/* * Copyright (c) 2013, 2014 Kenneth MacKay. All rights reserved. * Copyright (c) 2019 Vitaly Chikunov <vt@altlinux.org> * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include <crypto/ecc_curve.h>#include <linux/module.h>#include <linux/random.h>#include <linux/slab.h>#include <linux/swab.h>#include <linux/fips.h>#include <crypto/ecdh.h>#include <crypto/rng.h>#include <asm/unaligned.h>#include <linux/ratelimit.h> #include "ecc.h"#include "ecc_curve_defs.h" typedef struct { u64 m_low; u64 m_high;} uint128_t; /* Returns curv25519 curve param */const struct ecc_curve *ecc_get_curve25519(void){ return &ecc_25519;}EXPORT_SYMBOL(ecc_get_curve25519); const struct ecc_curve *ecc_get_curve(unsigned int curve_id){ switch (curve_id) { /* In FIPS mode only allow P256 and higher */ case ECC_CURVE_NIST_P192: return fips_enabled ? NULL : &nist_p192; case ECC_CURVE_NIST_P256: return &nist_p256; case ECC_CURVE_NIST_P384: return &nist_p384; default: return NULL; }}EXPORT_SYMBOL(ecc_get_curve); static u64 *ecc_alloc_digits_space(unsigned int ndigits){ size_t len = ndigits * sizeof(u64); if (!len) return NULL; return kmalloc(len, GFP_KERNEL);} static void ecc_free_digits_space(u64 *space){ kfree_sensitive(space);} static struct ecc_point *ecc_alloc_point(unsigned int ndigits){ struct ecc_point *p = kmalloc(sizeof(*p), GFP_KERNEL); if (!p) return NULL; p->x = ecc_alloc_digits_space(ndigits); if (!p->x) goto err_alloc_x; p->y = ecc_alloc_digits_space(ndigits); if (!p->y) goto err_alloc_y; p->ndigits = ndigits; return p; err_alloc_y: ecc_free_digits_space(p->x);err_alloc_x: kfree(p); return NULL;} static void ecc_free_point(struct ecc_point *p){ if (!p) return; kfree_sensitive(p->x); kfree_sensitive(p->y); kfree_sensitive(p);} static void vli_clear(u64 *vli, unsigned int ndigits){ int i; for (i = 0; i < ndigits; i++) vli[i] = 0;} /* Returns true if vli == 0, false otherwise. */bool vli_is_zero(const u64 *vli, unsigned int ndigits){ int i; for (i = 0; i < ndigits; i++) { if (vli[i]) return false; } return true;}EXPORT_SYMBOL(vli_is_zero); /* Returns nonzero if bit of vli is set. */static u64 vli_test_bit(const u64 *vli, unsigned int bit){ return (vli[bit / 64] & ((u64)1 << (bit % 64)));} static bool vli_is_negative(const u64 *vli, unsigned int ndigits){ return vli_test_bit(vli, ndigits * 64 - 1);} /* Counts the number of 64-bit "digits" in vli. */static unsigned int vli_num_digits(const u64 *vli, unsigned int ndigits){ int i; /* Search from the end until we find a non-zero digit. * We do it in reverse because we expect that most digits will * be nonzero. */ for (i = ndigits - 1; i >= 0 && vli[i] == 0; i--); return (i + 1);} /* Counts the number of bits required for vli. */static unsigned int vli_num_bits(const u64 *vli, unsigned int ndigits){ unsigned int i, num_digits; u64 digit; num_digits = vli_num_digits(vli, ndigits); if (num_digits == 0) return 0; digit = vli[num_digits - 1]; for (i = 0; digit; i++) digit >>= 1; return ((num_digits - 1) * 64 + i);} /* Set dest from unaligned bit string src. */void vli_from_be64(u64 *dest, const void *src, unsigned int ndigits){ int i; const u64 *from = src; for (i = 0; i < ndigits; i++) dest[i] = get_unaligned_be64(&from[ndigits - 1 - i]);}EXPORT_SYMBOL(vli_from_be64); void vli_from_le64(u64 *dest, const void *src, unsigned int ndigits){ int i; const u64 *from = src; for (i = 0; i < ndigits; i++) dest[i] = get_unaligned_le64(&from[i]);}EXPORT_SYMBOL(vli_from_le64); /* Sets dest = src. */static void vli_set(u64 *dest, const u64 *src, unsigned int ndigits){ int i; for (i = 0; i < ndigits; i++) dest[i] = src[i];} /* Returns sign of left - right. */int vli_cmp(const u64 *left, const u64 *right, unsigned int ndigits){ int i; for (i = ndigits - 1; i >= 0; i--) { if (left[i] > right[i]) return 1; else if (left[i] < right[i]) return -1; } return 0;}EXPORT_SYMBOL(vli_cmp); /* Computes result = in << c, returning carry. Can modify in place * (if result == in). 0 < shift < 64. */static u64 vli_lshift(u64 *result, const u64 *in, unsigned int shift, unsigned int ndigits){ u64 carry = 0; int i; for (i = 0; i < ndigits; i++) { u64 temp = in[i]; result[i] = (temp << shift) | carry; carry = temp >> (64 - shift); } return carry;} /* Computes vli = vli >> 1. */static void vli_rshift1(u64 *vli, unsigned int ndigits){ u64 *end = vli; u64 carry = 0; vli += ndigits; while (vli-- > end) { u64 temp = *vli; *vli = (temp >> 1) | carry; carry = temp << 63; }} /* Computes result = left + right, returning carry. Can modify in place. */static u64 vli_add(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits){ u64 carry = 0; int i; for (i = 0; i < ndigits; i++) { u64 sum; sum = left[i] + right[i] + carry; if (sum != left[i]) carry = (sum < left[i]); result[i] = sum; } return carry;} /* Computes result = left + right, returning carry. Can modify in place. */static u64 vli_uadd(u64 *result, const u64 *left, u64 right, unsigned int ndigits){ u64 carry = right; int i; for (i = 0; i < ndigits; i++) { u64 sum; sum = left[i] + carry; if (sum != left[i]) carry = (sum < left[i]); else carry = !!carry; result[i] = sum; } return carry;} /* Computes result = left - right, returning borrow. Can modify in place. */u64 vli_sub(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits){ u64 borrow = 0; int i; for (i = 0; i < ndigits; i++) { u64 diff; diff = left[i] - right[i] - borrow; if (diff != left[i]) borrow = (diff > left[i]); result[i] = diff; } return borrow;}EXPORT_SYMBOL(vli_sub); /* Computes result = left - right, returning borrow. Can modify in place. */static u64 vli_usub(u64 *result, const u64 *left, u64 right, unsigned int ndigits){ u64 borrow = right; int i; for (i = 0; i < ndigits; i++) { u64 diff; diff = left[i] - borrow; if (diff != left[i]) borrow = (diff > left[i]); result[i] = diff; } return borrow;} static uint128_t mul_64_64(u64 left, u64 right){ uint128_t result;#if defined(CONFIG_ARCH_SUPPORTS_INT128) unsigned __int128 m = (unsigned __int128)left * right; result.m_low = m; result.m_high = m >> 64;#else u64 a0 = left & 0xffffffffull; u64 a1 = left >> 32; u64 b0 = right & 0xffffffffull; u64 b1 = right >> 32; u64 m0 = a0 * b0; u64 m1 = a0 * b1; u64 m2 = a1 * b0; u64 m3 = a1 * b1; m2 += (m0 >> 32); m2 += m1; /* Overflow */ if (m2 < m1) m3 += 0x100000000ull; result.m_low = (m0 & 0xffffffffull) | (m2 << 32); result.m_high = m3 + (m2 >> 32);#endif return result;} static uint128_t add_128_128(uint128_t a, uint128_t b){ uint128_t result; result.m_low = a.m_low + b.m_low; result.m_high = a.m_high + b.m_high + (result.m_low < a.m_low); return result;} static void vli_mult(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits){ uint128_t r01 = { 0, 0 }; u64 r2 = 0; unsigned int i, k; /* Compute each digit of result in sequence, maintaining the * carries. */ for (k = 0; k < ndigits * 2 - 1; k++) { unsigned int min; if (k < ndigits) min = 0; else min = (k + 1) - ndigits; for (i = min; i <= k && i < ndigits; i++) { uint128_t product; product = mul_64_64(left[i], right[k - i]); r01 = add_128_128(r01, product); r2 += (r01.m_high < product.m_high); } result[k] = r01.m_low; r01.m_low = r01.m_high; r01.m_high = r2; r2 = 0; } result[ndigits * 2 - 1] = r01.m_low;} /* Compute product = left * right, for a small right value. */static void vli_umult(u64 *result, const u64 *left, u32 right, unsigned int ndigits){ uint128_t r01 = { 0 }; unsigned int k; for (k = 0; k < ndigits; k++) { uint128_t product; product = mul_64_64(left[k], right); r01 = add_128_128(r01, product); /* no carry */ result[k] = r01.m_low; r01.m_low = r01.m_high; r01.m_high = 0; } result[k] = r01.m_low; for (++k; k < ndigits * 2; k++) result[k] = 0;} static void vli_square(u64 *result, const u64 *left, unsigned int ndigits){ uint128_t r01 = { 0, 0 }; u64 r2 = 0; int i, k; for (k = 0; k < ndigits * 2 - 1; k++) { unsigned int min; if (k < ndigits) min = 0; else min = (k + 1) - ndigits; for (i = min; i <= k && i <= k - i; i++) { uint128_t product; product = mul_64_64(left[i], left[k - i]); if (i < k - i) { r2 += product.m_high >> 63; product.m_high = (product.m_high << 1) | (product.m_low >> 63); product.m_low <<= 1; } r01 = add_128_128(r01, product); r2 += (r01.m_high < product.m_high); } result[k] = r01.m_low; r01.m_low = r01.m_high; r01.m_high = r2; r2 = 0; } result[ndigits * 2 - 1] = r01.m_low;} /* Computes result = (left + right) % mod. * Assumes that left < mod and right < mod, result != mod. */static void vli_mod_add(u64 *result, const u64 *left, const u64 *right, const u64 *mod, unsigned int ndigits){ u64 carry; carry = vli_add(result, left, right, ndigits); /* result > mod (result = mod + remainder), so subtract mod to * get remainder. */ if (carry || vli_cmp(result, mod, ndigits) >= 0) vli_sub(result, result, mod, ndigits);}Lines 1–500 of 1664. Load more
/* * Copyright (c) 2013, 2014 Kenneth MacKay. All rights reserved. * Copyright (c) 2019 Vitaly Chikunov <vt@altlinux.org> * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include <crypto/ecc_curve.h> #include <linux/module.h> #include <linux/random.h> #include <linux/slab.h> #include <linux/swab.h> #include <linux/fips.h> #include <crypto/ecdh.h> #include <crypto/rng.h> #include <asm/unaligned.h> #include <linux/ratelimit.h> #include "ecc.h" #include "ecc_curve_defs.h" typedef struct { u64 m_low; u64 m_high; } uint128_t; /* Returns curv25519 curve param */ const struct ecc_curve *ecc_get_curve25519(void) { return &ecc_25519; } EXPORT_SYMBOL(ecc_get_curve25519); const struct ecc_curve *ecc_get_curve(unsigned int curve_id) { switch (curve_id) { /* In FIPS mode only allow P256 and higher */ case ECC_CURVE_NIST_P192: return fips_enabled ? NULL : &nist_p192; case ECC_CURVE_NIST_P256: return &nist_p256; case ECC_CURVE_NIST_P384: return &nist_p384; default: return NULL; } } EXPORT_SYMBOL(ecc_get_curve); static u64 *ecc_alloc_digits_space(unsigned int ndigits) { size_t len = ndigits * sizeof(u64); if (!len) return NULL; return kmalloc(len, GFP_KERNEL); } static void ecc_free_digits_space(u64 *space) { kfree_sensitive(space); } static struct ecc_point *ecc_alloc_point(unsigned int ndigits) { struct ecc_point *p = kmalloc(sizeof(*p), GFP_KERNEL); if (!p) return NULL; p->x = ecc_alloc_digits_space(ndigits); if (!p->x) goto err_alloc_x; p->y = ecc_alloc_digits_space(ndigits); if (!p->y) goto err_alloc_y; p->ndigits = ndigits; return p; err_alloc_y: ecc_free_digits_space(p->x); err_alloc_x: kfree(p); return NULL; } static void ecc_free_point(struct ecc_point *p) { if (!p) return; kfree_sensitive(p->x); kfree_sensitive(p->y); kfree_sensitive(p); } static void vli_clear(u64 *vli, unsigned int ndigits) { int i; for (i = 0; i < ndigits; i++) vli[i] = 0; } /* Returns true if vli == 0, false otherwise. */ bool vli_is_zero(const u64 *vli, unsigned int ndigits) { int i; for (i = 0; i < ndigits; i++) { if (vli[i]) return false; } return true; } EXPORT_SYMBOL(vli_is_zero); /* Returns nonzero if bit of vli is set. */ static u64 vli_test_bit(const u64 *vli, unsigned int bit) { return (vli[bit / 64] & ((u64)1 << (bit % 64))); } static bool vli_is_negative(const u64 *vli, unsigned int ndigits) { return vli_test_bit(vli, ndigits * 64 - 1); } /* Counts the number of 64-bit "digits" in vli. */ static unsigned int vli_num_digits(const u64 *vli, unsigned int ndigits) { int i; /* Search from the end until we find a non-zero digit. * We do it in reverse because we expect that most digits will * be nonzero. */ for (i = ndigits - 1; i >= 0 && vli[i] == 0; i--); return (i + 1); } /* Counts the number of bits required for vli. */ static unsigned int vli_num_bits(const u64 *vli, unsigned int ndigits) { unsigned int i, num_digits; u64 digit; num_digits = vli_num_digits(vli, ndigits); if (num_digits == 0) return 0; digit = vli[num_digits - 1]; for (i = 0; digit; i++) digit >>= 1; return ((num_digits - 1) * 64 + i); } /* Set dest from unaligned bit string src. */ void vli_from_be64(u64 *dest, const void *src, unsigned int ndigits) { int i; const u64 *from = src; for (i = 0; i < ndigits; i++) dest[i] = get_unaligned_be64(&from[ndigits - 1 - i]); } EXPORT_SYMBOL(vli_from_be64); void vli_from_le64(u64 *dest, const void *src, unsigned int ndigits) { int i; const u64 *from = src; for (i = 0; i < ndigits; i++) dest[i] = get_unaligned_le64(&from[i]); } EXPORT_SYMBOL(vli_from_le64); /* Sets dest = src. */ static void vli_set(u64 *dest, const u64 *src, unsigned int ndigits) { int i; for (i = 0; i < ndigits; i++) dest[i] = src[i]; } /* Returns sign of left - right. */ int vli_cmp(const u64 *left, const u64 *right, unsigned int ndigits) { int i; for (i = ndigits - 1; i >= 0; i--) { if (left[i] > right[i]) return 1; else if (left[i] < right[i]) return -1; } return 0; } EXPORT_SYMBOL(vli_cmp); /* Computes result = in << c, returning carry. Can modify in place * (if result == in). 0 < shift < 64. */ static u64 vli_lshift(u64 *result, const u64 *in, unsigned int shift, unsigned int ndigits) { u64 carry = 0; int i; for (i = 0; i < ndigits; i++) { u64 temp = in[i]; result[i] = (temp << shift) | carry; carry = temp >> (64 - shift); } return carry; } /* Computes vli = vli >> 1. */ static void vli_rshift1(u64 *vli, unsigned int ndigits) { u64 *end = vli; u64 carry = 0; vli += ndigits; while (vli-- > end) { u64 temp = *vli; *vli = (temp >> 1) | carry; carry = temp << 63; } } /* Computes result = left + right, returning carry. Can modify in place. */ static u64 vli_add(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits) { u64 carry = 0; int i; for (i = 0; i < ndigits; i++) { u64 sum; sum = left[i] + right[i] + carry; if (sum != left[i]) carry = (sum < left[i]); result[i] = sum; } return carry; } /* Computes result = left + right, returning carry. Can modify in place. */ static u64 vli_uadd(u64 *result, const u64 *left, u64 right, unsigned int ndigits) { u64 carry = right; int i; for (i = 0; i < ndigits; i++) { u64 sum; sum = left[i] + carry; if (sum != left[i]) carry = (sum < left[i]); else carry = !!carry; result[i] = sum; } return carry; } /* Computes result = left - right, returning borrow. Can modify in place. */ u64 vli_sub(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits) { u64 borrow = 0; int i; for (i = 0; i < ndigits; i++) { u64 diff; diff = left[i] - right[i] - borrow; if (diff != left[i]) borrow = (diff > left[i]); result[i] = diff; } return borrow; } EXPORT_SYMBOL(vli_sub); /* Computes result = left - right, returning borrow. Can modify in place. */ static u64 vli_usub(u64 *result, const u64 *left, u64 right, unsigned int ndigits) { u64 borrow = right; int i; for (i = 0; i < ndigits; i++) { u64 diff; diff = left[i] - borrow; if (diff != left[i]) borrow = (diff > left[i]); result[i] = diff; } return borrow; } static uint128_t mul_64_64(u64 left, u64 right) { uint128_t result; #if defined(CONFIG_ARCH_SUPPORTS_INT128) unsigned __int128 m = (unsigned __int128)left * right; result.m_low = m; result.m_high = m >> 64; #else u64 a0 = left & 0xffffffffull; u64 a1 = left >> 32; u64 b0 = right & 0xffffffffull; u64 b1 = right >> 32; u64 m0 = a0 * b0; u64 m1 = a0 * b1; u64 m2 = a1 * b0; u64 m3 = a1 * b1; m2 += (m0 >> 32); m2 += m1; /* Overflow */ if (m2 < m1) m3 += 0x100000000ull; result.m_low = (m0 & 0xffffffffull) | (m2 << 32); result.m_high = m3 + (m2 >> 32); #endif return result; } static uint128_t add_128_128(uint128_t a, uint128_t b) { uint128_t result; result.m_low = a.m_low + b.m_low; result.m_high = a.m_high + b.m_high + (result.m_low < a.m_low); return result; } static void vli_mult(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits) { uint128_t r01 = { 0, 0 }; u64 r2 = 0; unsigned int i, k; /* Compute each digit of result in sequence, maintaining the * carries. */ for (k = 0; k < ndigits * 2 - 1; k++) { unsigned int min; if (k < ndigits) min = 0; else min = (k + 1) - ndigits; for (i = min; i <= k && i < ndigits; i++) { uint128_t product; product = mul_64_64(left[i], right[k - i]); r01 = add_128_128(r01, product); r2 += (r01.m_high < product.m_high); } result[k] = r01.m_low; r01.m_low = r01.m_high; r01.m_high = r2; r2 = 0; } result[ndigits * 2 - 1] = r01.m_low; } /* Compute product = left * right, for a small right value. */ static void vli_umult(u64 *result, const u64 *left, u32 right, unsigned int ndigits) { uint128_t r01 = { 0 }; unsigned int k; for (k = 0; k < ndigits; k++) { uint128_t product; product = mul_64_64(left[k], right); r01 = add_128_128(r01, product); /* no carry */ result[k] = r01.m_low; r01.m_low = r01.m_high; r01.m_high = 0; } result[k] = r01.m_low; for (++k; k < ndigits * 2; k++) result[k] = 0; } static void vli_square(u64 *result, const u64 *left, unsigned int ndigits) { uint128_t r01 = { 0, 0 }; u64 r2 = 0; int i, k; for (k = 0; k < ndigits * 2 - 1; k++) { unsigned int min; if (k < ndigits) min = 0; else min = (k + 1) - ndigits; for (i = min; i <= k && i <= k - i; i++) { uint128_t product; product = mul_64_64(left[i], left[k - i]); if (i < k - i) { r2 += product.m_high >> 63; product.m_high = (product.m_high << 1) | (product.m_low >> 63); product.m_low <<= 1; } r01 = add_128_128(r01, product); r2 += (r01.m_high < product.m_high); } result[k] = r01.m_low; r01.m_low = r01.m_high; r01.m_high = r2; r2 = 0; } result[ndigits * 2 - 1] = r01.m_low; } /* Computes result = (left + right) % mod. * Assumes that left < mod and right < mod, result != mod. */ static void vli_mod_add(u64 *result, const u64 *left, const u64 *right, const u64 *mod, unsigned int ndigits) { u64 carry; carry = vli_add(result, left, right, ndigits); /* result > mod (result = mod + remainder), so subtract mod to * get remainder. */ if (carry || vli_cmp(result, mod, ndigits) >= 0) vli_sub(result, result, mod, ndigits); }