Loading...
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * SM2 asymmetric public-key algorithm
4 * as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012 SM2 and
5 * described at https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
6 *
7 * Copyright (c) 2020, Alibaba Group.
8 * Authors: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
9 */
10
11#include <linux/module.h>
12#include <linux/mpi.h>
13#include <crypto/internal/akcipher.h>
14#include <crypto/akcipher.h>
15#include <crypto/hash.h>
16#include <crypto/sm3.h>
17#include <crypto/rng.h>
18#include <crypto/sm2.h>
19#include "sm2signature.asn1.h"
20
21#define MPI_NBYTES(m) ((mpi_get_nbits(m) + 7) / 8)
22
23struct ecc_domain_parms {
24 const char *desc; /* Description of the curve. */
25 unsigned int nbits; /* Number of bits. */
26 unsigned int fips:1; /* True if this is a FIPS140-2 approved curve */
27
28 /* The model describing this curve. This is mainly used to select
29 * the group equation.
30 */
31 enum gcry_mpi_ec_models model;
32
33 /* The actual ECC dialect used. This is used for curve specific
34 * optimizations and to select encodings etc.
35 */
36 enum ecc_dialects dialect;
37
38 const char *p; /* The prime defining the field. */
39 const char *a, *b; /* The coefficients. For Twisted Edwards
40 * Curves b is used for d. For Montgomery
41 * Curves (a,b) has ((A-2)/4,B^-1).
42 */
43 const char *n; /* The order of the base point. */
44 const char *g_x, *g_y; /* Base point. */
45 unsigned int h; /* Cofactor. */
46};
47
48static const struct ecc_domain_parms sm2_ecp = {
49 .desc = "sm2p256v1",
50 .nbits = 256,
51 .fips = 0,
52 .model = MPI_EC_WEIERSTRASS,
53 .dialect = ECC_DIALECT_STANDARD,
54 .p = "0xfffffffeffffffffffffffffffffffffffffffff00000000ffffffffffffffff",
55 .a = "0xfffffffeffffffffffffffffffffffffffffffff00000000fffffffffffffffc",
56 .b = "0x28e9fa9e9d9f5e344d5a9e4bcf6509a7f39789f515ab8f92ddbcbd414d940e93",
57 .n = "0xfffffffeffffffffffffffffffffffff7203df6b21c6052b53bbf40939d54123",
58 .g_x = "0x32c4ae2c1f1981195f9904466a39c9948fe30bbff2660be1715a4589334c74c7",
59 .g_y = "0xbc3736a2f4f6779c59bdcee36b692153d0a9877cc62a474002df32e52139f0a0",
60 .h = 1
61};
62
63static int sm2_ec_ctx_init(struct mpi_ec_ctx *ec)
64{
65 const struct ecc_domain_parms *ecp = &sm2_ecp;
66 MPI p, a, b;
67 MPI x, y;
68 int rc = -EINVAL;
69
70 p = mpi_scanval(ecp->p);
71 a = mpi_scanval(ecp->a);
72 b = mpi_scanval(ecp->b);
73 if (!p || !a || !b)
74 goto free_p;
75
76 x = mpi_scanval(ecp->g_x);
77 y = mpi_scanval(ecp->g_y);
78 if (!x || !y)
79 goto free;
80
81 rc = -ENOMEM;
82
83 ec->Q = mpi_point_new(0);
84 if (!ec->Q)
85 goto free;
86
87 /* mpi_ec_setup_elliptic_curve */
88 ec->G = mpi_point_new(0);
89 if (!ec->G) {
90 mpi_point_release(ec->Q);
91 goto free;
92 }
93
94 mpi_set(ec->G->x, x);
95 mpi_set(ec->G->y, y);
96 mpi_set_ui(ec->G->z, 1);
97
98 rc = -EINVAL;
99 ec->n = mpi_scanval(ecp->n);
100 if (!ec->n) {
101 mpi_point_release(ec->Q);
102 mpi_point_release(ec->G);
103 goto free;
104 }
105
106 ec->h = ecp->h;
107 ec->name = ecp->desc;
108 mpi_ec_init(ec, ecp->model, ecp->dialect, 0, p, a, b);
109
110 rc = 0;
111
112free:
113 mpi_free(x);
114 mpi_free(y);
115free_p:
116 mpi_free(p);
117 mpi_free(a);
118 mpi_free(b);
119
120 return rc;
121}
122
123static void sm2_ec_ctx_deinit(struct mpi_ec_ctx *ec)
124{
125 mpi_ec_deinit(ec);
126
127 memset(ec, 0, sizeof(*ec));
128}
129
130/* RESULT must have been initialized and is set on success to the
131 * point given by VALUE.
132 */
133static int sm2_ecc_os2ec(MPI_POINT result, MPI value)
134{
135 int rc;
136 size_t n;
137 unsigned char *buf;
138 MPI x, y;
139
140 n = MPI_NBYTES(value);
141 buf = kmalloc(n, GFP_KERNEL);
142 if (!buf)
143 return -ENOMEM;
144
145 rc = mpi_print(GCRYMPI_FMT_USG, buf, n, &n, value);
146 if (rc)
147 goto err_freebuf;
148
149 rc = -EINVAL;
150 if (n < 1 || ((n - 1) % 2))
151 goto err_freebuf;
152 /* No support for point compression */
153 if (*buf != 0x4)
154 goto err_freebuf;
155
156 rc = -ENOMEM;
157 n = (n - 1) / 2;
158 x = mpi_read_raw_data(buf + 1, n);
159 if (!x)
160 goto err_freebuf;
161 y = mpi_read_raw_data(buf + 1 + n, n);
162 if (!y)
163 goto err_freex;
164
165 mpi_normalize(x);
166 mpi_normalize(y);
167 mpi_set(result->x, x);
168 mpi_set(result->y, y);
169 mpi_set_ui(result->z, 1);
170
171 rc = 0;
172
173 mpi_free(y);
174err_freex:
175 mpi_free(x);
176err_freebuf:
177 kfree(buf);
178 return rc;
179}
180
181struct sm2_signature_ctx {
182 MPI sig_r;
183 MPI sig_s;
184};
185
186int sm2_get_signature_r(void *context, size_t hdrlen, unsigned char tag,
187 const void *value, size_t vlen)
188{
189 struct sm2_signature_ctx *sig = context;
190
191 if (!value || !vlen)
192 return -EINVAL;
193
194 sig->sig_r = mpi_read_raw_data(value, vlen);
195 if (!sig->sig_r)
196 return -ENOMEM;
197
198 return 0;
199}
200
201int sm2_get_signature_s(void *context, size_t hdrlen, unsigned char tag,
202 const void *value, size_t vlen)
203{
204 struct sm2_signature_ctx *sig = context;
205
206 if (!value || !vlen)
207 return -EINVAL;
208
209 sig->sig_s = mpi_read_raw_data(value, vlen);
210 if (!sig->sig_s)
211 return -ENOMEM;
212
213 return 0;
214}
215
216static int sm2_z_digest_update(struct sm3_state *sctx,
217 MPI m, unsigned int pbytes)
218{
219 static const unsigned char zero[32];
220 unsigned char *in;
221 unsigned int inlen;
222
223 in = mpi_get_buffer(m, &inlen, NULL);
224 if (!in)
225 return -EINVAL;
226
227 if (inlen < pbytes) {
228 /* padding with zero */
229 sm3_update(sctx, zero, pbytes - inlen);
230 sm3_update(sctx, in, inlen);
231 } else if (inlen > pbytes) {
232 /* skip the starting zero */
233 sm3_update(sctx, in + inlen - pbytes, pbytes);
234 } else {
235 sm3_update(sctx, in, inlen);
236 }
237
238 kfree(in);
239 return 0;
240}
241
242static int sm2_z_digest_update_point(struct sm3_state *sctx,
243 MPI_POINT point, struct mpi_ec_ctx *ec, unsigned int pbytes)
244{
245 MPI x, y;
246 int ret = -EINVAL;
247
248 x = mpi_new(0);
249 y = mpi_new(0);
250
251 if (!mpi_ec_get_affine(x, y, point, ec) &&
252 !sm2_z_digest_update(sctx, x, pbytes) &&
253 !sm2_z_digest_update(sctx, y, pbytes))
254 ret = 0;
255
256 mpi_free(x);
257 mpi_free(y);
258 return ret;
259}
260
261int sm2_compute_z_digest(struct crypto_akcipher *tfm,
262 const unsigned char *id, size_t id_len,
263 unsigned char dgst[SM3_DIGEST_SIZE])
264{
265 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
266 uint16_t bits_len;
267 unsigned char entl[2];
268 struct sm3_state sctx;
269 unsigned int pbytes;
270
271 if (id_len > (USHRT_MAX / 8) || !ec->Q)
272 return -EINVAL;
273
274 bits_len = (uint16_t)(id_len * 8);
275 entl[0] = bits_len >> 8;
276 entl[1] = bits_len & 0xff;
277
278 pbytes = MPI_NBYTES(ec->p);
279
280 /* ZA = H256(ENTLA | IDA | a | b | xG | yG | xA | yA) */
281 sm3_init(&sctx);
282 sm3_update(&sctx, entl, 2);
283 sm3_update(&sctx, id, id_len);
284
285 if (sm2_z_digest_update(&sctx, ec->a, pbytes) ||
286 sm2_z_digest_update(&sctx, ec->b, pbytes) ||
287 sm2_z_digest_update_point(&sctx, ec->G, ec, pbytes) ||
288 sm2_z_digest_update_point(&sctx, ec->Q, ec, pbytes))
289 return -EINVAL;
290
291 sm3_final(&sctx, dgst);
292 return 0;
293}
294EXPORT_SYMBOL(sm2_compute_z_digest);
295
296static int _sm2_verify(struct mpi_ec_ctx *ec, MPI hash, MPI sig_r, MPI sig_s)
297{
298 int rc = -EINVAL;
299 struct gcry_mpi_point sG, tP;
300 MPI t = NULL;
301 MPI x1 = NULL, y1 = NULL;
302
303 mpi_point_init(&sG);
304 mpi_point_init(&tP);
305 x1 = mpi_new(0);
306 y1 = mpi_new(0);
307 t = mpi_new(0);
308
309 /* r, s in [1, n-1] */
310 if (mpi_cmp_ui(sig_r, 1) < 0 || mpi_cmp(sig_r, ec->n) > 0 ||
311 mpi_cmp_ui(sig_s, 1) < 0 || mpi_cmp(sig_s, ec->n) > 0) {
312 goto leave;
313 }
314
315 /* t = (r + s) % n, t == 0 */
316 mpi_addm(t, sig_r, sig_s, ec->n);
317 if (mpi_cmp_ui(t, 0) == 0)
318 goto leave;
319
320 /* sG + tP = (x1, y1) */
321 rc = -EBADMSG;
322 mpi_ec_mul_point(&sG, sig_s, ec->G, ec);
323 mpi_ec_mul_point(&tP, t, ec->Q, ec);
324 mpi_ec_add_points(&sG, &sG, &tP, ec);
325 if (mpi_ec_get_affine(x1, y1, &sG, ec))
326 goto leave;
327
328 /* R = (e + x1) % n */
329 mpi_addm(t, hash, x1, ec->n);
330
331 /* check R == r */
332 rc = -EKEYREJECTED;
333 if (mpi_cmp(t, sig_r))
334 goto leave;
335
336 rc = 0;
337
338leave:
339 mpi_point_free_parts(&sG);
340 mpi_point_free_parts(&tP);
341 mpi_free(x1);
342 mpi_free(y1);
343 mpi_free(t);
344
345 return rc;
346}
347
348static int sm2_verify(struct akcipher_request *req)
349{
350 struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
351 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
352 unsigned char *buffer;
353 struct sm2_signature_ctx sig;
354 MPI hash;
355 int ret;
356
357 if (unlikely(!ec->Q))
358 return -EINVAL;
359
360 buffer = kmalloc(req->src_len + req->dst_len, GFP_KERNEL);
361 if (!buffer)
362 return -ENOMEM;
363
364 sg_pcopy_to_buffer(req->src,
365 sg_nents_for_len(req->src, req->src_len + req->dst_len),
366 buffer, req->src_len + req->dst_len, 0);
367
368 sig.sig_r = NULL;
369 sig.sig_s = NULL;
370 ret = asn1_ber_decoder(&sm2signature_decoder, &sig,
371 buffer, req->src_len);
372 if (ret)
373 goto error;
374
375 ret = -ENOMEM;
376 hash = mpi_read_raw_data(buffer + req->src_len, req->dst_len);
377 if (!hash)
378 goto error;
379
380 ret = _sm2_verify(ec, hash, sig.sig_r, sig.sig_s);
381
382 mpi_free(hash);
383error:
384 mpi_free(sig.sig_r);
385 mpi_free(sig.sig_s);
386 kfree(buffer);
387 return ret;
388}
389
390static int sm2_set_pub_key(struct crypto_akcipher *tfm,
391 const void *key, unsigned int keylen)
392{
393 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
394 MPI a;
395 int rc;
396
397 /* include the uncompressed flag '0x04' */
398 a = mpi_read_raw_data(key, keylen);
399 if (!a)
400 return -ENOMEM;
401
402 mpi_normalize(a);
403 rc = sm2_ecc_os2ec(ec->Q, a);
404 mpi_free(a);
405
406 return rc;
407}
408
409static unsigned int sm2_max_size(struct crypto_akcipher *tfm)
410{
411 /* Unlimited max size */
412 return PAGE_SIZE;
413}
414
415static int sm2_init_tfm(struct crypto_akcipher *tfm)
416{
417 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
418
419 return sm2_ec_ctx_init(ec);
420}
421
422static void sm2_exit_tfm(struct crypto_akcipher *tfm)
423{
424 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
425
426 sm2_ec_ctx_deinit(ec);
427}
428
429static struct akcipher_alg sm2 = {
430 .verify = sm2_verify,
431 .set_pub_key = sm2_set_pub_key,
432 .max_size = sm2_max_size,
433 .init = sm2_init_tfm,
434 .exit = sm2_exit_tfm,
435 .base = {
436 .cra_name = "sm2",
437 .cra_driver_name = "sm2-generic",
438 .cra_priority = 100,
439 .cra_module = THIS_MODULE,
440 .cra_ctxsize = sizeof(struct mpi_ec_ctx),
441 },
442};
443
444static int __init sm2_init(void)
445{
446 return crypto_register_akcipher(&sm2);
447}
448
449static void __exit sm2_exit(void)
450{
451 crypto_unregister_akcipher(&sm2);
452}
453
454subsys_initcall(sm2_init);
455module_exit(sm2_exit);
456
457MODULE_LICENSE("GPL");
458MODULE_AUTHOR("Tianjia Zhang <tianjia.zhang@linux.alibaba.com>");
459MODULE_DESCRIPTION("SM2 generic algorithm");
460MODULE_ALIAS_CRYPTO("sm2-generic");
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * SM2 asymmetric public-key algorithm
4 * as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012 SM2 and
5 * described at https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
6 *
7 * Copyright (c) 2020, Alibaba Group.
8 * Authors: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
9 */
10
11#include <linux/module.h>
12#include <linux/mpi.h>
13#include <crypto/internal/akcipher.h>
14#include <crypto/akcipher.h>
15#include <crypto/hash.h>
16#include <crypto/rng.h>
17#include <crypto/sm2.h>
18#include "sm2signature.asn1.h"
19
20/* The default user id as specified in GM/T 0009-2012 */
21#define SM2_DEFAULT_USERID "1234567812345678"
22#define SM2_DEFAULT_USERID_LEN 16
23
24#define MPI_NBYTES(m) ((mpi_get_nbits(m) + 7) / 8)
25
26struct ecc_domain_parms {
27 const char *desc; /* Description of the curve. */
28 unsigned int nbits; /* Number of bits. */
29 unsigned int fips:1; /* True if this is a FIPS140-2 approved curve */
30
31 /* The model describing this curve. This is mainly used to select
32 * the group equation.
33 */
34 enum gcry_mpi_ec_models model;
35
36 /* The actual ECC dialect used. This is used for curve specific
37 * optimizations and to select encodings etc.
38 */
39 enum ecc_dialects dialect;
40
41 const char *p; /* The prime defining the field. */
42 const char *a, *b; /* The coefficients. For Twisted Edwards
43 * Curves b is used for d. For Montgomery
44 * Curves (a,b) has ((A-2)/4,B^-1).
45 */
46 const char *n; /* The order of the base point. */
47 const char *g_x, *g_y; /* Base point. */
48 unsigned int h; /* Cofactor. */
49};
50
51static const struct ecc_domain_parms sm2_ecp = {
52 .desc = "sm2p256v1",
53 .nbits = 256,
54 .fips = 0,
55 .model = MPI_EC_WEIERSTRASS,
56 .dialect = ECC_DIALECT_STANDARD,
57 .p = "0xfffffffeffffffffffffffffffffffffffffffff00000000ffffffffffffffff",
58 .a = "0xfffffffeffffffffffffffffffffffffffffffff00000000fffffffffffffffc",
59 .b = "0x28e9fa9e9d9f5e344d5a9e4bcf6509a7f39789f515ab8f92ddbcbd414d940e93",
60 .n = "0xfffffffeffffffffffffffffffffffff7203df6b21c6052b53bbf40939d54123",
61 .g_x = "0x32c4ae2c1f1981195f9904466a39c9948fe30bbff2660be1715a4589334c74c7",
62 .g_y = "0xbc3736a2f4f6779c59bdcee36b692153d0a9877cc62a474002df32e52139f0a0",
63 .h = 1
64};
65
66static int __sm2_set_pub_key(struct mpi_ec_ctx *ec,
67 const void *key, unsigned int keylen);
68
69static int sm2_ec_ctx_init(struct mpi_ec_ctx *ec)
70{
71 const struct ecc_domain_parms *ecp = &sm2_ecp;
72 MPI p, a, b;
73 MPI x, y;
74 int rc = -EINVAL;
75
76 p = mpi_scanval(ecp->p);
77 a = mpi_scanval(ecp->a);
78 b = mpi_scanval(ecp->b);
79 if (!p || !a || !b)
80 goto free_p;
81
82 x = mpi_scanval(ecp->g_x);
83 y = mpi_scanval(ecp->g_y);
84 if (!x || !y)
85 goto free;
86
87 rc = -ENOMEM;
88
89 ec->Q = mpi_point_new(0);
90 if (!ec->Q)
91 goto free;
92
93 /* mpi_ec_setup_elliptic_curve */
94 ec->G = mpi_point_new(0);
95 if (!ec->G) {
96 mpi_point_release(ec->Q);
97 goto free;
98 }
99
100 mpi_set(ec->G->x, x);
101 mpi_set(ec->G->y, y);
102 mpi_set_ui(ec->G->z, 1);
103
104 rc = -EINVAL;
105 ec->n = mpi_scanval(ecp->n);
106 if (!ec->n) {
107 mpi_point_release(ec->Q);
108 mpi_point_release(ec->G);
109 goto free;
110 }
111
112 ec->h = ecp->h;
113 ec->name = ecp->desc;
114 mpi_ec_init(ec, ecp->model, ecp->dialect, 0, p, a, b);
115
116 rc = 0;
117
118free:
119 mpi_free(x);
120 mpi_free(y);
121free_p:
122 mpi_free(p);
123 mpi_free(a);
124 mpi_free(b);
125
126 return rc;
127}
128
129static void sm2_ec_ctx_deinit(struct mpi_ec_ctx *ec)
130{
131 mpi_ec_deinit(ec);
132
133 memset(ec, 0, sizeof(*ec));
134}
135
136/* RESULT must have been initialized and is set on success to the
137 * point given by VALUE.
138 */
139static int sm2_ecc_os2ec(MPI_POINT result, MPI value)
140{
141 int rc;
142 size_t n;
143 unsigned char *buf;
144 MPI x, y;
145
146 n = MPI_NBYTES(value);
147 buf = kmalloc(n, GFP_KERNEL);
148 if (!buf)
149 return -ENOMEM;
150
151 rc = mpi_print(GCRYMPI_FMT_USG, buf, n, &n, value);
152 if (rc)
153 goto err_freebuf;
154
155 rc = -EINVAL;
156 if (n < 1 || ((n - 1) % 2))
157 goto err_freebuf;
158 /* No support for point compression */
159 if (*buf != 0x4)
160 goto err_freebuf;
161
162 rc = -ENOMEM;
163 n = (n - 1) / 2;
164 x = mpi_read_raw_data(buf + 1, n);
165 if (!x)
166 goto err_freebuf;
167 y = mpi_read_raw_data(buf + 1 + n, n);
168 if (!y)
169 goto err_freex;
170
171 mpi_normalize(x);
172 mpi_normalize(y);
173 mpi_set(result->x, x);
174 mpi_set(result->y, y);
175 mpi_set_ui(result->z, 1);
176
177 rc = 0;
178
179 mpi_free(y);
180err_freex:
181 mpi_free(x);
182err_freebuf:
183 kfree(buf);
184 return rc;
185}
186
187struct sm2_signature_ctx {
188 MPI sig_r;
189 MPI sig_s;
190};
191
192int sm2_get_signature_r(void *context, size_t hdrlen, unsigned char tag,
193 const void *value, size_t vlen)
194{
195 struct sm2_signature_ctx *sig = context;
196
197 if (!value || !vlen)
198 return -EINVAL;
199
200 sig->sig_r = mpi_read_raw_data(value, vlen);
201 if (!sig->sig_r)
202 return -ENOMEM;
203
204 return 0;
205}
206
207int sm2_get_signature_s(void *context, size_t hdrlen, unsigned char tag,
208 const void *value, size_t vlen)
209{
210 struct sm2_signature_ctx *sig = context;
211
212 if (!value || !vlen)
213 return -EINVAL;
214
215 sig->sig_s = mpi_read_raw_data(value, vlen);
216 if (!sig->sig_s)
217 return -ENOMEM;
218
219 return 0;
220}
221
222static int sm2_z_digest_update(struct shash_desc *desc,
223 MPI m, unsigned int pbytes)
224{
225 static const unsigned char zero[32];
226 unsigned char *in;
227 unsigned int inlen;
228 int err;
229
230 in = mpi_get_buffer(m, &inlen, NULL);
231 if (!in)
232 return -EINVAL;
233
234 if (inlen < pbytes) {
235 /* padding with zero */
236 err = crypto_shash_update(desc, zero, pbytes - inlen) ?:
237 crypto_shash_update(desc, in, inlen);
238 } else if (inlen > pbytes) {
239 /* skip the starting zero */
240 err = crypto_shash_update(desc, in + inlen - pbytes, pbytes);
241 } else {
242 err = crypto_shash_update(desc, in, inlen);
243 }
244
245 kfree(in);
246 return err;
247}
248
249static int sm2_z_digest_update_point(struct shash_desc *desc,
250 MPI_POINT point, struct mpi_ec_ctx *ec,
251 unsigned int pbytes)
252{
253 MPI x, y;
254 int ret = -EINVAL;
255
256 x = mpi_new(0);
257 y = mpi_new(0);
258
259 ret = mpi_ec_get_affine(x, y, point, ec) ? -EINVAL :
260 sm2_z_digest_update(desc, x, pbytes) ?:
261 sm2_z_digest_update(desc, y, pbytes);
262
263 mpi_free(x);
264 mpi_free(y);
265 return ret;
266}
267
268int sm2_compute_z_digest(struct shash_desc *desc,
269 const void *key, unsigned int keylen, void *dgst)
270{
271 struct mpi_ec_ctx *ec;
272 unsigned int bits_len;
273 unsigned int pbytes;
274 u8 entl[2];
275 int err;
276
277 ec = kmalloc(sizeof(*ec), GFP_KERNEL);
278 if (!ec)
279 return -ENOMEM;
280
281 err = sm2_ec_ctx_init(ec);
282 if (err)
283 goto out_free_ec;
284
285 err = __sm2_set_pub_key(ec, key, keylen);
286 if (err)
287 goto out_deinit_ec;
288
289 bits_len = SM2_DEFAULT_USERID_LEN * 8;
290 entl[0] = bits_len >> 8;
291 entl[1] = bits_len & 0xff;
292
293 pbytes = MPI_NBYTES(ec->p);
294
295 /* ZA = H256(ENTLA | IDA | a | b | xG | yG | xA | yA) */
296 err = crypto_shash_init(desc);
297 if (err)
298 goto out_deinit_ec;
299
300 err = crypto_shash_update(desc, entl, 2);
301 if (err)
302 goto out_deinit_ec;
303
304 err = crypto_shash_update(desc, SM2_DEFAULT_USERID,
305 SM2_DEFAULT_USERID_LEN);
306 if (err)
307 goto out_deinit_ec;
308
309 err = sm2_z_digest_update(desc, ec->a, pbytes) ?:
310 sm2_z_digest_update(desc, ec->b, pbytes) ?:
311 sm2_z_digest_update_point(desc, ec->G, ec, pbytes) ?:
312 sm2_z_digest_update_point(desc, ec->Q, ec, pbytes);
313 if (err)
314 goto out_deinit_ec;
315
316 err = crypto_shash_final(desc, dgst);
317
318out_deinit_ec:
319 sm2_ec_ctx_deinit(ec);
320out_free_ec:
321 kfree(ec);
322 return err;
323}
324EXPORT_SYMBOL_GPL(sm2_compute_z_digest);
325
326static int _sm2_verify(struct mpi_ec_ctx *ec, MPI hash, MPI sig_r, MPI sig_s)
327{
328 int rc = -EINVAL;
329 struct gcry_mpi_point sG, tP;
330 MPI t = NULL;
331 MPI x1 = NULL, y1 = NULL;
332
333 mpi_point_init(&sG);
334 mpi_point_init(&tP);
335 x1 = mpi_new(0);
336 y1 = mpi_new(0);
337 t = mpi_new(0);
338
339 /* r, s in [1, n-1] */
340 if (mpi_cmp_ui(sig_r, 1) < 0 || mpi_cmp(sig_r, ec->n) > 0 ||
341 mpi_cmp_ui(sig_s, 1) < 0 || mpi_cmp(sig_s, ec->n) > 0) {
342 goto leave;
343 }
344
345 /* t = (r + s) % n, t == 0 */
346 mpi_addm(t, sig_r, sig_s, ec->n);
347 if (mpi_cmp_ui(t, 0) == 0)
348 goto leave;
349
350 /* sG + tP = (x1, y1) */
351 rc = -EBADMSG;
352 mpi_ec_mul_point(&sG, sig_s, ec->G, ec);
353 mpi_ec_mul_point(&tP, t, ec->Q, ec);
354 mpi_ec_add_points(&sG, &sG, &tP, ec);
355 if (mpi_ec_get_affine(x1, y1, &sG, ec))
356 goto leave;
357
358 /* R = (e + x1) % n */
359 mpi_addm(t, hash, x1, ec->n);
360
361 /* check R == r */
362 rc = -EKEYREJECTED;
363 if (mpi_cmp(t, sig_r))
364 goto leave;
365
366 rc = 0;
367
368leave:
369 mpi_point_free_parts(&sG);
370 mpi_point_free_parts(&tP);
371 mpi_free(x1);
372 mpi_free(y1);
373 mpi_free(t);
374
375 return rc;
376}
377
378static int sm2_verify(struct akcipher_request *req)
379{
380 struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
381 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
382 unsigned char *buffer;
383 struct sm2_signature_ctx sig;
384 MPI hash;
385 int ret;
386
387 if (unlikely(!ec->Q))
388 return -EINVAL;
389
390 buffer = kmalloc(req->src_len + req->dst_len, GFP_KERNEL);
391 if (!buffer)
392 return -ENOMEM;
393
394 sg_pcopy_to_buffer(req->src,
395 sg_nents_for_len(req->src, req->src_len + req->dst_len),
396 buffer, req->src_len + req->dst_len, 0);
397
398 sig.sig_r = NULL;
399 sig.sig_s = NULL;
400 ret = asn1_ber_decoder(&sm2signature_decoder, &sig,
401 buffer, req->src_len);
402 if (ret)
403 goto error;
404
405 ret = -ENOMEM;
406 hash = mpi_read_raw_data(buffer + req->src_len, req->dst_len);
407 if (!hash)
408 goto error;
409
410 ret = _sm2_verify(ec, hash, sig.sig_r, sig.sig_s);
411
412 mpi_free(hash);
413error:
414 mpi_free(sig.sig_r);
415 mpi_free(sig.sig_s);
416 kfree(buffer);
417 return ret;
418}
419
420static int sm2_set_pub_key(struct crypto_akcipher *tfm,
421 const void *key, unsigned int keylen)
422{
423 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
424
425 return __sm2_set_pub_key(ec, key, keylen);
426
427}
428
429static int __sm2_set_pub_key(struct mpi_ec_ctx *ec,
430 const void *key, unsigned int keylen)
431{
432 MPI a;
433 int rc;
434
435 /* include the uncompressed flag '0x04' */
436 a = mpi_read_raw_data(key, keylen);
437 if (!a)
438 return -ENOMEM;
439
440 mpi_normalize(a);
441 rc = sm2_ecc_os2ec(ec->Q, a);
442 mpi_free(a);
443
444 return rc;
445}
446
447static unsigned int sm2_max_size(struct crypto_akcipher *tfm)
448{
449 /* Unlimited max size */
450 return PAGE_SIZE;
451}
452
453static int sm2_init_tfm(struct crypto_akcipher *tfm)
454{
455 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
456
457 return sm2_ec_ctx_init(ec);
458}
459
460static void sm2_exit_tfm(struct crypto_akcipher *tfm)
461{
462 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
463
464 sm2_ec_ctx_deinit(ec);
465}
466
467static struct akcipher_alg sm2 = {
468 .verify = sm2_verify,
469 .set_pub_key = sm2_set_pub_key,
470 .max_size = sm2_max_size,
471 .init = sm2_init_tfm,
472 .exit = sm2_exit_tfm,
473 .base = {
474 .cra_name = "sm2",
475 .cra_driver_name = "sm2-generic",
476 .cra_priority = 100,
477 .cra_module = THIS_MODULE,
478 .cra_ctxsize = sizeof(struct mpi_ec_ctx),
479 },
480};
481
482static int __init sm2_init(void)
483{
484 return crypto_register_akcipher(&sm2);
485}
486
487static void __exit sm2_exit(void)
488{
489 crypto_unregister_akcipher(&sm2);
490}
491
492subsys_initcall(sm2_init);
493module_exit(sm2_exit);
494
495MODULE_LICENSE("GPL");
496MODULE_AUTHOR("Tianjia Zhang <tianjia.zhang@linux.alibaba.com>");
497MODULE_DESCRIPTION("SM2 generic algorithm");
498MODULE_ALIAS_CRYPTO("sm2-generic");