]>
git.ipfire.org Git - thirdparty/linux.git/blob - crypto/sm2.c
1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * SM2 asymmetric public-key algorithm
4 * as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012 SM2 and
5 * described at https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
7 * Copyright (c) 2020, Alibaba Group.
8 * Authors: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
11 #include <linux/module.h>
12 #include <linux/mpi.h>
13 #include <crypto/internal/akcipher.h>
14 #include <crypto/akcipher.h>
15 #include <crypto/hash.h>
16 #include <crypto/rng.h>
17 #include <crypto/sm2.h>
18 #include "sm2signature.asn1.h"
20 /* The default user id as specified in GM/T 0009-2012 */
21 #define SM2_DEFAULT_USERID "1234567812345678"
22 #define SM2_DEFAULT_USERID_LEN 16
24 #define MPI_NBYTES(m) ((mpi_get_nbits(m) + 7) / 8)
26 struct ecc_domain_parms
{
27 const char *desc
; /* Description of the curve. */
28 unsigned int nbits
; /* Number of bits. */
29 unsigned int fips
:1; /* True if this is a FIPS140-2 approved curve */
31 /* The model describing this curve. This is mainly used to select
34 enum gcry_mpi_ec_models model
;
36 /* The actual ECC dialect used. This is used for curve specific
37 * optimizations and to select encodings etc.
39 enum ecc_dialects dialect
;
41 const char *p
; /* The prime defining the field. */
42 const char *a
, *b
; /* The coefficients. For Twisted Edwards
43 * Curves b is used for d. For Montgomery
44 * Curves (a,b) has ((A-2)/4,B^-1).
46 const char *n
; /* The order of the base point. */
47 const char *g_x
, *g_y
; /* Base point. */
48 unsigned int h
; /* Cofactor. */
51 static const struct ecc_domain_parms sm2_ecp
= {
55 .model
= MPI_EC_WEIERSTRASS
,
56 .dialect
= ECC_DIALECT_STANDARD
,
57 .p
= "0xfffffffeffffffffffffffffffffffffffffffff00000000ffffffffffffffff",
58 .a
= "0xfffffffeffffffffffffffffffffffffffffffff00000000fffffffffffffffc",
59 .b
= "0x28e9fa9e9d9f5e344d5a9e4bcf6509a7f39789f515ab8f92ddbcbd414d940e93",
60 .n
= "0xfffffffeffffffffffffffffffffffff7203df6b21c6052b53bbf40939d54123",
61 .g_x
= "0x32c4ae2c1f1981195f9904466a39c9948fe30bbff2660be1715a4589334c74c7",
62 .g_y
= "0xbc3736a2f4f6779c59bdcee36b692153d0a9877cc62a474002df32e52139f0a0",
66 static int __sm2_set_pub_key(struct mpi_ec_ctx
*ec
,
67 const void *key
, unsigned int keylen
);
69 static int sm2_ec_ctx_init(struct mpi_ec_ctx
*ec
)
71 const struct ecc_domain_parms
*ecp
= &sm2_ecp
;
76 p
= mpi_scanval(ecp
->p
);
77 a
= mpi_scanval(ecp
->a
);
78 b
= mpi_scanval(ecp
->b
);
82 x
= mpi_scanval(ecp
->g_x
);
83 y
= mpi_scanval(ecp
->g_y
);
89 ec
->Q
= mpi_point_new(0);
93 /* mpi_ec_setup_elliptic_curve */
94 ec
->G
= mpi_point_new(0);
96 mpi_point_release(ec
->Q
);
100 mpi_set(ec
->G
->x
, x
);
101 mpi_set(ec
->G
->y
, y
);
102 mpi_set_ui(ec
->G
->z
, 1);
105 ec
->n
= mpi_scanval(ecp
->n
);
107 mpi_point_release(ec
->Q
);
108 mpi_point_release(ec
->G
);
113 ec
->name
= ecp
->desc
;
114 mpi_ec_init(ec
, ecp
->model
, ecp
->dialect
, 0, p
, a
, b
);
129 static void sm2_ec_ctx_deinit(struct mpi_ec_ctx
*ec
)
133 memset(ec
, 0, sizeof(*ec
));
136 /* RESULT must have been initialized and is set on success to the
137 * point given by VALUE.
139 static int sm2_ecc_os2ec(MPI_POINT result
, MPI value
)
146 n
= MPI_NBYTES(value
);
147 buf
= kmalloc(n
, GFP_KERNEL
);
151 rc
= mpi_print(GCRYMPI_FMT_USG
, buf
, n
, &n
, value
);
156 if (n
< 1 || ((n
- 1) % 2))
158 /* No support for point compression */
164 x
= mpi_read_raw_data(buf
+ 1, n
);
167 y
= mpi_read_raw_data(buf
+ 1 + n
, n
);
173 mpi_set(result
->x
, x
);
174 mpi_set(result
->y
, y
);
175 mpi_set_ui(result
->z
, 1);
187 struct sm2_signature_ctx
{
192 int sm2_get_signature_r(void *context
, size_t hdrlen
, unsigned char tag
,
193 const void *value
, size_t vlen
)
195 struct sm2_signature_ctx
*sig
= context
;
200 sig
->sig_r
= mpi_read_raw_data(value
, vlen
);
207 int sm2_get_signature_s(void *context
, size_t hdrlen
, unsigned char tag
,
208 const void *value
, size_t vlen
)
210 struct sm2_signature_ctx
*sig
= context
;
215 sig
->sig_s
= mpi_read_raw_data(value
, vlen
);
222 static int sm2_z_digest_update(struct shash_desc
*desc
,
223 MPI m
, unsigned int pbytes
)
225 static const unsigned char zero
[32];
230 in
= mpi_get_buffer(m
, &inlen
, NULL
);
234 if (inlen
< pbytes
) {
235 /* padding with zero */
236 err
= crypto_shash_update(desc
, zero
, pbytes
- inlen
) ?:
237 crypto_shash_update(desc
, in
, inlen
);
238 } else if (inlen
> pbytes
) {
239 /* skip the starting zero */
240 err
= crypto_shash_update(desc
, in
+ inlen
- pbytes
, pbytes
);
242 err
= crypto_shash_update(desc
, in
, inlen
);
249 static int sm2_z_digest_update_point(struct shash_desc
*desc
,
250 MPI_POINT point
, struct mpi_ec_ctx
*ec
,
259 ret
= mpi_ec_get_affine(x
, y
, point
, ec
) ? -EINVAL
:
260 sm2_z_digest_update(desc
, x
, pbytes
) ?:
261 sm2_z_digest_update(desc
, y
, pbytes
);
268 int sm2_compute_z_digest(struct shash_desc
*desc
,
269 const void *key
, unsigned int keylen
, void *dgst
)
271 struct mpi_ec_ctx
*ec
;
272 unsigned int bits_len
;
277 ec
= kmalloc(sizeof(*ec
), GFP_KERNEL
);
281 err
= sm2_ec_ctx_init(ec
);
285 err
= __sm2_set_pub_key(ec
, key
, keylen
);
289 bits_len
= SM2_DEFAULT_USERID_LEN
* 8;
290 entl
[0] = bits_len
>> 8;
291 entl
[1] = bits_len
& 0xff;
293 pbytes
= MPI_NBYTES(ec
->p
);
295 /* ZA = H256(ENTLA | IDA | a | b | xG | yG | xA | yA) */
296 err
= crypto_shash_init(desc
);
300 err
= crypto_shash_update(desc
, entl
, 2);
304 err
= crypto_shash_update(desc
, SM2_DEFAULT_USERID
,
305 SM2_DEFAULT_USERID_LEN
);
309 err
= sm2_z_digest_update(desc
, ec
->a
, pbytes
) ?:
310 sm2_z_digest_update(desc
, ec
->b
, pbytes
) ?:
311 sm2_z_digest_update_point(desc
, ec
->G
, ec
, pbytes
) ?:
312 sm2_z_digest_update_point(desc
, ec
->Q
, ec
, pbytes
);
316 err
= crypto_shash_final(desc
, dgst
);
319 sm2_ec_ctx_deinit(ec
);
324 EXPORT_SYMBOL_GPL(sm2_compute_z_digest
);
326 static int _sm2_verify(struct mpi_ec_ctx
*ec
, MPI hash
, MPI sig_r
, MPI sig_s
)
329 struct gcry_mpi_point sG
, tP
;
331 MPI x1
= NULL
, y1
= NULL
;
339 /* r, s in [1, n-1] */
340 if (mpi_cmp_ui(sig_r
, 1) < 0 || mpi_cmp(sig_r
, ec
->n
) > 0 ||
341 mpi_cmp_ui(sig_s
, 1) < 0 || mpi_cmp(sig_s
, ec
->n
) > 0) {
345 /* t = (r + s) % n, t == 0 */
346 mpi_addm(t
, sig_r
, sig_s
, ec
->n
);
347 if (mpi_cmp_ui(t
, 0) == 0)
350 /* sG + tP = (x1, y1) */
352 mpi_ec_mul_point(&sG
, sig_s
, ec
->G
, ec
);
353 mpi_ec_mul_point(&tP
, t
, ec
->Q
, ec
);
354 mpi_ec_add_points(&sG
, &sG
, &tP
, ec
);
355 if (mpi_ec_get_affine(x1
, y1
, &sG
, ec
))
358 /* R = (e + x1) % n */
359 mpi_addm(t
, hash
, x1
, ec
->n
);
363 if (mpi_cmp(t
, sig_r
))
369 mpi_point_free_parts(&sG
);
370 mpi_point_free_parts(&tP
);
378 static int sm2_verify(struct akcipher_request
*req
)
380 struct crypto_akcipher
*tfm
= crypto_akcipher_reqtfm(req
);
381 struct mpi_ec_ctx
*ec
= akcipher_tfm_ctx(tfm
);
382 unsigned char *buffer
;
383 struct sm2_signature_ctx sig
;
387 if (unlikely(!ec
->Q
))
390 buffer
= kmalloc(req
->src_len
+ req
->dst_len
, GFP_KERNEL
);
394 sg_pcopy_to_buffer(req
->src
,
395 sg_nents_for_len(req
->src
, req
->src_len
+ req
->dst_len
),
396 buffer
, req
->src_len
+ req
->dst_len
, 0);
400 ret
= asn1_ber_decoder(&sm2signature_decoder
, &sig
,
401 buffer
, req
->src_len
);
406 hash
= mpi_read_raw_data(buffer
+ req
->src_len
, req
->dst_len
);
410 ret
= _sm2_verify(ec
, hash
, sig
.sig_r
, sig
.sig_s
);
420 static int sm2_set_pub_key(struct crypto_akcipher
*tfm
,
421 const void *key
, unsigned int keylen
)
423 struct mpi_ec_ctx
*ec
= akcipher_tfm_ctx(tfm
);
425 return __sm2_set_pub_key(ec
, key
, keylen
);
429 static int __sm2_set_pub_key(struct mpi_ec_ctx
*ec
,
430 const void *key
, unsigned int keylen
)
435 /* include the uncompressed flag '0x04' */
436 a
= mpi_read_raw_data(key
, keylen
);
441 rc
= sm2_ecc_os2ec(ec
->Q
, a
);
447 static unsigned int sm2_max_size(struct crypto_akcipher
*tfm
)
449 /* Unlimited max size */
453 static int sm2_init_tfm(struct crypto_akcipher
*tfm
)
455 struct mpi_ec_ctx
*ec
= akcipher_tfm_ctx(tfm
);
457 return sm2_ec_ctx_init(ec
);
460 static void sm2_exit_tfm(struct crypto_akcipher
*tfm
)
462 struct mpi_ec_ctx
*ec
= akcipher_tfm_ctx(tfm
);
464 sm2_ec_ctx_deinit(ec
);
467 static struct akcipher_alg sm2
= {
468 .verify
= sm2_verify
,
469 .set_pub_key
= sm2_set_pub_key
,
470 .max_size
= sm2_max_size
,
471 .init
= sm2_init_tfm
,
472 .exit
= sm2_exit_tfm
,
475 .cra_driver_name
= "sm2-generic",
477 .cra_module
= THIS_MODULE
,
478 .cra_ctxsize
= sizeof(struct mpi_ec_ctx
),
482 static int __init
sm2_init(void)
484 return crypto_register_akcipher(&sm2
);
487 static void __exit
sm2_exit(void)
489 crypto_unregister_akcipher(&sm2
);
492 subsys_initcall(sm2_init
);
493 module_exit(sm2_exit
);
495 MODULE_LICENSE("GPL");
496 MODULE_AUTHOR("Tianjia Zhang <tianjia.zhang@linux.alibaba.com>");
497 MODULE_DESCRIPTION("SM2 generic algorithm");
498 MODULE_ALIAS_CRYPTO("sm2-generic");