1// SPDX-License-Identifier: GPL-2.0-or-later
  2/* In-software asymmetric public-key crypto subtype
  3 *
  4 * See Documentation/crypto/asymmetric-keys.rst
  5 *
  6 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
  7 * Written by David Howells (dhowells@redhat.com)
  8 */
  9
 10#define pr_fmt(fmt) "PKEY: "fmt
 11#include <crypto/akcipher.h>
 12#include <crypto/public_key.h>
 13#include <crypto/sig.h>
 14#include <keys/asymmetric-subtype.h>
 15#include <linux/asn1.h>
 16#include <linux/err.h>
 17#include <linux/kernel.h>
 18#include <linux/module.h>
 19#include <linux/seq_file.h>
 20#include <linux/slab.h>
 21#include <linux/string.h>
 22
 23MODULE_DESCRIPTION("In-software asymmetric public-key subtype");
 24MODULE_AUTHOR("Red Hat, Inc.");
 25MODULE_LICENSE("GPL");
 26
 27/*
 28 * Provide a part of a description of the key for /proc/keys.
 29 */
 30static void public_key_describe(const struct key *asymmetric_key,
 31				struct seq_file *m)
 32{
 33	struct public_key *key = asymmetric_key->payload.data[asym_crypto];
 34
 35	if (key)
 36		seq_printf(m, "%s.%s", key->id_type, key->pkey_algo);
 37}
 38
 39/*
 40 * Destroy a public key algorithm key.
 41 */
 42void public_key_free(struct public_key *key)
 43{
 44	if (key) {
 45		kfree_sensitive(key->key);
 46		kfree(key->params);
 47		kfree(key);
 48	}
 49}
 50EXPORT_SYMBOL_GPL(public_key_free);
 51
 52/*
 53 * Destroy a public key algorithm key.
 54 */
 55static void public_key_destroy(void *payload0, void *payload3)
 56{
 57	public_key_free(payload0);
 58	public_key_signature_free(payload3);
 59}
 60
 61/*
 62 * Given a public_key, and an encoding and hash_algo to be used for signing
 63 * and/or verification with that key, determine the name of the corresponding
 64 * akcipher algorithm.  Also check that encoding and hash_algo are allowed.
 65 */
 66static int
 67software_key_determine_akcipher(const struct public_key *pkey,
 68				const char *encoding, const char *hash_algo,
 69				char alg_name[CRYPTO_MAX_ALG_NAME], bool *sig,
 70				enum kernel_pkey_operation op)
 71{
 72	int n;
 73
 74	*sig = true;
 75
 76	if (!encoding)
 77		return -EINVAL;
 78
 79	if (strcmp(pkey->pkey_algo, "rsa") == 0) {
 80		/*
 81		 * RSA signatures usually use EMSA-PKCS1-1_5 [RFC3447 sec 8.2].
 82		 */
 83		if (strcmp(encoding, "pkcs1") == 0) {
 84			*sig = op == kernel_pkey_sign ||
 85			       op == kernel_pkey_verify;
 86			if (!*sig) {
 87				/*
 88				 * For encrypt/decrypt, hash_algo is not used
 89				 * but allowed to be set for historic reasons.
 90				 */
 91				n = snprintf(alg_name, CRYPTO_MAX_ALG_NAME,
 92					     "pkcs1pad(%s)",
 93					     pkey->pkey_algo);
 94			} else {
 95				if (!hash_algo)
 96					hash_algo = "none";
 97				n = snprintf(alg_name, CRYPTO_MAX_ALG_NAME,
 98					     "pkcs1(%s,%s)",
 99					     pkey->pkey_algo, hash_algo);
100			}
101			return n >= CRYPTO_MAX_ALG_NAME ? -EINVAL : 0;
102		}
103		if (strcmp(encoding, "raw") != 0)
104			return -EINVAL;
105		/*
106		 * Raw RSA cannot differentiate between different hash
107		 * algorithms.
108		 */
109		if (hash_algo)
110			return -EINVAL;
111		*sig = false;
112	} else if (strncmp(pkey->pkey_algo, "ecdsa", 5) == 0) {
113		if (strcmp(encoding, "x962") != 0 &&
114		    strcmp(encoding, "p1363") != 0)
115			return -EINVAL;
116		/*
117		 * ECDSA signatures are taken over a raw hash, so they don't
118		 * differentiate between different hash algorithms.  That means
119		 * that the verifier should hard-code a specific hash algorithm.
120		 * Unfortunately, in practice ECDSA is used with multiple SHAs,
121		 * so we have to allow all of them and not just one.
122		 */
123		if (!hash_algo)
124			return -EINVAL;
125		if (strcmp(hash_algo, "sha1") != 0 &&
126		    strcmp(hash_algo, "sha224") != 0 &&
127		    strcmp(hash_algo, "sha256") != 0 &&
128		    strcmp(hash_algo, "sha384") != 0 &&
129		    strcmp(hash_algo, "sha512") != 0 &&
130		    strcmp(hash_algo, "sha3-256") != 0 &&
131		    strcmp(hash_algo, "sha3-384") != 0 &&
132		    strcmp(hash_algo, "sha3-512") != 0)
133			return -EINVAL;
134		n = snprintf(alg_name, CRYPTO_MAX_ALG_NAME, "%s(%s)",
135			     encoding, pkey->pkey_algo);
136		return n >= CRYPTO_MAX_ALG_NAME ? -EINVAL : 0;
137	} else if (strcmp(pkey->pkey_algo, "ecrdsa") == 0) {
138		if (strcmp(encoding, "raw") != 0)
139			return -EINVAL;
140		if (!hash_algo)
141			return -EINVAL;
142		if (strcmp(hash_algo, "streebog256") != 0 &&
143		    strcmp(hash_algo, "streebog512") != 0)
144			return -EINVAL;
145	} else {
146		/* Unknown public key algorithm */
147		return -ENOPKG;
148	}
149	if (strscpy(alg_name, pkey->pkey_algo, CRYPTO_MAX_ALG_NAME) < 0)
150		return -EINVAL;
151	return 0;
152}
153
154static u8 *pkey_pack_u32(u8 *dst, u32 val)
155{
156	memcpy(dst, &val, sizeof(val));
157	return dst + sizeof(val);
158}
159
160/*
161 * Query information about a key.
162 */
163static int software_key_query(const struct kernel_pkey_params *params,
164			      struct kernel_pkey_query *info)
165{
166	struct crypto_akcipher *tfm;
167	struct public_key *pkey = params->key->payload.data[asym_crypto];
168	char alg_name[CRYPTO_MAX_ALG_NAME];
169	struct crypto_sig *sig;
170	u8 *key, *ptr;
171	int ret, len;
172	bool issig;
173
174	ret = software_key_determine_akcipher(pkey, params->encoding,
175					      params->hash_algo, alg_name,
176					      &issig, kernel_pkey_sign);
177	if (ret < 0)
178		return ret;
179
180	key = kmalloc(pkey->keylen + sizeof(u32) * 2 + pkey->paramlen,
181		      GFP_KERNEL);
182	if (!key)
183		return -ENOMEM;
184
185	memcpy(key, pkey->key, pkey->keylen);
186	ptr = key + pkey->keylen;
187	ptr = pkey_pack_u32(ptr, pkey->algo);
188	ptr = pkey_pack_u32(ptr, pkey->paramlen);
189	memcpy(ptr, pkey->params, pkey->paramlen);
190
191	if (issig) {
192		sig = crypto_alloc_sig(alg_name, 0, 0);
193		if (IS_ERR(sig)) {
194			ret = PTR_ERR(sig);
195			goto error_free_key;
196		}
197
198		if (pkey->key_is_private)
199			ret = crypto_sig_set_privkey(sig, key, pkey->keylen);
200		else
201			ret = crypto_sig_set_pubkey(sig, key, pkey->keylen);
202		if (ret < 0)
203			goto error_free_tfm;
204
205		len = crypto_sig_keysize(sig);
206		info->max_sig_size = crypto_sig_maxsize(sig);
207		info->max_data_size = crypto_sig_digestsize(sig);
208
209		info->supported_ops = KEYCTL_SUPPORTS_VERIFY;
210		if (pkey->key_is_private)
211			info->supported_ops |= KEYCTL_SUPPORTS_SIGN;
212
213		if (strcmp(params->encoding, "pkcs1") == 0) {
214			info->supported_ops |= KEYCTL_SUPPORTS_ENCRYPT;
215			if (pkey->key_is_private)
216				info->supported_ops |= KEYCTL_SUPPORTS_DECRYPT;
217		}
218	} else {
219		tfm = crypto_alloc_akcipher(alg_name, 0, 0);
220		if (IS_ERR(tfm)) {
221			ret = PTR_ERR(tfm);
222			goto error_free_key;
223		}
224
225		if (pkey->key_is_private)
226			ret = crypto_akcipher_set_priv_key(tfm, key, pkey->keylen);
227		else
228			ret = crypto_akcipher_set_pub_key(tfm, key, pkey->keylen);
229		if (ret < 0)
230			goto error_free_tfm;
231
232		len = crypto_akcipher_maxsize(tfm);
233		info->max_sig_size = len;
234		info->max_data_size = len;
235
236		info->supported_ops = KEYCTL_SUPPORTS_ENCRYPT;
237		if (pkey->key_is_private)
238			info->supported_ops |= KEYCTL_SUPPORTS_DECRYPT;
239	}
240
241	info->key_size = len * 8;
242	info->max_enc_size = len;
243	info->max_dec_size = len;
244
245	ret = 0;
246
247error_free_tfm:
248	if (issig)
249		crypto_free_sig(sig);
250	else
251		crypto_free_akcipher(tfm);
252error_free_key:
253	kfree_sensitive(key);
254	pr_devel("<==%s() = %d\n", __func__, ret);
255	return ret;
256}
257
258/*
259 * Do encryption, decryption and signing ops.
260 */
261static int software_key_eds_op(struct kernel_pkey_params *params,
262			       const void *in, void *out)
263{
264	const struct public_key *pkey = params->key->payload.data[asym_crypto];
265	char alg_name[CRYPTO_MAX_ALG_NAME];
266	struct crypto_akcipher *tfm;
267	struct crypto_sig *sig;
268	char *key, *ptr;
269	bool issig;
270	int ksz;
271	int ret;
272
273	pr_devel("==>%s()\n", __func__);
274
275	ret = software_key_determine_akcipher(pkey, params->encoding,
276					      params->hash_algo, alg_name,
277					      &issig, params->op);
278	if (ret < 0)
279		return ret;
280
281	key = kmalloc(pkey->keylen + sizeof(u32) * 2 + pkey->paramlen,
282		      GFP_KERNEL);
283	if (!key)
284		return -ENOMEM;
285
286	memcpy(key, pkey->key, pkey->keylen);
287	ptr = key + pkey->keylen;
288	ptr = pkey_pack_u32(ptr, pkey->algo);
289	ptr = pkey_pack_u32(ptr, pkey->paramlen);
290	memcpy(ptr, pkey->params, pkey->paramlen);
291
292	if (issig) {
293		sig = crypto_alloc_sig(alg_name, 0, 0);
294		if (IS_ERR(sig)) {
295			ret = PTR_ERR(sig);
296			goto error_free_key;
297		}
298
299		if (pkey->key_is_private)
300			ret = crypto_sig_set_privkey(sig, key, pkey->keylen);
301		else
302			ret = crypto_sig_set_pubkey(sig, key, pkey->keylen);
303		if (ret)
304			goto error_free_tfm;
305
306		ksz = crypto_sig_keysize(sig);
307	} else {
308		tfm = crypto_alloc_akcipher(alg_name, 0, 0);
309		if (IS_ERR(tfm)) {
310			ret = PTR_ERR(tfm);
311			goto error_free_key;
312		}
313
314		if (pkey->key_is_private)
315			ret = crypto_akcipher_set_priv_key(tfm, key, pkey->keylen);
316		else
317			ret = crypto_akcipher_set_pub_key(tfm, key, pkey->keylen);
318		if (ret)
319			goto error_free_tfm;
320
321		ksz = crypto_akcipher_maxsize(tfm);
322	}
323
324	ret = -EINVAL;
325
326	/* Perform the encryption calculation. */
327	switch (params->op) {
328	case kernel_pkey_encrypt:
329		if (issig)
330			break;
331		ret = crypto_akcipher_sync_encrypt(tfm, in, params->in_len,
332						   out, params->out_len);
333		break;
334	case kernel_pkey_decrypt:
335		if (issig)
336			break;
337		ret = crypto_akcipher_sync_decrypt(tfm, in, params->in_len,
338						   out, params->out_len);
339		break;
340	case kernel_pkey_sign:
341		if (!issig)
342			break;
343		ret = crypto_sig_sign(sig, in, params->in_len,
344				      out, params->out_len);
345		break;
346	default:
347		BUG();
348	}
349
350	if (ret == 0)
351		ret = ksz;
352
353error_free_tfm:
354	if (issig)
355		crypto_free_sig(sig);
356	else
357		crypto_free_akcipher(tfm);
358error_free_key:
359	kfree_sensitive(key);
360	pr_devel("<==%s() = %d\n", __func__, ret);
361	return ret;
362}
363
364/*
365 * Verify a signature using a public key.
366 */
367int public_key_verify_signature(const struct public_key *pkey,
368				const struct public_key_signature *sig)
369{
370	char alg_name[CRYPTO_MAX_ALG_NAME];
371	struct crypto_sig *tfm;
372	char *key, *ptr;
373	bool issig;
374	int ret;
375
376	pr_devel("==>%s()\n", __func__);
377
378	BUG_ON(!pkey);
379	BUG_ON(!sig);
380	BUG_ON(!sig->s);
381
382	/*
383	 * If the signature specifies a public key algorithm, it *must* match
384	 * the key's actual public key algorithm.
385	 *
386	 * Small exception: ECDSA signatures don't specify the curve, but ECDSA
387	 * keys do.  So the strings can mismatch slightly in that case:
388	 * "ecdsa-nist-*" for the key, but "ecdsa" for the signature.
389	 */
390	if (sig->pkey_algo) {
391		if (strcmp(pkey->pkey_algo, sig->pkey_algo) != 0 &&
392		    (strncmp(pkey->pkey_algo, "ecdsa-", 6) != 0 ||
393		     strcmp(sig->pkey_algo, "ecdsa") != 0))
394			return -EKEYREJECTED;
395	}
396
397	ret = software_key_determine_akcipher(pkey, sig->encoding,
398					      sig->hash_algo, alg_name,
399					      &issig, kernel_pkey_verify);
400	if (ret < 0)
401		return ret;
402
403	tfm = crypto_alloc_sig(alg_name, 0, 0);
404	if (IS_ERR(tfm))
405		return PTR_ERR(tfm);
406
407	key = kmalloc(pkey->keylen + sizeof(u32) * 2 + pkey->paramlen,
408		      GFP_KERNEL);
409	if (!key) {
410		ret = -ENOMEM;
411		goto error_free_tfm;
412	}
413
414	memcpy(key, pkey->key, pkey->keylen);
415	ptr = key + pkey->keylen;
416	ptr = pkey_pack_u32(ptr, pkey->algo);
417	ptr = pkey_pack_u32(ptr, pkey->paramlen);
418	memcpy(ptr, pkey->params, pkey->paramlen);
419
420	if (pkey->key_is_private)
421		ret = crypto_sig_set_privkey(tfm, key, pkey->keylen);
422	else
423		ret = crypto_sig_set_pubkey(tfm, key, pkey->keylen);
424	if (ret)
425		goto error_free_key;
426
427	ret = crypto_sig_verify(tfm, sig->s, sig->s_size,
428				sig->digest, sig->digest_size);
429
430error_free_key:
431	kfree_sensitive(key);
432error_free_tfm:
433	crypto_free_sig(tfm);
434	pr_devel("<==%s() = %d\n", __func__, ret);
435	if (WARN_ON_ONCE(ret > 0))
436		ret = -EINVAL;
437	return ret;
438}
439EXPORT_SYMBOL_GPL(public_key_verify_signature);
440
441static int public_key_verify_signature_2(const struct key *key,
442					 const struct public_key_signature *sig)
443{
444	const struct public_key *pk = key->payload.data[asym_crypto];
445	return public_key_verify_signature(pk, sig);
446}
447
448/*
449 * Public key algorithm asymmetric key subtype
450 */
451struct asymmetric_key_subtype public_key_subtype = {
452	.owner			= THIS_MODULE,
453	.name			= "public_key",
454	.name_len		= sizeof("public_key") - 1,
455	.describe		= public_key_describe,
456	.destroy		= public_key_destroy,
457	.query			= software_key_query,
458	.eds_op			= software_key_eds_op,
459	.verify_signature	= public_key_verify_signature_2,
460};
461EXPORT_SYMBOL_GPL(public_key_subtype);