1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (c) 2020 Hannes Reinecke, SUSE Linux 4 */ 5 6 #include <linux/module.h> 7 #include <linux/crc32.h> 8 #include <linux/base64.h> 9 #include <linux/prandom.h> 10 #include <linux/scatterlist.h> 11 #include <linux/unaligned.h> 12 #include <crypto/hash.h> 13 #include <crypto/dh.h> 14 #include <crypto/hkdf.h> 15 #include <linux/nvme.h> 16 #include <linux/nvme-auth.h> 17 18 static u32 nvme_dhchap_seqnum; 19 static DEFINE_MUTEX(nvme_dhchap_mutex); 20 21 u32 nvme_auth_get_seqnum(void) 22 { 23 u32 seqnum; 24 25 mutex_lock(&nvme_dhchap_mutex); 26 if (!nvme_dhchap_seqnum) 27 nvme_dhchap_seqnum = get_random_u32(); 28 else { 29 nvme_dhchap_seqnum++; 30 if (!nvme_dhchap_seqnum) 31 nvme_dhchap_seqnum++; 32 } 33 seqnum = nvme_dhchap_seqnum; 34 mutex_unlock(&nvme_dhchap_mutex); 35 return seqnum; 36 } 37 EXPORT_SYMBOL_GPL(nvme_auth_get_seqnum); 38 39 static const struct nvme_auth_dhgroup_map { 40 char name[16]; 41 char kpp[16]; 42 } dhgroup_map[] = { 43 [NVME_AUTH_DHGROUP_NULL] = { 44 .name = "null", .kpp = "null" }, 45 [NVME_AUTH_DHGROUP_2048] = { 46 .name = "ffdhe2048", .kpp = "ffdhe2048(dh)" }, 47 [NVME_AUTH_DHGROUP_3072] = { 48 .name = "ffdhe3072", .kpp = "ffdhe3072(dh)" }, 49 [NVME_AUTH_DHGROUP_4096] = { 50 .name = "ffdhe4096", .kpp = "ffdhe4096(dh)" }, 51 [NVME_AUTH_DHGROUP_6144] = { 52 .name = "ffdhe6144", .kpp = "ffdhe6144(dh)" }, 53 [NVME_AUTH_DHGROUP_8192] = { 54 .name = "ffdhe8192", .kpp = "ffdhe8192(dh)" }, 55 }; 56 57 const char *nvme_auth_dhgroup_name(u8 dhgroup_id) 58 { 59 if (dhgroup_id >= ARRAY_SIZE(dhgroup_map)) 60 return NULL; 61 return dhgroup_map[dhgroup_id].name; 62 } 63 EXPORT_SYMBOL_GPL(nvme_auth_dhgroup_name); 64 65 const char *nvme_auth_dhgroup_kpp(u8 dhgroup_id) 66 { 67 if (dhgroup_id >= ARRAY_SIZE(dhgroup_map)) 68 return NULL; 69 return dhgroup_map[dhgroup_id].kpp; 70 } 71 EXPORT_SYMBOL_GPL(nvme_auth_dhgroup_kpp); 72 73 u8 nvme_auth_dhgroup_id(const char *dhgroup_name) 74 { 75 int i; 76 77 if (!dhgroup_name || !strlen(dhgroup_name)) 78 return NVME_AUTH_DHGROUP_INVALID; 79 for (i = 0; i < ARRAY_SIZE(dhgroup_map); i++) { 80 if (!strlen(dhgroup_map[i].name)) 81 continue; 82 if (!strncmp(dhgroup_map[i].name, dhgroup_name, 83 strlen(dhgroup_map[i].name))) 84 return i; 85 } 86 return NVME_AUTH_DHGROUP_INVALID; 87 } 88 EXPORT_SYMBOL_GPL(nvme_auth_dhgroup_id); 89 90 static const struct nvme_dhchap_hash_map { 91 int len; 92 char hmac[15]; 93 char digest[8]; 94 } hash_map[] = { 95 [NVME_AUTH_HASH_SHA256] = { 96 .len = 32, 97 .hmac = "hmac(sha256)", 98 .digest = "sha256", 99 }, 100 [NVME_AUTH_HASH_SHA384] = { 101 .len = 48, 102 .hmac = "hmac(sha384)", 103 .digest = "sha384", 104 }, 105 [NVME_AUTH_HASH_SHA512] = { 106 .len = 64, 107 .hmac = "hmac(sha512)", 108 .digest = "sha512", 109 }, 110 }; 111 112 const char *nvme_auth_hmac_name(u8 hmac_id) 113 { 114 if (hmac_id >= ARRAY_SIZE(hash_map)) 115 return NULL; 116 return hash_map[hmac_id].hmac; 117 } 118 EXPORT_SYMBOL_GPL(nvme_auth_hmac_name); 119 120 const char *nvme_auth_digest_name(u8 hmac_id) 121 { 122 if (hmac_id >= ARRAY_SIZE(hash_map)) 123 return NULL; 124 return hash_map[hmac_id].digest; 125 } 126 EXPORT_SYMBOL_GPL(nvme_auth_digest_name); 127 128 u8 nvme_auth_hmac_id(const char *hmac_name) 129 { 130 int i; 131 132 if (!hmac_name || !strlen(hmac_name)) 133 return NVME_AUTH_HASH_INVALID; 134 135 for (i = 0; i < ARRAY_SIZE(hash_map); i++) { 136 if (!strlen(hash_map[i].hmac)) 137 continue; 138 if (!strncmp(hash_map[i].hmac, hmac_name, 139 strlen(hash_map[i].hmac))) 140 return i; 141 } 142 return NVME_AUTH_HASH_INVALID; 143 } 144 EXPORT_SYMBOL_GPL(nvme_auth_hmac_id); 145 146 size_t nvme_auth_hmac_hash_len(u8 hmac_id) 147 { 148 if (hmac_id >= ARRAY_SIZE(hash_map)) 149 return 0; 150 return hash_map[hmac_id].len; 151 } 152 EXPORT_SYMBOL_GPL(nvme_auth_hmac_hash_len); 153 154 u32 nvme_auth_key_struct_size(u32 key_len) 155 { 156 struct nvme_dhchap_key key; 157 158 return struct_size(&key, key, key_len); 159 } 160 EXPORT_SYMBOL_GPL(nvme_auth_key_struct_size); 161 162 struct nvme_dhchap_key *nvme_auth_extract_key(const char *secret, u8 key_hash) 163 { 164 struct nvme_dhchap_key *key; 165 const char *p; 166 u32 crc; 167 int ret, key_len; 168 size_t allocated_len = strlen(secret); 169 170 /* Secret might be affixed with a ':' */ 171 p = strrchr(secret, ':'); 172 if (p) 173 allocated_len = p - secret; 174 key = nvme_auth_alloc_key(allocated_len, 0); 175 if (!key) 176 return ERR_PTR(-ENOMEM); 177 178 key_len = base64_decode(secret, allocated_len, key->key, true, BASE64_STD); 179 if (key_len < 0) { 180 pr_debug("base64 key decoding error %d\n", 181 key_len); 182 ret = key_len; 183 goto out_free_key; 184 } 185 186 if (key_len != 36 && key_len != 52 && 187 key_len != 68) { 188 pr_err("Invalid key len %d\n", key_len); 189 ret = -EINVAL; 190 goto out_free_key; 191 } 192 193 /* The last four bytes is the CRC in little-endian format */ 194 key_len -= 4; 195 /* 196 * The linux implementation doesn't do pre- and post-increments, 197 * so we have to do it manually. 198 */ 199 crc = ~crc32(~0, key->key, key_len); 200 201 if (get_unaligned_le32(key->key + key_len) != crc) { 202 pr_err("key crc mismatch (key %08x, crc %08x)\n", 203 get_unaligned_le32(key->key + key_len), crc); 204 ret = -EKEYREJECTED; 205 goto out_free_key; 206 } 207 key->len = key_len; 208 key->hash = key_hash; 209 return key; 210 out_free_key: 211 nvme_auth_free_key(key); 212 return ERR_PTR(ret); 213 } 214 EXPORT_SYMBOL_GPL(nvme_auth_extract_key); 215 216 struct nvme_dhchap_key *nvme_auth_alloc_key(u32 len, u8 hash) 217 { 218 u32 num_bytes = nvme_auth_key_struct_size(len); 219 struct nvme_dhchap_key *key = kzalloc(num_bytes, GFP_KERNEL); 220 221 if (key) { 222 key->len = len; 223 key->hash = hash; 224 } 225 return key; 226 } 227 EXPORT_SYMBOL_GPL(nvme_auth_alloc_key); 228 229 void nvme_auth_free_key(struct nvme_dhchap_key *key) 230 { 231 if (!key) 232 return; 233 kfree_sensitive(key); 234 } 235 EXPORT_SYMBOL_GPL(nvme_auth_free_key); 236 237 struct nvme_dhchap_key *nvme_auth_transform_key( 238 const struct nvme_dhchap_key *key, const char *nqn) 239 { 240 const char *hmac_name; 241 struct crypto_shash *key_tfm; 242 SHASH_DESC_ON_STACK(shash, key_tfm); 243 struct nvme_dhchap_key *transformed_key; 244 int ret, key_len; 245 246 if (!key) { 247 pr_warn("No key specified\n"); 248 return ERR_PTR(-ENOKEY); 249 } 250 if (key->hash == 0) { 251 key_len = nvme_auth_key_struct_size(key->len); 252 transformed_key = kmemdup(key, key_len, GFP_KERNEL); 253 if (!transformed_key) 254 return ERR_PTR(-ENOMEM); 255 return transformed_key; 256 } 257 hmac_name = nvme_auth_hmac_name(key->hash); 258 if (!hmac_name) { 259 pr_warn("Invalid key hash id %d\n", key->hash); 260 return ERR_PTR(-EINVAL); 261 } 262 263 key_tfm = crypto_alloc_shash(hmac_name, 0, 0); 264 if (IS_ERR(key_tfm)) 265 return ERR_CAST(key_tfm); 266 267 key_len = crypto_shash_digestsize(key_tfm); 268 transformed_key = nvme_auth_alloc_key(key_len, key->hash); 269 if (!transformed_key) { 270 ret = -ENOMEM; 271 goto out_free_key; 272 } 273 274 shash->tfm = key_tfm; 275 ret = crypto_shash_setkey(key_tfm, key->key, key->len); 276 if (ret < 0) 277 goto out_free_transformed_key; 278 ret = crypto_shash_init(shash); 279 if (ret < 0) 280 goto out_free_transformed_key; 281 ret = crypto_shash_update(shash, nqn, strlen(nqn)); 282 if (ret < 0) 283 goto out_free_transformed_key; 284 ret = crypto_shash_update(shash, "NVMe-over-Fabrics", 17); 285 if (ret < 0) 286 goto out_free_transformed_key; 287 ret = crypto_shash_final(shash, transformed_key->key); 288 if (ret < 0) 289 goto out_free_transformed_key; 290 291 crypto_free_shash(key_tfm); 292 293 return transformed_key; 294 295 out_free_transformed_key: 296 nvme_auth_free_key(transformed_key); 297 out_free_key: 298 crypto_free_shash(key_tfm); 299 300 return ERR_PTR(ret); 301 } 302 EXPORT_SYMBOL_GPL(nvme_auth_transform_key); 303 304 static int nvme_auth_hash_skey(int hmac_id, const u8 *skey, size_t skey_len, 305 u8 *hkey) 306 { 307 const char *digest_name; 308 struct crypto_shash *tfm; 309 int ret; 310 311 digest_name = nvme_auth_digest_name(hmac_id); 312 if (!digest_name) { 313 pr_debug("%s: failed to get digest for %d\n", __func__, 314 hmac_id); 315 return -EINVAL; 316 } 317 tfm = crypto_alloc_shash(digest_name, 0, 0); 318 if (IS_ERR(tfm)) 319 return -ENOMEM; 320 321 ret = crypto_shash_tfm_digest(tfm, skey, skey_len, hkey); 322 if (ret < 0) 323 pr_debug("%s: Failed to hash digest len %zu\n", __func__, 324 skey_len); 325 326 crypto_free_shash(tfm); 327 return ret; 328 } 329 330 int nvme_auth_augmented_challenge(u8 hmac_id, const u8 *skey, size_t skey_len, 331 const u8 *challenge, u8 *aug, size_t hlen) 332 { 333 struct crypto_shash *tfm; 334 u8 *hashed_key; 335 const char *hmac_name; 336 int ret; 337 338 hashed_key = kmalloc(hlen, GFP_KERNEL); 339 if (!hashed_key) 340 return -ENOMEM; 341 342 ret = nvme_auth_hash_skey(hmac_id, skey, 343 skey_len, hashed_key); 344 if (ret < 0) 345 goto out_free_key; 346 347 hmac_name = nvme_auth_hmac_name(hmac_id); 348 if (!hmac_name) { 349 pr_warn("%s: invalid hash algorithm %d\n", 350 __func__, hmac_id); 351 ret = -EINVAL; 352 goto out_free_key; 353 } 354 355 tfm = crypto_alloc_shash(hmac_name, 0, 0); 356 if (IS_ERR(tfm)) { 357 ret = PTR_ERR(tfm); 358 goto out_free_key; 359 } 360 361 ret = crypto_shash_setkey(tfm, hashed_key, hlen); 362 if (ret) 363 goto out_free_hash; 364 365 ret = crypto_shash_tfm_digest(tfm, challenge, hlen, aug); 366 out_free_hash: 367 crypto_free_shash(tfm); 368 out_free_key: 369 kfree_sensitive(hashed_key); 370 return ret; 371 } 372 EXPORT_SYMBOL_GPL(nvme_auth_augmented_challenge); 373 374 int nvme_auth_gen_privkey(struct crypto_kpp *dh_tfm, u8 dh_gid) 375 { 376 int ret; 377 378 ret = crypto_kpp_set_secret(dh_tfm, NULL, 0); 379 if (ret) 380 pr_debug("failed to set private key, error %d\n", ret); 381 382 return ret; 383 } 384 EXPORT_SYMBOL_GPL(nvme_auth_gen_privkey); 385 386 int nvme_auth_gen_pubkey(struct crypto_kpp *dh_tfm, 387 u8 *host_key, size_t host_key_len) 388 { 389 struct kpp_request *req; 390 struct crypto_wait wait; 391 struct scatterlist dst; 392 int ret; 393 394 req = kpp_request_alloc(dh_tfm, GFP_KERNEL); 395 if (!req) 396 return -ENOMEM; 397 398 crypto_init_wait(&wait); 399 kpp_request_set_input(req, NULL, 0); 400 sg_init_one(&dst, host_key, host_key_len); 401 kpp_request_set_output(req, &dst, host_key_len); 402 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 403 crypto_req_done, &wait); 404 405 ret = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait); 406 kpp_request_free(req); 407 return ret; 408 } 409 EXPORT_SYMBOL_GPL(nvme_auth_gen_pubkey); 410 411 int nvme_auth_gen_shared_secret(struct crypto_kpp *dh_tfm, 412 const u8 *ctrl_key, size_t ctrl_key_len, 413 u8 *sess_key, size_t sess_key_len) 414 { 415 struct kpp_request *req; 416 struct crypto_wait wait; 417 struct scatterlist src, dst; 418 int ret; 419 420 req = kpp_request_alloc(dh_tfm, GFP_KERNEL); 421 if (!req) 422 return -ENOMEM; 423 424 crypto_init_wait(&wait); 425 sg_init_one(&src, ctrl_key, ctrl_key_len); 426 kpp_request_set_input(req, &src, ctrl_key_len); 427 sg_init_one(&dst, sess_key, sess_key_len); 428 kpp_request_set_output(req, &dst, sess_key_len); 429 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 430 crypto_req_done, &wait); 431 432 ret = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait); 433 434 kpp_request_free(req); 435 return ret; 436 } 437 EXPORT_SYMBOL_GPL(nvme_auth_gen_shared_secret); 438 439 int nvme_auth_generate_key(const char *secret, struct nvme_dhchap_key **ret_key) 440 { 441 struct nvme_dhchap_key *key; 442 u8 key_hash; 443 444 if (!secret) { 445 *ret_key = NULL; 446 return 0; 447 } 448 449 if (sscanf(secret, "DHHC-1:%hhd:%*s:", &key_hash) != 1) 450 return -EINVAL; 451 452 /* Pass in the secret without the 'DHHC-1:XX:' prefix */ 453 key = nvme_auth_extract_key(secret + 10, key_hash); 454 if (IS_ERR(key)) { 455 *ret_key = NULL; 456 return PTR_ERR(key); 457 } 458 459 *ret_key = key; 460 return 0; 461 } 462 EXPORT_SYMBOL_GPL(nvme_auth_generate_key); 463 464 /** 465 * nvme_auth_generate_psk - Generate a PSK for TLS 466 * @hmac_id: Hash function identifier 467 * @skey: Session key 468 * @skey_len: Length of @skey 469 * @c1: Value of challenge C1 470 * @c2: Value of challenge C2 471 * @hash_len: Hash length of the hash algorithm 472 * @ret_psk: Pointer to the resulting generated PSK 473 * @ret_len: length of @ret_psk 474 * 475 * Generate a PSK for TLS as specified in NVMe base specification, section 476 * 8.13.5.9: Generated PSK for TLS 477 * 478 * The generated PSK for TLS shall be computed applying the HMAC function 479 * using the hash function H( ) selected by the HashID parameter in the 480 * DH-HMAC-CHAP_Challenge message with the session key KS as key to the 481 * concatenation of the two challenges C1 and C2 (i.e., generated 482 * PSK = HMAC(KS, C1 || C2)). 483 * 484 * Returns 0 on success with a valid generated PSK pointer in @ret_psk and 485 * the length of @ret_psk in @ret_len, or a negative error number otherwise. 486 */ 487 int nvme_auth_generate_psk(u8 hmac_id, const u8 *skey, size_t skey_len, 488 const u8 *c1, const u8 *c2, size_t hash_len, 489 u8 **ret_psk, size_t *ret_len) 490 { 491 struct crypto_shash *tfm; 492 SHASH_DESC_ON_STACK(shash, tfm); 493 u8 *psk; 494 const char *hmac_name; 495 int ret, psk_len; 496 497 if (!c1 || !c2) 498 return -EINVAL; 499 500 hmac_name = nvme_auth_hmac_name(hmac_id); 501 if (!hmac_name) { 502 pr_warn("%s: invalid hash algorithm %d\n", 503 __func__, hmac_id); 504 return -EINVAL; 505 } 506 507 tfm = crypto_alloc_shash(hmac_name, 0, 0); 508 if (IS_ERR(tfm)) 509 return PTR_ERR(tfm); 510 511 psk_len = crypto_shash_digestsize(tfm); 512 psk = kzalloc(psk_len, GFP_KERNEL); 513 if (!psk) { 514 ret = -ENOMEM; 515 goto out_free_tfm; 516 } 517 518 shash->tfm = tfm; 519 ret = crypto_shash_setkey(tfm, skey, skey_len); 520 if (ret) 521 goto out_free_psk; 522 523 ret = crypto_shash_init(shash); 524 if (ret) 525 goto out_free_psk; 526 527 ret = crypto_shash_update(shash, c1, hash_len); 528 if (ret) 529 goto out_free_psk; 530 531 ret = crypto_shash_update(shash, c2, hash_len); 532 if (ret) 533 goto out_free_psk; 534 535 ret = crypto_shash_final(shash, psk); 536 if (!ret) { 537 *ret_psk = psk; 538 *ret_len = psk_len; 539 } 540 541 out_free_psk: 542 if (ret) 543 kfree_sensitive(psk); 544 out_free_tfm: 545 crypto_free_shash(tfm); 546 547 return ret; 548 } 549 EXPORT_SYMBOL_GPL(nvme_auth_generate_psk); 550 551 /** 552 * nvme_auth_generate_digest - Generate TLS PSK digest 553 * @hmac_id: Hash function identifier 554 * @psk: Generated input PSK 555 * @psk_len: Length of @psk 556 * @subsysnqn: NQN of the subsystem 557 * @hostnqn: NQN of the host 558 * @ret_digest: Pointer to the returned digest 559 * 560 * Generate a TLS PSK digest as specified in TP8018 Section 3.6.1.3: 561 * TLS PSK and PSK identity Derivation 562 * 563 * The PSK digest shall be computed by encoding in Base64 (refer to RFC 564 * 4648) the result of the application of the HMAC function using the hash 565 * function specified in item 4 above (ie the hash function of the cipher 566 * suite associated with the PSK identity) with the PSK as HMAC key to the 567 * concatenation of: 568 * - the NQN of the host (i.e., NQNh) not including the null terminator; 569 * - a space character; 570 * - the NQN of the NVM subsystem (i.e., NQNc) not including the null 571 * terminator; 572 * - a space character; and 573 * - the seventeen ASCII characters "NVMe-over-Fabrics" 574 * (i.e., <PSK digest> = Base64(HMAC(PSK, NQNh || " " || NQNc || " " || 575 * "NVMe-over-Fabrics"))). 576 * The length of the PSK digest depends on the hash function used to compute 577 * it as follows: 578 * - If the SHA-256 hash function is used, the resulting PSK digest is 44 579 * characters long; or 580 * - If the SHA-384 hash function is used, the resulting PSK digest is 64 581 * characters long. 582 * 583 * Returns 0 on success with a valid digest pointer in @ret_digest, or a 584 * negative error number on failure. 585 */ 586 int nvme_auth_generate_digest(u8 hmac_id, const u8 *psk, size_t psk_len, 587 const char *subsysnqn, const char *hostnqn, 588 char **ret_digest) 589 { 590 struct crypto_shash *tfm; 591 SHASH_DESC_ON_STACK(shash, tfm); 592 u8 *digest; 593 char *enc; 594 const char *hmac_name; 595 size_t digest_len, hmac_len; 596 int ret; 597 598 if (WARN_ON(!subsysnqn || !hostnqn)) 599 return -EINVAL; 600 601 hmac_name = nvme_auth_hmac_name(hmac_id); 602 if (!hmac_name) { 603 pr_warn("%s: invalid hash algorithm %d\n", 604 __func__, hmac_id); 605 return -EINVAL; 606 } 607 608 switch (nvme_auth_hmac_hash_len(hmac_id)) { 609 case 32: 610 hmac_len = 44; 611 break; 612 case 48: 613 hmac_len = 64; 614 break; 615 default: 616 pr_warn("%s: invalid hash algorithm '%s'\n", 617 __func__, hmac_name); 618 return -EINVAL; 619 } 620 621 enc = kzalloc(hmac_len + 1, GFP_KERNEL); 622 if (!enc) 623 return -ENOMEM; 624 625 tfm = crypto_alloc_shash(hmac_name, 0, 0); 626 if (IS_ERR(tfm)) { 627 ret = PTR_ERR(tfm); 628 goto out_free_enc; 629 } 630 631 digest_len = crypto_shash_digestsize(tfm); 632 digest = kzalloc(digest_len, GFP_KERNEL); 633 if (!digest) { 634 ret = -ENOMEM; 635 goto out_free_tfm; 636 } 637 638 shash->tfm = tfm; 639 ret = crypto_shash_setkey(tfm, psk, psk_len); 640 if (ret) 641 goto out_free_digest; 642 643 ret = crypto_shash_init(shash); 644 if (ret) 645 goto out_free_digest; 646 647 ret = crypto_shash_update(shash, hostnqn, strlen(hostnqn)); 648 if (ret) 649 goto out_free_digest; 650 651 ret = crypto_shash_update(shash, " ", 1); 652 if (ret) 653 goto out_free_digest; 654 655 ret = crypto_shash_update(shash, subsysnqn, strlen(subsysnqn)); 656 if (ret) 657 goto out_free_digest; 658 659 ret = crypto_shash_update(shash, " NVMe-over-Fabrics", 18); 660 if (ret) 661 goto out_free_digest; 662 663 ret = crypto_shash_final(shash, digest); 664 if (ret) 665 goto out_free_digest; 666 667 ret = base64_encode(digest, digest_len, enc, true, BASE64_STD); 668 if (ret < hmac_len) { 669 ret = -ENOKEY; 670 goto out_free_digest; 671 } 672 *ret_digest = enc; 673 ret = 0; 674 675 out_free_digest: 676 kfree_sensitive(digest); 677 out_free_tfm: 678 crypto_free_shash(tfm); 679 out_free_enc: 680 if (ret) 681 kfree_sensitive(enc); 682 683 return ret; 684 } 685 EXPORT_SYMBOL_GPL(nvme_auth_generate_digest); 686 687 /** 688 * hkdf_expand_label - HKDF-Expand-Label (RFC 8846 section 7.1) 689 * @hmac_tfm: hash context keyed with pseudorandom key 690 * @label: ASCII label without "tls13 " prefix 691 * @labellen: length of @label 692 * @context: context bytes 693 * @contextlen: length of @context 694 * @okm: output keying material 695 * @okmlen: length of @okm 696 * 697 * Build the TLS 1.3 HkdfLabel structure and invoke hkdf_expand(). 698 * 699 * Returns 0 on success with output keying material stored in @okm, 700 * or a negative errno value otherwise. 701 */ 702 static int hkdf_expand_label(struct crypto_shash *hmac_tfm, 703 const u8 *label, unsigned int labellen, 704 const u8 *context, unsigned int contextlen, 705 u8 *okm, unsigned int okmlen) 706 { 707 int err; 708 u8 *info; 709 unsigned int infolen; 710 const char *tls13_prefix = "tls13 "; 711 unsigned int prefixlen = strlen(tls13_prefix); 712 713 if (WARN_ON(labellen > (255 - prefixlen))) 714 return -EINVAL; 715 if (WARN_ON(contextlen > 255)) 716 return -EINVAL; 717 718 infolen = 2 + (1 + prefixlen + labellen) + (1 + contextlen); 719 info = kzalloc(infolen, GFP_KERNEL); 720 if (!info) 721 return -ENOMEM; 722 723 /* HkdfLabel.Length */ 724 put_unaligned_be16(okmlen, info); 725 726 /* HkdfLabel.Label */ 727 info[2] = prefixlen + labellen; 728 memcpy(info + 3, tls13_prefix, prefixlen); 729 memcpy(info + 3 + prefixlen, label, labellen); 730 731 /* HkdfLabel.Context */ 732 info[3 + prefixlen + labellen] = contextlen; 733 memcpy(info + 4 + prefixlen + labellen, context, contextlen); 734 735 err = hkdf_expand(hmac_tfm, info, infolen, okm, okmlen); 736 kfree_sensitive(info); 737 return err; 738 } 739 740 /** 741 * nvme_auth_derive_tls_psk - Derive TLS PSK 742 * @hmac_id: Hash function identifier 743 * @psk: generated input PSK 744 * @psk_len: size of @psk 745 * @psk_digest: TLS PSK digest 746 * @ret_psk: Pointer to the resulting TLS PSK 747 * 748 * Derive a TLS PSK as specified in TP8018 Section 3.6.1.3: 749 * TLS PSK and PSK identity Derivation 750 * 751 * The TLS PSK shall be derived as follows from an input PSK 752 * (i.e., either a retained PSK or a generated PSK) and a PSK 753 * identity using the HKDF-Extract and HKDF-Expand-Label operations 754 * (refer to RFC 5869 and RFC 8446) where the hash function is the 755 * one specified by the hash specifier of the PSK identity: 756 * 1. PRK = HKDF-Extract(0, Input PSK); and 757 * 2. TLS PSK = HKDF-Expand-Label(PRK, "nvme-tls-psk", PskIdentityContext, L), 758 * where PskIdentityContext is the hash identifier indicated in 759 * the PSK identity concatenated to a space character and to the 760 * Base64 PSK digest (i.e., "<hash> <PSK digest>") and L is the 761 * output size in bytes of the hash function (i.e., 32 for SHA-256 762 * and 48 for SHA-384). 763 * 764 * Returns 0 on success with a valid psk pointer in @ret_psk or a negative 765 * error number otherwise. 766 */ 767 int nvme_auth_derive_tls_psk(int hmac_id, const u8 *psk, size_t psk_len, 768 const char *psk_digest, u8 **ret_psk) 769 { 770 struct crypto_shash *hmac_tfm; 771 const char *hmac_name; 772 const char *label = "nvme-tls-psk"; 773 static const u8 default_salt[NVME_AUTH_MAX_DIGEST_SIZE]; 774 size_t prk_len; 775 const char *ctx; 776 u8 *prk, *tls_key; 777 int ret; 778 779 hmac_name = nvme_auth_hmac_name(hmac_id); 780 if (!hmac_name) { 781 pr_warn("%s: invalid hash algorithm %d\n", 782 __func__, hmac_id); 783 return -EINVAL; 784 } 785 if (hmac_id == NVME_AUTH_HASH_SHA512) { 786 pr_warn("%s: unsupported hash algorithm %s\n", 787 __func__, hmac_name); 788 return -EINVAL; 789 } 790 791 hmac_tfm = crypto_alloc_shash(hmac_name, 0, 0); 792 if (IS_ERR(hmac_tfm)) 793 return PTR_ERR(hmac_tfm); 794 795 prk_len = crypto_shash_digestsize(hmac_tfm); 796 prk = kzalloc(prk_len, GFP_KERNEL); 797 if (!prk) { 798 ret = -ENOMEM; 799 goto out_free_shash; 800 } 801 802 if (WARN_ON(prk_len > NVME_AUTH_MAX_DIGEST_SIZE)) { 803 ret = -EINVAL; 804 goto out_free_prk; 805 } 806 ret = hkdf_extract(hmac_tfm, psk, psk_len, 807 default_salt, prk_len, prk); 808 if (ret) 809 goto out_free_prk; 810 811 ret = crypto_shash_setkey(hmac_tfm, prk, prk_len); 812 if (ret) 813 goto out_free_prk; 814 815 ctx = kasprintf(GFP_KERNEL, "%02d %s", hmac_id, psk_digest); 816 if (!ctx) { 817 ret = -ENOMEM; 818 goto out_free_prk; 819 } 820 821 tls_key = kzalloc(psk_len, GFP_KERNEL); 822 if (!tls_key) { 823 ret = -ENOMEM; 824 goto out_free_ctx; 825 } 826 ret = hkdf_expand_label(hmac_tfm, 827 label, strlen(label), 828 ctx, strlen(ctx), 829 tls_key, psk_len); 830 if (ret) { 831 kfree(tls_key); 832 goto out_free_ctx; 833 } 834 *ret_psk = tls_key; 835 836 out_free_ctx: 837 kfree(ctx); 838 out_free_prk: 839 kfree(prk); 840 out_free_shash: 841 crypto_free_shash(hmac_tfm); 842 843 return ret; 844 } 845 EXPORT_SYMBOL_GPL(nvme_auth_derive_tls_psk); 846 847 MODULE_DESCRIPTION("NVMe Authentication framework"); 848 MODULE_LICENSE("GPL v2"); 849