[linux-block.git] / crypto / dh.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*  Diffie-Hellman Key Agreement Method [RFC2631]
 *
 * Copyright (c) 2016, Intel Corporation
 * Authors: Salvatore Benedetto <salvatore.benedetto@intel.com>
 */

#include <linux/fips.h>
#include <linux/module.h>
#include <crypto/internal/kpp.h>
#include <crypto/kpp.h>
#include <crypto/dh.h>
#include <linux/mpi.h>

struct dh_ctx {
	MPI p;	/* Value is guaranteed to be set. */
	MPI q;	/* Value is optional. */
	MPI g;	/* Value is guaranteed to be set. */
	MPI xa;	/* Value is guaranteed to be set. */
};

static void dh_clear_ctx(struct dh_ctx *ctx)
{
	mpi_free(ctx->p);
	mpi_free(ctx->q);
	mpi_free(ctx->g);
	mpi_free(ctx->xa);
	memset(ctx, 0, sizeof(*ctx));
}

/*
 * If base is g we compute the public key
 *	ya = g^xa mod p; [RFC2631 sec 2.1.1]
 * else if base if the counterpart public key we compute the shared secret
 *	ZZ = yb^xa mod p; [RFC2631 sec 2.1.1]
 */
static int _compute_val(const struct dh_ctx *ctx, MPI base, MPI val)
{
	/* val = base^xa mod p */
	return mpi_powm(val, base, ctx->xa, ctx->p);
}

static inline struct dh_ctx *dh_get_ctx(struct crypto_kpp *tfm)
{
	return kpp_tfm_ctx(tfm);
}

static int dh_check_params_length(unsigned int p_len)
{
	if (fips_enabled)
		return (p_len < 2048) ? -EINVAL : 0;

	return (p_len < 1536) ? -EINVAL : 0;
}

static int dh_set_params(struct dh_ctx *ctx, struct dh *params)
{
	if (dh_check_params_length(params->p_size << 3))
		return -EINVAL;

	ctx->p = mpi_read_raw_data(params->p, params->p_size);
	if (!ctx->p)
		return -EINVAL;

	ctx->g = mpi_read_raw_data(params->g, params->g_size);
	if (!ctx->g)
		return -EINVAL;

	return 0;
}

static int dh_set_secret(struct crypto_kpp *tfm, const void *buf,
			 unsigned int len)
{
	struct dh_ctx *ctx = dh_get_ctx(tfm);
	struct dh params;

	/* Free the old MPI key if any */
	dh_clear_ctx(ctx);

	if (crypto_dh_decode_key(buf, len, &params) < 0)
		goto err_clear_ctx;

	if (dh_set_params(ctx, &params) < 0)
		goto err_clear_ctx;

	ctx->xa = mpi_read_raw_data(params.key, params.key_size);
	if (!ctx->xa)
		goto err_clear_ctx;

	return 0;

err_clear_ctx:
	dh_clear_ctx(ctx);
	return -EINVAL;
}

/*
 * SP800-56A public key verification:
 *
 * * If Q is provided as part of the domain paramenters, a full validation
 *   according to SP800-56A section 5.6.2.3.1 is performed.
 *
 * * If Q is not provided, a partial validation according to SP800-56A section
 *   5.6.2.3.2 is performed.
 */
static int dh_is_pubkey_valid(struct dh_ctx *ctx, MPI y)
{
	if (unlikely(!ctx->p))
		return -EINVAL;

	/*
	 * Step 1: Verify that 2 <= y <= p - 2.
	 *
	 * The upper limit check is actually y < p instead of y < p - 1
	 * as the mpi_sub_ui function is yet missing.
	 */
	if (mpi_cmp_ui(y, 1) < 1 || mpi_cmp(y, ctx->p) >= 0)
		return -EINVAL;

	/* Step 2: Verify that 1 = y^q mod p */
	if (ctx->q) {
		MPI val = mpi_alloc(0);
		int ret;

		if (!val)
			return -ENOMEM;

		ret = mpi_powm(val, y, ctx->q, ctx->p);

		if (ret) {
			mpi_free(val);
			return ret;
		}

		ret = mpi_cmp_ui(val, 1);

		mpi_free(val);

		if (ret != 0)
			return -EINVAL;
	}

	return 0;
}

static int dh_compute_value(struct kpp_request *req)
{
	struct crypto_kpp *tfm = crypto_kpp_reqtfm(req);
	struct dh_ctx *ctx = dh_get_ctx(tfm);
	MPI base, val = mpi_alloc(0);
	int ret = 0;
	int sign;

	if (!val)
		return -ENOMEM;

	if (unlikely(!ctx->xa)) {
		ret = -EINVAL;
		goto err_free_val;
	}

	if (req->src) {
		base = mpi_read_raw_from_sgl(req->src, req->src_len);
		if (!base) {
			ret = -EINVAL;
			goto err_free_val;
		}
		ret = dh_is_pubkey_valid(ctx, base);
		if (ret)
			goto err_free_base;
	} else {
		base = ctx->g;
	}

	ret = _compute_val(ctx, base, val);
	if (ret)
		goto err_free_base;

	if (fips_enabled) {
		/* SP800-56A rev3 5.7.1.1 check: Validation of shared secret */
		if (req->src) {
			MPI pone;

			/* z <= 1 */
			if (mpi_cmp_ui(val, 1) < 1) {
				ret = -EBADMSG;
				goto err_free_base;
			}

			/* z == p - 1 */
			pone = mpi_alloc(0);

			if (!pone) {
				ret = -ENOMEM;
				goto err_free_base;
			}

			ret = mpi_sub_ui(pone, ctx->p, 1);
			if (!ret && !mpi_cmp(pone, val))
				ret = -EBADMSG;

			mpi_free(pone);

			if (ret)
				goto err_free_base;

		/* SP800-56A rev 3 5.6.2.1.3 key check */
		} else {
			if (dh_is_pubkey_valid(ctx, val)) {
				ret = -EAGAIN;
				goto err_free_val;
			}
		}
	}

	ret = mpi_write_to_sgl(val, req->dst, req->dst_len, &sign);
	if (ret)
		goto err_free_base;

	if (sign < 0)
		ret = -EBADMSG;
err_free_base:
	if (req->src)
		mpi_free(base);
err_free_val:
	mpi_free(val);
	return ret;
}

static unsigned int dh_max_size(struct crypto_kpp *tfm)
{
	struct dh_ctx *ctx = dh_get_ctx(tfm);

	return mpi_get_size(ctx->p);
}

static void dh_exit_tfm(struct crypto_kpp *tfm)
{
	struct dh_ctx *ctx = dh_get_ctx(tfm);

	dh_clear_ctx(ctx);
}

static struct kpp_alg dh = {
	.set_secret = dh_set_secret,
	.generate_public_key = dh_compute_value,
	.compute_shared_secret = dh_compute_value,
	.max_size = dh_max_size,
	.exit = dh_exit_tfm,
	.base = {
		.cra_name = "dh",
		.cra_driver_name = "dh-generic",
		.cra_priority = 100,
		.cra_module = THIS_MODULE,
		.cra_ctxsize = sizeof(struct dh_ctx),
	},
};

static int dh_init(void)
{
	return crypto_register_kpp(&dh);
}

static void dh_exit(void)
{
	crypto_unregister_kpp(&dh);
}

subsys_initcall(dh_init);
module_exit(dh_exit);
MODULE_ALIAS_CRYPTO("dh");
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("DH generic algorithm");
Commit	Line	Data
2874c5fd	1	// SPDX-License-Identifier: GPL-2.0-or-later
802c7f1c SB	2	/* Diffie-Hellman Key Agreement Method [RFC2631]
	3	*
	4	* Copyright (c) 2016, Intel Corporation
	5	* Authors: Salvatore Benedetto <salvatore.benedetto@intel.com>
802c7f1c SB	6	*/
802c7f1c SB	7
1e146c39	8	#include <linux/fips.h>
802c7f1c SB	9	#include <linux/module.h>
	10	#include <crypto/internal/kpp.h>
	11	#include <crypto/kpp.h>
	12	#include <crypto/dh.h>
	13	#include <linux/mpi.h>
	14
	15	struct dh_ctx {
e3fe0ae1 SM	16	MPI p; /* Value is guaranteed to be set. */
	17	MPI q; /* Value is optional. */
	18	MPI g; /* Value is guaranteed to be set. */
	19	MPI xa; /* Value is guaranteed to be set. */
802c7f1c SB	20	};
802c7f1c SB	21
12d41a02	22	static void dh_clear_ctx(struct dh_ctx *ctx)
802c7f1c SB	23	{
802c7f1c SB	24	mpi_free(ctx->p);
e3fe0ae1	25	mpi_free(ctx->q);
802c7f1c	26	mpi_free(ctx->g);
802c7f1c	27	mpi_free(ctx->xa);
12d41a02	28	memset(ctx, 0, sizeof(*ctx));
802c7f1c SB	29	}
	30
	31	/*
	32	* If base is g we compute the public key
	33	* ya = g^xa mod p; [RFC2631 sec 2.1.1]
	34	* else if base if the counterpart public key we compute the shared secret
	35	* ZZ = yb^xa mod p; [RFC2631 sec 2.1.1]
	36	*/
	37	static int _compute_val(const struct dh_ctx *ctx, MPI base, MPI val)
	38	{
	39	/* val = base^xa mod p */
	40	return mpi_powm(val, base, ctx->xa, ctx->p);
	41	}
	42
	43	static inline struct dh_ctx dh_get_ctx(struct crypto_kpp tfm)
	44	{
	45	return kpp_tfm_ctx(tfm);
	46	}
	47
	48	static int dh_check_params_length(unsigned int p_len)
	49	{
1e146c39 SM	50	if (fips_enabled)
	51	return (p_len < 2048) ? -EINVAL : 0;
	52
802c7f1c SB	53	return (p_len < 1536) ? -EINVAL : 0;
	54	}
	55
	56	static int dh_set_params(struct dh_ctx ctx, struct dh params)
	57	{
802c7f1c SB	58	if (dh_check_params_length(params->p_size << 3))
	59	return -EINVAL;
	60
	61	ctx->p = mpi_read_raw_data(params->p, params->p_size);
	62	if (!ctx->p)
	63	return -EINVAL;
	64
	65	ctx->g = mpi_read_raw_data(params->g, params->g_size);
12d41a02	66	if (!ctx->g)
802c7f1c	67	return -EINVAL;
802c7f1c SB	68
	69	return 0;
	70	}
	71
5527dfb6 EB	72	static int dh_set_secret(struct crypto_kpp tfm, const void buf,
5527dfb6 EB	73	unsigned int len)
802c7f1c SB	74	{
	75	struct dh_ctx *ctx = dh_get_ctx(tfm);
	76	struct dh params;
	77
ee34e264	78	/* Free the old MPI key if any */
12d41a02	79	dh_clear_ctx(ctx);
ee34e264	80
802c7f1c	81	if (crypto_dh_decode_key(buf, len, &params) < 0)
12d41a02	82	goto err_clear_ctx;
802c7f1c SB	83
802c7f1c SB	84	if (dh_set_params(ctx, &params) < 0)
12d41a02	85	goto err_clear_ctx;
802c7f1c SB	86
802c7f1c SB	87	ctx->xa = mpi_read_raw_data(params.key, params.key_size);
12d41a02 EB	88	if (!ctx->xa)
12d41a02 EB	89	goto err_clear_ctx;
802c7f1c SB	90
802c7f1c SB	91	return 0;
12d41a02 EB	92
	93	err_clear_ctx:
	94	dh_clear_ctx(ctx);
	95	return -EINVAL;
802c7f1c SB	96	}
802c7f1c SB	97
e3fe0ae1 SM	98	/*
	99	* SP800-56A public key verification:
	100	*
	101	* * If Q is provided as part of the domain paramenters, a full validation
	102	* according to SP800-56A section 5.6.2.3.1 is performed.
	103	*
	104	* * If Q is not provided, a partial validation according to SP800-56A section
	105	* 5.6.2.3.2 is performed.
	106	*/
	107	static int dh_is_pubkey_valid(struct dh_ctx *ctx, MPI y)
	108	{
	109	if (unlikely(!ctx->p))
	110	return -EINVAL;
	111
	112	/*
	113	* Step 1: Verify that 2 <= y <= p - 2.
	114	*
	115	* The upper limit check is actually y < p instead of y < p - 1
	116	* as the mpi_sub_ui function is yet missing.
	117	*/
	118	if (mpi_cmp_ui(y, 1) < 1 \|\| mpi_cmp(y, ctx->p) >= 0)
	119	return -EINVAL;
	120
	121	/* Step 2: Verify that 1 = y^q mod p */
	122	if (ctx->q) {
	123	MPI val = mpi_alloc(0);
	124	int ret;
	125
	126	if (!val)
	127	return -ENOMEM;
	128
	129	ret = mpi_powm(val, y, ctx->q, ctx->p);
	130
	131	if (ret) {
	132	mpi_free(val);
	133	return ret;
	134	}
	135
	136	ret = mpi_cmp_ui(val, 1);
	137
	138	mpi_free(val);
	139
	140	if (ret != 0)
	141	return -EINVAL;
	142	}
	143
	144	return 0;
	145	}
	146
802c7f1c SB	147	static int dh_compute_value(struct kpp_request *req)
	148	{
	149	struct crypto_kpp *tfm = crypto_kpp_reqtfm(req);
	150	struct dh_ctx *ctx = dh_get_ctx(tfm);
	151	MPI base, val = mpi_alloc(0);
	152	int ret = 0;
	153	int sign;
	154
	155	if (!val)
	156	return -ENOMEM;
	157
	158	if (unlikely(!ctx->xa)) {
	159	ret = -EINVAL;
	160	goto err_free_val;
	161	}
	162
	163	if (req->src) {
	164	base = mpi_read_raw_from_sgl(req->src, req->src_len);
	165	if (!base) {
8edda7d2	166	ret = -EINVAL;
802c7f1c SB	167	goto err_free_val;
802c7f1c SB	168	}
e3fe0ae1 SM	169	ret = dh_is_pubkey_valid(ctx, base);
e3fe0ae1 SM	170	if (ret)
3fd8093b	171	goto err_free_base;
802c7f1c SB	172	} else {
	173	base = ctx->g;
	174	}
	175
	176	ret = _compute_val(ctx, base, val);
	177	if (ret)
	178	goto err_free_base;
	179
2ed5ba61 SM	180	if (fips_enabled) {
	181	/* SP800-56A rev3 5.7.1.1 check: Validation of shared secret */
	182	if (req->src) {
	183	MPI pone;
	184
	185	/* z <= 1 */
	186	if (mpi_cmp_ui(val, 1) < 1) {
	187	ret = -EBADMSG;
	188	goto err_free_base;
	189	}
	190
	191	/* z == p - 1 */
	192	pone = mpi_alloc(0);
	193
	194	if (!pone) {
	195	ret = -ENOMEM;
	196	goto err_free_base;
	197	}
	198
	199	ret = mpi_sub_ui(pone, ctx->p, 1);
	200	if (!ret && !mpi_cmp(pone, val))
	201	ret = -EBADMSG;
	202
	203	mpi_free(pone);
	204
	205	if (ret)
	206	goto err_free_base;
	207
	208	/* SP800-56A rev 3 5.6.2.1.3 key check */
	209	} else {
	210	if (dh_is_pubkey_valid(ctx, val)) {
	211	ret = -EAGAIN;
	212	goto err_free_val;
	213	}
90fa9ae5	214	}
90fa9ae5 SM	215	}
90fa9ae5 SM	216
9b45b7bb	217	ret = mpi_write_to_sgl(val, req->dst, req->dst_len, &sign);
802c7f1c SB	218	if (ret)
	219	goto err_free_base;
	220
	221	if (sign < 0)
	222	ret = -EBADMSG;
	223	err_free_base:
	224	if (req->src)
	225	mpi_free(base);
	226	err_free_val:
	227	mpi_free(val);
	228	return ret;
	229	}
	230
7f691050	231	static unsigned int dh_max_size(struct crypto_kpp *tfm)
802c7f1c SB	232	{
	233	struct dh_ctx *ctx = dh_get_ctx(tfm);
	234
	235	return mpi_get_size(ctx->p);
	236	}
	237
	238	static void dh_exit_tfm(struct crypto_kpp *tfm)
	239	{
	240	struct dh_ctx *ctx = dh_get_ctx(tfm);
	241
12d41a02	242	dh_clear_ctx(ctx);
802c7f1c SB	243	}
	244
	245	static struct kpp_alg dh = {
	246	.set_secret = dh_set_secret,
	247	.generate_public_key = dh_compute_value,
	248	.compute_shared_secret = dh_compute_value,
	249	.max_size = dh_max_size,
	250	.exit = dh_exit_tfm,
	251	.base = {
	252	.cra_name = "dh",
	253	.cra_driver_name = "dh-generic",
	254	.cra_priority = 100,
	255	.cra_module = THIS_MODULE,
	256	.cra_ctxsize = sizeof(struct dh_ctx),
	257	},
	258	};
	259
	260	static int dh_init(void)
	261	{
	262	return crypto_register_kpp(&dh);
	263	}
	264
	265	static void dh_exit(void)
	266	{
	267	crypto_unregister_kpp(&dh);
	268	}
	269
c4741b23	270	subsys_initcall(dh_init);
802c7f1c SB	271	module_exit(dh_exit);
	272	MODULE_ALIAS_CRYPTO("dh");
	273	MODULE_LICENSE("GPL");
	274	MODULE_DESCRIPTION("DH generic algorithm");