[thirdparty/linux.git] / crypto / dh.c

/*  Diffie-Hellman Key Agreement Method [RFC2631]
 *
 * Copyright (c) 2016, Intel Corporation
 * Authors: Salvatore Benedetto <salvatore.benedetto@intel.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 */

#include <linux/module.h>
#include <crypto/internal/kpp.h>
#include <crypto/kpp.h>
#include <crypto/dh.h>
#include <linux/mpi.h>

struct dh_ctx {
	MPI p;	/* Value is guaranteed to be set. */
	MPI q;	/* Value is optional. */
	MPI g;	/* Value is guaranteed to be set. */
	MPI xa;	/* Value is guaranteed to be set. */
};

static void dh_clear_ctx(struct dh_ctx *ctx)
{
	mpi_free(ctx->p);
	mpi_free(ctx->q);
	mpi_free(ctx->g);
	mpi_free(ctx->xa);
	memset(ctx, 0, sizeof(*ctx));
}

/*
 * If base is g we compute the public key
 *	ya = g^xa mod p; [RFC2631 sec 2.1.1]
 * else if base if the counterpart public key we compute the shared secret
 *	ZZ = yb^xa mod p; [RFC2631 sec 2.1.1]
 */
static int _compute_val(const struct dh_ctx *ctx, MPI base, MPI val)
{
	/* val = base^xa mod p */
	return mpi_powm(val, base, ctx->xa, ctx->p);
}

static inline struct dh_ctx *dh_get_ctx(struct crypto_kpp *tfm)
{
	return kpp_tfm_ctx(tfm);
}

static int dh_check_params_length(unsigned int p_len)
{
	return (p_len < 1536) ? -EINVAL : 0;
}

static int dh_set_params(struct dh_ctx *ctx, struct dh *params)
{
	if (dh_check_params_length(params->p_size << 3))
		return -EINVAL;

	ctx->p = mpi_read_raw_data(params->p, params->p_size);
	if (!ctx->p)
		return -EINVAL;

	if (params->q && params->q_size) {
		ctx->q = mpi_read_raw_data(params->q, params->q_size);
		if (!ctx->q)
			return -EINVAL;
	}

	ctx->g = mpi_read_raw_data(params->g, params->g_size);
	if (!ctx->g)
		return -EINVAL;

	return 0;
}

static int dh_set_secret(struct crypto_kpp *tfm, const void *buf,
			 unsigned int len)
{
	struct dh_ctx *ctx = dh_get_ctx(tfm);
	struct dh params;

	/* Free the old MPI key if any */
	dh_clear_ctx(ctx);

	if (crypto_dh_decode_key(buf, len, &params) < 0)
		goto err_clear_ctx;

	if (dh_set_params(ctx, &params) < 0)
		goto err_clear_ctx;

	ctx->xa = mpi_read_raw_data(params.key, params.key_size);
	if (!ctx->xa)
		goto err_clear_ctx;

	return 0;

err_clear_ctx:
	dh_clear_ctx(ctx);
	return -EINVAL;
}

/*
 * SP800-56A public key verification:
 *
 * * If Q is provided as part of the domain paramenters, a full validation
 *   according to SP800-56A section 5.6.2.3.1 is performed.
 *
 * * If Q is not provided, a partial validation according to SP800-56A section
 *   5.6.2.3.2 is performed.
 */
static int dh_is_pubkey_valid(struct dh_ctx *ctx, MPI y)
{
	if (unlikely(!ctx->p))
		return -EINVAL;

	/*
	 * Step 1: Verify that 2 <= y <= p - 2.
	 *
	 * The upper limit check is actually y < p instead of y < p - 1
	 * as the mpi_sub_ui function is yet missing.
	 */
	if (mpi_cmp_ui(y, 1) < 1 || mpi_cmp(y, ctx->p) >= 0)
		return -EINVAL;

	/* Step 2: Verify that 1 = y^q mod p */
	if (ctx->q) {
		MPI val = mpi_alloc(0);
		int ret;

		if (!val)
			return -ENOMEM;

		ret = mpi_powm(val, y, ctx->q, ctx->p);

		if (ret) {
			mpi_free(val);
			return ret;
		}

		ret = mpi_cmp_ui(val, 1);

		mpi_free(val);

		if (ret != 0)
			return -EINVAL;
	}

	return 0;
}

static int dh_compute_value(struct kpp_request *req)
{
	struct crypto_kpp *tfm = crypto_kpp_reqtfm(req);
	struct dh_ctx *ctx = dh_get_ctx(tfm);
	MPI base, val = mpi_alloc(0);
	int ret = 0;
	int sign;

	if (!val)
		return -ENOMEM;

	if (unlikely(!ctx->xa)) {
		ret = -EINVAL;
		goto err_free_val;
	}

	if (req->src) {
		base = mpi_read_raw_from_sgl(req->src, req->src_len);
		if (!base) {
			ret = -EINVAL;
			goto err_free_val;
		}
		ret = dh_is_pubkey_valid(ctx, base);
		if (ret)
			goto err_free_base;
	} else {
		base = ctx->g;
	}

	ret = _compute_val(ctx, base, val);
	if (ret)
		goto err_free_base;

	ret = mpi_write_to_sgl(val, req->dst, req->dst_len, &sign);
	if (ret)
		goto err_free_base;

	if (sign < 0)
		ret = -EBADMSG;
err_free_base:
	if (req->src)
		mpi_free(base);
err_free_val:
	mpi_free(val);
	return ret;
}

static unsigned int dh_max_size(struct crypto_kpp *tfm)
{
	struct dh_ctx *ctx = dh_get_ctx(tfm);

	return mpi_get_size(ctx->p);
}

static void dh_exit_tfm(struct crypto_kpp *tfm)
{
	struct dh_ctx *ctx = dh_get_ctx(tfm);

	dh_clear_ctx(ctx);
}

static struct kpp_alg dh = {
	.set_secret = dh_set_secret,
	.generate_public_key = dh_compute_value,
	.compute_shared_secret = dh_compute_value,
	.max_size = dh_max_size,
	.exit = dh_exit_tfm,
	.base = {
		.cra_name = "dh",
		.cra_driver_name = "dh-generic",
		.cra_priority = 100,
		.cra_module = THIS_MODULE,
		.cra_ctxsize = sizeof(struct dh_ctx),
	},
};

static int dh_init(void)
{
	return crypto_register_kpp(&dh);
}

static void dh_exit(void)
{
	crypto_unregister_kpp(&dh);
}

subsys_initcall(dh_init);
module_exit(dh_exit);
MODULE_ALIAS_CRYPTO("dh");
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("DH generic algorithm");
Commit	Line	Data
802c7f1c SB	1	/* Diffie-Hellman Key Agreement Method [RFC2631]
	2	*
	3	* Copyright (c) 2016, Intel Corporation
	4	* Authors: Salvatore Benedetto <salvatore.benedetto@intel.com>
	5	*
	6	* This program is free software; you can redistribute it and/or
c0ca1215	7	* modify it under the terms of the GNU General Public License
802c7f1c	8	* as published by the Free Software Foundation; either version
c0ca1215	9	* 2 of the License, or (at your option) any later version.
802c7f1c SB	10	*/
	11
	12	#include <linux/module.h>
	13	#include <crypto/internal/kpp.h>
	14	#include <crypto/kpp.h>
	15	#include <crypto/dh.h>
	16	#include <linux/mpi.h>
	17
	18	struct dh_ctx {
e3fe0ae1 SM	19	MPI p; /* Value is guaranteed to be set. */
	20	MPI q; /* Value is optional. */
	21	MPI g; /* Value is guaranteed to be set. */
	22	MPI xa; /* Value is guaranteed to be set. */
802c7f1c SB	23	};
802c7f1c SB	24
12d41a02	25	static void dh_clear_ctx(struct dh_ctx *ctx)
802c7f1c SB	26	{
802c7f1c SB	27	mpi_free(ctx->p);
e3fe0ae1	28	mpi_free(ctx->q);
802c7f1c	29	mpi_free(ctx->g);
802c7f1c	30	mpi_free(ctx->xa);
12d41a02	31	memset(ctx, 0, sizeof(*ctx));
802c7f1c SB	32	}
	33
	34	/*
	35	* If base is g we compute the public key
	36	* ya = g^xa mod p; [RFC2631 sec 2.1.1]
	37	* else if base if the counterpart public key we compute the shared secret
	38	* ZZ = yb^xa mod p; [RFC2631 sec 2.1.1]
	39	*/
	40	static int _compute_val(const struct dh_ctx *ctx, MPI base, MPI val)
	41	{
	42	/* val = base^xa mod p */
	43	return mpi_powm(val, base, ctx->xa, ctx->p);
	44	}
	45
	46	static inline struct dh_ctx dh_get_ctx(struct crypto_kpp tfm)
	47	{
	48	return kpp_tfm_ctx(tfm);
	49	}
	50
	51	static int dh_check_params_length(unsigned int p_len)
	52	{
	53	return (p_len < 1536) ? -EINVAL : 0;
	54	}
	55
	56	static int dh_set_params(struct dh_ctx ctx, struct dh params)
	57	{
802c7f1c SB	58	if (dh_check_params_length(params->p_size << 3))
	59	return -EINVAL;
	60
	61	ctx->p = mpi_read_raw_data(params->p, params->p_size);
	62	if (!ctx->p)
	63	return -EINVAL;
	64
e3fe0ae1 SM	65	if (params->q && params->q_size) {
	66	ctx->q = mpi_read_raw_data(params->q, params->q_size);
	67	if (!ctx->q)
	68	return -EINVAL;
	69	}
	70
802c7f1c	71	ctx->g = mpi_read_raw_data(params->g, params->g_size);
12d41a02	72	if (!ctx->g)
802c7f1c	73	return -EINVAL;
802c7f1c SB	74
	75	return 0;
	76	}
	77
5527dfb6 EB	78	static int dh_set_secret(struct crypto_kpp tfm, const void buf,
5527dfb6 EB	79	unsigned int len)
802c7f1c SB	80	{
	81	struct dh_ctx *ctx = dh_get_ctx(tfm);
	82	struct dh params;
	83
ee34e264	84	/* Free the old MPI key if any */
12d41a02	85	dh_clear_ctx(ctx);
ee34e264	86
802c7f1c	87	if (crypto_dh_decode_key(buf, len, &params) < 0)
12d41a02	88	goto err_clear_ctx;
802c7f1c SB	89
802c7f1c SB	90	if (dh_set_params(ctx, &params) < 0)
12d41a02	91	goto err_clear_ctx;
802c7f1c SB	92
802c7f1c SB	93	ctx->xa = mpi_read_raw_data(params.key, params.key_size);
12d41a02 EB	94	if (!ctx->xa)
12d41a02 EB	95	goto err_clear_ctx;
802c7f1c SB	96
802c7f1c SB	97	return 0;
12d41a02 EB	98
	99	err_clear_ctx:
	100	dh_clear_ctx(ctx);
	101	return -EINVAL;
802c7f1c SB	102	}
802c7f1c SB	103
e3fe0ae1 SM	104	/*
	105	* SP800-56A public key verification:
	106	*
	107	* * If Q is provided as part of the domain paramenters, a full validation
	108	* according to SP800-56A section 5.6.2.3.1 is performed.
	109	*
	110	* * If Q is not provided, a partial validation according to SP800-56A section
	111	* 5.6.2.3.2 is performed.
	112	*/
	113	static int dh_is_pubkey_valid(struct dh_ctx *ctx, MPI y)
	114	{
	115	if (unlikely(!ctx->p))
	116	return -EINVAL;
	117
	118	/*
	119	* Step 1: Verify that 2 <= y <= p - 2.
	120	*
	121	* The upper limit check is actually y < p instead of y < p - 1
	122	* as the mpi_sub_ui function is yet missing.
	123	*/
	124	if (mpi_cmp_ui(y, 1) < 1 \|\| mpi_cmp(y, ctx->p) >= 0)
	125	return -EINVAL;
	126
	127	/* Step 2: Verify that 1 = y^q mod p */
	128	if (ctx->q) {
	129	MPI val = mpi_alloc(0);
	130	int ret;
	131
	132	if (!val)
	133	return -ENOMEM;
	134
	135	ret = mpi_powm(val, y, ctx->q, ctx->p);
	136
	137	if (ret) {
	138	mpi_free(val);
	139	return ret;
	140	}
	141
	142	ret = mpi_cmp_ui(val, 1);
	143
	144	mpi_free(val);
	145
	146	if (ret != 0)
	147	return -EINVAL;
	148	}
	149
	150	return 0;
	151	}
	152
802c7f1c SB	153	static int dh_compute_value(struct kpp_request *req)
	154	{
	155	struct crypto_kpp *tfm = crypto_kpp_reqtfm(req);
	156	struct dh_ctx *ctx = dh_get_ctx(tfm);
	157	MPI base, val = mpi_alloc(0);
	158	int ret = 0;
	159	int sign;
	160
	161	if (!val)
	162	return -ENOMEM;
	163
	164	if (unlikely(!ctx->xa)) {
	165	ret = -EINVAL;
	166	goto err_free_val;
	167	}
	168
	169	if (req->src) {
	170	base = mpi_read_raw_from_sgl(req->src, req->src_len);
	171	if (!base) {
8edda7d2	172	ret = -EINVAL;
802c7f1c SB	173	goto err_free_val;
802c7f1c SB	174	}
e3fe0ae1 SM	175	ret = dh_is_pubkey_valid(ctx, base);
e3fe0ae1 SM	176	if (ret)
3fd8093b	177	goto err_free_base;
802c7f1c SB	178	} else {
	179	base = ctx->g;
	180	}
	181
	182	ret = _compute_val(ctx, base, val);
	183	if (ret)
	184	goto err_free_base;
	185
9b45b7bb	186	ret = mpi_write_to_sgl(val, req->dst, req->dst_len, &sign);
802c7f1c SB	187	if (ret)
	188	goto err_free_base;
	189
	190	if (sign < 0)
	191	ret = -EBADMSG;
	192	err_free_base:
	193	if (req->src)
	194	mpi_free(base);
	195	err_free_val:
	196	mpi_free(val);
	197	return ret;
	198	}
	199
7f691050	200	static unsigned int dh_max_size(struct crypto_kpp *tfm)
802c7f1c SB	201	{
	202	struct dh_ctx *ctx = dh_get_ctx(tfm);
	203
	204	return mpi_get_size(ctx->p);
	205	}
	206
	207	static void dh_exit_tfm(struct crypto_kpp *tfm)
	208	{
	209	struct dh_ctx *ctx = dh_get_ctx(tfm);
	210
12d41a02	211	dh_clear_ctx(ctx);
802c7f1c SB	212	}
	213
	214	static struct kpp_alg dh = {
	215	.set_secret = dh_set_secret,
	216	.generate_public_key = dh_compute_value,
	217	.compute_shared_secret = dh_compute_value,
	218	.max_size = dh_max_size,
	219	.exit = dh_exit_tfm,
	220	.base = {
	221	.cra_name = "dh",
	222	.cra_driver_name = "dh-generic",
	223	.cra_priority = 100,
	224	.cra_module = THIS_MODULE,
	225	.cra_ctxsize = sizeof(struct dh_ctx),
	226	},
	227	};
	228
	229	static int dh_init(void)
	230	{
	231	return crypto_register_kpp(&dh);
	232	}
	233
	234	static void dh_exit(void)
	235	{
	236	crypto_unregister_kpp(&dh);
	237	}
	238
c4741b23	239	subsys_initcall(dh_init);
802c7f1c SB	240	module_exit(dh_exit);
	241	MODULE_ALIAS_CRYPTO("dh");
	242	MODULE_LICENSE("GPL");
	243	MODULE_DESCRIPTION("DH generic algorithm");