mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-01-11 17:10:13 +00:00
1e562deace
A sig_alg backend has just been introduced with the intent of moving all
asymmetric sign/verify algorithms to it one by one.
Migrate the sign/verify operations from rsa-pkcs1pad.c to a separate
rsassa-pkcs1.c which uses the new backend.
Consequently there are now two templates which build on the "rsa"
akcipher_alg:
* The existing "pkcs1pad" template, which is instantiated as an
akcipher_instance and retains the encrypt/decrypt operations of
RSAES-PKCS1-v1_5 (RFC 8017 sec 7.2).
* The new "pkcs1" template, which is instantiated as a sig_instance
and contains the sign/verify operations of RSASSA-PKCS1-v1_5
(RFC 8017 sec 8.2).
In a separate step, rsa-pkcs1pad.c could optionally be renamed to
rsaes-pkcs1.c for clarity. Additional "oaep" and "pss" templates
could be added for RSAES-OAEP and RSASSA-PSS.
Note that it's currently allowed to allocate a "pkcs1pad(rsa)" transform
without specifying a hash algorithm. That makes sense if the transform
is only used for encrypt/decrypt and continues to be supported. But for
sign/verify, such transforms previously did not insert the Full Hash
Prefix into the padding. The resulting message encoding was incompliant
with EMSA-PKCS1-v1_5 (RFC 8017 sec 9.2) and therefore nonsensical.
From here on in, it is no longer allowed to allocate a transform without
specifying a hash algorithm if the transform is used for sign/verify
operations. This simplifies the code because the insertion of the Full
Hash Prefix is no longer optional, so various "if (digest_info)" clauses
can be removed.
There has been a previous attempt to forbid transform allocation without
specifying a hash algorithm, namely by commit c0d20d22e0ad ("crypto:
rsa-pkcs1pad - Require hash to be present"). It had to be rolled back
with commit b3a8c8a5ebb5 ("crypto: rsa-pkcs1pad: Allow hash to be
optional [ver #2]"), presumably because it broke allocation of a
transform which was solely used for encrypt/decrypt, not sign/verify.
Avoid such breakage by allowing transform allocation for encrypt/decrypt
with and without specifying a hash algorithm (and simply ignoring the
hash algorithm in the former case).
So again, specifying a hash algorithm is now mandatory for sign/verify,
but optional and ignored for encrypt/decrypt.
The new sig_alg API uses kernel buffers instead of sglists, which
avoids the overhead of copying signature and digest from sglists back
into kernel buffers. rsassa-pkcs1.c is thus simplified quite a bit.
sig_alg is always synchronous, whereas the underlying "rsa" akcipher_alg
may be asynchronous. So await the result of the akcipher_alg, similar
to crypto_akcipher_sync_{en,de}crypt().
As part of the migration, rename "rsa_digest_info" to "hash_prefix" to
adhere to the spec language in RFC 9580. Otherwise keep the code
unmodified wherever possible to ease reviewing and bisecting. Leave
several simplification and hardening opportunities to separate commits.
rsassa-pkcs1.c uses modern __free() syntax for allocation of buffers
which need to be freed by kfree_sensitive(), hence a DEFINE_FREE()
clause for kfree_sensitive() is introduced herein as a byproduct.
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
87 lines
2.2 KiB
C
87 lines
2.2 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* RSA internal helpers
|
|
*
|
|
* Copyright (c) 2015, Intel Corporation
|
|
* Authors: Tadeusz Struk <tadeusz.struk@intel.com>
|
|
*/
|
|
#ifndef _RSA_HELPER_
|
|
#define _RSA_HELPER_
|
|
#include <linux/types.h>
|
|
#include <crypto/akcipher.h>
|
|
|
|
/**
|
|
* rsa_key - RSA key structure
|
|
* @n : RSA modulus raw byte stream
|
|
* @e : RSA public exponent raw byte stream
|
|
* @d : RSA private exponent raw byte stream
|
|
* @p : RSA prime factor p of n raw byte stream
|
|
* @q : RSA prime factor q of n raw byte stream
|
|
* @dp : RSA exponent d mod (p - 1) raw byte stream
|
|
* @dq : RSA exponent d mod (q - 1) raw byte stream
|
|
* @qinv : RSA CRT coefficient q^(-1) mod p raw byte stream
|
|
* @n_sz : length in bytes of RSA modulus n
|
|
* @e_sz : length in bytes of RSA public exponent
|
|
* @d_sz : length in bytes of RSA private exponent
|
|
* @p_sz : length in bytes of p field
|
|
* @q_sz : length in bytes of q field
|
|
* @dp_sz : length in bytes of dp field
|
|
* @dq_sz : length in bytes of dq field
|
|
* @qinv_sz : length in bytes of qinv field
|
|
*/
|
|
struct rsa_key {
|
|
const u8 *n;
|
|
const u8 *e;
|
|
const u8 *d;
|
|
const u8 *p;
|
|
const u8 *q;
|
|
const u8 *dp;
|
|
const u8 *dq;
|
|
const u8 *qinv;
|
|
size_t n_sz;
|
|
size_t e_sz;
|
|
size_t d_sz;
|
|
size_t p_sz;
|
|
size_t q_sz;
|
|
size_t dp_sz;
|
|
size_t dq_sz;
|
|
size_t qinv_sz;
|
|
};
|
|
|
|
int rsa_parse_pub_key(struct rsa_key *rsa_key, const void *key,
|
|
unsigned int key_len);
|
|
|
|
int rsa_parse_priv_key(struct rsa_key *rsa_key, const void *key,
|
|
unsigned int key_len);
|
|
|
|
#define RSA_PUB (true)
|
|
#define RSA_PRIV (false)
|
|
|
|
static inline int rsa_set_key(struct crypto_akcipher *child,
|
|
unsigned int *key_size, bool is_pubkey,
|
|
const void *key, unsigned int keylen)
|
|
{
|
|
int err;
|
|
|
|
*key_size = 0;
|
|
|
|
if (is_pubkey)
|
|
err = crypto_akcipher_set_pub_key(child, key, keylen);
|
|
else
|
|
err = crypto_akcipher_set_priv_key(child, key, keylen);
|
|
if (err)
|
|
return err;
|
|
|
|
/* Find out new modulus size from rsa implementation */
|
|
err = crypto_akcipher_maxsize(child);
|
|
if (err > PAGE_SIZE)
|
|
return -ENOTSUPP;
|
|
|
|
*key_size = err;
|
|
return 0;
|
|
}
|
|
|
|
extern struct crypto_template rsa_pkcs1pad_tmpl;
|
|
extern struct crypto_template rsassa_pkcs1_tmpl;
|
|
#endif
|