crypto/ecdsa.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * Copyright (c) 2021 IBM Corporation
   4  */
   5
   6 #include <linux/module.h>
   7 #include <crypto/internal/ecc.h>
   8 #include <crypto/internal/sig.h>
   9 #include <crypto/ecdh.h>
  10 #include <crypto/sha2.h>
  11 #include <crypto/sig.h>
  12
  13 struct ecc_ctx {
  14         unsigned int curve_id;
  15         const struct ecc_curve *curve;
  16
  17         bool pub_key_set;
  18         u64 x[ECC_MAX_DIGITS]; /* pub key x and y coordinates */
  19         u64 y[ECC_MAX_DIGITS];
  20         struct ecc_point pub_key;
  21 };
  22
  23 static int _ecdsa_verify(struct ecc_ctx *ctx, const u64 *hash, const u64 *r, const u64 *s)
  24 {
  25         const struct ecc_curve *curve = ctx->curve;
  26         unsigned int ndigits = curve->g.ndigits;
  27         u64 s1[ECC_MAX_DIGITS];
  28         u64 u1[ECC_MAX_DIGITS];
  29         u64 u2[ECC_MAX_DIGITS];
  30         u64 x1[ECC_MAX_DIGITS];
  31         u64 y1[ECC_MAX_DIGITS];
  32         struct ecc_point res = ECC_POINT_INIT(x1, y1, ndigits);
  33
  34         /* 0 < r < n  and 0 < s < n */
  35         if (vli_is_zero(r, ndigits) || vli_cmp(r, curve->n, ndigits) >= 0 ||
  36             vli_is_zero(s, ndigits) || vli_cmp(s, curve->n, ndigits) >= 0)
  37                 return -EBADMSG;
  38
  39         /* hash is given */
  40         pr_devel("hash : %016llx %016llx ... %016llx\n",
  41                  hash[ndigits - 1], hash[ndigits - 2], hash[0]);
  42
  43         /* s1 = (s^-1) mod n */
  44         vli_mod_inv(s1, s, curve->n, ndigits);
  45         /* u1 = (hash * s1) mod n */
  46         vli_mod_mult_slow(u1, hash, s1, curve->n, ndigits);
  47         /* u2 = (r * s1) mod n */
  48         vli_mod_mult_slow(u2, r, s1, curve->n, ndigits);
  49         /* res = u1*G + u2 * pub_key */
  50         ecc_point_mult_shamir(&res, u1, &curve->g, u2, &ctx->pub_key, curve);
  51
  52         /* res.x = res.x mod n (if res.x > order) */
  53         if (unlikely(vli_cmp(res.x, curve->n, ndigits) == 1))
  54                 /* faster alternative for NIST p521, p384, p256 & p192 */
  55                 vli_sub(res.x, res.x, curve->n, ndigits);
  56
  57         if (!vli_cmp(res.x, r, ndigits))
  58                 return 0;
  59
  60         return -EKEYREJECTED;
  61 }
  62
  63 /*
  64  * Verify an ECDSA signature.
  65  */
  66 static int ecdsa_verify(struct crypto_sig *tfm,
  67                         const void *src, unsigned int slen,
  68                         const void *digest, unsigned int dlen)
  69 {
  70         struct ecc_ctx *ctx = crypto_sig_ctx(tfm);
  71         size_t bufsize = ctx->curve->g.ndigits * sizeof(u64);
  72         const struct ecdsa_raw_sig *sig = src;
  73         u64 hash[ECC_MAX_DIGITS];
  74
  75         if (unlikely(!ctx->pub_key_set))
  76                 return -EINVAL;
  77
  78         if (slen != sizeof(*sig))
  79                 return -EINVAL;
  80
  81         if (bufsize > dlen)
  82                 bufsize = dlen;
  83
  84         ecc_digits_from_bytes(digest, bufsize, hash, ctx->curve->g.ndigits);
  85
  86         return _ecdsa_verify(ctx, hash, sig->r, sig->s);
  87 }
  88
  89 static int ecdsa_ecc_ctx_init(struct ecc_ctx *ctx, unsigned int curve_id)
  90 {
  91         ctx->curve_id = curve_id;
  92         ctx->curve = ecc_get_curve(curve_id);
  93         if (!ctx->curve)
  94                 return -EINVAL;
  95
  96         return 0;
  97 }
  98
  99
 100 static void ecdsa_ecc_ctx_deinit(struct ecc_ctx *ctx)
 101 {
 102         ctx->pub_key_set = false;
 103 }
 104
 105 static int ecdsa_ecc_ctx_reset(struct ecc_ctx *ctx)
 106 {
 107         unsigned int curve_id = ctx->curve_id;
 108         int ret;
 109
 110         ecdsa_ecc_ctx_deinit(ctx);
 111         ret = ecdsa_ecc_ctx_init(ctx, curve_id);
 112         if (ret == 0)
 113                 ctx->pub_key = ECC_POINT_INIT(ctx->x, ctx->y,
 114                                               ctx->curve->g.ndigits);
 115         return ret;
 116 }
 117
 118 /*
 119  * Set the public ECC key as defined by RFC5480 section 2.2 "Subject Public
 120  * Key". Only the uncompressed format is supported.
 121  */
 122 static int ecdsa_set_pub_key(struct crypto_sig *tfm, const void *key,
 123                              unsigned int keylen)
 124 {
 125         struct ecc_ctx *ctx = crypto_sig_ctx(tfm);
 126         unsigned int digitlen, ndigits;
 127         const unsigned char *d = key;
 128         int ret;
 129
 130         ret = ecdsa_ecc_ctx_reset(ctx);
 131         if (ret < 0)
 132                 return ret;
 133
 134         if (keylen < 1 || ((keylen - 1) & 1) != 0)
 135                 return -EINVAL;
 136         /* we only accept uncompressed format indicated by '4' */
 137         if (d[0] != 4)
 138                 return -EINVAL;
 139
 140         keylen--;
 141         digitlen = keylen >> 1;
 142
 143         ndigits = DIV_ROUND_UP(digitlen, sizeof(u64));
 144         if (ndigits != ctx->curve->g.ndigits)
 145                 return -EINVAL;
 146
 147         d++;
 148
 149         ecc_digits_from_bytes(d, digitlen, ctx->pub_key.x, ndigits);
 150         ecc_digits_from_bytes(&d[digitlen], digitlen, ctx->pub_key.y, ndigits);
 151
 152         ret = ecc_is_pubkey_valid_full(ctx->curve, &ctx->pub_key);
 153
 154         ctx->pub_key_set = ret == 0;
 155
 156         return ret;
 157 }
 158
 159 static void ecdsa_exit_tfm(struct crypto_sig *tfm)
 160 {
 161         struct ecc_ctx *ctx = crypto_sig_ctx(tfm);
 162
 163         ecdsa_ecc_ctx_deinit(ctx);
 164 }
 165
 166 static unsigned int ecdsa_key_size(struct crypto_sig *tfm)
 167 {
 168         struct ecc_ctx *ctx = crypto_sig_ctx(tfm);
 169
 170         return DIV_ROUND_UP(ctx->curve->nbits, 8);
 171 }
 172
 173 static unsigned int ecdsa_digest_size(struct crypto_sig *tfm)
 174 {
 175         /*
 176          * ECDSA key sizes are much smaller than RSA, and thus could
 177          * operate on (hashed) inputs that are larger than the key size.
 178          * E.g. SHA384-hashed input used with secp256r1 based keys.
 179          * Return the largest supported hash size (SHA512).
 180          */
 181         return SHA512_DIGEST_SIZE;
 182 }
 183
 184 static int ecdsa_nist_p521_init_tfm(struct crypto_sig *tfm)
 185 {
 186         struct ecc_ctx *ctx = crypto_sig_ctx(tfm);
 187
 188         return ecdsa_ecc_ctx_init(ctx, ECC_CURVE_NIST_P521);
 189 }
 190
 191 static struct sig_alg ecdsa_nist_p521 = {
 192         .verify = ecdsa_verify,
 193         .set_pub_key = ecdsa_set_pub_key,
 194         .key_size = ecdsa_key_size,
 195         .digest_size = ecdsa_digest_size,
 196         .init = ecdsa_nist_p521_init_tfm,
 197         .exit = ecdsa_exit_tfm,
 198         .base = {
 199                 .cra_name = "ecdsa-nist-p521",
 200                 .cra_driver_name = "ecdsa-nist-p521-generic",
 201                 .cra_priority = 100,
 202                 .cra_module = THIS_MODULE,
 203                 .cra_ctxsize = sizeof(struct ecc_ctx),
 204         },
 205 };
 206
 207 static int ecdsa_nist_p384_init_tfm(struct crypto_sig *tfm)
 208 {
 209         struct ecc_ctx *ctx = crypto_sig_ctx(tfm);
 210
 211         return ecdsa_ecc_ctx_init(ctx, ECC_CURVE_NIST_P384);
 212 }
 213
 214 static struct sig_alg ecdsa_nist_p384 = {
 215         .verify = ecdsa_verify,
 216         .set_pub_key = ecdsa_set_pub_key,
 217         .key_size = ecdsa_key_size,
 218         .digest_size = ecdsa_digest_size,
 219         .init = ecdsa_nist_p384_init_tfm,
 220         .exit = ecdsa_exit_tfm,
 221         .base = {
 222                 .cra_name = "ecdsa-nist-p384",
 223                 .cra_driver_name = "ecdsa-nist-p384-generic",
 224                 .cra_priority = 100,
 225                 .cra_module = THIS_MODULE,
 226                 .cra_ctxsize = sizeof(struct ecc_ctx),
 227         },
 228 };
 229
 230 static int ecdsa_nist_p256_init_tfm(struct crypto_sig *tfm)
 231 {
 232         struct ecc_ctx *ctx = crypto_sig_ctx(tfm);
 233
 234         return ecdsa_ecc_ctx_init(ctx, ECC_CURVE_NIST_P256);
 235 }
 236
 237 static struct sig_alg ecdsa_nist_p256 = {
 238         .verify = ecdsa_verify,
 239         .set_pub_key = ecdsa_set_pub_key,
 240         .key_size = ecdsa_key_size,
 241         .digest_size = ecdsa_digest_size,
 242         .init = ecdsa_nist_p256_init_tfm,
 243         .exit = ecdsa_exit_tfm,
 244         .base = {
 245                 .cra_name = "ecdsa-nist-p256",
 246                 .cra_driver_name = "ecdsa-nist-p256-generic",
 247                 .cra_priority = 100,
 248                 .cra_module = THIS_MODULE,
 249                 .cra_ctxsize = sizeof(struct ecc_ctx),
 250         },
 251 };
 252
 253 static int ecdsa_nist_p192_init_tfm(struct crypto_sig *tfm)
 254 {
 255         struct ecc_ctx *ctx = crypto_sig_ctx(tfm);
 256
 257         return ecdsa_ecc_ctx_init(ctx, ECC_CURVE_NIST_P192);
 258 }
 259
 260 static struct sig_alg ecdsa_nist_p192 = {
 261         .verify = ecdsa_verify,
 262         .set_pub_key = ecdsa_set_pub_key,
 263         .key_size = ecdsa_key_size,
 264         .digest_size = ecdsa_digest_size,
 265         .init = ecdsa_nist_p192_init_tfm,
 266         .exit = ecdsa_exit_tfm,
 267         .base = {
 268                 .cra_name = "ecdsa-nist-p192",
 269                 .cra_driver_name = "ecdsa-nist-p192-generic",
 270                 .cra_priority = 100,
 271                 .cra_module = THIS_MODULE,
 272                 .cra_ctxsize = sizeof(struct ecc_ctx),
 273         },
 274 };
 275 static bool ecdsa_nist_p192_registered;
 276
 277 static int __init ecdsa_init(void)
 278 {
 279         int ret;
 280
 281         /* NIST p192 may not be available in FIPS mode */
 282         ret = crypto_register_sig(&ecdsa_nist_p192);
 283         ecdsa_nist_p192_registered = ret == 0;
 284
 285         ret = crypto_register_sig(&ecdsa_nist_p256);
 286         if (ret)
 287                 goto nist_p256_error;
 288
 289         ret = crypto_register_sig(&ecdsa_nist_p384);
 290         if (ret)
 291                 goto nist_p384_error;
 292
 293         ret = crypto_register_sig(&ecdsa_nist_p521);
 294         if (ret)
 295                 goto nist_p521_error;
 296
 297         ret = crypto_register_template(&ecdsa_x962_tmpl);
 298         if (ret)
 299                 goto x962_tmpl_error;
 300
 301         ret = crypto_register_template(&ecdsa_p1363_tmpl);
 302         if (ret)
 303                 goto p1363_tmpl_error;
 304
 305         return 0;
 306
 307 p1363_tmpl_error:
 308         crypto_unregister_template(&ecdsa_x962_tmpl);
 309
 310 x962_tmpl_error:
 311         crypto_unregister_sig(&ecdsa_nist_p521);
 312
 313 nist_p521_error:
 314         crypto_unregister_sig(&ecdsa_nist_p384);
 315
 316 nist_p384_error:
 317         crypto_unregister_sig(&ecdsa_nist_p256);
 318
 319 nist_p256_error:
 320         if (ecdsa_nist_p192_registered)
 321                 crypto_unregister_sig(&ecdsa_nist_p192);
 322         return ret;
 323 }
 324
 325 static void __exit ecdsa_exit(void)
 326 {
 327         crypto_unregister_template(&ecdsa_x962_tmpl);
 328         crypto_unregister_template(&ecdsa_p1363_tmpl);
 329
 330         if (ecdsa_nist_p192_registered)
 331                 crypto_unregister_sig(&ecdsa_nist_p192);
 332         crypto_unregister_sig(&ecdsa_nist_p256);
 333         crypto_unregister_sig(&ecdsa_nist_p384);
 334         crypto_unregister_sig(&ecdsa_nist_p521);
 335 }
 336
 337 subsys_initcall(ecdsa_init);
 338 module_exit(ecdsa_exit);
 339
 340 MODULE_LICENSE("GPL");
 341 MODULE_AUTHOR("Stefan Berger <stefanb@linux.ibm.com>");
 342 MODULE_DESCRIPTION("ECDSA generic algorithm");
 343 MODULE_ALIAS_CRYPTO("ecdsa-nist-p192");
 344 MODULE_ALIAS_CRYPTO("ecdsa-nist-p256");
 345 MODULE_ALIAS_CRYPTO("ecdsa-nist-p384");
 346 MODULE_ALIAS_CRYPTO("ecdsa-nist-p521");
 347 MODULE_ALIAS_CRYPTO("ecdsa-generic");