public_key.c

  1// SPDX-License-Identifier: GPL-2.0-or-later
  2/* In-software asymmetric public-key crypto subtype
  3 *
  4 * See Documentation/crypto/asymmetric-keys.rst
  5 *
  6 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
  7 * Written by David Howells (dhowells@redhat.com)
  8 */
  9
 10#define pr_fmt(fmt) "PKEY: "fmt
 11#include <crypto/akcipher.h>
 12#include <crypto/public_key.h>
 13#include <crypto/sig.h>
 14#include <keys/asymmetric-subtype.h>
 15#include <linux/asn1.h>
 16#include <linux/err.h>
 17#include <linux/kernel.h>
 18#include <linux/module.h>
 19#include <linux/seq_file.h>
 20#include <linux/slab.h>
 21#include <linux/string.h>
 22
 23MODULE_DESCRIPTION("In-software asymmetric public-key subtype");
 24MODULE_AUTHOR("Red Hat, Inc.");
 25MODULE_LICENSE("GPL");
 26
 27/*
 28 * Provide a part of a description of the key for /proc/keys.
 29 */
 30static void public_key_describe(const struct key *asymmetric_key,
 31				struct seq_file *m)
 32{
 33	struct public_key *key = asymmetric_key->payload.data[asym_crypto];
 34
 35	if (key)
 36		seq_printf(m, "%s.%s", key->id_type, key->pkey_algo);
 37}
 38
 39/*
 40 * Destroy a public key algorithm key.
 41 */
 42void public_key_free(struct public_key *key)
 43{
 44	if (key) {
 45		kfree_sensitive(key->key);
 46		kfree(key->params);
 47		kfree(key);
 48	}
 49}
 50EXPORT_SYMBOL_GPL(public_key_free);
 51
 52/*
 53 * Destroy a public key algorithm key.
 54 */
 55static void public_key_destroy(void *payload0, void *payload3)
 56{
 57	public_key_free(payload0);
 58	public_key_signature_free(payload3);
 59}
 60
 61/*
 62 * Given a public_key, and an encoding and hash_algo to be used for signing
 63 * and/or verification with that key, determine the name of the corresponding
 64 * akcipher algorithm.  Also check that encoding and hash_algo are allowed.
 65 */
 66static int
 67software_key_determine_akcipher(const struct public_key *pkey,
 68				const char *encoding, const char *hash_algo,
 69				char alg_name[CRYPTO_MAX_ALG_NAME], bool *sig,
 70				enum kernel_pkey_operation op)
 71{
 72	int n;
 73
 74	*sig = true;
 75
 76	if (!encoding)
 77		return -EINVAL;
 78
 79	if (strcmp(pkey->pkey_algo, "rsa") == 0) {
 80		/*
 81		 * RSA signatures usually use EMSA-PKCS1-1_5 [RFC3447 sec 8.2].
 82		 */
 83		if (strcmp(encoding, "pkcs1") == 0) {
 84			*sig = op == kernel_pkey_sign ||
 85			       op == kernel_pkey_verify;
 86			if (!*sig) {
 87				/*
 88				 * For encrypt/decrypt, hash_algo is not used
 89				 * but allowed to be set for historic reasons.
 90				 */
 91				n = snprintf(alg_name, CRYPTO_MAX_ALG_NAME,
 92					     "pkcs1pad(%s)",
 93					     pkey->pkey_algo);
 94			} else {
 95				if (!hash_algo)
 96					hash_algo = "none";
 97				n = snprintf(alg_name, CRYPTO_MAX_ALG_NAME,
 98					     "pkcs1(%s,%s)",
 99					     pkey->pkey_algo, hash_algo);
100			}
101			return n >= CRYPTO_MAX_ALG_NAME ? -EINVAL : 0;
102		}
103		if (strcmp(encoding, "raw") != 0)
104			return -EINVAL;
105		/*
106		 * Raw RSA cannot differentiate between different hash
107		 * algorithms.
108		 */
109		if (hash_algo)
110			return -EINVAL;
111		*sig = false;
112	} else if (strncmp(pkey->pkey_algo, "ecdsa", 5) == 0) {
113		if (strcmp(encoding, "x962") != 0 &&
114		    strcmp(encoding, "p1363") != 0)
115			return -EINVAL;
116		/*
117		 * ECDSA signatures are taken over a raw hash, so they don't
118		 * differentiate between different hash algorithms.  That means
119		 * that the verifier should hard-code a specific hash algorithm.
120		 * Unfortunately, in practice ECDSA is used with multiple SHAs,
121		 * so we have to allow all of them and not just one.
122		 */
123		if (!hash_algo)
124			return -EINVAL;
125		if (strcmp(hash_algo, "sha1") != 0 &&
126		    strcmp(hash_algo, "sha224") != 0 &&
127		    strcmp(hash_algo, "sha256") != 0 &&
128		    strcmp(hash_algo, "sha384") != 0 &&
129		    strcmp(hash_algo, "sha512") != 0 &&
130		    strcmp(hash_algo, "sha3-256") != 0 &&
131		    strcmp(hash_algo, "sha3-384") != 0 &&
132		    strcmp(hash_algo, "sha3-512") != 0)
133			return -EINVAL;
134		n = snprintf(alg_name, CRYPTO_MAX_ALG_NAME, "%s(%s)",
135			     encoding, pkey->pkey_algo);
136		return n >= CRYPTO_MAX_ALG_NAME ? -EINVAL : 0;
137	} else if (strcmp(pkey->pkey_algo, "ecrdsa") == 0) {
138		if (strcmp(encoding, "raw") != 0)
139			return -EINVAL;
140		if (!hash_algo)
141			return -EINVAL;
142		if (strcmp(hash_algo, "streebog256") != 0 &&
143		    strcmp(hash_algo, "streebog512") != 0)
144			return -EINVAL;
145	} else {
146		/* Unknown public key algorithm */
147		return -ENOPKG;
148	}
149	if (strscpy(alg_name, pkey->pkey_algo, CRYPTO_MAX_ALG_NAME) < 0)
150		return -EINVAL;
151	return 0;
152}
153
154static u8 *pkey_pack_u32(u8 *dst, u32 val)
155{
156	memcpy(dst, &val, sizeof(val));
157	return dst + sizeof(val);
158}
159
160/*
161 * Query information about a key.
162 */
163static int software_key_query(const struct kernel_pkey_params *params,
164			      struct kernel_pkey_query *info)
165{
166	struct public_key *pkey = params->key->payload.data[asym_crypto];
167	char alg_name[CRYPTO_MAX_ALG_NAME];
168	u8 *key, *ptr;
169	int ret, len;
170	bool issig;
171
172	ret = software_key_determine_akcipher(pkey, params->encoding,
173					      params->hash_algo, alg_name,
174					      &issig, kernel_pkey_sign);
175	if (ret < 0)
176		return ret;
177
178	key = kmalloc(pkey->keylen + sizeof(u32) * 2 + pkey->paramlen,
179		      GFP_KERNEL);
180	if (!key)
181		return -ENOMEM;
182
183	memcpy(key, pkey->key, pkey->keylen);
184	ptr = key + pkey->keylen;
185	ptr = pkey_pack_u32(ptr, pkey->algo);
186	ptr = pkey_pack_u32(ptr, pkey->paramlen);
187	memcpy(ptr, pkey->params, pkey->paramlen);
188
189	memset(info, 0, sizeof(*info));
190
191	if (issig) {
192		struct crypto_sig *sig;
193
194		sig = crypto_alloc_sig(alg_name, 0, 0);
195		if (IS_ERR(sig)) {
196			ret = PTR_ERR(sig);
197			goto error_free_key;
198		}
199
200		if (pkey->key_is_private)
201			ret = crypto_sig_set_privkey(sig, key, pkey->keylen);
202		else
203			ret = crypto_sig_set_pubkey(sig, key, pkey->keylen);
204		if (ret < 0)
205			goto error_free_sig;
206
207		len = crypto_sig_keysize(sig);
208		info->key_size = len;
209		info->max_sig_size = crypto_sig_maxsize(sig);
210		info->max_data_size = crypto_sig_digestsize(sig);
211
212		info->supported_ops = KEYCTL_SUPPORTS_VERIFY;
213		if (pkey->key_is_private)
214			info->supported_ops |= KEYCTL_SUPPORTS_SIGN;
215
216		if (strcmp(params->encoding, "pkcs1") == 0) {
217			info->max_enc_size = len / BITS_PER_BYTE;
218			info->max_dec_size = len / BITS_PER_BYTE;
219
220			info->supported_ops |= KEYCTL_SUPPORTS_ENCRYPT;
221			if (pkey->key_is_private)
222				info->supported_ops |= KEYCTL_SUPPORTS_DECRYPT;
223		}
224
225error_free_sig:
226		crypto_free_sig(sig);
227	} else {
228		struct crypto_akcipher *tfm;
229
230		tfm = crypto_alloc_akcipher(alg_name, 0, 0);
231		if (IS_ERR(tfm)) {
232			ret = PTR_ERR(tfm);
233			goto error_free_key;
234		}
235
236		if (pkey->key_is_private)
237			ret = crypto_akcipher_set_priv_key(tfm, key, pkey->keylen);
238		else
239			ret = crypto_akcipher_set_pub_key(tfm, key, pkey->keylen);
240		if (ret < 0)
241			goto error_free_akcipher;
242
243		len = crypto_akcipher_maxsize(tfm);
244		info->key_size = len * BITS_PER_BYTE;
245		info->max_sig_size = len;
246		info->max_data_size = len;
247		info->max_enc_size = len;
248		info->max_dec_size = len;
249
250		info->supported_ops = KEYCTL_SUPPORTS_ENCRYPT;
251		if (pkey->key_is_private)
252			info->supported_ops |= KEYCTL_SUPPORTS_DECRYPT;
253
254error_free_akcipher:
255		crypto_free_akcipher(tfm);
256	}
257
258error_free_key:
259	kfree_sensitive(key);
260	pr_devel("<==%s() = %d\n", __func__, ret);
261	return ret;
262}
263
264/*
265 * Do encryption, decryption and signing ops.
266 */
267static int software_key_eds_op(struct kernel_pkey_params *params,
268			       const void *in, void *out)
269{
270	const struct public_key *pkey = params->key->payload.data[asym_crypto];
271	char alg_name[CRYPTO_MAX_ALG_NAME];
272	struct crypto_akcipher *tfm;
273	struct crypto_sig *sig;
274	char *key, *ptr;
275	bool issig;
276	int ret;
277
278	pr_devel("==>%s()\n", __func__);
279
280	ret = software_key_determine_akcipher(pkey, params->encoding,
281					      params->hash_algo, alg_name,
282					      &issig, params->op);
283	if (ret < 0)
284		return ret;
285
286	key = kmalloc(pkey->keylen + sizeof(u32) * 2 + pkey->paramlen,
287		      GFP_KERNEL);
288	if (!key)
289		return -ENOMEM;
290
291	memcpy(key, pkey->key, pkey->keylen);
292	ptr = key + pkey->keylen;
293	ptr = pkey_pack_u32(ptr, pkey->algo);
294	ptr = pkey_pack_u32(ptr, pkey->paramlen);
295	memcpy(ptr, pkey->params, pkey->paramlen);
296
297	if (issig) {
298		sig = crypto_alloc_sig(alg_name, 0, 0);
299		if (IS_ERR(sig)) {
300			ret = PTR_ERR(sig);
301			goto error_free_key;
302		}
303
304		if (pkey->key_is_private)
305			ret = crypto_sig_set_privkey(sig, key, pkey->keylen);
306		else
307			ret = crypto_sig_set_pubkey(sig, key, pkey->keylen);
308		if (ret)
309			goto error_free_tfm;
310	} else {
311		tfm = crypto_alloc_akcipher(alg_name, 0, 0);
312		if (IS_ERR(tfm)) {
313			ret = PTR_ERR(tfm);
314			goto error_free_key;
315		}
316
317		if (pkey->key_is_private)
318			ret = crypto_akcipher_set_priv_key(tfm, key, pkey->keylen);
319		else
320			ret = crypto_akcipher_set_pub_key(tfm, key, pkey->keylen);
321		if (ret)
322			goto error_free_tfm;
323	}
324
325	ret = -EINVAL;
326
327	/* Perform the encryption calculation. */
328	switch (params->op) {
329	case kernel_pkey_encrypt:
330		if (issig)
331			break;
332		ret = crypto_akcipher_sync_encrypt(tfm, in, params->in_len,
333						   out, params->out_len);
334		break;
335	case kernel_pkey_decrypt:
336		if (issig)
337			break;
338		ret = crypto_akcipher_sync_decrypt(tfm, in, params->in_len,
339						   out, params->out_len);
340		break;
341	case kernel_pkey_sign:
342		if (!issig)
343			break;
344		ret = crypto_sig_sign(sig, in, params->in_len,
345				      out, params->out_len);
346		break;
347	default:
348		BUG();
349	}
350
351	if (!issig && ret == 0)
352		ret = crypto_akcipher_maxsize(tfm);
353
354error_free_tfm:
355	if (issig)
356		crypto_free_sig(sig);
357	else
358		crypto_free_akcipher(tfm);
359error_free_key:
360	kfree_sensitive(key);
361	pr_devel("<==%s() = %d\n", __func__, ret);
362	return ret;
363}
364
365/*
366 * Verify a signature using a public key.
367 */
368int public_key_verify_signature(const struct public_key *pkey,
369				const struct public_key_signature *sig)
370{
371	char alg_name[CRYPTO_MAX_ALG_NAME];
372	struct crypto_sig *tfm;
373	char *key, *ptr;
374	bool issig;
375	int ret;
376
377	pr_devel("==>%s()\n", __func__);
378
379	BUG_ON(!pkey);
380	BUG_ON(!sig);
381	BUG_ON(!sig->s);
382
383	/*
384	 * If the signature specifies a public key algorithm, it *must* match
385	 * the key's actual public key algorithm.
386	 *
387	 * Small exception: ECDSA signatures don't specify the curve, but ECDSA
388	 * keys do.  So the strings can mismatch slightly in that case:
389	 * "ecdsa-nist-*" for the key, but "ecdsa" for the signature.
390	 */
391	if (sig->pkey_algo) {
392		if (strcmp(pkey->pkey_algo, sig->pkey_algo) != 0 &&
393		    (strncmp(pkey->pkey_algo, "ecdsa-", 6) != 0 ||
394		     strcmp(sig->pkey_algo, "ecdsa") != 0))
395			return -EKEYREJECTED;
396	}
397
398	ret = software_key_determine_akcipher(pkey, sig->encoding,
399					      sig->hash_algo, alg_name,
400					      &issig, kernel_pkey_verify);
401	if (ret < 0)
402		return ret;
403
404	tfm = crypto_alloc_sig(alg_name, 0, 0);
405	if (IS_ERR(tfm))
406		return PTR_ERR(tfm);
407
408	key = kmalloc(pkey->keylen + sizeof(u32) * 2 + pkey->paramlen,
409		      GFP_KERNEL);
410	if (!key) {
411		ret = -ENOMEM;
412		goto error_free_tfm;
413	}
414
415	memcpy(key, pkey->key, pkey->keylen);
416	ptr = key + pkey->keylen;
417	ptr = pkey_pack_u32(ptr, pkey->algo);
418	ptr = pkey_pack_u32(ptr, pkey->paramlen);
419	memcpy(ptr, pkey->params, pkey->paramlen);
420
421	if (pkey->key_is_private)
422		ret = crypto_sig_set_privkey(tfm, key, pkey->keylen);
423	else
424		ret = crypto_sig_set_pubkey(tfm, key, pkey->keylen);
425	if (ret)
426		goto error_free_key;
427
428	ret = crypto_sig_verify(tfm, sig->s, sig->s_size,
429				sig->digest, sig->digest_size);
430
431error_free_key:
432	kfree_sensitive(key);
433error_free_tfm:
434	crypto_free_sig(tfm);
435	pr_devel("<==%s() = %d\n", __func__, ret);
436	if (WARN_ON_ONCE(ret > 0))
437		ret = -EINVAL;
438	return ret;
439}
440EXPORT_SYMBOL_GPL(public_key_verify_signature);
441
442static int public_key_verify_signature_2(const struct key *key,
443					 const struct public_key_signature *sig)
444{
445	const struct public_key *pk = key->payload.data[asym_crypto];
446	return public_key_verify_signature(pk, sig);
447}
448
449/*
450 * Public key algorithm asymmetric key subtype
451 */
452struct asymmetric_key_subtype public_key_subtype = {
453	.owner			= THIS_MODULE,
454	.name			= "public_key",
455	.name_len		= sizeof("public_key") - 1,
456	.describe		= public_key_describe,
457	.destroy		= public_key_destroy,
458	.query			= software_key_query,
459	.eds_op			= software_key_eds_op,
460	.verify_signature	= public_key_verify_signature_2,
461};
462EXPORT_SYMBOL_GPL(public_key_subtype);