Commit | Line | Data |
---|---|---|
2874c5fd | 1 | // SPDX-License-Identifier: GPL-2.0-or-later |
3c4b2390 SB |
2 | /* ECDH key-agreement protocol |
3 | * | |
4 | * Copyright (c) 2016, Intel Corporation | |
5 | * Authors: Salvator Benedetto <salvatore.benedetto@intel.com> | |
3c4b2390 SB |
6 | */ |
7 | ||
8 | #include <linux/module.h> | |
a745d3ac | 9 | #include <crypto/internal/ecc.h> |
3c4b2390 SB |
10 | #include <crypto/internal/kpp.h> |
11 | #include <crypto/kpp.h> | |
12 | #include <crypto/ecdh.h> | |
13 | #include <linux/scatterlist.h> | |
3c4b2390 SB |
14 | |
15 | struct ecdh_ctx { | |
16 | unsigned int curve_id; | |
17 | unsigned int ndigits; | |
18 | u64 private_key[ECC_MAX_DIGITS]; | |
3c4b2390 SB |
19 | }; |
20 | ||
21 | static inline struct ecdh_ctx *ecdh_get_ctx(struct crypto_kpp *tfm) | |
22 | { | |
23 | return kpp_tfm_ctx(tfm); | |
24 | } | |
25 | ||
5527dfb6 EB |
26 | static int ecdh_set_secret(struct crypto_kpp *tfm, const void *buf, |
27 | unsigned int len) | |
3c4b2390 SB |
28 | { |
29 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
bd955a4e | 30 | u64 priv[ECC_MAX_DIGITS]; |
3c4b2390 | 31 | struct ecdh params; |
bd955a4e | 32 | int ret = 0; |
3c4b2390 | 33 | |
0aa171e9 | 34 | if (crypto_ecdh_decode_key(buf, len, ¶ms) < 0 || |
6763f5ea | 35 | params.key_size > sizeof(u64) * ctx->ndigits) |
3c4b2390 SB |
36 | return -EINVAL; |
37 | ||
73e5984e JV |
38 | memset(ctx->private_key, 0, sizeof(ctx->private_key)); |
39 | ||
6755fd26 TDA |
40 | if (!params.key || !params.key_size) |
41 | return ecc_gen_privkey(ctx->curve_id, ctx->ndigits, | |
42 | ctx->private_key); | |
43 | ||
3c4b2390 | 44 | memcpy(ctx->private_key, params.key, params.key_size); |
bd955a4e | 45 | ecc_swap_digits(ctx->private_key, priv, ctx->ndigits); |
3c4b2390 | 46 | |
17858b14 | 47 | if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits, |
bd955a4e | 48 | priv, params.key_size) < 0) { |
17858b14 | 49 | memzero_explicit(ctx->private_key, params.key_size); |
bd955a4e | 50 | ret = -EINVAL; |
17858b14 | 51 | } |
bd955a4e SB |
52 | memzero_explicit(priv, sizeof(priv)); |
53 | ||
54 | return ret; | |
3c4b2390 SB |
55 | } |
56 | ||
57 | static int ecdh_compute_value(struct kpp_request *req) | |
58 | { | |
3c4b2390 SB |
59 | struct crypto_kpp *tfm = crypto_kpp_reqtfm(req); |
60 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
952035ba TDA |
61 | u64 *public_key; |
62 | u64 *shared_secret = NULL; | |
3c4b2390 | 63 | void *buf; |
952035ba TDA |
64 | size_t copied, nbytes, public_key_sz; |
65 | int ret = -ENOMEM; | |
3c4b2390 SB |
66 | |
67 | nbytes = ctx->ndigits << ECC_DIGITS_TO_BYTES_SHIFT; | |
952035ba TDA |
68 | /* Public part is a point thus it has both coordinates */ |
69 | public_key_sz = 2 * nbytes; | |
70 | ||
71 | public_key = kmalloc(public_key_sz, GFP_KERNEL); | |
72 | if (!public_key) | |
73 | return -ENOMEM; | |
3c4b2390 SB |
74 | |
75 | if (req->src) { | |
952035ba TDA |
76 | shared_secret = kmalloc(nbytes, GFP_KERNEL); |
77 | if (!shared_secret) | |
78 | goto free_pubkey; | |
79 | ||
95ec01ba JB |
80 | /* from here on it's invalid parameters */ |
81 | ret = -EINVAL; | |
82 | ||
83 | /* must have exactly two points to be on the curve */ | |
84 | if (public_key_sz != req->src_len) | |
85 | goto free_all; | |
86 | ||
87 | copied = sg_copy_to_buffer(req->src, | |
88 | sg_nents_for_len(req->src, | |
89 | public_key_sz), | |
90 | public_key, public_key_sz); | |
91 | if (copied != public_key_sz) | |
952035ba | 92 | goto free_all; |
3c4b2390 | 93 | |
8f44df15 | 94 | ret = crypto_ecdh_shared_secret(ctx->curve_id, ctx->ndigits, |
952035ba TDA |
95 | ctx->private_key, public_key, |
96 | shared_secret); | |
3c4b2390 | 97 | |
952035ba | 98 | buf = shared_secret; |
3c4b2390 | 99 | } else { |
7380c56d | 100 | ret = ecc_make_pub_key(ctx->curve_id, ctx->ndigits, |
952035ba TDA |
101 | ctx->private_key, public_key); |
102 | buf = public_key; | |
103 | nbytes = public_key_sz; | |
3c4b2390 SB |
104 | } |
105 | ||
106 | if (ret < 0) | |
952035ba | 107 | goto free_all; |
3c4b2390 | 108 | |
95ec01ba JB |
109 | /* might want less than we've got */ |
110 | nbytes = min_t(size_t, nbytes, req->dst_len); | |
111 | copied = sg_copy_from_buffer(req->dst, sg_nents_for_len(req->dst, | |
112 | nbytes), | |
113 | buf, nbytes); | |
3c4b2390 | 114 | if (copied != nbytes) |
952035ba | 115 | ret = -EINVAL; |
3c4b2390 | 116 | |
952035ba TDA |
117 | /* fall through */ |
118 | free_all: | |
453431a5 | 119 | kfree_sensitive(shared_secret); |
952035ba TDA |
120 | free_pubkey: |
121 | kfree(public_key); | |
3c4b2390 SB |
122 | return ret; |
123 | } | |
124 | ||
d0efb48b | 125 | static unsigned int ecdh_max_size(struct crypto_kpp *tfm) |
3c4b2390 SB |
126 | { |
127 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
3c4b2390 | 128 | |
d0efb48b TDA |
129 | /* Public key is made of two coordinates, add one to the left shift */ |
130 | return ctx->ndigits << (ECC_DIGITS_TO_BYTES_SHIFT + 1); | |
3c4b2390 SB |
131 | } |
132 | ||
6763f5ea MY |
133 | static int ecdh_nist_p192_init_tfm(struct crypto_kpp *tfm) |
134 | { | |
135 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
136 | ||
137 | ctx->curve_id = ECC_CURVE_NIST_P192; | |
138 | ctx->ndigits = ECC_CURVE_NIST_P192_DIGITS; | |
139 | ||
140 | return 0; | |
141 | } | |
142 | ||
143 | static struct kpp_alg ecdh_nist_p192 = { | |
3c4b2390 SB |
144 | .set_secret = ecdh_set_secret, |
145 | .generate_public_key = ecdh_compute_value, | |
146 | .compute_shared_secret = ecdh_compute_value, | |
147 | .max_size = ecdh_max_size, | |
6763f5ea | 148 | .init = ecdh_nist_p192_init_tfm, |
3c4b2390 | 149 | .base = { |
6763f5ea | 150 | .cra_name = "ecdh-nist-p192", |
c5ae16f5 | 151 | .cra_driver_name = "ecdh-nist-p192-generic", |
3c4b2390 SB |
152 | .cra_priority = 100, |
153 | .cra_module = THIS_MODULE, | |
154 | .cra_ctxsize = sizeof(struct ecdh_ctx), | |
155 | }, | |
156 | }; | |
157 | ||
6763f5ea MY |
158 | static int ecdh_nist_p256_init_tfm(struct crypto_kpp *tfm) |
159 | { | |
160 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
161 | ||
162 | ctx->curve_id = ECC_CURVE_NIST_P256; | |
163 | ctx->ndigits = ECC_CURVE_NIST_P256_DIGITS; | |
164 | ||
165 | return 0; | |
166 | } | |
167 | ||
168 | static struct kpp_alg ecdh_nist_p256 = { | |
169 | .set_secret = ecdh_set_secret, | |
170 | .generate_public_key = ecdh_compute_value, | |
171 | .compute_shared_secret = ecdh_compute_value, | |
172 | .max_size = ecdh_max_size, | |
173 | .init = ecdh_nist_p256_init_tfm, | |
174 | .base = { | |
175 | .cra_name = "ecdh-nist-p256", | |
c5ae16f5 | 176 | .cra_driver_name = "ecdh-nist-p256-generic", |
6763f5ea MY |
177 | .cra_priority = 100, |
178 | .cra_module = THIS_MODULE, | |
179 | .cra_ctxsize = sizeof(struct ecdh_ctx), | |
180 | }, | |
181 | }; | |
182 | ||
81541325 HT |
183 | static int ecdh_nist_p384_init_tfm(struct crypto_kpp *tfm) |
184 | { | |
185 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); | |
186 | ||
187 | ctx->curve_id = ECC_CURVE_NIST_P384; | |
188 | ctx->ndigits = ECC_CURVE_NIST_P384_DIGITS; | |
189 | ||
190 | return 0; | |
191 | } | |
192 | ||
193 | static struct kpp_alg ecdh_nist_p384 = { | |
194 | .set_secret = ecdh_set_secret, | |
195 | .generate_public_key = ecdh_compute_value, | |
196 | .compute_shared_secret = ecdh_compute_value, | |
197 | .max_size = ecdh_max_size, | |
198 | .init = ecdh_nist_p384_init_tfm, | |
199 | .base = { | |
200 | .cra_name = "ecdh-nist-p384", | |
201 | .cra_driver_name = "ecdh-nist-p384-generic", | |
202 | .cra_priority = 100, | |
203 | .cra_module = THIS_MODULE, | |
204 | .cra_ctxsize = sizeof(struct ecdh_ctx), | |
205 | }, | |
206 | }; | |
207 | ||
6763f5ea MY |
208 | static bool ecdh_nist_p192_registered; |
209 | ||
33837be3 | 210 | static int __init ecdh_init(void) |
3c4b2390 | 211 | { |
6763f5ea MY |
212 | int ret; |
213 | ||
6889fc21 | 214 | /* NIST p192 will fail to register in FIPS mode */ |
6763f5ea MY |
215 | ret = crypto_register_kpp(&ecdh_nist_p192); |
216 | ecdh_nist_p192_registered = ret == 0; | |
217 | ||
8fd28fa5 HT |
218 | ret = crypto_register_kpp(&ecdh_nist_p256); |
219 | if (ret) | |
220 | goto nist_p256_error; | |
221 | ||
81541325 HT |
222 | ret = crypto_register_kpp(&ecdh_nist_p384); |
223 | if (ret) | |
224 | goto nist_p384_error; | |
225 | ||
8fd28fa5 HT |
226 | return 0; |
227 | ||
81541325 HT |
228 | nist_p384_error: |
229 | crypto_unregister_kpp(&ecdh_nist_p256); | |
230 | ||
8fd28fa5 HT |
231 | nist_p256_error: |
232 | if (ecdh_nist_p192_registered) | |
233 | crypto_unregister_kpp(&ecdh_nist_p192); | |
234 | return ret; | |
3c4b2390 SB |
235 | } |
236 | ||
33837be3 | 237 | static void __exit ecdh_exit(void) |
3c4b2390 | 238 | { |
6763f5ea MY |
239 | if (ecdh_nist_p192_registered) |
240 | crypto_unregister_kpp(&ecdh_nist_p192); | |
241 | crypto_unregister_kpp(&ecdh_nist_p256); | |
81541325 | 242 | crypto_unregister_kpp(&ecdh_nist_p384); |
3c4b2390 SB |
243 | } |
244 | ||
c4741b23 | 245 | subsys_initcall(ecdh_init); |
3c4b2390 SB |
246 | module_exit(ecdh_exit); |
247 | MODULE_ALIAS_CRYPTO("ecdh"); | |
248 | MODULE_LICENSE("GPL"); | |
249 | MODULE_DESCRIPTION("ECDH generic algorithm"); |