2
0

ecx_meth.c 37 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427
  1. /*
  2. * Copyright 2006-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * ECDSA low level APIs are deprecated for public use, but still ok for
  11. * internal use.
  12. */
  13. #include "internal/deprecated.h"
  14. #include <stdio.h>
  15. #include <openssl/x509.h>
  16. #include <openssl/ec.h>
  17. #include <openssl/core_names.h>
  18. #include <openssl/param_build.h>
  19. #include <openssl/rand.h>
  20. #include "internal/cryptlib.h"
  21. #include "internal/provider.h"
  22. #include "crypto/asn1.h"
  23. #include "crypto/evp.h"
  24. #include "crypto/ecx.h"
  25. #include "ec_local.h"
  26. #include "curve448/curve448_local.h"
  27. #include "ecx_backend.h"
  28. static int ecx_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
  29. {
  30. const ECX_KEY *ecxkey = pkey->pkey.ecx;
  31. unsigned char *penc;
  32. if (ecxkey == NULL) {
  33. ERR_raise(ERR_LIB_EC, EC_R_INVALID_KEY);
  34. return 0;
  35. }
  36. penc = OPENSSL_memdup(ecxkey->pubkey, KEYLEN(pkey));
  37. if (penc == NULL)
  38. return 0;
  39. if (!X509_PUBKEY_set0_param(pk, OBJ_nid2obj(pkey->ameth->pkey_id),
  40. V_ASN1_UNDEF, NULL, penc, KEYLEN(pkey))) {
  41. OPENSSL_free(penc);
  42. ERR_raise(ERR_LIB_EC, ERR_R_X509_LIB);
  43. return 0;
  44. }
  45. return 1;
  46. }
  47. static int ecx_pub_decode(EVP_PKEY *pkey, const X509_PUBKEY *pubkey)
  48. {
  49. const unsigned char *p;
  50. int pklen;
  51. X509_ALGOR *palg;
  52. ECX_KEY *ecx;
  53. int ret = 0;
  54. if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &palg, pubkey))
  55. return 0;
  56. ecx = ossl_ecx_key_op(palg, p, pklen, pkey->ameth->pkey_id,
  57. KEY_OP_PUBLIC, NULL, NULL);
  58. if (ecx != NULL) {
  59. ret = 1;
  60. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx);
  61. }
  62. return ret;
  63. }
  64. static int ecx_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  65. {
  66. const ECX_KEY *akey = a->pkey.ecx;
  67. const ECX_KEY *bkey = b->pkey.ecx;
  68. if (akey == NULL || bkey == NULL)
  69. return -2;
  70. return CRYPTO_memcmp(akey->pubkey, bkey->pubkey, KEYLEN(a)) == 0;
  71. }
  72. static int ecx_priv_decode_ex(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8,
  73. OSSL_LIB_CTX *libctx, const char *propq)
  74. {
  75. int ret = 0;
  76. ECX_KEY *ecx = ossl_ecx_key_from_pkcs8(p8, libctx, propq);
  77. if (ecx != NULL) {
  78. ret = 1;
  79. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx);
  80. }
  81. return ret;
  82. }
  83. static int ecx_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
  84. {
  85. const ECX_KEY *ecxkey = pkey->pkey.ecx;
  86. ASN1_OCTET_STRING oct;
  87. unsigned char *penc = NULL;
  88. int penclen;
  89. if (ecxkey == NULL || ecxkey->privkey == NULL) {
  90. ERR_raise(ERR_LIB_EC, EC_R_INVALID_PRIVATE_KEY);
  91. return 0;
  92. }
  93. oct.data = ecxkey->privkey;
  94. oct.length = KEYLEN(pkey);
  95. oct.flags = 0;
  96. penclen = i2d_ASN1_OCTET_STRING(&oct, &penc);
  97. if (penclen < 0) {
  98. ERR_raise(ERR_LIB_EC, ERR_R_ASN1_LIB);
  99. return 0;
  100. }
  101. if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(pkey->ameth->pkey_id), 0,
  102. V_ASN1_UNDEF, NULL, penc, penclen)) {
  103. OPENSSL_clear_free(penc, penclen);
  104. ERR_raise(ERR_LIB_EC, ERR_R_ASN1_LIB);
  105. return 0;
  106. }
  107. return 1;
  108. }
  109. static int ecx_size(const EVP_PKEY *pkey)
  110. {
  111. return KEYLEN(pkey);
  112. }
  113. static int ecx_bits(const EVP_PKEY *pkey)
  114. {
  115. if (IS25519(pkey->ameth->pkey_id)) {
  116. return X25519_BITS;
  117. } else if (ISX448(pkey->ameth->pkey_id)) {
  118. return X448_BITS;
  119. } else {
  120. return ED448_BITS;
  121. }
  122. }
  123. static int ecx_security_bits(const EVP_PKEY *pkey)
  124. {
  125. if (IS25519(pkey->ameth->pkey_id)) {
  126. return X25519_SECURITY_BITS;
  127. } else {
  128. return X448_SECURITY_BITS;
  129. }
  130. }
  131. static void ecx_free(EVP_PKEY *pkey)
  132. {
  133. ossl_ecx_key_free(pkey->pkey.ecx);
  134. }
  135. /* "parameters" are always equal */
  136. static int ecx_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
  137. {
  138. return 1;
  139. }
  140. static int ecx_key_print(BIO *bp, const EVP_PKEY *pkey, int indent,
  141. ASN1_PCTX *ctx, ecx_key_op_t op)
  142. {
  143. const ECX_KEY *ecxkey = pkey->pkey.ecx;
  144. const char *nm = OBJ_nid2ln(pkey->ameth->pkey_id);
  145. if (op == KEY_OP_PRIVATE) {
  146. if (ecxkey == NULL || ecxkey->privkey == NULL) {
  147. if (BIO_printf(bp, "%*s<INVALID PRIVATE KEY>\n", indent, "") <= 0)
  148. return 0;
  149. return 1;
  150. }
  151. if (BIO_printf(bp, "%*s%s Private-Key:\n", indent, "", nm) <= 0)
  152. return 0;
  153. if (BIO_printf(bp, "%*spriv:\n", indent, "") <= 0)
  154. return 0;
  155. if (ASN1_buf_print(bp, ecxkey->privkey, KEYLEN(pkey),
  156. indent + 4) == 0)
  157. return 0;
  158. } else {
  159. if (ecxkey == NULL) {
  160. if (BIO_printf(bp, "%*s<INVALID PUBLIC KEY>\n", indent, "") <= 0)
  161. return 0;
  162. return 1;
  163. }
  164. if (BIO_printf(bp, "%*s%s Public-Key:\n", indent, "", nm) <= 0)
  165. return 0;
  166. }
  167. if (BIO_printf(bp, "%*spub:\n", indent, "") <= 0)
  168. return 0;
  169. if (ASN1_buf_print(bp, ecxkey->pubkey, KEYLEN(pkey),
  170. indent + 4) == 0)
  171. return 0;
  172. return 1;
  173. }
  174. static int ecx_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent,
  175. ASN1_PCTX *ctx)
  176. {
  177. return ecx_key_print(bp, pkey, indent, ctx, KEY_OP_PRIVATE);
  178. }
  179. static int ecx_pub_print(BIO *bp, const EVP_PKEY *pkey, int indent,
  180. ASN1_PCTX *ctx)
  181. {
  182. return ecx_key_print(bp, pkey, indent, ctx, KEY_OP_PUBLIC);
  183. }
  184. static int ecx_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
  185. {
  186. switch (op) {
  187. case ASN1_PKEY_CTRL_SET1_TLS_ENCPT: {
  188. ECX_KEY *ecx = ossl_ecx_key_op(NULL, arg2, arg1, pkey->ameth->pkey_id,
  189. KEY_OP_PUBLIC, NULL, NULL);
  190. if (ecx != NULL) {
  191. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx);
  192. return 1;
  193. }
  194. return 0;
  195. }
  196. case ASN1_PKEY_CTRL_GET1_TLS_ENCPT:
  197. if (pkey->pkey.ecx != NULL) {
  198. unsigned char **ppt = arg2;
  199. *ppt = OPENSSL_memdup(pkey->pkey.ecx->pubkey, KEYLEN(pkey));
  200. if (*ppt != NULL)
  201. return KEYLEN(pkey);
  202. }
  203. return 0;
  204. default:
  205. return -2;
  206. }
  207. }
  208. static int ecd_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
  209. {
  210. switch (op) {
  211. case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
  212. /* We currently only support Pure EdDSA which takes no digest */
  213. *(int *)arg2 = NID_undef;
  214. return 2;
  215. default:
  216. return -2;
  217. }
  218. }
  219. static int ecx_set_priv_key(EVP_PKEY *pkey, const unsigned char *priv,
  220. size_t len)
  221. {
  222. OSSL_LIB_CTX *libctx = NULL;
  223. ECX_KEY *ecx = NULL;
  224. if (pkey->keymgmt != NULL)
  225. libctx = ossl_provider_libctx(EVP_KEYMGMT_get0_provider(pkey->keymgmt));
  226. ecx = ossl_ecx_key_op(NULL, priv, len, pkey->ameth->pkey_id,
  227. KEY_OP_PRIVATE, libctx, NULL);
  228. if (ecx != NULL) {
  229. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx);
  230. return 1;
  231. }
  232. return 0;
  233. }
  234. static int ecx_set_pub_key(EVP_PKEY *pkey, const unsigned char *pub, size_t len)
  235. {
  236. OSSL_LIB_CTX *libctx = NULL;
  237. ECX_KEY *ecx = NULL;
  238. if (pkey->keymgmt != NULL)
  239. libctx = ossl_provider_libctx(EVP_KEYMGMT_get0_provider(pkey->keymgmt));
  240. ecx = ossl_ecx_key_op(NULL, pub, len, pkey->ameth->pkey_id,
  241. KEY_OP_PUBLIC, libctx, NULL);
  242. if (ecx != NULL) {
  243. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx);
  244. return 1;
  245. }
  246. return 0;
  247. }
  248. static int ecx_get_priv_key(const EVP_PKEY *pkey, unsigned char *priv,
  249. size_t *len)
  250. {
  251. const ECX_KEY *key = pkey->pkey.ecx;
  252. if (priv == NULL) {
  253. *len = KEYLENID(pkey->ameth->pkey_id);
  254. return 1;
  255. }
  256. if (key == NULL
  257. || key->privkey == NULL
  258. || *len < (size_t)KEYLENID(pkey->ameth->pkey_id))
  259. return 0;
  260. *len = KEYLENID(pkey->ameth->pkey_id);
  261. memcpy(priv, key->privkey, *len);
  262. return 1;
  263. }
  264. static int ecx_get_pub_key(const EVP_PKEY *pkey, unsigned char *pub,
  265. size_t *len)
  266. {
  267. const ECX_KEY *key = pkey->pkey.ecx;
  268. if (pub == NULL) {
  269. *len = KEYLENID(pkey->ameth->pkey_id);
  270. return 1;
  271. }
  272. if (key == NULL
  273. || *len < (size_t)KEYLENID(pkey->ameth->pkey_id))
  274. return 0;
  275. *len = KEYLENID(pkey->ameth->pkey_id);
  276. memcpy(pub, key->pubkey, *len);
  277. return 1;
  278. }
  279. static size_t ecx_pkey_dirty_cnt(const EVP_PKEY *pkey)
  280. {
  281. /*
  282. * We provide no mechanism to "update" an ECX key once it has been set,
  283. * therefore we do not have to maintain a dirty count.
  284. */
  285. return 1;
  286. }
  287. static int ecx_pkey_export_to(const EVP_PKEY *from, void *to_keydata,
  288. OSSL_FUNC_keymgmt_import_fn *importer,
  289. OSSL_LIB_CTX *libctx, const char *propq)
  290. {
  291. const ECX_KEY *key = from->pkey.ecx;
  292. OSSL_PARAM_BLD *tmpl = OSSL_PARAM_BLD_new();
  293. OSSL_PARAM *params = NULL;
  294. int selection = 0;
  295. int rv = 0;
  296. if (tmpl == NULL)
  297. return 0;
  298. /* A key must at least have a public part */
  299. if (!OSSL_PARAM_BLD_push_octet_string(tmpl, OSSL_PKEY_PARAM_PUB_KEY,
  300. key->pubkey, key->keylen))
  301. goto err;
  302. selection |= OSSL_KEYMGMT_SELECT_PUBLIC_KEY;
  303. if (key->privkey != NULL) {
  304. if (!OSSL_PARAM_BLD_push_octet_string(tmpl,
  305. OSSL_PKEY_PARAM_PRIV_KEY,
  306. key->privkey, key->keylen))
  307. goto err;
  308. selection |= OSSL_KEYMGMT_SELECT_PRIVATE_KEY;
  309. }
  310. params = OSSL_PARAM_BLD_to_param(tmpl);
  311. /* We export, the provider imports */
  312. rv = importer(to_keydata, selection, params);
  313. err:
  314. OSSL_PARAM_BLD_free(tmpl);
  315. OSSL_PARAM_free(params);
  316. return rv;
  317. }
  318. static int ecx_generic_import_from(const OSSL_PARAM params[], void *vpctx,
  319. int keytype)
  320. {
  321. EVP_PKEY_CTX *pctx = vpctx;
  322. EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(pctx);
  323. ECX_KEY *ecx = ossl_ecx_key_new(pctx->libctx, KEYNID2TYPE(keytype), 0,
  324. pctx->propquery);
  325. if (ecx == NULL) {
  326. ERR_raise(ERR_LIB_DH, ERR_R_EC_LIB);
  327. return 0;
  328. }
  329. if (!ossl_ecx_key_fromdata(ecx, params, 1)
  330. || !EVP_PKEY_assign(pkey, keytype, ecx)) {
  331. ossl_ecx_key_free(ecx);
  332. return 0;
  333. }
  334. return 1;
  335. }
  336. static int ecx_pkey_copy(EVP_PKEY *to, EVP_PKEY *from)
  337. {
  338. ECX_KEY *ecx = from->pkey.ecx, *dupkey = NULL;
  339. int ret;
  340. if (ecx != NULL) {
  341. dupkey = ossl_ecx_key_dup(ecx, OSSL_KEYMGMT_SELECT_ALL);
  342. if (dupkey == NULL)
  343. return 0;
  344. }
  345. ret = EVP_PKEY_assign(to, from->type, dupkey);
  346. if (!ret)
  347. ossl_ecx_key_free(dupkey);
  348. return ret;
  349. }
  350. static int x25519_import_from(const OSSL_PARAM params[], void *vpctx)
  351. {
  352. return ecx_generic_import_from(params, vpctx, EVP_PKEY_X25519);
  353. }
  354. const EVP_PKEY_ASN1_METHOD ossl_ecx25519_asn1_meth = {
  355. EVP_PKEY_X25519,
  356. EVP_PKEY_X25519,
  357. 0,
  358. "X25519",
  359. "OpenSSL X25519 algorithm",
  360. ecx_pub_decode,
  361. ecx_pub_encode,
  362. ecx_pub_cmp,
  363. ecx_pub_print,
  364. NULL,
  365. ecx_priv_encode,
  366. ecx_priv_print,
  367. ecx_size,
  368. ecx_bits,
  369. ecx_security_bits,
  370. 0, 0, 0, 0,
  371. ecx_cmp_parameters,
  372. 0, 0,
  373. ecx_free,
  374. ecx_ctrl,
  375. NULL,
  376. NULL,
  377. NULL,
  378. NULL,
  379. NULL,
  380. NULL,
  381. NULL,
  382. NULL,
  383. ecx_set_priv_key,
  384. ecx_set_pub_key,
  385. ecx_get_priv_key,
  386. ecx_get_pub_key,
  387. ecx_pkey_dirty_cnt,
  388. ecx_pkey_export_to,
  389. x25519_import_from,
  390. ecx_pkey_copy,
  391. ecx_priv_decode_ex
  392. };
  393. static int x448_import_from(const OSSL_PARAM params[], void *vpctx)
  394. {
  395. return ecx_generic_import_from(params, vpctx, EVP_PKEY_X448);
  396. }
  397. const EVP_PKEY_ASN1_METHOD ossl_ecx448_asn1_meth = {
  398. EVP_PKEY_X448,
  399. EVP_PKEY_X448,
  400. 0,
  401. "X448",
  402. "OpenSSL X448 algorithm",
  403. ecx_pub_decode,
  404. ecx_pub_encode,
  405. ecx_pub_cmp,
  406. ecx_pub_print,
  407. NULL,
  408. ecx_priv_encode,
  409. ecx_priv_print,
  410. ecx_size,
  411. ecx_bits,
  412. ecx_security_bits,
  413. 0, 0, 0, 0,
  414. ecx_cmp_parameters,
  415. 0, 0,
  416. ecx_free,
  417. ecx_ctrl,
  418. NULL,
  419. NULL,
  420. NULL,
  421. NULL,
  422. NULL,
  423. NULL,
  424. NULL,
  425. NULL,
  426. ecx_set_priv_key,
  427. ecx_set_pub_key,
  428. ecx_get_priv_key,
  429. ecx_get_pub_key,
  430. ecx_pkey_dirty_cnt,
  431. ecx_pkey_export_to,
  432. x448_import_from,
  433. ecx_pkey_copy,
  434. ecx_priv_decode_ex
  435. };
  436. static int ecd_size25519(const EVP_PKEY *pkey)
  437. {
  438. return ED25519_SIGSIZE;
  439. }
  440. static int ecd_size448(const EVP_PKEY *pkey)
  441. {
  442. return ED448_SIGSIZE;
  443. }
  444. static int ecd_item_verify(EVP_MD_CTX *ctx, const ASN1_ITEM *it,
  445. const void *asn, const X509_ALGOR *sigalg,
  446. const ASN1_BIT_STRING *str, EVP_PKEY *pkey)
  447. {
  448. const ASN1_OBJECT *obj;
  449. int ptype;
  450. int nid;
  451. /* Sanity check: make sure it is ED25519/ED448 with absent parameters */
  452. X509_ALGOR_get0(&obj, &ptype, NULL, sigalg);
  453. nid = OBJ_obj2nid(obj);
  454. if ((nid != NID_ED25519 && nid != NID_ED448) || ptype != V_ASN1_UNDEF) {
  455. ERR_raise(ERR_LIB_EC, EC_R_INVALID_ENCODING);
  456. return 0;
  457. }
  458. if (!EVP_DigestVerifyInit(ctx, NULL, NULL, NULL, pkey))
  459. return 0;
  460. return 2;
  461. }
  462. static int ecd_item_sign(X509_ALGOR *alg1, X509_ALGOR *alg2, int nid)
  463. {
  464. /* Note that X509_ALGOR_set0(..., ..., V_ASN1_UNDEF, ...) cannot fail */
  465. /* Set algorithms identifiers */
  466. (void)X509_ALGOR_set0(alg1, OBJ_nid2obj(nid), V_ASN1_UNDEF, NULL);
  467. if (alg2 != NULL)
  468. (void)X509_ALGOR_set0(alg2, OBJ_nid2obj(nid), V_ASN1_UNDEF, NULL);
  469. /* Algorithm identifiers set: carry on as normal */
  470. return 3;
  471. }
  472. static int ecd_item_sign25519(EVP_MD_CTX *ctx, const ASN1_ITEM *it,
  473. const void *asn,
  474. X509_ALGOR *alg1, X509_ALGOR *alg2,
  475. ASN1_BIT_STRING *str)
  476. {
  477. return ecd_item_sign(alg1, alg2, NID_ED25519);
  478. }
  479. static int ecd_sig_info_set25519(X509_SIG_INFO *siginf, const X509_ALGOR *alg,
  480. const ASN1_STRING *sig)
  481. {
  482. X509_SIG_INFO_set(siginf, NID_undef, NID_ED25519, X25519_SECURITY_BITS,
  483. X509_SIG_INFO_TLS);
  484. return 1;
  485. }
  486. static int ecd_item_sign448(EVP_MD_CTX *ctx, const ASN1_ITEM *it,
  487. const void *asn,
  488. X509_ALGOR *alg1, X509_ALGOR *alg2,
  489. ASN1_BIT_STRING *str)
  490. {
  491. return ecd_item_sign(alg1, alg2, NID_ED448);
  492. }
  493. static int ecd_sig_info_set448(X509_SIG_INFO *siginf, const X509_ALGOR *alg,
  494. const ASN1_STRING *sig)
  495. {
  496. X509_SIG_INFO_set(siginf, NID_undef, NID_ED448, X448_SECURITY_BITS,
  497. X509_SIG_INFO_TLS);
  498. return 1;
  499. }
  500. static int ed25519_import_from(const OSSL_PARAM params[], void *vpctx)
  501. {
  502. return ecx_generic_import_from(params, vpctx, EVP_PKEY_ED25519);
  503. }
  504. const EVP_PKEY_ASN1_METHOD ossl_ed25519_asn1_meth = {
  505. EVP_PKEY_ED25519,
  506. EVP_PKEY_ED25519,
  507. 0,
  508. "ED25519",
  509. "OpenSSL ED25519 algorithm",
  510. ecx_pub_decode,
  511. ecx_pub_encode,
  512. ecx_pub_cmp,
  513. ecx_pub_print,
  514. NULL,
  515. ecx_priv_encode,
  516. ecx_priv_print,
  517. ecd_size25519,
  518. ecx_bits,
  519. ecx_security_bits,
  520. 0, 0, 0, 0,
  521. ecx_cmp_parameters,
  522. 0, 0,
  523. ecx_free,
  524. ecd_ctrl,
  525. NULL,
  526. NULL,
  527. ecd_item_verify,
  528. ecd_item_sign25519,
  529. ecd_sig_info_set25519,
  530. NULL,
  531. NULL,
  532. NULL,
  533. ecx_set_priv_key,
  534. ecx_set_pub_key,
  535. ecx_get_priv_key,
  536. ecx_get_pub_key,
  537. ecx_pkey_dirty_cnt,
  538. ecx_pkey_export_to,
  539. ed25519_import_from,
  540. ecx_pkey_copy,
  541. ecx_priv_decode_ex
  542. };
  543. static int ed448_import_from(const OSSL_PARAM params[], void *vpctx)
  544. {
  545. return ecx_generic_import_from(params, vpctx, EVP_PKEY_ED448);
  546. }
  547. const EVP_PKEY_ASN1_METHOD ossl_ed448_asn1_meth = {
  548. EVP_PKEY_ED448,
  549. EVP_PKEY_ED448,
  550. 0,
  551. "ED448",
  552. "OpenSSL ED448 algorithm",
  553. ecx_pub_decode,
  554. ecx_pub_encode,
  555. ecx_pub_cmp,
  556. ecx_pub_print,
  557. NULL,
  558. ecx_priv_encode,
  559. ecx_priv_print,
  560. ecd_size448,
  561. ecx_bits,
  562. ecx_security_bits,
  563. 0, 0, 0, 0,
  564. ecx_cmp_parameters,
  565. 0, 0,
  566. ecx_free,
  567. ecd_ctrl,
  568. NULL,
  569. NULL,
  570. ecd_item_verify,
  571. ecd_item_sign448,
  572. ecd_sig_info_set448,
  573. NULL,
  574. NULL,
  575. NULL,
  576. ecx_set_priv_key,
  577. ecx_set_pub_key,
  578. ecx_get_priv_key,
  579. ecx_get_pub_key,
  580. ecx_pkey_dirty_cnt,
  581. ecx_pkey_export_to,
  582. ed448_import_from,
  583. ecx_pkey_copy,
  584. ecx_priv_decode_ex
  585. };
  586. static int pkey_ecx_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  587. {
  588. ECX_KEY *ecx = ossl_ecx_key_op(NULL, NULL, 0, ctx->pmeth->pkey_id,
  589. KEY_OP_KEYGEN, NULL, NULL);
  590. if (ecx != NULL) {
  591. EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, ecx);
  592. return 1;
  593. }
  594. return 0;
  595. }
  596. static int validate_ecx_derive(EVP_PKEY_CTX *ctx, unsigned char *key,
  597. size_t *keylen,
  598. const unsigned char **privkey,
  599. const unsigned char **pubkey)
  600. {
  601. const ECX_KEY *ecxkey, *peerkey;
  602. if (ctx->pkey == NULL || ctx->peerkey == NULL) {
  603. ERR_raise(ERR_LIB_EC, EC_R_KEYS_NOT_SET);
  604. return 0;
  605. }
  606. ecxkey = evp_pkey_get_legacy(ctx->pkey);
  607. peerkey = evp_pkey_get_legacy(ctx->peerkey);
  608. if (ecxkey == NULL || ecxkey->privkey == NULL) {
  609. ERR_raise(ERR_LIB_EC, EC_R_INVALID_PRIVATE_KEY);
  610. return 0;
  611. }
  612. if (peerkey == NULL) {
  613. ERR_raise(ERR_LIB_EC, EC_R_INVALID_PEER_KEY);
  614. return 0;
  615. }
  616. *privkey = ecxkey->privkey;
  617. *pubkey = peerkey->pubkey;
  618. return 1;
  619. }
  620. static int pkey_ecx_derive25519(EVP_PKEY_CTX *ctx, unsigned char *key,
  621. size_t *keylen)
  622. {
  623. const unsigned char *privkey, *pubkey;
  624. if (!validate_ecx_derive(ctx, key, keylen, &privkey, &pubkey)
  625. || (key != NULL
  626. && ossl_x25519(key, privkey, pubkey) == 0))
  627. return 0;
  628. *keylen = X25519_KEYLEN;
  629. return 1;
  630. }
  631. static int pkey_ecx_derive448(EVP_PKEY_CTX *ctx, unsigned char *key,
  632. size_t *keylen)
  633. {
  634. const unsigned char *privkey, *pubkey;
  635. if (!validate_ecx_derive(ctx, key, keylen, &privkey, &pubkey)
  636. || (key != NULL
  637. && ossl_x448(key, privkey, pubkey) == 0))
  638. return 0;
  639. *keylen = X448_KEYLEN;
  640. return 1;
  641. }
  642. static int pkey_ecx_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
  643. {
  644. /* Only need to handle peer key for derivation */
  645. if (type == EVP_PKEY_CTRL_PEER_KEY)
  646. return 1;
  647. return -2;
  648. }
  649. static const EVP_PKEY_METHOD ecx25519_pkey_meth = {
  650. EVP_PKEY_X25519,
  651. 0, 0, 0, 0, 0, 0, 0,
  652. pkey_ecx_keygen,
  653. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  654. pkey_ecx_derive25519,
  655. pkey_ecx_ctrl,
  656. 0
  657. };
  658. static const EVP_PKEY_METHOD ecx448_pkey_meth = {
  659. EVP_PKEY_X448,
  660. 0, 0, 0, 0, 0, 0, 0,
  661. pkey_ecx_keygen,
  662. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  663. pkey_ecx_derive448,
  664. pkey_ecx_ctrl,
  665. 0
  666. };
  667. static int pkey_ecd_digestsign25519(EVP_MD_CTX *ctx, unsigned char *sig,
  668. size_t *siglen, const unsigned char *tbs,
  669. size_t tbslen)
  670. {
  671. const ECX_KEY *edkey = evp_pkey_get_legacy(EVP_MD_CTX_get_pkey_ctx(ctx)->pkey);
  672. if (edkey == NULL) {
  673. ERR_raise(ERR_LIB_EC, EC_R_INVALID_KEY);
  674. return 0;
  675. }
  676. if (sig == NULL) {
  677. *siglen = ED25519_SIGSIZE;
  678. return 1;
  679. }
  680. if (*siglen < ED25519_SIGSIZE) {
  681. ERR_raise(ERR_LIB_EC, EC_R_BUFFER_TOO_SMALL);
  682. return 0;
  683. }
  684. if (ossl_ed25519_sign(sig, tbs, tbslen, edkey->pubkey, edkey->privkey,
  685. 0, 0, 0,
  686. NULL, 0,
  687. NULL, NULL) == 0)
  688. return 0;
  689. *siglen = ED25519_SIGSIZE;
  690. return 1;
  691. }
  692. static int pkey_ecd_digestsign448(EVP_MD_CTX *ctx, unsigned char *sig,
  693. size_t *siglen, const unsigned char *tbs,
  694. size_t tbslen)
  695. {
  696. const ECX_KEY *edkey = evp_pkey_get_legacy(EVP_MD_CTX_get_pkey_ctx(ctx)->pkey);
  697. if (edkey == NULL) {
  698. ERR_raise(ERR_LIB_EC, EC_R_INVALID_KEY);
  699. return 0;
  700. }
  701. if (sig == NULL) {
  702. *siglen = ED448_SIGSIZE;
  703. return 1;
  704. }
  705. if (*siglen < ED448_SIGSIZE) {
  706. ERR_raise(ERR_LIB_EC, EC_R_BUFFER_TOO_SMALL);
  707. return 0;
  708. }
  709. if (ossl_ed448_sign(edkey->libctx, sig, tbs, tbslen, edkey->pubkey,
  710. edkey->privkey, NULL, 0, 0, edkey->propq) == 0)
  711. return 0;
  712. *siglen = ED448_SIGSIZE;
  713. return 1;
  714. }
  715. static int pkey_ecd_digestverify25519(EVP_MD_CTX *ctx, const unsigned char *sig,
  716. size_t siglen, const unsigned char *tbs,
  717. size_t tbslen)
  718. {
  719. const ECX_KEY *edkey = evp_pkey_get_legacy(EVP_MD_CTX_get_pkey_ctx(ctx)->pkey);
  720. if (edkey == NULL) {
  721. ERR_raise(ERR_LIB_EC, EC_R_INVALID_KEY);
  722. return 0;
  723. }
  724. if (siglen != ED25519_SIGSIZE)
  725. return 0;
  726. return ossl_ed25519_verify(tbs, tbslen, sig, edkey->pubkey,
  727. 0, 0, 0,
  728. NULL, 0,
  729. edkey->libctx, edkey->propq);
  730. }
  731. static int pkey_ecd_digestverify448(EVP_MD_CTX *ctx, const unsigned char *sig,
  732. size_t siglen, const unsigned char *tbs,
  733. size_t tbslen)
  734. {
  735. const ECX_KEY *edkey = evp_pkey_get_legacy(EVP_MD_CTX_get_pkey_ctx(ctx)->pkey);
  736. if (edkey == NULL) {
  737. ERR_raise(ERR_LIB_EC, EC_R_INVALID_KEY);
  738. return 0;
  739. }
  740. if (siglen != ED448_SIGSIZE)
  741. return 0;
  742. return ossl_ed448_verify(edkey->libctx, tbs, tbslen, sig, edkey->pubkey,
  743. NULL, 0, 0, edkey->propq);
  744. }
  745. static int pkey_ecd_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
  746. {
  747. switch (type) {
  748. case EVP_PKEY_CTRL_MD:
  749. /* Only NULL allowed as digest */
  750. if (p2 == NULL || (const EVP_MD *)p2 == EVP_md_null())
  751. return 1;
  752. ERR_raise(ERR_LIB_EC, EC_R_INVALID_DIGEST_TYPE);
  753. return 0;
  754. case EVP_PKEY_CTRL_DIGESTINIT:
  755. return 1;
  756. }
  757. return -2;
  758. }
  759. static const EVP_PKEY_METHOD ed25519_pkey_meth = {
  760. EVP_PKEY_ED25519, EVP_PKEY_FLAG_SIGCTX_CUSTOM,
  761. 0, 0, 0, 0, 0, 0,
  762. pkey_ecx_keygen,
  763. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  764. pkey_ecd_ctrl,
  765. 0,
  766. pkey_ecd_digestsign25519,
  767. pkey_ecd_digestverify25519
  768. };
  769. static const EVP_PKEY_METHOD ed448_pkey_meth = {
  770. EVP_PKEY_ED448, EVP_PKEY_FLAG_SIGCTX_CUSTOM,
  771. 0, 0, 0, 0, 0, 0,
  772. pkey_ecx_keygen,
  773. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  774. pkey_ecd_ctrl,
  775. 0,
  776. pkey_ecd_digestsign448,
  777. pkey_ecd_digestverify448
  778. };
  779. #ifdef S390X_EC_ASM
  780. # include "s390x_arch.h"
  781. static int s390x_pkey_ecx_keygen25519(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  782. {
  783. static const unsigned char generator[] = {
  784. 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  785. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  786. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
  787. };
  788. ECX_KEY *key = ossl_ecx_key_new(ctx->libctx, ECX_KEY_TYPE_X25519, 1,
  789. ctx->propquery);
  790. unsigned char *privkey = NULL, *pubkey;
  791. if (key == NULL) {
  792. ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
  793. goto err;
  794. }
  795. pubkey = key->pubkey;
  796. privkey = ossl_ecx_key_allocate_privkey(key);
  797. if (privkey == NULL) {
  798. ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
  799. goto err;
  800. }
  801. if (RAND_priv_bytes_ex(ctx->libctx, privkey, X25519_KEYLEN, 0) <= 0)
  802. goto err;
  803. privkey[0] &= 248;
  804. privkey[31] &= 127;
  805. privkey[31] |= 64;
  806. if (s390x_x25519_mul(pubkey, generator, privkey) != 1)
  807. goto err;
  808. EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, key);
  809. return 1;
  810. err:
  811. ossl_ecx_key_free(key);
  812. return 0;
  813. }
  814. static int s390x_pkey_ecx_keygen448(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  815. {
  816. static const unsigned char generator[] = {
  817. 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  818. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  819. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  820. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  821. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
  822. };
  823. ECX_KEY *key = ossl_ecx_key_new(ctx->libctx, ECX_KEY_TYPE_X448, 1,
  824. ctx->propquery);
  825. unsigned char *privkey = NULL, *pubkey;
  826. if (key == NULL) {
  827. ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
  828. goto err;
  829. }
  830. pubkey = key->pubkey;
  831. privkey = ossl_ecx_key_allocate_privkey(key);
  832. if (privkey == NULL) {
  833. ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
  834. goto err;
  835. }
  836. if (RAND_priv_bytes_ex(ctx->libctx, privkey, X448_KEYLEN, 0) <= 0)
  837. goto err;
  838. privkey[0] &= 252;
  839. privkey[55] |= 128;
  840. if (s390x_x448_mul(pubkey, generator, privkey) != 1)
  841. goto err;
  842. EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, key);
  843. return 1;
  844. err:
  845. ossl_ecx_key_free(key);
  846. return 0;
  847. }
  848. static int s390x_pkey_ecd_keygen25519(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  849. {
  850. static const unsigned char generator_x[] = {
  851. 0x1a, 0xd5, 0x25, 0x8f, 0x60, 0x2d, 0x56, 0xc9, 0xb2, 0xa7, 0x25, 0x95,
  852. 0x60, 0xc7, 0x2c, 0x69, 0x5c, 0xdc, 0xd6, 0xfd, 0x31, 0xe2, 0xa4, 0xc0,
  853. 0xfe, 0x53, 0x6e, 0xcd, 0xd3, 0x36, 0x69, 0x21
  854. };
  855. static const unsigned char generator_y[] = {
  856. 0x58, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
  857. 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
  858. 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
  859. };
  860. unsigned char x_dst[32], buff[SHA512_DIGEST_LENGTH];
  861. ECX_KEY *key = ossl_ecx_key_new(ctx->libctx, ECX_KEY_TYPE_ED25519, 1,
  862. ctx->propquery);
  863. unsigned char *privkey = NULL, *pubkey;
  864. unsigned int sz;
  865. EVP_MD *md = NULL;
  866. int rv;
  867. if (key == NULL) {
  868. ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
  869. goto err;
  870. }
  871. pubkey = key->pubkey;
  872. privkey = ossl_ecx_key_allocate_privkey(key);
  873. if (privkey == NULL) {
  874. ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
  875. goto err;
  876. }
  877. if (RAND_priv_bytes_ex(ctx->libctx, privkey, ED25519_KEYLEN, 0) <= 0)
  878. goto err;
  879. md = EVP_MD_fetch(ctx->libctx, "SHA512", ctx->propquery);
  880. if (md == NULL)
  881. goto err;
  882. rv = EVP_Digest(privkey, 32, buff, &sz, md, NULL);
  883. EVP_MD_free(md);
  884. if (!rv)
  885. goto err;
  886. buff[0] &= 248;
  887. buff[31] &= 63;
  888. buff[31] |= 64;
  889. if (s390x_ed25519_mul(x_dst, pubkey,
  890. generator_x, generator_y, buff) != 1)
  891. goto err;
  892. pubkey[31] |= ((x_dst[0] & 0x01) << 7);
  893. EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, key);
  894. return 1;
  895. err:
  896. ossl_ecx_key_free(key);
  897. return 0;
  898. }
  899. static int s390x_pkey_ecd_keygen448(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  900. {
  901. static const unsigned char generator_x[] = {
  902. 0x5e, 0xc0, 0x0c, 0xc7, 0x2b, 0xa8, 0x26, 0x26, 0x8e, 0x93, 0x00, 0x8b,
  903. 0xe1, 0x80, 0x3b, 0x43, 0x11, 0x65, 0xb6, 0x2a, 0xf7, 0x1a, 0xae, 0x12,
  904. 0x64, 0xa4, 0xd3, 0xa3, 0x24, 0xe3, 0x6d, 0xea, 0x67, 0x17, 0x0f, 0x47,
  905. 0x70, 0x65, 0x14, 0x9e, 0xda, 0x36, 0xbf, 0x22, 0xa6, 0x15, 0x1d, 0x22,
  906. 0xed, 0x0d, 0xed, 0x6b, 0xc6, 0x70, 0x19, 0x4f, 0x00
  907. };
  908. static const unsigned char generator_y[] = {
  909. 0x14, 0xfa, 0x30, 0xf2, 0x5b, 0x79, 0x08, 0x98, 0xad, 0xc8, 0xd7, 0x4e,
  910. 0x2c, 0x13, 0xbd, 0xfd, 0xc4, 0x39, 0x7c, 0xe6, 0x1c, 0xff, 0xd3, 0x3a,
  911. 0xd7, 0xc2, 0xa0, 0x05, 0x1e, 0x9c, 0x78, 0x87, 0x40, 0x98, 0xa3, 0x6c,
  912. 0x73, 0x73, 0xea, 0x4b, 0x62, 0xc7, 0xc9, 0x56, 0x37, 0x20, 0x76, 0x88,
  913. 0x24, 0xbc, 0xb6, 0x6e, 0x71, 0x46, 0x3f, 0x69, 0x00
  914. };
  915. unsigned char x_dst[57], buff[114];
  916. ECX_KEY *key = ossl_ecx_key_new(ctx->libctx, ECX_KEY_TYPE_ED448, 1,
  917. ctx->propquery);
  918. unsigned char *privkey = NULL, *pubkey;
  919. EVP_MD_CTX *hashctx = NULL;
  920. EVP_MD *md = NULL;
  921. int rv;
  922. if (key == NULL) {
  923. ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
  924. goto err;
  925. }
  926. pubkey = key->pubkey;
  927. privkey = ossl_ecx_key_allocate_privkey(key);
  928. if (privkey == NULL) {
  929. ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
  930. goto err;
  931. }
  932. if (RAND_priv_bytes_ex(ctx->libctx, privkey, ED448_KEYLEN, 0) <= 0)
  933. goto err;
  934. hashctx = EVP_MD_CTX_new();
  935. if (hashctx == NULL)
  936. goto err;
  937. md = EVP_MD_fetch(ctx->libctx, "SHAKE256", ctx->propquery);
  938. if (md == NULL)
  939. goto err;
  940. rv = EVP_DigestInit_ex(hashctx, md, NULL);
  941. EVP_MD_free(md);
  942. if (rv != 1)
  943. goto err;
  944. if (EVP_DigestUpdate(hashctx, privkey, 57) != 1)
  945. goto err;
  946. if (EVP_DigestFinalXOF(hashctx, buff, sizeof(buff)) != 1)
  947. goto err;
  948. buff[0] &= -4;
  949. buff[55] |= 0x80;
  950. buff[56] = 0;
  951. if (s390x_ed448_mul(x_dst, pubkey,
  952. generator_x, generator_y, buff) != 1)
  953. goto err;
  954. pubkey[56] |= ((x_dst[0] & 0x01) << 7);
  955. EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, key);
  956. EVP_MD_CTX_free(hashctx);
  957. return 1;
  958. err:
  959. ossl_ecx_key_free(key);
  960. EVP_MD_CTX_free(hashctx);
  961. return 0;
  962. }
  963. static int s390x_pkey_ecx_derive25519(EVP_PKEY_CTX *ctx, unsigned char *key,
  964. size_t *keylen)
  965. {
  966. const unsigned char *privkey, *pubkey;
  967. if (!validate_ecx_derive(ctx, key, keylen, &privkey, &pubkey)
  968. || (key != NULL
  969. && s390x_x25519_mul(key, privkey, pubkey) == 0))
  970. return 0;
  971. *keylen = X25519_KEYLEN;
  972. return 1;
  973. }
  974. static int s390x_pkey_ecx_derive448(EVP_PKEY_CTX *ctx, unsigned char *key,
  975. size_t *keylen)
  976. {
  977. const unsigned char *privkey, *pubkey;
  978. if (!validate_ecx_derive(ctx, key, keylen, &privkey, &pubkey)
  979. || (key != NULL
  980. && s390x_x448_mul(key, pubkey, privkey) == 0))
  981. return 0;
  982. *keylen = X448_KEYLEN;
  983. return 1;
  984. }
  985. static int s390x_pkey_ecd_digestsign25519(EVP_MD_CTX *ctx,
  986. unsigned char *sig, size_t *siglen,
  987. const unsigned char *tbs,
  988. size_t tbslen)
  989. {
  990. union {
  991. struct {
  992. unsigned char sig[64];
  993. unsigned char priv[32];
  994. } ed25519;
  995. unsigned long long buff[512];
  996. } param;
  997. const ECX_KEY *edkey = evp_pkey_get_legacy(EVP_MD_CTX_get_pkey_ctx(ctx)->pkey);
  998. int rc;
  999. if (edkey == NULL) {
  1000. ERR_raise(ERR_LIB_EC, EC_R_INVALID_KEY);
  1001. return 0;
  1002. }
  1003. if (sig == NULL) {
  1004. *siglen = ED25519_SIGSIZE;
  1005. return 1;
  1006. }
  1007. if (*siglen < ED25519_SIGSIZE) {
  1008. ERR_raise(ERR_LIB_EC, EC_R_BUFFER_TOO_SMALL);
  1009. return 0;
  1010. }
  1011. memset(&param, 0, sizeof(param));
  1012. memcpy(param.ed25519.priv, edkey->privkey, sizeof(param.ed25519.priv));
  1013. rc = s390x_kdsa(S390X_EDDSA_SIGN_ED25519, &param.ed25519, tbs, tbslen);
  1014. OPENSSL_cleanse(param.ed25519.priv, sizeof(param.ed25519.priv));
  1015. if (rc != 0)
  1016. return 0;
  1017. s390x_flip_endian32(sig, param.ed25519.sig);
  1018. s390x_flip_endian32(sig + 32, param.ed25519.sig + 32);
  1019. *siglen = ED25519_SIGSIZE;
  1020. return 1;
  1021. }
  1022. static int s390x_pkey_ecd_digestsign448(EVP_MD_CTX *ctx,
  1023. unsigned char *sig, size_t *siglen,
  1024. const unsigned char *tbs,
  1025. size_t tbslen)
  1026. {
  1027. union {
  1028. struct {
  1029. unsigned char sig[128];
  1030. unsigned char priv[64];
  1031. } ed448;
  1032. unsigned long long buff[512];
  1033. } param;
  1034. const ECX_KEY *edkey = evp_pkey_get_legacy(EVP_MD_CTX_get_pkey_ctx(ctx)->pkey);
  1035. int rc;
  1036. if (edkey == NULL) {
  1037. ERR_raise(ERR_LIB_EC, EC_R_INVALID_KEY);
  1038. return 0;
  1039. }
  1040. if (sig == NULL) {
  1041. *siglen = ED448_SIGSIZE;
  1042. return 1;
  1043. }
  1044. if (*siglen < ED448_SIGSIZE) {
  1045. ERR_raise(ERR_LIB_EC, EC_R_BUFFER_TOO_SMALL);
  1046. return 0;
  1047. }
  1048. memset(&param, 0, sizeof(param));
  1049. memcpy(param.ed448.priv + 64 - 57, edkey->privkey, 57);
  1050. rc = s390x_kdsa(S390X_EDDSA_SIGN_ED448, &param.ed448, tbs, tbslen);
  1051. OPENSSL_cleanse(param.ed448.priv, sizeof(param.ed448.priv));
  1052. if (rc != 0)
  1053. return 0;
  1054. s390x_flip_endian64(param.ed448.sig, param.ed448.sig);
  1055. s390x_flip_endian64(param.ed448.sig + 64, param.ed448.sig + 64);
  1056. memcpy(sig, param.ed448.sig, 57);
  1057. memcpy(sig + 57, param.ed448.sig + 64, 57);
  1058. *siglen = ED448_SIGSIZE;
  1059. return 1;
  1060. }
  1061. static int s390x_pkey_ecd_digestverify25519(EVP_MD_CTX *ctx,
  1062. const unsigned char *sig,
  1063. size_t siglen,
  1064. const unsigned char *tbs,
  1065. size_t tbslen)
  1066. {
  1067. union {
  1068. struct {
  1069. unsigned char sig[64];
  1070. unsigned char pub[32];
  1071. } ed25519;
  1072. unsigned long long buff[512];
  1073. } param;
  1074. const ECX_KEY *edkey = evp_pkey_get_legacy(EVP_MD_CTX_get_pkey_ctx(ctx)->pkey);
  1075. if (edkey == NULL) {
  1076. ERR_raise(ERR_LIB_EC, EC_R_INVALID_KEY);
  1077. return 0;
  1078. }
  1079. if (siglen != ED25519_SIGSIZE)
  1080. return 0;
  1081. memset(&param, 0, sizeof(param));
  1082. s390x_flip_endian32(param.ed25519.sig, sig);
  1083. s390x_flip_endian32(param.ed25519.sig + 32, sig + 32);
  1084. s390x_flip_endian32(param.ed25519.pub, edkey->pubkey);
  1085. return s390x_kdsa(S390X_EDDSA_VERIFY_ED25519,
  1086. &param.ed25519, tbs, tbslen) == 0 ? 1 : 0;
  1087. }
  1088. static int s390x_pkey_ecd_digestverify448(EVP_MD_CTX *ctx,
  1089. const unsigned char *sig,
  1090. size_t siglen,
  1091. const unsigned char *tbs,
  1092. size_t tbslen)
  1093. {
  1094. union {
  1095. struct {
  1096. unsigned char sig[128];
  1097. unsigned char pub[64];
  1098. } ed448;
  1099. unsigned long long buff[512];
  1100. } param;
  1101. const ECX_KEY *edkey = evp_pkey_get_legacy(EVP_MD_CTX_get_pkey_ctx(ctx)->pkey);
  1102. if (edkey == NULL) {
  1103. ERR_raise(ERR_LIB_EC, EC_R_INVALID_KEY);
  1104. return 0;
  1105. }
  1106. if (siglen != ED448_SIGSIZE)
  1107. return 0;
  1108. memset(&param, 0, sizeof(param));
  1109. memcpy(param.ed448.sig, sig, 57);
  1110. s390x_flip_endian64(param.ed448.sig, param.ed448.sig);
  1111. memcpy(param.ed448.sig + 64, sig + 57, 57);
  1112. s390x_flip_endian64(param.ed448.sig + 64, param.ed448.sig + 64);
  1113. memcpy(param.ed448.pub, edkey->pubkey, 57);
  1114. s390x_flip_endian64(param.ed448.pub, param.ed448.pub);
  1115. return s390x_kdsa(S390X_EDDSA_VERIFY_ED448,
  1116. &param.ed448, tbs, tbslen) == 0 ? 1 : 0;
  1117. }
  1118. static const EVP_PKEY_METHOD ecx25519_s390x_pkey_meth = {
  1119. EVP_PKEY_X25519,
  1120. 0, 0, 0, 0, 0, 0, 0,
  1121. s390x_pkey_ecx_keygen25519,
  1122. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  1123. s390x_pkey_ecx_derive25519,
  1124. pkey_ecx_ctrl,
  1125. 0
  1126. };
  1127. static const EVP_PKEY_METHOD ecx448_s390x_pkey_meth = {
  1128. EVP_PKEY_X448,
  1129. 0, 0, 0, 0, 0, 0, 0,
  1130. s390x_pkey_ecx_keygen448,
  1131. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  1132. s390x_pkey_ecx_derive448,
  1133. pkey_ecx_ctrl,
  1134. 0
  1135. };
  1136. static const EVP_PKEY_METHOD ed25519_s390x_pkey_meth = {
  1137. EVP_PKEY_ED25519, EVP_PKEY_FLAG_SIGCTX_CUSTOM,
  1138. 0, 0, 0, 0, 0, 0,
  1139. s390x_pkey_ecd_keygen25519,
  1140. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  1141. pkey_ecd_ctrl,
  1142. 0,
  1143. s390x_pkey_ecd_digestsign25519,
  1144. s390x_pkey_ecd_digestverify25519
  1145. };
  1146. static const EVP_PKEY_METHOD ed448_s390x_pkey_meth = {
  1147. EVP_PKEY_ED448, EVP_PKEY_FLAG_SIGCTX_CUSTOM,
  1148. 0, 0, 0, 0, 0, 0,
  1149. s390x_pkey_ecd_keygen448,
  1150. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  1151. pkey_ecd_ctrl,
  1152. 0,
  1153. s390x_pkey_ecd_digestsign448,
  1154. s390x_pkey_ecd_digestverify448
  1155. };
  1156. #endif
  1157. const EVP_PKEY_METHOD *ossl_ecx25519_pkey_method(void)
  1158. {
  1159. #ifdef S390X_EC_ASM
  1160. if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_X25519))
  1161. return &ecx25519_s390x_pkey_meth;
  1162. #endif
  1163. return &ecx25519_pkey_meth;
  1164. }
  1165. const EVP_PKEY_METHOD *ossl_ecx448_pkey_method(void)
  1166. {
  1167. #ifdef S390X_EC_ASM
  1168. if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_X448))
  1169. return &ecx448_s390x_pkey_meth;
  1170. #endif
  1171. return &ecx448_pkey_meth;
  1172. }
  1173. const EVP_PKEY_METHOD *ossl_ed25519_pkey_method(void)
  1174. {
  1175. #ifdef S390X_EC_ASM
  1176. if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_ED25519)
  1177. && OPENSSL_s390xcap_P.kdsa[0] & S390X_CAPBIT(S390X_EDDSA_SIGN_ED25519)
  1178. && OPENSSL_s390xcap_P.kdsa[0]
  1179. & S390X_CAPBIT(S390X_EDDSA_VERIFY_ED25519))
  1180. return &ed25519_s390x_pkey_meth;
  1181. #endif
  1182. return &ed25519_pkey_meth;
  1183. }
  1184. const EVP_PKEY_METHOD *ossl_ed448_pkey_method(void)
  1185. {
  1186. #ifdef S390X_EC_ASM
  1187. if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_ED448)
  1188. && OPENSSL_s390xcap_P.kdsa[0] & S390X_CAPBIT(S390X_EDDSA_SIGN_ED448)
  1189. && OPENSSL_s390xcap_P.kdsa[0] & S390X_CAPBIT(S390X_EDDSA_VERIFY_ED448))
  1190. return &ed448_s390x_pkey_meth;
  1191. #endif
  1192. return &ed448_pkey_meth;
  1193. }