sm2.c 9.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460
  1. /* SPDX-License-Identifier: GPL-2.0-or-later */
  2. /*
  3. * SM2 asymmetric public-key algorithm
  4. * as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012 SM2 and
  5. * described at https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
  6. *
  7. * Copyright (c) 2020, Alibaba Group.
  8. * Authors: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
  9. */
  10. #include <linux/module.h>
  11. #include <linux/mpi.h>
  12. #include <crypto/internal/akcipher.h>
  13. #include <crypto/akcipher.h>
  14. #include <crypto/hash.h>
  15. #include <crypto/sm3_base.h>
  16. #include <crypto/rng.h>
  17. #include <crypto/sm2.h>
  18. #include "sm2signature.asn1.h"
  19. #define MPI_NBYTES(m) ((mpi_get_nbits(m) + 7) / 8)
  20. struct ecc_domain_parms {
  21. const char *desc; /* Description of the curve. */
  22. unsigned int nbits; /* Number of bits. */
  23. unsigned int fips:1; /* True if this is a FIPS140-2 approved curve */
  24. /* The model describing this curve. This is mainly used to select
  25. * the group equation.
  26. */
  27. enum gcry_mpi_ec_models model;
  28. /* The actual ECC dialect used. This is used for curve specific
  29. * optimizations and to select encodings etc.
  30. */
  31. enum ecc_dialects dialect;
  32. const char *p; /* The prime defining the field. */
  33. const char *a, *b; /* The coefficients. For Twisted Edwards
  34. * Curves b is used for d. For Montgomery
  35. * Curves (a,b) has ((A-2)/4,B^-1).
  36. */
  37. const char *n; /* The order of the base point. */
  38. const char *g_x, *g_y; /* Base point. */
  39. unsigned int h; /* Cofactor. */
  40. };
  41. static const struct ecc_domain_parms sm2_ecp = {
  42. .desc = "sm2p256v1",
  43. .nbits = 256,
  44. .fips = 0,
  45. .model = MPI_EC_WEIERSTRASS,
  46. .dialect = ECC_DIALECT_STANDARD,
  47. .p = "0xfffffffeffffffffffffffffffffffffffffffff00000000ffffffffffffffff",
  48. .a = "0xfffffffeffffffffffffffffffffffffffffffff00000000fffffffffffffffc",
  49. .b = "0x28e9fa9e9d9f5e344d5a9e4bcf6509a7f39789f515ab8f92ddbcbd414d940e93",
  50. .n = "0xfffffffeffffffffffffffffffffffff7203df6b21c6052b53bbf40939d54123",
  51. .g_x = "0x32c4ae2c1f1981195f9904466a39c9948fe30bbff2660be1715a4589334c74c7",
  52. .g_y = "0xbc3736a2f4f6779c59bdcee36b692153d0a9877cc62a474002df32e52139f0a0",
  53. .h = 1
  54. };
  55. static int sm2_ec_ctx_init(struct mpi_ec_ctx *ec)
  56. {
  57. const struct ecc_domain_parms *ecp = &sm2_ecp;
  58. MPI p, a, b;
  59. MPI x, y;
  60. int rc = -EINVAL;
  61. p = mpi_scanval(ecp->p);
  62. a = mpi_scanval(ecp->a);
  63. b = mpi_scanval(ecp->b);
  64. if (!p || !a || !b)
  65. goto free_p;
  66. x = mpi_scanval(ecp->g_x);
  67. y = mpi_scanval(ecp->g_y);
  68. if (!x || !y)
  69. goto free;
  70. rc = -ENOMEM;
  71. ec->Q = mpi_point_new(0);
  72. if (!ec->Q)
  73. goto free;
  74. /* mpi_ec_setup_elliptic_curve */
  75. ec->G = mpi_point_new(0);
  76. if (!ec->G) {
  77. mpi_point_release(ec->Q);
  78. goto free;
  79. }
  80. mpi_set(ec->G->x, x);
  81. mpi_set(ec->G->y, y);
  82. mpi_set_ui(ec->G->z, 1);
  83. rc = -EINVAL;
  84. ec->n = mpi_scanval(ecp->n);
  85. if (!ec->n) {
  86. mpi_point_release(ec->Q);
  87. mpi_point_release(ec->G);
  88. goto free;
  89. }
  90. ec->h = ecp->h;
  91. ec->name = ecp->desc;
  92. mpi_ec_init(ec, ecp->model, ecp->dialect, 0, p, a, b);
  93. rc = 0;
  94. free:
  95. mpi_free(x);
  96. mpi_free(y);
  97. free_p:
  98. mpi_free(p);
  99. mpi_free(a);
  100. mpi_free(b);
  101. return rc;
  102. }
  103. static void sm2_ec_ctx_deinit(struct mpi_ec_ctx *ec)
  104. {
  105. mpi_ec_deinit(ec);
  106. memset(ec, 0, sizeof(*ec));
  107. }
  108. /* RESULT must have been initialized and is set on success to the
  109. * point given by VALUE.
  110. */
  111. static int sm2_ecc_os2ec(MPI_POINT result, MPI value)
  112. {
  113. int rc;
  114. size_t n;
  115. unsigned char *buf;
  116. MPI x, y;
  117. n = MPI_NBYTES(value);
  118. buf = kmalloc(n, GFP_KERNEL);
  119. if (!buf)
  120. return -ENOMEM;
  121. rc = mpi_print(GCRYMPI_FMT_USG, buf, n, &n, value);
  122. if (rc)
  123. goto err_freebuf;
  124. rc = -EINVAL;
  125. if (n < 1 || ((n - 1) % 2))
  126. goto err_freebuf;
  127. /* No support for point compression */
  128. if (*buf != 0x4)
  129. goto err_freebuf;
  130. rc = -ENOMEM;
  131. n = (n - 1) / 2;
  132. x = mpi_read_raw_data(buf + 1, n);
  133. if (!x)
  134. goto err_freebuf;
  135. y = mpi_read_raw_data(buf + 1 + n, n);
  136. if (!y)
  137. goto err_freex;
  138. mpi_normalize(x);
  139. mpi_normalize(y);
  140. mpi_set(result->x, x);
  141. mpi_set(result->y, y);
  142. mpi_set_ui(result->z, 1);
  143. rc = 0;
  144. mpi_free(y);
  145. err_freex:
  146. mpi_free(x);
  147. err_freebuf:
  148. kfree(buf);
  149. return rc;
  150. }
  151. struct sm2_signature_ctx {
  152. MPI sig_r;
  153. MPI sig_s;
  154. };
  155. int sm2_get_signature_r(void *context, size_t hdrlen, unsigned char tag,
  156. const void *value, size_t vlen)
  157. {
  158. struct sm2_signature_ctx *sig = context;
  159. if (!value || !vlen)
  160. return -EINVAL;
  161. sig->sig_r = mpi_read_raw_data(value, vlen);
  162. if (!sig->sig_r)
  163. return -ENOMEM;
  164. return 0;
  165. }
  166. int sm2_get_signature_s(void *context, size_t hdrlen, unsigned char tag,
  167. const void *value, size_t vlen)
  168. {
  169. struct sm2_signature_ctx *sig = context;
  170. if (!value || !vlen)
  171. return -EINVAL;
  172. sig->sig_s = mpi_read_raw_data(value, vlen);
  173. if (!sig->sig_s)
  174. return -ENOMEM;
  175. return 0;
  176. }
  177. static int sm2_z_digest_update(struct shash_desc *desc,
  178. MPI m, unsigned int pbytes)
  179. {
  180. static const unsigned char zero[32];
  181. unsigned char *in;
  182. unsigned int inlen;
  183. in = mpi_get_buffer(m, &inlen, NULL);
  184. if (!in)
  185. return -EINVAL;
  186. if (inlen < pbytes) {
  187. /* padding with zero */
  188. crypto_sm3_update(desc, zero, pbytes - inlen);
  189. crypto_sm3_update(desc, in, inlen);
  190. } else if (inlen > pbytes) {
  191. /* skip the starting zero */
  192. crypto_sm3_update(desc, in + inlen - pbytes, pbytes);
  193. } else {
  194. crypto_sm3_update(desc, in, inlen);
  195. }
  196. kfree(in);
  197. return 0;
  198. }
  199. static int sm2_z_digest_update_point(struct shash_desc *desc,
  200. MPI_POINT point, struct mpi_ec_ctx *ec, unsigned int pbytes)
  201. {
  202. MPI x, y;
  203. int ret = -EINVAL;
  204. x = mpi_new(0);
  205. y = mpi_new(0);
  206. if (!mpi_ec_get_affine(x, y, point, ec) &&
  207. !sm2_z_digest_update(desc, x, pbytes) &&
  208. !sm2_z_digest_update(desc, y, pbytes))
  209. ret = 0;
  210. mpi_free(x);
  211. mpi_free(y);
  212. return ret;
  213. }
  214. int sm2_compute_z_digest(struct crypto_akcipher *tfm,
  215. const unsigned char *id, size_t id_len,
  216. unsigned char dgst[SM3_DIGEST_SIZE])
  217. {
  218. struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
  219. uint16_t bits_len;
  220. unsigned char entl[2];
  221. SHASH_DESC_ON_STACK(desc, NULL);
  222. unsigned int pbytes;
  223. if (id_len > (USHRT_MAX / 8) || !ec->Q)
  224. return -EINVAL;
  225. bits_len = (uint16_t)(id_len * 8);
  226. entl[0] = bits_len >> 8;
  227. entl[1] = bits_len & 0xff;
  228. pbytes = MPI_NBYTES(ec->p);
  229. /* ZA = H256(ENTLA | IDA | a | b | xG | yG | xA | yA) */
  230. sm3_base_init(desc);
  231. crypto_sm3_update(desc, entl, 2);
  232. crypto_sm3_update(desc, id, id_len);
  233. if (sm2_z_digest_update(desc, ec->a, pbytes) ||
  234. sm2_z_digest_update(desc, ec->b, pbytes) ||
  235. sm2_z_digest_update_point(desc, ec->G, ec, pbytes) ||
  236. sm2_z_digest_update_point(desc, ec->Q, ec, pbytes))
  237. return -EINVAL;
  238. crypto_sm3_final(desc, dgst);
  239. return 0;
  240. }
  241. EXPORT_SYMBOL(sm2_compute_z_digest);
  242. static int _sm2_verify(struct mpi_ec_ctx *ec, MPI hash, MPI sig_r, MPI sig_s)
  243. {
  244. int rc = -EINVAL;
  245. struct gcry_mpi_point sG, tP;
  246. MPI t = NULL;
  247. MPI x1 = NULL, y1 = NULL;
  248. mpi_point_init(&sG);
  249. mpi_point_init(&tP);
  250. x1 = mpi_new(0);
  251. y1 = mpi_new(0);
  252. t = mpi_new(0);
  253. /* r, s in [1, n-1] */
  254. if (mpi_cmp_ui(sig_r, 1) < 0 || mpi_cmp(sig_r, ec->n) > 0 ||
  255. mpi_cmp_ui(sig_s, 1) < 0 || mpi_cmp(sig_s, ec->n) > 0) {
  256. goto leave;
  257. }
  258. /* t = (r + s) % n, t == 0 */
  259. mpi_addm(t, sig_r, sig_s, ec->n);
  260. if (mpi_cmp_ui(t, 0) == 0)
  261. goto leave;
  262. /* sG + tP = (x1, y1) */
  263. rc = -EBADMSG;
  264. mpi_ec_mul_point(&sG, sig_s, ec->G, ec);
  265. mpi_ec_mul_point(&tP, t, ec->Q, ec);
  266. mpi_ec_add_points(&sG, &sG, &tP, ec);
  267. if (mpi_ec_get_affine(x1, y1, &sG, ec))
  268. goto leave;
  269. /* R = (e + x1) % n */
  270. mpi_addm(t, hash, x1, ec->n);
  271. /* check R == r */
  272. rc = -EKEYREJECTED;
  273. if (mpi_cmp(t, sig_r))
  274. goto leave;
  275. rc = 0;
  276. leave:
  277. mpi_point_free_parts(&sG);
  278. mpi_point_free_parts(&tP);
  279. mpi_free(x1);
  280. mpi_free(y1);
  281. mpi_free(t);
  282. return rc;
  283. }
  284. static int sm2_verify(struct akcipher_request *req)
  285. {
  286. struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
  287. struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
  288. unsigned char *buffer;
  289. struct sm2_signature_ctx sig;
  290. MPI hash;
  291. int ret;
  292. if (unlikely(!ec->Q))
  293. return -EINVAL;
  294. buffer = kmalloc(req->src_len + req->dst_len, GFP_KERNEL);
  295. if (!buffer)
  296. return -ENOMEM;
  297. sg_pcopy_to_buffer(req->src,
  298. sg_nents_for_len(req->src, req->src_len + req->dst_len),
  299. buffer, req->src_len + req->dst_len, 0);
  300. sig.sig_r = NULL;
  301. sig.sig_s = NULL;
  302. ret = asn1_ber_decoder(&sm2signature_decoder, &sig,
  303. buffer, req->src_len);
  304. if (ret)
  305. goto error;
  306. ret = -ENOMEM;
  307. hash = mpi_read_raw_data(buffer + req->src_len, req->dst_len);
  308. if (!hash)
  309. goto error;
  310. ret = _sm2_verify(ec, hash, sig.sig_r, sig.sig_s);
  311. mpi_free(hash);
  312. error:
  313. mpi_free(sig.sig_r);
  314. mpi_free(sig.sig_s);
  315. kfree(buffer);
  316. return ret;
  317. }
  318. static int sm2_set_pub_key(struct crypto_akcipher *tfm,
  319. const void *key, unsigned int keylen)
  320. {
  321. struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
  322. MPI a;
  323. int rc;
  324. /* include the uncompressed flag '0x04' */
  325. a = mpi_read_raw_data(key, keylen);
  326. if (!a)
  327. return -ENOMEM;
  328. mpi_normalize(a);
  329. rc = sm2_ecc_os2ec(ec->Q, a);
  330. mpi_free(a);
  331. return rc;
  332. }
  333. static unsigned int sm2_max_size(struct crypto_akcipher *tfm)
  334. {
  335. /* Unlimited max size */
  336. return PAGE_SIZE;
  337. }
  338. static int sm2_init_tfm(struct crypto_akcipher *tfm)
  339. {
  340. struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
  341. return sm2_ec_ctx_init(ec);
  342. }
  343. static void sm2_exit_tfm(struct crypto_akcipher *tfm)
  344. {
  345. struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
  346. sm2_ec_ctx_deinit(ec);
  347. }
  348. static struct akcipher_alg sm2 = {
  349. .verify = sm2_verify,
  350. .set_pub_key = sm2_set_pub_key,
  351. .max_size = sm2_max_size,
  352. .init = sm2_init_tfm,
  353. .exit = sm2_exit_tfm,
  354. .base = {
  355. .cra_name = "sm2",
  356. .cra_driver_name = "sm2-generic",
  357. .cra_priority = 100,
  358. .cra_module = THIS_MODULE,
  359. .cra_ctxsize = sizeof(struct mpi_ec_ctx),
  360. },
  361. };
  362. static int sm2_init(void)
  363. {
  364. return crypto_register_akcipher(&sm2);
  365. }
  366. static void sm2_exit(void)
  367. {
  368. crypto_unregister_akcipher(&sm2);
  369. }
  370. subsys_initcall(sm2_init);
  371. module_exit(sm2_exit);
  372. MODULE_LICENSE("GPL");
  373. MODULE_AUTHOR("Tianjia Zhang <tianjia.zhang@linux.alibaba.com>");
  374. MODULE_DESCRIPTION("SM2 generic algorithm");
  375. MODULE_ALIAS_CRYPTO("sm2-generic");