1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* RSA asymmetric public-key algorithm [RFC3447] 3 * 4 * Copyright (c) 2015, Intel Corporation 5 * Authors: Tadeusz Struk <tadeusz.struk@intel.com> 6 */ 7 8 #include <linux/fips.h> 9 #include <linux/module.h> 10 #include <linux/mpi.h> 11 #include <crypto/internal/rsa.h> 12 #include <crypto/internal/akcipher.h> 13 #include <crypto/akcipher.h> 14 #include <crypto/algapi.h> 15 16 struct rsa_mpi_key { 17 MPI n; 18 MPI e; 19 MPI d; 20 MPI p; 21 MPI q; 22 MPI dp; 23 MPI dq; 24 MPI qinv; 25 }; 26 27 /* 28 * RSAEP function [RFC3447 sec 5.1.1] 29 * c = m^e mod n; 30 */ 31 static int _rsa_enc(const struct rsa_mpi_key *key, MPI c, MPI m) 32 { 33 /* (1) Validate 0 <= m < n */ 34 if (mpi_cmp_ui(m, 0) < 0 || mpi_cmp(m, key->n) >= 0) 35 return -EINVAL; 36 37 /* (2) c = m^e mod n */ 38 return mpi_powm(c, m, key->e, key->n); 39 } 40 41 /* 42 * RSADP function [RFC3447 sec 5.1.2] 43 * m_1 = c^dP mod p; 44 * m_2 = c^dQ mod q; 45 * h = (m_1 - m_2) * qInv mod p; 46 * m = m_2 + q * h; 47 */ 48 static int _rsa_dec_crt(const struct rsa_mpi_key *key, MPI m_or_m1_or_h, MPI c) 49 { 50 MPI m2, m12_or_qh; 51 int ret = -ENOMEM; 52 53 /* (1) Validate 0 <= c < n */ 54 if (mpi_cmp_ui(c, 0) < 0 || mpi_cmp(c, key->n) >= 0) 55 return -EINVAL; 56 57 m2 = mpi_alloc(0); 58 m12_or_qh = mpi_alloc(0); 59 if (!m2 || !m12_or_qh) 60 goto err_free_mpi; 61 62 /* (2i) m_1 = c^dP mod p */ 63 ret = mpi_powm(m_or_m1_or_h, c, key->dp, key->p); 64 if (ret) 65 goto err_free_mpi; 66 67 /* (2i) m_2 = c^dQ mod q */ 68 ret = mpi_powm(m2, c, key->dq, key->q); 69 if (ret) 70 goto err_free_mpi; 71 72 /* (2iii) h = (m_1 - m_2) * qInv mod p */ 73 mpi_sub(m12_or_qh, m_or_m1_or_h, m2); 74 mpi_mulm(m_or_m1_or_h, m12_or_qh, key->qinv, key->p); 75 76 /* (2iv) m = m_2 + q * h */ 77 mpi_mul(m12_or_qh, key->q, m_or_m1_or_h); 78 mpi_addm(m_or_m1_or_h, m2, m12_or_qh, key->n); 79 80 ret = 0; 81 82 err_free_mpi: 83 mpi_free(m12_or_qh); 84 mpi_free(m2); 85 return ret; 86 } 87 88 static inline struct rsa_mpi_key *rsa_get_key(struct crypto_akcipher *tfm) 89 { 90 return akcipher_tfm_ctx(tfm); 91 } 92 93 static int rsa_enc(struct akcipher_request *req) 94 { 95 struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req); 96 const struct rsa_mpi_key *pkey = rsa_get_key(tfm); 97 MPI m, c = mpi_alloc(0); 98 int ret = 0; 99 int sign; 100 101 if (!c) 102 return -ENOMEM; 103 104 if (unlikely(!pkey->n || !pkey->e)) { 105 ret = -EINVAL; 106 goto err_free_c; 107 } 108 109 ret = -ENOMEM; 110 m = mpi_read_raw_from_sgl(req->src, req->src_len); 111 if (!m) 112 goto err_free_c; 113 114 ret = _rsa_enc(pkey, c, m); 115 if (ret) 116 goto err_free_m; 117 118 ret = mpi_write_to_sgl(c, req->dst, req->dst_len, &sign); 119 if (ret) 120 goto err_free_m; 121 122 if (sign < 0) 123 ret = -EBADMSG; 124 125 err_free_m: 126 mpi_free(m); 127 err_free_c: 128 mpi_free(c); 129 return ret; 130 } 131 132 static int rsa_dec(struct akcipher_request *req) 133 { 134 struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req); 135 const struct rsa_mpi_key *pkey = rsa_get_key(tfm); 136 MPI c, m = mpi_alloc(0); 137 int ret = 0; 138 int sign; 139 140 if (!m) 141 return -ENOMEM; 142 143 if (unlikely(!pkey->n || !pkey->d)) { 144 ret = -EINVAL; 145 goto err_free_m; 146 } 147 148 ret = -ENOMEM; 149 c = mpi_read_raw_from_sgl(req->src, req->src_len); 150 if (!c) 151 goto err_free_m; 152 153 ret = _rsa_dec_crt(pkey, m, c); 154 if (ret) 155 goto err_free_c; 156 157 ret = mpi_write_to_sgl(m, req->dst, req->dst_len, &sign); 158 if (ret) 159 goto err_free_c; 160 161 if (sign < 0) 162 ret = -EBADMSG; 163 err_free_c: 164 mpi_free(c); 165 err_free_m: 166 mpi_free(m); 167 return ret; 168 } 169 170 static void rsa_free_mpi_key(struct rsa_mpi_key *key) 171 { 172 mpi_free(key->d); 173 mpi_free(key->e); 174 mpi_free(key->n); 175 mpi_free(key->p); 176 mpi_free(key->q); 177 mpi_free(key->dp); 178 mpi_free(key->dq); 179 mpi_free(key->qinv); 180 key->d = NULL; 181 key->e = NULL; 182 key->n = NULL; 183 key->p = NULL; 184 key->q = NULL; 185 key->dp = NULL; 186 key->dq = NULL; 187 key->qinv = NULL; 188 } 189 190 static int rsa_check_key_length(unsigned int len) 191 { 192 switch (len) { 193 case 512: 194 case 1024: 195 case 1536: 196 if (fips_enabled) 197 return -EINVAL; 198 fallthrough; 199 case 2048: 200 case 3072: 201 case 4096: 202 return 0; 203 } 204 205 return -EINVAL; 206 } 207 208 static int rsa_check_exponent_fips(MPI e) 209 { 210 MPI e_max = NULL; 211 212 /* check if odd */ 213 if (!mpi_test_bit(e, 0)) { 214 return -EINVAL; 215 } 216 217 /* check if 2^16 < e < 2^256. */ 218 if (mpi_cmp_ui(e, 65536) <= 0) { 219 return -EINVAL; 220 } 221 222 e_max = mpi_alloc(0); 223 if (!e_max) 224 return -ENOMEM; 225 mpi_set_bit(e_max, 256); 226 227 if (mpi_cmp(e, e_max) >= 0) { 228 mpi_free(e_max); 229 return -EINVAL; 230 } 231 232 mpi_free(e_max); 233 return 0; 234 } 235 236 static int rsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, 237 unsigned int keylen) 238 { 239 struct rsa_mpi_key *mpi_key = akcipher_tfm_ctx(tfm); 240 struct rsa_key raw_key = {0}; 241 int ret; 242 243 /* Free the old MPI key if any */ 244 rsa_free_mpi_key(mpi_key); 245 246 ret = rsa_parse_pub_key(&raw_key, key, keylen); 247 if (ret) 248 return ret; 249 250 mpi_key->e = mpi_read_raw_data(raw_key.e, raw_key.e_sz); 251 if (!mpi_key->e) 252 goto err; 253 254 mpi_key->n = mpi_read_raw_data(raw_key.n, raw_key.n_sz); 255 if (!mpi_key->n) 256 goto err; 257 258 if (rsa_check_key_length(mpi_get_size(mpi_key->n) << 3)) { 259 rsa_free_mpi_key(mpi_key); 260 return -EINVAL; 261 } 262 263 if (fips_enabled && rsa_check_exponent_fips(mpi_key->e)) { 264 rsa_free_mpi_key(mpi_key); 265 return -EINVAL; 266 } 267 268 return 0; 269 270 err: 271 rsa_free_mpi_key(mpi_key); 272 return -ENOMEM; 273 } 274 275 static int rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key, 276 unsigned int keylen) 277 { 278 struct rsa_mpi_key *mpi_key = akcipher_tfm_ctx(tfm); 279 struct rsa_key raw_key = {0}; 280 int ret; 281 282 /* Free the old MPI key if any */ 283 rsa_free_mpi_key(mpi_key); 284 285 ret = rsa_parse_priv_key(&raw_key, key, keylen); 286 if (ret) 287 return ret; 288 289 mpi_key->d = mpi_read_raw_data(raw_key.d, raw_key.d_sz); 290 if (!mpi_key->d) 291 goto err; 292 293 mpi_key->e = mpi_read_raw_data(raw_key.e, raw_key.e_sz); 294 if (!mpi_key->e) 295 goto err; 296 297 mpi_key->n = mpi_read_raw_data(raw_key.n, raw_key.n_sz); 298 if (!mpi_key->n) 299 goto err; 300 301 mpi_key->p = mpi_read_raw_data(raw_key.p, raw_key.p_sz); 302 if (!mpi_key->p) 303 goto err; 304 305 mpi_key->q = mpi_read_raw_data(raw_key.q, raw_key.q_sz); 306 if (!mpi_key->q) 307 goto err; 308 309 mpi_key->dp = mpi_read_raw_data(raw_key.dp, raw_key.dp_sz); 310 if (!mpi_key->dp) 311 goto err; 312 313 mpi_key->dq = mpi_read_raw_data(raw_key.dq, raw_key.dq_sz); 314 if (!mpi_key->dq) 315 goto err; 316 317 mpi_key->qinv = mpi_read_raw_data(raw_key.qinv, raw_key.qinv_sz); 318 if (!mpi_key->qinv) 319 goto err; 320 321 if (rsa_check_key_length(mpi_get_size(mpi_key->n) << 3)) { 322 rsa_free_mpi_key(mpi_key); 323 return -EINVAL; 324 } 325 326 if (fips_enabled && rsa_check_exponent_fips(mpi_key->e)) { 327 rsa_free_mpi_key(mpi_key); 328 return -EINVAL; 329 } 330 331 return 0; 332 333 err: 334 rsa_free_mpi_key(mpi_key); 335 return -ENOMEM; 336 } 337 338 static unsigned int rsa_max_size(struct crypto_akcipher *tfm) 339 { 340 struct rsa_mpi_key *pkey = akcipher_tfm_ctx(tfm); 341 342 return mpi_get_size(pkey->n); 343 } 344 345 static void rsa_exit_tfm(struct crypto_akcipher *tfm) 346 { 347 struct rsa_mpi_key *pkey = akcipher_tfm_ctx(tfm); 348 349 rsa_free_mpi_key(pkey); 350 } 351 352 static struct akcipher_alg rsa = { 353 .encrypt = rsa_enc, 354 .decrypt = rsa_dec, 355 .set_priv_key = rsa_set_priv_key, 356 .set_pub_key = rsa_set_pub_key, 357 .max_size = rsa_max_size, 358 .exit = rsa_exit_tfm, 359 .base = { 360 .cra_name = "rsa", 361 .cra_driver_name = "rsa-generic", 362 .cra_priority = 100, 363 .cra_module = THIS_MODULE, 364 .cra_ctxsize = sizeof(struct rsa_mpi_key), 365 }, 366 }; 367 368 static int __init rsa_init(void) 369 { 370 int err; 371 372 err = crypto_register_akcipher(&rsa); 373 if (err) 374 return err; 375 376 err = crypto_register_template(&rsa_pkcs1pad_tmpl); 377 if (err) { 378 crypto_unregister_akcipher(&rsa); 379 return err; 380 } 381 382 return 0; 383 } 384 385 static void __exit rsa_exit(void) 386 { 387 crypto_unregister_template(&rsa_pkcs1pad_tmpl); 388 crypto_unregister_akcipher(&rsa); 389 } 390 391 subsys_initcall(rsa_init); 392 module_exit(rsa_exit); 393 MODULE_ALIAS_CRYPTO("rsa"); 394 MODULE_LICENSE("GPL"); 395 MODULE_DESCRIPTION("RSA generic algorithm"); 396