1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Copyright (c) 2021 IBM Corporation
4 */
5
6 #include <linux/module.h>
7 #include <crypto/internal/akcipher.h>
8 #include <crypto/internal/ecc.h>
9 #include <crypto/akcipher.h>
10 #include <crypto/ecdh.h>
11 #include <linux/asn1_decoder.h>
12 #include <linux/scatterlist.h>
13
14 #include "ecdsasignature.asn1.h"
15
16 struct ecc_ctx {
17 unsigned int curve_id;
18 const struct ecc_curve *curve;
19
20 bool pub_key_set;
21 u64 x[ECC_MAX_DIGITS]; /* pub key x and y coordinates */
22 u64 y[ECC_MAX_DIGITS];
23 struct ecc_point pub_key;
24 };
25
26 struct ecdsa_signature_ctx {
27 const struct ecc_curve *curve;
28 u64 r[ECC_MAX_DIGITS];
29 u64 s[ECC_MAX_DIGITS];
30 };
31
32 /*
33 * Get the r and s components of a signature from the X509 certificate.
34 */
ecdsa_get_signature_rs(u64 * dest,size_t hdrlen,unsigned char tag,const void * value,size_t vlen,unsigned int ndigits)35 static int ecdsa_get_signature_rs(u64 *dest, size_t hdrlen, unsigned char tag,
36 const void *value, size_t vlen, unsigned int ndigits)
37 {
38 size_t bufsize = ndigits * sizeof(u64);
39 const char *d = value;
40
41 if (!value || !vlen || vlen > bufsize + 1)
42 return -EINVAL;
43
44 /*
45 * vlen may be 1 byte larger than bufsize due to a leading zero byte
46 * (necessary if the most significant bit of the integer is set).
47 */
48 if (vlen > bufsize) {
49 /* skip over leading zeros that make 'value' a positive int */
50 if (*d == 0) {
51 vlen -= 1;
52 d++;
53 } else {
54 return -EINVAL;
55 }
56 }
57
58 ecc_digits_from_bytes(d, vlen, dest, ndigits);
59
60 return 0;
61 }
62
ecdsa_get_signature_r(void * context,size_t hdrlen,unsigned char tag,const void * value,size_t vlen)63 int ecdsa_get_signature_r(void *context, size_t hdrlen, unsigned char tag,
64 const void *value, size_t vlen)
65 {
66 struct ecdsa_signature_ctx *sig = context;
67
68 return ecdsa_get_signature_rs(sig->r, hdrlen, tag, value, vlen,
69 sig->curve->g.ndigits);
70 }
71
ecdsa_get_signature_s(void * context,size_t hdrlen,unsigned char tag,const void * value,size_t vlen)72 int ecdsa_get_signature_s(void *context, size_t hdrlen, unsigned char tag,
73 const void *value, size_t vlen)
74 {
75 struct ecdsa_signature_ctx *sig = context;
76
77 return ecdsa_get_signature_rs(sig->s, hdrlen, tag, value, vlen,
78 sig->curve->g.ndigits);
79 }
80
_ecdsa_verify(struct ecc_ctx * ctx,const u64 * hash,const u64 * r,const u64 * s)81 static int _ecdsa_verify(struct ecc_ctx *ctx, const u64 *hash, const u64 *r, const u64 *s)
82 {
83 const struct ecc_curve *curve = ctx->curve;
84 unsigned int ndigits = curve->g.ndigits;
85 u64 s1[ECC_MAX_DIGITS];
86 u64 u1[ECC_MAX_DIGITS];
87 u64 u2[ECC_MAX_DIGITS];
88 u64 x1[ECC_MAX_DIGITS];
89 u64 y1[ECC_MAX_DIGITS];
90 struct ecc_point res = ECC_POINT_INIT(x1, y1, ndigits);
91
92 /* 0 < r < n and 0 < s < n */
93 if (vli_is_zero(r, ndigits) || vli_cmp(r, curve->n, ndigits) >= 0 ||
94 vli_is_zero(s, ndigits) || vli_cmp(s, curve->n, ndigits) >= 0)
95 return -EBADMSG;
96
97 /* hash is given */
98 pr_devel("hash : %016llx %016llx ... %016llx\n",
99 hash[ndigits - 1], hash[ndigits - 2], hash[0]);
100
101 /* s1 = (s^-1) mod n */
102 vli_mod_inv(s1, s, curve->n, ndigits);
103 /* u1 = (hash * s1) mod n */
104 vli_mod_mult_slow(u1, hash, s1, curve->n, ndigits);
105 /* u2 = (r * s1) mod n */
106 vli_mod_mult_slow(u2, r, s1, curve->n, ndigits);
107 /* res = u1*G + u2 * pub_key */
108 ecc_point_mult_shamir(&res, u1, &curve->g, u2, &ctx->pub_key, curve);
109
110 /* res.x = res.x mod n (if res.x > order) */
111 if (unlikely(vli_cmp(res.x, curve->n, ndigits) == 1))
112 /* faster alternative for NIST p521, p384, p256 & p192 */
113 vli_sub(res.x, res.x, curve->n, ndigits);
114
115 if (!vli_cmp(res.x, r, ndigits))
116 return 0;
117
118 return -EKEYREJECTED;
119 }
120
121 /*
122 * Verify an ECDSA signature.
123 */
ecdsa_verify(struct akcipher_request * req)124 static int ecdsa_verify(struct akcipher_request *req)
125 {
126 struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
127 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);
128 size_t bufsize = ctx->curve->g.ndigits * sizeof(u64);
129 struct ecdsa_signature_ctx sig_ctx = {
130 .curve = ctx->curve,
131 };
132 u64 hash[ECC_MAX_DIGITS];
133 unsigned char *buffer;
134 int ret;
135
136 if (unlikely(!ctx->pub_key_set))
137 return -EINVAL;
138
139 buffer = kmalloc(req->src_len + req->dst_len, GFP_KERNEL);
140 if (!buffer)
141 return -ENOMEM;
142
143 sg_pcopy_to_buffer(req->src,
144 sg_nents_for_len(req->src, req->src_len + req->dst_len),
145 buffer, req->src_len + req->dst_len, 0);
146
147 ret = asn1_ber_decoder(&ecdsasignature_decoder, &sig_ctx,
148 buffer, req->src_len);
149 if (ret < 0)
150 goto error;
151
152 if (bufsize > req->dst_len)
153 bufsize = req->dst_len;
154
155 ecc_digits_from_bytes(buffer + req->src_len, bufsize,
156 hash, ctx->curve->g.ndigits);
157
158 ret = _ecdsa_verify(ctx, hash, sig_ctx.r, sig_ctx.s);
159
160 error:
161 kfree(buffer);
162
163 return ret;
164 }
165
ecdsa_ecc_ctx_init(struct ecc_ctx * ctx,unsigned int curve_id)166 static int ecdsa_ecc_ctx_init(struct ecc_ctx *ctx, unsigned int curve_id)
167 {
168 ctx->curve_id = curve_id;
169 ctx->curve = ecc_get_curve(curve_id);
170 if (!ctx->curve)
171 return -EINVAL;
172
173 return 0;
174 }
175
176
ecdsa_ecc_ctx_deinit(struct ecc_ctx * ctx)177 static void ecdsa_ecc_ctx_deinit(struct ecc_ctx *ctx)
178 {
179 ctx->pub_key_set = false;
180 }
181
ecdsa_ecc_ctx_reset(struct ecc_ctx * ctx)182 static int ecdsa_ecc_ctx_reset(struct ecc_ctx *ctx)
183 {
184 unsigned int curve_id = ctx->curve_id;
185 int ret;
186
187 ecdsa_ecc_ctx_deinit(ctx);
188 ret = ecdsa_ecc_ctx_init(ctx, curve_id);
189 if (ret == 0)
190 ctx->pub_key = ECC_POINT_INIT(ctx->x, ctx->y,
191 ctx->curve->g.ndigits);
192 return ret;
193 }
194
195 /*
196 * Set the public ECC key as defined by RFC5480 section 2.2 "Subject Public
197 * Key". Only the uncompressed format is supported.
198 */
ecdsa_set_pub_key(struct crypto_akcipher * tfm,const void * key,unsigned int keylen)199 static int ecdsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsigned int keylen)
200 {
201 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);
202 unsigned int digitlen, ndigits;
203 const unsigned char *d = key;
204 int ret;
205
206 ret = ecdsa_ecc_ctx_reset(ctx);
207 if (ret < 0)
208 return ret;
209
210 if (keylen < 1 || ((keylen - 1) & 1) != 0)
211 return -EINVAL;
212 /* we only accept uncompressed format indicated by '4' */
213 if (d[0] != 4)
214 return -EINVAL;
215
216 keylen--;
217 digitlen = keylen >> 1;
218
219 ndigits = DIV_ROUND_UP(digitlen, sizeof(u64));
220 if (ndigits != ctx->curve->g.ndigits)
221 return -EINVAL;
222
223 d++;
224
225 ecc_digits_from_bytes(d, digitlen, ctx->pub_key.x, ndigits);
226 ecc_digits_from_bytes(&d[digitlen], digitlen, ctx->pub_key.y, ndigits);
227
228 ret = ecc_is_pubkey_valid_full(ctx->curve, &ctx->pub_key);
229
230 ctx->pub_key_set = ret == 0;
231
232 return ret;
233 }
234
ecdsa_exit_tfm(struct crypto_akcipher * tfm)235 static void ecdsa_exit_tfm(struct crypto_akcipher *tfm)
236 {
237 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);
238
239 ecdsa_ecc_ctx_deinit(ctx);
240 }
241
ecdsa_max_size(struct crypto_akcipher * tfm)242 static unsigned int ecdsa_max_size(struct crypto_akcipher *tfm)
243 {
244 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);
245
246 return DIV_ROUND_UP(ctx->curve->nbits, 8);
247 }
248
ecdsa_nist_p521_init_tfm(struct crypto_akcipher * tfm)249 static int ecdsa_nist_p521_init_tfm(struct crypto_akcipher *tfm)
250 {
251 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);
252
253 return ecdsa_ecc_ctx_init(ctx, ECC_CURVE_NIST_P521);
254 }
255
256 static struct akcipher_alg ecdsa_nist_p521 = {
257 .verify = ecdsa_verify,
258 .set_pub_key = ecdsa_set_pub_key,
259 .max_size = ecdsa_max_size,
260 .init = ecdsa_nist_p521_init_tfm,
261 .exit = ecdsa_exit_tfm,
262 .base = {
263 .cra_name = "ecdsa-nist-p521",
264 .cra_driver_name = "ecdsa-nist-p521-generic",
265 .cra_priority = 100,
266 .cra_module = THIS_MODULE,
267 .cra_ctxsize = sizeof(struct ecc_ctx),
268 },
269 };
270
ecdsa_nist_p384_init_tfm(struct crypto_akcipher * tfm)271 static int ecdsa_nist_p384_init_tfm(struct crypto_akcipher *tfm)
272 {
273 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);
274
275 return ecdsa_ecc_ctx_init(ctx, ECC_CURVE_NIST_P384);
276 }
277
278 static struct akcipher_alg ecdsa_nist_p384 = {
279 .verify = ecdsa_verify,
280 .set_pub_key = ecdsa_set_pub_key,
281 .max_size = ecdsa_max_size,
282 .init = ecdsa_nist_p384_init_tfm,
283 .exit = ecdsa_exit_tfm,
284 .base = {
285 .cra_name = "ecdsa-nist-p384",
286 .cra_driver_name = "ecdsa-nist-p384-generic",
287 .cra_priority = 100,
288 .cra_module = THIS_MODULE,
289 .cra_ctxsize = sizeof(struct ecc_ctx),
290 },
291 };
292
ecdsa_nist_p256_init_tfm(struct crypto_akcipher * tfm)293 static int ecdsa_nist_p256_init_tfm(struct crypto_akcipher *tfm)
294 {
295 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);
296
297 return ecdsa_ecc_ctx_init(ctx, ECC_CURVE_NIST_P256);
298 }
299
300 static struct akcipher_alg ecdsa_nist_p256 = {
301 .verify = ecdsa_verify,
302 .set_pub_key = ecdsa_set_pub_key,
303 .max_size = ecdsa_max_size,
304 .init = ecdsa_nist_p256_init_tfm,
305 .exit = ecdsa_exit_tfm,
306 .base = {
307 .cra_name = "ecdsa-nist-p256",
308 .cra_driver_name = "ecdsa-nist-p256-generic",
309 .cra_priority = 100,
310 .cra_module = THIS_MODULE,
311 .cra_ctxsize = sizeof(struct ecc_ctx),
312 },
313 };
314
ecdsa_nist_p192_init_tfm(struct crypto_akcipher * tfm)315 static int ecdsa_nist_p192_init_tfm(struct crypto_akcipher *tfm)
316 {
317 struct ecc_ctx *ctx = akcipher_tfm_ctx(tfm);
318
319 return ecdsa_ecc_ctx_init(ctx, ECC_CURVE_NIST_P192);
320 }
321
322 static struct akcipher_alg ecdsa_nist_p192 = {
323 .verify = ecdsa_verify,
324 .set_pub_key = ecdsa_set_pub_key,
325 .max_size = ecdsa_max_size,
326 .init = ecdsa_nist_p192_init_tfm,
327 .exit = ecdsa_exit_tfm,
328 .base = {
329 .cra_name = "ecdsa-nist-p192",
330 .cra_driver_name = "ecdsa-nist-p192-generic",
331 .cra_priority = 100,
332 .cra_module = THIS_MODULE,
333 .cra_ctxsize = sizeof(struct ecc_ctx),
334 },
335 };
336 static bool ecdsa_nist_p192_registered;
337
ecdsa_init(void)338 static int __init ecdsa_init(void)
339 {
340 int ret;
341
342 /* NIST p192 may not be available in FIPS mode */
343 ret = crypto_register_akcipher(&ecdsa_nist_p192);
344 ecdsa_nist_p192_registered = ret == 0;
345
346 ret = crypto_register_akcipher(&ecdsa_nist_p256);
347 if (ret)
348 goto nist_p256_error;
349
350 ret = crypto_register_akcipher(&ecdsa_nist_p384);
351 if (ret)
352 goto nist_p384_error;
353
354 ret = crypto_register_akcipher(&ecdsa_nist_p521);
355 if (ret)
356 goto nist_p521_error;
357
358 return 0;
359
360 nist_p521_error:
361 crypto_unregister_akcipher(&ecdsa_nist_p384);
362
363 nist_p384_error:
364 crypto_unregister_akcipher(&ecdsa_nist_p256);
365
366 nist_p256_error:
367 if (ecdsa_nist_p192_registered)
368 crypto_unregister_akcipher(&ecdsa_nist_p192);
369 return ret;
370 }
371
ecdsa_exit(void)372 static void __exit ecdsa_exit(void)
373 {
374 if (ecdsa_nist_p192_registered)
375 crypto_unregister_akcipher(&ecdsa_nist_p192);
376 crypto_unregister_akcipher(&ecdsa_nist_p256);
377 crypto_unregister_akcipher(&ecdsa_nist_p384);
378 crypto_unregister_akcipher(&ecdsa_nist_p521);
379 }
380
381 subsys_initcall(ecdsa_init);
382 module_exit(ecdsa_exit);
383
384 MODULE_LICENSE("GPL");
385 MODULE_AUTHOR("Stefan Berger <stefanb@linux.ibm.com>");
386 MODULE_DESCRIPTION("ECDSA generic algorithm");
387 MODULE_ALIAS_CRYPTO("ecdsa-nist-p192");
388 MODULE_ALIAS_CRYPTO("ecdsa-nist-p256");
389 MODULE_ALIAS_CRYPTO("ecdsa-nist-p384");
390 MODULE_ALIAS_CRYPTO("ecdsa-nist-p521");
391 MODULE_ALIAS_CRYPTO("ecdsa-generic");
392