1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* In-software asymmetric public-key crypto subtype
4 * See Documentation/crypto/asymmetric-keys.rst
6 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
7 * Written by David Howells (dhowells@redhat.com)
10 #define pr_fmt(fmt) "PKEY: "fmt
11 #include <crypto/akcipher.h>
12 #include <crypto/public_key.h>
13 #include <crypto/sig.h>
14 #include <keys/asymmetric-subtype.h>
15 #include <linux/asn1.h>
16 #include <linux/err.h>
17 #include <linux/kernel.h>
18 #include <linux/module.h>
19 #include <linux/seq_file.h>
20 #include <linux/slab.h>
21 #include <linux/string.h>
23 MODULE_DESCRIPTION("In-software asymmetric public-key subtype");
24 MODULE_AUTHOR("Red Hat, Inc.");
25 MODULE_LICENSE("GPL");
28 * Provide a part of a description of the key for /proc/keys.
30 static void public_key_describe(const struct key *asymmetric_key,
33 struct public_key *key = asymmetric_key->payload.data[asym_crypto];
36 seq_printf(m, "%s.%s", key->id_type, key->pkey_algo);
40 * Destroy a public key algorithm key.
42 void public_key_free(struct public_key *key)
45 kfree_sensitive(key->key);
50 EXPORT_SYMBOL_GPL(public_key_free);
53 * Destroy a public key algorithm key.
55 static void public_key_destroy(void *payload0, void *payload3)
57 public_key_free(payload0);
58 public_key_signature_free(payload3);
62 * Given a public_key, and an encoding and hash_algo to be used for signing
63 * and/or verification with that key, determine the name of the corresponding
64 * akcipher algorithm. Also check that encoding and hash_algo are allowed.
67 software_key_determine_akcipher(const struct public_key *pkey,
68 const char *encoding, const char *hash_algo,
69 char alg_name[CRYPTO_MAX_ALG_NAME], bool *sig,
70 enum kernel_pkey_operation op)
79 if (strcmp(pkey->pkey_algo, "rsa") == 0) {
81 * RSA signatures usually use EMSA-PKCS1-1_5 [RFC3447 sec 8.2].
83 if (strcmp(encoding, "pkcs1") == 0) {
86 n = snprintf(alg_name, CRYPTO_MAX_ALG_NAME,
90 *sig = op == kernel_pkey_sign ||
91 op == kernel_pkey_verify;
92 n = snprintf(alg_name, CRYPTO_MAX_ALG_NAME,
94 pkey->pkey_algo, hash_algo);
96 return n >= CRYPTO_MAX_ALG_NAME ? -EINVAL : 0;
98 if (strcmp(encoding, "raw") != 0)
101 * Raw RSA cannot differentiate between different hash
107 } else if (strncmp(pkey->pkey_algo, "ecdsa", 5) == 0) {
108 if (strcmp(encoding, "x962") != 0)
111 * ECDSA signatures are taken over a raw hash, so they don't
112 * differentiate between different hash algorithms. That means
113 * that the verifier should hard-code a specific hash algorithm.
114 * Unfortunately, in practice ECDSA is used with multiple SHAs,
115 * so we have to allow all of them and not just one.
119 if (strcmp(hash_algo, "sha1") != 0 &&
120 strcmp(hash_algo, "sha224") != 0 &&
121 strcmp(hash_algo, "sha256") != 0 &&
122 strcmp(hash_algo, "sha384") != 0 &&
123 strcmp(hash_algo, "sha512") != 0)
125 } else if (strcmp(pkey->pkey_algo, "sm2") == 0) {
126 if (strcmp(encoding, "raw") != 0)
130 if (strcmp(hash_algo, "sm3") != 0)
132 } else if (strcmp(pkey->pkey_algo, "ecrdsa") == 0) {
133 if (strcmp(encoding, "raw") != 0)
137 if (strcmp(hash_algo, "streebog256") != 0 &&
138 strcmp(hash_algo, "streebog512") != 0)
141 /* Unknown public key algorithm */
144 if (strscpy(alg_name, pkey->pkey_algo, CRYPTO_MAX_ALG_NAME) < 0)
149 static u8 *pkey_pack_u32(u8 *dst, u32 val)
151 memcpy(dst, &val, sizeof(val));
152 return dst + sizeof(val);
156 * Query information about a key.
158 static int software_key_query(const struct kernel_pkey_params *params,
159 struct kernel_pkey_query *info)
161 struct crypto_akcipher *tfm;
162 struct public_key *pkey = params->key->payload.data[asym_crypto];
163 char alg_name[CRYPTO_MAX_ALG_NAME];
164 struct crypto_sig *sig;
169 ret = software_key_determine_akcipher(pkey, params->encoding,
170 params->hash_algo, alg_name,
171 &issig, kernel_pkey_sign);
175 key = kmalloc(pkey->keylen + sizeof(u32) * 2 + pkey->paramlen,
180 memcpy(key, pkey->key, pkey->keylen);
181 ptr = key + pkey->keylen;
182 ptr = pkey_pack_u32(ptr, pkey->algo);
183 ptr = pkey_pack_u32(ptr, pkey->paramlen);
184 memcpy(ptr, pkey->params, pkey->paramlen);
187 sig = crypto_alloc_sig(alg_name, 0, 0);
193 if (pkey->key_is_private)
194 ret = crypto_sig_set_privkey(sig, key, pkey->keylen);
196 ret = crypto_sig_set_pubkey(sig, key, pkey->keylen);
200 len = crypto_sig_maxsize(sig);
202 info->supported_ops = KEYCTL_SUPPORTS_VERIFY;
203 if (pkey->key_is_private)
204 info->supported_ops |= KEYCTL_SUPPORTS_SIGN;
206 if (strcmp(params->encoding, "pkcs1") == 0) {
207 info->supported_ops |= KEYCTL_SUPPORTS_ENCRYPT;
208 if (pkey->key_is_private)
209 info->supported_ops |= KEYCTL_SUPPORTS_DECRYPT;
212 tfm = crypto_alloc_akcipher(alg_name, 0, 0);
218 if (pkey->key_is_private)
219 ret = crypto_akcipher_set_priv_key(tfm, key, pkey->keylen);
221 ret = crypto_akcipher_set_pub_key(tfm, key, pkey->keylen);
225 len = crypto_akcipher_maxsize(tfm);
227 info->supported_ops = KEYCTL_SUPPORTS_ENCRYPT;
228 if (pkey->key_is_private)
229 info->supported_ops |= KEYCTL_SUPPORTS_DECRYPT;
232 info->key_size = len * 8;
234 if (strncmp(pkey->pkey_algo, "ecdsa", 5) == 0) {
236 * ECDSA key sizes are much smaller than RSA, and thus could
237 * operate on (hashed) inputs that are larger than key size.
238 * For example SHA384-hashed input used with secp256r1
239 * based keys. Set max_data_size to be at least as large as
240 * the largest supported hash size (SHA512)
242 info->max_data_size = 64;
245 * Verify takes ECDSA-Sig (described in RFC 5480) as input,
246 * which is actually 2 'key_size'-bit integers encoded in
247 * ASN.1. Account for the ASN.1 encoding overhead here.
249 info->max_sig_size = 2 * (len + 3) + 2;
251 info->max_data_size = len;
252 info->max_sig_size = len;
255 info->max_enc_size = len;
256 info->max_dec_size = len;
262 crypto_free_sig(sig);
264 crypto_free_akcipher(tfm);
266 kfree_sensitive(key);
267 pr_devel("<==%s() = %d\n", __func__, ret);
272 * Do encryption, decryption and signing ops.
274 static int software_key_eds_op(struct kernel_pkey_params *params,
275 const void *in, void *out)
277 const struct public_key *pkey = params->key->payload.data[asym_crypto];
278 char alg_name[CRYPTO_MAX_ALG_NAME];
279 struct crypto_akcipher *tfm;
280 struct crypto_sig *sig;
286 pr_devel("==>%s()\n", __func__);
288 ret = software_key_determine_akcipher(pkey, params->encoding,
289 params->hash_algo, alg_name,
294 key = kmalloc(pkey->keylen + sizeof(u32) * 2 + pkey->paramlen,
299 memcpy(key, pkey->key, pkey->keylen);
300 ptr = key + pkey->keylen;
301 ptr = pkey_pack_u32(ptr, pkey->algo);
302 ptr = pkey_pack_u32(ptr, pkey->paramlen);
303 memcpy(ptr, pkey->params, pkey->paramlen);
306 sig = crypto_alloc_sig(alg_name, 0, 0);
312 if (pkey->key_is_private)
313 ret = crypto_sig_set_privkey(sig, key, pkey->keylen);
315 ret = crypto_sig_set_pubkey(sig, key, pkey->keylen);
319 ksz = crypto_sig_maxsize(sig);
321 tfm = crypto_alloc_akcipher(alg_name, 0, 0);
327 if (pkey->key_is_private)
328 ret = crypto_akcipher_set_priv_key(tfm, key, pkey->keylen);
330 ret = crypto_akcipher_set_pub_key(tfm, key, pkey->keylen);
334 ksz = crypto_akcipher_maxsize(tfm);
339 /* Perform the encryption calculation. */
340 switch (params->op) {
341 case kernel_pkey_encrypt:
344 ret = crypto_akcipher_sync_encrypt(tfm, in, params->in_len,
345 out, params->out_len);
347 case kernel_pkey_decrypt:
350 ret = crypto_akcipher_sync_decrypt(tfm, in, params->in_len,
351 out, params->out_len);
353 case kernel_pkey_sign:
356 ret = crypto_sig_sign(sig, in, params->in_len,
357 out, params->out_len);
368 crypto_free_sig(sig);
370 crypto_free_akcipher(tfm);
372 kfree_sensitive(key);
373 pr_devel("<==%s() = %d\n", __func__, ret);
378 * Verify a signature using a public key.
380 int public_key_verify_signature(const struct public_key *pkey,
381 const struct public_key_signature *sig)
383 char alg_name[CRYPTO_MAX_ALG_NAME];
384 struct crypto_sig *tfm;
389 pr_devel("==>%s()\n", __func__);
396 * If the signature specifies a public key algorithm, it *must* match
397 * the key's actual public key algorithm.
399 * Small exception: ECDSA signatures don't specify the curve, but ECDSA
400 * keys do. So the strings can mismatch slightly in that case:
401 * "ecdsa-nist-*" for the key, but "ecdsa" for the signature.
403 if (sig->pkey_algo) {
404 if (strcmp(pkey->pkey_algo, sig->pkey_algo) != 0 &&
405 (strncmp(pkey->pkey_algo, "ecdsa-", 6) != 0 ||
406 strcmp(sig->pkey_algo, "ecdsa") != 0))
407 return -EKEYREJECTED;
410 ret = software_key_determine_akcipher(pkey, sig->encoding,
411 sig->hash_algo, alg_name,
412 &issig, kernel_pkey_verify);
416 tfm = crypto_alloc_sig(alg_name, 0, 0);
420 key = kmalloc(pkey->keylen + sizeof(u32) * 2 + pkey->paramlen,
427 memcpy(key, pkey->key, pkey->keylen);
428 ptr = key + pkey->keylen;
429 ptr = pkey_pack_u32(ptr, pkey->algo);
430 ptr = pkey_pack_u32(ptr, pkey->paramlen);
431 memcpy(ptr, pkey->params, pkey->paramlen);
433 if (pkey->key_is_private)
434 ret = crypto_sig_set_privkey(tfm, key, pkey->keylen);
436 ret = crypto_sig_set_pubkey(tfm, key, pkey->keylen);
440 ret = crypto_sig_verify(tfm, sig->s, sig->s_size,
441 sig->digest, sig->digest_size);
444 kfree_sensitive(key);
446 crypto_free_sig(tfm);
447 pr_devel("<==%s() = %d\n", __func__, ret);
448 if (WARN_ON_ONCE(ret > 0))
452 EXPORT_SYMBOL_GPL(public_key_verify_signature);
454 static int public_key_verify_signature_2(const struct key *key,
455 const struct public_key_signature *sig)
457 const struct public_key *pk = key->payload.data[asym_crypto];
458 return public_key_verify_signature(pk, sig);
462 * Public key algorithm asymmetric key subtype
464 struct asymmetric_key_subtype public_key_subtype = {
465 .owner = THIS_MODULE,
466 .name = "public_key",
467 .name_len = sizeof("public_key") - 1,
468 .describe = public_key_describe,
469 .destroy = public_key_destroy,
470 .query = software_key_query,
471 .eds_op = software_key_eds_op,
472 .verify_signature = public_key_verify_signature_2,
474 EXPORT_SYMBOL_GPL(public_key_subtype);