1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*  Diffie-Hellman Key Agreement Method [RFC2631]
24 	mpi_free(ctx->p);  in dh_clear_ctx()
25 	mpi_free(ctx->g);  in dh_clear_ctx()
26 	mpi_free(ctx->xa);  in dh_clear_ctx()
39 	return mpi_powm(val, base, ctx->xa, ctx->p);  in _compute_val()
50 		return (p_len < 2048) ? -EINVAL : 0;  in dh_check_params_length()
52 	return (p_len < 1536) ? -EINVAL : 0;  in dh_check_params_length()
57 	if (dh_check_params_length(params->p_size << 3))  in dh_set_params()
58 		return -EINVAL;  in dh_set_params()
60 	ctx->p = mpi_read_raw_data(params->p, params->p_size);  in dh_set_params()
61 	if (!ctx->p)  in dh_set_params()
62 		return -EINVAL;  in dh_set_params()
64 	ctx->g = mpi_read_raw_data(params->g, params->g_size);  in dh_set_params()
65 	if (!ctx->g)  in dh_set_params()
66 		return -EINVAL;  in dh_set_params()
86 	ctx->xa = mpi_read_raw_data(params.key, params.key_size);  in dh_set_secret()
87 	if (!ctx->xa)  in dh_set_secret()
94 	return -EINVAL;  in dh_set_secret()
98  * SP800-56A public key verification:
100  * * For the safe-prime groups in FIPS mode, Q can be computed
101  *   trivially from P and a full validation according to SP800-56A
105  *   according to SP800-56A section 5.6.2.3.2 is performed.
115 	if (unlikely(!ctx->p))  in dh_is_pubkey_valid()
116 		return -EINVAL;  in dh_is_pubkey_valid()
119 	 * Step 1: Verify that 2 <= y <= p - 2.  in dh_is_pubkey_valid()
121 	 * The upper limit check is actually y < p instead of y < p - 1  in dh_is_pubkey_valid()
123 	 * p - 1 is the non-trivial element of the subgroup of order 2 and  in dh_is_pubkey_valid()
124 	 * thus, the check on y^q below would fail if y == p - 1.  in dh_is_pubkey_valid()
126 	if (mpi_cmp_ui(y, 1) < 1 || mpi_cmp(y, ctx->p) >= 0)  in dh_is_pubkey_valid()
127 		return -EINVAL;  in dh_is_pubkey_valid()
130 	 * Step 2: Verify that 1 = y^q mod p  in dh_is_pubkey_valid()
132 	 * For the safe-prime groups q = (p - 1)/2.  in dh_is_pubkey_valid()
136 		return -ENOMEM;  in dh_is_pubkey_valid()
138 	q = mpi_alloc(mpi_get_nlimbs(ctx->p));  in dh_is_pubkey_valid()
141 		return -ENOMEM;  in dh_is_pubkey_valid()
145 	 * ->p is odd, so no need to explicitly subtract one  in dh_is_pubkey_valid()
148 	ret = mpi_rshift(q, ctx->p, 1) ?:  in dh_is_pubkey_valid()
149 	      mpi_powm(val, y, q, ctx->p);  in dh_is_pubkey_valid()
162 		return -EINVAL;  in dh_is_pubkey_valid()
176 		return -ENOMEM;  in dh_compute_value()
178 	if (unlikely(!ctx->xa)) {  in dh_compute_value()
179 		ret = -EINVAL;  in dh_compute_value()
183 	if (req->src) {  in dh_compute_value()
184 		base = mpi_read_raw_from_sgl(req->src, req->src_len);  in dh_compute_value()
186 			ret = -EINVAL;  in dh_compute_value()
193 		base = ctx->g;  in dh_compute_value()
201 		/* SP800-56A rev3 5.7.1.1 check: Validation of shared secret */  in dh_compute_value()
202 		if (req->src) {  in dh_compute_value()
207 				ret = -EBADMSG;  in dh_compute_value()
211 			/* z == p - 1 */  in dh_compute_value()
215 				ret = -ENOMEM;  in dh_compute_value()
219 			ret = mpi_sub_ui(pone, ctx->p, 1);  in dh_compute_value()
221 				ret = -EBADMSG;  in dh_compute_value()
228 		/* SP800-56A rev 3 5.6.2.1.3 key check */  in dh_compute_value()
231 				ret = -EAGAIN;  in dh_compute_value()
237 	ret = mpi_write_to_sgl(val, req->dst, req->dst_len, &sign);  in dh_compute_value()
242 		ret = -EBADMSG;  in dh_compute_value()
244 	if (req->src)  in dh_compute_value()
255 	return mpi_get_size(ctx->p);  in dh_max_size()
273 		.cra_driver_name = "dh-generic",
287 static const char safe_prime_g[]  = { 2 };
302 	crypto_drop_kpp(&ctx->dh_spawn);  in dh_safe_prime_free_instance()
318 	tfm_ctx->dh_tfm = crypto_spawn_kpp(&inst_ctx->dh_spawn);  in dh_safe_prime_init_tfm()
319 	if (IS_ERR(tfm_ctx->dh_tfm))  in dh_safe_prime_init_tfm()
320 		return PTR_ERR(tfm_ctx->dh_tfm);  in dh_safe_prime_init_tfm()
323 			     crypto_kpp_reqsize(tfm_ctx->dh_tfm));  in dh_safe_prime_init_tfm()
332 	crypto_free_kpp(tfm_ctx->dh_tfm);  in dh_safe_prime_exit_tfm()
339 	for (i = n; val && i > 0; --i) {  in __add_u64_to_be()
340 		u64 tmp = be64_to_cpu(dst[i - 1]);  in __add_u64_to_be()
344 		dst[i - 1] = cpu_to_be64(tmp);  in __add_u64_to_be()
359 	 * Generate a private key following NIST SP800-56Ar3,  in dh_safe_prime_gen_privkey()
363 	 * 2 * ->max_strength <= N <= log2(q) + 1 = ->p_size * 8 - 1  in dh_safe_prime_gen_privkey()
364 	 * with q = (p - 1) / 2 for the safe-prime groups.  in dh_safe_prime_gen_privkey()
370 	 * - N >= 256, in particular it is a multiple of 2^6 = 64  in dh_safe_prime_gen_privkey()
372 	 * - N < log2(q) + 1, i.e. N respects the upper bound.  in dh_safe_prime_gen_privkey()
374 	n = roundup_pow_of_two(2 * safe_prime->max_strength);  in dh_safe_prime_gen_privkey()
375 	WARN_ON_ONCE(n & ((1u << 6) - 1));  in dh_safe_prime_gen_privkey()
385 		return ERR_PTR(-ENOMEM);  in dh_safe_prime_gen_privkey()
391 	err = -EFAULT;  in dh_safe_prime_gen_privkey()
402 	 * 5.6.1.1.3, step 5 is implicit: 2^N < q and thus,  in dh_safe_prime_gen_privkey()
403 	 * M = min(2^N, q) = 2^N.  in dh_safe_prime_gen_privkey()
406 	 * key = (key[] mod (M - 1)) + 1 = (key[] mod (2^N - 1)) + 1.  in dh_safe_prime_gen_privkey()
409 	 * 2^N mod (2^N - 1) = 1 and thus, for any integer h,  in dh_safe_prime_gen_privkey()
410 	 * 2^N * h mod (2^N - 1) = h mod (2^N - 1) always holds.  in dh_safe_prime_gen_privkey()
411 	 * The big endian integer key[] composed of n + 1 64bit words  in dh_safe_prime_gen_privkey()
412 	 * may be written as key[] = h * 2^N + l, with h = key[0]  in dh_safe_prime_gen_privkey()
414 	 * corresponding to the remaining 2^N bits. With the remark  in dh_safe_prime_gen_privkey()
416 	 * h * 2^N + l mod (2^N - 1) = l + h mod (2^N - 1).  in dh_safe_prime_gen_privkey()
417 	 * As both, l and h are less than 2^N, their sum after  in dh_safe_prime_gen_privkey()
418 	 * this first reduction is guaranteed to be <= 2^(N + 1) - 2.  in dh_safe_prime_gen_privkey()
420 	 * h' * 2^N + l' with h' now either zero or one and if one,  in dh_safe_prime_gen_privkey()
421 	 * then l' <= 2^N - 2. Thus, all bits at positions >= N will  in dh_safe_prime_gen_privkey()
423 	 * h' * 2^N + l' mod (2^N - 1) = l' + h' mod (2^N - 1).  in dh_safe_prime_gen_privkey()
425 	 * l' + h' = 2^N - 1, i.e. that l' + h' mod (2^N - 1)  in dh_safe_prime_gen_privkey()
437 	 * The overflow bit o from the increment is either zero or  in dh_safe_prime_gen_privkey()
438 	 * one. If zero, key[1:n] holds the final result in big-endian  in dh_safe_prime_gen_privkey()
473 			return -EINVAL;  in dh_safe_prime_set_secret()
476 	params.p = inst_ctx->safe_prime->p;  in dh_safe_prime_set_secret()
477 	params.p_size = inst_ctx->safe_prime->p_size;  in dh_safe_prime_set_secret()
482 		key = dh_safe_prime_gen_privkey(inst_ctx->safe_prime,  in dh_safe_prime_set_secret()
492 		err = -ENOMEM;  in dh_safe_prime_set_secret()
500 	err = crypto_kpp_set_secret(tfm_ctx->dh_tfm, buf, buf_size);  in dh_safe_prime_set_secret()
520 	kpp_request_set_tfm(dh_req, tfm_ctx->dh_tfm);  in dh_safe_prime_prepare_dh_req()
521 	kpp_request_set_callback(dh_req, req->base.flags,  in dh_safe_prime_prepare_dh_req()
524 	kpp_request_set_input(dh_req, req->src, req->src_len);  in dh_safe_prime_prepare_dh_req()
525 	kpp_request_set_output(dh_req, req->dst, req->dst_len);  in dh_safe_prime_prepare_dh_req()
548 	return crypto_kpp_maxsize(tfm_ctx->dh_tfm);  in dh_safe_prime_max_size()
572 		return -ENOMEM;  in __dh_safe_prime_create()
576 	err = crypto_grab_kpp(&ctx->dh_spawn, kpp_crypto_instance(inst),  in __dh_safe_prime_create()
581 	err = -EINVAL;  in __dh_safe_prime_create()
582 	dh_alg = crypto_spawn_kpp_alg(&ctx->dh_spawn);  in __dh_safe_prime_create()
583 	if (strcmp(dh_alg->base.cra_name, "dh"))  in __dh_safe_prime_create()
586 	ctx->safe_prime = safe_prime;  in __dh_safe_prime_create()
589 				  tmpl->name, &dh_alg->base);  in __dh_safe_prime_create()
593 	inst->alg.set_secret = dh_safe_prime_set_secret;  in __dh_safe_prime_create()
594 	inst->alg.generate_public_key = dh_safe_prime_generate_public_key;  in __dh_safe_prime_create()
595 	inst->alg.compute_shared_secret = dh_safe_prime_compute_shared_secret;  in __dh_safe_prime_create()
596 	inst->alg.max_size = dh_safe_prime_max_size;  in __dh_safe_prime_create()
597 	inst->alg.init = dh_safe_prime_init_tfm;  in __dh_safe_prime_create()
598 	inst->alg.exit = dh_safe_prime_exit_tfm;  in __dh_safe_prime_create()
599 	inst->alg.base.cra_priority = dh_alg->base.cra_priority;  in __dh_safe_prime_create()
600 	inst->alg.base.cra_module = THIS_MODULE;  in __dh_safe_prime_create()
601 	inst->alg.base.cra_ctxsize = sizeof(struct dh_safe_prime_tfm_ctx);  in __dh_safe_prime_create()
603 	inst->free = dh_safe_prime_free_instance;  in __dh_safe_prime_create()
635 	"\x91\x72\xfe\x9c\xe9\x85\x83\xff\x8e\x4f\x12\x32\xee\xf2\x81\x83"
657 	"\x91\x72\xfe\x9c\xe9\x85\x83\xff\x8e\x4f\x12\x32\xee\xf2\x81\x83"
687 	"\x91\x72\xfe\x9c\xe9\x85\x83\xff\x8e\x4f\x12\x32\xee\xf2\x81\x83"
701 	"\x71\x35\xc8\x86\xef\xb4\x31\x8a\xed\x6a\x1e\x01\x2d\x9e\x68\x32"
725 	"\x91\x72\xfe\x9c\xe9\x85\x83\xff\x8e\x4f\x12\x32\xee\xf2\x81\x83"
739 	"\x71\x35\xc8\x86\xef\xb4\x31\x8a\xed\x6a\x1e\x01\x2d\x9e\x68\x32"
746 	"\x3b\xb4\x54\x32\x9b\x76\x24\xc8\x91\x7b\xdd\x64\xb1\xc0\xfd\x4c"
749 	"\xa5\x24\x71\xf7\xa9\xa9\x69\x10\xb8\x55\x32\x2e\xdb\x63\x40\xd8"
760 	"\xa4\x0e\x32\x9c\xd0\xe4\x0e\x65\xff\xff\xff\xff\xff\xff\xff\xff",
779 	"\x91\x72\xfe\x9c\xe9\x85\x83\xff\x8e\x4f\x12\x32\xee\xf2\x81\x83"
793 	"\x71\x35\xc8\x86\xef\xb4\x31\x8a\xed\x6a\x1e\x01\x2d\x9e\x68\x32"
800 	"\x3b\xb4\x54\x32\x9b\x76\x24\xc8\x91\x7b\xdd\x64\xb1\xc0\xfd\x4c"
803 	"\xa5\x24\x71\xf7\xa9\xa9\x69\x10\xb8\x55\x32\x2e\xdb\x63\x40\xd8"
814 	"\xa4\x0e\x32\x9c\xcf\xf4\x6a\xaa\x36\xad\x00\x4c\xf6\x00\xc8\x38"