rsa.c 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* RSA asymmetric public-key algorithm [RFC3447]
  3. *
  4. * Copyright (c) 2015, Intel Corporation
  5. * Authors: Tadeusz Struk <[email protected]>
  6. */
  7. #include <linux/fips.h>
  8. #include <linux/module.h>
  9. #include <linux/mpi.h>
  10. #include <crypto/internal/rsa.h>
  11. #include <crypto/internal/akcipher.h>
  12. #include <crypto/akcipher.h>
  13. #include <crypto/algapi.h>
  14. struct rsa_mpi_key {
  15. MPI n;
  16. MPI e;
  17. MPI d;
  18. MPI p;
  19. MPI q;
  20. MPI dp;
  21. MPI dq;
  22. MPI qinv;
  23. };
  24. /*
  25. * RSAEP function [RFC3447 sec 5.1.1]
  26. * c = m^e mod n;
  27. */
  28. static int _rsa_enc(const struct rsa_mpi_key *key, MPI c, MPI m)
  29. {
  30. /* (1) Validate 0 <= m < n */
  31. if (mpi_cmp_ui(m, 0) < 0 || mpi_cmp(m, key->n) >= 0)
  32. return -EINVAL;
  33. /* (2) c = m^e mod n */
  34. return mpi_powm(c, m, key->e, key->n);
  35. }
  36. /*
  37. * RSADP function [RFC3447 sec 5.1.2]
  38. * m_1 = c^dP mod p;
  39. * m_2 = c^dQ mod q;
  40. * h = (m_1 - m_2) * qInv mod p;
  41. * m = m_2 + q * h;
  42. */
  43. static int _rsa_dec_crt(const struct rsa_mpi_key *key, MPI m_or_m1_or_h, MPI c)
  44. {
  45. MPI m2, m12_or_qh;
  46. int ret = -ENOMEM;
  47. /* (1) Validate 0 <= c < n */
  48. if (mpi_cmp_ui(c, 0) < 0 || mpi_cmp(c, key->n) >= 0)
  49. return -EINVAL;
  50. m2 = mpi_alloc(0);
  51. m12_or_qh = mpi_alloc(0);
  52. if (!m2 || !m12_or_qh)
  53. goto err_free_mpi;
  54. /* (2i) m_1 = c^dP mod p */
  55. ret = mpi_powm(m_or_m1_or_h, c, key->dp, key->p);
  56. if (ret)
  57. goto err_free_mpi;
  58. /* (2i) m_2 = c^dQ mod q */
  59. ret = mpi_powm(m2, c, key->dq, key->q);
  60. if (ret)
  61. goto err_free_mpi;
  62. /* (2iii) h = (m_1 - m_2) * qInv mod p */
  63. mpi_sub(m12_or_qh, m_or_m1_or_h, m2);
  64. mpi_mulm(m_or_m1_or_h, m12_or_qh, key->qinv, key->p);
  65. /* (2iv) m = m_2 + q * h */
  66. mpi_mul(m12_or_qh, key->q, m_or_m1_or_h);
  67. mpi_addm(m_or_m1_or_h, m2, m12_or_qh, key->n);
  68. ret = 0;
  69. err_free_mpi:
  70. mpi_free(m12_or_qh);
  71. mpi_free(m2);
  72. return ret;
  73. }
  74. static inline struct rsa_mpi_key *rsa_get_key(struct crypto_akcipher *tfm)
  75. {
  76. return akcipher_tfm_ctx(tfm);
  77. }
  78. static int rsa_enc(struct akcipher_request *req)
  79. {
  80. struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
  81. const struct rsa_mpi_key *pkey = rsa_get_key(tfm);
  82. MPI m, c = mpi_alloc(0);
  83. int ret = 0;
  84. int sign;
  85. if (!c)
  86. return -ENOMEM;
  87. if (unlikely(!pkey->n || !pkey->e)) {
  88. ret = -EINVAL;
  89. goto err_free_c;
  90. }
  91. ret = -ENOMEM;
  92. m = mpi_read_raw_from_sgl(req->src, req->src_len);
  93. if (!m)
  94. goto err_free_c;
  95. ret = _rsa_enc(pkey, c, m);
  96. if (ret)
  97. goto err_free_m;
  98. ret = mpi_write_to_sgl(c, req->dst, req->dst_len, &sign);
  99. if (ret)
  100. goto err_free_m;
  101. if (sign < 0)
  102. ret = -EBADMSG;
  103. err_free_m:
  104. mpi_free(m);
  105. err_free_c:
  106. mpi_free(c);
  107. return ret;
  108. }
  109. static int rsa_dec(struct akcipher_request *req)
  110. {
  111. struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
  112. const struct rsa_mpi_key *pkey = rsa_get_key(tfm);
  113. MPI c, m = mpi_alloc(0);
  114. int ret = 0;
  115. int sign;
  116. if (!m)
  117. return -ENOMEM;
  118. if (unlikely(!pkey->n || !pkey->d)) {
  119. ret = -EINVAL;
  120. goto err_free_m;
  121. }
  122. ret = -ENOMEM;
  123. c = mpi_read_raw_from_sgl(req->src, req->src_len);
  124. if (!c)
  125. goto err_free_m;
  126. ret = _rsa_dec_crt(pkey, m, c);
  127. if (ret)
  128. goto err_free_c;
  129. ret = mpi_write_to_sgl(m, req->dst, req->dst_len, &sign);
  130. if (ret)
  131. goto err_free_c;
  132. if (sign < 0)
  133. ret = -EBADMSG;
  134. err_free_c:
  135. mpi_free(c);
  136. err_free_m:
  137. mpi_free(m);
  138. return ret;
  139. }
  140. static void rsa_free_mpi_key(struct rsa_mpi_key *key)
  141. {
  142. mpi_free(key->d);
  143. mpi_free(key->e);
  144. mpi_free(key->n);
  145. mpi_free(key->p);
  146. mpi_free(key->q);
  147. mpi_free(key->dp);
  148. mpi_free(key->dq);
  149. mpi_free(key->qinv);
  150. key->d = NULL;
  151. key->e = NULL;
  152. key->n = NULL;
  153. key->p = NULL;
  154. key->q = NULL;
  155. key->dp = NULL;
  156. key->dq = NULL;
  157. key->qinv = NULL;
  158. }
  159. static int rsa_check_key_length(unsigned int len)
  160. {
  161. switch (len) {
  162. case 512:
  163. case 1024:
  164. case 1536:
  165. if (fips_enabled)
  166. return -EINVAL;
  167. fallthrough;
  168. case 2048:
  169. case 3072:
  170. case 4096:
  171. return 0;
  172. }
  173. return -EINVAL;
  174. }
  175. static int rsa_set_pub_key(struct crypto_akcipher *tfm, const void *key,
  176. unsigned int keylen)
  177. {
  178. struct rsa_mpi_key *mpi_key = akcipher_tfm_ctx(tfm);
  179. struct rsa_key raw_key = {0};
  180. int ret;
  181. /* Free the old MPI key if any */
  182. rsa_free_mpi_key(mpi_key);
  183. ret = rsa_parse_pub_key(&raw_key, key, keylen);
  184. if (ret)
  185. return ret;
  186. mpi_key->e = mpi_read_raw_data(raw_key.e, raw_key.e_sz);
  187. if (!mpi_key->e)
  188. goto err;
  189. mpi_key->n = mpi_read_raw_data(raw_key.n, raw_key.n_sz);
  190. if (!mpi_key->n)
  191. goto err;
  192. if (rsa_check_key_length(mpi_get_size(mpi_key->n) << 3)) {
  193. rsa_free_mpi_key(mpi_key);
  194. return -EINVAL;
  195. }
  196. return 0;
  197. err:
  198. rsa_free_mpi_key(mpi_key);
  199. return -ENOMEM;
  200. }
  201. static int rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key,
  202. unsigned int keylen)
  203. {
  204. struct rsa_mpi_key *mpi_key = akcipher_tfm_ctx(tfm);
  205. struct rsa_key raw_key = {0};
  206. int ret;
  207. /* Free the old MPI key if any */
  208. rsa_free_mpi_key(mpi_key);
  209. ret = rsa_parse_priv_key(&raw_key, key, keylen);
  210. if (ret)
  211. return ret;
  212. mpi_key->d = mpi_read_raw_data(raw_key.d, raw_key.d_sz);
  213. if (!mpi_key->d)
  214. goto err;
  215. mpi_key->e = mpi_read_raw_data(raw_key.e, raw_key.e_sz);
  216. if (!mpi_key->e)
  217. goto err;
  218. mpi_key->n = mpi_read_raw_data(raw_key.n, raw_key.n_sz);
  219. if (!mpi_key->n)
  220. goto err;
  221. mpi_key->p = mpi_read_raw_data(raw_key.p, raw_key.p_sz);
  222. if (!mpi_key->p)
  223. goto err;
  224. mpi_key->q = mpi_read_raw_data(raw_key.q, raw_key.q_sz);
  225. if (!mpi_key->q)
  226. goto err;
  227. mpi_key->dp = mpi_read_raw_data(raw_key.dp, raw_key.dp_sz);
  228. if (!mpi_key->dp)
  229. goto err;
  230. mpi_key->dq = mpi_read_raw_data(raw_key.dq, raw_key.dq_sz);
  231. if (!mpi_key->dq)
  232. goto err;
  233. mpi_key->qinv = mpi_read_raw_data(raw_key.qinv, raw_key.qinv_sz);
  234. if (!mpi_key->qinv)
  235. goto err;
  236. if (rsa_check_key_length(mpi_get_size(mpi_key->n) << 3)) {
  237. rsa_free_mpi_key(mpi_key);
  238. return -EINVAL;
  239. }
  240. return 0;
  241. err:
  242. rsa_free_mpi_key(mpi_key);
  243. return -ENOMEM;
  244. }
  245. static unsigned int rsa_max_size(struct crypto_akcipher *tfm)
  246. {
  247. struct rsa_mpi_key *pkey = akcipher_tfm_ctx(tfm);
  248. return mpi_get_size(pkey->n);
  249. }
  250. static void rsa_exit_tfm(struct crypto_akcipher *tfm)
  251. {
  252. struct rsa_mpi_key *pkey = akcipher_tfm_ctx(tfm);
  253. rsa_free_mpi_key(pkey);
  254. }
  255. static struct akcipher_alg rsa = {
  256. .encrypt = rsa_enc,
  257. .decrypt = rsa_dec,
  258. .set_priv_key = rsa_set_priv_key,
  259. .set_pub_key = rsa_set_pub_key,
  260. .max_size = rsa_max_size,
  261. .exit = rsa_exit_tfm,
  262. .base = {
  263. .cra_name = "rsa",
  264. .cra_driver_name = "rsa-generic",
  265. .cra_priority = 100,
  266. .cra_module = THIS_MODULE,
  267. .cra_ctxsize = sizeof(struct rsa_mpi_key),
  268. },
  269. };
  270. static int __init rsa_init(void)
  271. {
  272. int err;
  273. err = crypto_register_akcipher(&rsa);
  274. if (err)
  275. return err;
  276. err = crypto_register_template(&rsa_pkcs1pad_tmpl);
  277. if (err) {
  278. crypto_unregister_akcipher(&rsa);
  279. return err;
  280. }
  281. return 0;
  282. }
  283. static void __exit rsa_exit(void)
  284. {
  285. crypto_unregister_template(&rsa_pkcs1pad_tmpl);
  286. crypto_unregister_akcipher(&rsa);
  287. }
  288. subsys_initcall(rsa_init);
  289. module_exit(rsa_exit);
  290. MODULE_ALIAS_CRYPTO("rsa");
  291. MODULE_LICENSE("GPL");
  292. MODULE_DESCRIPTION("RSA generic algorithm");