1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* ECDH key-agreement protocol |
3 | * |
4 | * Copyright (c) 2016, Intel Corporation |
5 | * Authors: Salvator Benedetto <salvatore.benedetto@intel.com> |
6 | */ |
7 | |
8 | #include <linux/module.h> |
9 | #include <crypto/internal/ecc.h> |
10 | #include <crypto/internal/kpp.h> |
11 | #include <crypto/kpp.h> |
12 | #include <crypto/ecdh.h> |
13 | #include <linux/scatterlist.h> |
14 | |
15 | struct ecdh_ctx { |
16 | unsigned int curve_id; |
17 | unsigned int ndigits; |
18 | u64 private_key[ECC_MAX_DIGITS]; |
19 | }; |
20 | |
21 | static inline struct ecdh_ctx *ecdh_get_ctx(struct crypto_kpp *tfm) |
22 | { |
23 | return kpp_tfm_ctx(tfm); |
24 | } |
25 | |
26 | static int ecdh_set_secret(struct crypto_kpp *tfm, const void *buf, |
27 | unsigned int len) |
28 | { |
29 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); |
30 | struct ecdh params; |
31 | |
32 | if (crypto_ecdh_decode_key(buf, len, p: ¶ms) < 0 || |
33 | params.key_size > sizeof(u64) * ctx->ndigits) |
34 | return -EINVAL; |
35 | |
36 | if (!params.key || !params.key_size) |
37 | return ecc_gen_privkey(curve_id: ctx->curve_id, ndigits: ctx->ndigits, |
38 | privkey: ctx->private_key); |
39 | |
40 | memcpy(ctx->private_key, params.key, params.key_size); |
41 | |
42 | if (ecc_is_key_valid(curve_id: ctx->curve_id, ndigits: ctx->ndigits, |
43 | private_key: ctx->private_key, private_key_len: params.key_size) < 0) { |
44 | memzero_explicit(s: ctx->private_key, count: params.key_size); |
45 | return -EINVAL; |
46 | } |
47 | return 0; |
48 | } |
49 | |
50 | static int ecdh_compute_value(struct kpp_request *req) |
51 | { |
52 | struct crypto_kpp *tfm = crypto_kpp_reqtfm(req); |
53 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); |
54 | u64 *public_key; |
55 | u64 *shared_secret = NULL; |
56 | void *buf; |
57 | size_t copied, nbytes, public_key_sz; |
58 | int ret = -ENOMEM; |
59 | |
60 | nbytes = ctx->ndigits << ECC_DIGITS_TO_BYTES_SHIFT; |
61 | /* Public part is a point thus it has both coordinates */ |
62 | public_key_sz = 2 * nbytes; |
63 | |
64 | public_key = kmalloc(size: public_key_sz, GFP_KERNEL); |
65 | if (!public_key) |
66 | return -ENOMEM; |
67 | |
68 | if (req->src) { |
69 | shared_secret = kmalloc(size: nbytes, GFP_KERNEL); |
70 | if (!shared_secret) |
71 | goto free_pubkey; |
72 | |
73 | /* from here on it's invalid parameters */ |
74 | ret = -EINVAL; |
75 | |
76 | /* must have exactly two points to be on the curve */ |
77 | if (public_key_sz != req->src_len) |
78 | goto free_all; |
79 | |
80 | copied = sg_copy_to_buffer(sgl: req->src, |
81 | nents: sg_nents_for_len(sg: req->src, |
82 | len: public_key_sz), |
83 | buf: public_key, buflen: public_key_sz); |
84 | if (copied != public_key_sz) |
85 | goto free_all; |
86 | |
87 | ret = crypto_ecdh_shared_secret(curve_id: ctx->curve_id, ndigits: ctx->ndigits, |
88 | private_key: ctx->private_key, public_key, |
89 | secret: shared_secret); |
90 | |
91 | buf = shared_secret; |
92 | } else { |
93 | ret = ecc_make_pub_key(curve_id: ctx->curve_id, ndigits: ctx->ndigits, |
94 | private_key: ctx->private_key, public_key); |
95 | buf = public_key; |
96 | nbytes = public_key_sz; |
97 | } |
98 | |
99 | if (ret < 0) |
100 | goto free_all; |
101 | |
102 | /* might want less than we've got */ |
103 | nbytes = min_t(size_t, nbytes, req->dst_len); |
104 | copied = sg_copy_from_buffer(sgl: req->dst, nents: sg_nents_for_len(sg: req->dst, |
105 | len: nbytes), |
106 | buf, buflen: nbytes); |
107 | if (copied != nbytes) |
108 | ret = -EINVAL; |
109 | |
110 | /* fall through */ |
111 | free_all: |
112 | kfree_sensitive(objp: shared_secret); |
113 | free_pubkey: |
114 | kfree(objp: public_key); |
115 | return ret; |
116 | } |
117 | |
118 | static unsigned int ecdh_max_size(struct crypto_kpp *tfm) |
119 | { |
120 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); |
121 | |
122 | /* Public key is made of two coordinates, add one to the left shift */ |
123 | return ctx->ndigits << (ECC_DIGITS_TO_BYTES_SHIFT + 1); |
124 | } |
125 | |
126 | static int ecdh_nist_p192_init_tfm(struct crypto_kpp *tfm) |
127 | { |
128 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); |
129 | |
130 | ctx->curve_id = ECC_CURVE_NIST_P192; |
131 | ctx->ndigits = ECC_CURVE_NIST_P192_DIGITS; |
132 | |
133 | return 0; |
134 | } |
135 | |
136 | static struct kpp_alg ecdh_nist_p192 = { |
137 | .set_secret = ecdh_set_secret, |
138 | .generate_public_key = ecdh_compute_value, |
139 | .compute_shared_secret = ecdh_compute_value, |
140 | .max_size = ecdh_max_size, |
141 | .init = ecdh_nist_p192_init_tfm, |
142 | .base = { |
143 | .cra_name = "ecdh-nist-p192" , |
144 | .cra_driver_name = "ecdh-nist-p192-generic" , |
145 | .cra_priority = 100, |
146 | .cra_module = THIS_MODULE, |
147 | .cra_ctxsize = sizeof(struct ecdh_ctx), |
148 | }, |
149 | }; |
150 | |
151 | static int ecdh_nist_p256_init_tfm(struct crypto_kpp *tfm) |
152 | { |
153 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); |
154 | |
155 | ctx->curve_id = ECC_CURVE_NIST_P256; |
156 | ctx->ndigits = ECC_CURVE_NIST_P256_DIGITS; |
157 | |
158 | return 0; |
159 | } |
160 | |
161 | static struct kpp_alg ecdh_nist_p256 = { |
162 | .set_secret = ecdh_set_secret, |
163 | .generate_public_key = ecdh_compute_value, |
164 | .compute_shared_secret = ecdh_compute_value, |
165 | .max_size = ecdh_max_size, |
166 | .init = ecdh_nist_p256_init_tfm, |
167 | .base = { |
168 | .cra_name = "ecdh-nist-p256" , |
169 | .cra_driver_name = "ecdh-nist-p256-generic" , |
170 | .cra_priority = 100, |
171 | .cra_module = THIS_MODULE, |
172 | .cra_ctxsize = sizeof(struct ecdh_ctx), |
173 | }, |
174 | }; |
175 | |
176 | static int ecdh_nist_p384_init_tfm(struct crypto_kpp *tfm) |
177 | { |
178 | struct ecdh_ctx *ctx = ecdh_get_ctx(tfm); |
179 | |
180 | ctx->curve_id = ECC_CURVE_NIST_P384; |
181 | ctx->ndigits = ECC_CURVE_NIST_P384_DIGITS; |
182 | |
183 | return 0; |
184 | } |
185 | |
186 | static struct kpp_alg ecdh_nist_p384 = { |
187 | .set_secret = ecdh_set_secret, |
188 | .generate_public_key = ecdh_compute_value, |
189 | .compute_shared_secret = ecdh_compute_value, |
190 | .max_size = ecdh_max_size, |
191 | .init = ecdh_nist_p384_init_tfm, |
192 | .base = { |
193 | .cra_name = "ecdh-nist-p384" , |
194 | .cra_driver_name = "ecdh-nist-p384-generic" , |
195 | .cra_priority = 100, |
196 | .cra_module = THIS_MODULE, |
197 | .cra_ctxsize = sizeof(struct ecdh_ctx), |
198 | }, |
199 | }; |
200 | |
201 | static bool ecdh_nist_p192_registered; |
202 | |
203 | static int __init ecdh_init(void) |
204 | { |
205 | int ret; |
206 | |
207 | /* NIST p192 will fail to register in FIPS mode */ |
208 | ret = crypto_register_kpp(alg: &ecdh_nist_p192); |
209 | ecdh_nist_p192_registered = ret == 0; |
210 | |
211 | ret = crypto_register_kpp(alg: &ecdh_nist_p256); |
212 | if (ret) |
213 | goto nist_p256_error; |
214 | |
215 | ret = crypto_register_kpp(alg: &ecdh_nist_p384); |
216 | if (ret) |
217 | goto nist_p384_error; |
218 | |
219 | return 0; |
220 | |
221 | nist_p384_error: |
222 | crypto_unregister_kpp(alg: &ecdh_nist_p256); |
223 | |
224 | nist_p256_error: |
225 | if (ecdh_nist_p192_registered) |
226 | crypto_unregister_kpp(alg: &ecdh_nist_p192); |
227 | return ret; |
228 | } |
229 | |
230 | static void __exit ecdh_exit(void) |
231 | { |
232 | if (ecdh_nist_p192_registered) |
233 | crypto_unregister_kpp(alg: &ecdh_nist_p192); |
234 | crypto_unregister_kpp(alg: &ecdh_nist_p256); |
235 | crypto_unregister_kpp(alg: &ecdh_nist_p384); |
236 | } |
237 | |
238 | subsys_initcall(ecdh_init); |
239 | module_exit(ecdh_exit); |
240 | MODULE_ALIAS_CRYPTO("ecdh" ); |
241 | MODULE_LICENSE("GPL" ); |
242 | MODULE_DESCRIPTION("ECDH generic algorithm" ); |
243 | |