1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*  Diffie-Hellman Key Agreement Method [RFC2631]
24 	mpi_free(ctx->p);  in dh_clear_ctx()
25 	mpi_free(ctx->g);  in dh_clear_ctx()
26 	mpi_free(ctx->xa);  in dh_clear_ctx()
39 	return mpi_powm(val, base, ctx->xa, ctx->p);  in _compute_val()
50 		return (p_len < 2048) ? -EINVAL : 0;  in dh_check_params_length()
52 	return (p_len < 1536) ? -EINVAL : 0;  in dh_check_params_length()
57 	if (dh_check_params_length(params->p_size << 3))  in dh_set_params()
58 		return -EINVAL;  in dh_set_params()
60 	ctx->p = mpi_read_raw_data(params->p, params->p_size);  in dh_set_params()
61 	if (!ctx->p)  in dh_set_params()
62 		return -EINVAL;  in dh_set_params()
64 	ctx->g = mpi_read_raw_data(params->g, params->g_size);  in dh_set_params()
65 	if (!ctx->g)  in dh_set_params()
66 		return -EINVAL;  in dh_set_params()
86 	ctx->xa = mpi_read_raw_data(params.key, params.key_size);  in dh_set_secret()
87 	if (!ctx->xa)  in dh_set_secret()
94 	return -EINVAL;  in dh_set_secret()
98  * SP800-56A public key verification:
100  * * For the safe-prime groups in FIPS mode, Q can be computed
101  *   trivially from P and a full validation according to SP800-56A
105  *   according to SP800-56A section 5.6.2.3.2 is performed.
109 	if (unlikely(!ctx->p))  in dh_is_pubkey_valid()
110 		return -EINVAL;  in dh_is_pubkey_valid()
113 	 * Step 1: Verify that 2 <= y <= p - 2.  in dh_is_pubkey_valid()
115 	 * The upper limit check is actually y < p instead of y < p - 1  in dh_is_pubkey_valid()
117 	 * p - 1 is the non-trivial element of the subgroup of order 2 and  in dh_is_pubkey_valid()
118 	 * thus, the check on y^q below would fail if y == p - 1.  in dh_is_pubkey_valid()
120 	if (mpi_cmp_ui(y, 1) < 1 || mpi_cmp(y, ctx->p) >= 0)  in dh_is_pubkey_valid()
121 		return -EINVAL;  in dh_is_pubkey_valid()
124 	 * Step 2: Verify that 1 = y^q mod p  in dh_is_pubkey_valid()
126 	 * For the safe-prime groups q = (p - 1)/2.  in dh_is_pubkey_valid()
134 			return -ENOMEM;  in dh_is_pubkey_valid()
136 		q = mpi_alloc(mpi_get_nlimbs(ctx->p));  in dh_is_pubkey_valid()
139 			return -ENOMEM;  in dh_is_pubkey_valid()
143 		 * ->p is odd, so no need to explicitly subtract one  in dh_is_pubkey_valid()
146 		mpi_rshift(q, ctx->p, 1);  in dh_is_pubkey_valid()
148 		ret = mpi_powm(val, y, q, ctx->p);  in dh_is_pubkey_valid()
160 			return -EINVAL;  in dh_is_pubkey_valid()
175 		return -ENOMEM;  in dh_compute_value()
177 	if (unlikely(!ctx->xa)) {  in dh_compute_value()
178 		ret = -EINVAL;  in dh_compute_value()
182 	if (req->src) {  in dh_compute_value()
183 		base = mpi_read_raw_from_sgl(req->src, req->src_len);  in dh_compute_value()
185 			ret = -EINVAL;  in dh_compute_value()
192 		base = ctx->g;  in dh_compute_value()
200 		/* SP800-56A rev3 5.7.1.1 check: Validation of shared secret */  in dh_compute_value()
201 		if (req->src) {  in dh_compute_value()
206 				ret = -EBADMSG;  in dh_compute_value()
210 			/* z == p - 1 */  in dh_compute_value()
214 				ret = -ENOMEM;  in dh_compute_value()
218 			ret = mpi_sub_ui(pone, ctx->p, 1);  in dh_compute_value()
220 				ret = -EBADMSG;  in dh_compute_value()
227 		/* SP800-56A rev 3 5.6.2.1.3 key check */  in dh_compute_value()
230 				ret = -EAGAIN;  in dh_compute_value()
236 	ret = mpi_write_to_sgl(val, req->dst, req->dst_len, &sign);  in dh_compute_value()
241 		ret = -EBADMSG;  in dh_compute_value()
243 	if (req->src)  in dh_compute_value()
254 	return mpi_get_size(ctx->p);  in dh_max_size()
272 		.cra_driver_name = "dh-generic",
286 static const char safe_prime_g[]  = { 2 };
301 	crypto_drop_kpp(&ctx->dh_spawn);  in dh_safe_prime_free_instance()
317 	tfm_ctx->dh_tfm = crypto_spawn_kpp(&inst_ctx->dh_spawn);  in dh_safe_prime_init_tfm()
318 	if (IS_ERR(tfm_ctx->dh_tfm))  in dh_safe_prime_init_tfm()
319 		return PTR_ERR(tfm_ctx->dh_tfm);  in dh_safe_prime_init_tfm()
322 			     crypto_kpp_reqsize(tfm_ctx->dh_tfm));  in dh_safe_prime_init_tfm()
331 	crypto_free_kpp(tfm_ctx->dh_tfm);  in dh_safe_prime_exit_tfm()
338 	for (i = n; val && i > 0; --i) {  in __add_u64_to_be()
339 		u64 tmp = be64_to_cpu(dst[i - 1]);  in __add_u64_to_be()
343 		dst[i - 1] = cpu_to_be64(tmp);  in __add_u64_to_be()
358 	 * Generate a private key following NIST SP800-56Ar3,  in dh_safe_prime_gen_privkey()
362 	 * 2 * ->max_strength <= N <= log2(q) + 1 = ->p_size * 8 - 1  in dh_safe_prime_gen_privkey()
363 	 * with q = (p - 1) / 2 for the safe-prime groups.  in dh_safe_prime_gen_privkey()
369 	 * - N >= 256, in particular it is a multiple of 2^6 = 64  in dh_safe_prime_gen_privkey()
371 	 * - N < log2(q) + 1, i.e. N respects the upper bound.  in dh_safe_prime_gen_privkey()
373 	n = roundup_pow_of_two(2 * safe_prime->max_strength);  in dh_safe_prime_gen_privkey()
374 	WARN_ON_ONCE(n & ((1u << 6) - 1));  in dh_safe_prime_gen_privkey()
384 		return ERR_PTR(-ENOMEM);  in dh_safe_prime_gen_privkey()
390 	err = -EFAULT;  in dh_safe_prime_gen_privkey()
401 	 * 5.6.1.1.3, step 5 is implicit: 2^N < q and thus,  in dh_safe_prime_gen_privkey()
402 	 * M = min(2^N, q) = 2^N.  in dh_safe_prime_gen_privkey()
405 	 * key = (key[] mod (M - 1)) + 1 = (key[] mod (2^N - 1)) + 1.  in dh_safe_prime_gen_privkey()
408 	 * 2^N mod (2^N - 1) = 1 and thus, for any integer h,  in dh_safe_prime_gen_privkey()
409 	 * 2^N * h mod (2^N - 1) = h mod (2^N - 1) always holds.  in dh_safe_prime_gen_privkey()
410 	 * The big endian integer key[] composed of n + 1 64bit words  in dh_safe_prime_gen_privkey()
411 	 * may be written as key[] = h * 2^N + l, with h = key[0]  in dh_safe_prime_gen_privkey()
413 	 * corresponding to the remaining 2^N bits. With the remark  in dh_safe_prime_gen_privkey()
415 	 * h * 2^N + l mod (2^N - 1) = l + h mod (2^N - 1).  in dh_safe_prime_gen_privkey()
416 	 * As both, l and h are less than 2^N, their sum after  in dh_safe_prime_gen_privkey()
417 	 * this first reduction is guaranteed to be <= 2^(N + 1) - 2.  in dh_safe_prime_gen_privkey()
419 	 * h' * 2^N + l' with h' now either zero or one and if one,  in dh_safe_prime_gen_privkey()
420 	 * then l' <= 2^N - 2. Thus, all bits at positions >= N will  in dh_safe_prime_gen_privkey()
422 	 * h' * 2^N + l' mod (2^N - 1) = l' + h' mod (2^N - 1).  in dh_safe_prime_gen_privkey()
424 	 * l' + h' = 2^N - 1, i.e. that l' + h' mod (2^N - 1)  in dh_safe_prime_gen_privkey()
436 	 * The overflow bit o from the increment is either zero or  in dh_safe_prime_gen_privkey()
437 	 * one. If zero, key[1:n] holds the final result in big-endian  in dh_safe_prime_gen_privkey()
472 			return -EINVAL;  in dh_safe_prime_set_secret()
475 	params.p = inst_ctx->safe_prime->p;  in dh_safe_prime_set_secret()
476 	params.p_size = inst_ctx->safe_prime->p_size;  in dh_safe_prime_set_secret()
481 		key = dh_safe_prime_gen_privkey(inst_ctx->safe_prime,  in dh_safe_prime_set_secret()
491 		err = -ENOMEM;  in dh_safe_prime_set_secret()
499 	err = crypto_kpp_set_secret(tfm_ctx->dh_tfm, buf, buf_size);  in dh_safe_prime_set_secret()
519 	kpp_request_set_tfm(dh_req, tfm_ctx->dh_tfm);  in dh_safe_prime_prepare_dh_req()
520 	kpp_request_set_callback(dh_req, req->base.flags,  in dh_safe_prime_prepare_dh_req()
523 	kpp_request_set_input(dh_req, req->src, req->src_len);  in dh_safe_prime_prepare_dh_req()
524 	kpp_request_set_output(dh_req, req->dst, req->dst_len);  in dh_safe_prime_prepare_dh_req()
547 	return crypto_kpp_maxsize(tfm_ctx->dh_tfm);  in dh_safe_prime_max_size()
571 		return -ENOMEM;  in __dh_safe_prime_create()
575 	err = crypto_grab_kpp(&ctx->dh_spawn, kpp_crypto_instance(inst),  in __dh_safe_prime_create()
580 	err = -EINVAL;  in __dh_safe_prime_create()
581 	dh_alg = crypto_spawn_kpp_alg(&ctx->dh_spawn);  in __dh_safe_prime_create()
582 	if (strcmp(dh_alg->base.cra_name, "dh"))  in __dh_safe_prime_create()
585 	ctx->safe_prime = safe_prime;  in __dh_safe_prime_create()
588 				  tmpl->name, &dh_alg->base);  in __dh_safe_prime_create()
592 	inst->alg.set_secret = dh_safe_prime_set_secret;  in __dh_safe_prime_create()
593 	inst->alg.generate_public_key = dh_safe_prime_generate_public_key;  in __dh_safe_prime_create()
594 	inst->alg.compute_shared_secret = dh_safe_prime_compute_shared_secret;  in __dh_safe_prime_create()
595 	inst->alg.max_size = dh_safe_prime_max_size;  in __dh_safe_prime_create()
596 	inst->alg.init = dh_safe_prime_init_tfm;  in __dh_safe_prime_create()
597 	inst->alg.exit = dh_safe_prime_exit_tfm;  in __dh_safe_prime_create()
598 	inst->alg.base.cra_priority = dh_alg->base.cra_priority;  in __dh_safe_prime_create()
599 	inst->alg.base.cra_module = THIS_MODULE;  in __dh_safe_prime_create()
600 	inst->alg.base.cra_ctxsize = sizeof(struct dh_safe_prime_tfm_ctx);  in __dh_safe_prime_create()
602 	inst->free = dh_safe_prime_free_instance;  in __dh_safe_prime_create()
634 	"\x91\x72\xfe\x9c\xe9\x85\x83\xff\x8e\x4f\x12\x32\xee\xf2\x81\x83"
656 	"\x91\x72\xfe\x9c\xe9\x85\x83\xff\x8e\x4f\x12\x32\xee\xf2\x81\x83"
686 	"\x91\x72\xfe\x9c\xe9\x85\x83\xff\x8e\x4f\x12\x32\xee\xf2\x81\x83"
700 	"\x71\x35\xc8\x86\xef\xb4\x31\x8a\xed\x6a\x1e\x01\x2d\x9e\x68\x32"
724 	"\x91\x72\xfe\x9c\xe9\x85\x83\xff\x8e\x4f\x12\x32\xee\xf2\x81\x83"
738 	"\x71\x35\xc8\x86\xef\xb4\x31\x8a\xed\x6a\x1e\x01\x2d\x9e\x68\x32"
745 	"\x3b\xb4\x54\x32\x9b\x76\x24\xc8\x91\x7b\xdd\x64\xb1\xc0\xfd\x4c"
748 	"\xa5\x24\x71\xf7\xa9\xa9\x69\x10\xb8\x55\x32\x2e\xdb\x63\x40\xd8"
759 	"\xa4\x0e\x32\x9c\xd0\xe4\x0e\x65\xff\xff\xff\xff\xff\xff\xff\xff",
778 	"\x91\x72\xfe\x9c\xe9\x85\x83\xff\x8e\x4f\x12\x32\xee\xf2\x81\x83"
792 	"\x71\x35\xc8\x86\xef\xb4\x31\x8a\xed\x6a\x1e\x01\x2d\x9e\x68\x32"
799 	"\x3b\xb4\x54\x32\x9b\x76\x24\xc8\x91\x7b\xdd\x64\xb1\xc0\xfd\x4c"
802 	"\xa5\x24\x71\xf7\xa9\xa9\x69\x10\xb8\x55\x32\x2e\xdb\x63\x40\xd8"
813 	"\xa4\x0e\x32\x9c\xcf\xf4\x6a\xaa\x36\xad\x00\x4c\xf6\x00\xc8\x38"