1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (c) 2020 Hannes Reinecke, SUSE Linux 4 */ 5 6 #include <linux/module.h> 7 #include <linux/crc32.h> 8 #include <linux/base64.h> 9 #include <linux/prandom.h> 10 #include <linux/scatterlist.h> 11 #include <linux/unaligned.h> 12 #include <crypto/dh.h> 13 #include <crypto/sha2.h> 14 #include <linux/nvme.h> 15 #include <linux/nvme-auth.h> 16 17 static u32 nvme_dhchap_seqnum; 18 static DEFINE_MUTEX(nvme_dhchap_mutex); 19 20 u32 nvme_auth_get_seqnum(void) 21 { 22 u32 seqnum; 23 24 mutex_lock(&nvme_dhchap_mutex); 25 if (!nvme_dhchap_seqnum) 26 nvme_dhchap_seqnum = get_random_u32(); 27 else { 28 nvme_dhchap_seqnum++; 29 if (!nvme_dhchap_seqnum) 30 nvme_dhchap_seqnum++; 31 } 32 seqnum = nvme_dhchap_seqnum; 33 mutex_unlock(&nvme_dhchap_mutex); 34 return seqnum; 35 } 36 EXPORT_SYMBOL_GPL(nvme_auth_get_seqnum); 37 38 static const struct nvme_auth_dhgroup_map { 39 char name[16]; 40 char kpp[16]; 41 } dhgroup_map[] = { 42 [NVME_AUTH_DHGROUP_NULL] = { 43 .name = "null", .kpp = "null" }, 44 [NVME_AUTH_DHGROUP_2048] = { 45 .name = "ffdhe2048", .kpp = "ffdhe2048(dh)" }, 46 [NVME_AUTH_DHGROUP_3072] = { 47 .name = "ffdhe3072", .kpp = "ffdhe3072(dh)" }, 48 [NVME_AUTH_DHGROUP_4096] = { 49 .name = "ffdhe4096", .kpp = "ffdhe4096(dh)" }, 50 [NVME_AUTH_DHGROUP_6144] = { 51 .name = "ffdhe6144", .kpp = "ffdhe6144(dh)" }, 52 [NVME_AUTH_DHGROUP_8192] = { 53 .name = "ffdhe8192", .kpp = "ffdhe8192(dh)" }, 54 }; 55 56 const char *nvme_auth_dhgroup_name(u8 dhgroup_id) 57 { 58 if (dhgroup_id >= ARRAY_SIZE(dhgroup_map)) 59 return NULL; 60 return dhgroup_map[dhgroup_id].name; 61 } 62 EXPORT_SYMBOL_GPL(nvme_auth_dhgroup_name); 63 64 const char *nvme_auth_dhgroup_kpp(u8 dhgroup_id) 65 { 66 if (dhgroup_id >= ARRAY_SIZE(dhgroup_map)) 67 return NULL; 68 return dhgroup_map[dhgroup_id].kpp; 69 } 70 EXPORT_SYMBOL_GPL(nvme_auth_dhgroup_kpp); 71 72 u8 nvme_auth_dhgroup_id(const char *dhgroup_name) 73 { 74 int i; 75 76 if (!dhgroup_name || !strlen(dhgroup_name)) 77 return NVME_AUTH_DHGROUP_INVALID; 78 for (i = 0; i < ARRAY_SIZE(dhgroup_map); i++) { 79 if (!strlen(dhgroup_map[i].name)) 80 continue; 81 if (!strncmp(dhgroup_map[i].name, dhgroup_name, 82 strlen(dhgroup_map[i].name))) 83 return i; 84 } 85 return NVME_AUTH_DHGROUP_INVALID; 86 } 87 EXPORT_SYMBOL_GPL(nvme_auth_dhgroup_id); 88 89 static const struct nvme_dhchap_hash_map { 90 int len; 91 char hmac[15]; 92 char digest[8]; 93 } hash_map[] = { 94 [NVME_AUTH_HASH_SHA256] = { 95 .len = 32, 96 .hmac = "hmac(sha256)", 97 .digest = "sha256", 98 }, 99 [NVME_AUTH_HASH_SHA384] = { 100 .len = 48, 101 .hmac = "hmac(sha384)", 102 .digest = "sha384", 103 }, 104 [NVME_AUTH_HASH_SHA512] = { 105 .len = 64, 106 .hmac = "hmac(sha512)", 107 .digest = "sha512", 108 }, 109 }; 110 111 const char *nvme_auth_hmac_name(u8 hmac_id) 112 { 113 if (hmac_id >= ARRAY_SIZE(hash_map)) 114 return NULL; 115 return hash_map[hmac_id].hmac; 116 } 117 EXPORT_SYMBOL_GPL(nvme_auth_hmac_name); 118 119 const char *nvme_auth_digest_name(u8 hmac_id) 120 { 121 if (hmac_id >= ARRAY_SIZE(hash_map)) 122 return NULL; 123 return hash_map[hmac_id].digest; 124 } 125 EXPORT_SYMBOL_GPL(nvme_auth_digest_name); 126 127 u8 nvme_auth_hmac_id(const char *hmac_name) 128 { 129 int i; 130 131 if (!hmac_name || !strlen(hmac_name)) 132 return NVME_AUTH_HASH_INVALID; 133 134 for (i = 0; i < ARRAY_SIZE(hash_map); i++) { 135 if (!strlen(hash_map[i].hmac)) 136 continue; 137 if (!strncmp(hash_map[i].hmac, hmac_name, 138 strlen(hash_map[i].hmac))) 139 return i; 140 } 141 return NVME_AUTH_HASH_INVALID; 142 } 143 EXPORT_SYMBOL_GPL(nvme_auth_hmac_id); 144 145 size_t nvme_auth_hmac_hash_len(u8 hmac_id) 146 { 147 if (hmac_id >= ARRAY_SIZE(hash_map)) 148 return 0; 149 return hash_map[hmac_id].len; 150 } 151 EXPORT_SYMBOL_GPL(nvme_auth_hmac_hash_len); 152 153 u32 nvme_auth_key_struct_size(u32 key_len) 154 { 155 struct nvme_dhchap_key key; 156 157 return struct_size(&key, key, key_len); 158 } 159 EXPORT_SYMBOL_GPL(nvme_auth_key_struct_size); 160 161 struct nvme_dhchap_key *nvme_auth_extract_key(const char *secret, u8 key_hash) 162 { 163 struct nvme_dhchap_key *key; 164 const char *p; 165 u32 crc; 166 int ret, key_len; 167 size_t allocated_len = strlen(secret); 168 169 /* Secret might be affixed with a ':' */ 170 p = strrchr(secret, ':'); 171 if (p) 172 allocated_len = p - secret; 173 key = nvme_auth_alloc_key(allocated_len, 0); 174 if (!key) 175 return ERR_PTR(-ENOMEM); 176 177 key_len = base64_decode(secret, allocated_len, key->key, true, BASE64_STD); 178 if (key_len < 0) { 179 pr_debug("base64 key decoding error %d\n", 180 key_len); 181 ret = key_len; 182 goto out_free_key; 183 } 184 185 if (key_len != 36 && key_len != 52 && 186 key_len != 68) { 187 pr_err("Invalid key len %d\n", key_len); 188 ret = -EINVAL; 189 goto out_free_key; 190 } 191 192 /* The last four bytes is the CRC in little-endian format */ 193 key_len -= 4; 194 /* 195 * The linux implementation doesn't do pre- and post-increments, 196 * so we have to do it manually. 197 */ 198 crc = ~crc32(~0, key->key, key_len); 199 200 if (get_unaligned_le32(key->key + key_len) != crc) { 201 pr_err("key crc mismatch (key %08x, crc %08x)\n", 202 get_unaligned_le32(key->key + key_len), crc); 203 ret = -EKEYREJECTED; 204 goto out_free_key; 205 } 206 key->len = key_len; 207 key->hash = key_hash; 208 return key; 209 out_free_key: 210 nvme_auth_free_key(key); 211 return ERR_PTR(ret); 212 } 213 EXPORT_SYMBOL_GPL(nvme_auth_extract_key); 214 215 struct nvme_dhchap_key *nvme_auth_alloc_key(u32 len, u8 hash) 216 { 217 u32 num_bytes = nvme_auth_key_struct_size(len); 218 struct nvme_dhchap_key *key = kzalloc(num_bytes, GFP_KERNEL); 219 220 if (key) { 221 key->len = len; 222 key->hash = hash; 223 } 224 return key; 225 } 226 EXPORT_SYMBOL_GPL(nvme_auth_alloc_key); 227 228 void nvme_auth_free_key(struct nvme_dhchap_key *key) 229 { 230 if (!key) 231 return; 232 kfree_sensitive(key); 233 } 234 EXPORT_SYMBOL_GPL(nvme_auth_free_key); 235 236 /* 237 * Start computing an HMAC value, given the algorithm ID and raw key. 238 * 239 * The context should be zeroized at the end of its lifetime. The caller can do 240 * that implicitly by calling nvme_auth_hmac_final(), or explicitly (needed when 241 * a context is abandoned without finalizing it) by calling memzero_explicit(). 242 */ 243 int nvme_auth_hmac_init(struct nvme_auth_hmac_ctx *hmac, u8 hmac_id, 244 const u8 *key, size_t key_len) 245 { 246 hmac->hmac_id = hmac_id; 247 switch (hmac_id) { 248 case NVME_AUTH_HASH_SHA256: 249 hmac_sha256_init_usingrawkey(&hmac->sha256, key, key_len); 250 return 0; 251 case NVME_AUTH_HASH_SHA384: 252 hmac_sha384_init_usingrawkey(&hmac->sha384, key, key_len); 253 return 0; 254 case NVME_AUTH_HASH_SHA512: 255 hmac_sha512_init_usingrawkey(&hmac->sha512, key, key_len); 256 return 0; 257 } 258 pr_warn("%s: invalid hash algorithm %d\n", __func__, hmac_id); 259 return -EINVAL; 260 } 261 EXPORT_SYMBOL_GPL(nvme_auth_hmac_init); 262 263 void nvme_auth_hmac_update(struct nvme_auth_hmac_ctx *hmac, const u8 *data, 264 size_t data_len) 265 { 266 switch (hmac->hmac_id) { 267 case NVME_AUTH_HASH_SHA256: 268 hmac_sha256_update(&hmac->sha256, data, data_len); 269 return; 270 case NVME_AUTH_HASH_SHA384: 271 hmac_sha384_update(&hmac->sha384, data, data_len); 272 return; 273 case NVME_AUTH_HASH_SHA512: 274 hmac_sha512_update(&hmac->sha512, data, data_len); 275 return; 276 } 277 /* Unreachable because nvme_auth_hmac_init() validated hmac_id */ 278 WARN_ON_ONCE(1); 279 } 280 EXPORT_SYMBOL_GPL(nvme_auth_hmac_update); 281 282 /* Finish computing an HMAC value. Note that this zeroizes the HMAC context. */ 283 void nvme_auth_hmac_final(struct nvme_auth_hmac_ctx *hmac, u8 *out) 284 { 285 switch (hmac->hmac_id) { 286 case NVME_AUTH_HASH_SHA256: 287 hmac_sha256_final(&hmac->sha256, out); 288 return; 289 case NVME_AUTH_HASH_SHA384: 290 hmac_sha384_final(&hmac->sha384, out); 291 return; 292 case NVME_AUTH_HASH_SHA512: 293 hmac_sha512_final(&hmac->sha512, out); 294 return; 295 } 296 /* Unreachable because nvme_auth_hmac_init() validated hmac_id */ 297 WARN_ON_ONCE(1); 298 } 299 EXPORT_SYMBOL_GPL(nvme_auth_hmac_final); 300 301 static int nvme_auth_hmac(u8 hmac_id, const u8 *key, size_t key_len, 302 const u8 *data, size_t data_len, u8 *out) 303 { 304 struct nvme_auth_hmac_ctx hmac; 305 int ret; 306 307 ret = nvme_auth_hmac_init(&hmac, hmac_id, key, key_len); 308 if (ret == 0) { 309 nvme_auth_hmac_update(&hmac, data, data_len); 310 nvme_auth_hmac_final(&hmac, out); 311 } 312 return ret; 313 } 314 315 static int nvme_auth_hash(u8 hmac_id, const u8 *data, size_t data_len, u8 *out) 316 { 317 switch (hmac_id) { 318 case NVME_AUTH_HASH_SHA256: 319 sha256(data, data_len, out); 320 return 0; 321 case NVME_AUTH_HASH_SHA384: 322 sha384(data, data_len, out); 323 return 0; 324 case NVME_AUTH_HASH_SHA512: 325 sha512(data, data_len, out); 326 return 0; 327 } 328 pr_warn("%s: invalid hash algorithm %d\n", __func__, hmac_id); 329 return -EINVAL; 330 } 331 332 struct nvme_dhchap_key *nvme_auth_transform_key( 333 const struct nvme_dhchap_key *key, const char *nqn) 334 { 335 struct nvme_auth_hmac_ctx hmac; 336 struct nvme_dhchap_key *transformed_key; 337 int ret, key_len; 338 339 if (!key) { 340 pr_warn("No key specified\n"); 341 return ERR_PTR(-ENOKEY); 342 } 343 if (key->hash == 0) { 344 key_len = nvme_auth_key_struct_size(key->len); 345 transformed_key = kmemdup(key, key_len, GFP_KERNEL); 346 if (!transformed_key) 347 return ERR_PTR(-ENOMEM); 348 return transformed_key; 349 } 350 ret = nvme_auth_hmac_init(&hmac, key->hash, key->key, key->len); 351 if (ret) 352 return ERR_PTR(ret); 353 key_len = nvme_auth_hmac_hash_len(key->hash); 354 transformed_key = nvme_auth_alloc_key(key_len, key->hash); 355 if (!transformed_key) { 356 memzero_explicit(&hmac, sizeof(hmac)); 357 return ERR_PTR(-ENOMEM); 358 } 359 nvme_auth_hmac_update(&hmac, nqn, strlen(nqn)); 360 nvme_auth_hmac_update(&hmac, "NVMe-over-Fabrics", 17); 361 nvme_auth_hmac_final(&hmac, transformed_key->key); 362 return transformed_key; 363 } 364 EXPORT_SYMBOL_GPL(nvme_auth_transform_key); 365 366 int nvme_auth_augmented_challenge(u8 hmac_id, const u8 *skey, size_t skey_len, 367 const u8 *challenge, u8 *aug, size_t hlen) 368 { 369 u8 hashed_key[NVME_AUTH_MAX_DIGEST_SIZE]; 370 int ret; 371 372 ret = nvme_auth_hash(hmac_id, skey, skey_len, hashed_key); 373 if (ret) 374 return ret; 375 ret = nvme_auth_hmac(hmac_id, hashed_key, hlen, challenge, hlen, aug); 376 memzero_explicit(hashed_key, sizeof(hashed_key)); 377 return ret; 378 } 379 EXPORT_SYMBOL_GPL(nvme_auth_augmented_challenge); 380 381 int nvme_auth_gen_privkey(struct crypto_kpp *dh_tfm, u8 dh_gid) 382 { 383 int ret; 384 385 ret = crypto_kpp_set_secret(dh_tfm, NULL, 0); 386 if (ret) 387 pr_debug("failed to set private key, error %d\n", ret); 388 389 return ret; 390 } 391 EXPORT_SYMBOL_GPL(nvme_auth_gen_privkey); 392 393 int nvme_auth_gen_pubkey(struct crypto_kpp *dh_tfm, 394 u8 *host_key, size_t host_key_len) 395 { 396 struct kpp_request *req; 397 struct crypto_wait wait; 398 struct scatterlist dst; 399 int ret; 400 401 req = kpp_request_alloc(dh_tfm, GFP_KERNEL); 402 if (!req) 403 return -ENOMEM; 404 405 crypto_init_wait(&wait); 406 kpp_request_set_input(req, NULL, 0); 407 sg_init_one(&dst, host_key, host_key_len); 408 kpp_request_set_output(req, &dst, host_key_len); 409 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 410 crypto_req_done, &wait); 411 412 ret = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait); 413 kpp_request_free(req); 414 return ret; 415 } 416 EXPORT_SYMBOL_GPL(nvme_auth_gen_pubkey); 417 418 int nvme_auth_gen_shared_secret(struct crypto_kpp *dh_tfm, 419 const u8 *ctrl_key, size_t ctrl_key_len, 420 u8 *sess_key, size_t sess_key_len) 421 { 422 struct kpp_request *req; 423 struct crypto_wait wait; 424 struct scatterlist src, dst; 425 int ret; 426 427 req = kpp_request_alloc(dh_tfm, GFP_KERNEL); 428 if (!req) 429 return -ENOMEM; 430 431 crypto_init_wait(&wait); 432 sg_init_one(&src, ctrl_key, ctrl_key_len); 433 kpp_request_set_input(req, &src, ctrl_key_len); 434 sg_init_one(&dst, sess_key, sess_key_len); 435 kpp_request_set_output(req, &dst, sess_key_len); 436 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 437 crypto_req_done, &wait); 438 439 ret = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait); 440 441 kpp_request_free(req); 442 return ret; 443 } 444 EXPORT_SYMBOL_GPL(nvme_auth_gen_shared_secret); 445 446 int nvme_auth_parse_key(const char *secret, struct nvme_dhchap_key **ret_key) 447 { 448 struct nvme_dhchap_key *key; 449 u8 key_hash; 450 451 if (!secret) { 452 *ret_key = NULL; 453 return 0; 454 } 455 456 if (sscanf(secret, "DHHC-1:%hhd:%*s:", &key_hash) != 1) 457 return -EINVAL; 458 459 /* Pass in the secret without the 'DHHC-1:XX:' prefix */ 460 key = nvme_auth_extract_key(secret + 10, key_hash); 461 if (IS_ERR(key)) { 462 *ret_key = NULL; 463 return PTR_ERR(key); 464 } 465 466 *ret_key = key; 467 return 0; 468 } 469 EXPORT_SYMBOL_GPL(nvme_auth_parse_key); 470 471 /** 472 * nvme_auth_generate_psk - Generate a PSK for TLS 473 * @hmac_id: Hash function identifier 474 * @skey: Session key 475 * @skey_len: Length of @skey 476 * @c1: Value of challenge C1 477 * @c2: Value of challenge C2 478 * @hash_len: Hash length of the hash algorithm 479 * @ret_psk: Pointer to the resulting generated PSK 480 * @ret_len: length of @ret_psk 481 * 482 * Generate a PSK for TLS as specified in NVMe base specification, section 483 * 8.13.5.9: Generated PSK for TLS 484 * 485 * The generated PSK for TLS shall be computed applying the HMAC function 486 * using the hash function H( ) selected by the HashID parameter in the 487 * DH-HMAC-CHAP_Challenge message with the session key KS as key to the 488 * concatenation of the two challenges C1 and C2 (i.e., generated 489 * PSK = HMAC(KS, C1 || C2)). 490 * 491 * Returns 0 on success with a valid generated PSK pointer in @ret_psk and 492 * the length of @ret_psk in @ret_len, or a negative error number otherwise. 493 */ 494 int nvme_auth_generate_psk(u8 hmac_id, const u8 *skey, size_t skey_len, 495 const u8 *c1, const u8 *c2, size_t hash_len, 496 u8 **ret_psk, size_t *ret_len) 497 { 498 size_t psk_len = nvme_auth_hmac_hash_len(hmac_id); 499 struct nvme_auth_hmac_ctx hmac; 500 u8 *psk; 501 int ret; 502 503 if (!c1 || !c2) 504 return -EINVAL; 505 506 ret = nvme_auth_hmac_init(&hmac, hmac_id, skey, skey_len); 507 if (ret) 508 return ret; 509 psk = kzalloc(psk_len, GFP_KERNEL); 510 if (!psk) { 511 memzero_explicit(&hmac, sizeof(hmac)); 512 return -ENOMEM; 513 } 514 nvme_auth_hmac_update(&hmac, c1, hash_len); 515 nvme_auth_hmac_update(&hmac, c2, hash_len); 516 nvme_auth_hmac_final(&hmac, psk); 517 *ret_psk = psk; 518 *ret_len = psk_len; 519 return 0; 520 } 521 EXPORT_SYMBOL_GPL(nvme_auth_generate_psk); 522 523 /** 524 * nvme_auth_generate_digest - Generate TLS PSK digest 525 * @hmac_id: Hash function identifier 526 * @psk: Generated input PSK 527 * @psk_len: Length of @psk 528 * @subsysnqn: NQN of the subsystem 529 * @hostnqn: NQN of the host 530 * @ret_digest: Pointer to the returned digest 531 * 532 * Generate a TLS PSK digest as specified in TP8018 Section 3.6.1.3: 533 * TLS PSK and PSK identity Derivation 534 * 535 * The PSK digest shall be computed by encoding in Base64 (refer to RFC 536 * 4648) the result of the application of the HMAC function using the hash 537 * function specified in item 4 above (ie the hash function of the cipher 538 * suite associated with the PSK identity) with the PSK as HMAC key to the 539 * concatenation of: 540 * - the NQN of the host (i.e., NQNh) not including the null terminator; 541 * - a space character; 542 * - the NQN of the NVM subsystem (i.e., NQNc) not including the null 543 * terminator; 544 * - a space character; and 545 * - the seventeen ASCII characters "NVMe-over-Fabrics" 546 * (i.e., <PSK digest> = Base64(HMAC(PSK, NQNh || " " || NQNc || " " || 547 * "NVMe-over-Fabrics"))). 548 * The length of the PSK digest depends on the hash function used to compute 549 * it as follows: 550 * - If the SHA-256 hash function is used, the resulting PSK digest is 44 551 * characters long; or 552 * - If the SHA-384 hash function is used, the resulting PSK digest is 64 553 * characters long. 554 * 555 * Returns 0 on success with a valid digest pointer in @ret_digest, or a 556 * negative error number on failure. 557 */ 558 int nvme_auth_generate_digest(u8 hmac_id, const u8 *psk, size_t psk_len, 559 const char *subsysnqn, const char *hostnqn, 560 char **ret_digest) 561 { 562 struct nvme_auth_hmac_ctx hmac; 563 u8 digest[NVME_AUTH_MAX_DIGEST_SIZE]; 564 size_t hash_len = nvme_auth_hmac_hash_len(hmac_id); 565 char *enc; 566 size_t enc_len; 567 int ret; 568 569 if (WARN_ON(!subsysnqn || !hostnqn)) 570 return -EINVAL; 571 572 if (hash_len == 0) { 573 pr_warn("%s: invalid hash algorithm %d\n", 574 __func__, hmac_id); 575 return -EINVAL; 576 } 577 578 switch (hash_len) { 579 case 32: 580 enc_len = 44; 581 break; 582 case 48: 583 enc_len = 64; 584 break; 585 default: 586 pr_warn("%s: invalid hash algorithm '%s'\n", 587 __func__, nvme_auth_hmac_name(hmac_id)); 588 return -EINVAL; 589 } 590 591 enc = kzalloc(enc_len + 1, GFP_KERNEL); 592 if (!enc) { 593 ret = -ENOMEM; 594 goto out; 595 } 596 597 ret = nvme_auth_hmac_init(&hmac, hmac_id, psk, psk_len); 598 if (ret) 599 goto out; 600 nvme_auth_hmac_update(&hmac, hostnqn, strlen(hostnqn)); 601 nvme_auth_hmac_update(&hmac, " ", 1); 602 nvme_auth_hmac_update(&hmac, subsysnqn, strlen(subsysnqn)); 603 nvme_auth_hmac_update(&hmac, " NVMe-over-Fabrics", 18); 604 nvme_auth_hmac_final(&hmac, digest); 605 606 ret = base64_encode(digest, hash_len, enc, true, BASE64_STD); 607 if (ret < enc_len) { 608 ret = -ENOKEY; 609 goto out; 610 } 611 *ret_digest = enc; 612 ret = 0; 613 614 out: 615 if (ret) 616 kfree_sensitive(enc); 617 memzero_explicit(digest, sizeof(digest)); 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(nvme_auth_generate_digest); 621 622 /** 623 * nvme_auth_derive_tls_psk - Derive TLS PSK 624 * @hmac_id: Hash function identifier 625 * @psk: generated input PSK 626 * @psk_len: size of @psk 627 * @psk_digest: TLS PSK digest 628 * @ret_psk: Pointer to the resulting TLS PSK 629 * 630 * Derive a TLS PSK as specified in TP8018 Section 3.6.1.3: 631 * TLS PSK and PSK identity Derivation 632 * 633 * The TLS PSK shall be derived as follows from an input PSK 634 * (i.e., either a retained PSK or a generated PSK) and a PSK 635 * identity using the HKDF-Extract and HKDF-Expand-Label operations 636 * (refer to RFC 5869 and RFC 8446) where the hash function is the 637 * one specified by the hash specifier of the PSK identity: 638 * 1. PRK = HKDF-Extract(0, Input PSK); and 639 * 2. TLS PSK = HKDF-Expand-Label(PRK, "nvme-tls-psk", PskIdentityContext, L), 640 * where PskIdentityContext is the hash identifier indicated in 641 * the PSK identity concatenated to a space character and to the 642 * Base64 PSK digest (i.e., "<hash> <PSK digest>") and L is the 643 * output size in bytes of the hash function (i.e., 32 for SHA-256 644 * and 48 for SHA-384). 645 * 646 * Returns 0 on success with a valid psk pointer in @ret_psk or a negative 647 * error number otherwise. 648 */ 649 int nvme_auth_derive_tls_psk(int hmac_id, const u8 *psk, size_t psk_len, 650 const char *psk_digest, u8 **ret_psk) 651 { 652 static const u8 default_salt[NVME_AUTH_MAX_DIGEST_SIZE]; 653 static const char label[] = "tls13 nvme-tls-psk"; 654 const size_t label_len = sizeof(label) - 1; 655 u8 prk[NVME_AUTH_MAX_DIGEST_SIZE]; 656 size_t hash_len, ctx_len; 657 u8 *hmac_data = NULL, *tls_key; 658 size_t i; 659 int ret; 660 661 hash_len = nvme_auth_hmac_hash_len(hmac_id); 662 if (hash_len == 0) { 663 pr_warn("%s: invalid hash algorithm %d\n", 664 __func__, hmac_id); 665 return -EINVAL; 666 } 667 if (hmac_id == NVME_AUTH_HASH_SHA512) { 668 pr_warn("%s: unsupported hash algorithm %s\n", 669 __func__, nvme_auth_hmac_name(hmac_id)); 670 return -EINVAL; 671 } 672 673 if (psk_len != hash_len) { 674 pr_warn("%s: unexpected psk_len %zu\n", __func__, psk_len); 675 return -EINVAL; 676 } 677 678 /* HKDF-Extract */ 679 ret = nvme_auth_hmac(hmac_id, default_salt, hash_len, psk, psk_len, 680 prk); 681 if (ret) 682 goto out; 683 684 /* 685 * HKDF-Expand-Label (RFC 8446 section 7.1), with output length equal to 686 * the hash length (so only a single HMAC operation is needed) 687 */ 688 689 hmac_data = kmalloc(/* output length */ 2 + 690 /* label */ 1 + label_len + 691 /* context (max) */ 1 + 3 + 1 + strlen(psk_digest) + 692 /* counter */ 1, 693 GFP_KERNEL); 694 if (!hmac_data) { 695 ret = -ENOMEM; 696 goto out; 697 } 698 /* output length */ 699 i = 0; 700 hmac_data[i++] = hash_len >> 8; 701 hmac_data[i++] = hash_len; 702 703 /* label */ 704 static_assert(label_len <= 255); 705 hmac_data[i] = label_len; 706 memcpy(&hmac_data[i + 1], label, label_len); 707 i += 1 + label_len; 708 709 /* context */ 710 ctx_len = sprintf(&hmac_data[i + 1], "%02d %s", hmac_id, psk_digest); 711 if (ctx_len > 255) { 712 ret = -EINVAL; 713 goto out; 714 } 715 hmac_data[i] = ctx_len; 716 i += 1 + ctx_len; 717 718 /* counter (this overwrites the NUL terminator written by sprintf) */ 719 hmac_data[i++] = 1; 720 721 tls_key = kzalloc(psk_len, GFP_KERNEL); 722 if (!tls_key) { 723 ret = -ENOMEM; 724 goto out; 725 } 726 ret = nvme_auth_hmac(hmac_id, prk, hash_len, hmac_data, i, tls_key); 727 if (ret) { 728 kfree_sensitive(tls_key); 729 goto out; 730 } 731 *ret_psk = tls_key; 732 out: 733 kfree_sensitive(hmac_data); 734 memzero_explicit(prk, sizeof(prk)); 735 return ret; 736 } 737 EXPORT_SYMBOL_GPL(nvme_auth_derive_tls_psk); 738 739 MODULE_DESCRIPTION("NVMe Authentication framework"); 740 MODULE_LICENSE("GPL v2"); 741