1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Cryptographic API. 4 * 5 * HMAC: Keyed-Hashing for Message Authentication (RFC2104). 6 * 7 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au> 8 * Copyright (c) 2006 Herbert Xu <herbert@gondor.apana.org.au> 9 * 10 * The HMAC implementation is derived from USAGI. 11 * Copyright (c) 2002 Kazunori Miyazawa <miyazawa@linux-ipv6.org> / USAGI 12 */ 13 14 #include <crypto/hmac.h> 15 #include <crypto/internal/hash.h> 16 #include <linux/err.h> 17 #include <linux/fips.h> 18 #include <linux/kernel.h> 19 #include <linux/module.h> 20 #include <linux/slab.h> 21 #include <linux/string.h> 22 23 struct hmac_ctx { 24 struct crypto_shash *hash; 25 /* Contains 'u8 ipad[statesize];', then 'u8 opad[statesize];' */ 26 u8 pads[]; 27 }; 28 29 struct ahash_hmac_ctx { 30 struct crypto_ahash *hash; 31 /* Contains 'u8 ipad[statesize];', then 'u8 opad[statesize];' */ 32 u8 pads[]; 33 }; 34 35 static int hmac_setkey(struct crypto_shash *parent, 36 const u8 *inkey, unsigned int keylen) 37 { 38 int bs = crypto_shash_blocksize(parent); 39 int ds = crypto_shash_digestsize(parent); 40 int ss = crypto_shash_statesize(parent); 41 struct hmac_ctx *tctx = crypto_shash_ctx(parent); 42 struct crypto_shash *hash = tctx->hash; 43 u8 *ipad = &tctx->pads[0]; 44 u8 *opad = &tctx->pads[ss]; 45 SHASH_DESC_ON_STACK(shash, hash); 46 int err, i; 47 48 if (fips_enabled && (keylen < 112 / 8)) 49 return -EINVAL; 50 51 shash->tfm = hash; 52 53 if (keylen > bs) { 54 int err; 55 56 err = crypto_shash_digest(shash, inkey, keylen, ipad); 57 if (err) 58 return err; 59 60 keylen = ds; 61 } else 62 memcpy(ipad, inkey, keylen); 63 64 memset(ipad + keylen, 0, bs - keylen); 65 memcpy(opad, ipad, bs); 66 67 for (i = 0; i < bs; i++) { 68 ipad[i] ^= HMAC_IPAD_VALUE; 69 opad[i] ^= HMAC_OPAD_VALUE; 70 } 71 72 err = crypto_shash_init(shash) ?: 73 crypto_shash_update(shash, ipad, bs) ?: 74 crypto_shash_export(shash, ipad) ?: 75 crypto_shash_init(shash) ?: 76 crypto_shash_update(shash, opad, bs) ?: 77 crypto_shash_export(shash, opad); 78 shash_desc_zero(shash); 79 return err; 80 } 81 82 static int hmac_export(struct shash_desc *pdesc, void *out) 83 { 84 struct shash_desc *desc = shash_desc_ctx(pdesc); 85 86 return crypto_shash_export(desc, out); 87 } 88 89 static int hmac_import(struct shash_desc *pdesc, const void *in) 90 { 91 struct shash_desc *desc = shash_desc_ctx(pdesc); 92 const struct hmac_ctx *tctx = crypto_shash_ctx(pdesc->tfm); 93 94 desc->tfm = tctx->hash; 95 96 return crypto_shash_import(desc, in); 97 } 98 99 static int hmac_export_core(struct shash_desc *pdesc, void *out) 100 { 101 struct shash_desc *desc = shash_desc_ctx(pdesc); 102 103 return crypto_shash_export_core(desc, out); 104 } 105 106 static int hmac_import_core(struct shash_desc *pdesc, const void *in) 107 { 108 const struct hmac_ctx *tctx = crypto_shash_ctx(pdesc->tfm); 109 struct shash_desc *desc = shash_desc_ctx(pdesc); 110 111 desc->tfm = tctx->hash; 112 return crypto_shash_import_core(desc, in); 113 } 114 115 static int hmac_init(struct shash_desc *pdesc) 116 { 117 const struct hmac_ctx *tctx = crypto_shash_ctx(pdesc->tfm); 118 119 return hmac_import(pdesc, &tctx->pads[0]); 120 } 121 122 static int hmac_update(struct shash_desc *pdesc, 123 const u8 *data, unsigned int nbytes) 124 { 125 struct shash_desc *desc = shash_desc_ctx(pdesc); 126 127 return crypto_shash_update(desc, data, nbytes); 128 } 129 130 static int hmac_finup(struct shash_desc *pdesc, const u8 *data, 131 unsigned int nbytes, u8 *out) 132 { 133 134 struct crypto_shash *parent = pdesc->tfm; 135 int ds = crypto_shash_digestsize(parent); 136 int ss = crypto_shash_statesize(parent); 137 const struct hmac_ctx *tctx = crypto_shash_ctx(parent); 138 const u8 *opad = &tctx->pads[ss]; 139 struct shash_desc *desc = shash_desc_ctx(pdesc); 140 141 return crypto_shash_finup(desc, data, nbytes, out) ?: 142 crypto_shash_import(desc, opad) ?: 143 crypto_shash_finup(desc, out, ds, out); 144 } 145 146 static int hmac_init_tfm(struct crypto_shash *parent) 147 { 148 struct crypto_shash *hash; 149 struct shash_instance *inst = shash_alg_instance(parent); 150 struct crypto_shash_spawn *spawn = shash_instance_ctx(inst); 151 struct hmac_ctx *tctx = crypto_shash_ctx(parent); 152 153 hash = crypto_spawn_shash(spawn); 154 if (IS_ERR(hash)) 155 return PTR_ERR(hash); 156 157 tctx->hash = hash; 158 return 0; 159 } 160 161 static void hmac_exit_tfm(struct crypto_shash *parent) 162 { 163 struct hmac_ctx *tctx = crypto_shash_ctx(parent); 164 165 crypto_free_shash(tctx->hash); 166 } 167 168 static int __hmac_create_shash(struct crypto_template *tmpl, 169 struct rtattr **tb, u32 mask) 170 { 171 struct shash_instance *inst; 172 struct crypto_shash_spawn *spawn; 173 struct crypto_alg *alg; 174 struct shash_alg *salg; 175 int err; 176 int ds; 177 int ss; 178 179 inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL); 180 if (!inst) 181 return -ENOMEM; 182 spawn = shash_instance_ctx(inst); 183 184 mask |= CRYPTO_AHASH_ALG_NO_EXPORT_CORE; 185 err = crypto_grab_shash(spawn, shash_crypto_instance(inst), 186 crypto_attr_alg_name(tb[1]), 0, mask); 187 if (err) 188 goto err_free_inst; 189 salg = crypto_spawn_shash_alg(spawn); 190 alg = &salg->base; 191 192 /* The underlying hash algorithm must not require a key */ 193 err = -EINVAL; 194 if (crypto_shash_alg_needs_key(salg)) 195 goto err_free_inst; 196 197 ds = salg->digestsize; 198 ss = salg->statesize; 199 if (ds > alg->cra_blocksize || 200 ss < alg->cra_blocksize) 201 goto err_free_inst; 202 203 err = crypto_inst_setname(shash_crypto_instance(inst), "hmac", 204 "hmac-shash", alg); 205 if (err) 206 goto err_free_inst; 207 208 inst->alg.base.cra_priority = alg->cra_priority; 209 inst->alg.base.cra_blocksize = alg->cra_blocksize; 210 inst->alg.base.cra_ctxsize = sizeof(struct hmac_ctx) + (ss * 2); 211 212 inst->alg.digestsize = ds; 213 inst->alg.statesize = ss; 214 inst->alg.descsize = sizeof(struct shash_desc) + salg->descsize; 215 inst->alg.init = hmac_init; 216 inst->alg.update = hmac_update; 217 inst->alg.finup = hmac_finup; 218 inst->alg.export = hmac_export; 219 inst->alg.import = hmac_import; 220 inst->alg.export_core = hmac_export_core; 221 inst->alg.import_core = hmac_import_core; 222 inst->alg.setkey = hmac_setkey; 223 inst->alg.init_tfm = hmac_init_tfm; 224 inst->alg.exit_tfm = hmac_exit_tfm; 225 226 inst->free = shash_free_singlespawn_instance; 227 228 err = shash_register_instance(tmpl, inst); 229 if (err) { 230 err_free_inst: 231 shash_free_singlespawn_instance(inst); 232 } 233 return err; 234 } 235 236 static int hmac_setkey_ahash(struct crypto_ahash *parent, 237 const u8 *inkey, unsigned int keylen) 238 { 239 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(parent); 240 struct crypto_ahash *fb = crypto_ahash_fb(tctx->hash); 241 int ds = crypto_ahash_digestsize(parent); 242 int bs = crypto_ahash_blocksize(parent); 243 int ss = crypto_ahash_statesize(parent); 244 HASH_REQUEST_ON_STACK(req, fb); 245 u8 *opad = &tctx->pads[ss]; 246 u8 *ipad = &tctx->pads[0]; 247 int err, i; 248 249 if (fips_enabled && (keylen < 112 / 8)) 250 return -EINVAL; 251 252 ahash_request_set_callback(req, 0, NULL, NULL); 253 254 if (keylen > bs) { 255 ahash_request_set_virt(req, inkey, ipad, keylen); 256 err = crypto_ahash_digest(req); 257 if (err) 258 goto out_zero_req; 259 260 keylen = ds; 261 } else 262 memcpy(ipad, inkey, keylen); 263 264 memset(ipad + keylen, 0, bs - keylen); 265 memcpy(opad, ipad, bs); 266 267 for (i = 0; i < bs; i++) { 268 ipad[i] ^= HMAC_IPAD_VALUE; 269 opad[i] ^= HMAC_OPAD_VALUE; 270 } 271 272 ahash_request_set_virt(req, ipad, NULL, bs); 273 err = crypto_ahash_init(req) ?: 274 crypto_ahash_update(req) ?: 275 crypto_ahash_export(req, ipad); 276 277 ahash_request_set_virt(req, opad, NULL, bs); 278 err = err ?: 279 crypto_ahash_init(req) ?: 280 crypto_ahash_update(req) ?: 281 crypto_ahash_export(req, opad); 282 283 out_zero_req: 284 HASH_REQUEST_ZERO(req); 285 return err; 286 } 287 288 static int hmac_export_ahash(struct ahash_request *preq, void *out) 289 { 290 return crypto_ahash_export(ahash_request_ctx(preq), out); 291 } 292 293 static int hmac_import_ahash(struct ahash_request *preq, const void *in) 294 { 295 struct crypto_ahash *tfm = crypto_ahash_reqtfm(preq); 296 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(tfm); 297 struct ahash_request *req = ahash_request_ctx(preq); 298 299 ahash_request_set_tfm(req, tctx->hash); 300 return crypto_ahash_import(req, in); 301 } 302 303 static int hmac_export_core_ahash(struct ahash_request *preq, void *out) 304 { 305 return crypto_ahash_export_core(ahash_request_ctx(preq), out); 306 } 307 308 static int hmac_import_core_ahash(struct ahash_request *preq, const void *in) 309 { 310 struct crypto_ahash *tfm = crypto_ahash_reqtfm(preq); 311 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(tfm); 312 struct ahash_request *req = ahash_request_ctx(preq); 313 314 ahash_request_set_tfm(req, tctx->hash); 315 return crypto_ahash_import_core(req, in); 316 } 317 318 static int hmac_init_ahash(struct ahash_request *preq) 319 { 320 struct crypto_ahash *tfm = crypto_ahash_reqtfm(preq); 321 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(tfm); 322 323 return hmac_import_ahash(preq, &tctx->pads[0]); 324 } 325 326 static int hmac_update_ahash(struct ahash_request *preq) 327 { 328 struct ahash_request *req = ahash_request_ctx(preq); 329 330 ahash_request_set_callback(req, ahash_request_flags(preq), 331 preq->base.complete, preq->base.data); 332 if (ahash_request_isvirt(preq)) 333 ahash_request_set_virt(req, preq->svirt, NULL, preq->nbytes); 334 else 335 ahash_request_set_crypt(req, preq->src, NULL, preq->nbytes); 336 return crypto_ahash_update(req); 337 } 338 339 static int hmac_finup_finish(struct ahash_request *preq, unsigned int mask) 340 { 341 struct crypto_ahash *tfm = crypto_ahash_reqtfm(preq); 342 struct ahash_request *req = ahash_request_ctx(preq); 343 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(tfm); 344 int ds = crypto_ahash_digestsize(tfm); 345 int ss = crypto_ahash_statesize(tfm); 346 const u8 *opad = &tctx->pads[ss]; 347 348 ahash_request_set_callback(req, ahash_request_flags(preq) & ~mask, 349 preq->base.complete, preq->base.data); 350 ahash_request_set_virt(req, preq->result, preq->result, ds); 351 return crypto_ahash_import(req, opad) ?: 352 crypto_ahash_finup(req); 353 354 } 355 356 static void hmac_finup_done(void *data, int err) 357 { 358 struct ahash_request *preq = data; 359 360 if (err) 361 goto out; 362 363 err = hmac_finup_finish(preq, CRYPTO_TFM_REQ_MAY_SLEEP); 364 if (err == -EINPROGRESS || err == -EBUSY) 365 return; 366 367 out: 368 ahash_request_complete(preq, err); 369 } 370 371 static int hmac_finup_ahash(struct ahash_request *preq) 372 { 373 struct ahash_request *req = ahash_request_ctx(preq); 374 375 ahash_request_set_callback(req, ahash_request_flags(preq), 376 hmac_finup_done, preq); 377 if (ahash_request_isvirt(preq)) 378 ahash_request_set_virt(req, preq->svirt, preq->result, 379 preq->nbytes); 380 else 381 ahash_request_set_crypt(req, preq->src, preq->result, 382 preq->nbytes); 383 return crypto_ahash_finup(req) ?: 384 hmac_finup_finish(preq, 0); 385 } 386 387 static int hmac_digest_ahash(struct ahash_request *preq) 388 { 389 return hmac_init_ahash(preq) ?: 390 hmac_finup_ahash(preq); 391 } 392 393 static int hmac_init_ahash_tfm(struct crypto_ahash *parent) 394 { 395 struct ahash_instance *inst = ahash_alg_instance(parent); 396 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(parent); 397 struct crypto_ahash *hash; 398 399 hash = crypto_spawn_ahash(ahash_instance_ctx(inst)); 400 if (IS_ERR(hash)) 401 return PTR_ERR(hash); 402 403 if (crypto_ahash_reqsize(parent) < sizeof(struct ahash_request) + 404 crypto_ahash_reqsize(hash)) 405 return -EINVAL; 406 407 tctx->hash = hash; 408 return 0; 409 } 410 411 static void hmac_exit_ahash_tfm(struct crypto_ahash *parent) 412 { 413 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(parent); 414 415 crypto_free_ahash(tctx->hash); 416 } 417 418 static int hmac_create_ahash(struct crypto_template *tmpl, struct rtattr **tb, 419 u32 mask) 420 { 421 struct crypto_ahash_spawn *spawn; 422 struct ahash_instance *inst; 423 struct crypto_alg *alg; 424 struct hash_alg_common *halg; 425 int ds, ss, err; 426 427 inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL); 428 if (!inst) 429 return -ENOMEM; 430 spawn = ahash_instance_ctx(inst); 431 432 mask |= CRYPTO_AHASH_ALG_NO_EXPORT_CORE; 433 err = crypto_grab_ahash(spawn, ahash_crypto_instance(inst), 434 crypto_attr_alg_name(tb[1]), 0, mask); 435 if (err) 436 goto err_free_inst; 437 halg = crypto_spawn_ahash_alg(spawn); 438 alg = &halg->base; 439 440 /* The underlying hash algorithm must not require a key */ 441 err = -EINVAL; 442 if (crypto_hash_alg_needs_key(halg)) 443 goto err_free_inst; 444 445 ds = halg->digestsize; 446 ss = halg->statesize; 447 if (ds > alg->cra_blocksize || ss < alg->cra_blocksize) 448 goto err_free_inst; 449 450 err = crypto_inst_setname(ahash_crypto_instance(inst), tmpl->name, alg); 451 if (err) 452 goto err_free_inst; 453 454 inst->alg.halg.base.cra_flags = alg->cra_flags & 455 CRYPTO_ALG_INHERITED_FLAGS; 456 inst->alg.halg.base.cra_flags |= CRYPTO_ALG_REQ_VIRT; 457 inst->alg.halg.base.cra_priority = alg->cra_priority + 100; 458 inst->alg.halg.base.cra_blocksize = alg->cra_blocksize; 459 inst->alg.halg.base.cra_ctxsize = sizeof(struct ahash_hmac_ctx) + 460 (ss * 2); 461 inst->alg.halg.base.cra_reqsize = sizeof(struct ahash_request) + 462 alg->cra_reqsize; 463 464 inst->alg.halg.digestsize = ds; 465 inst->alg.halg.statesize = ss; 466 inst->alg.init = hmac_init_ahash; 467 inst->alg.update = hmac_update_ahash; 468 inst->alg.finup = hmac_finup_ahash; 469 inst->alg.digest = hmac_digest_ahash; 470 inst->alg.export = hmac_export_ahash; 471 inst->alg.import = hmac_import_ahash; 472 inst->alg.export_core = hmac_export_core_ahash; 473 inst->alg.import_core = hmac_import_core_ahash; 474 inst->alg.setkey = hmac_setkey_ahash; 475 inst->alg.init_tfm = hmac_init_ahash_tfm; 476 inst->alg.exit_tfm = hmac_exit_ahash_tfm; 477 478 inst->free = ahash_free_singlespawn_instance; 479 480 err = ahash_register_instance(tmpl, inst); 481 if (err) { 482 err_free_inst: 483 ahash_free_singlespawn_instance(inst); 484 } 485 return err; 486 } 487 488 static int hmac_create(struct crypto_template *tmpl, struct rtattr **tb) 489 { 490 struct crypto_attr_type *algt; 491 u32 mask; 492 493 algt = crypto_get_attr_type(tb); 494 if (IS_ERR(algt)) 495 return PTR_ERR(algt); 496 497 mask = crypto_algt_inherited_mask(algt); 498 499 if (!((algt->type ^ CRYPTO_ALG_TYPE_AHASH) & 500 algt->mask & CRYPTO_ALG_TYPE_MASK)) 501 return hmac_create_ahash(tmpl, tb, mask); 502 503 if ((algt->type ^ CRYPTO_ALG_TYPE_SHASH) & 504 algt->mask & CRYPTO_ALG_TYPE_MASK) 505 return -EINVAL; 506 507 return __hmac_create_shash(tmpl, tb, mask); 508 } 509 510 static int hmac_create_shash(struct crypto_template *tmpl, struct rtattr **tb) 511 { 512 u32 mask; 513 int err; 514 515 err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_SHASH, &mask); 516 if (err) 517 return err == -EINVAL ? -ENOENT : err; 518 519 return __hmac_create_shash(tmpl, tb, mask); 520 } 521 522 static struct crypto_template hmac_tmpls[] = { 523 { 524 .name = "hmac", 525 .create = hmac_create, 526 .module = THIS_MODULE, 527 }, 528 { 529 .name = "hmac-shash", 530 .create = hmac_create_shash, 531 .module = THIS_MODULE, 532 }, 533 }; 534 535 static int __init hmac_module_init(void) 536 { 537 return crypto_register_templates(hmac_tmpls, ARRAY_SIZE(hmac_tmpls)); 538 } 539 540 static void __exit hmac_module_exit(void) 541 { 542 crypto_unregister_templates(hmac_tmpls, ARRAY_SIZE(hmac_tmpls)); 543 } 544 545 module_init(hmac_module_init); 546 module_exit(hmac_module_exit); 547 548 MODULE_LICENSE("GPL"); 549 MODULE_DESCRIPTION("HMAC hash algorithm"); 550 MODULE_ALIAS_CRYPTO("hmac"); 551