1b886d83cSThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
2051dbb91SDmitry Kasatkin /*
3051dbb91SDmitry Kasatkin * Copyright (C) 2011 Nokia Corporation
4051dbb91SDmitry Kasatkin * Copyright (C) 2011 Intel Corporation
5051dbb91SDmitry Kasatkin *
6051dbb91SDmitry Kasatkin * Author:
7051dbb91SDmitry Kasatkin * Dmitry Kasatkin <dmitry.kasatkin@nokia.com>
8051dbb91SDmitry Kasatkin * <dmitry.kasatkin@intel.com>
9051dbb91SDmitry Kasatkin *
10051dbb91SDmitry Kasatkin * File: sign.c
11051dbb91SDmitry Kasatkin * implements signature (RSA) verification
12051dbb91SDmitry Kasatkin * pkcs decoding is based on LibTomCrypt code
13051dbb91SDmitry Kasatkin */
14051dbb91SDmitry Kasatkin
15051dbb91SDmitry Kasatkin #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
16051dbb91SDmitry Kasatkin
17051dbb91SDmitry Kasatkin #include <linux/err.h>
18051dbb91SDmitry Kasatkin #include <linux/module.h>
19051dbb91SDmitry Kasatkin #include <linux/slab.h>
20051dbb91SDmitry Kasatkin #include <linux/key.h>
21051dbb91SDmitry Kasatkin #include <linux/crypto.h>
22051dbb91SDmitry Kasatkin #include <crypto/hash.h>
23*a24d22b2SEric Biggers #include <crypto/sha1.h>
24051dbb91SDmitry Kasatkin #include <keys/user-type.h>
25051dbb91SDmitry Kasatkin #include <linux/mpi.h>
26051dbb91SDmitry Kasatkin #include <linux/digsig.h>
27051dbb91SDmitry Kasatkin
28051dbb91SDmitry Kasatkin static struct crypto_shash *shash;
29051dbb91SDmitry Kasatkin
pkcs_1_v1_5_decode_emsa(const unsigned char * msg,unsigned long msglen,unsigned long modulus_bitlen,unsigned long * outlen)3026d43845SDmitry Kasatkin static const char *pkcs_1_v1_5_decode_emsa(const unsigned char *msg,
31051dbb91SDmitry Kasatkin unsigned long msglen,
32051dbb91SDmitry Kasatkin unsigned long modulus_bitlen,
33b35e286aSDmitry Kasatkin unsigned long *outlen)
34051dbb91SDmitry Kasatkin {
35051dbb91SDmitry Kasatkin unsigned long modulus_len, ps_len, i;
36051dbb91SDmitry Kasatkin
37051dbb91SDmitry Kasatkin modulus_len = (modulus_bitlen >> 3) + (modulus_bitlen & 7 ? 1 : 0);
38051dbb91SDmitry Kasatkin
39051dbb91SDmitry Kasatkin /* test message size */
40051dbb91SDmitry Kasatkin if ((msglen > modulus_len) || (modulus_len < 11))
4126d43845SDmitry Kasatkin return NULL;
42051dbb91SDmitry Kasatkin
43051dbb91SDmitry Kasatkin /* separate encoded message */
4426d43845SDmitry Kasatkin if (msg[0] != 0x00 || msg[1] != 0x01)
4526d43845SDmitry Kasatkin return NULL;
46051dbb91SDmitry Kasatkin
47051dbb91SDmitry Kasatkin for (i = 2; i < modulus_len - 1; i++)
48051dbb91SDmitry Kasatkin if (msg[i] != 0xFF)
49051dbb91SDmitry Kasatkin break;
50051dbb91SDmitry Kasatkin
51051dbb91SDmitry Kasatkin /* separator check */
52b35e286aSDmitry Kasatkin if (msg[i] != 0)
53051dbb91SDmitry Kasatkin /* There was no octet with hexadecimal value 0x00
54051dbb91SDmitry Kasatkin to separate ps from m. */
5526d43845SDmitry Kasatkin return NULL;
56051dbb91SDmitry Kasatkin
57051dbb91SDmitry Kasatkin ps_len = i - 2;
58051dbb91SDmitry Kasatkin
59051dbb91SDmitry Kasatkin *outlen = (msglen - (2 + ps_len + 1));
60051dbb91SDmitry Kasatkin
6126d43845SDmitry Kasatkin return msg + 2 + ps_len + 1;
62051dbb91SDmitry Kasatkin }
63051dbb91SDmitry Kasatkin
64051dbb91SDmitry Kasatkin /*
65051dbb91SDmitry Kasatkin * RSA Signature verification with public key
66051dbb91SDmitry Kasatkin */
digsig_verify_rsa(struct key * key,const char * sig,int siglen,const char * h,int hlen)67051dbb91SDmitry Kasatkin static int digsig_verify_rsa(struct key *key,
68051dbb91SDmitry Kasatkin const char *sig, int siglen,
69051dbb91SDmitry Kasatkin const char *h, int hlen)
70051dbb91SDmitry Kasatkin {
71051dbb91SDmitry Kasatkin int err = -EINVAL;
72051dbb91SDmitry Kasatkin unsigned long len;
73051dbb91SDmitry Kasatkin unsigned long mlen, mblen;
74051dbb91SDmitry Kasatkin unsigned nret, l;
75b35e286aSDmitry Kasatkin int head, i;
7626d43845SDmitry Kasatkin unsigned char *out1 = NULL;
7726d43845SDmitry Kasatkin const char *m;
78051dbb91SDmitry Kasatkin MPI in = NULL, res = NULL, pkey[2];
79146aa8b1SDavid Howells uint8_t *p, *datap;
80146aa8b1SDavid Howells const uint8_t *endp;
81146aa8b1SDavid Howells const struct user_key_payload *ukp;
82051dbb91SDmitry Kasatkin struct pubkey_hdr *pkh;
83051dbb91SDmitry Kasatkin
84051dbb91SDmitry Kasatkin down_read(&key->sem);
850837e49aSDavid Howells ukp = user_key_payload_locked(key);
86f58a0815SDmitry Kasatkin
87192cabd6SEric Biggers if (!ukp) {
88192cabd6SEric Biggers /* key was revoked before we acquired its semaphore */
89192cabd6SEric Biggers err = -EKEYREVOKED;
90192cabd6SEric Biggers goto err1;
91192cabd6SEric Biggers }
92192cabd6SEric Biggers
93f58a0815SDmitry Kasatkin if (ukp->datalen < sizeof(*pkh))
94f58a0815SDmitry Kasatkin goto err1;
95f58a0815SDmitry Kasatkin
96051dbb91SDmitry Kasatkin pkh = (struct pubkey_hdr *)ukp->data;
97051dbb91SDmitry Kasatkin
98051dbb91SDmitry Kasatkin if (pkh->version != 1)
99051dbb91SDmitry Kasatkin goto err1;
100051dbb91SDmitry Kasatkin
101051dbb91SDmitry Kasatkin if (pkh->algo != PUBKEY_ALGO_RSA)
102051dbb91SDmitry Kasatkin goto err1;
103051dbb91SDmitry Kasatkin
104051dbb91SDmitry Kasatkin if (pkh->nmpi != 2)
105051dbb91SDmitry Kasatkin goto err1;
106051dbb91SDmitry Kasatkin
107051dbb91SDmitry Kasatkin datap = pkh->mpi;
108f58a0815SDmitry Kasatkin endp = ukp->data + ukp->datalen;
109051dbb91SDmitry Kasatkin
110051dbb91SDmitry Kasatkin for (i = 0; i < pkh->nmpi; i++) {
111051dbb91SDmitry Kasatkin unsigned int remaining = endp - datap;
112051dbb91SDmitry Kasatkin pkey[i] = mpi_read_from_buffer(datap, &remaining);
11303cdfaadSNicolai Stange if (IS_ERR(pkey[i])) {
11403cdfaadSNicolai Stange err = PTR_ERR(pkey[i]);
11586f8bedcSDmitry Kasatkin goto err;
11603cdfaadSNicolai Stange }
117051dbb91SDmitry Kasatkin datap += remaining;
118051dbb91SDmitry Kasatkin }
119051dbb91SDmitry Kasatkin
120051dbb91SDmitry Kasatkin mblen = mpi_get_nbits(pkey[0]);
12126d43845SDmitry Kasatkin mlen = DIV_ROUND_UP(mblen, 8);
122051dbb91SDmitry Kasatkin
123c5ce7c69SNicolai Stange if (mlen == 0) {
124c5ce7c69SNicolai Stange err = -EINVAL;
125f58a0815SDmitry Kasatkin goto err;
126c5ce7c69SNicolai Stange }
127c5ce7c69SNicolai Stange
128c5ce7c69SNicolai Stange err = -ENOMEM;
129051dbb91SDmitry Kasatkin
130051dbb91SDmitry Kasatkin out1 = kzalloc(mlen, GFP_KERNEL);
131051dbb91SDmitry Kasatkin if (!out1)
132051dbb91SDmitry Kasatkin goto err;
133051dbb91SDmitry Kasatkin
134051dbb91SDmitry Kasatkin nret = siglen;
135051dbb91SDmitry Kasatkin in = mpi_read_from_buffer(sig, &nret);
13603cdfaadSNicolai Stange if (IS_ERR(in)) {
13703cdfaadSNicolai Stange err = PTR_ERR(in);
138051dbb91SDmitry Kasatkin goto err;
13903cdfaadSNicolai Stange }
140051dbb91SDmitry Kasatkin
141051dbb91SDmitry Kasatkin res = mpi_alloc(mpi_get_nlimbs(in) * 2);
142051dbb91SDmitry Kasatkin if (!res)
143051dbb91SDmitry Kasatkin goto err;
144051dbb91SDmitry Kasatkin
145051dbb91SDmitry Kasatkin err = mpi_powm(res, in, pkey[1], pkey[0]);
146051dbb91SDmitry Kasatkin if (err)
147051dbb91SDmitry Kasatkin goto err;
148051dbb91SDmitry Kasatkin
149051dbb91SDmitry Kasatkin if (mpi_get_nlimbs(res) * BYTES_PER_MPI_LIMB > mlen) {
150051dbb91SDmitry Kasatkin err = -EINVAL;
151051dbb91SDmitry Kasatkin goto err;
152051dbb91SDmitry Kasatkin }
153051dbb91SDmitry Kasatkin
154051dbb91SDmitry Kasatkin p = mpi_get_buffer(res, &l, NULL);
155051dbb91SDmitry Kasatkin if (!p) {
156051dbb91SDmitry Kasatkin err = -EINVAL;
157051dbb91SDmitry Kasatkin goto err;
158051dbb91SDmitry Kasatkin }
159051dbb91SDmitry Kasatkin
160051dbb91SDmitry Kasatkin len = mlen;
161051dbb91SDmitry Kasatkin head = len - l;
162051dbb91SDmitry Kasatkin memset(out1, 0, head);
163051dbb91SDmitry Kasatkin memcpy(out1 + head, p, l);
164051dbb91SDmitry Kasatkin
1657810cc1eSYOSHIFUJI Hideaki kfree(p);
1667810cc1eSYOSHIFUJI Hideaki
16726d43845SDmitry Kasatkin m = pkcs_1_v1_5_decode_emsa(out1, len, mblen, &len);
168051dbb91SDmitry Kasatkin
16926d43845SDmitry Kasatkin if (!m || len != hlen || memcmp(m, h, hlen))
170bc01637aSDmitry Kasatkin err = -EINVAL;
171051dbb91SDmitry Kasatkin
172051dbb91SDmitry Kasatkin err:
173051dbb91SDmitry Kasatkin mpi_free(in);
174051dbb91SDmitry Kasatkin mpi_free(res);
175051dbb91SDmitry Kasatkin kfree(out1);
17686f8bedcSDmitry Kasatkin while (--i >= 0)
17786f8bedcSDmitry Kasatkin mpi_free(pkey[i]);
178051dbb91SDmitry Kasatkin err1:
179051dbb91SDmitry Kasatkin up_read(&key->sem);
180051dbb91SDmitry Kasatkin
181051dbb91SDmitry Kasatkin return err;
182051dbb91SDmitry Kasatkin }
183051dbb91SDmitry Kasatkin
184051dbb91SDmitry Kasatkin /**
185051dbb91SDmitry Kasatkin * digsig_verify() - digital signature verification with public key
186051dbb91SDmitry Kasatkin * @keyring: keyring to search key in
187051dbb91SDmitry Kasatkin * @sig: digital signature
18854b14f40SFabian Frederick * @siglen: length of the signature
189051dbb91SDmitry Kasatkin * @data: data
190051dbb91SDmitry Kasatkin * @datalen: length of the data
19154b14f40SFabian Frederick *
19254b14f40SFabian Frederick * Returns 0 on success, -EINVAL otherwise
193051dbb91SDmitry Kasatkin *
194051dbb91SDmitry Kasatkin * Verifies data integrity against digital signature.
195051dbb91SDmitry Kasatkin * Currently only RSA is supported.
196051dbb91SDmitry Kasatkin * Normally hash of the content is used as a data for this function.
197051dbb91SDmitry Kasatkin *
198051dbb91SDmitry Kasatkin */
digsig_verify(struct key * keyring,const char * sig,int siglen,const char * data,int datalen)199051dbb91SDmitry Kasatkin int digsig_verify(struct key *keyring, const char *sig, int siglen,
200051dbb91SDmitry Kasatkin const char *data, int datalen)
201051dbb91SDmitry Kasatkin {
202051dbb91SDmitry Kasatkin int err = -ENOMEM;
203051dbb91SDmitry Kasatkin struct signature_hdr *sh = (struct signature_hdr *)sig;
204051dbb91SDmitry Kasatkin struct shash_desc *desc = NULL;
205051dbb91SDmitry Kasatkin unsigned char hash[SHA1_DIGEST_SIZE];
206051dbb91SDmitry Kasatkin struct key *key;
207051dbb91SDmitry Kasatkin char name[20];
208051dbb91SDmitry Kasatkin
209051dbb91SDmitry Kasatkin if (siglen < sizeof(*sh) + 2)
210051dbb91SDmitry Kasatkin return -EINVAL;
211051dbb91SDmitry Kasatkin
212051dbb91SDmitry Kasatkin if (sh->algo != PUBKEY_ALGO_RSA)
213051dbb91SDmitry Kasatkin return -ENOTSUPP;
214051dbb91SDmitry Kasatkin
215051dbb91SDmitry Kasatkin sprintf(name, "%llX", __be64_to_cpup((uint64_t *)sh->keyid));
216051dbb91SDmitry Kasatkin
217051dbb91SDmitry Kasatkin if (keyring) {
218051dbb91SDmitry Kasatkin /* search in specific keyring */
219051dbb91SDmitry Kasatkin key_ref_t kref;
220051dbb91SDmitry Kasatkin kref = keyring_search(make_key_ref(keyring, 1UL),
221dcf49dbcSDavid Howells &key_type_user, name, true);
222051dbb91SDmitry Kasatkin if (IS_ERR(kref))
223ff6092a8SDuan Jiong key = ERR_CAST(kref);
224051dbb91SDmitry Kasatkin else
225051dbb91SDmitry Kasatkin key = key_ref_to_ptr(kref);
226051dbb91SDmitry Kasatkin } else {
227028db3e2SLinus Torvalds key = request_key(&key_type_user, name, NULL);
228051dbb91SDmitry Kasatkin }
229051dbb91SDmitry Kasatkin if (IS_ERR(key)) {
230051dbb91SDmitry Kasatkin pr_err("key not found, id: %s\n", name);
231051dbb91SDmitry Kasatkin return PTR_ERR(key);
232051dbb91SDmitry Kasatkin }
233051dbb91SDmitry Kasatkin
234051dbb91SDmitry Kasatkin desc = kzalloc(sizeof(*desc) + crypto_shash_descsize(shash),
235051dbb91SDmitry Kasatkin GFP_KERNEL);
236051dbb91SDmitry Kasatkin if (!desc)
237051dbb91SDmitry Kasatkin goto err;
238051dbb91SDmitry Kasatkin
239051dbb91SDmitry Kasatkin desc->tfm = shash;
240051dbb91SDmitry Kasatkin
241051dbb91SDmitry Kasatkin crypto_shash_init(desc);
242051dbb91SDmitry Kasatkin crypto_shash_update(desc, data, datalen);
243051dbb91SDmitry Kasatkin crypto_shash_update(desc, sig, sizeof(*sh));
244051dbb91SDmitry Kasatkin crypto_shash_final(desc, hash);
245051dbb91SDmitry Kasatkin
246051dbb91SDmitry Kasatkin kfree(desc);
247051dbb91SDmitry Kasatkin
248051dbb91SDmitry Kasatkin /* pass signature mpis address */
249051dbb91SDmitry Kasatkin err = digsig_verify_rsa(key, sig + sizeof(*sh), siglen - sizeof(*sh),
250051dbb91SDmitry Kasatkin hash, sizeof(hash));
251051dbb91SDmitry Kasatkin
252051dbb91SDmitry Kasatkin err:
253051dbb91SDmitry Kasatkin key_put(key);
254051dbb91SDmitry Kasatkin
255051dbb91SDmitry Kasatkin return err ? -EINVAL : 0;
256051dbb91SDmitry Kasatkin }
257051dbb91SDmitry Kasatkin EXPORT_SYMBOL_GPL(digsig_verify);
258051dbb91SDmitry Kasatkin
digsig_init(void)259051dbb91SDmitry Kasatkin static int __init digsig_init(void)
260051dbb91SDmitry Kasatkin {
261051dbb91SDmitry Kasatkin shash = crypto_alloc_shash("sha1", 0, 0);
262051dbb91SDmitry Kasatkin if (IS_ERR(shash)) {
263051dbb91SDmitry Kasatkin pr_err("shash allocation failed\n");
264051dbb91SDmitry Kasatkin return PTR_ERR(shash);
265051dbb91SDmitry Kasatkin }
266051dbb91SDmitry Kasatkin
267051dbb91SDmitry Kasatkin return 0;
268051dbb91SDmitry Kasatkin
269051dbb91SDmitry Kasatkin }
270051dbb91SDmitry Kasatkin
digsig_cleanup(void)271051dbb91SDmitry Kasatkin static void __exit digsig_cleanup(void)
272051dbb91SDmitry Kasatkin {
273051dbb91SDmitry Kasatkin crypto_free_shash(shash);
274051dbb91SDmitry Kasatkin }
275051dbb91SDmitry Kasatkin
276051dbb91SDmitry Kasatkin module_init(digsig_init);
277051dbb91SDmitry Kasatkin module_exit(digsig_cleanup);
278051dbb91SDmitry Kasatkin
279051dbb91SDmitry Kasatkin MODULE_LICENSE("GPL");
280