// SPDX-License-Identifier: GPL-2.0-or-later/*  Diffie-Hellman Key Agreement Method [RFC2631] * * Copyright (c) 2016, Intel Corporation * Authors: Salvatore Benedetto <salvatore.benedetto@intel.com> */ #include <linux/fips.h>#include <linux/module.h>#include <crypto/internal/kpp.h>#include <crypto/kpp.h>#include <crypto/dh.h>#include <crypto/rng.h>#include <linux/mpi.h> struct dh_ctx {	MPI p;	/* Value is guaranteed to be set. */	MPI g;	/* Value is guaranteed to be set. */	MPI xa;	/* Value is guaranteed to be set. */}; static void dh_clear_ctx(struct dh_ctx *ctx){	mpi_free(ctx->p);	mpi_free(ctx->g);	mpi_free(ctx->xa);	memset(ctx, 0, sizeof(*ctx));} /* * If base is g we compute the public key *	ya = g^xa mod p; [RFC2631 sec 2.1.1] * else if base if the counterpart public key we compute the shared secret *	ZZ = yb^xa mod p; [RFC2631 sec 2.1.1] */static int _compute_val(const struct dh_ctx *ctx, MPI base, MPI val){	/* val = base^xa mod p */	return mpi_powm(val, base, ctx->xa, ctx->p);} static inline struct dh_ctx *dh_get_ctx(struct crypto_kpp *tfm){	return kpp_tfm_ctx(tfm);} static int dh_check_params_length(unsigned int p_len){	if (fips_enabled)		return (p_len < 2048) ? -EINVAL : 0; 	return (p_len < 1536) ? -EINVAL : 0;} static int dh_set_params(struct dh_ctx *ctx, struct dh *params){	if (dh_check_params_length(params->p_size << 3))		return -EINVAL; 	ctx->p = mpi_read_raw_data(params->p, params->p_size);	if (!ctx->p)		return -EINVAL; 	ctx->g = mpi_read_raw_data(params->g, params->g_size);	if (!ctx->g)		return -EINVAL; 	return 0;} static int dh_set_secret(struct crypto_kpp *tfm, const void *buf,			 unsigned int len){	struct dh_ctx *ctx = dh_get_ctx(tfm);	struct dh params; 	/* Free the old MPI key if any */	dh_clear_ctx(ctx); 	if (crypto_dh_decode_key(buf, len, &params) < 0)		goto err_clear_ctx; 	if (dh_set_params(ctx, &params) < 0)		goto err_clear_ctx; 	ctx->xa = mpi_read_raw_data(params.key, params.key_size);	if (!ctx->xa)		goto err_clear_ctx; 	return 0; err_clear_ctx:	dh_clear_ctx(ctx);	return -EINVAL;} /* * SP800-56A public key verification: * * * For the safe-prime groups in FIPS mode, Q can be computed *   trivially from P and a full validation according to SP800-56A *   section 5.6.2.3.1 is performed. * * * For all other sets of group parameters, only a partial validation *   according to SP800-56A section 5.6.2.3.2 is performed. */static int dh_is_pubkey_valid(struct dh_ctx *ctx, MPI y){	MPI val, q;	int ret; 	if (!fips_enabled)		return 0; 	if (unlikely(!ctx->p))		return -EINVAL; 	/*	 * Step 1: Verify that 2 <= y <= p - 2.	 *	 * The upper limit check is actually y < p instead of y < p - 1	 * in order to save one mpi_sub_ui() invocation here. Note that	 * p - 1 is the non-trivial element of the subgroup of order 2 and	 * thus, the check on y^q below would fail if y == p - 1.	 */	if (mpi_cmp_ui(y, 1) < 1 || mpi_cmp(y, ctx->p) >= 0)		return -EINVAL; 	/*	 * Step 2: Verify that 1 = y^q mod p	 *	 * For the safe-prime groups q = (p - 1)/2.	 */	val = mpi_alloc(0);	if (!val)		return -ENOMEM; 	q = mpi_alloc(mpi_get_nlimbs(ctx->p));	if (!q) {		mpi_free(val);		return -ENOMEM;	} 	/*	 * ->p is odd, so no need to explicitly subtract one	 * from it before shifting to the right.	 */	ret = mpi_rshift(q, ctx->p, 1) ?:	      mpi_powm(val, y, q, ctx->p); 	mpi_free(q);	if (ret) {		mpi_free(val);		return ret;	} 	ret = mpi_cmp_ui(val, 1); 	mpi_free(val); 	if (ret != 0)		return -EINVAL; 	return 0;} static int dh_compute_value(struct kpp_request *req){	struct crypto_kpp *tfm = crypto_kpp_reqtfm(req);	struct dh_ctx *ctx = dh_get_ctx(tfm);	MPI base, val = mpi_alloc(0);	int ret = 0;	int sign; 	if (!val)		return -ENOMEM; 	if (unlikely(!ctx->xa)) {		ret = -EINVAL;		goto err_free_val;	} 	if (req->src) {		base = mpi_read_raw_from_sgl(req->src, req->src_len);		if (!base) {			ret = -EINVAL;			goto err_free_val;		}		ret = dh_is_pubkey_valid(ctx, base);		if (ret)			goto err_free_base;	} else {		base = ctx->g;	} 	ret = _compute_val(ctx, base, val);	if (ret)		goto err_free_base; 	if (fips_enabled) {		/* SP800-56A rev3 5.7.1.1 check: Validation of shared secret */		if (req->src) {			MPI pone; 			/* z <= 1 */			if (mpi_cmp_ui(val, 1) < 1) {				ret = -EBADMSG;				goto err_free_base;			} 			/* z == p - 1 */			pone = mpi_alloc(0); 			if (!pone) {				ret = -ENOMEM;				goto err_free_base;			} 			ret = mpi_sub_ui(pone, ctx->p, 1);			if (!ret && !mpi_cmp(pone, val))				ret = -EBADMSG; 			mpi_free(pone); 			if (ret)				goto err_free_base; 		/* SP800-56A rev 3 5.6.2.1.3 key check */		} else {			if (dh_is_pubkey_valid(ctx, val)) {				ret = -EAGAIN;				goto err_free_val;			}		}	} 	ret = mpi_write_to_sgl(val, req->dst, req->dst_len, &sign);	if (ret)		goto err_free_base; 	if (sign < 0)		ret = -EBADMSG;err_free_base:	if (req->src)		mpi_free(base);err_free_val:	mpi_free(val);	return ret;} static unsigned int dh_max_size(struct crypto_kpp *tfm){	struct dh_ctx *ctx = dh_get_ctx(tfm); 	return mpi_get_size(ctx->p);} static void dh_exit_tfm(struct crypto_kpp *tfm){	struct dh_ctx *ctx = dh_get_ctx(tfm); 	dh_clear_ctx(ctx);} static struct kpp_alg dh = {	.set_secret = dh_set_secret,	.generate_public_key = dh_compute_value,	.compute_shared_secret = dh_compute_value,	.max_size = dh_max_size,	.exit = dh_exit_tfm,	.base = {		.cra_name = "dh",		.cra_driver_name = "dh-generic",		.cra_priority = 100,		.cra_module = THIS_MODULE,		.cra_ctxsize = sizeof(struct dh_ctx),	},};  struct dh_safe_prime {	unsigned int max_strength;	unsigned int p_size;	const char *p;}; static const char safe_prime_g[]  = { 2 }; struct dh_safe_prime_instance_ctx {	struct crypto_kpp_spawn dh_spawn;	const struct dh_safe_prime *safe_prime;}; struct dh_safe_prime_tfm_ctx {	struct crypto_kpp *dh_tfm;}; static void dh_safe_prime_free_instance(struct kpp_instance *inst){	struct dh_safe_prime_instance_ctx *ctx = kpp_instance_ctx(inst); 	crypto_drop_kpp(&ctx->dh_spawn);	kfree(inst);} static inline struct dh_safe_prime_instance_ctx *dh_safe_prime_instance_ctx(	struct crypto_kpp *tfm){	return kpp_instance_ctx(kpp_alg_instance(tfm));} static int dh_safe_prime_init_tfm(struct crypto_kpp *tfm){	struct dh_safe_prime_instance_ctx *inst_ctx =		dh_safe_prime_instance_ctx(tfm);	struct dh_safe_prime_tfm_ctx *tfm_ctx = kpp_tfm_ctx(tfm); 	tfm_ctx->dh_tfm = crypto_spawn_kpp(&inst_ctx->dh_spawn);	if (IS_ERR(tfm_ctx->dh_tfm))		return PTR_ERR(tfm_ctx->dh_tfm); 	kpp_set_reqsize(tfm, sizeof(struct kpp_request) +			     crypto_kpp_reqsize(tfm_ctx->dh_tfm)); 	return 0;} static void dh_safe_prime_exit_tfm(struct crypto_kpp *tfm){	struct dh_safe_prime_tfm_ctx *tfm_ctx = kpp_tfm_ctx(tfm); 	crypto_free_kpp(tfm_ctx->dh_tfm);} static u64 __add_u64_to_be(__be64 *dst, unsigned int n, u64 val){	unsigned int i; 	for (i = n; val && i > 0; --i) {		u64 tmp = be64_to_cpu(dst[i - 1]); 		tmp += val;		val = tmp >= val ? 0 : 1;		dst[i - 1] = cpu_to_be64(tmp);	} 	return val;} static void *dh_safe_prime_gen_privkey(const struct dh_safe_prime *safe_prime,				       unsigned int *key_size){	unsigned int n, oversampling_size;	__be64 *key;	int err;	u64 h, o; 	/*	 * Generate a private key following NIST SP800-56Ar3,	 * sec. 5.6.1.1.1 and 5.6.1.1.3 resp..	 *	 * 5.6.1.1.1: choose key length N such that	 * 2 * ->max_strength <= N <= log2(q) + 1 = ->p_size * 8 - 1	 * with q = (p - 1) / 2 for the safe-prime groups.	 * Choose the lower bound's next power of two for N in order to	 * avoid excessively large private keys while still	 * maintaining some extra reserve beyond the bare minimum in	 * most cases. Note that for each entry in safe_prime_groups[],	 * the following holds for such N:	 * - N >= 256, in particular it is a multiple of 2^6 = 64	 *   bits and	 * - N < log2(q) + 1, i.e. N respects the upper bound.	 */	n = roundup_pow_of_two(2 * safe_prime->max_strength);	WARN_ON_ONCE(n & ((1u << 6) - 1));	n >>= 6; /* Convert N into units of u64. */ 	/*	 * Reserve one extra u64 to hold the extra random bits	 * required as per 5.6.1.1.3.	 */	oversampling_size = (n + 1) * sizeof(__be64);	key = kmalloc(oversampling_size, GFP_KERNEL);	if (!key)		return ERR_PTR(-ENOMEM); 	/*	 * 5.6.1.1.3, step 3 (and implicitly step 4): obtain N + 64	 * random bits and interpret them as a big endian integer.	 */	err = crypto_stdrng_get_bytes(key, oversampling_size);	if (err)		goto out_err; 	/*	 * 5.6.1.1.3, step 5 is implicit: 2^N < q and thus,	 * M = min(2^N, q) = 2^N.	 *	 * For step 6, calculate	 * key = (key[] mod (M - 1)) + 1 = (key[] mod (2^N - 1)) + 1.	 *	 * In order to avoid expensive divisions, note that	 * 2^N mod (2^N - 1) = 1 and thus, for any integer h,	 * 2^N * h mod (2^N - 1) = h mod (2^N - 1) always holds.	 * The big endian integer key[] composed of n + 1 64bit words	 * may be written as key[] = h * 2^N + l, with h = key[0]	 * representing the 64 most significant bits and l	 * corresponding to the remaining 2^N bits. With the remark	 * from above,	 * h * 2^N + l mod (2^N - 1) = l + h mod (2^N - 1).	 * As both, l and h are less than 2^N, their sum after	 * this first reduction is guaranteed to be <= 2^(N + 1) - 2.	 * Or equivalently, that their sum can again be written as	 * h' * 2^N + l' with h' now either zero or one and if one,	 * then l' <= 2^N - 2. Thus, all bits at positions >= N will	 * be zero after a second reduction:	 * h' * 2^N + l' mod (2^N - 1) = l' + h' mod (2^N - 1).	 * At this point, it is still possible that	 * l' + h' = 2^N - 1, i.e. that l' + h' mod (2^N - 1)	 * is zero. This condition will be detected below by means of	 * the final increment overflowing in this case.	 */	h = be64_to_cpu(key[0]);	h = __add_u64_to_be(key + 1, n, h);	h = __add_u64_to_be(key + 1, n, h);	WARN_ON_ONCE(h); 	/* Increment to obtain the final result. */	o = __add_u64_to_be(key + 1, n, 1);	/*	 * The overflow bit o from the increment is either zero or	 * one. If zero, key[1:n] holds the final result in big-endian	 * order. If one, key[1:n] is zero now, but needs to be set to	 * one, c.f. above.	 */	if (o)		key[n] = cpu_to_be64(1); 	/* n is in units of u64, convert to bytes. */	*key_size = n << 3;	/* Strip the leading extra __be64, which is (virtually) zero by now. */	memmove(key, &key[1], *key_size); 	return key; out_err:	kfree_sensitive(key);	return ERR_PTR(err);} static int dh_safe_prime_set_secret(struct crypto_kpp *tfm, const void *buffer,				    unsigned int len){	struct dh_safe_prime_instance_ctx *inst_ctx =		dh_safe_prime_instance_ctx(tfm);	struct dh_safe_prime_tfm_ctx *tfm_ctx = kpp_tfm_ctx(tfm);	struct dh params = {};	void *buf = NULL, *key = NULL;	unsigned int buf_size;	int err; 	if (buffer) {		err = __crypto_dh_decode_key(buffer, len, &params);		if (err)			return err;		if (params.p_size || params.g_size)			return -EINVAL;	} 	params.p = inst_ctx->safe_prime->p;	params.p_size = inst_ctx->safe_prime->p_size;	params.g = safe_prime_g;	params.g_size = sizeof(safe_prime_g); 	if (!params.key_size) {		key = dh_safe_prime_gen_privkey(inst_ctx->safe_prime,						&params.key_size);		if (IS_ERR(key))			return PTR_ERR(key);		params.key = key;	} 	buf_size = crypto_dh_key_len(&params);	buf = kmalloc(buf_size, GFP_KERNEL);	if (!buf) {		err = -ENOMEM;		goto out;	} 	err = crypto_dh_encode_key(buf, buf_size, &params);	if (err)		goto out; 	err = crypto_kpp_set_secret(tfm_ctx->dh_tfm, buf, buf_size);out:	kfree_sensitive(buf);	kfree_sensitive(key);	return err;} 

Lines 1–500 of 921. Load more