Commit 6cb8815f authored by Herbert Xu's avatar Herbert Xu
Browse files

crypto: sig - Add interface for sign/verify 



Split out the sign/verify functionality from the existing akcipher
interface.  Most algorithms in akcipher either support encryption
and decryption, or signing and verify.  Only one supports both.

As a signature algorithm may not support encryption at all, these
two should be spearated.

For now sig is simply a wrapper around akcipher as all algorithms
remain unchanged.  This is a first step and allows users to start
allocating sig instead of akcipher.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent addde1f2

crypto/Kconfig

+10 −0
Original line number Diff line number Diff line
@@ -72,6 +72,15 @@ config CRYPTO_AEAD2 
	tristate

	select CRYPTO_ALGAPI2



config CRYPTO_SIG

	tristate

	select CRYPTO_SIG2

	select CRYPTO_ALGAPI



config CRYPTO_SIG2

	tristate

	select CRYPTO_ALGAPI2



config CRYPTO_SKCIPHER

	tristate

	select CRYPTO_SKCIPHER2
@@ -143,6 +152,7 @@ config CRYPTO_MANAGER2 
	select CRYPTO_ACOMP2

	select CRYPTO_AEAD2

	select CRYPTO_AKCIPHER2

	select CRYPTO_SIG2

	select CRYPTO_HASH2

	select CRYPTO_KPP2

	select CRYPTO_RNG2

crypto/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ crypto_hash-y += shash.o 
obj-$(CONFIG_CRYPTO_HASH2) += crypto_hash.o



obj-$(CONFIG_CRYPTO_AKCIPHER2) += akcipher.o

obj-$(CONFIG_CRYPTO_SIG2) += sig.o

obj-$(CONFIG_CRYPTO_KPP2) += kpp.o



dh_generic-y := dh.o

crypto/akcipher.c

+36 −17
Original line number Diff line number Diff line
@@ -18,18 +18,7 @@ 


#include "internal.h"



struct crypto_akcipher_sync_data {

	struct crypto_akcipher *tfm;

	const void *src;

	void *dst;

	unsigned int slen;

	unsigned int dlen;



	struct akcipher_request *req;

	struct crypto_wait cwait;

	struct scatterlist sg;

	u8 *buf;

};

#define CRYPTO_ALG_TYPE_AHASH_MASK	0x0000000e



static int __maybe_unused crypto_akcipher_report(

	struct sk_buff *skb, struct crypto_alg *alg)
@@ -119,7 +108,7 @@ static const struct crypto_type crypto_akcipher_type = { 
	.report_stat = crypto_akcipher_report_stat,

#endif

	.maskclear = ~CRYPTO_ALG_TYPE_MASK,

	.maskset = CRYPTO_ALG_TYPE_MASK,

	.maskset = CRYPTO_ALG_TYPE_AHASH_MASK,

	.type = CRYPTO_ALG_TYPE_AKCIPHER,

	.tfmsize = offsetof(struct crypto_akcipher, base),

};
@@ -200,7 +189,7 @@ int akcipher_register_instance(struct crypto_template *tmpl, 
}

EXPORT_SYMBOL_GPL(akcipher_register_instance);



static int crypto_akcipher_sync_prep(struct crypto_akcipher_sync_data *data)

int crypto_akcipher_sync_prep(struct crypto_akcipher_sync_data *data)

{

	unsigned int reqsize = crypto_akcipher_reqsize(data->tfm);

	unsigned int mlen = max(data->slen, data->dlen);
@@ -223,7 +212,7 @@ static int crypto_akcipher_sync_prep(struct crypto_akcipher_sync_data *data) 
	data->buf = buf;

	memcpy(buf, data->src, data->slen);



	sg = &data->sg;

	sg = data->sg;

	sg_init_one(sg, buf, mlen);

	akcipher_request_set_crypt(req, sg, sg, data->slen, data->dlen);
@@ -233,9 +222,9 @@ static int crypto_akcipher_sync_prep(struct crypto_akcipher_sync_data *data) 


	return 0;

}

EXPORT_SYMBOL_GPL(crypto_akcipher_sync_prep);



static int crypto_akcipher_sync_post(struct crypto_akcipher_sync_data *data,

				     int err)

int crypto_akcipher_sync_post(struct crypto_akcipher_sync_data *data, int err)

{

	err = crypto_wait_req(err, &data->cwait);

	memcpy(data->dst, data->buf, data->dlen);
@@ -243,6 +232,7 @@ static int crypto_akcipher_sync_post(struct crypto_akcipher_sync_data *data, 
	kfree_sensitive(data->req);

	return err;

}

EXPORT_SYMBOL_GPL(crypto_akcipher_sync_post);



int crypto_akcipher_sync_encrypt(struct crypto_akcipher *tfm,

				 const void *src, unsigned int slen,
@@ -281,5 +271,34 @@ int crypto_akcipher_sync_decrypt(struct crypto_akcipher *tfm, 
}

EXPORT_SYMBOL_GPL(crypto_akcipher_sync_decrypt);



static void crypto_exit_akcipher_ops_sig(struct crypto_tfm *tfm)

{

	struct crypto_akcipher **ctx = crypto_tfm_ctx(tfm);



	crypto_free_akcipher(*ctx);

}



int crypto_init_akcipher_ops_sig(struct crypto_tfm *tfm)

{

	struct crypto_akcipher **ctx = crypto_tfm_ctx(tfm);

	struct crypto_alg *calg = tfm->__crt_alg;

	struct crypto_akcipher *akcipher;



	if (!crypto_mod_get(calg))

		return -EAGAIN;



	akcipher = crypto_create_tfm(calg, &crypto_akcipher_type);

	if (IS_ERR(akcipher)) {

		crypto_mod_put(calg);

		return PTR_ERR(akcipher);

	}



	*ctx = akcipher;

	tfm->exit = crypto_exit_akcipher_ops_sig;



	return 0;

}

EXPORT_SYMBOL_GPL(crypto_init_akcipher_ops_sig);



MODULE_LICENSE("GPL");

MODULE_DESCRIPTION("Generic public key cipher type");

crypto/internal.h

+20 −0
Original line number Diff line number Diff line
@@ -18,9 +18,12 @@ 
#include <linux/numa.h>

#include <linux/refcount.h>

#include <linux/rwsem.h>

#include <linux/scatterlist.h>

#include <linux/sched.h>

#include <linux/types.h>



struct akcipher_request;

struct crypto_akcipher;

struct crypto_instance;

struct crypto_template;
@@ -32,6 +35,19 @@ struct crypto_larval { 
	bool test_started;

};



struct crypto_akcipher_sync_data {

	struct crypto_akcipher *tfm;

	const void *src;

	void *dst;

	unsigned int slen;

	unsigned int dlen;



	struct akcipher_request *req;

	struct crypto_wait cwait;

	struct scatterlist sg[2];

	u8 *buf;

};



enum {

	CRYPTOA_UNSPEC,

	CRYPTOA_ALG,
@@ -111,6 +127,10 @@ void *crypto_create_tfm_node(struct crypto_alg *alg, 
void *crypto_clone_tfm(const struct crypto_type *frontend,

		       struct crypto_tfm *otfm);



int crypto_akcipher_sync_prep(struct crypto_akcipher_sync_data *data);

int crypto_akcipher_sync_post(struct crypto_akcipher_sync_data *data, int err);

int crypto_init_akcipher_ops_sig(struct crypto_tfm *tfm);



static inline void *crypto_create_tfm(struct crypto_alg *alg,

			const struct crypto_type *frontend)

{

crypto/sig.c

0 → 100644
+159 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0-or-later */

/*

 * Public Key Signature Algorithm

 *

 * Copyright (c) 2023 Herbert Xu <herbert@gondor.apana.org.au>

 */



#include <crypto/akcipher.h>

#include <crypto/internal/sig.h>

#include <linux/cryptouser.h>

#include <linux/kernel.h>

#include <linux/module.h>

#include <linux/scatterlist.h>

#include <linux/seq_file.h>

#include <linux/string.h>

#include <net/netlink.h>



#include "internal.h"



#define CRYPTO_ALG_TYPE_SIG_MASK	0x0000000e



static const struct crypto_type crypto_sig_type;



static inline struct crypto_sig *__crypto_sig_tfm(struct crypto_tfm *tfm)

{

	return container_of(tfm, struct crypto_sig, base);

}



static int crypto_sig_init_tfm(struct crypto_tfm *tfm)

{

	if (tfm->__crt_alg->cra_type != &crypto_sig_type)

		return crypto_init_akcipher_ops_sig(tfm);



	return 0;

}



static void __maybe_unused crypto_sig_show(struct seq_file *m,

					   struct crypto_alg *alg)

{

	seq_puts(m, "type         : sig\n");

}



static int __maybe_unused crypto_sig_report(struct sk_buff *skb,

					    struct crypto_alg *alg)

{

	struct crypto_report_akcipher rsig = {};



	strscpy(rsig.type, "sig", sizeof(rsig.type));



	return nla_put(skb, CRYPTOCFGA_REPORT_AKCIPHER, sizeof(rsig), &rsig);

}



static int __maybe_unused crypto_sig_report_stat(struct sk_buff *skb,

						 struct crypto_alg *alg)

{

	struct crypto_stat_akcipher rsig = {};



	strscpy(rsig.type, "sig", sizeof(rsig.type));



	return nla_put(skb, CRYPTOCFGA_STAT_AKCIPHER, sizeof(rsig), &rsig);

}



static const struct crypto_type crypto_sig_type = {

	.extsize = crypto_alg_extsize,

	.init_tfm = crypto_sig_init_tfm,

#ifdef CONFIG_PROC_FS

	.show = crypto_sig_show,

#endif

#if IS_ENABLED(CONFIG_CRYPTO_USER)

	.report = crypto_sig_report,

#endif

#ifdef CONFIG_CRYPTO_STATS

	.report_stat = crypto_sig_report_stat,

#endif

	.maskclear = ~CRYPTO_ALG_TYPE_MASK,

	.maskset = CRYPTO_ALG_TYPE_SIG_MASK,

	.type = CRYPTO_ALG_TYPE_SIG,

	.tfmsize = offsetof(struct crypto_sig, base),

};



struct crypto_sig *crypto_alloc_sig(const char *alg_name, u32 type, u32 mask)

{

	return crypto_alloc_tfm(alg_name, &crypto_sig_type, type, mask);

}

EXPORT_SYMBOL_GPL(crypto_alloc_sig);



int crypto_sig_maxsize(struct crypto_sig *tfm)

{

	struct crypto_akcipher **ctx = crypto_sig_ctx(tfm);



	return crypto_akcipher_maxsize(*ctx);

}

EXPORT_SYMBOL_GPL(crypto_sig_maxsize);



int crypto_sig_sign(struct crypto_sig *tfm,

		    const void *src, unsigned int slen,

		    void *dst, unsigned int dlen)

{

	struct crypto_akcipher **ctx = crypto_sig_ctx(tfm);

	struct crypto_akcipher_sync_data data = {

		.tfm = *ctx,

		.src = src,

		.dst = dst,

		.slen = slen,

		.dlen = dlen,

	};



	return crypto_akcipher_sync_prep(&data) ?:

	       crypto_akcipher_sync_post(&data,

					 crypto_akcipher_sign(data.req));

}

EXPORT_SYMBOL_GPL(crypto_sig_sign);



int crypto_sig_verify(struct crypto_sig *tfm,

		      const void *src, unsigned int slen,

		      const void *digest, unsigned int dlen)

{

	struct crypto_akcipher **ctx = crypto_sig_ctx(tfm);

	struct crypto_akcipher_sync_data data = {

		.tfm = *ctx,

		.src = src,

		.slen = slen,

		.dlen = dlen,

	};

	int err;



	err = crypto_akcipher_sync_prep(&data);

	if (err)

		return err;



	sg_init_table(data.sg, 2);

	sg_set_buf(&data.sg[0], src, slen);

	sg_set_buf(&data.sg[1], digest, dlen);



	return crypto_akcipher_sync_post(&data,

					 crypto_akcipher_verify(data.req));

}

EXPORT_SYMBOL_GPL(crypto_sig_verify);



int crypto_sig_set_pubkey(struct crypto_sig *tfm,

			  const void *key, unsigned int keylen)

{

	struct crypto_akcipher **ctx = crypto_sig_ctx(tfm);



	return crypto_akcipher_set_pub_key(*ctx, key, keylen);

}

EXPORT_SYMBOL_GPL(crypto_sig_set_pubkey);



int crypto_sig_set_privkey(struct crypto_sig *tfm,

			  const void *key, unsigned int keylen)

{

	struct crypto_akcipher **ctx = crypto_sig_ctx(tfm);



	return crypto_akcipher_set_priv_key(*ctx, key, keylen);

}

EXPORT_SYMBOL_GPL(crypto_sig_set_privkey);



MODULE_LICENSE("GPL");

MODULE_DESCRIPTION("Public Key Signature Algorithms");