1 /*
2 * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <openssl/core_dispatch.h>
11 #include <openssl/core_names.h>
12 #include <openssl/err.h>
13 #include <openssl/param_build.h>
14 #include <openssl/params.h>
15 #include <openssl/proverr.h>
16 #include <openssl/rand.h>
17 #include <openssl/self_test.h>
18 #include "internal/nelem.h"
19 #include "internal/param_build_set.h"
20 #include "prov/implementations.h"
21 #include "prov/mlx_kem.h"
22 #include "prov/provider_ctx.h"
23 #include "prov/providercommon.h"
24 #include "prov/securitycheck.h"
25
26 static OSSL_FUNC_keymgmt_gen_fn mlx_kem_gen;
27 static OSSL_FUNC_keymgmt_gen_cleanup_fn mlx_kem_gen_cleanup;
28 static OSSL_FUNC_keymgmt_gen_set_params_fn mlx_kem_gen_set_params;
29 static OSSL_FUNC_keymgmt_gen_settable_params_fn mlx_kem_gen_settable_params;
30 static OSSL_FUNC_keymgmt_get_params_fn mlx_kem_get_params;
31 static OSSL_FUNC_keymgmt_gettable_params_fn mlx_kem_gettable_params;
32 static OSSL_FUNC_keymgmt_set_params_fn mlx_kem_set_params;
33 static OSSL_FUNC_keymgmt_settable_params_fn mlx_kem_settable_params;
34 static OSSL_FUNC_keymgmt_has_fn mlx_kem_has;
35 static OSSL_FUNC_keymgmt_match_fn mlx_kem_match;
36 static OSSL_FUNC_keymgmt_import_fn mlx_kem_import;
37 static OSSL_FUNC_keymgmt_export_fn mlx_kem_export;
38 static OSSL_FUNC_keymgmt_import_types_fn mlx_kem_imexport_types;
39 static OSSL_FUNC_keymgmt_export_types_fn mlx_kem_imexport_types;
40 static OSSL_FUNC_keymgmt_dup_fn mlx_kem_dup;
41
42 static const int minimal_selection = OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS
43 | OSSL_KEYMGMT_SELECT_PRIVATE_KEY;
44
45 /* Must match DECLARE_DISPATCH invocations at the end of the file */
46 static const ECDH_VINFO hybrid_vtable[] = {
47 { "EC", "P-256", 65, 32, 32, 1, EVP_PKEY_ML_KEM_768 },
48 { "EC", "P-384", 97, 48, 48, 1, EVP_PKEY_ML_KEM_1024 },
49 #if !defined(OPENSSL_NO_ECX)
50 { "X25519", NULL, 32, 32, 32, 0, EVP_PKEY_ML_KEM_768 },
51 { "X448", NULL, 56, 56, 56, 0, EVP_PKEY_ML_KEM_1024 },
52 #endif
53 };
54
55 typedef struct mlx_kem_gen_ctx_st {
56 OSSL_LIB_CTX *libctx;
57 char *propq;
58 int selection;
59 unsigned int evp_type;
60 } PROV_ML_KEM_GEN_CTX;
61
mlx_kem_key_free(void * vkey)62 static void mlx_kem_key_free(void *vkey)
63 {
64 MLX_KEY *key = vkey;
65
66 if (key == NULL)
67 return;
68 OPENSSL_free(key->propq);
69 EVP_PKEY_free(key->mkey);
70 EVP_PKEY_free(key->xkey);
71 OPENSSL_free(key);
72 }
73
74 /* Takes ownership of propq */
75 static void *
mlx_kem_key_new(unsigned int v,OSSL_LIB_CTX * libctx,char * propq)76 mlx_kem_key_new(unsigned int v, OSSL_LIB_CTX *libctx, char *propq)
77 {
78 MLX_KEY *key = NULL;
79 unsigned int ml_kem_variant;
80
81 if (!ossl_prov_is_running()
82 || v >= OSSL_NELEM(hybrid_vtable)
83 || (key = OPENSSL_malloc(sizeof(*key))) == NULL)
84 goto err;
85
86 ml_kem_variant = hybrid_vtable[v].ml_kem_variant;
87 key->libctx = libctx;
88 key->minfo = ossl_ml_kem_get_vinfo(ml_kem_variant);
89 key->xinfo = &hybrid_vtable[v];
90 key->xkey = key->mkey = NULL;
91 key->state = MLX_HAVE_NOKEYS;
92 key->propq = propq;
93 return key;
94
95 err:
96 OPENSSL_free(propq);
97 return NULL;
98 }
99
mlx_kem_has(const void * vkey,int selection)100 static int mlx_kem_has(const void *vkey, int selection)
101 {
102 const MLX_KEY *key = vkey;
103
104 /* A NULL key MUST fail to have anything */
105 if (!ossl_prov_is_running() || key == NULL)
106 return 0;
107
108 switch (selection & OSSL_KEYMGMT_SELECT_KEYPAIR) {
109 case 0:
110 return 1;
111 case OSSL_KEYMGMT_SELECT_PUBLIC_KEY:
112 return mlx_kem_have_pubkey(key);
113 default:
114 return mlx_kem_have_prvkey(key);
115 }
116 }
117
mlx_kem_match(const void * vkey1,const void * vkey2,int selection)118 static int mlx_kem_match(const void *vkey1, const void *vkey2, int selection)
119 {
120 const MLX_KEY *key1 = vkey1;
121 const MLX_KEY *key2 = vkey2;
122 int have_pub1 = mlx_kem_have_pubkey(key1);
123 int have_pub2 = mlx_kem_have_pubkey(key2);
124
125 if (!ossl_prov_is_running())
126 return 0;
127
128 /* Compare domain parameters */
129 if (key1->xinfo != key2->xinfo)
130 return 0;
131
132 if (!(selection & OSSL_KEYMGMT_SELECT_KEYPAIR))
133 return 1;
134
135 if (have_pub1 ^ have_pub2)
136 return 0;
137
138 /* As in other providers, equal when both have no key material. */
139 if (!have_pub1)
140 return 1;
141
142 return EVP_PKEY_eq(key1->mkey, key2->mkey)
143 && EVP_PKEY_eq(key1->xkey, key2->xkey);
144 }
145
146 typedef struct export_cb_arg_st {
147 const char *algorithm_name;
148 uint8_t *pubenc;
149 uint8_t *prvenc;
150 int pubcount;
151 int prvcount;
152 size_t puboff;
153 size_t prvoff;
154 size_t publen;
155 size_t prvlen;
156 } EXPORT_CB_ARG;
157
158 /* Copy any exported key material into its storage slot */
export_sub_cb(const OSSL_PARAM * params,void * varg)159 static int export_sub_cb(const OSSL_PARAM *params, void *varg)
160 {
161 EXPORT_CB_ARG *sub_arg = varg;
162 const OSSL_PARAM *p = NULL;
163 size_t len;
164
165 /*
166 * The caller will decide whether anything essential is missing, but, if
167 * some key material was returned, it should have the right (parameter)
168 * data type and length.
169 */
170 if (ossl_param_is_empty(params))
171 return 1;
172 if (sub_arg->pubenc != NULL
173 && (p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PUB_KEY)) != NULL) {
174 void *pub = sub_arg->pubenc + sub_arg->puboff;
175
176 if (OSSL_PARAM_get_octet_string(p, &pub, sub_arg->publen, &len) != 1)
177 return 0;
178 if (len != sub_arg->publen) {
179 ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
180 "Unexpected %s public key length %lu != %lu",
181 sub_arg->algorithm_name, (unsigned long)len,
182 sub_arg->publen);
183 return 0;
184 }
185 ++sub_arg->pubcount;
186 }
187 if (sub_arg->prvenc != NULL
188 && (p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PRIV_KEY)) != NULL) {
189 void *prv = sub_arg->prvenc + sub_arg->prvoff;
190
191 if (OSSL_PARAM_get_octet_string(p, &prv, sub_arg->prvlen, &len) != 1)
192 return 0;
193 if (len != sub_arg->prvlen) {
194 ERR_raise_data(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR,
195 "Unexpected %s private key length %lu != %lu",
196 sub_arg->algorithm_name, (unsigned long)len,
197 (unsigned long)sub_arg->publen);
198 return 0;
199 }
200 ++sub_arg->prvcount;
201 }
202 return 1;
203 }
204
205 static int
export_sub(EXPORT_CB_ARG * sub_arg,int selection,MLX_KEY * key)206 export_sub(EXPORT_CB_ARG *sub_arg, int selection, MLX_KEY *key)
207 {
208 int slot;
209
210 /*
211 * The caller is responsible for initialising only the pubenc and prvenc
212 * pointer fields, the rest are set here or in the callback.
213 */
214 sub_arg->pubcount = 0;
215 sub_arg->prvcount = 0;
216
217 for (slot = 0; slot < 2; ++slot) {
218 int ml_kem_slot = key->xinfo->ml_kem_slot;
219 EVP_PKEY *pkey;
220
221 /* Export the parts of each component into its storage slot */
222 if (slot == ml_kem_slot) {
223 pkey = key->mkey;
224 sub_arg->algorithm_name = key->minfo->algorithm_name;
225 sub_arg->puboff = slot * key->xinfo->pubkey_bytes;
226 sub_arg->prvoff = slot * key->xinfo->prvkey_bytes;
227 sub_arg->publen = key->minfo->pubkey_bytes;
228 sub_arg->prvlen = key->minfo->prvkey_bytes;
229 } else {
230 pkey = key->xkey;
231 sub_arg->algorithm_name = key->xinfo->algorithm_name;
232 sub_arg->puboff = (1 - ml_kem_slot) * key->minfo->pubkey_bytes;
233 sub_arg->prvoff = (1 - ml_kem_slot) * key->minfo->prvkey_bytes;
234 sub_arg->publen = key->xinfo->pubkey_bytes;
235 sub_arg->prvlen = key->xinfo->prvkey_bytes;
236 }
237 if (!EVP_PKEY_export(pkey, selection, export_sub_cb, (void *)sub_arg))
238 return 0;
239 }
240 return 1;
241 }
242
mlx_kem_export(void * vkey,int selection,OSSL_CALLBACK * param_cb,void * cbarg)243 static int mlx_kem_export(void *vkey, int selection, OSSL_CALLBACK *param_cb,
244 void *cbarg)
245 {
246 MLX_KEY *key = vkey;
247 OSSL_PARAM_BLD *tmpl = NULL;
248 OSSL_PARAM *params = NULL, *p;
249 size_t publen;
250 size_t prvlen;
251 int ret = 0;
252 EXPORT_CB_ARG sub_arg;
253
254 if (!ossl_prov_is_running() || key == NULL)
255 return 0;
256
257 if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
258 return 0;
259
260 /* Fail when no key material has yet been provided */
261 if (!mlx_kem_have_pubkey(key)) {
262 ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY);
263 return 0;
264 }
265 publen = key->minfo->pubkey_bytes + key->xinfo->pubkey_bytes;
266 prvlen = key->minfo->prvkey_bytes + key->xinfo->prvkey_bytes;
267 memset(&sub_arg, 0, sizeof(sub_arg));
268
269 if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) {
270 sub_arg.pubenc = OPENSSL_malloc(publen);
271 if (sub_arg.pubenc == NULL)
272 goto err;
273 }
274
275 if (mlx_kem_have_prvkey(key)
276 && (selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) {
277 /*
278 * Allocated on the secure heap if configured, this is detected in
279 * ossl_param_build_set_octet_string(), which will then also use the
280 * secure heap.
281 */
282 sub_arg.prvenc = OPENSSL_secure_zalloc(prvlen);
283 if (sub_arg.prvenc == NULL)
284 goto err;
285 }
286
287 tmpl = OSSL_PARAM_BLD_new();
288 if (tmpl == NULL)
289 goto err;
290
291 /* Extract sub-component key material */
292 if (!export_sub(&sub_arg, selection, key))
293 goto err;
294
295 if (sub_arg.pubenc != NULL && sub_arg.pubcount == 2
296 && !ossl_param_build_set_octet_string(
297 tmpl, NULL, OSSL_PKEY_PARAM_PUB_KEY, sub_arg.pubenc, publen))
298 goto err;
299
300 if (sub_arg.prvenc != NULL && sub_arg.prvcount == 2
301 && !ossl_param_build_set_octet_string(
302 tmpl, NULL, OSSL_PKEY_PARAM_PRIV_KEY, sub_arg.prvenc, prvlen))
303 goto err;
304
305 params = OSSL_PARAM_BLD_to_param(tmpl);
306 if (params == NULL)
307 goto err;
308
309 ret = param_cb(params, cbarg);
310 /*
311 * OSSL_PARAM_free() only wipes the secure-heap data block,
312 * so wipe the key material copies held in the params first.
313 */
314 for (p = params; p->key != NULL; p++)
315 OPENSSL_cleanse(p->data, p->data_size);
316 OSSL_PARAM_free(params);
317
318 err:
319 OSSL_PARAM_BLD_free(tmpl);
320 OPENSSL_secure_clear_free(sub_arg.prvenc, prvlen);
321 OPENSSL_clear_free(sub_arg.pubenc, publen);
322 return ret;
323 }
324
mlx_kem_imexport_types(int selection)325 static const OSSL_PARAM *mlx_kem_imexport_types(int selection)
326 {
327 static const OSSL_PARAM key_types[] = {
328 OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_PUB_KEY, NULL, 0),
329 OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_PRIV_KEY, NULL, 0),
330 OSSL_PARAM_END
331 };
332
333 if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0)
334 return key_types;
335 return NULL;
336 }
337
338 static int
load_slot(OSSL_LIB_CTX * libctx,const char * propq,const char * pname,int selection,MLX_KEY * key,int slot,const uint8_t * in,int mbytes,int xbytes)339 load_slot(OSSL_LIB_CTX *libctx, const char *propq, const char *pname,
340 int selection, MLX_KEY *key, int slot, const uint8_t *in,
341 int mbytes, int xbytes)
342 {
343 EVP_PKEY_CTX *ctx;
344 EVP_PKEY **ppkey;
345 OSSL_PARAM parr[] = { OSSL_PARAM_END, OSSL_PARAM_END, OSSL_PARAM_END };
346 const char *alg;
347 char *group = NULL;
348 size_t off, len;
349 void *val;
350 int ml_kem_slot = key->xinfo->ml_kem_slot;
351 int ret = 0;
352
353 if (slot == ml_kem_slot) {
354 alg = key->minfo->algorithm_name;
355 ppkey = &key->mkey;
356 off = slot * xbytes;
357 len = mbytes;
358 } else {
359 alg = key->xinfo->algorithm_name;
360 group = (char *)key->xinfo->group_name;
361 ppkey = &key->xkey;
362 off = (1 - ml_kem_slot) * mbytes;
363 len = xbytes;
364 }
365 val = (void *)(in + off);
366
367 if ((ctx = EVP_PKEY_CTX_new_from_name(libctx, alg, propq)) == NULL
368 || EVP_PKEY_fromdata_init(ctx) <= 0)
369 goto err;
370 parr[0] = OSSL_PARAM_construct_octet_string(pname, val, len);
371 if (group != NULL)
372 parr[1] = OSSL_PARAM_construct_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME,
373 group, 0);
374 if (EVP_PKEY_fromdata(ctx, ppkey, selection, parr) > 0)
375 ret = 1;
376
377 err:
378 EVP_PKEY_CTX_free(ctx);
379 return ret;
380 }
381
382 static int
load_keys(MLX_KEY * key,const uint8_t * pubenc,size_t publen,const uint8_t * prvenc,size_t prvlen)383 load_keys(MLX_KEY *key,
384 const uint8_t *pubenc, size_t publen,
385 const uint8_t *prvenc, size_t prvlen)
386 {
387 int slot;
388
389 for (slot = 0; slot < 2; ++slot) {
390 if (prvlen) {
391 /* Ignore public keys when private provided */
392 if (!load_slot(key->libctx, key->propq, OSSL_PKEY_PARAM_PRIV_KEY,
393 minimal_selection, key, slot, prvenc,
394 key->minfo->prvkey_bytes, key->xinfo->prvkey_bytes))
395 goto err;
396 } else if (publen) {
397 /* Absent private key data, import public keys */
398 if (!load_slot(key->libctx, key->propq, OSSL_PKEY_PARAM_PUB_KEY,
399 minimal_selection, key, slot, pubenc,
400 key->minfo->pubkey_bytes, key->xinfo->pubkey_bytes))
401 goto err;
402 }
403 }
404 key->state = prvlen ? MLX_HAVE_PRVKEY : MLX_HAVE_PUBKEY;
405 return 1;
406
407 err:
408 EVP_PKEY_free(key->mkey);
409 EVP_PKEY_free(key->xkey);
410 key->xkey = key->mkey = NULL;
411 key->state = MLX_HAVE_NOKEYS;
412 return 0;
413 }
414
mlx_kem_key_fromdata(MLX_KEY * key,const OSSL_PARAM params[],int include_private)415 static int mlx_kem_key_fromdata(MLX_KEY *key,
416 const OSSL_PARAM params[],
417 int include_private)
418 {
419 const OSSL_PARAM *param_prv_key = NULL, *param_pub_key;
420 const void *pubenc = NULL, *prvenc = NULL;
421 size_t pubkey_bytes, prvkey_bytes;
422 size_t publen = 0, prvlen = 0;
423
424 /* Invalid attempt to mutate a key, what is the right error to report? */
425 if (key == NULL || mlx_kem_have_pubkey(key))
426 return 0;
427 pubkey_bytes = key->minfo->pubkey_bytes + key->xinfo->pubkey_bytes;
428 prvkey_bytes = key->minfo->prvkey_bytes + key->xinfo->prvkey_bytes;
429
430 /* What does the caller want to set? */
431 param_pub_key = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PUB_KEY);
432 if (param_pub_key != NULL && OSSL_PARAM_get_octet_string_ptr(param_pub_key, &pubenc, &publen) != 1)
433 return 0;
434 if (include_private)
435 param_prv_key = OSSL_PARAM_locate_const(params,
436 OSSL_PKEY_PARAM_PRIV_KEY);
437 if (param_prv_key != NULL && OSSL_PARAM_get_octet_string_ptr(param_prv_key, &prvenc, &prvlen) != 1)
438 return 0;
439
440 /* The caller MUST specify at least one of the public or private keys. */
441 if (publen == 0 && prvlen == 0) {
442 ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY);
443 return 0;
444 }
445
446 /*
447 * When a pubkey is provided, its length MUST be correct, if a private key
448 * is also provided, the public key will be otherwise ignored. We could
449 * look for a matching encoded block, but unclear this is useful.
450 */
451 if (publen != 0 && publen != pubkey_bytes) {
452 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
453 return 0;
454 }
455 if (prvlen != 0 && prvlen != prvkey_bytes) {
456 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
457 return 0;
458 }
459
460 return load_keys(key, pubenc, publen, prvenc, prvlen);
461 }
462
mlx_kem_import(void * vkey,int selection,const OSSL_PARAM params[])463 static int mlx_kem_import(void *vkey, int selection, const OSSL_PARAM params[])
464 {
465 MLX_KEY *key = vkey;
466 int include_private;
467
468 if (!ossl_prov_is_running() || key == NULL)
469 return 0;
470
471 if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
472 return 0;
473
474 include_private = selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY ? 1 : 0;
475 return mlx_kem_key_fromdata(key, params, include_private);
476 }
477
mlx_kem_gettable_params(void * provctx)478 static const OSSL_PARAM *mlx_kem_gettable_params(void *provctx)
479 {
480 static const OSSL_PARAM arr[] = {
481 OSSL_PARAM_int(OSSL_PKEY_PARAM_BITS, NULL),
482 OSSL_PARAM_int(OSSL_PKEY_PARAM_SECURITY_BITS, NULL),
483 OSSL_PARAM_int(OSSL_PKEY_PARAM_MAX_SIZE, NULL),
484 OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY, NULL, 0),
485 OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_PRIV_KEY, NULL, 0),
486 OSSL_PARAM_END
487 };
488
489 return arr;
490 }
491
492 /*
493 * It is assumed the key is guaranteed non-NULL here, and is from this provider
494 */
mlx_kem_get_params(void * vkey,OSSL_PARAM params[])495 static int mlx_kem_get_params(void *vkey, OSSL_PARAM params[])
496 {
497 MLX_KEY *key = vkey;
498 OSSL_PARAM *p, *pub, *prv = NULL;
499 EXPORT_CB_ARG sub_arg;
500 int selection;
501 size_t publen = key->minfo->pubkey_bytes + key->xinfo->pubkey_bytes;
502 size_t prvlen = key->minfo->prvkey_bytes + key->xinfo->prvkey_bytes;
503
504 /* The reported "bit" count is those of the ML-KEM key */
505 p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_BITS);
506 if (p != NULL)
507 if (!OSSL_PARAM_set_int(p, key->minfo->bits))
508 return 0;
509
510 /* The reported security bits are those of the ML-KEM key */
511 p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_SECURITY_BITS);
512 if (p != NULL)
513 if (!OSSL_PARAM_set_int(p, key->minfo->secbits))
514 return 0;
515
516 /* The ciphertext sizes are additive */
517 p = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_MAX_SIZE);
518 if (p != NULL)
519 if (!OSSL_PARAM_set_int(p, key->minfo->ctext_bytes + key->xinfo->pubkey_bytes))
520 return 0;
521
522 if (!mlx_kem_have_pubkey(key))
523 return 1;
524
525 memset(&sub_arg, 0, sizeof(sub_arg));
526 pub = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY);
527 if (pub != NULL) {
528 if (pub->data_type != OSSL_PARAM_OCTET_STRING)
529 return 0;
530 pub->return_size = publen;
531 if (pub->data == NULL) {
532 pub = NULL;
533 } else if (pub->data_size < publen) {
534 ERR_raise_data(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL,
535 "public key output buffer too short: %lu < %lu",
536 (unsigned long)pub->data_size,
537 (unsigned long)publen);
538 return 0;
539 } else {
540 sub_arg.pubenc = pub->data;
541 }
542 }
543 if (mlx_kem_have_prvkey(key)) {
544 prv = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_PRIV_KEY);
545 if (prv != NULL) {
546 if (prv->data_type != OSSL_PARAM_OCTET_STRING)
547 return 0;
548 prv->return_size = prvlen;
549 if (prv->data == NULL) {
550 prv = NULL;
551 } else if (prv->data_size < prvlen) {
552 ERR_raise_data(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL,
553 "private key output buffer too short: %lu < %lu",
554 (unsigned long)prv->data_size,
555 (unsigned long)prvlen);
556 return 0;
557 } else {
558 sub_arg.prvenc = prv->data;
559 }
560 }
561 }
562 if (pub == NULL && prv == NULL)
563 return 1;
564
565 selection = prv == NULL ? 0 : OSSL_KEYMGMT_SELECT_PRIVATE_KEY;
566 selection |= pub == NULL ? 0 : OSSL_KEYMGMT_SELECT_PUBLIC_KEY;
567 if (key->xinfo->group_name != NULL)
568 selection |= OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS;
569
570 /* Extract sub-component key material */
571 if (!export_sub(&sub_arg, selection, key)
572 || (pub != NULL && sub_arg.pubcount != 2)
573 || (prv != NULL && sub_arg.prvcount != 2)) {
574 /* Erase any partial key material on failure */
575 if (sub_arg.pubenc != NULL)
576 OPENSSL_cleanse(sub_arg.pubenc,
577 key->minfo->pubkey_bytes + key->xinfo->pubkey_bytes);
578 if (sub_arg.prvenc != NULL)
579 OPENSSL_cleanse(sub_arg.prvenc,
580 key->minfo->prvkey_bytes + key->xinfo->prvkey_bytes);
581 return 0;
582 }
583
584 return 1;
585 }
586
mlx_kem_settable_params(void * provctx)587 static const OSSL_PARAM *mlx_kem_settable_params(void *provctx)
588 {
589 static const OSSL_PARAM arr[] = {
590 OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY, NULL, 0),
591 OSSL_PARAM_END
592 };
593
594 return arr;
595 }
596
mlx_kem_set_params(void * vkey,const OSSL_PARAM params[])597 static int mlx_kem_set_params(void *vkey, const OSSL_PARAM params[])
598 {
599 MLX_KEY *key = vkey;
600 const OSSL_PARAM *p;
601 const void *pubenc = NULL;
602 size_t publen = 0;
603
604 if (ossl_param_is_empty(params))
605 return 1;
606
607 /* Only one settable parameter is supported */
608 p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY);
609 if (p == NULL)
610 return 1;
611
612 /* Key mutation is reportedly generally not allowed */
613 if (mlx_kem_have_pubkey(key)) {
614 ERR_raise_data(ERR_LIB_PROV,
615 PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE,
616 "keys cannot be mutated");
617 return 0;
618 }
619 /* An unlikely failure mode is the parameter having some unexpected type */
620 if (!OSSL_PARAM_get_octet_string_ptr(p, &pubenc, &publen))
621 return 0;
622
623 p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PROPERTIES);
624 if (p != NULL) {
625 OPENSSL_free(key->propq);
626 key->propq = NULL;
627 if (!OSSL_PARAM_get_utf8_string(p, &key->propq, 0))
628 return 0;
629 }
630
631 if (publen != key->minfo->pubkey_bytes + key->xinfo->pubkey_bytes) {
632 ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY);
633 return 0;
634 }
635
636 return load_keys(key, pubenc, publen, NULL, 0);
637 }
638
mlx_kem_gen_set_params(void * vgctx,const OSSL_PARAM params[])639 static int mlx_kem_gen_set_params(void *vgctx, const OSSL_PARAM params[])
640 {
641 PROV_ML_KEM_GEN_CTX *gctx = vgctx;
642 const OSSL_PARAM *p;
643
644 if (gctx == NULL)
645 return 0;
646 if (ossl_param_is_empty(params))
647 return 1;
648
649 p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_PROPERTIES);
650 if (p != NULL) {
651 if (p->data_type != OSSL_PARAM_UTF8_STRING)
652 return 0;
653 OPENSSL_free(gctx->propq);
654 if ((gctx->propq = OPENSSL_strdup(p->data)) == NULL)
655 return 0;
656 }
657 return 1;
658 }
659
mlx_kem_gen_init(int evp_type,OSSL_LIB_CTX * libctx,int selection,const OSSL_PARAM params[])660 static void *mlx_kem_gen_init(int evp_type, OSSL_LIB_CTX *libctx,
661 int selection, const OSSL_PARAM params[])
662 {
663 PROV_ML_KEM_GEN_CTX *gctx = NULL;
664
665 /*
666 * We can only generate private keys, check that the selection is
667 * appropriate.
668 */
669 if (!ossl_prov_is_running()
670 || (selection & minimal_selection) == 0
671 || (gctx = OPENSSL_zalloc(sizeof(*gctx))) == NULL)
672 return NULL;
673
674 gctx->evp_type = evp_type;
675 gctx->libctx = libctx;
676 gctx->selection = selection;
677 if (mlx_kem_gen_set_params(gctx, params))
678 return gctx;
679
680 mlx_kem_gen_cleanup(gctx);
681 return NULL;
682 }
683
mlx_kem_gen_settable_params(ossl_unused void * vgctx,ossl_unused void * provctx)684 static const OSSL_PARAM *mlx_kem_gen_settable_params(ossl_unused void *vgctx,
685 ossl_unused void *provctx)
686 {
687 static OSSL_PARAM settable[] = {
688 OSSL_PARAM_octet_string(OSSL_PKEY_PARAM_PROPERTIES, NULL, 0),
689 OSSL_PARAM_END
690 };
691
692 return settable;
693 }
694
mlx_kem_gen(void * vgctx,OSSL_CALLBACK * osslcb,void * cbarg)695 static void *mlx_kem_gen(void *vgctx, OSSL_CALLBACK *osslcb, void *cbarg)
696 {
697 PROV_ML_KEM_GEN_CTX *gctx = vgctx;
698 MLX_KEY *key;
699 char *propq;
700
701 if (gctx == NULL
702 || (gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == OSSL_KEYMGMT_SELECT_PUBLIC_KEY)
703 return NULL;
704
705 /* Lose ownership of propq */
706 propq = gctx->propq;
707 gctx->propq = NULL;
708 if ((key = mlx_kem_key_new(gctx->evp_type, gctx->libctx, propq)) == NULL)
709 return NULL;
710
711 if ((gctx->selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0)
712 return key;
713
714 /* For now, using the same "propq" for all components */
715 key->mkey = EVP_PKEY_Q_keygen(key->libctx, key->propq,
716 key->minfo->algorithm_name);
717 key->xkey = EVP_PKEY_Q_keygen(key->libctx, key->propq,
718 key->xinfo->algorithm_name,
719 key->xinfo->group_name);
720 if (key->mkey != NULL && key->xkey != NULL) {
721 key->state = MLX_HAVE_PRVKEY;
722 return key;
723 }
724
725 mlx_kem_key_free(key);
726 return NULL;
727 }
728
mlx_kem_gen_cleanup(void * vgctx)729 static void mlx_kem_gen_cleanup(void *vgctx)
730 {
731 PROV_ML_KEM_GEN_CTX *gctx = vgctx;
732
733 if (gctx == NULL)
734 return;
735 OPENSSL_free(gctx->propq);
736 OPENSSL_free(gctx);
737 }
738
mlx_kem_dup(const void * vkey,int selection)739 static void *mlx_kem_dup(const void *vkey, int selection)
740 {
741 const MLX_KEY *key = vkey;
742 MLX_KEY *ret;
743
744 if (!ossl_prov_is_running()
745 || (ret = OPENSSL_memdup(key, sizeof(*ret))) == NULL)
746 return NULL;
747
748 ret->mkey = ret->xkey = NULL;
749
750 if (key->propq != NULL
751 && (ret->propq = OPENSSL_strdup(key->propq)) == NULL) {
752 OPENSSL_free(ret);
753 return NULL;
754 }
755
756 /* Absent key material, nothing left to do */
757 if (key->mkey == NULL) {
758 if (key->xkey == NULL)
759 return ret;
760 /* Fail if the source key is an inconsistent state */
761 OPENSSL_free(ret->propq);
762 OPENSSL_free(ret);
763 return NULL;
764 }
765
766 switch (selection & OSSL_KEYMGMT_SELECT_KEYPAIR) {
767 case 0:
768 ret->state = MLX_HAVE_NOKEYS;
769 return ret;
770 case OSSL_KEYMGMT_SELECT_KEYPAIR:
771 ret->mkey = EVP_PKEY_dup(key->mkey);
772 ret->xkey = EVP_PKEY_dup(key->xkey);
773 if (ret->xkey != NULL && ret->mkey != NULL)
774 return ret;
775 break;
776 default:
777 ERR_raise_data(ERR_LIB_PROV, PROV_R_UNSUPPORTED_SELECTION,
778 "duplication of partial key material not supported");
779 break;
780 }
781
782 mlx_kem_key_free(ret);
783 return NULL;
784 }
785
786 #define DECLARE_DISPATCH(name, variant) \
787 static OSSL_FUNC_keymgmt_new_fn mlx_##name##_kem_new; \
788 static void *mlx_##name##_kem_new(void *provctx) \
789 { \
790 OSSL_LIB_CTX *libctx; \
791 \
792 libctx = provctx == NULL ? NULL : PROV_LIBCTX_OF(provctx); \
793 return mlx_kem_key_new(variant, libctx, NULL); \
794 } \
795 static OSSL_FUNC_keymgmt_gen_init_fn mlx_##name##_kem_gen_init; \
796 static void *mlx_##name##_kem_gen_init(void *provctx, int selection, \
797 const OSSL_PARAM params[]) \
798 { \
799 OSSL_LIB_CTX *libctx; \
800 \
801 libctx = provctx == NULL ? NULL : PROV_LIBCTX_OF(provctx); \
802 return mlx_kem_gen_init(variant, libctx, selection, params); \
803 } \
804 const OSSL_DISPATCH ossl_mlx_##name##_kem_kmgmt_functions[] = { \
805 { OSSL_FUNC_KEYMGMT_NEW, (OSSL_FUNC)mlx_##name##_kem_new }, \
806 { OSSL_FUNC_KEYMGMT_FREE, (OSSL_FUNC)mlx_kem_key_free }, \
807 { OSSL_FUNC_KEYMGMT_GET_PARAMS, (OSSL_FUNC)mlx_kem_get_params }, \
808 { OSSL_FUNC_KEYMGMT_GETTABLE_PARAMS, (OSSL_FUNC)mlx_kem_gettable_params }, \
809 { OSSL_FUNC_KEYMGMT_SET_PARAMS, (OSSL_FUNC)mlx_kem_set_params }, \
810 { OSSL_FUNC_KEYMGMT_SETTABLE_PARAMS, (OSSL_FUNC)mlx_kem_settable_params }, \
811 { OSSL_FUNC_KEYMGMT_HAS, (OSSL_FUNC)mlx_kem_has }, \
812 { OSSL_FUNC_KEYMGMT_MATCH, (OSSL_FUNC)mlx_kem_match }, \
813 { OSSL_FUNC_KEYMGMT_GEN_INIT, (OSSL_FUNC)mlx_##name##_kem_gen_init }, \
814 { OSSL_FUNC_KEYMGMT_GEN_SET_PARAMS, (OSSL_FUNC)mlx_kem_gen_set_params }, \
815 { OSSL_FUNC_KEYMGMT_GEN_SETTABLE_PARAMS, (OSSL_FUNC)mlx_kem_gen_settable_params }, \
816 { OSSL_FUNC_KEYMGMT_GEN, (OSSL_FUNC)mlx_kem_gen }, \
817 { OSSL_FUNC_KEYMGMT_GEN_CLEANUP, (OSSL_FUNC)mlx_kem_gen_cleanup }, \
818 { OSSL_FUNC_KEYMGMT_DUP, (OSSL_FUNC)mlx_kem_dup }, \
819 { OSSL_FUNC_KEYMGMT_IMPORT, (OSSL_FUNC)mlx_kem_import }, \
820 { OSSL_FUNC_KEYMGMT_IMPORT_TYPES, (OSSL_FUNC)mlx_kem_imexport_types }, \
821 { OSSL_FUNC_KEYMGMT_EXPORT, (OSSL_FUNC)mlx_kem_export }, \
822 { OSSL_FUNC_KEYMGMT_EXPORT_TYPES, (OSSL_FUNC)mlx_kem_imexport_types }, \
823 OSSL_DISPATCH_END \
824 }
825 /* See |hybrid_vtable| above */
826 DECLARE_DISPATCH(p256, 0);
827 DECLARE_DISPATCH(p384, 1);
828 #if !defined(OPENSSL_NO_ECX)
829 DECLARE_DISPATCH(x25519, 2);
830 DECLARE_DISPATCH(x448, 3);
831 #endif
832