1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* ECDH key-agreement protocol
4 * Copyright (c) 2016, Intel Corporation
5 * Authors: Salvator Benedetto <salvatore.benedetto@intel.com>
8 #include <linux/module.h>
9 #include <crypto/internal/kpp.h>
10 #include <crypto/kpp.h>
11 #include <crypto/ecdh.h>
12 #include <linux/scatterlist.h>
16 unsigned int curve_id
;
18 u64 private_key
[ECC_MAX_DIGITS
];
21 static inline struct ecdh_ctx
*ecdh_get_ctx(struct crypto_kpp
*tfm
)
23 return kpp_tfm_ctx(tfm
);
26 static int ecdh_set_secret(struct crypto_kpp
*tfm
, const void *buf
,
29 struct ecdh_ctx
*ctx
= ecdh_get_ctx(tfm
);
32 if (crypto_ecdh_decode_key(buf
, len
, ¶ms
) < 0 ||
33 params
.key_size
> sizeof(u64
) * ctx
->ndigits
)
36 if (!params
.key
|| !params
.key_size
)
37 return ecc_gen_privkey(ctx
->curve_id
, ctx
->ndigits
,
40 memcpy(ctx
->private_key
, params
.key
, params
.key_size
);
42 if (ecc_is_key_valid(ctx
->curve_id
, ctx
->ndigits
,
43 ctx
->private_key
, params
.key_size
) < 0) {
44 memzero_explicit(ctx
->private_key
, params
.key_size
);
50 static int ecdh_compute_value(struct kpp_request
*req
)
52 struct crypto_kpp
*tfm
= crypto_kpp_reqtfm(req
);
53 struct ecdh_ctx
*ctx
= ecdh_get_ctx(tfm
);
55 u64
*shared_secret
= NULL
;
57 size_t copied
, nbytes
, public_key_sz
;
60 nbytes
= ctx
->ndigits
<< ECC_DIGITS_TO_BYTES_SHIFT
;
61 /* Public part is a point thus it has both coordinates */
62 public_key_sz
= 2 * nbytes
;
64 public_key
= kmalloc(public_key_sz
, GFP_KERNEL
);
69 shared_secret
= kmalloc(nbytes
, GFP_KERNEL
);
73 /* from here on it's invalid parameters */
76 /* must have exactly two points to be on the curve */
77 if (public_key_sz
!= req
->src_len
)
80 copied
= sg_copy_to_buffer(req
->src
,
81 sg_nents_for_len(req
->src
,
83 public_key
, public_key_sz
);
84 if (copied
!= public_key_sz
)
87 ret
= crypto_ecdh_shared_secret(ctx
->curve_id
, ctx
->ndigits
,
88 ctx
->private_key
, public_key
,
93 ret
= ecc_make_pub_key(ctx
->curve_id
, ctx
->ndigits
,
94 ctx
->private_key
, public_key
);
96 nbytes
= public_key_sz
;
102 /* might want less than we've got */
103 nbytes
= min_t(size_t, nbytes
, req
->dst_len
);
104 copied
= sg_copy_from_buffer(req
->dst
, sg_nents_for_len(req
->dst
,
107 if (copied
!= nbytes
)
112 kfree_sensitive(shared_secret
);
118 static unsigned int ecdh_max_size(struct crypto_kpp
*tfm
)
120 struct ecdh_ctx
*ctx
= ecdh_get_ctx(tfm
);
122 /* Public key is made of two coordinates, add one to the left shift */
123 return ctx
->ndigits
<< (ECC_DIGITS_TO_BYTES_SHIFT
+ 1);
126 static int ecdh_nist_p192_init_tfm(struct crypto_kpp
*tfm
)
128 struct ecdh_ctx
*ctx
= ecdh_get_ctx(tfm
);
130 ctx
->curve_id
= ECC_CURVE_NIST_P192
;
131 ctx
->ndigits
= ECC_CURVE_NIST_P192_DIGITS
;
136 static struct kpp_alg ecdh_nist_p192
= {
137 .set_secret
= ecdh_set_secret
,
138 .generate_public_key
= ecdh_compute_value
,
139 .compute_shared_secret
= ecdh_compute_value
,
140 .max_size
= ecdh_max_size
,
141 .init
= ecdh_nist_p192_init_tfm
,
143 .cra_name
= "ecdh-nist-p192",
144 .cra_driver_name
= "ecdh-nist-p192-generic",
146 .cra_module
= THIS_MODULE
,
147 .cra_ctxsize
= sizeof(struct ecdh_ctx
),
151 static int ecdh_nist_p256_init_tfm(struct crypto_kpp
*tfm
)
153 struct ecdh_ctx
*ctx
= ecdh_get_ctx(tfm
);
155 ctx
->curve_id
= ECC_CURVE_NIST_P256
;
156 ctx
->ndigits
= ECC_CURVE_NIST_P256_DIGITS
;
161 static struct kpp_alg ecdh_nist_p256
= {
162 .set_secret
= ecdh_set_secret
,
163 .generate_public_key
= ecdh_compute_value
,
164 .compute_shared_secret
= ecdh_compute_value
,
165 .max_size
= ecdh_max_size
,
166 .init
= ecdh_nist_p256_init_tfm
,
168 .cra_name
= "ecdh-nist-p256",
169 .cra_driver_name
= "ecdh-nist-p256-generic",
171 .cra_module
= THIS_MODULE
,
172 .cra_ctxsize
= sizeof(struct ecdh_ctx
),
176 static int ecdh_nist_p384_init_tfm(struct crypto_kpp
*tfm
)
178 struct ecdh_ctx
*ctx
= ecdh_get_ctx(tfm
);
180 ctx
->curve_id
= ECC_CURVE_NIST_P384
;
181 ctx
->ndigits
= ECC_CURVE_NIST_P384_DIGITS
;
186 static struct kpp_alg ecdh_nist_p384
= {
187 .set_secret
= ecdh_set_secret
,
188 .generate_public_key
= ecdh_compute_value
,
189 .compute_shared_secret
= ecdh_compute_value
,
190 .max_size
= ecdh_max_size
,
191 .init
= ecdh_nist_p384_init_tfm
,
193 .cra_name
= "ecdh-nist-p384",
194 .cra_driver_name
= "ecdh-nist-p384-generic",
196 .cra_module
= THIS_MODULE
,
197 .cra_ctxsize
= sizeof(struct ecdh_ctx
),
201 static bool ecdh_nist_p192_registered
;
203 static int ecdh_init(void)
207 /* NIST p192 will fail to register in FIPS mode */
208 ret
= crypto_register_kpp(&ecdh_nist_p192
);
209 ecdh_nist_p192_registered
= ret
== 0;
211 ret
= crypto_register_kpp(&ecdh_nist_p256
);
213 goto nist_p256_error
;
215 ret
= crypto_register_kpp(&ecdh_nist_p384
);
217 goto nist_p384_error
;
222 crypto_unregister_kpp(&ecdh_nist_p256
);
225 if (ecdh_nist_p192_registered
)
226 crypto_unregister_kpp(&ecdh_nist_p192
);
230 static void ecdh_exit(void)
232 if (ecdh_nist_p192_registered
)
233 crypto_unregister_kpp(&ecdh_nist_p192
);
234 crypto_unregister_kpp(&ecdh_nist_p256
);
235 crypto_unregister_kpp(&ecdh_nist_p384
);
238 subsys_initcall(ecdh_init
);
239 module_exit(ecdh_exit
);
240 MODULE_ALIAS_CRYPTO("ecdh");
241 MODULE_LICENSE("GPL");
242 MODULE_DESCRIPTION("ECDH generic algorithm");