1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*  Diffie-Hellman Key Agreement Method [RFC2631]
24 	mpi_free(ctx->p);  in dh_clear_ctx()
25 	mpi_free(ctx->g);  in dh_clear_ctx()
26 	mpi_free(ctx->xa);  in dh_clear_ctx()
32  *	ya = g^xa mod p; [RFC2631 sec 2.1.1]
34  *	ZZ = yb^xa mod p; [RFC2631 sec 2.1.1]
39 	return mpi_powm(val, base, ctx->xa, ctx->p);  in _compute_val()
50 		return (p_len < 2048) ? -EINVAL : 0;  in dh_check_params_length()
52 	return (p_len < 1536) ? -EINVAL : 0;  in dh_check_params_length()
57 	if (dh_check_params_length(params->p_size << 3))  in dh_set_params()
58 		return -EINVAL;  in dh_set_params()
60 	ctx->p = mpi_read_raw_data(params->p, params->p_size);  in dh_set_params()
61 	if (!ctx->p)  in dh_set_params()
62 		return -EINVAL;  in dh_set_params()
64 	ctx->g = mpi_read_raw_data(params->g, params->g_size);  in dh_set_params()
65 	if (!ctx->g)  in dh_set_params()
66 		return -EINVAL;  in dh_set_params()
86 	ctx->xa = mpi_read_raw_data(params.key, params.key_size);  in dh_set_secret()
87 	if (!ctx->xa)  in dh_set_secret()
94 	return -EINVAL;  in dh_set_secret()
98  * SP800-56A public key verification:
100  * * For the safe-prime groups in FIPS mode, Q can be computed
101  *   trivially from P and a full validation according to SP800-56A
102  *   section 5.6.2.3.1 is performed.
105  *   according to SP800-56A section 5.6.2.3.2 is performed.
109 	if (unlikely(!ctx->p))  in dh_is_pubkey_valid()
110 		return -EINVAL;  in dh_is_pubkey_valid()
113 	 * Step 1: Verify that 2 <= y <= p - 2.  in dh_is_pubkey_valid()
115 	 * The upper limit check is actually y < p instead of y < p - 1  in dh_is_pubkey_valid()
117 	 * p - 1 is the non-trivial element of the subgroup of order 2 and  in dh_is_pubkey_valid()
118 	 * thus, the check on y^q below would fail if y == p - 1.  in dh_is_pubkey_valid()
120 	if (mpi_cmp_ui(y, 1) < 1 || mpi_cmp(y, ctx->p) >= 0)  in dh_is_pubkey_valid()
121 		return -EINVAL;  in dh_is_pubkey_valid()
124 	 * Step 2: Verify that 1 = y^q mod p  in dh_is_pubkey_valid()
126 	 * For the safe-prime groups q = (p - 1)/2.  in dh_is_pubkey_valid()
134 			return -ENOMEM;  in dh_is_pubkey_valid()
136 		q = mpi_alloc(mpi_get_nlimbs(ctx->p));  in dh_is_pubkey_valid()
139 			return -ENOMEM;  in dh_is_pubkey_valid()
143 		 * ->p is odd, so no need to explicitly subtract one  in dh_is_pubkey_valid()
146 		mpi_rshift(q, ctx->p, 1);  in dh_is_pubkey_valid()
148 		ret = mpi_powm(val, y, q, ctx->p);  in dh_is_pubkey_valid()
155 		ret = mpi_cmp_ui(val, 1);  in dh_is_pubkey_valid()
160 			return -EINVAL;  in dh_is_pubkey_valid()
175 		return -ENOMEM;  in dh_compute_value()
177 	if (unlikely(!ctx->xa)) {  in dh_compute_value()
178 		ret = -EINVAL;  in dh_compute_value()
182 	if (req->src) {  in dh_compute_value()
183 		base = mpi_read_raw_from_sgl(req->src, req->src_len);  in dh_compute_value()
185 			ret = -EINVAL;  in dh_compute_value()
192 		base = ctx->g;  in dh_compute_value()
200 		/* SP800-56A rev3 5.7.1.1 check: Validation of shared secret */  in dh_compute_value()
201 		if (req->src) {  in dh_compute_value()
204 			/* z <= 1 */  in dh_compute_value()
205 			if (mpi_cmp_ui(val, 1) < 1) {  in dh_compute_value()
206 				ret = -EBADMSG;  in dh_compute_value()
210 			/* z == p - 1 */  in dh_compute_value()
214 				ret = -ENOMEM;  in dh_compute_value()
218 			ret = mpi_sub_ui(pone, ctx->p, 1);  in dh_compute_value()
220 				ret = -EBADMSG;  in dh_compute_value()
227 		/* SP800-56A rev 3 5.6.2.1.3 key check */  in dh_compute_value()
230 				ret = -EAGAIN;  in dh_compute_value()
236 	ret = mpi_write_to_sgl(val, req->dst, req->dst_len, &sign);  in dh_compute_value()
241 		ret = -EBADMSG;  in dh_compute_value()
243 	if (req->src)  in dh_compute_value()
254 	return mpi_get_size(ctx->p);  in dh_max_size()
272 		.cra_driver_name = "dh-generic",
301 	crypto_drop_kpp(&ctx->dh_spawn);  in dh_safe_prime_free_instance()
317 	tfm_ctx->dh_tfm = crypto_spawn_kpp(&inst_ctx->dh_spawn);  in dh_safe_prime_init_tfm()
318 	if (IS_ERR(tfm_ctx->dh_tfm))  in dh_safe_prime_init_tfm()
319 		return PTR_ERR(tfm_ctx->dh_tfm);  in dh_safe_prime_init_tfm()
322 			     crypto_kpp_reqsize(tfm_ctx->dh_tfm));  in dh_safe_prime_init_tfm()
331 	crypto_free_kpp(tfm_ctx->dh_tfm);  in dh_safe_prime_exit_tfm()
338 	for (i = n; val && i > 0; --i) {  in __add_u64_to_be()
339 		u64 tmp = be64_to_cpu(dst[i - 1]);  in __add_u64_to_be()
342 		val = tmp >= val ? 0 : 1;  in __add_u64_to_be()
343 		dst[i - 1] = cpu_to_be64(tmp);  in __add_u64_to_be()
358 	 * Generate a private key following NIST SP800-56Ar3,  in dh_safe_prime_gen_privkey()
359 	 * sec. 5.6.1.1.1 and 5.6.1.1.3 resp..  in dh_safe_prime_gen_privkey()
361 	 * 5.6.1.1.1: choose key length N such that  in dh_safe_prime_gen_privkey()
362 	 * 2 * ->max_strength <= N <= log2(q) + 1 = ->p_size * 8 - 1  in dh_safe_prime_gen_privkey()
363 	 * with q = (p - 1) / 2 for the safe-prime groups.  in dh_safe_prime_gen_privkey()
369 	 * - N >= 256, in particular it is a multiple of 2^6 = 64  in dh_safe_prime_gen_privkey()
371 	 * - N < log2(q) + 1, i.e. N respects the upper bound.  in dh_safe_prime_gen_privkey()
373 	n = roundup_pow_of_two(2 * safe_prime->max_strength);  in dh_safe_prime_gen_privkey()
374 	WARN_ON_ONCE(n & ((1u << 6) - 1));  in dh_safe_prime_gen_privkey()
381 	oversampling_size = (n + 1) * sizeof(__be64);  in dh_safe_prime_gen_privkey()
384 		return ERR_PTR(-ENOMEM);  in dh_safe_prime_gen_privkey()
390 	err = -EFAULT;  in dh_safe_prime_gen_privkey()
405 	 * key = (key[] mod (M - 1)) + 1 = (key[] mod (2^N - 1)) + 1.  in dh_safe_prime_gen_privkey()
408 	 * 2^N mod (2^N - 1) = 1 and thus, for any integer h,  in dh_safe_prime_gen_privkey()
409 	 * 2^N * h mod (2^N - 1) = h mod (2^N - 1) always holds.  in dh_safe_prime_gen_privkey()
410 	 * The big endian integer key[] composed of n + 1 64bit words  in dh_safe_prime_gen_privkey()
415 	 * h * 2^N + l mod (2^N - 1) = l + h mod (2^N - 1).  in dh_safe_prime_gen_privkey()
417 	 * this first reduction is guaranteed to be <= 2^(N + 1) - 2.  in dh_safe_prime_gen_privkey()
420 	 * then l' <= 2^N - 2. Thus, all bits at positions >= N will  in dh_safe_prime_gen_privkey()
422 	 * h' * 2^N + l' mod (2^N - 1) = l' + h' mod (2^N - 1).  in dh_safe_prime_gen_privkey()
424 	 * l' + h' = 2^N - 1, i.e. that l' + h' mod (2^N - 1)  in dh_safe_prime_gen_privkey()
429 	h = __add_u64_to_be(key + 1, n, h);  in dh_safe_prime_gen_privkey()
430 	h = __add_u64_to_be(key + 1, n, h);  in dh_safe_prime_gen_privkey()
434 	o = __add_u64_to_be(key + 1, n, 1);  in dh_safe_prime_gen_privkey()
436 	 * The overflow bit o from the increment is either zero or  in dh_safe_prime_gen_privkey()
437 	 * one. If zero, key[1:n] holds the final result in big-endian  in dh_safe_prime_gen_privkey()
438 	 * order. If one, key[1:n] is zero now, but needs to be set to  in dh_safe_prime_gen_privkey()
442 		key[n] = cpu_to_be64(1);  in dh_safe_prime_gen_privkey()
447 	memmove(key, &key[1], *key_size);  in dh_safe_prime_gen_privkey()
472 			return -EINVAL;  in dh_safe_prime_set_secret()
475 	params.p = inst_ctx->safe_prime->p;  in dh_safe_prime_set_secret()
476 	params.p_size = inst_ctx->safe_prime->p_size;  in dh_safe_prime_set_secret()
481 		key = dh_safe_prime_gen_privkey(inst_ctx->safe_prime,  in dh_safe_prime_set_secret()
491 		err = -ENOMEM;  in dh_safe_prime_set_secret()
499 	err = crypto_kpp_set_secret(tfm_ctx->dh_tfm, buf, buf_size);  in dh_safe_prime_set_secret()
519 	kpp_request_set_tfm(dh_req, tfm_ctx->dh_tfm);  in dh_safe_prime_prepare_dh_req()
520 	kpp_request_set_callback(dh_req, req->base.flags,  in dh_safe_prime_prepare_dh_req()
523 	kpp_request_set_input(dh_req, req->src, req->src_len);  in dh_safe_prime_prepare_dh_req()
524 	kpp_request_set_output(dh_req, req->dst, req->dst_len);  in dh_safe_prime_prepare_dh_req()
547 	return crypto_kpp_maxsize(tfm_ctx->dh_tfm);  in dh_safe_prime_max_size()
565 	dh_name = crypto_attr_alg_name(tb[1]);  in __dh_safe_prime_create()
571 		return -ENOMEM;  in __dh_safe_prime_create()
575 	err = crypto_grab_kpp(&ctx->dh_spawn, kpp_crypto_instance(inst),  in __dh_safe_prime_create()
580 	err = -EINVAL;  in __dh_safe_prime_create()
581 	dh_alg = crypto_spawn_kpp_alg(&ctx->dh_spawn);  in __dh_safe_prime_create()
582 	if (strcmp(dh_alg->base.cra_name, "dh"))  in __dh_safe_prime_create()
585 	ctx->safe_prime = safe_prime;  in __dh_safe_prime_create()
588 				  tmpl->name, &dh_alg->base);  in __dh_safe_prime_create()
592 	inst->alg.set_secret = dh_safe_prime_set_secret;  in __dh_safe_prime_create()
593 	inst->alg.generate_public_key = dh_safe_prime_generate_public_key;  in __dh_safe_prime_create()
594 	inst->alg.compute_shared_secret = dh_safe_prime_compute_shared_secret;  in __dh_safe_prime_create()
595 	inst->alg.max_size = dh_safe_prime_max_size;  in __dh_safe_prime_create()
596 	inst->alg.init = dh_safe_prime_init_tfm;  in __dh_safe_prime_create()
597 	inst->alg.exit = dh_safe_prime_exit_tfm;  in __dh_safe_prime_create()
598 	inst->alg.base.cra_priority = dh_alg->base.cra_priority;  in __dh_safe_prime_create()
599 	inst->alg.base.cra_module = THIS_MODULE;  in __dh_safe_prime_create()
600 	inst->alg.base.cra_ctxsize = sizeof(struct dh_safe_prime_tfm_ctx);  in __dh_safe_prime_create()
602 	inst->free = dh_safe_prime_free_instance;  in __dh_safe_prime_create()
624 	"\xa9\xe1\x36\x41\x14\x64\x33\xfb\xcc\x93\x9d\xce\x24\x9b\x3e\xf9"
646 	"\xa9\xe1\x36\x41\x14\x64\x33\xfb\xcc\x93\x9d\xce\x24\x9b\x3e\xf9"
663 	"\xf4\xfd\x44\x52\xe2\xd7\x4d\xd3\x64\xf2\xe2\x1e\x71\xf5\x4b\xff"
676 	"\xa9\xe1\x36\x41\x14\x64\x33\xfb\xcc\x93\x9d\xce\x24\x9b\x3e\xf9"
693 	"\xf4\xfd\x44\x52\xe2\xd7\x4d\xd3\x64\xf2\xe2\x1e\x71\xf5\x4b\xff"
714 	"\xa9\xe1\x36\x41\x14\x64\x33\xfb\xcc\x93\x9d\xce\x24\x9b\x3e\xf9"
731 	"\xf4\xfd\x44\x52\xe2\xd7\x4d\xd3\x64\xf2\xe2\x1e\x71\xf5\x4b\xff"
743 	"\xc6\x8a\x00\x7e\x5e\x0d\xd9\x02\x0b\xfd\x64\xb6\x45\x03\x6c\x7a"
745 	"\x3b\xb4\x54\x32\x9b\x76\x24\xc8\x91\x7b\xdd\x64\xb1\xc0\xfd\x4c"
768 	"\xa9\xe1\x36\x41\x14\x64\x33\xfb\xcc\x93\x9d\xce\x24\x9b\x3e\xf9"
785 	"\xf4\xfd\x44\x52\xe2\xd7\x4d\xd3\x64\xf2\xe2\x1e\x71\xf5\x4b\xff"
797 	"\xc6\x8a\x00\x7e\x5e\x0d\xd9\x02\x0b\xfd\x64\xb6\x45\x03\x6c\x7a"
799 	"\x3b\xb4\x54\x32\x9b\x76\x24\xc8\x91\x7b\xdd\x64\xb1\xc0\xfd\x4c"
814 	"\x1e\x42\x5a\x31\xd9\x51\xae\x64\xfd\xb2\x3f\xce\xc9\x50\x9d\x43"