Commit | Line | Data |
---|---|---|
2874c5fd | 1 | // SPDX-License-Identifier: GPL-2.0-or-later |
3c4b2390 SB |
2 | /* ECDH key-agreement protocol |
3 | * | |
4 | * Copyright (c) 2016, Intel Corporation | |
5 | * Authors: Salvator Benedetto <salvatore.benedetto@intel.com> | |
3c4b2390 SB |
6 | */ |
7 | ||
8 | #include <linux/module.h> | |
9 | #include <crypto/internal/kpp.h> | |
10 | #include <crypto/kpp.h> | |
11 | #include <crypto/ecdh.h> | |
12 | #include <linux/scatterlist.h> | |
13 | #include "ecc.h" | |
14 | ||
15 | struct ecdh_ctx { | |
16 | unsigned int curve_id; | |
17 | unsigned int ndigits; | |
18 | u64 private_key[ECC_MAX_DIGITS]; | |
3c4b2390 SB |
19 | }; |
20 | ||
21 | static inline struct ecdh_ctx *ecdh_get_ctx(struct crypto_kpp *tfm) | |
22 | { | |
23 | return kpp_tfm_ctx(tfm); | |
24 | } | |
25 | ||
26 | static unsigned int ecdh_supported_curve(unsigned int curve_id) | |
27 | { | |
28 | switch (curve_id) { | |
d5c3b178 KC |
29 | case ECC_CURVE_NIST_P192: return ECC_CURVE_NIST_P192_DIGITS; |
30 | case ECC_CURVE_NIST_P256: return ECC_CURVE_NIST_P256_DIGITS; | |
3c4b2390 SB |
31 | default: return 0; |
32 | } | |
33 | } | |
34 | ||
5527dfb6 EB |
35 | static int ecdh_set_secret(struct crypto_kpp *tfm, const void *buf, |
36 | unsigned int len) | |
3c4b2390 SB |
37 | { |
38 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
39 | struct ecdh params; | |
40 | unsigned int ndigits; | |
41 | ||
0aa171e9 AB |
42 | if (crypto_ecdh_decode_key(buf, len, ¶ms) < 0 || |
43 | params.key_size > sizeof(ctx->private_key)) | |
3c4b2390 SB |
44 | return -EINVAL; |
45 | ||
46 | ndigits = ecdh_supported_curve(params.curve_id); | |
47 | if (!ndigits) | |
48 | return -EINVAL; | |
49 | ||
50 | ctx->curve_id = params.curve_id; | |
51 | ctx->ndigits = ndigits; | |
52 | ||
6755fd26 TDA |
53 | if (!params.key || !params.key_size) |
54 | return ecc_gen_privkey(ctx->curve_id, ctx->ndigits, | |
55 | ctx->private_key); | |
56 | ||
3c4b2390 SB |
57 | memcpy(ctx->private_key, params.key, params.key_size); |
58 | ||
17858b14 AB |
59 | if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits, |
60 | ctx->private_key, params.key_size) < 0) { | |
61 | memzero_explicit(ctx->private_key, params.key_size); | |
62 | return -EINVAL; | |
63 | } | |
3c4b2390 SB |
64 | return 0; |
65 | } | |
66 | ||
67 | static int ecdh_compute_value(struct kpp_request *req) | |
68 | { | |
3c4b2390 SB |
69 | struct crypto_kpp *tfm = crypto_kpp_reqtfm(req); |
70 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
952035ba TDA |
71 | u64 *public_key; |
72 | u64 *shared_secret = NULL; | |
3c4b2390 | 73 | void *buf; |
952035ba TDA |
74 | size_t copied, nbytes, public_key_sz; |
75 | int ret = -ENOMEM; | |
3c4b2390 SB |
76 | |
77 | nbytes = ctx->ndigits << ECC_DIGITS_TO_BYTES_SHIFT; | |
952035ba TDA |
78 | /* Public part is a point thus it has both coordinates */ |
79 | public_key_sz = 2 * nbytes; | |
80 | ||
81 | public_key = kmalloc(public_key_sz, GFP_KERNEL); | |
82 | if (!public_key) | |
83 | return -ENOMEM; | |
3c4b2390 SB |
84 | |
85 | if (req->src) { | |
952035ba TDA |
86 | shared_secret = kmalloc(nbytes, GFP_KERNEL); |
87 | if (!shared_secret) | |
88 | goto free_pubkey; | |
89 | ||
95ec01ba JB |
90 | /* from here on it's invalid parameters */ |
91 | ret = -EINVAL; | |
92 | ||
93 | /* must have exactly two points to be on the curve */ | |
94 | if (public_key_sz != req->src_len) | |
95 | goto free_all; | |
96 | ||
97 | copied = sg_copy_to_buffer(req->src, | |
98 | sg_nents_for_len(req->src, | |
99 | public_key_sz), | |
100 | public_key, public_key_sz); | |
101 | if (copied != public_key_sz) | |
952035ba | 102 | goto free_all; |
3c4b2390 | 103 | |
8f44df15 | 104 | ret = crypto_ecdh_shared_secret(ctx->curve_id, ctx->ndigits, |
952035ba TDA |
105 | ctx->private_key, public_key, |
106 | shared_secret); | |
3c4b2390 | 107 | |
952035ba | 108 | buf = shared_secret; |
3c4b2390 | 109 | } else { |
7380c56d | 110 | ret = ecc_make_pub_key(ctx->curve_id, ctx->ndigits, |
952035ba TDA |
111 | ctx->private_key, public_key); |
112 | buf = public_key; | |
113 | nbytes = public_key_sz; | |
3c4b2390 SB |
114 | } |
115 | ||
116 | if (ret < 0) | |
952035ba | 117 | goto free_all; |
3c4b2390 | 118 | |
95ec01ba JB |
119 | /* might want less than we've got */ |
120 | nbytes = min_t(size_t, nbytes, req->dst_len); | |
121 | copied = sg_copy_from_buffer(req->dst, sg_nents_for_len(req->dst, | |
122 | nbytes), | |
123 | buf, nbytes); | |
3c4b2390 | 124 | if (copied != nbytes) |
952035ba | 125 | ret = -EINVAL; |
3c4b2390 | 126 | |
952035ba TDA |
127 | /* fall through */ |
128 | free_all: | |
453431a5 | 129 | kfree_sensitive(shared_secret); |
952035ba TDA |
130 | free_pubkey: |
131 | kfree(public_key); | |
3c4b2390 SB |
132 | return ret; |
133 | } | |
134 | ||
d0efb48b | 135 | static unsigned int ecdh_max_size(struct crypto_kpp *tfm) |
3c4b2390 SB |
136 | { |
137 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
3c4b2390 | 138 | |
d0efb48b TDA |
139 | /* Public key is made of two coordinates, add one to the left shift */ |
140 | return ctx->ndigits << (ECC_DIGITS_TO_BYTES_SHIFT + 1); | |
3c4b2390 SB |
141 | } |
142 | ||
3c4b2390 SB |
143 | static struct kpp_alg ecdh = { |
144 | .set_secret = ecdh_set_secret, | |
145 | .generate_public_key = ecdh_compute_value, | |
146 | .compute_shared_secret = ecdh_compute_value, | |
147 | .max_size = ecdh_max_size, | |
3c4b2390 SB |
148 | .base = { |
149 | .cra_name = "ecdh", | |
150 | .cra_driver_name = "ecdh-generic", | |
151 | .cra_priority = 100, | |
152 | .cra_module = THIS_MODULE, | |
153 | .cra_ctxsize = sizeof(struct ecdh_ctx), | |
154 | }, | |
155 | }; | |
156 | ||
157 | static int ecdh_init(void) | |
158 | { | |
159 | return crypto_register_kpp(&ecdh); | |
160 | } | |
161 | ||
162 | static void ecdh_exit(void) | |
163 | { | |
164 | crypto_unregister_kpp(&ecdh); | |
165 | } | |
166 | ||
c4741b23 | 167 | subsys_initcall(ecdh_init); |
3c4b2390 SB |
168 | module_exit(ecdh_exit); |
169 | MODULE_ALIAS_CRYPTO("ecdh"); | |
170 | MODULE_LICENSE("GPL"); | |
171 | MODULE_DESCRIPTION("ECDH generic algorithm"); |