1 // SPDX-License-Identifier: GPL-2.0 OR MIT
3 * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
5 * Based on public domain code from Daniel J. Bernstein and Peter Schwabe. This
6 * began from SUPERCOP's curve25519/neon2/scalarmult.s, but has subsequently been
7 * manually reworked for use in kernel space.
10 #include <asm/hwcap.h>
13 #include <crypto/internal/kpp.h>
14 #include <crypto/internal/simd.h>
15 #include <linux/types.h>
16 #include <linux/module.h>
17 #include <linux/init.h>
18 #include <linux/jump_label.h>
19 #include <crypto/curve25519.h>
21 asmlinkage void curve25519_neon(u8 mypublic[CURVE25519_KEY_SIZE],
22 const u8 secret[CURVE25519_KEY_SIZE],
23 const u8 basepoint[CURVE25519_KEY_SIZE]);
25 static __ro_after_init DEFINE_STATIC_KEY_FALSE(have_neon);
27 void curve25519_arch(u8 out[CURVE25519_KEY_SIZE],
28 const u8 scalar[CURVE25519_KEY_SIZE],
29 const u8 point[CURVE25519_KEY_SIZE])
31 if (static_branch_likely(&have_neon) && crypto_simd_usable()) {
33 curve25519_neon(out, scalar, point);
36 curve25519_generic(out, scalar, point);
39 EXPORT_SYMBOL(curve25519_arch);
41 static int curve25519_set_secret(struct crypto_kpp *tfm, const void *buf,
44 u8 *secret = kpp_tfm_ctx(tfm);
47 curve25519_generate_secret(secret);
48 else if (len == CURVE25519_KEY_SIZE &&
49 crypto_memneq(buf, curve25519_null_point, CURVE25519_KEY_SIZE))
50 memcpy(secret, buf, CURVE25519_KEY_SIZE);
56 static int curve25519_compute_value(struct kpp_request *req)
58 struct crypto_kpp *tfm = crypto_kpp_reqtfm(req);
59 const u8 *secret = kpp_tfm_ctx(tfm);
60 u8 public_key[CURVE25519_KEY_SIZE];
61 u8 buf[CURVE25519_KEY_SIZE];
66 copied = sg_copy_to_buffer(req->src,
67 sg_nents_for_len(req->src,
69 public_key, CURVE25519_KEY_SIZE);
70 if (copied != CURVE25519_KEY_SIZE)
74 bp = curve25519_base_point;
77 curve25519_arch(buf, secret, bp);
79 /* might want less than we've got */
80 nbytes = min_t(size_t, CURVE25519_KEY_SIZE, req->dst_len);
81 copied = sg_copy_from_buffer(req->dst, sg_nents_for_len(req->dst,
89 static unsigned int curve25519_max_size(struct crypto_kpp *tfm)
91 return CURVE25519_KEY_SIZE;
94 static struct kpp_alg curve25519_alg = {
95 .base.cra_name = "curve25519",
96 .base.cra_driver_name = "curve25519-neon",
97 .base.cra_priority = 200,
98 .base.cra_module = THIS_MODULE,
99 .base.cra_ctxsize = CURVE25519_KEY_SIZE,
101 .set_secret = curve25519_set_secret,
102 .generate_public_key = curve25519_compute_value,
103 .compute_shared_secret = curve25519_compute_value,
104 .max_size = curve25519_max_size,
107 static int __init mod_init(void)
109 if (elf_hwcap & HWCAP_NEON) {
110 static_branch_enable(&have_neon);
111 return crypto_register_kpp(&curve25519_alg);
116 static void __exit mod_exit(void)
118 if (elf_hwcap & HWCAP_NEON)
119 crypto_unregister_kpp(&curve25519_alg);
122 module_init(mod_init);
123 module_exit(mod_exit);
125 MODULE_ALIAS_CRYPTO("curve25519");
126 MODULE_ALIAS_CRYPTO("curve25519-neon");
127 MODULE_LICENSE("GPL v2");