.pcc[1]                                      \
         & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P##bits))                 \
        && (OPENSSL_s390xcap_P.kdsa[0]                                  \
            & S390X_CAPBIT(S390X_ECDSA_VERIFY_P##bits))                 \
        && (OPENSSL_s390xcap_P.kdsa[0]                                  \
            & S390X_CAPBIT(S390X_ECDSA_SIGN_P##bits)))                  \
        ret = &EC_GFp_s390x_nistp##bits##_meth;                         \
    else                                                                \
        ret = EC_GFp_mont_method();                                     \
                                                                        \
    return ret;                                                         \
}

EC_GFP_S390X_NISTP_METHOD(256)
EC_GFP_S390X_NISTP_METHOD(384)
EC_GFP_S390X_NISTP_METHOD(521)
Commit	Line	Data
1461e667	1	/*
8020d79b	2	* Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
1461e667 PS	3	*
	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
	8	*/
	9
23ccae80 BB	10	/*
	11	* EC_METHOD low level APIs are deprecated for public use, but still ok for
	12	* internal use.
	13	*/
	14	#include "internal/deprecated.h"
	15
1461e667 PS	16	#include <stdlib.h>
	17	#include <string.h>
	18	#include <openssl/err.h>
58c35587	19	#include <openssl/rand.h>
706457b7	20	#include "ec_local.h"
1461e667 PS	21	#include "s390x_arch.h"
	22
	23	/* Size of parameter blocks */
	24	#define S390X_SIZE_PARAM 4096
	25
	26	/* Size of fields in parameter blocks */
	27	#define S390X_SIZE_P256 32
	28	#define S390X_SIZE_P384 48
	29	#define S390X_SIZE_P521 80
	30
	31	/* Offsets of fields in PCC parameter blocks */
	32	#define S390X_OFF_RES_X(n) (0 * n)
	33	#define S390X_OFF_RES_Y(n) (1 * n)
	34	#define S390X_OFF_SRC_X(n) (2 * n)
	35	#define S390X_OFF_SRC_Y(n) (3 * n)
	36	#define S390X_OFF_SCALAR(n) (4 * n)
	37
58c35587 PS	38	/* Offsets of fields in KDSA parameter blocks */
	39	#define S390X_OFF_R(n) (0 * n)
	40	#define S390X_OFF_S(n) (1 * n)
	41	#define S390X_OFF_H(n) (2 * n)
	42	#define S390X_OFF_K(n) (3 * n)
	43	#define S390X_OFF_X(n) (3 * n)
	44	#define S390X_OFF_RN(n) (4 * n)
	45	#define S390X_OFF_Y(n) (4 * n)
	46
1461e667 PS	47	static int ec_GFp_s390x_nistp_mul(const EC_GROUP group, EC_POINT r,
	48	const BIGNUM *scalar,
	49	size_t num, const EC_POINT *points[],
	50	const BIGNUM *scalars[],
	51	BN_CTX *ctx, unsigned int fc, int len)
	52	{
	53	unsigned char param[S390X_SIZE_PARAM];
	54	BIGNUM x, y;
	55	const EC_POINT *point_ptr = NULL;
	56	const BIGNUM *scalar_ptr = NULL;
	57	BN_CTX *new_ctx = NULL;
	58	int rc = -1;
	59
	60	if (ctx == NULL) {
	61	ctx = new_ctx = BN_CTX_new_ex(group->libctx);
	62	if (ctx == NULL)
	63	return 0;
	64	}
	65
	66	BN_CTX_start(ctx);
	67
	68	x = BN_CTX_get(ctx);
	69	y = BN_CTX_get(ctx);
	70	if (x == NULL \|\| y == NULL) {
	71	rc = 0;
	72	goto ret;
	73	}
	74
	75	/*
	76	* Use PCC for EC keygen and ECDH key derivation:
	77	* scalar * generator and scalar * peer public key,
	78	* scalar in [0,order).
	79	*/
	80	if ((scalar != NULL && num == 0 && BN_is_negative(scalar) == 0)
	81	\|\| (scalar == NULL && num == 1 && BN_is_negative(scalars[0]) == 0)) {
	82
	83	if (num == 0) {
	84	point_ptr = EC_GROUP_get0_generator(group);
	85	scalar_ptr = scalar;
	86	} else {
	87	point_ptr = points[0];
	88	scalar_ptr = scalars[0];
	89	}
	90
	91	if (EC_POINT_is_at_infinity(group, point_ptr) == 1
	92	\|\| BN_is_zero(scalar_ptr)) {
	93	rc = EC_POINT_set_to_infinity(group, r);
	94	goto ret;
	95	}
	96
	97	memset(&param, 0, sizeof(param));
	98
	99	if (group->meth->point_get_affine_coordinates(group, point_ptr,
	100	x, y, ctx) != 1
	101	\|\| BN_bn2binpad(x, param + S390X_OFF_SRC_X(len), len) == -1
	102	\|\| BN_bn2binpad(y, param + S390X_OFF_SRC_Y(len), len) == -1
	103	\|\| BN_bn2binpad(scalar_ptr,
	104	param + S390X_OFF_SCALAR(len), len) == -1
	105	\|\| s390x_pcc(fc, param) != 0
	106	\|\| BN_bin2bn(param + S390X_OFF_RES_X(len), len, x) == NULL
	107	\|\| BN_bin2bn(param + S390X_OFF_RES_Y(len), len, y) == NULL
	108	\|\| group->meth->point_set_affine_coordinates(group, r,
	109	x, y, ctx) != 1)
	110	goto ret;
111
112	rc = 1;
113	}
114
115	ret:
116	/* Otherwise use default. */
117	if (rc == -1)
32ab57cb	118	rc = ossl_ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
2281be2e	119	OPENSSL_cleanse(param + S390X_OFF_SCALAR(len), len);
1461e667 PS	120	BN_CTX_end(ctx);
	121	BN_CTX_free(new_ctx);
	122	return rc;
	123	}
	124
58c35587 PS	125	static ECDSA_SIG ecdsa_s390x_nistp_sign_sig(const unsigned char dgst,
	126	int dgstlen,
	127	const BIGNUM *kinv,
	128	const BIGNUM *r,
	129	EC_KEY *eckey,
	130	unsigned int fc, int len)
	131	{
	132	unsigned char param[S390X_SIZE_PARAM];
	133	int ok = 0;
	134	BIGNUM *k;
	135	ECDSA_SIG *sig;
	136	const EC_GROUP *group;
	137	const BIGNUM *privkey;
	138	int off;
	139
	140	group = EC_KEY_get0_group(eckey);
	141	privkey = EC_KEY_get0_private_key(eckey);
	142	if (group == NULL \|\| privkey == NULL) {
9311d0c4	143	ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS);
58c35587 PS	144	return NULL;
	145	}
	146
	147	if (!EC_KEY_can_sign(eckey)) {
9311d0c4	148	ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
58c35587 PS	149	return NULL;
	150	}
	151
	152	k = BN_secure_new();
	153	sig = ECDSA_SIG_new();
	154	if (k == NULL \|\| sig == NULL) {
9311d0c4	155	ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
58c35587 PS	156	goto ret;
	157	}
	158
	159	sig->r = BN_new();
	160	sig->s = BN_new();
	161	if (sig->r == NULL \|\| sig->s == NULL) {
9311d0c4	162	ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
58c35587 PS	163	goto ret;
	164	}
	165
	166	memset(param, 0, sizeof(param));
	167	off = len - (dgstlen > len ? len : dgstlen);
	168	memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
	169
	170	if (BN_bn2binpad(privkey, param + S390X_OFF_K(len), len) == -1) {
9311d0c4	171	ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
58c35587 PS	172	goto ret;
	173	}
	174
	175	if (r == NULL \|\| kinv == NULL) {
28cab209 P	176	if (len < 0) {
	177	ERR_raise(ERR_LIB_EC, EC_R_INVALID_LENGTH);
	178	goto ret;
	179	}
58c35587	180	/*
47c239c6	181	* Generate random k and copy to param param block. RAND_priv_bytes_ex
58c35587 PS	182	* is used instead of BN_priv_rand_range or BN_generate_dsa_nonce
	183	* because kdsa instruction constructs an in-range, invertible nonce
	184	* internally implementing counter-measures for RNG weakness.
	185	*/
47c239c6	186	if (RAND_priv_bytes_ex(eckey->libctx, param + S390X_OFF_RN(len),
28cab209	187	(size_t)len, 0) != 1) {
9311d0c4	188	ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED);
58c35587 PS	189	goto ret;
	190	}
	191	} else {
	192	/* Reconstruct k = (k^-1)^-1. */
32ab57cb	193	if (ossl_ec_group_do_inverse_ord(group, k, kinv, NULL) == 0
58c35587	194	\|\| BN_bn2binpad(k, param + S390X_OFF_RN(len), len) == -1) {
9311d0c4	195	ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
58c35587 PS	196	goto ret;
	197	}
	198	/* Turns KDSA internal nonce-generation off. */
	199	fc \|= S390X_KDSA_D;
	200	}
	201
	202	if (s390x_kdsa(fc, param, NULL, 0) != 0) {
9311d0c4	203	ERR_raise(ERR_LIB_EC, ERR_R_ECDSA_LIB);
58c35587 PS	204	goto ret;
	205	}
	206
	207	if (BN_bin2bn(param + S390X_OFF_R(len), len, sig->r) == NULL
	208	\|\| BN_bin2bn(param + S390X_OFF_S(len), len, sig->s) == NULL) {
9311d0c4	209	ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
58c35587 PS	210	goto ret;
	211	}
	212
	213	ok = 1;
	214	ret:
2281be2e	215	OPENSSL_cleanse(param + S390X_OFF_K(len), 2 * len);
58c35587 PS	216	if (ok != 1) {
	217	ECDSA_SIG_free(sig);
	218	sig = NULL;
	219	}
	220	BN_clear_free(k);
	221	return sig;
	222	}
	223
	224	static int ecdsa_s390x_nistp_verify_sig(const unsigned char *dgst, int dgstlen,
	225	const ECDSA_SIG sig, EC_KEY eckey,
	226	unsigned int fc, int len)
	227	{
	228	unsigned char param[S390X_SIZE_PARAM];
	229	int rc = -1;
	230	BN_CTX *ctx;
	231	BIGNUM x, y;
	232	const EC_GROUP *group;
	233	const EC_POINT *pubkey;
	234	int off;
	235
	236	group = EC_KEY_get0_group(eckey);
	237	pubkey = EC_KEY_get0_public_key(eckey);
	238	if (eckey == NULL \|\| group == NULL \|\| pubkey == NULL \|\| sig == NULL) {
9311d0c4	239	ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS);
58c35587 PS	240	return -1;
	241	}
	242
	243	if (!EC_KEY_can_sign(eckey)) {
9311d0c4	244	ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
58c35587 PS	245	return -1;
	246	}
	247
	248	ctx = BN_CTX_new_ex(group->libctx);
	249	if (ctx == NULL) {
9311d0c4	250	ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
58c35587 PS	251	return -1;
	252	}
	253
	254	BN_CTX_start(ctx);
	255
	256	x = BN_CTX_get(ctx);
	257	y = BN_CTX_get(ctx);
	258	if (x == NULL \|\| y == NULL) {
9311d0c4	259	ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
58c35587 PS	260	goto ret;
	261	}
	262
	263	memset(param, 0, sizeof(param));
	264	off = len - (dgstlen > len ? len : dgstlen);
	265	memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
	266
	267	if (group->meth->point_get_affine_coordinates(group, pubkey,
	268	x, y, ctx) != 1
	269	\|\| BN_bn2binpad(sig->r, param + S390X_OFF_R(len), len) == -1
	270	\|\| BN_bn2binpad(sig->s, param + S390X_OFF_S(len), len) == -1
	271	\|\| BN_bn2binpad(x, param + S390X_OFF_X(len), len) == -1
	272	\|\| BN_bn2binpad(y, param + S390X_OFF_Y(len), len) == -1) {
9311d0c4	273	ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
58c35587 PS	274	goto ret;
	275	}
	276
	277	rc = s390x_kdsa(fc, param, NULL, 0) == 0 ? 1 : 0;
	278	ret:
	279	BN_CTX_end(ctx);
	280	BN_CTX_free(ctx);
	281	return rc;
	282	}
	283
1461e667 PS	284	#define EC_GFP_S390X_NISTP_METHOD(bits) \
	285	\
	286	static int ec_GFp_s390x_nistp##bits##_mul(const EC_GROUP *group, \
	287	EC_POINT *r, \
	288	const BIGNUM *scalar, \
	289	size_t num, \
	290	const EC_POINT *points[], \
	291	const BIGNUM *scalars[], \
	292	BN_CTX *ctx) \
	293	{ \
	294	return ec_GFp_s390x_nistp_mul(group, r, scalar, num, points, \
	295	scalars, ctx, \
	296	S390X_SCALAR_MULTIPLY_P##bits, \
	297	S390X_SIZE_P##bits); \
	298	} \
	299	\
58c35587 PS	300	static ECDSA_SIG *ecdsa_s390x_nistp##bits##_sign_sig(const unsigned \
	301	char *dgst, \
	302	int dgstlen, \
	303	const BIGNUM *kinv,\
	304	const BIGNUM *r, \
	305	EC_KEY *eckey) \
	306	{ \
	307	return ecdsa_s390x_nistp_sign_sig(dgst, dgstlen, kinv, r, eckey, \
	308	S390X_ECDSA_SIGN_P##bits, \
	309	S390X_SIZE_P##bits); \
	310	} \
	311	\
	312	static int ecdsa_s390x_nistp##bits##_verify_sig(const \
	313	unsigned char *dgst, \
	314	int dgstlen, \
	315	const ECDSA_SIG *sig, \
	316	EC_KEY *eckey) \
	317	{ \
	318	return ecdsa_s390x_nistp_verify_sig(dgst, dgstlen, sig, eckey, \
	319	S390X_ECDSA_VERIFY_P##bits, \
	320	S390X_SIZE_P##bits); \
	321	} \
	322	\
1461e667 PS	323	const EC_METHOD *EC_GFp_s390x_nistp##bits##_method(void) \
	324	{ \
	325	static const EC_METHOD EC_GFp_s390x_nistp##bits##_meth = { \
	326	EC_FLAGS_DEFAULT_OCT, \
	327	NID_X9_62_prime_field, \
32ab57cb SL	328	ossl_ec_GFp_simple_group_init, \
	329	ossl_ec_GFp_simple_group_finish, \
	330	ossl_ec_GFp_simple_group_clear_finish, \
	331	ossl_ec_GFp_simple_group_copy, \
	332	ossl_ec_GFp_simple_group_set_curve, \
	333	ossl_ec_GFp_simple_group_get_curve, \
	334	ossl_ec_GFp_simple_group_get_degree, \
	335	ossl_ec_group_simple_order_bits, \
	336	ossl_ec_GFp_simple_group_check_discriminant, \
	337	ossl_ec_GFp_simple_point_init, \
	338	ossl_ec_GFp_simple_point_finish, \
	339	ossl_ec_GFp_simple_point_clear_finish, \
	340	ossl_ec_GFp_simple_point_copy, \
	341	ossl_ec_GFp_simple_point_set_to_infinity, \
	342	ossl_ec_GFp_simple_point_set_affine_coordinates, \
	343	ossl_ec_GFp_simple_point_get_affine_coordinates, \
1461e667 PS	344	NULL, /* point_set_compressed_coordinates */ \
	345	NULL, /* point2oct */ \
	346	NULL, /* oct2point */ \
32ab57cb SL	347	ossl_ec_GFp_simple_add, \
	348	ossl_ec_GFp_simple_dbl, \
	349	ossl_ec_GFp_simple_invert, \
	350	ossl_ec_GFp_simple_is_at_infinity, \
	351	ossl_ec_GFp_simple_is_on_curve, \
	352	ossl_ec_GFp_simple_cmp, \
	353	ossl_ec_GFp_simple_make_affine, \
	354	ossl_ec_GFp_simple_points_make_affine, \
1461e667 PS	355	ec_GFp_s390x_nistp##bits##_mul, \
	356	NULL, /* precompute_mult */ \
	357	NULL, /* have_precompute_mult */ \
32ab57cb SL	358	ossl_ec_GFp_simple_field_mul, \
32ab57cb SL	359	ossl_ec_GFp_simple_field_sqr, \
1461e667	360	NULL, /* field_div */ \
32ab57cb	361	ossl_ec_GFp_simple_field_inv, \
1461e667 PS	362	NULL, /* field_encode */ \
	363	NULL, /* field_decode */ \
	364	NULL, /* field_set_to_one */ \
32ab57cb SL	365	ossl_ec_key_simple_priv2oct, \
32ab57cb SL	366	ossl_ec_key_simple_oct2priv, \
1461e667	367	NULL, /* set_private */ \
32ab57cb SL	368	ossl_ec_key_simple_generate_key, \
	369	ossl_ec_key_simple_check_key, \
	370	ossl_ec_key_simple_generate_public_key, \
1461e667 PS	371	NULL, /* keycopy */ \
1461e667 PS	372	NULL, /* keyfinish */ \
32ab57cb SL	373	ossl_ecdh_simple_compute_key, \
32ab57cb SL	374	ossl_ecdsa_simple_sign_setup, \
58c35587 PS	375	ecdsa_s390x_nistp##bits##_sign_sig, \
58c35587 PS	376	ecdsa_s390x_nistp##bits##_verify_sig, \
1461e667	377	NULL, /* field_inverse_mod_ord */ \
32ab57cb SL	378	ossl_ec_GFp_simple_blind_coordinates, \
	379	ossl_ec_GFp_simple_ladder_pre, \
	380	ossl_ec_GFp_simple_ladder_step, \
	381	ossl_ec_GFp_simple_ladder_post \
1461e667 PS	382	}; \
	383	static const EC_METHOD *ret; \
	384	\
58c35587 PS	385	if ((OPENSSL_s390xcap_P.pcc[1] \
	386	& S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P##bits)) \
	387	&& (OPENSSL_s390xcap_P.kdsa[0] \
	388	& S390X_CAPBIT(S390X_ECDSA_VERIFY_P##bits)) \
	389	&& (OPENSSL_s390xcap_P.kdsa[0] \
	390	& S390X_CAPBIT(S390X_ECDSA_SIGN_P##bits))) \
1461e667 PS	391	ret = &EC_GFp_s390x_nistp##bits##_meth; \
	392	else \
	393	ret = EC_GFp_mont_method(); \
	394	\
	395	return ret; \
	396	}
	397
	398	EC_GFP_S390X_NISTP_METHOD(256)
	399	EC_GFP_S390X_NISTP_METHOD(384)
	400	EC_GFP_S390X_NISTP_METHOD(521)