Something went wrong. Try again.
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438// SPDX-License-Identifier: GPL-2.0-or-later/* RSA asymmetric public-key algorithm [RFC3447] * * Copyright (c) 2015, Intel Corporation * Authors: Tadeusz Struk <tadeusz.struk@intel.com> */
#include <linux/fips.h>#include <linux/module.h>#include <linux/mpi.h>#include <crypto/internal/rsa.h>#include <crypto/internal/akcipher.h>#include <crypto/akcipher.h>#include <crypto/algapi.h>
struct rsa_mpi_key { MPI n; MPI e; MPI d; MPI p; MPI q; MPI dp; MPI dq; MPI qinv;};
static int rsa_check_payload(MPI x, MPI n){ MPI n1;
if (mpi_cmp_ui(x, 1) <= 0) return -EINVAL;
n1 = mpi_alloc(0); if (!n1) return -ENOMEM;
if (mpi_sub_ui(n1, n, 1) || mpi_cmp(x, n1) >= 0) { mpi_free(n1); return -EINVAL; }
mpi_free(n1); return 0;}
/* * RSAEP function [RFC3447 sec 5.1.1] * c = m^e mod n; */static int _rsa_enc(const struct rsa_mpi_key *key, MPI c, MPI m){ /* * Even though (1) in RFC3447 only requires 0 <= m <= n - 1, we are * slightly more conservative and require 1 < m < n - 1. This is in line * with SP 800-56Br2, Section 7.1.1. */ if (rsa_check_payload(m, key->n)) return -EINVAL;
/* (2) c = m^e mod n */ return mpi_powm(c, m, key->e, key->n);}
/* * RSADP function [RFC3447 sec 5.1.2] * m_1 = c^dP mod p; * m_2 = c^dQ mod q; * h = (m_1 - m_2) * qInv mod p; * m = m_2 + q * h; */static int _rsa_dec_crt(const struct rsa_mpi_key *key, MPI m_or_m1_or_h, MPI c){ MPI m2, m12_or_qh; int ret = -ENOMEM;
/* * Even though (1) in RFC3447 only requires 0 <= c <= n - 1, we are * slightly more conservative and require 1 < c < n - 1. This is in line * with SP 800-56Br2, Section 7.1.2. */ if (rsa_check_payload(c, key->n)) return -EINVAL;
m2 = mpi_alloc(0); m12_or_qh = mpi_alloc(0); if (!m2 || !m12_or_qh) goto err_free_mpi;
/* (2i) m_1 = c^dP mod p */ ret = mpi_powm(m_or_m1_or_h, c, key->dp, key->p); if (ret) goto err_free_mpi;
/* (2i) m_2 = c^dQ mod q */ ret = mpi_powm(m2, c, key->dq, key->q); if (ret) goto err_free_mpi;
/* (2iii) h = (m_1 - m_2) * qInv mod p */ ret = mpi_sub(m12_or_qh, m_or_m1_or_h, m2) ?: mpi_mulm(m_or_m1_or_h, m12_or_qh, key->qinv, key->p);
/* (2iv) m = m_2 + q * h */ ret = ret ?: mpi_mul(m12_or_qh, key->q, m_or_m1_or_h) ?: mpi_addm(m_or_m1_or_h, m2, m12_or_qh, key->n);
err_free_mpi: mpi_free(m12_or_qh); mpi_free(m2); return ret;}
static inline struct rsa_mpi_key *rsa_get_key(struct crypto_akcipher *tfm){ return akcipher_tfm_ctx(tfm);}
static int rsa_enc(struct akcipher_request *req){ struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req); const struct rsa_mpi_key *pkey = rsa_get_key(tfm); MPI m, c = mpi_alloc(0); int ret = 0; int sign;
if (!c) return -ENOMEM;
if (unlikely(!pkey->n || !pkey->e)) { ret = -EINVAL; goto err_free_c; }
ret = -ENOMEM; m = mpi_read_raw_from_sgl(req->src, req->src_len); if (!m) goto err_free_c;
ret = _rsa_enc(pkey, c, m); if (ret) goto err_free_m;
ret = mpi_write_to_sgl(c, req->dst, req->dst_len, &sign); if (ret) goto err_free_m;
if (sign < 0) ret = -EBADMSG;
err_free_m: mpi_free(m);err_free_c: mpi_free(c); return ret;}
static int rsa_dec(struct akcipher_request *req){ struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req); const struct rsa_mpi_key *pkey = rsa_get_key(tfm); MPI c, m = mpi_alloc(0); int ret = 0; int sign;
if (!m) return -ENOMEM;
if (unlikely(!pkey->n || !pkey->d)) { ret = -EINVAL; goto err_free_m; }
ret = -ENOMEM; c = mpi_read_raw_from_sgl(req->src, req->src_len); if (!c) goto err_free_m;
ret = _rsa_dec_crt(pkey, m, c); if (ret) goto err_free_c;
ret = mpi_write_to_sgl(m, req->dst, req->dst_len, &sign); if (ret) goto err_free_c;
if (sign < 0) ret = -EBADMSG;err_free_c: mpi_free(c);err_free_m: mpi_free(m); return ret;}
static void rsa_free_mpi_key(struct rsa_mpi_key *key){ mpi_free(key->d); mpi_free(key->e); mpi_free(key->n); mpi_free(key->p); mpi_free(key->q); mpi_free(key->dp); mpi_free(key->dq); mpi_free(key->qinv); key->d = NULL; key->e = NULL; key->n = NULL; key->p = NULL; key->q = NULL; key->dp = NULL; key->dq = NULL; key->qinv = NULL;}
static int rsa_check_key_length(unsigned int len){ switch (len) { case 512: case 1024: case 1536: if (fips_enabled) return -EINVAL; fallthrough; case 2048: case 3072: case 4096: return 0; }
return -EINVAL;}
static int rsa_check_exponent_fips(MPI e){ MPI e_max = NULL; int err;
/* check if odd */ if (!mpi_test_bit(e, 0)) { return -EINVAL; }
/* check if 2^16 < e < 2^256. */ if (mpi_cmp_ui(e, 65536) <= 0) { return -EINVAL; }
e_max = mpi_alloc(0); if (!e_max) return -ENOMEM;
err = mpi_set_bit(e_max, 256); if (err) { mpi_free(e_max); return err; }
if (mpi_cmp(e, e_max) >= 0) { mpi_free(e_max); return -EINVAL; }
mpi_free(e_max); return 0;}
static int rsa_set_pub_key(struct crypto_akcipher *tfm, const void *key, unsigned int keylen){ struct rsa_mpi_key *mpi_key = akcipher_tfm_ctx(tfm); struct rsa_key raw_key = {0}; int ret;
/* Free the old MPI key if any */ rsa_free_mpi_key(mpi_key);
ret = rsa_parse_pub_key(&raw_key, key, keylen); if (ret) return ret;
mpi_key->e = mpi_read_raw_data(raw_key.e, raw_key.e_sz); if (!mpi_key->e) goto err;
mpi_key->n = mpi_read_raw_data(raw_key.n, raw_key.n_sz); if (!mpi_key->n) goto err;
if (rsa_check_key_length(mpi_get_size(mpi_key->n) << 3)) { rsa_free_mpi_key(mpi_key); return -EINVAL; }
if (fips_enabled && rsa_check_exponent_fips(mpi_key->e)) { rsa_free_mpi_key(mpi_key); return -EINVAL; }
return 0;
err: rsa_free_mpi_key(mpi_key); return -ENOMEM;}
static int rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key, unsigned int keylen){ struct rsa_mpi_key *mpi_key = akcipher_tfm_ctx(tfm); struct rsa_key raw_key = {0}; int ret;
/* Free the old MPI key if any */ rsa_free_mpi_key(mpi_key);
ret = rsa_parse_priv_key(&raw_key, key, keylen); if (ret) return ret;
mpi_key->d = mpi_read_raw_data(raw_key.d, raw_key.d_sz); if (!mpi_key->d) goto err;
mpi_key->e = mpi_read_raw_data(raw_key.e, raw_key.e_sz); if (!mpi_key->e) goto err;
mpi_key->n = mpi_read_raw_data(raw_key.n, raw_key.n_sz); if (!mpi_key->n) goto err;
mpi_key->p = mpi_read_raw_data(raw_key.p, raw_key.p_sz); if (!mpi_key->p) goto err;
mpi_key->q = mpi_read_raw_data(raw_key.q, raw_key.q_sz); if (!mpi_key->q) goto err;
mpi_key->dp = mpi_read_raw_data(raw_key.dp, raw_key.dp_sz); if (!mpi_key->dp) goto err;
mpi_key->dq = mpi_read_raw_data(raw_key.dq, raw_key.dq_sz); if (!mpi_key->dq) goto err;
mpi_key->qinv = mpi_read_raw_data(raw_key.qinv, raw_key.qinv_sz); if (!mpi_key->qinv) goto err;
if (rsa_check_key_length(mpi_get_size(mpi_key->n) << 3)) { rsa_free_mpi_key(mpi_key); return -EINVAL; }
if (fips_enabled && rsa_check_exponent_fips(mpi_key->e)) { rsa_free_mpi_key(mpi_key); return -EINVAL; }
return 0;
err: rsa_free_mpi_key(mpi_key); return -ENOMEM;}
static unsigned int rsa_max_size(struct crypto_akcipher *tfm){ struct rsa_mpi_key *pkey = akcipher_tfm_ctx(tfm);
return mpi_get_size(pkey->n);}
static void rsa_exit_tfm(struct crypto_akcipher *tfm){ struct rsa_mpi_key *pkey = akcipher_tfm_ctx(tfm);
rsa_free_mpi_key(pkey);}
static struct akcipher_alg rsa = { .encrypt = rsa_enc, .decrypt = rsa_dec, .set_priv_key = rsa_set_priv_key, .set_pub_key = rsa_set_pub_key, .max_size = rsa_max_size, .exit = rsa_exit_tfm, .base = { .cra_name = "rsa", .cra_driver_name = "rsa-generic", .cra_priority = 100, .cra_module = THIS_MODULE, .cra_ctxsize = sizeof(struct rsa_mpi_key), },};
static int __init rsa_init(void){ int err;
err = crypto_register_akcipher(&rsa); if (err) return err;
err = crypto_register_template(&rsa_pkcs1pad_tmpl); if (err) goto err_unregister_rsa;
err = crypto_register_template(&rsassa_pkcs1_tmpl); if (err) goto err_unregister_rsa_pkcs1pad;
return 0;
err_unregister_rsa_pkcs1pad: crypto_unregister_template(&rsa_pkcs1pad_tmpl);err_unregister_rsa: crypto_unregister_akcipher(&rsa); return err;}
static void __exit rsa_exit(void){ crypto_unregister_template(&rsassa_pkcs1_tmpl); crypto_unregister_template(&rsa_pkcs1pad_tmpl); crypto_unregister_akcipher(&rsa);}
module_init(rsa_init);module_exit(rsa_exit);MODULE_ALIAS_CRYPTO("rsa");MODULE_LICENSE("GPL");MODULE_DESCRIPTION("RSA generic algorithm");