1// SPDX-License-Identifier: GPL-2.0
  2
  3/*
  4 * SP800-108 Key-derivation function
  5 *
  6 * Copyright (C) 2021, Stephan Mueller <smueller@chronox.de>
  7 */
  8
  9#include <linux/fips.h>
 10#include <linux/module.h>
 11#include <crypto/kdf_sp800108.h>
 12#include <crypto/internal/kdf_selftest.h>
 13
 14/*
 15 * SP800-108 CTR KDF implementation
 16 */
 17int crypto_kdf108_ctr_generate(struct crypto_shash *kmd,
 18			       const struct kvec *info, unsigned int info_nvec,
 19			       u8 *dst, unsigned int dlen)
 20{
 21	SHASH_DESC_ON_STACK(desc, kmd);
 22	__be32 counter = cpu_to_be32(1);
 23	const unsigned int h = crypto_shash_digestsize(kmd), dlen_orig = dlen;
 24	unsigned int i;
 25	int err = 0;
 26	u8 *dst_orig = dst;
 27
 28	desc->tfm = kmd;
 29
 30	while (dlen) {
 31		err = crypto_shash_init(desc);
 32		if (err)
 33			goto out;
 34
 35		err = crypto_shash_update(desc, (u8 *)&counter, sizeof(__be32));
 36		if (err)
 37			goto out;
 38
 39		for (i = 0; i < info_nvec; i++) {
 40			err = crypto_shash_update(desc, info[i].iov_base,
 41						  info[i].iov_len);
 42			if (err)
 43				goto out;
 44		}
 45
 46		if (dlen < h) {
 47			u8 tmpbuffer[HASH_MAX_DIGESTSIZE];
 48
 49			err = crypto_shash_final(desc, tmpbuffer);
 50			if (err)
 51				goto out;
 52			memcpy(dst, tmpbuffer, dlen);
 53			memzero_explicit(tmpbuffer, h);
 54			goto out;
 55		}
 56
 57		err = crypto_shash_final(desc, dst);
 58		if (err)
 59			goto out;
 60
 61		dlen -= h;
 62		dst += h;
 63		counter = cpu_to_be32(be32_to_cpu(counter) + 1);
 64	}
 65
 66out:
 67	if (err)
 68		memzero_explicit(dst_orig, dlen_orig);
 69	shash_desc_zero(desc);
 70	return err;
 71}
 72EXPORT_SYMBOL(crypto_kdf108_ctr_generate);
 73
 74/*
 75 * The seeding of the KDF
 76 */
 77int crypto_kdf108_setkey(struct crypto_shash *kmd,
 78			 const u8 *key, size_t keylen,
 79			 const u8 *ikm, size_t ikmlen)
 80{
 81	unsigned int ds = crypto_shash_digestsize(kmd);
 82
 83	/* SP800-108 does not support IKM */
 84	if (ikm || ikmlen)
 85		return -EINVAL;
 86
 87	/* Check according to SP800-108 section 7.2 */
 88	if (ds > keylen)
 89		return -EINVAL;
 90
 91	/* Set the key for the MAC used for the KDF. */
 92	return crypto_shash_setkey(kmd, key, keylen);
 93}
 94EXPORT_SYMBOL(crypto_kdf108_setkey);
 95
 96/*
 97 * Test vector obtained from
 98 * http://csrc.nist.gov/groups/STM/cavp/documents/KBKDF800-108/CounterMode.zip
 99 */
100static const struct kdf_testvec kdf_ctr_hmac_sha256_tv_template[] = {
101	{
102		.key = "\xdd\x1d\x91\xb7\xd9\x0b\x2b\xd3"
103		       "\x13\x85\x33\xce\x92\xb2\x72\xfb"
104		       "\xf8\xa3\x69\x31\x6a\xef\xe2\x42"
105		       "\xe6\x59\xcc\x0a\xe2\x38\xaf\xe0",
106		.keylen = 32,
107		.ikm = NULL,
108		.ikmlen = 0,
109		.info = {
110			.iov_base = "\x01\x32\x2b\x96\xb3\x0a\xcd\x19"
111				    "\x79\x79\x44\x4e\x46\x8e\x1c\x5c"
112				    "\x68\x59\xbf\x1b\x1c\xf9\x51\xb7"
113				    "\xe7\x25\x30\x3e\x23\x7e\x46\xb8"
114				    "\x64\xa1\x45\xfa\xb2\x5e\x51\x7b"
115				    "\x08\xf8\x68\x3d\x03\x15\xbb\x29"
116				    "\x11\xd8\x0a\x0e\x8a\xba\x17\xf3"
117				    "\xb4\x13\xfa\xac",
118			.iov_len  = 60
119		},
120		.expected	  = "\x10\x62\x13\x42\xbf\xb0\xfd\x40"
121				    "\x04\x6c\x0e\x29\xf2\xcf\xdb\xf0",
122		.expectedlen	  = 16
123	}
124};
125
126static int __init crypto_kdf108_init(void)
127{
128	int ret;
129
130	if (IS_ENABLED(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS))
131		return 0;
132
133	ret = kdf_test(&kdf_ctr_hmac_sha256_tv_template[0], "hmac(sha256)",
134		       crypto_kdf108_setkey, crypto_kdf108_ctr_generate);
135	if (ret) {
136		if (fips_enabled)
137			panic("alg: self-tests for CTR-KDF (hmac(sha256)) failed (rc=%d)\n",
138			      ret);
139
140		WARN(1,
141		     "alg: self-tests for CTR-KDF (hmac(sha256)) failed (rc=%d)\n",
142		     ret);
143	} else if (fips_enabled) {
144		pr_info("alg: self-tests for CTR-KDF (hmac(sha256)) passed\n");
145	}
146
147	return ret;
148}
149
150static void __exit crypto_kdf108_exit(void) { }
151
152module_init(crypto_kdf108_init);
153module_exit(crypto_kdf108_exit);
154
155MODULE_LICENSE("GPL v2");
156MODULE_AUTHOR("Stephan Mueller <smueller@chronox.de>");
157MODULE_DESCRIPTION("Key Derivation Function conformant to SP800-108");