Commit | Line | Data |
---|---|---|
051dbb91 DK |
1 | /* |
2 | * Copyright (C) 2011 Nokia Corporation | |
3 | * Copyright (C) 2011 Intel Corporation | |
4 | * | |
5 | * Author: | |
6 | * Dmitry Kasatkin <dmitry.kasatkin@nokia.com> | |
7 | * <dmitry.kasatkin@intel.com> | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or modify | |
10 | * it under the terms of the GNU General Public License as published by | |
11 | * the Free Software Foundation, version 2 of the License. | |
12 | * | |
13 | * File: sign.c | |
14 | * implements signature (RSA) verification | |
15 | * pkcs decoding is based on LibTomCrypt code | |
16 | */ | |
17 | ||
18 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt | |
19 | ||
20 | #include <linux/err.h> | |
21 | #include <linux/module.h> | |
22 | #include <linux/slab.h> | |
23 | #include <linux/key.h> | |
24 | #include <linux/crypto.h> | |
25 | #include <crypto/hash.h> | |
26 | #include <crypto/sha.h> | |
27 | #include <keys/user-type.h> | |
28 | #include <linux/mpi.h> | |
29 | #include <linux/digsig.h> | |
30 | ||
31 | static struct crypto_shash *shash; | |
32 | ||
26d43845 DK |
33 | static const char *pkcs_1_v1_5_decode_emsa(const unsigned char *msg, |
34 | unsigned long msglen, | |
35 | unsigned long modulus_bitlen, | |
36 | unsigned long *outlen) | |
051dbb91 DK |
37 | { |
38 | unsigned long modulus_len, ps_len, i; | |
051dbb91 DK |
39 | |
40 | modulus_len = (modulus_bitlen >> 3) + (modulus_bitlen & 7 ? 1 : 0); | |
41 | ||
42 | /* test message size */ | |
43 | if ((msglen > modulus_len) || (modulus_len < 11)) | |
26d43845 | 44 | return NULL; |
051dbb91 DK |
45 | |
46 | /* separate encoded message */ | |
26d43845 DK |
47 | if (msg[0] != 0x00 || msg[1] != 0x01) |
48 | return NULL; | |
051dbb91 DK |
49 | |
50 | for (i = 2; i < modulus_len - 1; i++) | |
51 | if (msg[i] != 0xFF) | |
52 | break; | |
53 | ||
54 | /* separator check */ | |
b35e286a | 55 | if (msg[i] != 0) |
051dbb91 DK |
56 | /* There was no octet with hexadecimal value 0x00 |
57 | to separate ps from m. */ | |
26d43845 | 58 | return NULL; |
051dbb91 DK |
59 | |
60 | ps_len = i - 2; | |
61 | ||
051dbb91 | 62 | *outlen = (msglen - (2 + ps_len + 1)); |
051dbb91 | 63 | |
26d43845 | 64 | return msg + 2 + ps_len + 1; |
051dbb91 DK |
65 | } |
66 | ||
67 | /* | |
68 | * RSA Signature verification with public key | |
69 | */ | |
70 | static int digsig_verify_rsa(struct key *key, | |
71 | const char *sig, int siglen, | |
72 | const char *h, int hlen) | |
73 | { | |
74 | int err = -EINVAL; | |
75 | unsigned long len; | |
76 | unsigned long mlen, mblen; | |
77 | unsigned nret, l; | |
b35e286a | 78 | int head, i; |
26d43845 DK |
79 | unsigned char *out1 = NULL; |
80 | const char *m; | |
051dbb91 | 81 | MPI in = NULL, res = NULL, pkey[2]; |
146aa8b1 DH |
82 | uint8_t *p, *datap; |
83 | const uint8_t *endp; | |
84 | const struct user_key_payload *ukp; | |
051dbb91 DK |
85 | struct pubkey_hdr *pkh; |
86 | ||
87 | down_read(&key->sem); | |
146aa8b1 | 88 | ukp = user_key_payload(key); |
f58a0815 | 89 | |
503ef5c0 EB |
90 | if (!ukp) { |
91 | /* key was revoked before we acquired its semaphore */ | |
92 | err = -EKEYREVOKED; | |
93 | goto err1; | |
94 | } | |
95 | ||
f58a0815 DK |
96 | if (ukp->datalen < sizeof(*pkh)) |
97 | goto err1; | |
98 | ||
051dbb91 DK |
99 | pkh = (struct pubkey_hdr *)ukp->data; |
100 | ||
101 | if (pkh->version != 1) | |
102 | goto err1; | |
103 | ||
104 | if (pkh->algo != PUBKEY_ALGO_RSA) | |
105 | goto err1; | |
106 | ||
107 | if (pkh->nmpi != 2) | |
108 | goto err1; | |
109 | ||
110 | datap = pkh->mpi; | |
f58a0815 | 111 | endp = ukp->data + ukp->datalen; |
051dbb91 | 112 | |
86f8bedc DK |
113 | err = -ENOMEM; |
114 | ||
051dbb91 DK |
115 | for (i = 0; i < pkh->nmpi; i++) { |
116 | unsigned int remaining = endp - datap; | |
117 | pkey[i] = mpi_read_from_buffer(datap, &remaining); | |
86f8bedc DK |
118 | if (!pkey[i]) |
119 | goto err; | |
051dbb91 DK |
120 | datap += remaining; |
121 | } | |
122 | ||
123 | mblen = mpi_get_nbits(pkey[0]); | |
26d43845 | 124 | mlen = DIV_ROUND_UP(mblen, 8); |
051dbb91 | 125 | |
f58a0815 DK |
126 | if (mlen == 0) |
127 | goto err; | |
051dbb91 DK |
128 | |
129 | out1 = kzalloc(mlen, GFP_KERNEL); | |
130 | if (!out1) | |
131 | goto err; | |
132 | ||
051dbb91 DK |
133 | nret = siglen; |
134 | in = mpi_read_from_buffer(sig, &nret); | |
135 | if (!in) | |
136 | goto err; | |
137 | ||
138 | res = mpi_alloc(mpi_get_nlimbs(in) * 2); | |
139 | if (!res) | |
140 | goto err; | |
141 | ||
142 | err = mpi_powm(res, in, pkey[1], pkey[0]); | |
143 | if (err) | |
144 | goto err; | |
145 | ||
146 | if (mpi_get_nlimbs(res) * BYTES_PER_MPI_LIMB > mlen) { | |
147 | err = -EINVAL; | |
148 | goto err; | |
149 | } | |
150 | ||
151 | p = mpi_get_buffer(res, &l, NULL); | |
152 | if (!p) { | |
153 | err = -EINVAL; | |
154 | goto err; | |
155 | } | |
156 | ||
157 | len = mlen; | |
158 | head = len - l; | |
159 | memset(out1, 0, head); | |
160 | memcpy(out1 + head, p, l); | |
161 | ||
7810cc1e YH |
162 | kfree(p); |
163 | ||
26d43845 | 164 | m = pkcs_1_v1_5_decode_emsa(out1, len, mblen, &len); |
051dbb91 | 165 | |
26d43845 | 166 | if (!m || len != hlen || memcmp(m, h, hlen)) |
bc01637a | 167 | err = -EINVAL; |
051dbb91 DK |
168 | |
169 | err: | |
170 | mpi_free(in); | |
171 | mpi_free(res); | |
172 | kfree(out1); | |
86f8bedc DK |
173 | while (--i >= 0) |
174 | mpi_free(pkey[i]); | |
051dbb91 DK |
175 | err1: |
176 | up_read(&key->sem); | |
177 | ||
178 | return err; | |
179 | } | |
180 | ||
181 | /** | |
182 | * digsig_verify() - digital signature verification with public key | |
183 | * @keyring: keyring to search key in | |
184 | * @sig: digital signature | |
54b14f40 | 185 | * @siglen: length of the signature |
051dbb91 DK |
186 | * @data: data |
187 | * @datalen: length of the data | |
54b14f40 FF |
188 | * |
189 | * Returns 0 on success, -EINVAL otherwise | |
051dbb91 DK |
190 | * |
191 | * Verifies data integrity against digital signature. | |
192 | * Currently only RSA is supported. | |
193 | * Normally hash of the content is used as a data for this function. | |
194 | * | |
195 | */ | |
196 | int digsig_verify(struct key *keyring, const char *sig, int siglen, | |
197 | const char *data, int datalen) | |
198 | { | |
199 | int err = -ENOMEM; | |
200 | struct signature_hdr *sh = (struct signature_hdr *)sig; | |
201 | struct shash_desc *desc = NULL; | |
202 | unsigned char hash[SHA1_DIGEST_SIZE]; | |
203 | struct key *key; | |
204 | char name[20]; | |
205 | ||
206 | if (siglen < sizeof(*sh) + 2) | |
207 | return -EINVAL; | |
208 | ||
209 | if (sh->algo != PUBKEY_ALGO_RSA) | |
210 | return -ENOTSUPP; | |
211 | ||
212 | sprintf(name, "%llX", __be64_to_cpup((uint64_t *)sh->keyid)); | |
213 | ||
214 | if (keyring) { | |
215 | /* search in specific keyring */ | |
216 | key_ref_t kref; | |
217 | kref = keyring_search(make_key_ref(keyring, 1UL), | |
218 | &key_type_user, name); | |
219 | if (IS_ERR(kref)) | |
ff6092a8 | 220 | key = ERR_CAST(kref); |
051dbb91 DK |
221 | else |
222 | key = key_ref_to_ptr(kref); | |
223 | } else { | |
224 | key = request_key(&key_type_user, name, NULL); | |
225 | } | |
226 | if (IS_ERR(key)) { | |
227 | pr_err("key not found, id: %s\n", name); | |
228 | return PTR_ERR(key); | |
229 | } | |
230 | ||
231 | desc = kzalloc(sizeof(*desc) + crypto_shash_descsize(shash), | |
232 | GFP_KERNEL); | |
233 | if (!desc) | |
234 | goto err; | |
235 | ||
236 | desc->tfm = shash; | |
237 | desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP; | |
238 | ||
239 | crypto_shash_init(desc); | |
240 | crypto_shash_update(desc, data, datalen); | |
241 | crypto_shash_update(desc, sig, sizeof(*sh)); | |
242 | crypto_shash_final(desc, hash); | |
243 | ||
244 | kfree(desc); | |
245 | ||
246 | /* pass signature mpis address */ | |
247 | err = digsig_verify_rsa(key, sig + sizeof(*sh), siglen - sizeof(*sh), | |
248 | hash, sizeof(hash)); | |
249 | ||
250 | err: | |
251 | key_put(key); | |
252 | ||
253 | return err ? -EINVAL : 0; | |
254 | } | |
255 | EXPORT_SYMBOL_GPL(digsig_verify); | |
256 | ||
257 | static int __init digsig_init(void) | |
258 | { | |
259 | shash = crypto_alloc_shash("sha1", 0, 0); | |
260 | if (IS_ERR(shash)) { | |
261 | pr_err("shash allocation failed\n"); | |
262 | return PTR_ERR(shash); | |
263 | } | |
264 | ||
265 | return 0; | |
266 | ||
267 | } | |
268 | ||
269 | static void __exit digsig_cleanup(void) | |
270 | { | |
271 | crypto_free_shash(shash); | |
272 | } | |
273 | ||
274 | module_init(digsig_init); | |
275 | module_exit(digsig_cleanup); | |
276 | ||
277 | MODULE_LICENSE("GPL"); |