1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* RSA asymmetric public-key algorithm [RFC3447] 3 * 4 * Copyright (c) 2015, Intel Corporation 5 * Authors: Tadeusz Struk <tadeusz.struk@intel.com> 6 */ 7 8 #include <linux/fips.h> 9 #include <linux/module.h> 10 #include <linux/mpi.h> 11 #include <crypto/internal/rsa.h> 12 #include <crypto/internal/akcipher.h> 13 #include <crypto/akcipher.h> 14 #include <crypto/algapi.h> 15 16 struct rsa_mpi_key { 17 MPI n; 18 MPI e; 19 MPI d; 20 MPI p; 21 MPI q; 22 MPI dp; 23 MPI dq; 24 MPI qinv; 25 }; 26 27 /* 28 * RSAEP function [RFC3447 sec 5.1.1] 29 * c = m^e mod n; 30 */ 31 static int _rsa_enc(const struct rsa_mpi_key *key, MPI c, MPI m) 32 { 33 /* (1) Validate 0 <= m < n */ 34 if (mpi_cmp_ui(m, 0) < 0 || mpi_cmp(m, key->n) >= 0) 35 return -EINVAL; 36 37 /* (2) c = m^e mod n */ 38 return mpi_powm(c, m, key->e, key->n); 39 } 40 41 /* 42 * RSADP function [RFC3447 sec 5.1.2] 43 * m_1 = c^dP mod p; 44 * m_2 = c^dQ mod q; 45 * h = (m_1 - m_2) * qInv mod p; 46 * m = m_2 + q * h; 47 */ 48 static int _rsa_dec_crt(const struct rsa_mpi_key *key, MPI m_or_m1_or_h, MPI c) 49 { 50 MPI m2, m12_or_qh; 51 int ret = -ENOMEM; 52 53 /* (1) Validate 0 <= c < n */ 54 if (mpi_cmp_ui(c, 0) < 0 || mpi_cmp(c, key->n) >= 0) 55 return -EINVAL; 56 57 m2 = mpi_alloc(0); 58 m12_or_qh = mpi_alloc(0); 59 if (!m2 || !m12_or_qh) 60 goto err_free_mpi; 61 62 /* (2i) m_1 = c^dP mod p */ 63 ret = mpi_powm(m_or_m1_or_h, c, key->dp, key->p); 64 if (ret) 65 goto err_free_mpi; 66 67 /* (2i) m_2 = c^dQ mod q */ 68 ret = mpi_powm(m2, c, key->dq, key->q); 69 if (ret) 70 goto err_free_mpi; 71 72 /* (2iii) h = (m_1 - m_2) * qInv mod p */ 73 mpi_sub(m12_or_qh, m_or_m1_or_h, m2); 74 mpi_mulm(m_or_m1_or_h, m12_or_qh, key->qinv, key->p); 75 76 /* (2iv) m = m_2 + q * h */ 77 mpi_mul(m12_or_qh, key->q, m_or_m1_or_h); 78 mpi_addm(m_or_m1_or_h, m2, m12_or_qh, key->n); 79 80 ret = 0; 81 82 err_free_mpi: 83 mpi_free(m12_or_qh); 84 mpi_free(m2); 85 return ret; 86 } 87 88 static inline struct rsa_mpi_key *rsa_get_key(struct crypto_akcipher *tfm) 89 { 90 return akcipher_tfm_ctx(tfm); 91 } 92 93 static int rsa_enc(struct akcipher_request *req) 94 { 95 struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req); 96 const struct rsa_mpi_key *pkey = rsa_get_key(tfm); 97 MPI m, c = mpi_alloc(0); 98 int ret = 0; 99 int sign; 100 101 if (!c) 102 return -ENOMEM; 103 104 if (unlikely(!pkey->n || !pkey->e)) { 105 ret = -EINVAL; 106 goto err_free_c; 107 } 108 109 ret = -ENOMEM; 110 m = mpi_read_raw_from_sgl(req->src, req->src_len); 111 if (!m) 112 goto err_free_c; 113 114 ret = _rsa_enc(pkey, c, m); 115 if (ret) 116 goto err_free_m; 117 118 ret = mpi_write_to_sgl(c, req->dst, req->dst_len, &sign); 119 if (ret) 120 goto err_free_m; 121 122 if (sign < 0) 123 ret = -EBADMSG; 124 125 err_free_m: 126 mpi_free(m); 127 err_free_c: 128 mpi_free(c); 129 return ret; 130 } 131 132 static int rsa_dec(struct akcipher_request *req) 133 { 134 struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req); 135 const struct rsa_mpi_key *pkey = rsa_get_key(tfm); 136 MPI c, m = mpi_alloc(0); 137 int ret = 0; 138 int sign; 139 140 if (!m) 141 return -ENOMEM; 142 143 if (unlikely(!pkey->n || !pkey->d)) { 144 ret = -EINVAL; 145 goto err_free_m; 146 } 147 148 ret = -ENOMEM; 149 c = mpi_read_raw_from_sgl(req->src, req->src_len); 150 if (!c) 151 goto err_free_m; 152 153 ret = _rsa_dec_crt(pkey, m, c); 154 if (ret) 155 goto err_free_c; 156 157 ret = mpi_write_to_sgl(m, req->dst, req->dst_len, &sign); 158 if (ret) 159 goto err_free_c; 160 161 if (sign < 0) 162 ret = -EBADMSG; 163 err_free_c: 164 mpi_free(c); 165 err_free_m: 166 mpi_free(m); 167 return ret; 168 } 169 170 static void rsa_free_mpi_key(struct rsa_mpi_key *key) 171 { 172 mpi_free(key->d); 173 mpi_free(key->e); 174 mpi_free(key->n); 175 mpi_free(key->p); 176 mpi_free(key->q); 177 mpi_free(key->dp); 178 mpi_free(key->dq); 179 mpi_free(key->qinv); 180 key->d = NULL; 181 key->e = NULL; 182 key->n = NULL; 183 key->p = NULL; 184 key->q = NULL; 185 key->dp = NULL; 186 key->dq = NULL; 187 key->qinv = NULL; 188 } 189 190 static int rsa_check_key_length(unsigned int len) 191 { 192 switch (len) { 193 case 512: 194 case 1024: 195 case 1536: 196 if (fips_enabled) 197 return -EINVAL; 198 fallthrough; 199 case 2048: 200 case 3072: 201 case 4096: 202 return 0; 203 } 204 205 return -EINVAL; 206 } 207 208 static int rsa_check_exponent_fips(MPI e) 209 { 210 MPI e_max = NULL; 211 212 /* check if odd */ 213 if (!mpi_test_bit(e, 0)) { 214 return -EINVAL; 215 } 216 217 /* check if 2^16 < e < 2^256. */ 218 if (mpi_cmp_ui(e, 65536) <= 0) { 219 return -EINVAL; 220 } 221 222 e_max = mpi_alloc(0); 223 mpi_set_bit(e_max, 256); 224 225 if (mpi_cmp(e, e_max) >= 0) { 226 mpi_free(e_max); 227 return -EINVAL; 228 } 229 230 mpi_free(e_max); 231 return 0; 232 } 233 234 static int rsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, 235 unsigned int keylen) 236 { 237 struct rsa_mpi_key *mpi_key = akcipher_tfm_ctx(tfm); 238 struct rsa_key raw_key = {0}; 239 int ret; 240 241 /* Free the old MPI key if any */ 242 rsa_free_mpi_key(mpi_key); 243 244 ret = rsa_parse_pub_key(&raw_key, key, keylen); 245 if (ret) 246 return ret; 247 248 mpi_key->e = mpi_read_raw_data(raw_key.e, raw_key.e_sz); 249 if (!mpi_key->e) 250 goto err; 251 252 mpi_key->n = mpi_read_raw_data(raw_key.n, raw_key.n_sz); 253 if (!mpi_key->n) 254 goto err; 255 256 if (rsa_check_key_length(mpi_get_size(mpi_key->n) << 3)) { 257 rsa_free_mpi_key(mpi_key); 258 return -EINVAL; 259 } 260 261 if (fips_enabled && rsa_check_exponent_fips(mpi_key->e)) { 262 rsa_free_mpi_key(mpi_key); 263 return -EINVAL; 264 } 265 266 return 0; 267 268 err: 269 rsa_free_mpi_key(mpi_key); 270 return -ENOMEM; 271 } 272 273 static int rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key, 274 unsigned int keylen) 275 { 276 struct rsa_mpi_key *mpi_key = akcipher_tfm_ctx(tfm); 277 struct rsa_key raw_key = {0}; 278 int ret; 279 280 /* Free the old MPI key if any */ 281 rsa_free_mpi_key(mpi_key); 282 283 ret = rsa_parse_priv_key(&raw_key, key, keylen); 284 if (ret) 285 return ret; 286 287 mpi_key->d = mpi_read_raw_data(raw_key.d, raw_key.d_sz); 288 if (!mpi_key->d) 289 goto err; 290 291 mpi_key->e = mpi_read_raw_data(raw_key.e, raw_key.e_sz); 292 if (!mpi_key->e) 293 goto err; 294 295 mpi_key->n = mpi_read_raw_data(raw_key.n, raw_key.n_sz); 296 if (!mpi_key->n) 297 goto err; 298 299 mpi_key->p = mpi_read_raw_data(raw_key.p, raw_key.p_sz); 300 if (!mpi_key->p) 301 goto err; 302 303 mpi_key->q = mpi_read_raw_data(raw_key.q, raw_key.q_sz); 304 if (!mpi_key->q) 305 goto err; 306 307 mpi_key->dp = mpi_read_raw_data(raw_key.dp, raw_key.dp_sz); 308 if (!mpi_key->dp) 309 goto err; 310 311 mpi_key->dq = mpi_read_raw_data(raw_key.dq, raw_key.dq_sz); 312 if (!mpi_key->dq) 313 goto err; 314 315 mpi_key->qinv = mpi_read_raw_data(raw_key.qinv, raw_key.qinv_sz); 316 if (!mpi_key->qinv) 317 goto err; 318 319 if (rsa_check_key_length(mpi_get_size(mpi_key->n) << 3)) { 320 rsa_free_mpi_key(mpi_key); 321 return -EINVAL; 322 } 323 324 if (fips_enabled && rsa_check_exponent_fips(mpi_key->e)) { 325 rsa_free_mpi_key(mpi_key); 326 return -EINVAL; 327 } 328 329 return 0; 330 331 err: 332 rsa_free_mpi_key(mpi_key); 333 return -ENOMEM; 334 } 335 336 static unsigned int rsa_max_size(struct crypto_akcipher *tfm) 337 { 338 struct rsa_mpi_key *pkey = akcipher_tfm_ctx(tfm); 339 340 return mpi_get_size(pkey->n); 341 } 342 343 static void rsa_exit_tfm(struct crypto_akcipher *tfm) 344 { 345 struct rsa_mpi_key *pkey = akcipher_tfm_ctx(tfm); 346 347 rsa_free_mpi_key(pkey); 348 } 349 350 static struct akcipher_alg rsa = { 351 .encrypt = rsa_enc, 352 .decrypt = rsa_dec, 353 .set_priv_key = rsa_set_priv_key, 354 .set_pub_key = rsa_set_pub_key, 355 .max_size = rsa_max_size, 356 .exit = rsa_exit_tfm, 357 .base = { 358 .cra_name = "rsa", 359 .cra_driver_name = "rsa-generic", 360 .cra_priority = 100, 361 .cra_module = THIS_MODULE, 362 .cra_ctxsize = sizeof(struct rsa_mpi_key), 363 }, 364 }; 365 366 static int __init rsa_init(void) 367 { 368 int err; 369 370 err = crypto_register_akcipher(&rsa); 371 if (err) 372 return err; 373 374 err = crypto_register_template(&rsa_pkcs1pad_tmpl); 375 if (err) { 376 crypto_unregister_akcipher(&rsa); 377 return err; 378 } 379 380 return 0; 381 } 382 383 static void __exit rsa_exit(void) 384 { 385 crypto_unregister_template(&rsa_pkcs1pad_tmpl); 386 crypto_unregister_akcipher(&rsa); 387 } 388 389 subsys_initcall(rsa_init); 390 module_exit(rsa_exit); 391 MODULE_ALIAS_CRYPTO("rsa"); 392 MODULE_LICENSE("GPL"); 393 MODULE_DESCRIPTION("RSA generic algorithm"); 394