ecdh.c 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* ECDH key-agreement protocol
  3. *
  4. * Copyright (c) 2016, Intel Corporation
  5. * Authors: Salvator Benedetto <salvatore.benedetto@intel.com>
  6. */
  7. #include <linux/module.h>
  8. #include <crypto/internal/kpp.h>
  9. #include <crypto/kpp.h>
  10. #include <crypto/ecdh.h>
  11. #include <linux/scatterlist.h>
  12. #include "ecc.h"
  13. struct ecdh_ctx {
  14. unsigned int curve_id;
  15. unsigned int ndigits;
  16. u64 private_key[ECC_MAX_DIGITS];
  17. };
  18. static inline struct ecdh_ctx *ecdh_get_ctx(struct crypto_kpp *tfm)
  19. {
  20. return kpp_tfm_ctx(tfm);
  21. }
  22. static unsigned int ecdh_supported_curve(unsigned int curve_id)
  23. {
  24. switch (curve_id) {
  25. case ECC_CURVE_NIST_P192: return ECC_CURVE_NIST_P192_DIGITS;
  26. case ECC_CURVE_NIST_P256: return ECC_CURVE_NIST_P256_DIGITS;
  27. default: return 0;
  28. }
  29. }
  30. static int ecdh_set_secret(struct crypto_kpp *tfm, const void *buf,
  31. unsigned int len)
  32. {
  33. struct ecdh_ctx *ctx = ecdh_get_ctx(tfm);
  34. struct ecdh params;
  35. unsigned int ndigits;
  36. if (crypto_ecdh_decode_key(buf, len, &params) < 0 ||
  37. params.key_size > sizeof(ctx->private_key))
  38. return -EINVAL;
  39. ndigits = ecdh_supported_curve(params.curve_id);
  40. if (!ndigits)
  41. return -EINVAL;
  42. ctx->curve_id = params.curve_id;
  43. ctx->ndigits = ndigits;
  44. if (!params.key || !params.key_size)
  45. return ecc_gen_privkey(ctx->curve_id, ctx->ndigits,
  46. ctx->private_key);
  47. memcpy(ctx->private_key, params.key, params.key_size);
  48. if (ecc_is_key_valid(ctx->curve_id, ctx->ndigits,
  49. ctx->private_key, params.key_size) < 0) {
  50. memzero_explicit(ctx->private_key, params.key_size);
  51. return -EINVAL;
  52. }
  53. return 0;
  54. }
  55. static int ecdh_compute_value(struct kpp_request *req)
  56. {
  57. struct crypto_kpp *tfm = crypto_kpp_reqtfm(req);
  58. struct ecdh_ctx *ctx = ecdh_get_ctx(tfm);
  59. u64 *public_key;
  60. u64 *shared_secret = NULL;
  61. void *buf;
  62. size_t copied, nbytes, public_key_sz;
  63. int ret = -ENOMEM;
  64. nbytes = ctx->ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
  65. /* Public part is a point thus it has both coordinates */
  66. public_key_sz = 2 * nbytes;
  67. public_key = kmalloc(public_key_sz, GFP_KERNEL);
  68. if (!public_key)
  69. return -ENOMEM;
  70. if (req->src) {
  71. shared_secret = kmalloc(nbytes, GFP_KERNEL);
  72. if (!shared_secret)
  73. goto free_pubkey;
  74. /* from here on it's invalid parameters */
  75. ret = -EINVAL;
  76. /* must have exactly two points to be on the curve */
  77. if (public_key_sz != req->src_len)
  78. goto free_all;
  79. copied = sg_copy_to_buffer(req->src,
  80. sg_nents_for_len(req->src,
  81. public_key_sz),
  82. public_key, public_key_sz);
  83. if (copied != public_key_sz)
  84. goto free_all;
  85. ret = crypto_ecdh_shared_secret(ctx->curve_id, ctx->ndigits,
  86. ctx->private_key, public_key,
  87. shared_secret);
  88. buf = shared_secret;
  89. } else {
  90. ret = ecc_make_pub_key(ctx->curve_id, ctx->ndigits,
  91. ctx->private_key, public_key);
  92. buf = public_key;
  93. nbytes = public_key_sz;
  94. }
  95. if (ret < 0)
  96. goto free_all;
  97. /* might want less than we've got */
  98. nbytes = min_t(size_t, nbytes, req->dst_len);
  99. copied = sg_copy_from_buffer(req->dst, sg_nents_for_len(req->dst,
  100. nbytes),
  101. buf, nbytes);
  102. if (copied != nbytes)
  103. ret = -EINVAL;
  104. /* fall through */
  105. free_all:
  106. kfree_sensitive(shared_secret);
  107. free_pubkey:
  108. kfree(public_key);
  109. return ret;
  110. }
  111. static unsigned int ecdh_max_size(struct crypto_kpp *tfm)
  112. {
  113. struct ecdh_ctx *ctx = ecdh_get_ctx(tfm);
  114. /* Public key is made of two coordinates, add one to the left shift */
  115. return ctx->ndigits << (ECC_DIGITS_TO_BYTES_SHIFT + 1);
  116. }
  117. static struct kpp_alg ecdh = {
  118. .set_secret = ecdh_set_secret,
  119. .generate_public_key = ecdh_compute_value,
  120. .compute_shared_secret = ecdh_compute_value,
  121. .max_size = ecdh_max_size,
  122. .base = {
  123. .cra_name = "ecdh",
  124. .cra_driver_name = "ecdh-generic",
  125. .cra_priority = 100,
  126. .cra_module = THIS_MODULE,
  127. .cra_ctxsize = sizeof(struct ecdh_ctx),
  128. },
  129. };
  130. static int ecdh_init(void)
  131. {
  132. return crypto_register_kpp(&ecdh);
  133. }
  134. static void ecdh_exit(void)
  135. {
  136. crypto_unregister_kpp(&ecdh);
  137. }
  138. subsys_initcall(ecdh_init);
  139. module_exit(ecdh_exit);
  140. MODULE_ALIAS_CRYPTO("ecdh");
  141. MODULE_LICENSE("GPL");
  142. MODULE_DESCRIPTION("ECDH generic algorithm");