]>
Commit | Line | Data |
---|---|---|
1 | // SPDX-License-Identifier: GPL-2.0-or-later | |
2 | /* ECDH key-agreement protocol | |
3 | * | |
4 | * Copyright (c) 2016, Intel Corporation | |
5 | * Authors: Salvator Benedetto <salvatore.benedetto@intel.com> | |
6 | */ | |
7 | ||
8 | #include <linux/module.h> | |
9 | #include <crypto/internal/ecc.h> | |
10 | #include <crypto/internal/kpp.h> | |
11 | #include <crypto/kpp.h> | |
12 | #include <crypto/ecdh.h> | |
13 | #include <linux/scatterlist.h> | |
14 | ||
15 | struct ecdh_ctx { | |
16 | unsigned int curve_id; | |
17 | unsigned int ndigits; | |
18 | u64 private_key[ECC_MAX_DIGITS]; | |
19 | }; | |
20 | ||
21 | static inline struct ecdh_ctx *ecdh_get_ctx(struct crypto_kpp *tfm) | |
22 | { | |
23 | return kpp_tfm_ctx(tfm); | |
24 | } | |
25 | ||
26 | static int ecdh_set_secret(struct crypto_kpp *tfm, const void *buf, | |
27 | unsigned int len) | |
28 | { | |
29 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
30 | struct ecdh params; | |
31 | ||
32 | if (crypto_ecdh_decode_key(buf, len, ¶ms) < 0 || | |
33 | params.key_size > sizeof(u64) * ctx->ndigits) | |
34 | return -EINVAL; | |
35 | ||
36 | if (!params.key || !params.key_size) | |
37 | return ecc_gen_privkey(ctx->curve_id, ctx->ndigits, | |
38 | ctx->private_key); | |
39 | ||
40 | memcpy(ctx->private_key, params.key, params.key_size); | |
41 | ||
42 | if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits, | |
43 | ctx->private_key, params.key_size) < 0) { | |
44 | memzero_explicit(ctx->private_key, params.key_size); | |
45 | return -EINVAL; | |
46 | } | |
47 | return 0; | |
48 | } | |
49 | ||
50 | static int ecdh_compute_value(struct kpp_request *req) | |
51 | { | |
52 | struct crypto_kpp *tfm = crypto_kpp_reqtfm(req); | |
53 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
54 | u64 *public_key; | |
55 | u64 *shared_secret = NULL; | |
56 | void *buf; | |
57 | size_t copied, nbytes, public_key_sz; | |
58 | int ret = -ENOMEM; | |
59 | ||
60 | nbytes = ctx->ndigits << ECC_DIGITS_TO_BYTES_SHIFT; | |
61 | /* Public part is a point thus it has both coordinates */ | |
62 | public_key_sz = 2 * nbytes; | |
63 | ||
64 | public_key = kmalloc(public_key_sz, GFP_KERNEL); | |
65 | if (!public_key) | |
66 | return -ENOMEM; | |
67 | ||
68 | if (req->src) { | |
69 | shared_secret = kmalloc(nbytes, GFP_KERNEL); | |
70 | if (!shared_secret) | |
71 | goto free_pubkey; | |
72 | ||
73 | /* from here on it's invalid parameters */ | |
74 | ret = -EINVAL; | |
75 | ||
76 | /* must have exactly two points to be on the curve */ | |
77 | if (public_key_sz != req->src_len) | |
78 | goto free_all; | |
79 | ||
80 | copied = sg_copy_to_buffer(req->src, | |
81 | sg_nents_for_len(req->src, | |
82 | public_key_sz), | |
83 | public_key, public_key_sz); | |
84 | if (copied != public_key_sz) | |
85 | goto free_all; | |
86 | ||
87 | ret = crypto_ecdh_shared_secret(ctx->curve_id, ctx->ndigits, | |
88 | ctx->private_key, public_key, | |
89 | shared_secret); | |
90 | ||
91 | buf = shared_secret; | |
92 | } else { | |
93 | ret = ecc_make_pub_key(ctx->curve_id, ctx->ndigits, | |
94 | ctx->private_key, public_key); | |
95 | buf = public_key; | |
96 | nbytes = public_key_sz; | |
97 | } | |
98 | ||
99 | if (ret < 0) | |
100 | goto free_all; | |
101 | ||
102 | /* might want less than we've got */ | |
103 | nbytes = min_t(size_t, nbytes, req->dst_len); | |
104 | copied = sg_copy_from_buffer(req->dst, sg_nents_for_len(req->dst, | |
105 | nbytes), | |
106 | buf, nbytes); | |
107 | if (copied != nbytes) | |
108 | ret = -EINVAL; | |
109 | ||
110 | /* fall through */ | |
111 | free_all: | |
112 | kfree_sensitive(shared_secret); | |
113 | free_pubkey: | |
114 | kfree(public_key); | |
115 | return ret; | |
116 | } | |
117 | ||
118 | static unsigned int ecdh_max_size(struct crypto_kpp *tfm) | |
119 | { | |
120 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
121 | ||
122 | /* Public key is made of two coordinates, add one to the left shift */ | |
123 | return ctx->ndigits << (ECC_DIGITS_TO_BYTES_SHIFT + 1); | |
124 | } | |
125 | ||
126 | static int ecdh_nist_p192_init_tfm(struct crypto_kpp *tfm) | |
127 | { | |
128 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
129 | ||
130 | ctx->curve_id = ECC_CURVE_NIST_P192; | |
131 | ctx->ndigits = ECC_CURVE_NIST_P192_DIGITS; | |
132 | ||
133 | return 0; | |
134 | } | |
135 | ||
136 | static struct kpp_alg ecdh_nist_p192 = { | |
137 | .set_secret = ecdh_set_secret, | |
138 | .generate_public_key = ecdh_compute_value, | |
139 | .compute_shared_secret = ecdh_compute_value, | |
140 | .max_size = ecdh_max_size, | |
141 | .init = ecdh_nist_p192_init_tfm, | |
142 | .base = { | |
143 | .cra_name = "ecdh-nist-p192", | |
144 | .cra_driver_name = "ecdh-nist-p192-generic", | |
145 | .cra_priority = 100, | |
146 | .cra_module = THIS_MODULE, | |
147 | .cra_ctxsize = sizeof(struct ecdh_ctx), | |
148 | }, | |
149 | }; | |
150 | ||
151 | static int ecdh_nist_p256_init_tfm(struct crypto_kpp *tfm) | |
152 | { | |
153 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
154 | ||
155 | ctx->curve_id = ECC_CURVE_NIST_P256; | |
156 | ctx->ndigits = ECC_CURVE_NIST_P256_DIGITS; | |
157 | ||
158 | return 0; | |
159 | } | |
160 | ||
161 | static struct kpp_alg ecdh_nist_p256 = { | |
162 | .set_secret = ecdh_set_secret, | |
163 | .generate_public_key = ecdh_compute_value, | |
164 | .compute_shared_secret = ecdh_compute_value, | |
165 | .max_size = ecdh_max_size, | |
166 | .init = ecdh_nist_p256_init_tfm, | |
167 | .base = { | |
168 | .cra_name = "ecdh-nist-p256", | |
169 | .cra_driver_name = "ecdh-nist-p256-generic", | |
170 | .cra_priority = 100, | |
171 | .cra_module = THIS_MODULE, | |
172 | .cra_ctxsize = sizeof(struct ecdh_ctx), | |
173 | }, | |
174 | }; | |
175 | ||
176 | static int ecdh_nist_p384_init_tfm(struct crypto_kpp *tfm) | |
177 | { | |
178 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
179 | ||
180 | ctx->curve_id = ECC_CURVE_NIST_P384; | |
181 | ctx->ndigits = ECC_CURVE_NIST_P384_DIGITS; | |
182 | ||
183 | return 0; | |
184 | } | |
185 | ||
186 | static struct kpp_alg ecdh_nist_p384 = { | |
187 | .set_secret = ecdh_set_secret, | |
188 | .generate_public_key = ecdh_compute_value, | |
189 | .compute_shared_secret = ecdh_compute_value, | |
190 | .max_size = ecdh_max_size, | |
191 | .init = ecdh_nist_p384_init_tfm, | |
192 | .base = { | |
193 | .cra_name = "ecdh-nist-p384", | |
194 | .cra_driver_name = "ecdh-nist-p384-generic", | |
195 | .cra_priority = 100, | |
196 | .cra_module = THIS_MODULE, | |
197 | .cra_ctxsize = sizeof(struct ecdh_ctx), | |
198 | }, | |
199 | }; | |
200 | ||
201 | static bool ecdh_nist_p192_registered; | |
202 | ||
203 | static int ecdh_init(void) | |
204 | { | |
205 | int ret; | |
206 | ||
207 | /* NIST p192 will fail to register in FIPS mode */ | |
208 | ret = crypto_register_kpp(&ecdh_nist_p192); | |
209 | ecdh_nist_p192_registered = ret == 0; | |
210 | ||
211 | ret = crypto_register_kpp(&ecdh_nist_p256); | |
212 | if (ret) | |
213 | goto nist_p256_error; | |
214 | ||
215 | ret = crypto_register_kpp(&ecdh_nist_p384); | |
216 | if (ret) | |
217 | goto nist_p384_error; | |
218 | ||
219 | return 0; | |
220 | ||
221 | nist_p384_error: | |
222 | crypto_unregister_kpp(&ecdh_nist_p256); | |
223 | ||
224 | nist_p256_error: | |
225 | if (ecdh_nist_p192_registered) | |
226 | crypto_unregister_kpp(&ecdh_nist_p192); | |
227 | return ret; | |
228 | } | |
229 | ||
230 | static void ecdh_exit(void) | |
231 | { | |
232 | if (ecdh_nist_p192_registered) | |
233 | crypto_unregister_kpp(&ecdh_nist_p192); | |
234 | crypto_unregister_kpp(&ecdh_nist_p256); | |
235 | crypto_unregister_kpp(&ecdh_nist_p384); | |
236 | } | |
237 | ||
238 | subsys_initcall(ecdh_init); | |
239 | module_exit(ecdh_exit); | |
240 | MODULE_ALIAS_CRYPTO("ecdh"); | |
241 | MODULE_LICENSE("GPL"); | |
242 | MODULE_DESCRIPTION("ECDH generic algorithm"); |