]>
Commit | Line | Data |
---|---|---|
802c7f1c SB |
1 | /* Diffie-Hellman Key Agreement Method [RFC2631] |
2 | * | |
3 | * Copyright (c) 2016, Intel Corporation | |
4 | * Authors: Salvatore Benedetto <salvatore.benedetto@intel.com> | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or | |
c0ca1215 | 7 | * modify it under the terms of the GNU General Public License |
802c7f1c | 8 | * as published by the Free Software Foundation; either version |
c0ca1215 | 9 | * 2 of the License, or (at your option) any later version. |
802c7f1c SB |
10 | */ |
11 | ||
12 | #include <linux/module.h> | |
13 | #include <crypto/internal/kpp.h> | |
14 | #include <crypto/kpp.h> | |
15 | #include <crypto/dh.h> | |
16 | #include <linux/mpi.h> | |
17 | ||
18 | struct dh_ctx { | |
19 | MPI p; | |
20 | MPI g; | |
21 | MPI xa; | |
22 | }; | |
23 | ||
783e561d | 24 | static void dh_clear_ctx(struct dh_ctx *ctx) |
802c7f1c SB |
25 | { |
26 | mpi_free(ctx->p); | |
27 | mpi_free(ctx->g); | |
802c7f1c | 28 | mpi_free(ctx->xa); |
783e561d | 29 | memset(ctx, 0, sizeof(*ctx)); |
802c7f1c SB |
30 | } |
31 | ||
32 | /* | |
33 | * If base is g we compute the public key | |
34 | * ya = g^xa mod p; [RFC2631 sec 2.1.1] | |
35 | * else if base if the counterpart public key we compute the shared secret | |
36 | * ZZ = yb^xa mod p; [RFC2631 sec 2.1.1] | |
37 | */ | |
38 | static int _compute_val(const struct dh_ctx *ctx, MPI base, MPI val) | |
39 | { | |
40 | /* val = base^xa mod p */ | |
41 | return mpi_powm(val, base, ctx->xa, ctx->p); | |
42 | } | |
43 | ||
44 | static inline struct dh_ctx *dh_get_ctx(struct crypto_kpp *tfm) | |
45 | { | |
46 | return kpp_tfm_ctx(tfm); | |
47 | } | |
48 | ||
49 | static int dh_check_params_length(unsigned int p_len) | |
50 | { | |
51 | return (p_len < 1536) ? -EINVAL : 0; | |
52 | } | |
53 | ||
54 | static int dh_set_params(struct dh_ctx *ctx, struct dh *params) | |
55 | { | |
56 | if (unlikely(!params->p || !params->g)) | |
57 | return -EINVAL; | |
58 | ||
59 | if (dh_check_params_length(params->p_size << 3)) | |
60 | return -EINVAL; | |
61 | ||
62 | ctx->p = mpi_read_raw_data(params->p, params->p_size); | |
63 | if (!ctx->p) | |
64 | return -EINVAL; | |
65 | ||
66 | ctx->g = mpi_read_raw_data(params->g, params->g_size); | |
783e561d | 67 | if (!ctx->g) |
802c7f1c | 68 | return -EINVAL; |
802c7f1c SB |
69 | |
70 | return 0; | |
71 | } | |
72 | ||
5527dfb6 EB |
73 | static int dh_set_secret(struct crypto_kpp *tfm, const void *buf, |
74 | unsigned int len) | |
802c7f1c SB |
75 | { |
76 | struct dh_ctx *ctx = dh_get_ctx(tfm); | |
77 | struct dh params; | |
78 | ||
ee34e264 | 79 | /* Free the old MPI key if any */ |
783e561d | 80 | dh_clear_ctx(ctx); |
ee34e264 | 81 | |
802c7f1c | 82 | if (crypto_dh_decode_key(buf, len, ¶ms) < 0) |
783e561d | 83 | goto err_clear_ctx; |
802c7f1c SB |
84 | |
85 | if (dh_set_params(ctx, ¶ms) < 0) | |
783e561d | 86 | goto err_clear_ctx; |
802c7f1c SB |
87 | |
88 | ctx->xa = mpi_read_raw_data(params.key, params.key_size); | |
783e561d EB |
89 | if (!ctx->xa) |
90 | goto err_clear_ctx; | |
802c7f1c SB |
91 | |
92 | return 0; | |
783e561d EB |
93 | |
94 | err_clear_ctx: | |
95 | dh_clear_ctx(ctx); | |
96 | return -EINVAL; | |
802c7f1c SB |
97 | } |
98 | ||
99 | static int dh_compute_value(struct kpp_request *req) | |
100 | { | |
101 | struct crypto_kpp *tfm = crypto_kpp_reqtfm(req); | |
102 | struct dh_ctx *ctx = dh_get_ctx(tfm); | |
103 | MPI base, val = mpi_alloc(0); | |
104 | int ret = 0; | |
105 | int sign; | |
106 | ||
107 | if (!val) | |
108 | return -ENOMEM; | |
109 | ||
110 | if (unlikely(!ctx->xa)) { | |
111 | ret = -EINVAL; | |
112 | goto err_free_val; | |
113 | } | |
114 | ||
115 | if (req->src) { | |
116 | base = mpi_read_raw_from_sgl(req->src, req->src_len); | |
117 | if (!base) { | |
8edda7d2 | 118 | ret = -EINVAL; |
802c7f1c SB |
119 | goto err_free_val; |
120 | } | |
121 | } else { | |
122 | base = ctx->g; | |
123 | } | |
124 | ||
125 | ret = _compute_val(ctx, base, val); | |
126 | if (ret) | |
127 | goto err_free_base; | |
128 | ||
9b45b7bb | 129 | ret = mpi_write_to_sgl(val, req->dst, req->dst_len, &sign); |
802c7f1c SB |
130 | if (ret) |
131 | goto err_free_base; | |
132 | ||
133 | if (sign < 0) | |
134 | ret = -EBADMSG; | |
135 | err_free_base: | |
136 | if (req->src) | |
137 | mpi_free(base); | |
138 | err_free_val: | |
139 | mpi_free(val); | |
140 | return ret; | |
141 | } | |
142 | ||
7f691050 | 143 | static unsigned int dh_max_size(struct crypto_kpp *tfm) |
802c7f1c SB |
144 | { |
145 | struct dh_ctx *ctx = dh_get_ctx(tfm); | |
146 | ||
147 | return mpi_get_size(ctx->p); | |
148 | } | |
149 | ||
150 | static void dh_exit_tfm(struct crypto_kpp *tfm) | |
151 | { | |
152 | struct dh_ctx *ctx = dh_get_ctx(tfm); | |
153 | ||
783e561d | 154 | dh_clear_ctx(ctx); |
802c7f1c SB |
155 | } |
156 | ||
157 | static struct kpp_alg dh = { | |
158 | .set_secret = dh_set_secret, | |
159 | .generate_public_key = dh_compute_value, | |
160 | .compute_shared_secret = dh_compute_value, | |
161 | .max_size = dh_max_size, | |
162 | .exit = dh_exit_tfm, | |
163 | .base = { | |
164 | .cra_name = "dh", | |
165 | .cra_driver_name = "dh-generic", | |
166 | .cra_priority = 100, | |
167 | .cra_module = THIS_MODULE, | |
168 | .cra_ctxsize = sizeof(struct dh_ctx), | |
169 | }, | |
170 | }; | |
171 | ||
172 | static int dh_init(void) | |
173 | { | |
174 | return crypto_register_kpp(&dh); | |
175 | } | |
176 | ||
177 | static void dh_exit(void) | |
178 | { | |
179 | crypto_unregister_kpp(&dh); | |
180 | } | |
181 | ||
182 | module_init(dh_init); | |
183 | module_exit(dh_exit); | |
184 | MODULE_ALIAS_CRYPTO("dh"); | |
185 | MODULE_LICENSE("GPL"); | |
186 | MODULE_DESCRIPTION("DH generic algorithm"); |