Commit 1e562dea authored by Lukas Wunner's avatar Lukas Wunner Committed by Herbert Xu
Browse files

crypto: rsassa-pkcs1 - Migrate to sig_alg backend 



A sig_alg backend has just been introduced with the intent of moving all
asymmetric sign/verify algorithms to it one by one.

Migrate the sign/verify operations from rsa-pkcs1pad.c to a separate
rsassa-pkcs1.c which uses the new backend.

Consequently there are now two templates which build on the "rsa"
akcipher_alg:

* The existing "pkcs1pad" template, which is instantiated as an
  akcipher_instance and retains the encrypt/decrypt operations of
  RSAES-PKCS1-v1_5 (RFC 8017 sec 7.2).

* The new "pkcs1" template, which is instantiated as a sig_instance
  and contains the sign/verify operations of RSASSA-PKCS1-v1_5
  (RFC 8017 sec 8.2).

In a separate step, rsa-pkcs1pad.c could optionally be renamed to
rsaes-pkcs1.c for clarity.  Additional "oaep" and "pss" templates
could be added for RSAES-OAEP and RSASSA-PSS.

Note that it's currently allowed to allocate a "pkcs1pad(rsa)" transform
without specifying a hash algorithm.  That makes sense if the transform
is only used for encrypt/decrypt and continues to be supported.  But for
sign/verify, such transforms previously did not insert the Full Hash
Prefix into the padding.  The resulting message encoding was incompliant
with EMSA-PKCS1-v1_5 (RFC 8017 sec 9.2) and therefore nonsensical.

From here on in, it is no longer allowed to allocate a transform without
specifying a hash algorithm if the transform is used for sign/verify
operations.  This simplifies the code because the insertion of the Full
Hash Prefix is no longer optional, so various "if (digest_info)" clauses
can be removed.

There has been a previous attempt to forbid transform allocation without
specifying a hash algorithm, namely by commit c0d20d22 ("crypto:
rsa-pkcs1pad - Require hash to be present").  It had to be rolled back
with commit b3a8c8a5 ("crypto: rsa-pkcs1pad: Allow hash to be
optional [ver #2]"), presumably because it broke allocation of a
transform which was solely used for encrypt/decrypt, not sign/verify.
Avoid such breakage by allowing transform allocation for encrypt/decrypt
with and without specifying a hash algorithm (and simply ignoring the
hash algorithm in the former case).

So again, specifying a hash algorithm is now mandatory for sign/verify,
but optional and ignored for encrypt/decrypt.

The new sig_alg API uses kernel buffers instead of sglists, which
avoids the overhead of copying signature and digest from sglists back
into kernel buffers.  rsassa-pkcs1.c is thus simplified quite a bit.

sig_alg is always synchronous, whereas the underlying "rsa" akcipher_alg
may be asynchronous.  So await the result of the akcipher_alg, similar
to crypto_akcipher_sync_{en,de}crypt().

As part of the migration, rename "rsa_digest_info" to "hash_prefix" to
adhere to the spec language in RFC 9580.  Otherwise keep the code
unmodified wherever possible to ease reviewing and bisecting.  Leave
several simplification and hardening opportunities to separate commits.

rsassa-pkcs1.c uses modern __free() syntax for allocation of buffers
which need to be freed by kfree_sensitive(), hence a DEFINE_FREE()
clause for kfree_sensitive() is introduced herein as a byproduct.

Signed-off-by: default avatarLukas Wunner <lukas@wunner.de>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 7964b0d4

crypto/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -250,6 +250,7 @@ config CRYPTO_RSA 
	tristate "RSA (Rivest-Shamir-Adleman)"

	select CRYPTO_AKCIPHER

	select CRYPTO_MANAGER

	select CRYPTO_SIG

	select MPILIB

	select ASN1

	help

crypto/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -48,6 +48,7 @@ rsa_generic-y += rsaprivkey.asn1.o 
rsa_generic-y += rsa.o

rsa_generic-y += rsa_helper.o

rsa_generic-y += rsa-pkcs1pad.o

rsa_generic-y += rsassa-pkcs1.o

obj-$(CONFIG_CRYPTO_RSA) += rsa_generic.o



$(obj)/ecdsasignature.asn1.o: $(obj)/ecdsasignature.asn1.c $(obj)/ecdsasignature.asn1.h

crypto/asymmetric_keys/public_key.c

+8 −2
Original line number Diff line number Diff line
@@ -83,13 +83,19 @@ software_key_determine_akcipher(const struct public_key *pkey, 
		if (strcmp(encoding, "pkcs1") == 0) {

			*sig = op == kernel_pkey_sign ||

			       op == kernel_pkey_verify;

			if (!hash_algo) {

			if (!*sig) {

				/*

				 * For encrypt/decrypt, hash_algo is not used

				 * but allowed to be set for historic reasons.

				 */

				n = snprintf(alg_name, CRYPTO_MAX_ALG_NAME,

					     "pkcs1pad(%s)",

					     pkey->pkey_algo);

			} else {

				if (!hash_algo)

					return -EINVAL;

				n = snprintf(alg_name, CRYPTO_MAX_ALG_NAME,

					     "pkcs1pad(%s,%s)",

					     "pkcs1(%s,%s)",

					     pkey->pkey_algo, hash_algo);

			}

			return n >= CRYPTO_MAX_ALG_NAME ? -EINVAL : 0;

crypto/rsa-pkcs1pad.c

+16 −325
Original line number Diff line number Diff line
@@ -16,101 +16,6 @@ 
#include <linux/random.h>

#include <linux/scatterlist.h>



/*

 * Hash algorithm OIDs plus ASN.1 DER wrappings [RFC4880 sec 5.2.2].

 */

static const u8 rsa_digest_info_md5[] = {

	0x30, 0x20, 0x30, 0x0c, 0x06, 0x08,

	0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, /* OID */

	0x05, 0x00, 0x04, 0x10

};



static const u8 rsa_digest_info_sha1[] = {

	0x30, 0x21, 0x30, 0x09, 0x06, 0x05,

	0x2b, 0x0e, 0x03, 0x02, 0x1a,

	0x05, 0x00, 0x04, 0x14

};



static const u8 rsa_digest_info_rmd160[] = {

	0x30, 0x21, 0x30, 0x09, 0x06, 0x05,

	0x2b, 0x24, 0x03, 0x02, 0x01,

	0x05, 0x00, 0x04, 0x14

};



static const u8 rsa_digest_info_sha224[] = {

	0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,

	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,

	0x05, 0x00, 0x04, 0x1c

};



static const u8 rsa_digest_info_sha256[] = {

	0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,

	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,

	0x05, 0x00, 0x04, 0x20

};



static const u8 rsa_digest_info_sha384[] = {

	0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,

	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,

	0x05, 0x00, 0x04, 0x30

};



static const u8 rsa_digest_info_sha512[] = {

	0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,

	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,

	0x05, 0x00, 0x04, 0x40

};



static const u8 rsa_digest_info_sha3_256[] = {

	0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,

	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x08,

	0x05, 0x00, 0x04, 0x20

};



static const u8 rsa_digest_info_sha3_384[] = {

	0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,

	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x09,

	0x05, 0x00, 0x04, 0x30

};



static const u8 rsa_digest_info_sha3_512[] = {

	0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,

	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x0A,

	0x05, 0x00, 0x04, 0x40

};



static const struct rsa_asn1_template {

	const char	*name;

	const u8	*data;

	size_t		size;

} rsa_asn1_templates[] = {

#define _(X) { #X, rsa_digest_info_##X, sizeof(rsa_digest_info_##X) }

	_(md5),

	_(sha1),

	_(rmd160),

	_(sha256),

	_(sha384),

	_(sha512),

	_(sha224),

#undef _

#define _(X) { "sha3-" #X, rsa_digest_info_sha3_##X, sizeof(rsa_digest_info_sha3_##X) }

	_(256),

	_(384),

	_(512),

#undef _

	{ NULL }

};



static const struct rsa_asn1_template *rsa_lookup_asn1(const char *name)

{

	const struct rsa_asn1_template *p;



	for (p = rsa_asn1_templates; p->name; p++)

		if (strcmp(name, p->name) == 0)

			return p;

	return NULL;

}



struct pkcs1pad_ctx {

	struct crypto_akcipher *child;

	unsigned int key_size;
@@ -118,7 +23,6 @@ struct pkcs1pad_ctx { 


struct pkcs1pad_inst_ctx {

	struct crypto_akcipher_spawn spawn;

	const struct rsa_asn1_template *digest_info;

};



struct pkcs1pad_request {
@@ -148,9 +52,9 @@ static unsigned int pkcs1pad_get_max_size(struct crypto_akcipher *tfm) 
	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);



	/*

	 * The maximum destination buffer size for the encrypt/sign operations

	 * The maximum destination buffer size for the encrypt operation

	 * will be the same as for RSA, even though it's smaller for

	 * decrypt/verify.

	 * decrypt.

	 */



	return ctx->key_size;
@@ -168,7 +72,7 @@ static void pkcs1pad_sg_set_buf(struct scatterlist *sg, void *buf, size_t len, 
		sg_chain(sg, nsegs, next);

}



static int pkcs1pad_encrypt_sign_complete(struct akcipher_request *req, int err)

static int pkcs1pad_encrypt_complete(struct akcipher_request *req, int err)

{

	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);

	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
@@ -207,14 +111,14 @@ static int pkcs1pad_encrypt_sign_complete(struct akcipher_request *req, int err) 
	return err;

}



static void pkcs1pad_encrypt_sign_complete_cb(void *data, int err)

static void pkcs1pad_encrypt_complete_cb(void *data, int err)

{

	struct akcipher_request *req = data;



	if (err == -EINPROGRESS)

		goto out;



	err = pkcs1pad_encrypt_sign_complete(req, err);

	err = pkcs1pad_encrypt_complete(req, err);



out:

	akcipher_request_complete(req, err);
@@ -255,7 +159,7 @@ static int pkcs1pad_encrypt(struct akcipher_request *req) 


	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);

	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,

			pkcs1pad_encrypt_sign_complete_cb, req);

			pkcs1pad_encrypt_complete_cb, req);



	/* Reuse output buffer */

	akcipher_request_set_crypt(&req_ctx->child_req, req_ctx->in_sg,
@@ -263,7 +167,7 @@ static int pkcs1pad_encrypt(struct akcipher_request *req) 


	err = crypto_akcipher_encrypt(&req_ctx->child_req);

	if (err != -EINPROGRESS && err != -EBUSY)

		return pkcs1pad_encrypt_sign_complete(req, err);

		return pkcs1pad_encrypt_complete(req, err);



	return err;

}
@@ -368,195 +272,6 @@ static int pkcs1pad_decrypt(struct akcipher_request *req) 
	return err;

}



static int pkcs1pad_sign(struct akcipher_request *req)

{

	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);

	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);

	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);

	struct akcipher_instance *inst = akcipher_alg_instance(tfm);

	struct pkcs1pad_inst_ctx *ictx = akcipher_instance_ctx(inst);

	const struct rsa_asn1_template *digest_info = ictx->digest_info;

	int err;

	unsigned int ps_end, digest_info_size = 0;



	if (!ctx->key_size)

		return -EINVAL;



	if (digest_info)

		digest_info_size = digest_info->size;



	if (req->src_len + digest_info_size > ctx->key_size - 11)

		return -EOVERFLOW;



	if (req->dst_len < ctx->key_size) {

		req->dst_len = ctx->key_size;

		return -EOVERFLOW;

	}



	req_ctx->in_buf = kmalloc(ctx->key_size - 1 - req->src_len,

				  GFP_KERNEL);

	if (!req_ctx->in_buf)

		return -ENOMEM;



	ps_end = ctx->key_size - digest_info_size - req->src_len - 2;

	req_ctx->in_buf[0] = 0x01;

	memset(req_ctx->in_buf + 1, 0xff, ps_end - 1);

	req_ctx->in_buf[ps_end] = 0x00;



	if (digest_info)

		memcpy(req_ctx->in_buf + ps_end + 1, digest_info->data,

		       digest_info->size);



	pkcs1pad_sg_set_buf(req_ctx->in_sg, req_ctx->in_buf,

			ctx->key_size - 1 - req->src_len, req->src);



	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);

	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,

			pkcs1pad_encrypt_sign_complete_cb, req);



	/* Reuse output buffer */

	akcipher_request_set_crypt(&req_ctx->child_req, req_ctx->in_sg,

				   req->dst, ctx->key_size - 1, req->dst_len);



	err = crypto_akcipher_decrypt(&req_ctx->child_req);

	if (err != -EINPROGRESS && err != -EBUSY)

		return pkcs1pad_encrypt_sign_complete(req, err);



	return err;

}



static int pkcs1pad_verify_complete(struct akcipher_request *req, int err)

{

	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);

	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);

	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);

	struct akcipher_instance *inst = akcipher_alg_instance(tfm);

	struct pkcs1pad_inst_ctx *ictx = akcipher_instance_ctx(inst);

	const struct rsa_asn1_template *digest_info = ictx->digest_info;

	const unsigned int sig_size = req->src_len;

	const unsigned int digest_size = req->dst_len;

	unsigned int dst_len;

	unsigned int pos;

	u8 *out_buf;



	if (err)

		goto done;



	err = -EINVAL;

	dst_len = req_ctx->child_req.dst_len;

	if (dst_len < ctx->key_size - 1)

		goto done;



	out_buf = req_ctx->out_buf;

	if (dst_len == ctx->key_size) {

		if (out_buf[0] != 0x00)

			/* Decrypted value had no leading 0 byte */

			goto done;



		dst_len--;

		out_buf++;

	}



	err = -EBADMSG;

	if (out_buf[0] != 0x01)

		goto done;



	for (pos = 1; pos < dst_len; pos++)

		if (out_buf[pos] != 0xff)

			break;



	if (pos < 9 || pos == dst_len || out_buf[pos] != 0x00)

		goto done;

	pos++;



	if (digest_info) {

		if (digest_info->size > dst_len - pos)

			goto done;

		if (crypto_memneq(out_buf + pos, digest_info->data,

				  digest_info->size))

			goto done;



		pos += digest_info->size;

	}



	err = 0;



	if (digest_size != dst_len - pos) {

		err = -EKEYREJECTED;

		req->dst_len = dst_len - pos;

		goto done;

	}

	/* Extract appended digest. */

	sg_pcopy_to_buffer(req->src,

			   sg_nents_for_len(req->src, sig_size + digest_size),

			   req_ctx->out_buf + ctx->key_size,

			   digest_size, sig_size);

	/* Do the actual verification step. */

	if (memcmp(req_ctx->out_buf + ctx->key_size, out_buf + pos,

		   digest_size) != 0)

		err = -EKEYREJECTED;

done:

	kfree_sensitive(req_ctx->out_buf);



	return err;

}



static void pkcs1pad_verify_complete_cb(void *data, int err)

{

	struct akcipher_request *req = data;



	if (err == -EINPROGRESS)

		goto out;



	err = pkcs1pad_verify_complete(req, err);



out:

	akcipher_request_complete(req, err);

}



/*

 * The verify operation is here for completeness similar to the verification

 * defined in RFC2313 section 10.2 except that block type 0 is not accepted,

 * as in RFC2437.  RFC2437 section 9.2 doesn't define any operation to

 * retrieve the DigestInfo from a signature, instead the user is expected

 * to call the sign operation to generate the expected signature and compare

 * signatures instead of the message-digests.

 */

static int pkcs1pad_verify(struct akcipher_request *req)

{

	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);

	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);

	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);

	const unsigned int sig_size = req->src_len;

	const unsigned int digest_size = req->dst_len;

	int err;



	if (WARN_ON(req->dst) || WARN_ON(!digest_size) ||

	    !ctx->key_size || sig_size != ctx->key_size)

		return -EINVAL;



	req_ctx->out_buf = kmalloc(ctx->key_size + digest_size, GFP_KERNEL);

	if (!req_ctx->out_buf)

		return -ENOMEM;



	pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,

			    ctx->key_size, NULL);



	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);

	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,

			pkcs1pad_verify_complete_cb, req);



	/* Reuse input buffer, output to a new buffer */

	akcipher_request_set_crypt(&req_ctx->child_req, req->src,

				   req_ctx->out_sg, sig_size, ctx->key_size);



	err = crypto_akcipher_encrypt(&req_ctx->child_req);

	if (err != -EINPROGRESS && err != -EBUSY)

		return pkcs1pad_verify_complete(req, err);



	return err;

}



static int pkcs1pad_init_tfm(struct crypto_akcipher *tfm)

{

	struct akcipher_instance *inst = akcipher_alg_instance(tfm);
@@ -598,7 +313,6 @@ static int pkcs1pad_create(struct crypto_template *tmpl, struct rtattr **tb) 
	struct akcipher_instance *inst;

	struct pkcs1pad_inst_ctx *ctx;

	struct akcipher_alg *rsa_alg;

	const char *hash_name;

	int err;



	err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_AKCIPHER, &mask);
@@ -624,8 +338,6 @@ static int pkcs1pad_create(struct crypto_template *tmpl, struct rtattr **tb) 
	}



	err = -ENAMETOOLONG;

	hash_name = crypto_attr_alg_name(tb[2]);

	if (IS_ERR(hash_name)) {

	if (snprintf(inst->alg.base.cra_name,

		     CRYPTO_MAX_ALG_NAME, "pkcs1pad(%s)",

		     rsa_alg->base.cra_name) >= CRYPTO_MAX_ALG_NAME)
@@ -633,28 +345,9 @@ static int pkcs1pad_create(struct crypto_template *tmpl, struct rtattr **tb) 


	if (snprintf(inst->alg.base.cra_driver_name,

		     CRYPTO_MAX_ALG_NAME, "pkcs1pad(%s)",

			     rsa_alg->base.cra_driver_name) >=

			     CRYPTO_MAX_ALG_NAME)

			goto err_free_inst;

	} else {

		ctx->digest_info = rsa_lookup_asn1(hash_name);

		if (!ctx->digest_info) {

			err = -EINVAL;

			goto err_free_inst;

		}



		if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,

			     "pkcs1pad(%s,%s)", rsa_alg->base.cra_name,

			     hash_name) >= CRYPTO_MAX_ALG_NAME)

		     rsa_alg->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)

		goto err_free_inst;



		if (snprintf(inst->alg.base.cra_driver_name,

			     CRYPTO_MAX_ALG_NAME, "pkcs1pad(%s,%s)",

			     rsa_alg->base.cra_driver_name,

			     hash_name) >= CRYPTO_MAX_ALG_NAME)

			goto err_free_inst;

	}



	inst->alg.base.cra_priority = rsa_alg->base.cra_priority;

	inst->alg.base.cra_ctxsize = sizeof(struct pkcs1pad_ctx);
@@ -663,8 +356,6 @@ static int pkcs1pad_create(struct crypto_template *tmpl, struct rtattr **tb) 


	inst->alg.encrypt = pkcs1pad_encrypt;

	inst->alg.decrypt = pkcs1pad_decrypt;

	inst->alg.sign = pkcs1pad_sign;

	inst->alg.verify = pkcs1pad_verify;

	inst->alg.set_pub_key = pkcs1pad_set_pub_key;

	inst->alg.set_priv_key = pkcs1pad_set_priv_key;

	inst->alg.max_size = pkcs1pad_get_max_size;

crypto/rsa.c

+13 −4
Original line number Diff line number Diff line
@@ -407,16 +407,25 @@ static int __init rsa_init(void) 
		return err;



	err = crypto_register_template(&rsa_pkcs1pad_tmpl);

	if (err) {

		crypto_unregister_akcipher(&rsa);

		return err;

	}

	if (err)

		goto err_unregister_rsa;



	err = crypto_register_template(&rsassa_pkcs1_tmpl);

	if (err)

		goto err_unregister_rsa_pkcs1pad;



	return 0;



err_unregister_rsa_pkcs1pad:

	crypto_unregister_template(&rsa_pkcs1pad_tmpl);

err_unregister_rsa:

	crypto_unregister_akcipher(&rsa);

	return err;

}



static void __exit rsa_exit(void)

{

	crypto_unregister_template(&rsassa_pkcs1_tmpl);

	crypto_unregister_template(&rsa_pkcs1pad_tmpl);

	crypto_unregister_akcipher(&rsa);

}