14920a4a7STom Rix // SPDX-License-Identifier: GPL-2.0-or-later
2ea7ecb66STianjia Zhang /*
3ea7ecb66STianjia Zhang * SM2 asymmetric public-key algorithm
4ea7ecb66STianjia Zhang * as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012 SM2 and
5ea7ecb66STianjia Zhang * described at https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
6ea7ecb66STianjia Zhang *
7ea7ecb66STianjia Zhang * Copyright (c) 2020, Alibaba Group.
8ea7ecb66STianjia Zhang * Authors: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
9ea7ecb66STianjia Zhang */
10ea7ecb66STianjia Zhang
11ea7ecb66STianjia Zhang #include <linux/module.h>
12ea7ecb66STianjia Zhang #include <linux/mpi.h>
13ea7ecb66STianjia Zhang #include <crypto/internal/akcipher.h>
14ea7ecb66STianjia Zhang #include <crypto/akcipher.h>
15ea7ecb66STianjia Zhang #include <crypto/hash.h>
16ea7ecb66STianjia Zhang #include <crypto/rng.h>
17ea7ecb66STianjia Zhang #include <crypto/sm2.h>
18ea7ecb66STianjia Zhang #include "sm2signature.asn1.h"
19ea7ecb66STianjia Zhang
20e5221fa6SHerbert Xu /* The default user id as specified in GM/T 0009-2012 */
21e5221fa6SHerbert Xu #define SM2_DEFAULT_USERID "1234567812345678"
22e5221fa6SHerbert Xu #define SM2_DEFAULT_USERID_LEN 16
23e5221fa6SHerbert Xu
24ea7ecb66STianjia Zhang #define MPI_NBYTES(m) ((mpi_get_nbits(m) + 7) / 8)
25ea7ecb66STianjia Zhang
26ea7ecb66STianjia Zhang struct ecc_domain_parms {
27ea7ecb66STianjia Zhang const char *desc; /* Description of the curve. */
28ea7ecb66STianjia Zhang unsigned int nbits; /* Number of bits. */
29ea7ecb66STianjia Zhang unsigned int fips:1; /* True if this is a FIPS140-2 approved curve */
30ea7ecb66STianjia Zhang
31ea7ecb66STianjia Zhang /* The model describing this curve. This is mainly used to select
32ea7ecb66STianjia Zhang * the group equation.
33ea7ecb66STianjia Zhang */
34ea7ecb66STianjia Zhang enum gcry_mpi_ec_models model;
35ea7ecb66STianjia Zhang
36ea7ecb66STianjia Zhang /* The actual ECC dialect used. This is used for curve specific
37ea7ecb66STianjia Zhang * optimizations and to select encodings etc.
38ea7ecb66STianjia Zhang */
39ea7ecb66STianjia Zhang enum ecc_dialects dialect;
40ea7ecb66STianjia Zhang
41ea7ecb66STianjia Zhang const char *p; /* The prime defining the field. */
42ea7ecb66STianjia Zhang const char *a, *b; /* The coefficients. For Twisted Edwards
43ea7ecb66STianjia Zhang * Curves b is used for d. For Montgomery
44ea7ecb66STianjia Zhang * Curves (a,b) has ((A-2)/4,B^-1).
45ea7ecb66STianjia Zhang */
46ea7ecb66STianjia Zhang const char *n; /* The order of the base point. */
47ea7ecb66STianjia Zhang const char *g_x, *g_y; /* Base point. */
48ea7ecb66STianjia Zhang unsigned int h; /* Cofactor. */
49ea7ecb66STianjia Zhang };
50ea7ecb66STianjia Zhang
51ea7ecb66STianjia Zhang static const struct ecc_domain_parms sm2_ecp = {
52ea7ecb66STianjia Zhang .desc = "sm2p256v1",
53ea7ecb66STianjia Zhang .nbits = 256,
54ea7ecb66STianjia Zhang .fips = 0,
55ea7ecb66STianjia Zhang .model = MPI_EC_WEIERSTRASS,
56ea7ecb66STianjia Zhang .dialect = ECC_DIALECT_STANDARD,
57ea7ecb66STianjia Zhang .p = "0xfffffffeffffffffffffffffffffffffffffffff00000000ffffffffffffffff",
58ea7ecb66STianjia Zhang .a = "0xfffffffeffffffffffffffffffffffffffffffff00000000fffffffffffffffc",
59ea7ecb66STianjia Zhang .b = "0x28e9fa9e9d9f5e344d5a9e4bcf6509a7f39789f515ab8f92ddbcbd414d940e93",
60ea7ecb66STianjia Zhang .n = "0xfffffffeffffffffffffffffffffffff7203df6b21c6052b53bbf40939d54123",
61ea7ecb66STianjia Zhang .g_x = "0x32c4ae2c1f1981195f9904466a39c9948fe30bbff2660be1715a4589334c74c7",
62ea7ecb66STianjia Zhang .g_y = "0xbc3736a2f4f6779c59bdcee36b692153d0a9877cc62a474002df32e52139f0a0",
63ea7ecb66STianjia Zhang .h = 1
64ea7ecb66STianjia Zhang };
65ea7ecb66STianjia Zhang
66e5221fa6SHerbert Xu static int __sm2_set_pub_key(struct mpi_ec_ctx *ec,
67e5221fa6SHerbert Xu const void *key, unsigned int keylen);
68e5221fa6SHerbert Xu
sm2_ec_ctx_init(struct mpi_ec_ctx * ec)69ea7ecb66STianjia Zhang static int sm2_ec_ctx_init(struct mpi_ec_ctx *ec)
70ea7ecb66STianjia Zhang {
71ea7ecb66STianjia Zhang const struct ecc_domain_parms *ecp = &sm2_ecp;
72ea7ecb66STianjia Zhang MPI p, a, b;
73ea7ecb66STianjia Zhang MPI x, y;
74ea7ecb66STianjia Zhang int rc = -EINVAL;
75ea7ecb66STianjia Zhang
76ea7ecb66STianjia Zhang p = mpi_scanval(ecp->p);
77ea7ecb66STianjia Zhang a = mpi_scanval(ecp->a);
78ea7ecb66STianjia Zhang b = mpi_scanval(ecp->b);
79ea7ecb66STianjia Zhang if (!p || !a || !b)
80ea7ecb66STianjia Zhang goto free_p;
81ea7ecb66STianjia Zhang
82ea7ecb66STianjia Zhang x = mpi_scanval(ecp->g_x);
83ea7ecb66STianjia Zhang y = mpi_scanval(ecp->g_y);
84ea7ecb66STianjia Zhang if (!x || !y)
85ea7ecb66STianjia Zhang goto free;
86ea7ecb66STianjia Zhang
87ea7ecb66STianjia Zhang rc = -ENOMEM;
885cd259caSHongbo Li
895cd259caSHongbo Li ec->Q = mpi_point_new(0);
905cd259caSHongbo Li if (!ec->Q)
915cd259caSHongbo Li goto free;
925cd259caSHongbo Li
93ea7ecb66STianjia Zhang /* mpi_ec_setup_elliptic_curve */
94ea7ecb66STianjia Zhang ec->G = mpi_point_new(0);
955cd259caSHongbo Li if (!ec->G) {
965cd259caSHongbo Li mpi_point_release(ec->Q);
97ea7ecb66STianjia Zhang goto free;
985cd259caSHongbo Li }
99ea7ecb66STianjia Zhang
100ea7ecb66STianjia Zhang mpi_set(ec->G->x, x);
101ea7ecb66STianjia Zhang mpi_set(ec->G->y, y);
102ea7ecb66STianjia Zhang mpi_set_ui(ec->G->z, 1);
103ea7ecb66STianjia Zhang
104ea7ecb66STianjia Zhang rc = -EINVAL;
105ea7ecb66STianjia Zhang ec->n = mpi_scanval(ecp->n);
106ea7ecb66STianjia Zhang if (!ec->n) {
1075cd259caSHongbo Li mpi_point_release(ec->Q);
108ea7ecb66STianjia Zhang mpi_point_release(ec->G);
109ea7ecb66STianjia Zhang goto free;
110ea7ecb66STianjia Zhang }
111ea7ecb66STianjia Zhang
112ea7ecb66STianjia Zhang ec->h = ecp->h;
113ea7ecb66STianjia Zhang ec->name = ecp->desc;
114ea7ecb66STianjia Zhang mpi_ec_init(ec, ecp->model, ecp->dialect, 0, p, a, b);
115ea7ecb66STianjia Zhang
116ea7ecb66STianjia Zhang rc = 0;
117ea7ecb66STianjia Zhang
118ea7ecb66STianjia Zhang free:
119ea7ecb66STianjia Zhang mpi_free(x);
120ea7ecb66STianjia Zhang mpi_free(y);
121ea7ecb66STianjia Zhang free_p:
122ea7ecb66STianjia Zhang mpi_free(p);
123ea7ecb66STianjia Zhang mpi_free(a);
124ea7ecb66STianjia Zhang mpi_free(b);
125ea7ecb66STianjia Zhang
126ea7ecb66STianjia Zhang return rc;
127ea7ecb66STianjia Zhang }
128ea7ecb66STianjia Zhang
sm2_ec_ctx_deinit(struct mpi_ec_ctx * ec)129ea7ecb66STianjia Zhang static void sm2_ec_ctx_deinit(struct mpi_ec_ctx *ec)
130ea7ecb66STianjia Zhang {
131ea7ecb66STianjia Zhang mpi_ec_deinit(ec);
132ea7ecb66STianjia Zhang
133ea7ecb66STianjia Zhang memset(ec, 0, sizeof(*ec));
134ea7ecb66STianjia Zhang }
135ea7ecb66STianjia Zhang
136ea7ecb66STianjia Zhang /* RESULT must have been initialized and is set on success to the
137ea7ecb66STianjia Zhang * point given by VALUE.
138ea7ecb66STianjia Zhang */
sm2_ecc_os2ec(MPI_POINT result,MPI value)139ea7ecb66STianjia Zhang static int sm2_ecc_os2ec(MPI_POINT result, MPI value)
140ea7ecb66STianjia Zhang {
141ea7ecb66STianjia Zhang int rc;
142ea7ecb66STianjia Zhang size_t n;
1431bc608b4STianjia Zhang unsigned char *buf;
144ea7ecb66STianjia Zhang MPI x, y;
145ea7ecb66STianjia Zhang
1461bc608b4STianjia Zhang n = MPI_NBYTES(value);
1471bc608b4STianjia Zhang buf = kmalloc(n, GFP_KERNEL);
1481bc608b4STianjia Zhang if (!buf)
1491bc608b4STianjia Zhang return -ENOMEM;
150ea7ecb66STianjia Zhang
1511bc608b4STianjia Zhang rc = mpi_print(GCRYMPI_FMT_USG, buf, n, &n, value);
1521bc608b4STianjia Zhang if (rc)
1531bc608b4STianjia Zhang goto err_freebuf;
1541bc608b4STianjia Zhang
1551bc608b4STianjia Zhang rc = -EINVAL;
1561bc608b4STianjia Zhang if (n < 1 || ((n - 1) % 2))
1571bc608b4STianjia Zhang goto err_freebuf;
1581bc608b4STianjia Zhang /* No support for point compression */
1591bc608b4STianjia Zhang if (*buf != 0x4)
1601bc608b4STianjia Zhang goto err_freebuf;
1611bc608b4STianjia Zhang
1621bc608b4STianjia Zhang rc = -ENOMEM;
163ea7ecb66STianjia Zhang n = (n - 1) / 2;
164ea7ecb66STianjia Zhang x = mpi_read_raw_data(buf + 1, n);
1651bc608b4STianjia Zhang if (!x)
1661bc608b4STianjia Zhang goto err_freebuf;
167ea7ecb66STianjia Zhang y = mpi_read_raw_data(buf + 1 + n, n);
1681bc608b4STianjia Zhang if (!y)
1691bc608b4STianjia Zhang goto err_freex;
170ea7ecb66STianjia Zhang
171ea7ecb66STianjia Zhang mpi_normalize(x);
172ea7ecb66STianjia Zhang mpi_normalize(y);
173ea7ecb66STianjia Zhang mpi_set(result->x, x);
174ea7ecb66STianjia Zhang mpi_set(result->y, y);
175ea7ecb66STianjia Zhang mpi_set_ui(result->z, 1);
176ea7ecb66STianjia Zhang
1771bc608b4STianjia Zhang rc = 0;
178ea7ecb66STianjia Zhang
1791bc608b4STianjia Zhang mpi_free(y);
1801bc608b4STianjia Zhang err_freex:
1811bc608b4STianjia Zhang mpi_free(x);
1821bc608b4STianjia Zhang err_freebuf:
1831bc608b4STianjia Zhang kfree(buf);
1841bc608b4STianjia Zhang return rc;
185ea7ecb66STianjia Zhang }
186ea7ecb66STianjia Zhang
187ea7ecb66STianjia Zhang struct sm2_signature_ctx {
188ea7ecb66STianjia Zhang MPI sig_r;
189ea7ecb66STianjia Zhang MPI sig_s;
190ea7ecb66STianjia Zhang };
191ea7ecb66STianjia Zhang
sm2_get_signature_r(void * context,size_t hdrlen,unsigned char tag,const void * value,size_t vlen)192ea7ecb66STianjia Zhang int sm2_get_signature_r(void *context, size_t hdrlen, unsigned char tag,
193ea7ecb66STianjia Zhang const void *value, size_t vlen)
194ea7ecb66STianjia Zhang {
195ea7ecb66STianjia Zhang struct sm2_signature_ctx *sig = context;
196ea7ecb66STianjia Zhang
197ea7ecb66STianjia Zhang if (!value || !vlen)
198ea7ecb66STianjia Zhang return -EINVAL;
199ea7ecb66STianjia Zhang
200ea7ecb66STianjia Zhang sig->sig_r = mpi_read_raw_data(value, vlen);
201ea7ecb66STianjia Zhang if (!sig->sig_r)
202ea7ecb66STianjia Zhang return -ENOMEM;
203ea7ecb66STianjia Zhang
204ea7ecb66STianjia Zhang return 0;
205ea7ecb66STianjia Zhang }
206ea7ecb66STianjia Zhang
sm2_get_signature_s(void * context,size_t hdrlen,unsigned char tag,const void * value,size_t vlen)207ea7ecb66STianjia Zhang int sm2_get_signature_s(void *context, size_t hdrlen, unsigned char tag,
208ea7ecb66STianjia Zhang const void *value, size_t vlen)
209ea7ecb66STianjia Zhang {
210ea7ecb66STianjia Zhang struct sm2_signature_ctx *sig = context;
211ea7ecb66STianjia Zhang
212ea7ecb66STianjia Zhang if (!value || !vlen)
213ea7ecb66STianjia Zhang return -EINVAL;
214ea7ecb66STianjia Zhang
215ea7ecb66STianjia Zhang sig->sig_s = mpi_read_raw_data(value, vlen);
216ea7ecb66STianjia Zhang if (!sig->sig_s)
217ea7ecb66STianjia Zhang return -ENOMEM;
218ea7ecb66STianjia Zhang
219ea7ecb66STianjia Zhang return 0;
220ea7ecb66STianjia Zhang }
221ea7ecb66STianjia Zhang
sm2_z_digest_update(struct shash_desc * desc,MPI m,unsigned int pbytes)222e5221fa6SHerbert Xu static int sm2_z_digest_update(struct shash_desc *desc,
223ea7ecb66STianjia Zhang MPI m, unsigned int pbytes)
224ea7ecb66STianjia Zhang {
225ea7ecb66STianjia Zhang static const unsigned char zero[32];
226ea7ecb66STianjia Zhang unsigned char *in;
227ea7ecb66STianjia Zhang unsigned int inlen;
228e5221fa6SHerbert Xu int err;
229ea7ecb66STianjia Zhang
230ea7ecb66STianjia Zhang in = mpi_get_buffer(m, &inlen, NULL);
231ea7ecb66STianjia Zhang if (!in)
232ea7ecb66STianjia Zhang return -EINVAL;
233ea7ecb66STianjia Zhang
234ea7ecb66STianjia Zhang if (inlen < pbytes) {
235ea7ecb66STianjia Zhang /* padding with zero */
236e5221fa6SHerbert Xu err = crypto_shash_update(desc, zero, pbytes - inlen) ?:
237e5221fa6SHerbert Xu crypto_shash_update(desc, in, inlen);
238ea7ecb66STianjia Zhang } else if (inlen > pbytes) {
239ea7ecb66STianjia Zhang /* skip the starting zero */
240e5221fa6SHerbert Xu err = crypto_shash_update(desc, in + inlen - pbytes, pbytes);
241ea7ecb66STianjia Zhang } else {
242e5221fa6SHerbert Xu err = crypto_shash_update(desc, in, inlen);
243ea7ecb66STianjia Zhang }
244ea7ecb66STianjia Zhang
245ea7ecb66STianjia Zhang kfree(in);
246e5221fa6SHerbert Xu return err;
247ea7ecb66STianjia Zhang }
248ea7ecb66STianjia Zhang
sm2_z_digest_update_point(struct shash_desc * desc,MPI_POINT point,struct mpi_ec_ctx * ec,unsigned int pbytes)249e5221fa6SHerbert Xu static int sm2_z_digest_update_point(struct shash_desc *desc,
250e5221fa6SHerbert Xu MPI_POINT point, struct mpi_ec_ctx *ec,
251e5221fa6SHerbert Xu unsigned int pbytes)
252ea7ecb66STianjia Zhang {
253ea7ecb66STianjia Zhang MPI x, y;
254ea7ecb66STianjia Zhang int ret = -EINVAL;
255ea7ecb66STianjia Zhang
256ea7ecb66STianjia Zhang x = mpi_new(0);
257ea7ecb66STianjia Zhang y = mpi_new(0);
258ea7ecb66STianjia Zhang
259e5221fa6SHerbert Xu ret = mpi_ec_get_affine(x, y, point, ec) ? -EINVAL :
260e5221fa6SHerbert Xu sm2_z_digest_update(desc, x, pbytes) ?:
261e5221fa6SHerbert Xu sm2_z_digest_update(desc, y, pbytes);
262ea7ecb66STianjia Zhang
263ea7ecb66STianjia Zhang mpi_free(x);
264ea7ecb66STianjia Zhang mpi_free(y);
265ea7ecb66STianjia Zhang return ret;
266ea7ecb66STianjia Zhang }
267ea7ecb66STianjia Zhang
sm2_compute_z_digest(struct shash_desc * desc,const void * key,unsigned int keylen,void * dgst)268e5221fa6SHerbert Xu int sm2_compute_z_digest(struct shash_desc *desc,
269e5221fa6SHerbert Xu const void *key, unsigned int keylen, void *dgst)
270ea7ecb66STianjia Zhang {
271e5221fa6SHerbert Xu struct mpi_ec_ctx *ec;
272e5221fa6SHerbert Xu unsigned int bits_len;
273ea7ecb66STianjia Zhang unsigned int pbytes;
274e5221fa6SHerbert Xu u8 entl[2];
275e5221fa6SHerbert Xu int err;
276ea7ecb66STianjia Zhang
277e5221fa6SHerbert Xu ec = kmalloc(sizeof(*ec), GFP_KERNEL);
278e5221fa6SHerbert Xu if (!ec)
279e5221fa6SHerbert Xu return -ENOMEM;
280ea7ecb66STianjia Zhang
281*21155620STianjia Zhang err = sm2_ec_ctx_init(ec);
282e5221fa6SHerbert Xu if (err)
283e5221fa6SHerbert Xu goto out_free_ec;
284e5221fa6SHerbert Xu
285*21155620STianjia Zhang err = __sm2_set_pub_key(ec, key, keylen);
286*21155620STianjia Zhang if (err)
287*21155620STianjia Zhang goto out_deinit_ec;
288*21155620STianjia Zhang
289e5221fa6SHerbert Xu bits_len = SM2_DEFAULT_USERID_LEN * 8;
290ea7ecb66STianjia Zhang entl[0] = bits_len >> 8;
291ea7ecb66STianjia Zhang entl[1] = bits_len & 0xff;
292ea7ecb66STianjia Zhang
293ea7ecb66STianjia Zhang pbytes = MPI_NBYTES(ec->p);
294ea7ecb66STianjia Zhang
295ea7ecb66STianjia Zhang /* ZA = H256(ENTLA | IDA | a | b | xG | yG | xA | yA) */
296e5221fa6SHerbert Xu err = crypto_shash_init(desc);
297e5221fa6SHerbert Xu if (err)
298e5221fa6SHerbert Xu goto out_deinit_ec;
299ea7ecb66STianjia Zhang
300e5221fa6SHerbert Xu err = crypto_shash_update(desc, entl, 2);
301e5221fa6SHerbert Xu if (err)
302e5221fa6SHerbert Xu goto out_deinit_ec;
303ea7ecb66STianjia Zhang
304e5221fa6SHerbert Xu err = crypto_shash_update(desc, SM2_DEFAULT_USERID,
305e5221fa6SHerbert Xu SM2_DEFAULT_USERID_LEN);
306e5221fa6SHerbert Xu if (err)
307e5221fa6SHerbert Xu goto out_deinit_ec;
308e5221fa6SHerbert Xu
309e5221fa6SHerbert Xu err = sm2_z_digest_update(desc, ec->a, pbytes) ?:
310e5221fa6SHerbert Xu sm2_z_digest_update(desc, ec->b, pbytes) ?:
311e5221fa6SHerbert Xu sm2_z_digest_update_point(desc, ec->G, ec, pbytes) ?:
312e5221fa6SHerbert Xu sm2_z_digest_update_point(desc, ec->Q, ec, pbytes);
313e5221fa6SHerbert Xu if (err)
314e5221fa6SHerbert Xu goto out_deinit_ec;
315e5221fa6SHerbert Xu
316e5221fa6SHerbert Xu err = crypto_shash_final(desc, dgst);
317e5221fa6SHerbert Xu
318e5221fa6SHerbert Xu out_deinit_ec:
319e5221fa6SHerbert Xu sm2_ec_ctx_deinit(ec);
320e5221fa6SHerbert Xu out_free_ec:
321e5221fa6SHerbert Xu kfree(ec);
322e5221fa6SHerbert Xu return err;
323ea7ecb66STianjia Zhang }
324e5221fa6SHerbert Xu EXPORT_SYMBOL_GPL(sm2_compute_z_digest);
325ea7ecb66STianjia Zhang
_sm2_verify(struct mpi_ec_ctx * ec,MPI hash,MPI sig_r,MPI sig_s)326ea7ecb66STianjia Zhang static int _sm2_verify(struct mpi_ec_ctx *ec, MPI hash, MPI sig_r, MPI sig_s)
327ea7ecb66STianjia Zhang {
328ea7ecb66STianjia Zhang int rc = -EINVAL;
329ea7ecb66STianjia Zhang struct gcry_mpi_point sG, tP;
330ea7ecb66STianjia Zhang MPI t = NULL;
331ea7ecb66STianjia Zhang MPI x1 = NULL, y1 = NULL;
332ea7ecb66STianjia Zhang
333ea7ecb66STianjia Zhang mpi_point_init(&sG);
334ea7ecb66STianjia Zhang mpi_point_init(&tP);
335ea7ecb66STianjia Zhang x1 = mpi_new(0);
336ea7ecb66STianjia Zhang y1 = mpi_new(0);
337ea7ecb66STianjia Zhang t = mpi_new(0);
338ea7ecb66STianjia Zhang
339ea7ecb66STianjia Zhang /* r, s in [1, n-1] */
340ea7ecb66STianjia Zhang if (mpi_cmp_ui(sig_r, 1) < 0 || mpi_cmp(sig_r, ec->n) > 0 ||
341ea7ecb66STianjia Zhang mpi_cmp_ui(sig_s, 1) < 0 || mpi_cmp(sig_s, ec->n) > 0) {
342ea7ecb66STianjia Zhang goto leave;
343ea7ecb66STianjia Zhang }
344ea7ecb66STianjia Zhang
345ea7ecb66STianjia Zhang /* t = (r + s) % n, t == 0 */
346ea7ecb66STianjia Zhang mpi_addm(t, sig_r, sig_s, ec->n);
347ea7ecb66STianjia Zhang if (mpi_cmp_ui(t, 0) == 0)
348ea7ecb66STianjia Zhang goto leave;
349ea7ecb66STianjia Zhang
350ea7ecb66STianjia Zhang /* sG + tP = (x1, y1) */
351ea7ecb66STianjia Zhang rc = -EBADMSG;
352ea7ecb66STianjia Zhang mpi_ec_mul_point(&sG, sig_s, ec->G, ec);
353ea7ecb66STianjia Zhang mpi_ec_mul_point(&tP, t, ec->Q, ec);
354ea7ecb66STianjia Zhang mpi_ec_add_points(&sG, &sG, &tP, ec);
355ea7ecb66STianjia Zhang if (mpi_ec_get_affine(x1, y1, &sG, ec))
356ea7ecb66STianjia Zhang goto leave;
357ea7ecb66STianjia Zhang
358ea7ecb66STianjia Zhang /* R = (e + x1) % n */
359ea7ecb66STianjia Zhang mpi_addm(t, hash, x1, ec->n);
360ea7ecb66STianjia Zhang
361ea7ecb66STianjia Zhang /* check R == r */
362ea7ecb66STianjia Zhang rc = -EKEYREJECTED;
363ea7ecb66STianjia Zhang if (mpi_cmp(t, sig_r))
364ea7ecb66STianjia Zhang goto leave;
365ea7ecb66STianjia Zhang
366ea7ecb66STianjia Zhang rc = 0;
367ea7ecb66STianjia Zhang
368ea7ecb66STianjia Zhang leave:
369ea7ecb66STianjia Zhang mpi_point_free_parts(&sG);
370ea7ecb66STianjia Zhang mpi_point_free_parts(&tP);
371ea7ecb66STianjia Zhang mpi_free(x1);
372ea7ecb66STianjia Zhang mpi_free(y1);
373ea7ecb66STianjia Zhang mpi_free(t);
374ea7ecb66STianjia Zhang
375ea7ecb66STianjia Zhang return rc;
376ea7ecb66STianjia Zhang }
377ea7ecb66STianjia Zhang
sm2_verify(struct akcipher_request * req)378ea7ecb66STianjia Zhang static int sm2_verify(struct akcipher_request *req)
379ea7ecb66STianjia Zhang {
380ea7ecb66STianjia Zhang struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
381ea7ecb66STianjia Zhang struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
382ea7ecb66STianjia Zhang unsigned char *buffer;
383ea7ecb66STianjia Zhang struct sm2_signature_ctx sig;
384ea7ecb66STianjia Zhang MPI hash;
385ea7ecb66STianjia Zhang int ret;
386ea7ecb66STianjia Zhang
387ea7ecb66STianjia Zhang if (unlikely(!ec->Q))
388ea7ecb66STianjia Zhang return -EINVAL;
389ea7ecb66STianjia Zhang
390ea7ecb66STianjia Zhang buffer = kmalloc(req->src_len + req->dst_len, GFP_KERNEL);
391ea7ecb66STianjia Zhang if (!buffer)
392ea7ecb66STianjia Zhang return -ENOMEM;
393ea7ecb66STianjia Zhang
394ea7ecb66STianjia Zhang sg_pcopy_to_buffer(req->src,
395ea7ecb66STianjia Zhang sg_nents_for_len(req->src, req->src_len + req->dst_len),
396ea7ecb66STianjia Zhang buffer, req->src_len + req->dst_len, 0);
397ea7ecb66STianjia Zhang
398ea7ecb66STianjia Zhang sig.sig_r = NULL;
399ea7ecb66STianjia Zhang sig.sig_s = NULL;
400ea7ecb66STianjia Zhang ret = asn1_ber_decoder(&sm2signature_decoder, &sig,
401ea7ecb66STianjia Zhang buffer, req->src_len);
402ea7ecb66STianjia Zhang if (ret)
403ea7ecb66STianjia Zhang goto error;
404ea7ecb66STianjia Zhang
405ea7ecb66STianjia Zhang ret = -ENOMEM;
406ea7ecb66STianjia Zhang hash = mpi_read_raw_data(buffer + req->src_len, req->dst_len);
407ea7ecb66STianjia Zhang if (!hash)
408ea7ecb66STianjia Zhang goto error;
409ea7ecb66STianjia Zhang
410ea7ecb66STianjia Zhang ret = _sm2_verify(ec, hash, sig.sig_r, sig.sig_s);
411ea7ecb66STianjia Zhang
412ea7ecb66STianjia Zhang mpi_free(hash);
413ea7ecb66STianjia Zhang error:
414ea7ecb66STianjia Zhang mpi_free(sig.sig_r);
415ea7ecb66STianjia Zhang mpi_free(sig.sig_s);
416ea7ecb66STianjia Zhang kfree(buffer);
417ea7ecb66STianjia Zhang return ret;
418ea7ecb66STianjia Zhang }
419ea7ecb66STianjia Zhang
sm2_set_pub_key(struct crypto_akcipher * tfm,const void * key,unsigned int keylen)420ea7ecb66STianjia Zhang static int sm2_set_pub_key(struct crypto_akcipher *tfm,
421ea7ecb66STianjia Zhang const void *key, unsigned int keylen)
422ea7ecb66STianjia Zhang {
423ea7ecb66STianjia Zhang struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
424e5221fa6SHerbert Xu
425e5221fa6SHerbert Xu return __sm2_set_pub_key(ec, key, keylen);
426e5221fa6SHerbert Xu
427e5221fa6SHerbert Xu }
428e5221fa6SHerbert Xu
__sm2_set_pub_key(struct mpi_ec_ctx * ec,const void * key,unsigned int keylen)429e5221fa6SHerbert Xu static int __sm2_set_pub_key(struct mpi_ec_ctx *ec,
430e5221fa6SHerbert Xu const void *key, unsigned int keylen)
431e5221fa6SHerbert Xu {
432ea7ecb66STianjia Zhang MPI a;
433ea7ecb66STianjia Zhang int rc;
434ea7ecb66STianjia Zhang
435ea7ecb66STianjia Zhang /* include the uncompressed flag '0x04' */
436ea7ecb66STianjia Zhang a = mpi_read_raw_data(key, keylen);
437ea7ecb66STianjia Zhang if (!a)
4385cd259caSHongbo Li return -ENOMEM;
439ea7ecb66STianjia Zhang
440ea7ecb66STianjia Zhang mpi_normalize(a);
441ea7ecb66STianjia Zhang rc = sm2_ecc_os2ec(ec->Q, a);
442ea7ecb66STianjia Zhang mpi_free(a);
443ea7ecb66STianjia Zhang
444ea7ecb66STianjia Zhang return rc;
445ea7ecb66STianjia Zhang }
446ea7ecb66STianjia Zhang
sm2_max_size(struct crypto_akcipher * tfm)447ea7ecb66STianjia Zhang static unsigned int sm2_max_size(struct crypto_akcipher *tfm)
448ea7ecb66STianjia Zhang {
449ea7ecb66STianjia Zhang /* Unlimited max size */
450ea7ecb66STianjia Zhang return PAGE_SIZE;
451ea7ecb66STianjia Zhang }
452ea7ecb66STianjia Zhang
sm2_init_tfm(struct crypto_akcipher * tfm)453ea7ecb66STianjia Zhang static int sm2_init_tfm(struct crypto_akcipher *tfm)
454ea7ecb66STianjia Zhang {
455ea7ecb66STianjia Zhang struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
456ea7ecb66STianjia Zhang
457ea7ecb66STianjia Zhang return sm2_ec_ctx_init(ec);
458ea7ecb66STianjia Zhang }
459ea7ecb66STianjia Zhang
sm2_exit_tfm(struct crypto_akcipher * tfm)460ea7ecb66STianjia Zhang static void sm2_exit_tfm(struct crypto_akcipher *tfm)
461ea7ecb66STianjia Zhang {
462ea7ecb66STianjia Zhang struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
463ea7ecb66STianjia Zhang
464ea7ecb66STianjia Zhang sm2_ec_ctx_deinit(ec);
465ea7ecb66STianjia Zhang }
466ea7ecb66STianjia Zhang
467ea7ecb66STianjia Zhang static struct akcipher_alg sm2 = {
468ea7ecb66STianjia Zhang .verify = sm2_verify,
469ea7ecb66STianjia Zhang .set_pub_key = sm2_set_pub_key,
470ea7ecb66STianjia Zhang .max_size = sm2_max_size,
471ea7ecb66STianjia Zhang .init = sm2_init_tfm,
472ea7ecb66STianjia Zhang .exit = sm2_exit_tfm,
473ea7ecb66STianjia Zhang .base = {
474ea7ecb66STianjia Zhang .cra_name = "sm2",
475ea7ecb66STianjia Zhang .cra_driver_name = "sm2-generic",
476ea7ecb66STianjia Zhang .cra_priority = 100,
477ea7ecb66STianjia Zhang .cra_module = THIS_MODULE,
478ea7ecb66STianjia Zhang .cra_ctxsize = sizeof(struct mpi_ec_ctx),
479ea7ecb66STianjia Zhang },
480ea7ecb66STianjia Zhang };
481ea7ecb66STianjia Zhang
sm2_init(void)48233837be3SXiu Jianfeng static int __init sm2_init(void)
483ea7ecb66STianjia Zhang {
484ea7ecb66STianjia Zhang return crypto_register_akcipher(&sm2);
485ea7ecb66STianjia Zhang }
486ea7ecb66STianjia Zhang
sm2_exit(void)48733837be3SXiu Jianfeng static void __exit sm2_exit(void)
488ea7ecb66STianjia Zhang {
489ea7ecb66STianjia Zhang crypto_unregister_akcipher(&sm2);
490ea7ecb66STianjia Zhang }
491ea7ecb66STianjia Zhang
492ea7ecb66STianjia Zhang subsys_initcall(sm2_init);
493ea7ecb66STianjia Zhang module_exit(sm2_exit);
494ea7ecb66STianjia Zhang
495ea7ecb66STianjia Zhang MODULE_LICENSE("GPL");
496ea7ecb66STianjia Zhang MODULE_AUTHOR("Tianjia Zhang <tianjia.zhang@linux.alibaba.com>");
497ea7ecb66STianjia Zhang MODULE_DESCRIPTION("SM2 generic algorithm");
498ea7ecb66STianjia Zhang MODULE_ALIAS_CRYPTO("sm2-generic");
499