1 | /* |
2 | * Copyright (c) 2013, Kenneth MacKay |
3 | * All rights reserved. |
4 | * |
5 | * Redistribution and use in source and binary forms, with or without |
6 | * modification, are permitted provided that the following conditions are |
7 | * met: |
8 | * * Redistributions of source code must retain the above copyright |
9 | * notice, this list of conditions and the following disclaimer. |
10 | * * Redistributions in binary form must reproduce the above copyright |
11 | * notice, this list of conditions and the following disclaimer in the |
12 | * documentation and/or other materials provided with the distribution. |
13 | * |
14 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
15 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
16 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
17 | * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
18 | * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
19 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
20 | * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
21 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
22 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
23 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
24 | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
25 | */ |
26 | #ifndef _CRYPTO_ECC_H |
27 | #define _CRYPTO_ECC_H |
28 | |
29 | #include <crypto/ecc_curve.h> |
30 | #include <asm/unaligned.h> |
31 | |
32 | /* One digit is u64 qword. */ |
33 | #define ECC_CURVE_NIST_P192_DIGITS 3 |
34 | #define ECC_CURVE_NIST_P256_DIGITS 4 |
35 | #define ECC_CURVE_NIST_P384_DIGITS 6 |
36 | #define ECC_MAX_DIGITS (512 / 64) /* due to ecrdsa */ |
37 | |
38 | #define ECC_DIGITS_TO_BYTES_SHIFT 3 |
39 | |
40 | #define ECC_MAX_BYTES (ECC_MAX_DIGITS << ECC_DIGITS_TO_BYTES_SHIFT) |
41 | |
42 | #define ECC_POINT_INIT(x, y, ndigits) (struct ecc_point) { x, y, ndigits } |
43 | |
44 | /** |
45 | * ecc_swap_digits() - Copy ndigits from big endian array to native array |
46 | * @in: Input array |
47 | * @out: Output array |
48 | * @ndigits: Number of digits to copy |
49 | */ |
50 | static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigits) |
51 | { |
52 | const __be64 *src = (__force __be64 *)in; |
53 | int i; |
54 | |
55 | for (i = 0; i < ndigits; i++) |
56 | out[i] = get_unaligned_be64(p: &src[ndigits - 1 - i]); |
57 | } |
58 | |
59 | /** |
60 | * ecc_is_key_valid() - Validate a given ECDH private key |
61 | * |
62 | * @curve_id: id representing the curve to use |
63 | * @ndigits: curve's number of digits |
64 | * @private_key: private key to be used for the given curve |
65 | * @private_key_len: private key length |
66 | * |
67 | * Returns 0 if the key is acceptable, a negative value otherwise |
68 | */ |
69 | int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits, |
70 | const u64 *private_key, unsigned int private_key_len); |
71 | |
72 | /** |
73 | * ecc_gen_privkey() - Generates an ECC private key. |
74 | * The private key is a random integer in the range 0 < random < n, where n is a |
75 | * prime that is the order of the cyclic subgroup generated by the distinguished |
76 | * point G. |
77 | * @curve_id: id representing the curve to use |
78 | * @ndigits: curve number of digits |
79 | * @private_key: buffer for storing the generated private key |
80 | * |
81 | * Returns 0 if the private key was generated successfully, a negative value |
82 | * if an error occurred. |
83 | */ |
84 | int ecc_gen_privkey(unsigned int curve_id, unsigned int ndigits, u64 *privkey); |
85 | |
86 | /** |
87 | * ecc_make_pub_key() - Compute an ECC public key |
88 | * |
89 | * @curve_id: id representing the curve to use |
90 | * @ndigits: curve's number of digits |
91 | * @private_key: pregenerated private key for the given curve |
92 | * @public_key: buffer for storing the generated public key |
93 | * |
94 | * Returns 0 if the public key was generated successfully, a negative value |
95 | * if an error occurred. |
96 | */ |
97 | int ecc_make_pub_key(const unsigned int curve_id, unsigned int ndigits, |
98 | const u64 *private_key, u64 *public_key); |
99 | |
100 | /** |
101 | * crypto_ecdh_shared_secret() - Compute a shared secret |
102 | * |
103 | * @curve_id: id representing the curve to use |
104 | * @ndigits: curve's number of digits |
105 | * @private_key: private key of part A |
106 | * @public_key: public key of counterpart B |
107 | * @secret: buffer for storing the calculated shared secret |
108 | * |
109 | * Note: It is recommended that you hash the result of crypto_ecdh_shared_secret |
110 | * before using it for symmetric encryption or HMAC. |
111 | * |
112 | * Returns 0 if the shared secret was generated successfully, a negative value |
113 | * if an error occurred. |
114 | */ |
115 | int crypto_ecdh_shared_secret(unsigned int curve_id, unsigned int ndigits, |
116 | const u64 *private_key, const u64 *public_key, |
117 | u64 *secret); |
118 | |
119 | /** |
120 | * ecc_is_pubkey_valid_partial() - Partial public key validation |
121 | * |
122 | * @curve: elliptic curve domain parameters |
123 | * @pk: public key as a point |
124 | * |
125 | * Valdiate public key according to SP800-56A section 5.6.2.3.4 ECC Partial |
126 | * Public-Key Validation Routine. |
127 | * |
128 | * Note: There is no check that the public key is in the correct elliptic curve |
129 | * subgroup. |
130 | * |
131 | * Return: 0 if validation is successful, -EINVAL if validation is failed. |
132 | */ |
133 | int ecc_is_pubkey_valid_partial(const struct ecc_curve *curve, |
134 | struct ecc_point *pk); |
135 | |
136 | /** |
137 | * ecc_is_pubkey_valid_full() - Full public key validation |
138 | * |
139 | * @curve: elliptic curve domain parameters |
140 | * @pk: public key as a point |
141 | * |
142 | * Valdiate public key according to SP800-56A section 5.6.2.3.3 ECC Full |
143 | * Public-Key Validation Routine. |
144 | * |
145 | * Return: 0 if validation is successful, -EINVAL if validation is failed. |
146 | */ |
147 | int ecc_is_pubkey_valid_full(const struct ecc_curve *curve, |
148 | struct ecc_point *pk); |
149 | |
150 | /** |
151 | * vli_is_zero() - Determine is vli is zero |
152 | * |
153 | * @vli: vli to check. |
154 | * @ndigits: length of the @vli |
155 | */ |
156 | bool vli_is_zero(const u64 *vli, unsigned int ndigits); |
157 | |
158 | /** |
159 | * vli_cmp() - compare left and right vlis |
160 | * |
161 | * @left: vli |
162 | * @right: vli |
163 | * @ndigits: length of both vlis |
164 | * |
165 | * Returns sign of @left - @right, i.e. -1 if @left < @right, |
166 | * 0 if @left == @right, 1 if @left > @right. |
167 | */ |
168 | int vli_cmp(const u64 *left, const u64 *right, unsigned int ndigits); |
169 | |
170 | /** |
171 | * vli_sub() - Subtracts right from left |
172 | * |
173 | * @result: where to write result |
174 | * @left: vli |
175 | * @right vli |
176 | * @ndigits: length of all vlis |
177 | * |
178 | * Note: can modify in-place. |
179 | * |
180 | * Return: carry bit. |
181 | */ |
182 | u64 vli_sub(u64 *result, const u64 *left, const u64 *right, |
183 | unsigned int ndigits); |
184 | |
185 | /** |
186 | * vli_from_be64() - Load vli from big-endian u64 array |
187 | * |
188 | * @dest: destination vli |
189 | * @src: source array of u64 BE values |
190 | * @ndigits: length of both vli and array |
191 | */ |
192 | void vli_from_be64(u64 *dest, const void *src, unsigned int ndigits); |
193 | |
194 | /** |
195 | * vli_from_le64() - Load vli from little-endian u64 array |
196 | * |
197 | * @dest: destination vli |
198 | * @src: source array of u64 LE values |
199 | * @ndigits: length of both vli and array |
200 | */ |
201 | void vli_from_le64(u64 *dest, const void *src, unsigned int ndigits); |
202 | |
203 | /** |
204 | * vli_mod_inv() - Modular inversion |
205 | * |
206 | * @result: where to write vli number |
207 | * @input: vli value to operate on |
208 | * @mod: modulus |
209 | * @ndigits: length of all vlis |
210 | */ |
211 | void vli_mod_inv(u64 *result, const u64 *input, const u64 *mod, |
212 | unsigned int ndigits); |
213 | |
214 | /** |
215 | * vli_mod_mult_slow() - Modular multiplication |
216 | * |
217 | * @result: where to write result value |
218 | * @left: vli number to multiply with @right |
219 | * @right: vli number to multiply with @left |
220 | * @mod: modulus |
221 | * @ndigits: length of all vlis |
222 | * |
223 | * Note: Assumes that mod is big enough curve order. |
224 | */ |
225 | void vli_mod_mult_slow(u64 *result, const u64 *left, const u64 *right, |
226 | const u64 *mod, unsigned int ndigits); |
227 | |
228 | /** |
229 | * vli_num_bits() - Counts the number of bits required for vli. |
230 | * |
231 | * @vli: vli to check. |
232 | * @ndigits: Length of the @vli |
233 | * |
234 | * Return: The number of bits required to represent @vli. |
235 | */ |
236 | unsigned int vli_num_bits(const u64 *vli, unsigned int ndigits); |
237 | |
238 | /** |
239 | * ecc_aloc_point() - Allocate ECC point. |
240 | * |
241 | * @ndigits: Length of vlis in u64 qwords. |
242 | * |
243 | * Return: Pointer to the allocated point or NULL if allocation failed. |
244 | */ |
245 | struct ecc_point *ecc_alloc_point(unsigned int ndigits); |
246 | |
247 | /** |
248 | * ecc_free_point() - Free ECC point. |
249 | * |
250 | * @p: The point to free. |
251 | */ |
252 | void ecc_free_point(struct ecc_point *p); |
253 | |
254 | /** |
255 | * ecc_point_is_zero() - Check if point is zero. |
256 | * |
257 | * @p: Point to check for zero. |
258 | * |
259 | * Return: true if point is the point at infinity, false otherwise. |
260 | */ |
261 | bool ecc_point_is_zero(const struct ecc_point *point); |
262 | |
263 | /** |
264 | * ecc_point_mult_shamir() - Add two points multiplied by scalars |
265 | * |
266 | * @result: resulting point |
267 | * @x: scalar to multiply with @p |
268 | * @p: point to multiply with @x |
269 | * @y: scalar to multiply with @q |
270 | * @q: point to multiply with @y |
271 | * @curve: curve |
272 | * |
273 | * Returns result = x * p + x * q over the curve. |
274 | * This works faster than two multiplications and addition. |
275 | */ |
276 | void ecc_point_mult_shamir(const struct ecc_point *result, |
277 | const u64 *x, const struct ecc_point *p, |
278 | const u64 *y, const struct ecc_point *q, |
279 | const struct ecc_curve *curve); |
280 | |
281 | #endif |
282 | |