X.509: support OSCCA certificate parse

The digital certificate format based on SM2 crypto algorithm as
specified in GM/T 0015-2012. It was published by State Encryption
Management Bureau, China.

This patch adds the OID object identifier defined by OSCCA. The
x509 certificate supports SM2-with-SM3 type certificate parsing.
It uses the standard elliptic curve public key, and the sm2
algorithm signs the hash generated by sm3.

Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Tested-by: Xufeng Zhang <yunbo.xufeng@linux.alibaba.com>
Reviewed-by: Vitaly Chikunov <vt@altlinux.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index 26ec20e..52c9b45 100644 (file)
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -234,6 +234,10 @@ int x509_note_pkey_algo(void *context, size_t hdrlen,
        case OID_gost2012Signature512:
                ctx->cert->sig->hash_algo = "streebog512";
                goto ecrdsa;
+
+       case OID_SM2_with_SM3:
+               ctx->cert->sig->hash_algo = "sm3";
+               goto sm2;
        }
 
 rsa_pkcs1:
@@ -246,6 +250,11 @@ ecrdsa:
        ctx->cert->sig->encoding = "raw";
        ctx->algo_oid = ctx->last_oid;
        return 0;
+sm2:
+       ctx->cert->sig->pkey_algo = "sm2";
+       ctx->cert->sig->encoding = "raw";
+       ctx->algo_oid = ctx->last_oid;
+       return 0;
 }
 
 /*
@@ -266,7 +275,8 @@ int x509_note_signature(void *context, size_t hdrlen,
        }
 
        if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0 ||
-           strcmp(ctx->cert->sig->pkey_algo, "ecrdsa") == 0) {
+           strcmp(ctx->cert->sig->pkey_algo, "ecrdsa") == 0 ||
+           strcmp(ctx->cert->sig->pkey_algo, "sm2") == 0) {
                /* Discard the BIT STRING metadata */
                if (vlen < 1 || *(const u8 *)value != 0)
                        return -EBADMSG;
@@ -451,13 +461,20 @@ int x509_extract_key_data(void *context, size_t hdrlen,
        struct x509_parse_context *ctx = context;
 
        ctx->key_algo = ctx->last_oid;
-       if (ctx->last_oid == OID_rsaEncryption)
+       switch (ctx->last_oid) {
+       case OID_rsaEncryption:
                ctx->cert->pub->pkey_algo = "rsa";
-       else if (ctx->last_oid == OID_gost2012PKey256 ||
-                ctx->last_oid == OID_gost2012PKey512)
+               break;
+       case OID_gost2012PKey256:
+       case OID_gost2012PKey512:
                ctx->cert->pub->pkey_algo = "ecrdsa";
-       else
+               break;
+       case OID_id_ecPublicKey:
+               ctx->cert->pub->pkey_algo = "sm2";
+               break;
+       default:
                return -ENOPKG;
+       }
 
        /* Discard the BIT STRING metadata */
        if (vlen < 1 || *(const u8 *)value != 0)

diff --git a/include/linux/oid_registry.h b/include/linux/oid_registry.h
index 657d6bf..4462ed2 100644 (file)
--- a/include/linux/oid_registry.h
+++ b/include/linux/oid_registry.h
@@ -107,6 +107,12 @@ enum OID {
        OID_gostTC26Sign512B,           /* 1.2.643.7.1.2.1.2.2 */
        OID_gostTC26Sign512C,           /* 1.2.643.7.1.2.1.2.3 */
 
+       /* OSCCA */
+       OID_sm2,                        /* 1.2.156.10197.1.301 */
+       OID_sm3,                        /* 1.2.156.10197.1.401 */
+       OID_SM2_with_SM3,               /* 1.2.156.10197.1.501 */
+       OID_sm3WithRSAEncryption,       /* 1.2.156.10197.1.504 */
+
        OID__NR
 };