dh.c 5.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* Diffie-Hellman Key Agreement Method [RFC2631]
  3. *
  4. * Copyright (c) 2016, Intel Corporation
  5. * Authors: Salvatore Benedetto <salvatore.benedetto@intel.com>
  6. */
  7. #include <linux/module.h>
  8. #include <crypto/internal/kpp.h>
  9. #include <crypto/kpp.h>
  10. #include <crypto/dh.h>
  11. #include <linux/fips.h>
  12. #include <linux/mpi.h>
  13. struct dh_ctx {
  14. MPI p; /* Value is guaranteed to be set. */
  15. MPI q; /* Value is optional. */
  16. MPI g; /* Value is guaranteed to be set. */
  17. MPI xa; /* Value is guaranteed to be set. */
  18. };
  19. static void dh_clear_ctx(struct dh_ctx *ctx)
  20. {
  21. mpi_free(ctx->p);
  22. mpi_free(ctx->q);
  23. mpi_free(ctx->g);
  24. mpi_free(ctx->xa);
  25. memset(ctx, 0, sizeof(*ctx));
  26. }
  27. /*
  28. * If base is g we compute the public key
  29. * ya = g^xa mod p; [RFC2631 sec 2.1.1]
  30. * else if base if the counterpart public key we compute the shared secret
  31. * ZZ = yb^xa mod p; [RFC2631 sec 2.1.1]
  32. */
  33. static int _compute_val(const struct dh_ctx *ctx, MPI base, MPI val)
  34. {
  35. /* val = base^xa mod p */
  36. return mpi_powm(val, base, ctx->xa, ctx->p);
  37. }
  38. static inline struct dh_ctx *dh_get_ctx(struct crypto_kpp *tfm)
  39. {
  40. return kpp_tfm_ctx(tfm);
  41. }
  42. static int dh_check_params_length(unsigned int p_len)
  43. {
  44. return (p_len < 1536) ? -EINVAL : 0;
  45. }
  46. static int dh_set_params(struct dh_ctx *ctx, struct dh *params)
  47. {
  48. if (dh_check_params_length(params->p_size << 3))
  49. return -EINVAL;
  50. ctx->p = mpi_read_raw_data(params->p, params->p_size);
  51. if (!ctx->p)
  52. return -EINVAL;
  53. if (params->q && params->q_size) {
  54. ctx->q = mpi_read_raw_data(params->q, params->q_size);
  55. if (!ctx->q)
  56. return -EINVAL;
  57. }
  58. ctx->g = mpi_read_raw_data(params->g, params->g_size);
  59. if (!ctx->g)
  60. return -EINVAL;
  61. return 0;
  62. }
  63. static int dh_set_secret(struct crypto_kpp *tfm, const void *buf,
  64. unsigned int len)
  65. {
  66. struct dh_ctx *ctx = dh_get_ctx(tfm);
  67. struct dh params;
  68. /* Free the old MPI key if any */
  69. dh_clear_ctx(ctx);
  70. if (crypto_dh_decode_key(buf, len, &params) < 0)
  71. goto err_clear_ctx;
  72. if (dh_set_params(ctx, &params) < 0)
  73. goto err_clear_ctx;
  74. ctx->xa = mpi_read_raw_data(params.key, params.key_size);
  75. if (!ctx->xa)
  76. goto err_clear_ctx;
  77. return 0;
  78. err_clear_ctx:
  79. dh_clear_ctx(ctx);
  80. return -EINVAL;
  81. }
  82. /*
  83. * SP800-56A public key verification:
  84. *
  85. * * If Q is provided as part of the domain paramenters, a full validation
  86. * according to SP800-56A section 5.6.2.3.1 is performed.
  87. *
  88. * * If Q is not provided, a partial validation according to SP800-56A section
  89. * 5.6.2.3.2 is performed.
  90. */
  91. static int dh_is_pubkey_valid(struct dh_ctx *ctx, MPI y)
  92. {
  93. if (unlikely(!ctx->p))
  94. return -EINVAL;
  95. /*
  96. * Step 1: Verify that 2 <= y <= p - 2.
  97. *
  98. * The upper limit check is actually y < p instead of y < p - 1
  99. * as the mpi_sub_ui function is yet missing.
  100. */
  101. if (mpi_cmp_ui(y, 1) < 1 || mpi_cmp(y, ctx->p) >= 0)
  102. return -EINVAL;
  103. /* Step 2: Verify that 1 = y^q mod p */
  104. if (ctx->q) {
  105. MPI val = mpi_alloc(0);
  106. int ret;
  107. if (!val)
  108. return -ENOMEM;
  109. ret = mpi_powm(val, y, ctx->q, ctx->p);
  110. if (ret) {
  111. mpi_free(val);
  112. return ret;
  113. }
  114. ret = mpi_cmp_ui(val, 1);
  115. mpi_free(val);
  116. if (ret != 0)
  117. return -EINVAL;
  118. }
  119. return 0;
  120. }
  121. static int dh_compute_value(struct kpp_request *req)
  122. {
  123. struct crypto_kpp *tfm = crypto_kpp_reqtfm(req);
  124. struct dh_ctx *ctx = dh_get_ctx(tfm);
  125. MPI base, val = mpi_alloc(0);
  126. int ret = 0;
  127. int sign;
  128. if (!val)
  129. return -ENOMEM;
  130. if (unlikely(!ctx->xa)) {
  131. ret = -EINVAL;
  132. goto err_free_val;
  133. }
  134. if (req->src) {
  135. base = mpi_read_raw_from_sgl(req->src, req->src_len);
  136. if (!base) {
  137. ret = -EINVAL;
  138. goto err_free_val;
  139. }
  140. ret = dh_is_pubkey_valid(ctx, base);
  141. if (ret)
  142. goto err_free_base;
  143. } else {
  144. base = ctx->g;
  145. }
  146. ret = _compute_val(ctx, base, val);
  147. if (ret)
  148. goto err_free_base;
  149. if (fips_enabled) {
  150. /* SP800-56A rev3 5.7.1.1 check: Validation of shared secret */
  151. if (req->src) {
  152. MPI pone;
  153. /* z <= 1 */
  154. if (mpi_cmp_ui(val, 1) < 1) {
  155. ret = -EBADMSG;
  156. goto err_free_base;
  157. }
  158. /* z == p - 1 */
  159. pone = mpi_alloc(0);
  160. if (!pone) {
  161. ret = -ENOMEM;
  162. goto err_free_base;
  163. }
  164. ret = mpi_sub_ui(pone, ctx->p, 1);
  165. if (!ret && !mpi_cmp(pone, val))
  166. ret = -EBADMSG;
  167. mpi_free(pone);
  168. if (ret)
  169. goto err_free_base;
  170. /* SP800-56A rev 3 5.6.2.1.3 key check */
  171. } else {
  172. if (dh_is_pubkey_valid(ctx, val)) {
  173. ret = -EAGAIN;
  174. goto err_free_val;
  175. }
  176. }
  177. }
  178. ret = mpi_write_to_sgl(val, req->dst, req->dst_len, &sign);
  179. if (ret)
  180. goto err_free_base;
  181. if (sign < 0)
  182. ret = -EBADMSG;
  183. err_free_base:
  184. if (req->src)
  185. mpi_free(base);
  186. err_free_val:
  187. mpi_free(val);
  188. return ret;
  189. }
  190. static unsigned int dh_max_size(struct crypto_kpp *tfm)
  191. {
  192. struct dh_ctx *ctx = dh_get_ctx(tfm);
  193. return mpi_get_size(ctx->p);
  194. }
  195. static void dh_exit_tfm(struct crypto_kpp *tfm)
  196. {
  197. struct dh_ctx *ctx = dh_get_ctx(tfm);
  198. dh_clear_ctx(ctx);
  199. }
  200. static struct kpp_alg dh = {
  201. .set_secret = dh_set_secret,
  202. .generate_public_key = dh_compute_value,
  203. .compute_shared_secret = dh_compute_value,
  204. .max_size = dh_max_size,
  205. .exit = dh_exit_tfm,
  206. .base = {
  207. .cra_name = "dh",
  208. .cra_driver_name = "dh-generic",
  209. .cra_priority = 100,
  210. .cra_module = THIS_MODULE,
  211. .cra_ctxsize = sizeof(struct dh_ctx),
  212. },
  213. };
  214. static int dh_init(void)
  215. {
  216. return crypto_register_kpp(&dh);
  217. }
  218. static void dh_exit(void)
  219. {
  220. crypto_unregister_kpp(&dh);
  221. }
  222. subsys_initcall(dh_init);
  223. module_exit(dh_exit);
  224. MODULE_ALIAS_CRYPTO("dh");
  225. MODULE_LICENSE("GPL");
  226. MODULE_DESCRIPTION("DH generic algorithm");