crypto/ec/ecp_s390x_nistp.c

   1 /*
   2  * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /*
  11  * EC_METHOD low level APIs are deprecated for public use, but still ok for
  12  * internal use.
  13  */
  14 #include "internal/deprecated.h"
  15
  16 #include <stdlib.h>
  17 #include <string.h>
  18 #include <openssl/err.h>
  19 #include <openssl/rand.h>
  20 #include "ec_local.h"
  21 #include "s390x_arch.h"
  22
  23 /* Size of parameter blocks */
  24 #define S390X_SIZE_PARAM                4096
  25
  26 /* Size of fields in parameter blocks */
  27 #define S390X_SIZE_P256                 32
  28 #define S390X_SIZE_P384                 48
  29 #define S390X_SIZE_P521                 80
  30
  31 /* Offsets of fields in PCC parameter blocks */
  32 #define S390X_OFF_RES_X(n)              (0 * n)
  33 #define S390X_OFF_RES_Y(n)              (1 * n)
  34 #define S390X_OFF_SRC_X(n)              (2 * n)
  35 #define S390X_OFF_SRC_Y(n)              (3 * n)
  36 #define S390X_OFF_SCALAR(n)             (4 * n)
  37
  38 /* Offsets of fields in KDSA parameter blocks */
  39 #define S390X_OFF_R(n)                  (0 * n)
  40 #define S390X_OFF_S(n)                  (1 * n)
  41 #define S390X_OFF_H(n)                  (2 * n)
  42 #define S390X_OFF_K(n)                  (3 * n)
  43 #define S390X_OFF_X(n)                  (3 * n)
  44 #define S390X_OFF_RN(n)                 (4 * n)
  45 #define S390X_OFF_Y(n)                  (4 * n)
  46
  47 static int ec_GFp_s390x_nistp_mul(const EC_GROUP *group, EC_POINT *r,
  48                                   const BIGNUM *scalar,
  49                                   size_t num, const EC_POINT *points[],
  50                                   const BIGNUM *scalars[],
  51                                   BN_CTX *ctx, unsigned int fc, int len)
  52 {
  53     unsigned char param[S390X_SIZE_PARAM];
  54     BIGNUM *x, *y;
  55     const EC_POINT *point_ptr = NULL;
  56     const BIGNUM *scalar_ptr = NULL;
  57     BN_CTX *new_ctx = NULL;
  58     int rc = -1;
  59
  60     if (ctx == NULL) {
  61         ctx = new_ctx = BN_CTX_new_ex(group->libctx);
  62         if (ctx == NULL)
  63             return 0;
  64     }
  65
  66     BN_CTX_start(ctx);
  67
  68     x = BN_CTX_get(ctx);
  69     y = BN_CTX_get(ctx);
  70     if (x == NULL || y == NULL) {
  71         rc = 0;
  72         goto ret;
  73     }
  74
  75     /*
  76      * Use PCC for EC keygen and ECDH key derivation:
  77      * scalar * generator and scalar * peer public key,
  78      * scalar in [0,order).
  79      */
  80     if ((scalar != NULL && num == 0 && BN_is_negative(scalar) == 0)
  81         || (scalar == NULL && num == 1 && BN_is_negative(scalars[0]) == 0)) {
  82
  83         if (num == 0) {
  84             point_ptr = EC_GROUP_get0_generator(group);
  85             scalar_ptr = scalar;
  86         } else {
  87             point_ptr = points[0];
  88             scalar_ptr = scalars[0];
  89         }
  90
  91         if (EC_POINT_is_at_infinity(group, point_ptr) == 1
  92             || BN_is_zero(scalar_ptr)) {
  93             rc = EC_POINT_set_to_infinity(group, r);
  94             goto ret;
  95         }
  96
  97         memset(&param, 0, sizeof(param));
  98
  99         if (group->meth->point_get_affine_coordinates(group, point_ptr,
 100                                                       x, y, ctx) != 1
 101             || BN_bn2binpad(x, param + S390X_OFF_SRC_X(len), len) == -1
 102             || BN_bn2binpad(y, param + S390X_OFF_SRC_Y(len), len) == -1
 103             || BN_bn2binpad(scalar_ptr,
 104                             param + S390X_OFF_SCALAR(len), len) == -1
 105             || s390x_pcc(fc, param) != 0
 106             || BN_bin2bn(param + S390X_OFF_RES_X(len), len, x) == NULL
 107             || BN_bin2bn(param + S390X_OFF_RES_Y(len), len, y) == NULL
 108             || group->meth->point_set_affine_coordinates(group, r,
 109                                                          x, y, ctx) != 1)
 110             goto ret;
 111
 112         rc = 1;
 113     }
 114
 115 ret:
 116     /* Otherwise use default. */
 117     if (rc == -1)
 118         rc = ossl_ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
 119     OPENSSL_cleanse(param + S390X_OFF_SCALAR(len), len);
 120     BN_CTX_end(ctx);
 121     BN_CTX_free(new_ctx);
 122     return rc;
 123 }
 124
 125 static ECDSA_SIG *ecdsa_s390x_nistp_sign_sig(const unsigned char *dgst,
 126                                              int dgstlen,
 127                                              const BIGNUM *kinv,
 128                                              const BIGNUM *r,
 129                                              EC_KEY *eckey,
 130                                              unsigned int fc, int len)
 131 {
 132     unsigned char param[S390X_SIZE_PARAM];
 133     int ok = 0;
 134     BIGNUM *k;
 135     ECDSA_SIG *sig;
 136     const EC_GROUP *group;
 137     const BIGNUM *privkey;
 138     int off;
 139
 140     group = EC_KEY_get0_group(eckey);
 141     privkey = EC_KEY_get0_private_key(eckey);
 142     if (group == NULL || privkey == NULL) {
 143         ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS);
 144         return NULL;
 145     }
 146
 147     if (!EC_KEY_can_sign(eckey)) {
 148         ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
 149         return NULL;
 150     }
 151
 152     k = BN_secure_new();
 153     sig = ECDSA_SIG_new();
 154     if (k == NULL || sig == NULL) {
 155         ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
 156         goto ret;
 157     }
 158
 159     sig->r = BN_new();
 160     sig->s = BN_new();
 161     if (sig->r == NULL || sig->s == NULL) {
 162         ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
 163         goto ret;
 164     }
 165
 166     memset(param, 0, sizeof(param));
 167     off = len - (dgstlen > len ? len : dgstlen);
 168     memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
 169
 170     if (BN_bn2binpad(privkey, param + S390X_OFF_K(len), len) == -1) {
 171         ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
 172         goto ret;
 173     }
 174
 175     if (r == NULL || kinv == NULL) {
 176         /*
 177          * Generate random k and copy to param param block. RAND_priv_bytes_ex
 178          * is used instead of BN_priv_rand_range or BN_generate_dsa_nonce
 179          * because kdsa instruction constructs an in-range, invertible nonce
 180          * internally implementing counter-measures for RNG weakness.
 181          */
 182          if (RAND_priv_bytes_ex(eckey->libctx, param + S390X_OFF_RN(len),
 183                                 len) != 1) {
 184              ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED);
 185              goto ret;
 186          }
 187     } else {
 188         /* Reconstruct k = (k^-1)^-1. */
 189         if (ossl_ec_group_do_inverse_ord(group, k, kinv, NULL) == 0
 190             || BN_bn2binpad(k, param + S390X_OFF_RN(len), len) == -1) {
 191             ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
 192             goto ret;
 193         }
 194         /* Turns KDSA internal nonce-generation off. */
 195         fc |= S390X_KDSA_D;
 196     }
 197
 198     if (s390x_kdsa(fc, param, NULL, 0) != 0) {
 199         ERR_raise(ERR_LIB_EC, ERR_R_ECDSA_LIB);
 200         goto ret;
 201     }
 202
 203     if (BN_bin2bn(param + S390X_OFF_R(len), len, sig->r) == NULL
 204         || BN_bin2bn(param + S390X_OFF_S(len), len, sig->s) == NULL) {
 205         ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
 206         goto ret;
 207     }
 208
 209     ok = 1;
 210 ret:
 211     OPENSSL_cleanse(param + S390X_OFF_K(len), 2 * len);
 212     if (ok != 1) {
 213         ECDSA_SIG_free(sig);
 214         sig = NULL;
 215     }
 216     BN_clear_free(k);
 217     return sig;
 218 }
 219
 220 static int ecdsa_s390x_nistp_verify_sig(const unsigned char *dgst, int dgstlen,
 221                                         const ECDSA_SIG *sig, EC_KEY *eckey,
 222                                         unsigned int fc, int len)
 223 {
 224     unsigned char param[S390X_SIZE_PARAM];
 225     int rc = -1;
 226     BN_CTX *ctx;
 227     BIGNUM *x, *y;
 228     const EC_GROUP *group;
 229     const EC_POINT *pubkey;
 230     int off;
 231
 232     group = EC_KEY_get0_group(eckey);
 233     pubkey = EC_KEY_get0_public_key(eckey);
 234     if (eckey == NULL || group == NULL || pubkey == NULL || sig == NULL) {
 235         ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS);
 236         return -1;
 237     }
 238
 239     if (!EC_KEY_can_sign(eckey)) {
 240         ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
 241         return -1;
 242     }
 243
 244     ctx = BN_CTX_new_ex(group->libctx);
 245     if (ctx == NULL) {
 246         ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
 247         return -1;
 248     }
 249
 250     BN_CTX_start(ctx);
 251
 252     x = BN_CTX_get(ctx);
 253     y = BN_CTX_get(ctx);
 254     if (x == NULL || y == NULL) {
 255         ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
 256         goto ret;
 257     }
 258
 259     memset(param, 0, sizeof(param));
 260     off = len - (dgstlen > len ? len : dgstlen);
 261     memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
 262
 263     if (group->meth->point_get_affine_coordinates(group, pubkey,
 264                                                   x, y, ctx) != 1
 265         || BN_bn2binpad(sig->r, param + S390X_OFF_R(len), len) == -1
 266         || BN_bn2binpad(sig->s, param + S390X_OFF_S(len), len) == -1
 267         || BN_bn2binpad(x, param + S390X_OFF_X(len), len) == -1
 268         || BN_bn2binpad(y, param + S390X_OFF_Y(len), len) == -1) {
 269         ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
 270         goto ret;
 271     }
 272
 273     rc = s390x_kdsa(fc, param, NULL, 0) == 0 ? 1 : 0;
 274 ret:
 275     BN_CTX_end(ctx);
 276     BN_CTX_free(ctx);
 277     return rc;
 278 }
 279
 280 #define EC_GFP_S390X_NISTP_METHOD(bits)                                 \
 281                                                                         \
 282 static int ec_GFp_s390x_nistp##bits##_mul(const EC_GROUP *group,        \
 283                                           EC_POINT *r,                  \
 284                                           const BIGNUM *scalar,         \
 285                                           size_t num,                   \
 286                                           const EC_POINT *points[],     \
 287                                           const BIGNUM *scalars[],      \
 288                                           BN_CTX *ctx)                  \
 289 {                                                                       \
 290     return ec_GFp_s390x_nistp_mul(group, r, scalar, num, points,        \
 291                                   scalars, ctx,                         \
 292                                   S390X_SCALAR_MULTIPLY_P##bits,        \
 293                                   S390X_SIZE_P##bits);                  \
 294 }                                                                       \
 295                                                                         \
 296 static ECDSA_SIG *ecdsa_s390x_nistp##bits##_sign_sig(const unsigned     \
 297                                                      char *dgst,        \
 298                                                      int dgstlen,       \
 299                                                      const BIGNUM *kinv,\
 300                                                      const BIGNUM *r,   \
 301                                                      EC_KEY *eckey)     \
 302 {                                                                       \
 303     return ecdsa_s390x_nistp_sign_sig(dgst, dgstlen, kinv, r, eckey,    \
 304                                       S390X_ECDSA_SIGN_P##bits,         \
 305                                       S390X_SIZE_P##bits);              \
 306 }                                                                       \
 307                                                                         \
 308 static int ecdsa_s390x_nistp##bits##_verify_sig(const                   \
 309                                                 unsigned char *dgst,    \
 310                                                 int dgstlen,            \
 311                                                 const ECDSA_SIG *sig,   \
 312                                                 EC_KEY *eckey)          \
 313 {                                                                       \
 314     return ecdsa_s390x_nistp_verify_sig(dgst, dgstlen, sig, eckey,      \
 315                                         S390X_ECDSA_VERIFY_P##bits,     \
 316                                         S390X_SIZE_P##bits);            \
 317 }                                                                       \
 318                                                                         \
 319 const EC_METHOD *EC_GFp_s390x_nistp##bits##_method(void)                \
 320 {                                                                       \
 321     static const EC_METHOD EC_GFp_s390x_nistp##bits##_meth = {          \
 322         EC_FLAGS_DEFAULT_OCT,                                           \
 323         NID_X9_62_prime_field,                                          \
 324         ossl_ec_GFp_simple_group_init,                                  \
 325         ossl_ec_GFp_simple_group_finish,                                \
 326         ossl_ec_GFp_simple_group_clear_finish,                          \
 327         ossl_ec_GFp_simple_group_copy,                                  \
 328         ossl_ec_GFp_simple_group_set_curve,                             \
 329         ossl_ec_GFp_simple_group_get_curve,                             \
 330         ossl_ec_GFp_simple_group_get_degree,                            \
 331         ossl_ec_group_simple_order_bits,                                \
 332         ossl_ec_GFp_simple_group_check_discriminant,                    \
 333         ossl_ec_GFp_simple_point_init,                                  \
 334         ossl_ec_GFp_simple_point_finish,                                \
 335         ossl_ec_GFp_simple_point_clear_finish,                          \
 336         ossl_ec_GFp_simple_point_copy,                                  \
 337         ossl_ec_GFp_simple_point_set_to_infinity,                       \
 338         ossl_ec_GFp_simple_point_set_affine_coordinates,                \
 339         ossl_ec_GFp_simple_point_get_affine_coordinates,                \
 340         NULL, /* point_set_compressed_coordinates */                    \
 341         NULL, /* point2oct */                                           \
 342         NULL, /* oct2point */                                           \
 343         ossl_ec_GFp_simple_add,                                         \
 344         ossl_ec_GFp_simple_dbl,                                         \
 345         ossl_ec_GFp_simple_invert,                                      \
 346         ossl_ec_GFp_simple_is_at_infinity,                              \
 347         ossl_ec_GFp_simple_is_on_curve,                                 \
 348         ossl_ec_GFp_simple_cmp,                                         \
 349         ossl_ec_GFp_simple_make_affine,                                 \
 350         ossl_ec_GFp_simple_points_make_affine,                          \
 351         ec_GFp_s390x_nistp##bits##_mul,                                 \
 352         NULL, /* precompute_mult */                                     \
 353         NULL, /* have_precompute_mult */                                \
 354         ossl_ec_GFp_simple_field_mul,                                   \
 355         ossl_ec_GFp_simple_field_sqr,                                   \
 356         NULL, /* field_div */                                           \
 357         ossl_ec_GFp_simple_field_inv,                                   \
 358         NULL, /* field_encode */                                        \
 359         NULL, /* field_decode */                                        \
 360         NULL, /* field_set_to_one */                                    \
 361         ossl_ec_key_simple_priv2oct,                                    \
 362         ossl_ec_key_simple_oct2priv,                                    \
 363         NULL, /* set_private */                                         \
 364         ossl_ec_key_simple_generate_key,                                \
 365         ossl_ec_key_simple_check_key,                                   \
 366         ossl_ec_key_simple_generate_public_key,                         \
 367         NULL, /* keycopy */                                             \
 368         NULL, /* keyfinish */                                           \
 369         ossl_ecdh_simple_compute_key,                                   \
 370         ossl_ecdsa_simple_sign_setup,                                   \
 371         ecdsa_s390x_nistp##bits##_sign_sig,                             \
 372         ecdsa_s390x_nistp##bits##_verify_sig,                           \
 373         NULL, /* field_inverse_mod_ord */                               \
 374         ossl_ec_GFp_simple_blind_coordinates,                           \
 375         ossl_ec_GFp_simple_ladder_pre,                                  \
 376         ossl_ec_GFp_simple_ladder_step,                                 \
 377         ossl_ec_GFp_simple_ladder_post                                  \
 378     };                                                                  \
 379     static const EC_METHOD *ret;                                        \
 380                                                                         \
 381     if ((OPENSSL_s390xcap_P.pcc[1]                                      \
 382          & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P##bits))                 \
 383         && (OPENSSL_s390xcap_P.kdsa[0]                                  \
 384             & S390X_CAPBIT(S390X_ECDSA_VERIFY_P##bits))                 \
 385         && (OPENSSL_s390xcap_P.kdsa[0]                                  \
 386             & S390X_CAPBIT(S390X_ECDSA_SIGN_P##bits)))                  \
 387         ret = &EC_GFp_s390x_nistp##bits##_meth;                         \
 388     else                                                                \
 389         ret = EC_GFp_mont_method();                                     \
 390                                                                         \
 391     return ret;                                                         \
 392 }
 393
 394 EC_GFP_S390X_NISTP_METHOD(256)
 395 EC_GFP_S390X_NISTP_METHOD(384)
 396 EC_GFP_S390X_NISTP_METHOD(521)