1b4d0d230SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-or-later
24ae71c1dSDavid Howells /* Signature verification with an asymmetric key
34ae71c1dSDavid Howells *
40efaaa86SMauro Carvalho Chehab * See Documentation/crypto/asymmetric-keys.rst
54ae71c1dSDavid Howells *
64ae71c1dSDavid Howells * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
74ae71c1dSDavid Howells * Written by David Howells (dhowells@redhat.com)
84ae71c1dSDavid Howells */
94ae71c1dSDavid Howells
10c3ce6dfaSDavid Howells #define pr_fmt(fmt) "SIG: "fmt
114ae71c1dSDavid Howells #include <keys/asymmetric-subtype.h>
121f6a9ab0SPaul Gortmaker #include <linux/export.h>
134ae71c1dSDavid Howells #include <linux/err.h>
143b764563SDavid Howells #include <linux/slab.h>
155a307718SDavid Howells #include <linux/keyctl.h>
164ae71c1dSDavid Howells #include <crypto/public_key.h>
175a307718SDavid Howells #include <keys/user-type.h>
184ae71c1dSDavid Howells #include "asymmetric_keys.h"
194ae71c1dSDavid Howells
203b764563SDavid Howells /*
213b764563SDavid Howells * Destroy a public key signature.
223b764563SDavid Howells */
public_key_signature_free(struct public_key_signature * sig)233b764563SDavid Howells void public_key_signature_free(struct public_key_signature *sig)
243b764563SDavid Howells {
25a022ec02SDavid Howells int i;
26a022ec02SDavid Howells
273b764563SDavid Howells if (sig) {
28a022ec02SDavid Howells for (i = 0; i < ARRAY_SIZE(sig->auth_ids); i++)
29a022ec02SDavid Howells kfree(sig->auth_ids[i]);
303b764563SDavid Howells kfree(sig->s);
313b764563SDavid Howells kfree(sig->digest);
323b764563SDavid Howells kfree(sig);
333b764563SDavid Howells }
343b764563SDavid Howells }
353b764563SDavid Howells EXPORT_SYMBOL_GPL(public_key_signature_free);
363b764563SDavid Howells
374ae71c1dSDavid Howells /**
38*4920a4a7STom Rix * query_asymmetric_key - Get information about an asymmetric key.
395a307718SDavid Howells * @params: Various parameters.
405a307718SDavid Howells * @info: Where to put the information.
415a307718SDavid Howells */
query_asymmetric_key(const struct kernel_pkey_params * params,struct kernel_pkey_query * info)425a307718SDavid Howells int query_asymmetric_key(const struct kernel_pkey_params *params,
435a307718SDavid Howells struct kernel_pkey_query *info)
445a307718SDavid Howells {
455a307718SDavid Howells const struct asymmetric_key_subtype *subtype;
465a307718SDavid Howells struct key *key = params->key;
475a307718SDavid Howells int ret;
485a307718SDavid Howells
495a307718SDavid Howells pr_devel("==>%s()\n", __func__);
505a307718SDavid Howells
515a307718SDavid Howells if (key->type != &key_type_asymmetric)
525a307718SDavid Howells return -EINVAL;
535a307718SDavid Howells subtype = asymmetric_key_subtype(key);
545a307718SDavid Howells if (!subtype ||
555a307718SDavid Howells !key->payload.data[0])
565a307718SDavid Howells return -EINVAL;
575a307718SDavid Howells if (!subtype->query)
585a307718SDavid Howells return -ENOTSUPP;
595a307718SDavid Howells
605a307718SDavid Howells ret = subtype->query(params, info);
615a307718SDavid Howells
625a307718SDavid Howells pr_devel("<==%s() = %d\n", __func__, ret);
635a307718SDavid Howells return ret;
645a307718SDavid Howells }
655a307718SDavid Howells EXPORT_SYMBOL_GPL(query_asymmetric_key);
665a307718SDavid Howells
675a307718SDavid Howells /**
685a307718SDavid Howells * encrypt_blob - Encrypt data using an asymmetric key
695a307718SDavid Howells * @params: Various parameters
705a307718SDavid Howells * @data: Data blob to be encrypted, length params->data_len
715a307718SDavid Howells * @enc: Encrypted data buffer, length params->enc_len
725a307718SDavid Howells *
735a307718SDavid Howells * Encrypt the specified data blob using the private key specified by
745a307718SDavid Howells * params->key. The encrypted data is wrapped in an encoding if
755a307718SDavid Howells * params->encoding is specified (eg. "pkcs1").
765a307718SDavid Howells *
775a307718SDavid Howells * Returns the length of the data placed in the encrypted data buffer or an
785a307718SDavid Howells * error.
795a307718SDavid Howells */
encrypt_blob(struct kernel_pkey_params * params,const void * data,void * enc)805a307718SDavid Howells int encrypt_blob(struct kernel_pkey_params *params,
815a307718SDavid Howells const void *data, void *enc)
825a307718SDavid Howells {
835a307718SDavid Howells params->op = kernel_pkey_encrypt;
845a307718SDavid Howells return asymmetric_key_eds_op(params, data, enc);
855a307718SDavid Howells }
865a307718SDavid Howells EXPORT_SYMBOL_GPL(encrypt_blob);
875a307718SDavid Howells
885a307718SDavid Howells /**
895a307718SDavid Howells * decrypt_blob - Decrypt data using an asymmetric key
905a307718SDavid Howells * @params: Various parameters
915a307718SDavid Howells * @enc: Encrypted data to be decrypted, length params->enc_len
925a307718SDavid Howells * @data: Decrypted data buffer, length params->data_len
935a307718SDavid Howells *
945a307718SDavid Howells * Decrypt the specified data blob using the private key specified by
955a307718SDavid Howells * params->key. The decrypted data is wrapped in an encoding if
965a307718SDavid Howells * params->encoding is specified (eg. "pkcs1").
975a307718SDavid Howells *
985a307718SDavid Howells * Returns the length of the data placed in the decrypted data buffer or an
995a307718SDavid Howells * error.
1005a307718SDavid Howells */
decrypt_blob(struct kernel_pkey_params * params,const void * enc,void * data)1015a307718SDavid Howells int decrypt_blob(struct kernel_pkey_params *params,
1025a307718SDavid Howells const void *enc, void *data)
1035a307718SDavid Howells {
1045a307718SDavid Howells params->op = kernel_pkey_decrypt;
1055a307718SDavid Howells return asymmetric_key_eds_op(params, enc, data);
1065a307718SDavid Howells }
1075a307718SDavid Howells EXPORT_SYMBOL_GPL(decrypt_blob);
1085a307718SDavid Howells
1095a307718SDavid Howells /**
1105a307718SDavid Howells * create_signature - Sign some data using an asymmetric key
1115a307718SDavid Howells * @params: Various parameters
1125a307718SDavid Howells * @data: Data blob to be signed, length params->data_len
1135a307718SDavid Howells * @enc: Signature buffer, length params->enc_len
1145a307718SDavid Howells *
1155a307718SDavid Howells * Sign the specified data blob using the private key specified by params->key.
1165a307718SDavid Howells * The signature is wrapped in an encoding if params->encoding is specified
1175a307718SDavid Howells * (eg. "pkcs1"). If the encoding needs to know the digest type, this can be
1185a307718SDavid Howells * passed through params->hash_algo (eg. "sha1").
1195a307718SDavid Howells *
1205a307718SDavid Howells * Returns the length of the data placed in the signature buffer or an error.
1215a307718SDavid Howells */
create_signature(struct kernel_pkey_params * params,const void * data,void * enc)1225a307718SDavid Howells int create_signature(struct kernel_pkey_params *params,
1235a307718SDavid Howells const void *data, void *enc)
1245a307718SDavid Howells {
1255a307718SDavid Howells params->op = kernel_pkey_sign;
1265a307718SDavid Howells return asymmetric_key_eds_op(params, data, enc);
1275a307718SDavid Howells }
1285a307718SDavid Howells EXPORT_SYMBOL_GPL(create_signature);
1295a307718SDavid Howells
1305a307718SDavid Howells /**
1314ae71c1dSDavid Howells * verify_signature - Initiate the use of an asymmetric key to verify a signature
1324ae71c1dSDavid Howells * @key: The asymmetric key to verify against
1334ae71c1dSDavid Howells * @sig: The signature to check
1344ae71c1dSDavid Howells *
1354ae71c1dSDavid Howells * Returns 0 if successful or else an error.
1364ae71c1dSDavid Howells */
verify_signature(const struct key * key,const struct public_key_signature * sig)1374ae71c1dSDavid Howells int verify_signature(const struct key *key,
1384ae71c1dSDavid Howells const struct public_key_signature *sig)
1394ae71c1dSDavid Howells {
1404ae71c1dSDavid Howells const struct asymmetric_key_subtype *subtype;
1414ae71c1dSDavid Howells int ret;
1424ae71c1dSDavid Howells
1434ae71c1dSDavid Howells pr_devel("==>%s()\n", __func__);
1444ae71c1dSDavid Howells
1454ae71c1dSDavid Howells if (key->type != &key_type_asymmetric)
1464ae71c1dSDavid Howells return -EINVAL;
1474ae71c1dSDavid Howells subtype = asymmetric_key_subtype(key);
1484ae71c1dSDavid Howells if (!subtype ||
149146aa8b1SDavid Howells !key->payload.data[0])
1504ae71c1dSDavid Howells return -EINVAL;
1514ae71c1dSDavid Howells if (!subtype->verify_signature)
1524ae71c1dSDavid Howells return -ENOTSUPP;
1534ae71c1dSDavid Howells
1544ae71c1dSDavid Howells ret = subtype->verify_signature(key, sig);
1554ae71c1dSDavid Howells
1564ae71c1dSDavid Howells pr_devel("<==%s() = %d\n", __func__, ret);
1574ae71c1dSDavid Howells return ret;
1584ae71c1dSDavid Howells }
1594ae71c1dSDavid Howells EXPORT_SYMBOL_GPL(verify_signature);
160