]>
Commit | Line | Data |
---|---|---|
1461e667 | 1 | /* |
33388b44 | 2 | * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. |
1461e667 PS |
3 | * |
4 | * Licensed under the Apache License 2.0 (the "License"). You may not use | |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
8 | */ | |
9 | ||
23ccae80 BB |
10 | /* |
11 | * EC_METHOD low level APIs are deprecated for public use, but still ok for | |
12 | * internal use. | |
13 | */ | |
14 | #include "internal/deprecated.h" | |
15 | ||
1461e667 PS |
16 | #include <stdlib.h> |
17 | #include <string.h> | |
18 | #include <openssl/err.h> | |
58c35587 | 19 | #include <openssl/rand.h> |
706457b7 | 20 | #include "ec_local.h" |
1461e667 PS |
21 | #include "s390x_arch.h" |
22 | ||
23 | /* Size of parameter blocks */ | |
24 | #define S390X_SIZE_PARAM 4096 | |
25 | ||
26 | /* Size of fields in parameter blocks */ | |
27 | #define S390X_SIZE_P256 32 | |
28 | #define S390X_SIZE_P384 48 | |
29 | #define S390X_SIZE_P521 80 | |
30 | ||
31 | /* Offsets of fields in PCC parameter blocks */ | |
32 | #define S390X_OFF_RES_X(n) (0 * n) | |
33 | #define S390X_OFF_RES_Y(n) (1 * n) | |
34 | #define S390X_OFF_SRC_X(n) (2 * n) | |
35 | #define S390X_OFF_SRC_Y(n) (3 * n) | |
36 | #define S390X_OFF_SCALAR(n) (4 * n) | |
37 | ||
58c35587 PS |
38 | /* Offsets of fields in KDSA parameter blocks */ |
39 | #define S390X_OFF_R(n) (0 * n) | |
40 | #define S390X_OFF_S(n) (1 * n) | |
41 | #define S390X_OFF_H(n) (2 * n) | |
42 | #define S390X_OFF_K(n) (3 * n) | |
43 | #define S390X_OFF_X(n) (3 * n) | |
44 | #define S390X_OFF_RN(n) (4 * n) | |
45 | #define S390X_OFF_Y(n) (4 * n) | |
46 | ||
1461e667 PS |
47 | static int ec_GFp_s390x_nistp_mul(const EC_GROUP *group, EC_POINT *r, |
48 | const BIGNUM *scalar, | |
49 | size_t num, const EC_POINT *points[], | |
50 | const BIGNUM *scalars[], | |
51 | BN_CTX *ctx, unsigned int fc, int len) | |
52 | { | |
53 | unsigned char param[S390X_SIZE_PARAM]; | |
54 | BIGNUM *x, *y; | |
55 | const EC_POINT *point_ptr = NULL; | |
56 | const BIGNUM *scalar_ptr = NULL; | |
57 | BN_CTX *new_ctx = NULL; | |
58 | int rc = -1; | |
59 | ||
60 | if (ctx == NULL) { | |
61 | ctx = new_ctx = BN_CTX_new_ex(group->libctx); | |
62 | if (ctx == NULL) | |
63 | return 0; | |
64 | } | |
65 | ||
66 | BN_CTX_start(ctx); | |
67 | ||
68 | x = BN_CTX_get(ctx); | |
69 | y = BN_CTX_get(ctx); | |
70 | if (x == NULL || y == NULL) { | |
71 | rc = 0; | |
72 | goto ret; | |
73 | } | |
74 | ||
75 | /* | |
76 | * Use PCC for EC keygen and ECDH key derivation: | |
77 | * scalar * generator and scalar * peer public key, | |
78 | * scalar in [0,order). | |
79 | */ | |
80 | if ((scalar != NULL && num == 0 && BN_is_negative(scalar) == 0) | |
81 | || (scalar == NULL && num == 1 && BN_is_negative(scalars[0]) == 0)) { | |
82 | ||
83 | if (num == 0) { | |
84 | point_ptr = EC_GROUP_get0_generator(group); | |
85 | scalar_ptr = scalar; | |
86 | } else { | |
87 | point_ptr = points[0]; | |
88 | scalar_ptr = scalars[0]; | |
89 | } | |
90 | ||
91 | if (EC_POINT_is_at_infinity(group, point_ptr) == 1 | |
92 | || BN_is_zero(scalar_ptr)) { | |
93 | rc = EC_POINT_set_to_infinity(group, r); | |
94 | goto ret; | |
95 | } | |
96 | ||
97 | memset(¶m, 0, sizeof(param)); | |
98 | ||
99 | if (group->meth->point_get_affine_coordinates(group, point_ptr, | |
100 | x, y, ctx) != 1 | |
101 | || BN_bn2binpad(x, param + S390X_OFF_SRC_X(len), len) == -1 | |
102 | || BN_bn2binpad(y, param + S390X_OFF_SRC_Y(len), len) == -1 | |
103 | || BN_bn2binpad(scalar_ptr, | |
104 | param + S390X_OFF_SCALAR(len), len) == -1 | |
105 | || s390x_pcc(fc, param) != 0 | |
106 | || BN_bin2bn(param + S390X_OFF_RES_X(len), len, x) == NULL | |
107 | || BN_bin2bn(param + S390X_OFF_RES_Y(len), len, y) == NULL | |
108 | || group->meth->point_set_affine_coordinates(group, r, | |
109 | x, y, ctx) != 1) | |
110 | goto ret; | |
111 | ||
112 | rc = 1; | |
113 | } | |
114 | ||
115 | ret: | |
116 | /* Otherwise use default. */ | |
117 | if (rc == -1) | |
118 | rc = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx); | |
2281be2e | 119 | OPENSSL_cleanse(param + S390X_OFF_SCALAR(len), len); |
1461e667 PS |
120 | BN_CTX_end(ctx); |
121 | BN_CTX_free(new_ctx); | |
122 | return rc; | |
123 | } | |
124 | ||
58c35587 PS |
125 | static ECDSA_SIG *ecdsa_s390x_nistp_sign_sig(const unsigned char *dgst, |
126 | int dgstlen, | |
127 | const BIGNUM *kinv, | |
128 | const BIGNUM *r, | |
129 | EC_KEY *eckey, | |
130 | unsigned int fc, int len) | |
131 | { | |
132 | unsigned char param[S390X_SIZE_PARAM]; | |
133 | int ok = 0; | |
134 | BIGNUM *k; | |
135 | ECDSA_SIG *sig; | |
136 | const EC_GROUP *group; | |
137 | const BIGNUM *privkey; | |
138 | int off; | |
139 | ||
140 | group = EC_KEY_get0_group(eckey); | |
141 | privkey = EC_KEY_get0_private_key(eckey); | |
142 | if (group == NULL || privkey == NULL) { | |
143 | ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, EC_R_MISSING_PARAMETERS); | |
144 | return NULL; | |
145 | } | |
146 | ||
147 | if (!EC_KEY_can_sign(eckey)) { | |
148 | ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, | |
149 | EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING); | |
150 | return NULL; | |
151 | } | |
152 | ||
153 | k = BN_secure_new(); | |
154 | sig = ECDSA_SIG_new(); | |
155 | if (k == NULL || sig == NULL) { | |
156 | ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_MALLOC_FAILURE); | |
157 | goto ret; | |
158 | } | |
159 | ||
160 | sig->r = BN_new(); | |
161 | sig->s = BN_new(); | |
162 | if (sig->r == NULL || sig->s == NULL) { | |
163 | ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_MALLOC_FAILURE); | |
164 | goto ret; | |
165 | } | |
166 | ||
167 | memset(param, 0, sizeof(param)); | |
168 | off = len - (dgstlen > len ? len : dgstlen); | |
169 | memcpy(param + S390X_OFF_H(len) + off, dgst, len - off); | |
170 | ||
171 | if (BN_bn2binpad(privkey, param + S390X_OFF_K(len), len) == -1) { | |
172 | ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_BN_LIB); | |
173 | goto ret; | |
174 | } | |
175 | ||
176 | if (r == NULL || kinv == NULL) { | |
177 | /* | |
47c239c6 | 178 | * Generate random k and copy to param param block. RAND_priv_bytes_ex |
58c35587 PS |
179 | * is used instead of BN_priv_rand_range or BN_generate_dsa_nonce |
180 | * because kdsa instruction constructs an in-range, invertible nonce | |
181 | * internally implementing counter-measures for RNG weakness. | |
182 | */ | |
47c239c6 SL |
183 | if (RAND_priv_bytes_ex(eckey->libctx, param + S390X_OFF_RN(len), |
184 | len) != 1) { | |
58c35587 PS |
185 | ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, |
186 | EC_R_RANDOM_NUMBER_GENERATION_FAILED); | |
187 | goto ret; | |
188 | } | |
189 | } else { | |
190 | /* Reconstruct k = (k^-1)^-1. */ | |
191 | if (ec_group_do_inverse_ord(group, k, kinv, NULL) == 0 | |
192 | || BN_bn2binpad(k, param + S390X_OFF_RN(len), len) == -1) { | |
193 | ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_BN_LIB); | |
194 | goto ret; | |
195 | } | |
196 | /* Turns KDSA internal nonce-generation off. */ | |
197 | fc |= S390X_KDSA_D; | |
198 | } | |
199 | ||
200 | if (s390x_kdsa(fc, param, NULL, 0) != 0) { | |
201 | ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_ECDSA_LIB); | |
202 | goto ret; | |
203 | } | |
204 | ||
205 | if (BN_bin2bn(param + S390X_OFF_R(len), len, sig->r) == NULL | |
206 | || BN_bin2bn(param + S390X_OFF_S(len), len, sig->s) == NULL) { | |
207 | ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_BN_LIB); | |
208 | goto ret; | |
209 | } | |
210 | ||
211 | ok = 1; | |
212 | ret: | |
2281be2e | 213 | OPENSSL_cleanse(param + S390X_OFF_K(len), 2 * len); |
58c35587 PS |
214 | if (ok != 1) { |
215 | ECDSA_SIG_free(sig); | |
216 | sig = NULL; | |
217 | } | |
218 | BN_clear_free(k); | |
219 | return sig; | |
220 | } | |
221 | ||
222 | static int ecdsa_s390x_nistp_verify_sig(const unsigned char *dgst, int dgstlen, | |
223 | const ECDSA_SIG *sig, EC_KEY *eckey, | |
224 | unsigned int fc, int len) | |
225 | { | |
226 | unsigned char param[S390X_SIZE_PARAM]; | |
227 | int rc = -1; | |
228 | BN_CTX *ctx; | |
229 | BIGNUM *x, *y; | |
230 | const EC_GROUP *group; | |
231 | const EC_POINT *pubkey; | |
232 | int off; | |
233 | ||
234 | group = EC_KEY_get0_group(eckey); | |
235 | pubkey = EC_KEY_get0_public_key(eckey); | |
236 | if (eckey == NULL || group == NULL || pubkey == NULL || sig == NULL) { | |
237 | ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, EC_R_MISSING_PARAMETERS); | |
238 | return -1; | |
239 | } | |
240 | ||
241 | if (!EC_KEY_can_sign(eckey)) { | |
242 | ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, | |
243 | EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING); | |
244 | return -1; | |
245 | } | |
246 | ||
247 | ctx = BN_CTX_new_ex(group->libctx); | |
248 | if (ctx == NULL) { | |
249 | ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, ERR_R_MALLOC_FAILURE); | |
250 | return -1; | |
251 | } | |
252 | ||
253 | BN_CTX_start(ctx); | |
254 | ||
255 | x = BN_CTX_get(ctx); | |
256 | y = BN_CTX_get(ctx); | |
257 | if (x == NULL || y == NULL) { | |
258 | ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, ERR_R_MALLOC_FAILURE); | |
259 | goto ret; | |
260 | } | |
261 | ||
262 | memset(param, 0, sizeof(param)); | |
263 | off = len - (dgstlen > len ? len : dgstlen); | |
264 | memcpy(param + S390X_OFF_H(len) + off, dgst, len - off); | |
265 | ||
266 | if (group->meth->point_get_affine_coordinates(group, pubkey, | |
267 | x, y, ctx) != 1 | |
268 | || BN_bn2binpad(sig->r, param + S390X_OFF_R(len), len) == -1 | |
269 | || BN_bn2binpad(sig->s, param + S390X_OFF_S(len), len) == -1 | |
270 | || BN_bn2binpad(x, param + S390X_OFF_X(len), len) == -1 | |
271 | || BN_bn2binpad(y, param + S390X_OFF_Y(len), len) == -1) { | |
272 | ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, ERR_R_BN_LIB); | |
273 | goto ret; | |
274 | } | |
275 | ||
276 | rc = s390x_kdsa(fc, param, NULL, 0) == 0 ? 1 : 0; | |
277 | ret: | |
278 | BN_CTX_end(ctx); | |
279 | BN_CTX_free(ctx); | |
280 | return rc; | |
281 | } | |
282 | ||
1461e667 PS |
283 | #define EC_GFP_S390X_NISTP_METHOD(bits) \ |
284 | \ | |
285 | static int ec_GFp_s390x_nistp##bits##_mul(const EC_GROUP *group, \ | |
286 | EC_POINT *r, \ | |
287 | const BIGNUM *scalar, \ | |
288 | size_t num, \ | |
289 | const EC_POINT *points[], \ | |
290 | const BIGNUM *scalars[], \ | |
291 | BN_CTX *ctx) \ | |
292 | { \ | |
293 | return ec_GFp_s390x_nistp_mul(group, r, scalar, num, points, \ | |
294 | scalars, ctx, \ | |
295 | S390X_SCALAR_MULTIPLY_P##bits, \ | |
296 | S390X_SIZE_P##bits); \ | |
297 | } \ | |
298 | \ | |
58c35587 PS |
299 | static ECDSA_SIG *ecdsa_s390x_nistp##bits##_sign_sig(const unsigned \ |
300 | char *dgst, \ | |
301 | int dgstlen, \ | |
302 | const BIGNUM *kinv,\ | |
303 | const BIGNUM *r, \ | |
304 | EC_KEY *eckey) \ | |
305 | { \ | |
306 | return ecdsa_s390x_nistp_sign_sig(dgst, dgstlen, kinv, r, eckey, \ | |
307 | S390X_ECDSA_SIGN_P##bits, \ | |
308 | S390X_SIZE_P##bits); \ | |
309 | } \ | |
310 | \ | |
311 | static int ecdsa_s390x_nistp##bits##_verify_sig(const \ | |
312 | unsigned char *dgst, \ | |
313 | int dgstlen, \ | |
314 | const ECDSA_SIG *sig, \ | |
315 | EC_KEY *eckey) \ | |
316 | { \ | |
317 | return ecdsa_s390x_nistp_verify_sig(dgst, dgstlen, sig, eckey, \ | |
318 | S390X_ECDSA_VERIFY_P##bits, \ | |
319 | S390X_SIZE_P##bits); \ | |
320 | } \ | |
321 | \ | |
1461e667 PS |
322 | const EC_METHOD *EC_GFp_s390x_nistp##bits##_method(void) \ |
323 | { \ | |
324 | static const EC_METHOD EC_GFp_s390x_nistp##bits##_meth = { \ | |
325 | EC_FLAGS_DEFAULT_OCT, \ | |
326 | NID_X9_62_prime_field, \ | |
327 | ec_GFp_simple_group_init, \ | |
328 | ec_GFp_simple_group_finish, \ | |
329 | ec_GFp_simple_group_clear_finish, \ | |
330 | ec_GFp_simple_group_copy, \ | |
331 | ec_GFp_simple_group_set_curve, \ | |
332 | ec_GFp_simple_group_get_curve, \ | |
333 | ec_GFp_simple_group_get_degree, \ | |
334 | ec_group_simple_order_bits, \ | |
335 | ec_GFp_simple_group_check_discriminant, \ | |
336 | ec_GFp_simple_point_init, \ | |
337 | ec_GFp_simple_point_finish, \ | |
338 | ec_GFp_simple_point_clear_finish, \ | |
339 | ec_GFp_simple_point_copy, \ | |
340 | ec_GFp_simple_point_set_to_infinity, \ | |
1461e667 PS |
341 | ec_GFp_simple_point_set_affine_coordinates, \ |
342 | ec_GFp_simple_point_get_affine_coordinates, \ | |
343 | NULL, /* point_set_compressed_coordinates */ \ | |
344 | NULL, /* point2oct */ \ | |
345 | NULL, /* oct2point */ \ | |
346 | ec_GFp_simple_add, \ | |
347 | ec_GFp_simple_dbl, \ | |
348 | ec_GFp_simple_invert, \ | |
349 | ec_GFp_simple_is_at_infinity, \ | |
350 | ec_GFp_simple_is_on_curve, \ | |
351 | ec_GFp_simple_cmp, \ | |
352 | ec_GFp_simple_make_affine, \ | |
353 | ec_GFp_simple_points_make_affine, \ | |
354 | ec_GFp_s390x_nistp##bits##_mul, \ | |
355 | NULL, /* precompute_mult */ \ | |
356 | NULL, /* have_precompute_mult */ \ | |
357 | ec_GFp_simple_field_mul, \ | |
358 | ec_GFp_simple_field_sqr, \ | |
359 | NULL, /* field_div */ \ | |
360 | ec_GFp_simple_field_inv, \ | |
361 | NULL, /* field_encode */ \ | |
362 | NULL, /* field_decode */ \ | |
363 | NULL, /* field_set_to_one */ \ | |
364 | ec_key_simple_priv2oct, \ | |
365 | ec_key_simple_oct2priv, \ | |
366 | NULL, /* set_private */ \ | |
367 | ec_key_simple_generate_key, \ | |
368 | ec_key_simple_check_key, \ | |
369 | ec_key_simple_generate_public_key, \ | |
370 | NULL, /* keycopy */ \ | |
371 | NULL, /* keyfinish */ \ | |
372 | ecdh_simple_compute_key, \ | |
9bf682f6 | 373 | ecdsa_simple_sign_setup, \ |
58c35587 PS |
374 | ecdsa_s390x_nistp##bits##_sign_sig, \ |
375 | ecdsa_s390x_nistp##bits##_verify_sig, \ | |
1461e667 PS |
376 | NULL, /* field_inverse_mod_ord */ \ |
377 | ec_GFp_simple_blind_coordinates, \ | |
378 | ec_GFp_simple_ladder_pre, \ | |
379 | ec_GFp_simple_ladder_step, \ | |
380 | ec_GFp_simple_ladder_post \ | |
381 | }; \ | |
382 | static const EC_METHOD *ret; \ | |
383 | \ | |
58c35587 PS |
384 | if ((OPENSSL_s390xcap_P.pcc[1] \ |
385 | & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P##bits)) \ | |
386 | && (OPENSSL_s390xcap_P.kdsa[0] \ | |
387 | & S390X_CAPBIT(S390X_ECDSA_VERIFY_P##bits)) \ | |
388 | && (OPENSSL_s390xcap_P.kdsa[0] \ | |
389 | & S390X_CAPBIT(S390X_ECDSA_SIGN_P##bits))) \ | |
1461e667 PS |
390 | ret = &EC_GFp_s390x_nistp##bits##_meth; \ |
391 | else \ | |
392 | ret = EC_GFp_mont_method(); \ | |
393 | \ | |
394 | return ret; \ | |
395 | } | |
396 | ||
397 | EC_GFP_S390X_NISTP_METHOD(256) | |
398 | EC_GFP_S390X_NISTP_METHOD(384) | |
399 | EC_GFP_S390X_NISTP_METHOD(521) |