]>
git.proxmox.com Git - mirror_ubuntu-kernels.git/blob - crypto/sm2.c
1 /* SPDX-License-Identifier: GPL-2.0-or-later */
3 * SM2 asymmetric public-key algorithm
4 * as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012 SM2 and
5 * described at https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
7 * Copyright (c) 2020, Alibaba Group.
8 * Authors: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
11 #include <linux/module.h>
12 #include <linux/mpi.h>
13 #include <crypto/internal/akcipher.h>
14 #include <crypto/akcipher.h>
15 #include <crypto/hash.h>
16 #include <crypto/sm3_base.h>
17 #include <crypto/rng.h>
18 #include <crypto/sm2.h>
19 #include "sm2signature.asn1.h"
21 #define MPI_NBYTES(m) ((mpi_get_nbits(m) + 7) / 8)
23 struct ecc_domain_parms
{
24 const char *desc
; /* Description of the curve. */
25 unsigned int nbits
; /* Number of bits. */
26 unsigned int fips
:1; /* True if this is a FIPS140-2 approved curve */
28 /* The model describing this curve. This is mainly used to select
31 enum gcry_mpi_ec_models model
;
33 /* The actual ECC dialect used. This is used for curve specific
34 * optimizations and to select encodings etc.
36 enum ecc_dialects dialect
;
38 const char *p
; /* The prime defining the field. */
39 const char *a
, *b
; /* The coefficients. For Twisted Edwards
40 * Curves b is used for d. For Montgomery
41 * Curves (a,b) has ((A-2)/4,B^-1).
43 const char *n
; /* The order of the base point. */
44 const char *g_x
, *g_y
; /* Base point. */
45 unsigned int h
; /* Cofactor. */
48 static const struct ecc_domain_parms sm2_ecp
= {
52 .model
= MPI_EC_WEIERSTRASS
,
53 .dialect
= ECC_DIALECT_STANDARD
,
54 .p
= "0xfffffffeffffffffffffffffffffffffffffffff00000000ffffffffffffffff",
55 .a
= "0xfffffffeffffffffffffffffffffffffffffffff00000000fffffffffffffffc",
56 .b
= "0x28e9fa9e9d9f5e344d5a9e4bcf6509a7f39789f515ab8f92ddbcbd414d940e93",
57 .n
= "0xfffffffeffffffffffffffffffffffff7203df6b21c6052b53bbf40939d54123",
58 .g_x
= "0x32c4ae2c1f1981195f9904466a39c9948fe30bbff2660be1715a4589334c74c7",
59 .g_y
= "0xbc3736a2f4f6779c59bdcee36b692153d0a9877cc62a474002df32e52139f0a0",
63 static int sm2_ec_ctx_init(struct mpi_ec_ctx
*ec
)
65 const struct ecc_domain_parms
*ecp
= &sm2_ecp
;
70 p
= mpi_scanval(ecp
->p
);
71 a
= mpi_scanval(ecp
->a
);
72 b
= mpi_scanval(ecp
->b
);
76 x
= mpi_scanval(ecp
->g_x
);
77 y
= mpi_scanval(ecp
->g_y
);
83 ec
->Q
= mpi_point_new(0);
87 /* mpi_ec_setup_elliptic_curve */
88 ec
->G
= mpi_point_new(0);
90 mpi_point_release(ec
->Q
);
96 mpi_set_ui(ec
->G
->z
, 1);
99 ec
->n
= mpi_scanval(ecp
->n
);
101 mpi_point_release(ec
->Q
);
102 mpi_point_release(ec
->G
);
107 ec
->name
= ecp
->desc
;
108 mpi_ec_init(ec
, ecp
->model
, ecp
->dialect
, 0, p
, a
, b
);
123 static void sm2_ec_ctx_deinit(struct mpi_ec_ctx
*ec
)
127 memset(ec
, 0, sizeof(*ec
));
130 /* RESULT must have been initialized and is set on success to the
131 * point given by VALUE.
133 static int sm2_ecc_os2ec(MPI_POINT result
, MPI value
)
140 n
= MPI_NBYTES(value
);
141 buf
= kmalloc(n
, GFP_KERNEL
);
145 rc
= mpi_print(GCRYMPI_FMT_USG
, buf
, n
, &n
, value
);
150 if (n
< 1 || ((n
- 1) % 2))
152 /* No support for point compression */
158 x
= mpi_read_raw_data(buf
+ 1, n
);
161 y
= mpi_read_raw_data(buf
+ 1 + n
, n
);
167 mpi_set(result
->x
, x
);
168 mpi_set(result
->y
, y
);
169 mpi_set_ui(result
->z
, 1);
181 struct sm2_signature_ctx
{
186 int sm2_get_signature_r(void *context
, size_t hdrlen
, unsigned char tag
,
187 const void *value
, size_t vlen
)
189 struct sm2_signature_ctx
*sig
= context
;
194 sig
->sig_r
= mpi_read_raw_data(value
, vlen
);
201 int sm2_get_signature_s(void *context
, size_t hdrlen
, unsigned char tag
,
202 const void *value
, size_t vlen
)
204 struct sm2_signature_ctx
*sig
= context
;
209 sig
->sig_s
= mpi_read_raw_data(value
, vlen
);
216 static int sm2_z_digest_update(struct shash_desc
*desc
,
217 MPI m
, unsigned int pbytes
)
219 static const unsigned char zero
[32];
223 in
= mpi_get_buffer(m
, &inlen
, NULL
);
227 if (inlen
< pbytes
) {
228 /* padding with zero */
229 crypto_sm3_update(desc
, zero
, pbytes
- inlen
);
230 crypto_sm3_update(desc
, in
, inlen
);
231 } else if (inlen
> pbytes
) {
232 /* skip the starting zero */
233 crypto_sm3_update(desc
, in
+ inlen
- pbytes
, pbytes
);
235 crypto_sm3_update(desc
, in
, inlen
);
242 static int sm2_z_digest_update_point(struct shash_desc
*desc
,
243 MPI_POINT point
, struct mpi_ec_ctx
*ec
, unsigned int pbytes
)
251 if (!mpi_ec_get_affine(x
, y
, point
, ec
) &&
252 !sm2_z_digest_update(desc
, x
, pbytes
) &&
253 !sm2_z_digest_update(desc
, y
, pbytes
))
261 int sm2_compute_z_digest(struct crypto_akcipher
*tfm
,
262 const unsigned char *id
, size_t id_len
,
263 unsigned char dgst
[SM3_DIGEST_SIZE
])
265 struct mpi_ec_ctx
*ec
= akcipher_tfm_ctx(tfm
);
267 unsigned char entl
[2];
268 SHASH_DESC_ON_STACK(desc
, NULL
);
271 if (id_len
> (USHRT_MAX
/ 8) || !ec
->Q
)
274 bits_len
= (uint16_t)(id_len
* 8);
275 entl
[0] = bits_len
>> 8;
276 entl
[1] = bits_len
& 0xff;
278 pbytes
= MPI_NBYTES(ec
->p
);
280 /* ZA = H256(ENTLA | IDA | a | b | xG | yG | xA | yA) */
282 crypto_sm3_update(desc
, entl
, 2);
283 crypto_sm3_update(desc
, id
, id_len
);
285 if (sm2_z_digest_update(desc
, ec
->a
, pbytes
) ||
286 sm2_z_digest_update(desc
, ec
->b
, pbytes
) ||
287 sm2_z_digest_update_point(desc
, ec
->G
, ec
, pbytes
) ||
288 sm2_z_digest_update_point(desc
, ec
->Q
, ec
, pbytes
))
291 crypto_sm3_final(desc
, dgst
);
294 EXPORT_SYMBOL(sm2_compute_z_digest
);
296 static int _sm2_verify(struct mpi_ec_ctx
*ec
, MPI hash
, MPI sig_r
, MPI sig_s
)
299 struct gcry_mpi_point sG
, tP
;
301 MPI x1
= NULL
, y1
= NULL
;
309 /* r, s in [1, n-1] */
310 if (mpi_cmp_ui(sig_r
, 1) < 0 || mpi_cmp(sig_r
, ec
->n
) > 0 ||
311 mpi_cmp_ui(sig_s
, 1) < 0 || mpi_cmp(sig_s
, ec
->n
) > 0) {
315 /* t = (r + s) % n, t == 0 */
316 mpi_addm(t
, sig_r
, sig_s
, ec
->n
);
317 if (mpi_cmp_ui(t
, 0) == 0)
320 /* sG + tP = (x1, y1) */
322 mpi_ec_mul_point(&sG
, sig_s
, ec
->G
, ec
);
323 mpi_ec_mul_point(&tP
, t
, ec
->Q
, ec
);
324 mpi_ec_add_points(&sG
, &sG
, &tP
, ec
);
325 if (mpi_ec_get_affine(x1
, y1
, &sG
, ec
))
328 /* R = (e + x1) % n */
329 mpi_addm(t
, hash
, x1
, ec
->n
);
333 if (mpi_cmp(t
, sig_r
))
339 mpi_point_free_parts(&sG
);
340 mpi_point_free_parts(&tP
);
348 static int sm2_verify(struct akcipher_request
*req
)
350 struct crypto_akcipher
*tfm
= crypto_akcipher_reqtfm(req
);
351 struct mpi_ec_ctx
*ec
= akcipher_tfm_ctx(tfm
);
352 unsigned char *buffer
;
353 struct sm2_signature_ctx sig
;
357 if (unlikely(!ec
->Q
))
360 buffer
= kmalloc(req
->src_len
+ req
->dst_len
, GFP_KERNEL
);
364 sg_pcopy_to_buffer(req
->src
,
365 sg_nents_for_len(req
->src
, req
->src_len
+ req
->dst_len
),
366 buffer
, req
->src_len
+ req
->dst_len
, 0);
370 ret
= asn1_ber_decoder(&sm2signature_decoder
, &sig
,
371 buffer
, req
->src_len
);
376 hash
= mpi_read_raw_data(buffer
+ req
->src_len
, req
->dst_len
);
380 ret
= _sm2_verify(ec
, hash
, sig
.sig_r
, sig
.sig_s
);
390 static int sm2_set_pub_key(struct crypto_akcipher
*tfm
,
391 const void *key
, unsigned int keylen
)
393 struct mpi_ec_ctx
*ec
= akcipher_tfm_ctx(tfm
);
397 /* include the uncompressed flag '0x04' */
398 a
= mpi_read_raw_data(key
, keylen
);
403 rc
= sm2_ecc_os2ec(ec
->Q
, a
);
409 static unsigned int sm2_max_size(struct crypto_akcipher
*tfm
)
411 /* Unlimited max size */
415 static int sm2_init_tfm(struct crypto_akcipher
*tfm
)
417 struct mpi_ec_ctx
*ec
= akcipher_tfm_ctx(tfm
);
419 return sm2_ec_ctx_init(ec
);
422 static void sm2_exit_tfm(struct crypto_akcipher
*tfm
)
424 struct mpi_ec_ctx
*ec
= akcipher_tfm_ctx(tfm
);
426 sm2_ec_ctx_deinit(ec
);
429 static struct akcipher_alg sm2
= {
430 .verify
= sm2_verify
,
431 .set_pub_key
= sm2_set_pub_key
,
432 .max_size
= sm2_max_size
,
433 .init
= sm2_init_tfm
,
434 .exit
= sm2_exit_tfm
,
437 .cra_driver_name
= "sm2-generic",
439 .cra_module
= THIS_MODULE
,
440 .cra_ctxsize
= sizeof(struct mpi_ec_ctx
),
444 static int sm2_init(void)
446 return crypto_register_akcipher(&sm2
);
449 static void sm2_exit(void)
451 crypto_unregister_akcipher(&sm2
);
454 subsys_initcall(sm2_init
);
455 module_exit(sm2_exit
);
457 MODULE_LICENSE("GPL");
458 MODULE_AUTHOR("Tianjia Zhang <tianjia.zhang@linux.alibaba.com>");
459 MODULE_DESCRIPTION("SM2 generic algorithm");
460 MODULE_ALIAS_CRYPTO("sm2-generic");