1 /* SPDX-License-Identifier: GPL-2.0-or-later */
3 * SM2 asymmetric public-key algorithm
4 * as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012 SM2 and
5 * described at https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
7 * Copyright (c) 2020, Alibaba Group.
8 * Authors: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
11 #include <linux/module.h>
12 #include <linux/mpi.h>
13 #include <crypto/internal/akcipher.h>
14 #include <crypto/akcipher.h>
15 #include <crypto/hash.h>
16 #include <crypto/sm3_base.h>
17 #include <crypto/rng.h>
18 #include <crypto/sm2.h>
19 #include "sm2signature.asn1.h"
21 #define MPI_NBYTES(m) ((mpi_get_nbits(m) + 7) / 8)
23 struct ecc_domain_parms {
24 const char *desc; /* Description of the curve. */
25 unsigned int nbits; /* Number of bits. */
26 unsigned int fips:1; /* True if this is a FIPS140-2 approved curve */
28 /* The model describing this curve. This is mainly used to select
31 enum gcry_mpi_ec_models model;
33 /* The actual ECC dialect used. This is used for curve specific
34 * optimizations and to select encodings etc.
36 enum ecc_dialects dialect;
38 const char *p; /* The prime defining the field. */
39 const char *a, *b; /* The coefficients. For Twisted Edwards
40 * Curves b is used for d. For Montgomery
41 * Curves (a,b) has ((A-2)/4,B^-1).
43 const char *n; /* The order of the base point. */
44 const char *g_x, *g_y; /* Base point. */
45 unsigned int h; /* Cofactor. */
48 static const struct ecc_domain_parms sm2_ecp = {
52 .model = MPI_EC_WEIERSTRASS,
53 .dialect = ECC_DIALECT_STANDARD,
54 .p = "0xfffffffeffffffffffffffffffffffffffffffff00000000ffffffffffffffff",
55 .a = "0xfffffffeffffffffffffffffffffffffffffffff00000000fffffffffffffffc",
56 .b = "0x28e9fa9e9d9f5e344d5a9e4bcf6509a7f39789f515ab8f92ddbcbd414d940e93",
57 .n = "0xfffffffeffffffffffffffffffffffff7203df6b21c6052b53bbf40939d54123",
58 .g_x = "0x32c4ae2c1f1981195f9904466a39c9948fe30bbff2660be1715a4589334c74c7",
59 .g_y = "0xbc3736a2f4f6779c59bdcee36b692153d0a9877cc62a474002df32e52139f0a0",
63 static int sm2_ec_ctx_init(struct mpi_ec_ctx *ec)
65 const struct ecc_domain_parms *ecp = &sm2_ecp;
70 p = mpi_scanval(ecp->p);
71 a = mpi_scanval(ecp->a);
72 b = mpi_scanval(ecp->b);
76 x = mpi_scanval(ecp->g_x);
77 y = mpi_scanval(ecp->g_y);
82 /* mpi_ec_setup_elliptic_curve */
83 ec->G = mpi_point_new(0);
89 mpi_set_ui(ec->G->z, 1);
92 ec->n = mpi_scanval(ecp->n);
94 mpi_point_release(ec->G);
100 mpi_ec_init(ec, ecp->model, ecp->dialect, 0, p, a, b);
115 static void sm2_ec_ctx_deinit(struct mpi_ec_ctx *ec)
119 memset(ec, 0, sizeof(*ec));
122 static int sm2_ec_ctx_reset(struct mpi_ec_ctx *ec)
124 sm2_ec_ctx_deinit(ec);
125 return sm2_ec_ctx_init(ec);
128 /* RESULT must have been initialized and is set on success to the
129 * point given by VALUE.
131 static int sm2_ecc_os2ec(MPI_POINT result, MPI value)
135 const unsigned char *buf;
136 unsigned char *buf_memory;
139 n = (mpi_get_nbits(value)+7)/8;
140 buf_memory = kmalloc(n, GFP_KERNEL);
141 rc = mpi_print(GCRYMPI_FMT_USG, buf_memory, n, &n, value);
154 return -EINVAL; /* No support for point compression. */
161 x = mpi_read_raw_data(buf + 1, n);
166 y = mpi_read_raw_data(buf + 1 + n, n);
176 mpi_set(result->x, x);
177 mpi_set(result->y, y);
178 mpi_set_ui(result->z, 1);
186 struct sm2_signature_ctx {
191 int sm2_get_signature_r(void *context, size_t hdrlen, unsigned char tag,
192 const void *value, size_t vlen)
194 struct sm2_signature_ctx *sig = context;
199 sig->sig_r = mpi_read_raw_data(value, vlen);
206 int sm2_get_signature_s(void *context, size_t hdrlen, unsigned char tag,
207 const void *value, size_t vlen)
209 struct sm2_signature_ctx *sig = context;
214 sig->sig_s = mpi_read_raw_data(value, vlen);
221 static int sm2_z_digest_update(struct shash_desc *desc,
222 MPI m, unsigned int pbytes)
224 static const unsigned char zero[32];
228 in = mpi_get_buffer(m, &inlen, NULL);
232 if (inlen < pbytes) {
233 /* padding with zero */
234 crypto_sm3_update(desc, zero, pbytes - inlen);
235 crypto_sm3_update(desc, in, inlen);
236 } else if (inlen > pbytes) {
237 /* skip the starting zero */
238 crypto_sm3_update(desc, in + inlen - pbytes, pbytes);
240 crypto_sm3_update(desc, in, inlen);
247 static int sm2_z_digest_update_point(struct shash_desc *desc,
248 MPI_POINT point, struct mpi_ec_ctx *ec, unsigned int pbytes)
256 if (!mpi_ec_get_affine(x, y, point, ec) &&
257 !sm2_z_digest_update(desc, x, pbytes) &&
258 !sm2_z_digest_update(desc, y, pbytes))
266 int sm2_compute_z_digest(struct crypto_akcipher *tfm,
267 const unsigned char *id, size_t id_len,
268 unsigned char dgst[SM3_DIGEST_SIZE])
270 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
272 unsigned char entl[2];
273 SHASH_DESC_ON_STACK(desc, NULL);
276 if (id_len > (USHRT_MAX / 8) || !ec->Q)
279 bits_len = (uint16_t)(id_len * 8);
280 entl[0] = bits_len >> 8;
281 entl[1] = bits_len & 0xff;
283 pbytes = MPI_NBYTES(ec->p);
285 /* ZA = H256(ENTLA | IDA | a | b | xG | yG | xA | yA) */
287 crypto_sm3_update(desc, entl, 2);
288 crypto_sm3_update(desc, id, id_len);
290 if (sm2_z_digest_update(desc, ec->a, pbytes) ||
291 sm2_z_digest_update(desc, ec->b, pbytes) ||
292 sm2_z_digest_update_point(desc, ec->G, ec, pbytes) ||
293 sm2_z_digest_update_point(desc, ec->Q, ec, pbytes))
296 crypto_sm3_final(desc, dgst);
299 EXPORT_SYMBOL(sm2_compute_z_digest);
301 static int _sm2_verify(struct mpi_ec_ctx *ec, MPI hash, MPI sig_r, MPI sig_s)
304 struct gcry_mpi_point sG, tP;
306 MPI x1 = NULL, y1 = NULL;
314 /* r, s in [1, n-1] */
315 if (mpi_cmp_ui(sig_r, 1) < 0 || mpi_cmp(sig_r, ec->n) > 0 ||
316 mpi_cmp_ui(sig_s, 1) < 0 || mpi_cmp(sig_s, ec->n) > 0) {
320 /* t = (r + s) % n, t == 0 */
321 mpi_addm(t, sig_r, sig_s, ec->n);
322 if (mpi_cmp_ui(t, 0) == 0)
325 /* sG + tP = (x1, y1) */
327 mpi_ec_mul_point(&sG, sig_s, ec->G, ec);
328 mpi_ec_mul_point(&tP, t, ec->Q, ec);
329 mpi_ec_add_points(&sG, &sG, &tP, ec);
330 if (mpi_ec_get_affine(x1, y1, &sG, ec))
333 /* R = (e + x1) % n */
334 mpi_addm(t, hash, x1, ec->n);
338 if (mpi_cmp(t, sig_r))
344 mpi_point_free_parts(&sG);
345 mpi_point_free_parts(&tP);
353 static int sm2_verify(struct akcipher_request *req)
355 struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
356 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
357 unsigned char *buffer;
358 struct sm2_signature_ctx sig;
362 if (unlikely(!ec->Q))
365 buffer = kmalloc(req->src_len + req->dst_len, GFP_KERNEL);
369 sg_pcopy_to_buffer(req->src,
370 sg_nents_for_len(req->src, req->src_len + req->dst_len),
371 buffer, req->src_len + req->dst_len, 0);
375 ret = asn1_ber_decoder(&sm2signature_decoder, &sig,
376 buffer, req->src_len);
381 hash = mpi_read_raw_data(buffer + req->src_len, req->dst_len);
385 ret = _sm2_verify(ec, hash, sig.sig_r, sig.sig_s);
395 static int sm2_set_pub_key(struct crypto_akcipher *tfm,
396 const void *key, unsigned int keylen)
398 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
402 rc = sm2_ec_ctx_reset(ec);
406 ec->Q = mpi_point_new(0);
410 /* include the uncompressed flag '0x04' */
412 a = mpi_read_raw_data(key, keylen);
417 rc = sm2_ecc_os2ec(ec->Q, a);
425 mpi_point_release(ec->Q);
430 static unsigned int sm2_max_size(struct crypto_akcipher *tfm)
432 /* Unlimited max size */
436 static int sm2_init_tfm(struct crypto_akcipher *tfm)
438 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
440 return sm2_ec_ctx_init(ec);
443 static void sm2_exit_tfm(struct crypto_akcipher *tfm)
445 struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
447 sm2_ec_ctx_deinit(ec);
450 static struct akcipher_alg sm2 = {
451 .verify = sm2_verify,
452 .set_pub_key = sm2_set_pub_key,
453 .max_size = sm2_max_size,
454 .init = sm2_init_tfm,
455 .exit = sm2_exit_tfm,
458 .cra_driver_name = "sm2-generic",
460 .cra_module = THIS_MODULE,
461 .cra_ctxsize = sizeof(struct mpi_ec_ctx),
465 static int sm2_init(void)
467 return crypto_register_akcipher(&sm2);
470 static void sm2_exit(void)
472 crypto_unregister_akcipher(&sm2);
475 subsys_initcall(sm2_init);
476 module_exit(sm2_exit);
478 MODULE_LICENSE("GPL");
479 MODULE_AUTHOR("Tianjia Zhang <tianjia.zhang@linux.alibaba.com>");
480 MODULE_DESCRIPTION("SM2 generic algorithm");
481 MODULE_ALIAS_CRYPTO("sm2-generic");