1 /*
2 * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /*
11 * EC_METHOD low level APIs are deprecated for public use, but still ok for
12 * internal use.
13 */
14 #include "internal/deprecated.h"
15
16 #include <stdlib.h>
17 #include <string.h>
18 #include <openssl/err.h>
19 #include <openssl/rand.h>
20 #include "ec_local.h"
21 #include "s390x_arch.h"
22
23 /* Size of parameter blocks */
24 #define S390X_SIZE_PARAM 4096
25
26 /* Size of fields in parameter blocks */
27 #define S390X_SIZE_P256 32
28 #define S390X_SIZE_P384 48
29 #define S390X_SIZE_P521 80
30
31 /* Offsets of fields in PCC parameter blocks */
32 #define S390X_OFF_RES_X(n) (0 * n)
33 #define S390X_OFF_RES_Y(n) (1 * n)
34 #define S390X_OFF_SRC_X(n) (2 * n)
35 #define S390X_OFF_SRC_Y(n) (3 * n)
36 #define S390X_OFF_SCALAR(n) (4 * n)
37
38 /* Offsets of fields in KDSA parameter blocks */
39 #define S390X_OFF_R(n) (0 * n)
40 #define S390X_OFF_S(n) (1 * n)
41 #define S390X_OFF_H(n) (2 * n)
42 #define S390X_OFF_K(n) (3 * n)
43 #define S390X_OFF_X(n) (3 * n)
44 #define S390X_OFF_RN(n) (4 * n)
45 #define S390X_OFF_Y(n) (4 * n)
46
47 #define S390X_PAD(n) (n == 80 ? 14 : 0)
48
ec_GFp_s390x_nistp_mul(const EC_GROUP * group,EC_POINT * r,const BIGNUM * scalar,size_t num,const EC_POINT * points[],const BIGNUM * scalars[],BN_CTX * ctx,unsigned int fc,int len)49 static int ec_GFp_s390x_nistp_mul(const EC_GROUP *group, EC_POINT *r,
50 const BIGNUM *scalar,
51 size_t num, const EC_POINT *points[],
52 const BIGNUM *scalars[],
53 BN_CTX *ctx, unsigned int fc, int len)
54 {
55 unsigned char param[S390X_SIZE_PARAM];
56 BIGNUM *x, *y;
57 const EC_POINT *point_ptr = NULL;
58 const BIGNUM *scalar_ptr = NULL;
59 BN_CTX *new_ctx = NULL;
60 int rc = -1;
61
62 if (ctx == NULL) {
63 ctx = new_ctx = BN_CTX_new_ex(group->libctx);
64 if (ctx == NULL)
65 return 0;
66 }
67
68 BN_CTX_start(ctx);
69
70 x = BN_CTX_get(ctx);
71 y = BN_CTX_get(ctx);
72 if (x == NULL || y == NULL) {
73 rc = 0;
74 goto ret;
75 }
76
77 /*
78 * Use PCC for EC keygen and ECDH key derivation:
79 * scalar * generator and scalar * peer public key,
80 * scalar in [0,order).
81 */
82 if ((scalar != NULL && num == 0 && BN_is_negative(scalar) == 0)
83 || (scalar == NULL && num == 1 && BN_is_negative(scalars[0]) == 0)) {
84
85 if (num == 0) {
86 point_ptr = EC_GROUP_get0_generator(group);
87 scalar_ptr = scalar;
88 } else {
89 point_ptr = points[0];
90 scalar_ptr = scalars[0];
91 }
92
93 if (EC_POINT_is_at_infinity(group, point_ptr) == 1
94 || BN_is_zero(scalar_ptr)) {
95 rc = EC_POINT_set_to_infinity(group, r);
96 goto ret;
97 }
98
99 memset(¶m, 0, sizeof(param));
100
101 if (group->meth->point_get_affine_coordinates(group, point_ptr,
102 x, y, ctx)
103 != 1
104 || BN_bn2binpad(x, param + S390X_OFF_SRC_X(len), len) == -1
105 || BN_bn2binpad(y, param + S390X_OFF_SRC_Y(len), len) == -1
106 || BN_bn2binpad(scalar_ptr,
107 param + S390X_OFF_SCALAR(len), len)
108 == -1
109 || s390x_pcc(fc, param) != 0
110 || BN_bin2bn(param + S390X_OFF_RES_X(len), len, x) == NULL
111 || BN_bin2bn(param + S390X_OFF_RES_Y(len), len, y) == NULL
112 || group->meth->point_set_affine_coordinates(group, r,
113 x, y, ctx)
114 != 1)
115 goto ret;
116
117 rc = 1;
118 }
119
120 ret:
121 /* Otherwise use default. */
122 if (rc == -1)
123 rc = ossl_ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
124 OPENSSL_cleanse(param, sizeof(param));
125 BN_CTX_end(ctx);
126 BN_CTX_free(new_ctx);
127 return rc;
128 }
129
ecdsa_s390x_nistp_sign_sig(const unsigned char * dgst,int dgstlen,const BIGNUM * kinv,const BIGNUM * r,EC_KEY * eckey,unsigned int fc,int len)130 static ECDSA_SIG *ecdsa_s390x_nistp_sign_sig(const unsigned char *dgst,
131 int dgstlen,
132 const BIGNUM *kinv,
133 const BIGNUM *r,
134 EC_KEY *eckey,
135 unsigned int fc, int len)
136 {
137 unsigned char param[S390X_SIZE_PARAM];
138 int ok = 0;
139 BIGNUM *k;
140 ECDSA_SIG *sig;
141 const EC_GROUP *group;
142 const BIGNUM *privkey;
143 int off;
144
145 group = EC_KEY_get0_group(eckey);
146 privkey = EC_KEY_get0_private_key(eckey);
147 if (group == NULL || privkey == NULL) {
148 ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS);
149 return NULL;
150 }
151
152 if (!EC_KEY_can_sign(eckey)) {
153 ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
154 return NULL;
155 }
156
157 k = BN_secure_new();
158 sig = ECDSA_SIG_new();
159 if (k == NULL || sig == NULL) {
160 ERR_raise(ERR_LIB_EC, ERR_R_ECDSA_LIB);
161 goto ret;
162 }
163
164 sig->r = BN_new();
165 sig->s = BN_new();
166 if (sig->r == NULL || sig->s == NULL) {
167 ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
168 goto ret;
169 }
170
171 memset(param, 0, sizeof(param));
172 off = len - (dgstlen > len ? len : dgstlen);
173 memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
174
175 if (BN_bn2binpad(privkey, param + S390X_OFF_K(len), len) == -1) {
176 ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
177 goto ret;
178 }
179
180 if (r == NULL || kinv == NULL) {
181 if (len < 0) {
182 ERR_raise(ERR_LIB_EC, EC_R_INVALID_LENGTH);
183 goto ret;
184 }
185 /*
186 * Generate random k and copy to param block. RAND_priv_bytes_ex
187 * is used instead of BN_priv_rand_range or BN_generate_dsa_nonce
188 * because kdsa instruction constructs an in-range, invertible nonce
189 * internally implementing counter-measures for RNG weakness.
190 */
191 if (RAND_priv_bytes_ex(eckey->libctx, param + S390X_OFF_RN(len),
192 (size_t)len, 0)
193 != 1) {
194 ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED);
195 goto ret;
196 }
197 } else {
198 /* Reconstruct k = (k^-1)^-1. */
199 if (ossl_ec_group_do_inverse_ord(group, k, kinv, NULL) == 0
200 || BN_bn2binpad(k, param + S390X_OFF_RN(len), len) == -1) {
201 ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
202 goto ret;
203 }
204 /* Turns KDSA internal nonce-generation off. */
205 fc |= S390X_KDSA_D;
206 }
207
208 if (s390x_kdsa(fc, param, NULL, 0) != 0) {
209 ERR_raise(ERR_LIB_EC, ERR_R_ECDSA_LIB);
210 goto ret;
211 }
212
213 if (BN_bin2bn(param + S390X_OFF_R(len), len, sig->r) == NULL
214 || BN_bin2bn(param + S390X_OFF_S(len), len, sig->s) == NULL) {
215 ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
216 goto ret;
217 }
218
219 ok = 1;
220 ret:
221 OPENSSL_cleanse(param, sizeof(param));
222 if (ok != 1) {
223 ECDSA_SIG_free(sig);
224 sig = NULL;
225 }
226 BN_clear_free(k);
227 return sig;
228 }
229
ecdsa_s390x_nistp_verify_sig(const unsigned char * dgst,int dgstlen,const ECDSA_SIG * sig,EC_KEY * eckey,unsigned int fc,int len)230 static int ecdsa_s390x_nistp_verify_sig(const unsigned char *dgst, int dgstlen,
231 const ECDSA_SIG *sig, EC_KEY *eckey,
232 unsigned int fc, int len)
233 {
234 unsigned char param[S390X_SIZE_PARAM];
235 int rc = -1;
236 BN_CTX *ctx;
237 BIGNUM *x, *y;
238 const EC_GROUP *group;
239 const EC_POINT *pubkey;
240 int off;
241
242 group = EC_KEY_get0_group(eckey);
243 pubkey = EC_KEY_get0_public_key(eckey);
244 if (eckey == NULL || group == NULL || pubkey == NULL || sig == NULL) {
245 ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS);
246 return -1;
247 }
248
249 if (!EC_KEY_can_sign(eckey)) {
250 ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
251 return -1;
252 }
253
254 ctx = BN_CTX_new_ex(group->libctx);
255 if (ctx == NULL) {
256 ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
257 return -1;
258 }
259
260 BN_CTX_start(ctx);
261
262 x = BN_CTX_get(ctx);
263 y = BN_CTX_get(ctx);
264 if (x == NULL || y == NULL) {
265 ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
266 goto ret;
267 }
268
269 memset(param, 0, sizeof(param));
270 off = len - (dgstlen > len ? len : dgstlen);
271 memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
272
273 /* Check for invalid malformed signatures (r/s negative or too large) */
274 if (BN_is_negative(sig->r) || BN_is_negative(sig->s)
275 || BN_bn2binpad(sig->r, param + S390X_OFF_R(len) + S390X_PAD(len),
276 len - S390X_PAD(len))
277 == -1
278 || BN_bn2binpad(sig->s, param + S390X_OFF_S(len) + S390X_PAD(len),
279 len - S390X_PAD(len))
280 == -1) {
281 ERR_raise(ERR_LIB_EC, EC_R_BAD_SIGNATURE);
282 rc = 0;
283 goto ret;
284 }
285
286 if (group->meth->point_get_affine_coordinates(group, pubkey,
287 x, y, ctx)
288 != 1
289 || BN_bn2binpad(x, param + S390X_OFF_X(len), len) == -1
290 || BN_bn2binpad(y, param + S390X_OFF_Y(len), len) == -1) {
291 ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
292 goto ret;
293 }
294
295 rc = s390x_kdsa(fc, param, NULL, 0);
296 if (rc == 2)
297 ERR_raise(ERR_LIB_EC, EC_R_BAD_SIGNATURE);
298 rc = rc == 0 ? 1 : 0;
299 ret:
300 BN_CTX_end(ctx);
301 BN_CTX_free(ctx);
302 return rc;
303 }
304
305 #define EC_GFP_S390X_NISTP_METHOD(bits) \
306 \
307 static int ec_GFp_s390x_nistp##bits##_mul(const EC_GROUP *group, \
308 EC_POINT *r, \
309 const BIGNUM *scalar, \
310 size_t num, \
311 const EC_POINT *points[], \
312 const BIGNUM *scalars[], \
313 BN_CTX *ctx) \
314 { \
315 return ec_GFp_s390x_nistp_mul(group, r, scalar, num, points, \
316 scalars, ctx, \
317 S390X_SCALAR_MULTIPLY_P##bits, \
318 S390X_SIZE_P##bits); \
319 } \
320 \
321 static ECDSA_SIG *ecdsa_s390x_nistp##bits##_sign_sig(const unsigned char *dgst, \
322 int dgstlen, \
323 const BIGNUM *kinv, \
324 const BIGNUM *r, \
325 EC_KEY *eckey) \
326 { \
327 return ecdsa_s390x_nistp_sign_sig(dgst, dgstlen, kinv, r, eckey, \
328 S390X_ECDSA_SIGN_P##bits, \
329 S390X_SIZE_P##bits); \
330 } \
331 \
332 static int ecdsa_s390x_nistp##bits##_verify_sig(const unsigned char *dgst, \
333 int dgstlen, \
334 const ECDSA_SIG *sig, \
335 EC_KEY *eckey) \
336 { \
337 return ecdsa_s390x_nistp_verify_sig(dgst, dgstlen, sig, eckey, \
338 S390X_ECDSA_VERIFY_P##bits, \
339 S390X_SIZE_P##bits); \
340 } \
341 \
342 const EC_METHOD *EC_GFp_s390x_nistp##bits##_method(void) \
343 { \
344 static const EC_METHOD EC_GFp_s390x_nistp##bits##_meth = { \
345 EC_FLAGS_DEFAULT_OCT, \
346 NID_X9_62_prime_field, \
347 ossl_ec_GFp_simple_group_init, \
348 ossl_ec_GFp_simple_group_finish, \
349 ossl_ec_GFp_simple_group_clear_finish, \
350 ossl_ec_GFp_simple_group_copy, \
351 ossl_ec_GFp_simple_group_set_curve, \
352 ossl_ec_GFp_simple_group_get_curve, \
353 ossl_ec_GFp_simple_group_get_degree, \
354 ossl_ec_group_simple_order_bits, \
355 ossl_ec_GFp_simple_group_check_discriminant, \
356 ossl_ec_GFp_simple_point_init, \
357 ossl_ec_GFp_simple_point_finish, \
358 ossl_ec_GFp_simple_point_clear_finish, \
359 ossl_ec_GFp_simple_point_copy, \
360 ossl_ec_GFp_simple_point_set_to_infinity, \
361 ossl_ec_GFp_simple_point_set_affine_coordinates, \
362 ossl_ec_GFp_simple_point_get_affine_coordinates, \
363 NULL, /* point_set_compressed_coordinates */ \
364 NULL, /* point2oct */ \
365 NULL, /* oct2point */ \
366 ossl_ec_GFp_simple_add, \
367 ossl_ec_GFp_simple_dbl, \
368 ossl_ec_GFp_simple_invert, \
369 ossl_ec_GFp_simple_is_at_infinity, \
370 ossl_ec_GFp_simple_is_on_curve, \
371 ossl_ec_GFp_simple_cmp, \
372 ossl_ec_GFp_simple_make_affine, \
373 ossl_ec_GFp_simple_points_make_affine, \
374 ec_GFp_s390x_nistp##bits##_mul, \
375 NULL, /* precompute_mult */ \
376 NULL, /* have_precompute_mult */ \
377 ossl_ec_GFp_simple_field_mul, \
378 ossl_ec_GFp_simple_field_sqr, \
379 NULL, /* field_div */ \
380 ossl_ec_GFp_simple_field_inv, \
381 NULL, /* field_encode */ \
382 NULL, /* field_decode */ \
383 NULL, /* field_set_to_one */ \
384 ossl_ec_key_simple_priv2oct, \
385 ossl_ec_key_simple_oct2priv, \
386 NULL, /* set_private */ \
387 ossl_ec_key_simple_generate_key, \
388 ossl_ec_key_simple_check_key, \
389 ossl_ec_key_simple_generate_public_key, \
390 NULL, /* keycopy */ \
391 NULL, /* keyfinish */ \
392 ossl_ecdh_simple_compute_key, \
393 ossl_ecdsa_simple_sign_setup, \
394 ecdsa_s390x_nistp##bits##_sign_sig, \
395 ecdsa_s390x_nistp##bits##_verify_sig, \
396 NULL, /* field_inverse_mod_ord */ \
397 ossl_ec_GFp_simple_blind_coordinates, \
398 ossl_ec_GFp_simple_ladder_pre, \
399 ossl_ec_GFp_simple_ladder_step, \
400 ossl_ec_GFp_simple_ladder_post \
401 }; \
402 static const EC_METHOD *ret; \
403 \
404 if ((OPENSSL_s390xcap_P.pcc[1] \
405 & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P##bits)) \
406 && (OPENSSL_s390xcap_P.kdsa[0] \
407 & S390X_CAPBIT(S390X_ECDSA_VERIFY_P##bits)) \
408 && (OPENSSL_s390xcap_P.kdsa[0] \
409 & S390X_CAPBIT(S390X_ECDSA_SIGN_P##bits))) \
410 ret = &EC_GFp_s390x_nistp##bits##_meth; \
411 else \
412 ret = EC_GFp_mont_method(); \
413 \
414 return ret; \
415 }
416
417 EC_GFP_S390X_NISTP_METHOD(256)
418 EC_GFP_S390X_NISTP_METHOD(384)
419 EC_GFP_S390X_NISTP_METHOD(521)
420