xref: /openbmc/linux/crypto/sm2.c (revision 7eb1e476) 
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * SM2 asymmetric public-key algorithm
4  * as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012 SM2 and
5  * described at https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
6  *
7  * Copyright (c) 2020, Alibaba Group.
8  * Authors: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
9  */
10 
11 #include <linux/module.h>
12 #include <linux/mpi.h>
13 #include <crypto/internal/akcipher.h>
14 #include <crypto/akcipher.h>
15 #include <crypto/hash.h>
16 #include <crypto/rng.h>
17 #include <crypto/sm2.h>
18 #include "sm2signature.asn1.h"
19 
20 /* The default user id as specified in GM/T 0009-2012 */
21 #define SM2_DEFAULT_USERID "1234567812345678"
22 #define SM2_DEFAULT_USERID_LEN 16
23 
24 #define MPI_NBYTES(m)   ((mpi_get_nbits(m) + 7) / 8)
25 
26 struct ecc_domain_parms {
27 	const char *desc;           /* Description of the curve.  */
28 	unsigned int nbits;         /* Number of bits.  */
29 	unsigned int fips:1; /* True if this is a FIPS140-2 approved curve */
30 
31 	/* The model describing this curve.  This is mainly used to select
32 	 * the group equation.
33 	 */
34 	enum gcry_mpi_ec_models model;
35 
36 	/* The actual ECC dialect used.  This is used for curve specific
37 	 * optimizations and to select encodings etc.
38 	 */
39 	enum ecc_dialects dialect;
40 
41 	const char *p;              /* The prime defining the field.  */
42 	const char *a, *b;          /* The coefficients.  For Twisted Edwards
43 				     * Curves b is used for d.  For Montgomery
44 				     * Curves (a,b) has ((A-2)/4,B^-1).
45 				     */
46 	const char *n;              /* The order of the base point.  */
47 	const char *g_x, *g_y;      /* Base point.  */
48 	unsigned int h;             /* Cofactor.  */
49 };
50 
51 static const struct ecc_domain_parms sm2_ecp = {
52 	.desc = "sm2p256v1",
53 	.nbits = 256,
54 	.fips = 0,
55 	.model = MPI_EC_WEIERSTRASS,
56 	.dialect = ECC_DIALECT_STANDARD,
57 	.p   = "0xfffffffeffffffffffffffffffffffffffffffff00000000ffffffffffffffff",
58 	.a   = "0xfffffffeffffffffffffffffffffffffffffffff00000000fffffffffffffffc",
59 	.b   = "0x28e9fa9e9d9f5e344d5a9e4bcf6509a7f39789f515ab8f92ddbcbd414d940e93",
60 	.n   = "0xfffffffeffffffffffffffffffffffff7203df6b21c6052b53bbf40939d54123",
61 	.g_x = "0x32c4ae2c1f1981195f9904466a39c9948fe30bbff2660be1715a4589334c74c7",
62 	.g_y = "0xbc3736a2f4f6779c59bdcee36b692153d0a9877cc62a474002df32e52139f0a0",
63 	.h = 1
64 };
65 
66 static int __sm2_set_pub_key(struct mpi_ec_ctx *ec,
67 			     const void *key, unsigned int keylen);
68 
69 static int sm2_ec_ctx_init(struct mpi_ec_ctx *ec)
70 {
71 	const struct ecc_domain_parms *ecp = &sm2_ecp;
72 	MPI p, a, b;
73 	MPI x, y;
74 	int rc = -EINVAL;
75 
76 	p = mpi_scanval(ecp->p);
77 	a = mpi_scanval(ecp->a);
78 	b = mpi_scanval(ecp->b);
79 	if (!p || !a || !b)
80 		goto free_p;
81 
82 	x = mpi_scanval(ecp->g_x);
83 	y = mpi_scanval(ecp->g_y);
84 	if (!x || !y)
85 		goto free;
86 
87 	rc = -ENOMEM;
88 
89 	ec->Q = mpi_point_new(0);
90 	if (!ec->Q)
91 		goto free;
92 
93 	/* mpi_ec_setup_elliptic_curve */
94 	ec->G = mpi_point_new(0);
95 	if (!ec->G) {
96 		mpi_point_release(ec->Q);
97 		goto free;
98 	}
99 
100 	mpi_set(ec->G->x, x);
101 	mpi_set(ec->G->y, y);
102 	mpi_set_ui(ec->G->z, 1);
103 
104 	rc = -EINVAL;
105 	ec->n = mpi_scanval(ecp->n);
106 	if (!ec->n) {
107 		mpi_point_release(ec->Q);
108 		mpi_point_release(ec->G);
109 		goto free;
110 	}
111 
112 	ec->h = ecp->h;
113 	ec->name = ecp->desc;
114 	mpi_ec_init(ec, ecp->model, ecp->dialect, 0, p, a, b);
115 
116 	rc = 0;
117 
118 free:
119 	mpi_free(x);
120 	mpi_free(y);
121 free_p:
122 	mpi_free(p);
123 	mpi_free(a);
124 	mpi_free(b);
125 
126 	return rc;
127 }
128 
129 static void sm2_ec_ctx_deinit(struct mpi_ec_ctx *ec)
130 {
131 	mpi_ec_deinit(ec);
132 
133 	memset(ec, 0, sizeof(*ec));
134 }
135 
136 /* RESULT must have been initialized and is set on success to the
137  * point given by VALUE.
138  */
139 static int sm2_ecc_os2ec(MPI_POINT result, MPI value)
140 {
141 	int rc;
142 	size_t n;
143 	unsigned char *buf;
144 	MPI x, y;
145 
146 	n = MPI_NBYTES(value);
147 	buf = kmalloc(n, GFP_KERNEL);
148 	if (!buf)
149 		return -ENOMEM;
150 
151 	rc = mpi_print(GCRYMPI_FMT_USG, buf, n, &n, value);
152 	if (rc)
153 		goto err_freebuf;
154 
155 	rc = -EINVAL;
156 	if (n < 1 || ((n - 1) % 2))
157 		goto err_freebuf;
158 	/* No support for point compression */
159 	if (*buf != 0x4)
160 		goto err_freebuf;
161 
162 	rc = -ENOMEM;
163 	n = (n - 1) / 2;
164 	x = mpi_read_raw_data(buf + 1, n);
165 	if (!x)
166 		goto err_freebuf;
167 	y = mpi_read_raw_data(buf + 1 + n, n);
168 	if (!y)
169 		goto err_freex;
170 
171 	mpi_normalize(x);
172 	mpi_normalize(y);
173 	mpi_set(result->x, x);
174 	mpi_set(result->y, y);
175 	mpi_set_ui(result->z, 1);
176 
177 	rc = 0;
178 
179 	mpi_free(y);
180 err_freex:
181 	mpi_free(x);
182 err_freebuf:
183 	kfree(buf);
184 	return rc;
185 }
186 
187 struct sm2_signature_ctx {
188 	MPI sig_r;
189 	MPI sig_s;
190 };
191 
192 int sm2_get_signature_r(void *context, size_t hdrlen, unsigned char tag,
193 				const void *value, size_t vlen)
194 {
195 	struct sm2_signature_ctx *sig = context;
196 
197 	if (!value || !vlen)
198 		return -EINVAL;
199 
200 	sig->sig_r = mpi_read_raw_data(value, vlen);
201 	if (!sig->sig_r)
202 		return -ENOMEM;
203 
204 	return 0;
205 }
206 
207 int sm2_get_signature_s(void *context, size_t hdrlen, unsigned char tag,
208 				const void *value, size_t vlen)
209 {
210 	struct sm2_signature_ctx *sig = context;
211 
212 	if (!value || !vlen)
213 		return -EINVAL;
214 
215 	sig->sig_s = mpi_read_raw_data(value, vlen);
216 	if (!sig->sig_s)
217 		return -ENOMEM;
218 
219 	return 0;
220 }
221 
222 static int sm2_z_digest_update(struct shash_desc *desc,
223 			       MPI m, unsigned int pbytes)
224 {
225 	static const unsigned char zero[32];
226 	unsigned char *in;
227 	unsigned int inlen;
228 	int err;
229 
230 	in = mpi_get_buffer(m, &inlen, NULL);
231 	if (!in)
232 		return -EINVAL;
233 
234 	if (inlen < pbytes) {
235 		/* padding with zero */
236 		err = crypto_shash_update(desc, zero, pbytes - inlen) ?:
237 		      crypto_shash_update(desc, in, inlen);
238 	} else if (inlen > pbytes) {
239 		/* skip the starting zero */
240 		err = crypto_shash_update(desc, in + inlen - pbytes, pbytes);
241 	} else {
242 		err = crypto_shash_update(desc, in, inlen);
243 	}
244 
245 	kfree(in);
246 	return err;
247 }
248 
249 static int sm2_z_digest_update_point(struct shash_desc *desc,
250 				     MPI_POINT point, struct mpi_ec_ctx *ec,
251 				     unsigned int pbytes)
252 {
253 	MPI x, y;
254 	int ret = -EINVAL;
255 
256 	x = mpi_new(0);
257 	y = mpi_new(0);
258 
259 	ret = mpi_ec_get_affine(x, y, point, ec) ? -EINVAL :
260 	      sm2_z_digest_update(desc, x, pbytes) ?:
261 	      sm2_z_digest_update(desc, y, pbytes);
262 
263 	mpi_free(x);
264 	mpi_free(y);
265 	return ret;
266 }
267 
268 int sm2_compute_z_digest(struct shash_desc *desc,
269 			 const void *key, unsigned int keylen, void *dgst)
270 {
271 	struct mpi_ec_ctx *ec;
272 	unsigned int bits_len;
273 	unsigned int pbytes;
274 	u8 entl[2];
275 	int err;
276 
277 	ec = kmalloc(sizeof(*ec), GFP_KERNEL);
278 	if (!ec)
279 		return -ENOMEM;
280 
281 	err = __sm2_set_pub_key(ec, key, keylen);
282 	if (err)
283 		goto out_free_ec;
284 
285 	bits_len = SM2_DEFAULT_USERID_LEN * 8;
286 	entl[0] = bits_len >> 8;
287 	entl[1] = bits_len & 0xff;
288 
289 	pbytes = MPI_NBYTES(ec->p);
290 
291 	/* ZA = H256(ENTLA | IDA | a | b | xG | yG | xA | yA) */
292 	err = crypto_shash_init(desc);
293 	if (err)
294 		goto out_deinit_ec;
295 
296 	err = crypto_shash_update(desc, entl, 2);
297 	if (err)
298 		goto out_deinit_ec;
299 
300 	err = crypto_shash_update(desc, SM2_DEFAULT_USERID,
301 				  SM2_DEFAULT_USERID_LEN);
302 	if (err)
303 		goto out_deinit_ec;
304 
305 	err = sm2_z_digest_update(desc, ec->a, pbytes) ?:
306 	      sm2_z_digest_update(desc, ec->b, pbytes) ?:
307 	      sm2_z_digest_update_point(desc, ec->G, ec, pbytes) ?:
308 	      sm2_z_digest_update_point(desc, ec->Q, ec, pbytes);
309 	if (err)
310 		goto out_deinit_ec;
311 
312 	err = crypto_shash_final(desc, dgst);
313 
314 out_deinit_ec:
315 	sm2_ec_ctx_deinit(ec);
316 out_free_ec:
317 	kfree(ec);
318 	return err;
319 }
320 EXPORT_SYMBOL_GPL(sm2_compute_z_digest);
321 
322 static int _sm2_verify(struct mpi_ec_ctx *ec, MPI hash, MPI sig_r, MPI sig_s)
323 {
324 	int rc = -EINVAL;
325 	struct gcry_mpi_point sG, tP;
326 	MPI t = NULL;
327 	MPI x1 = NULL, y1 = NULL;
328 
329 	mpi_point_init(&sG);
330 	mpi_point_init(&tP);
331 	x1 = mpi_new(0);
332 	y1 = mpi_new(0);
333 	t = mpi_new(0);
334 
335 	/* r, s in [1, n-1] */
336 	if (mpi_cmp_ui(sig_r, 1) < 0 || mpi_cmp(sig_r, ec->n) > 0 ||
337 		mpi_cmp_ui(sig_s, 1) < 0 || mpi_cmp(sig_s, ec->n) > 0) {
338 		goto leave;
339 	}
340 
341 	/* t = (r + s) % n, t == 0 */
342 	mpi_addm(t, sig_r, sig_s, ec->n);
343 	if (mpi_cmp_ui(t, 0) == 0)
344 		goto leave;
345 
346 	/* sG + tP = (x1, y1) */
347 	rc = -EBADMSG;
348 	mpi_ec_mul_point(&sG, sig_s, ec->G, ec);
349 	mpi_ec_mul_point(&tP, t, ec->Q, ec);
350 	mpi_ec_add_points(&sG, &sG, &tP, ec);
351 	if (mpi_ec_get_affine(x1, y1, &sG, ec))
352 		goto leave;
353 
354 	/* R = (e + x1) % n */
355 	mpi_addm(t, hash, x1, ec->n);
356 
357 	/* check R == r */
358 	rc = -EKEYREJECTED;
359 	if (mpi_cmp(t, sig_r))
360 		goto leave;
361 
362 	rc = 0;
363 
364 leave:
365 	mpi_point_free_parts(&sG);
366 	mpi_point_free_parts(&tP);
367 	mpi_free(x1);
368 	mpi_free(y1);
369 	mpi_free(t);
370 
371 	return rc;
372 }
373 
374 static int sm2_verify(struct akcipher_request *req)
375 {
376 	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
377 	struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
378 	unsigned char *buffer;
379 	struct sm2_signature_ctx sig;
380 	MPI hash;
381 	int ret;
382 
383 	if (unlikely(!ec->Q))
384 		return -EINVAL;
385 
386 	buffer = kmalloc(req->src_len + req->dst_len, GFP_KERNEL);
387 	if (!buffer)
388 		return -ENOMEM;
389 
390 	sg_pcopy_to_buffer(req->src,
391 		sg_nents_for_len(req->src, req->src_len + req->dst_len),
392 		buffer, req->src_len + req->dst_len, 0);
393 
394 	sig.sig_r = NULL;
395 	sig.sig_s = NULL;
396 	ret = asn1_ber_decoder(&sm2signature_decoder, &sig,
397 				buffer, req->src_len);
398 	if (ret)
399 		goto error;
400 
401 	ret = -ENOMEM;
402 	hash = mpi_read_raw_data(buffer + req->src_len, req->dst_len);
403 	if (!hash)
404 		goto error;
405 
406 	ret = _sm2_verify(ec, hash, sig.sig_r, sig.sig_s);
407 
408 	mpi_free(hash);
409 error:
410 	mpi_free(sig.sig_r);
411 	mpi_free(sig.sig_s);
412 	kfree(buffer);
413 	return ret;
414 }
415 
416 static int sm2_set_pub_key(struct crypto_akcipher *tfm,
417 			const void *key, unsigned int keylen)
418 {
419 	struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
420 
421 	return __sm2_set_pub_key(ec, key, keylen);
422 
423 }
424 
425 static int __sm2_set_pub_key(struct mpi_ec_ctx *ec,
426 			     const void *key, unsigned int keylen)
427 {
428 	MPI a;
429 	int rc;
430 
431 	/* include the uncompressed flag '0x04' */
432 	a = mpi_read_raw_data(key, keylen);
433 	if (!a)
434 		return -ENOMEM;
435 
436 	mpi_normalize(a);
437 	rc = sm2_ecc_os2ec(ec->Q, a);
438 	mpi_free(a);
439 
440 	return rc;
441 }
442 
443 static unsigned int sm2_max_size(struct crypto_akcipher *tfm)
444 {
445 	/* Unlimited max size */
446 	return PAGE_SIZE;
447 }
448 
449 static int sm2_init_tfm(struct crypto_akcipher *tfm)
450 {
451 	struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
452 
453 	return sm2_ec_ctx_init(ec);
454 }
455 
456 static void sm2_exit_tfm(struct crypto_akcipher *tfm)
457 {
458 	struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
459 
460 	sm2_ec_ctx_deinit(ec);
461 }
462 
463 static struct akcipher_alg sm2 = {
464 	.verify = sm2_verify,
465 	.set_pub_key = sm2_set_pub_key,
466 	.max_size = sm2_max_size,
467 	.init = sm2_init_tfm,
468 	.exit = sm2_exit_tfm,
469 	.base = {
470 		.cra_name = "sm2",
471 		.cra_driver_name = "sm2-generic",
472 		.cra_priority = 100,
473 		.cra_module = THIS_MODULE,
474 		.cra_ctxsize = sizeof(struct mpi_ec_ctx),
475 	},
476 };
477 
478 static int __init sm2_init(void)
479 {
480 	return crypto_register_akcipher(&sm2);
481 }
482 
483 static void __exit sm2_exit(void)
484 {
485 	crypto_unregister_akcipher(&sm2);
486 }
487 
488 subsys_initcall(sm2_init);
489 module_exit(sm2_exit);
490 
491 MODULE_LICENSE("GPL");
492 MODULE_AUTHOR("Tianjia Zhang <tianjia.zhang@linux.alibaba.com>");
493 MODULE_DESCRIPTION("SM2 generic algorithm");
494 MODULE_ALIAS_CRYPTO("sm2-generic");
495