ecx_meth.c 36 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388
  1. /*
  2. * Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * ECDSA low level APIs are deprecated for public use, but still ok for
  11. * internal use.
  12. */
  13. #include "internal/deprecated.h"
  14. #include <stdio.h>
  15. #include <openssl/x509.h>
  16. #include <openssl/ec.h>
  17. #include <openssl/core_names.h>
  18. #include <openssl/param_build.h>
  19. #include <openssl/rand.h>
  20. #include "internal/cryptlib.h"
  21. #include "internal/provider.h"
  22. #include "crypto/asn1.h"
  23. #include "crypto/evp.h"
  24. #include "crypto/ecx.h"
  25. #include "ec_local.h"
  26. #include "curve448/curve448_local.h"
  27. #include "ecx_backend.h"
  28. static int ecx_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
  29. {
  30. const ECX_KEY *ecxkey = pkey->pkey.ecx;
  31. unsigned char *penc;
  32. if (ecxkey == NULL) {
  33. ERR_raise(ERR_LIB_EC, EC_R_INVALID_KEY);
  34. return 0;
  35. }
  36. penc = OPENSSL_memdup(ecxkey->pubkey, KEYLEN(pkey));
  37. if (penc == NULL) {
  38. ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
  39. return 0;
  40. }
  41. if (!X509_PUBKEY_set0_param(pk, OBJ_nid2obj(pkey->ameth->pkey_id),
  42. V_ASN1_UNDEF, NULL, penc, KEYLEN(pkey))) {
  43. OPENSSL_free(penc);
  44. ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
  45. return 0;
  46. }
  47. return 1;
  48. }
  49. static int ecx_pub_decode(EVP_PKEY *pkey, const X509_PUBKEY *pubkey)
  50. {
  51. const unsigned char *p;
  52. int pklen;
  53. X509_ALGOR *palg;
  54. ECX_KEY *ecx;
  55. int ret = 0;
  56. if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &palg, pubkey))
  57. return 0;
  58. ecx = ossl_ecx_key_op(palg, p, pklen, pkey->ameth->pkey_id,
  59. KEY_OP_PUBLIC, NULL, NULL);
  60. if (ecx != NULL) {
  61. ret = 1;
  62. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx);
  63. }
  64. return ret;
  65. }
  66. static int ecx_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
  67. {
  68. const ECX_KEY *akey = a->pkey.ecx;
  69. const ECX_KEY *bkey = b->pkey.ecx;
  70. if (akey == NULL || bkey == NULL)
  71. return -2;
  72. return CRYPTO_memcmp(akey->pubkey, bkey->pubkey, KEYLEN(a)) == 0;
  73. }
  74. static int ecx_priv_decode_ex(EVP_PKEY *pkey, const PKCS8_PRIV_KEY_INFO *p8,
  75. OSSL_LIB_CTX *libctx, const char *propq)
  76. {
  77. int ret = 0;
  78. ECX_KEY *ecx = ossl_ecx_key_from_pkcs8(p8, libctx, propq);
  79. if (ecx != NULL) {
  80. ret = 1;
  81. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx);
  82. }
  83. return ret;
  84. }
  85. static int ecx_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
  86. {
  87. const ECX_KEY *ecxkey = pkey->pkey.ecx;
  88. ASN1_OCTET_STRING oct;
  89. unsigned char *penc = NULL;
  90. int penclen;
  91. if (ecxkey == NULL || ecxkey->privkey == NULL) {
  92. ERR_raise(ERR_LIB_EC, EC_R_INVALID_PRIVATE_KEY);
  93. return 0;
  94. }
  95. oct.data = ecxkey->privkey;
  96. oct.length = KEYLEN(pkey);
  97. oct.flags = 0;
  98. penclen = i2d_ASN1_OCTET_STRING(&oct, &penc);
  99. if (penclen < 0) {
  100. ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
  101. return 0;
  102. }
  103. if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(pkey->ameth->pkey_id), 0,
  104. V_ASN1_UNDEF, NULL, penc, penclen)) {
  105. OPENSSL_clear_free(penc, penclen);
  106. ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
  107. return 0;
  108. }
  109. return 1;
  110. }
  111. static int ecx_size(const EVP_PKEY *pkey)
  112. {
  113. return KEYLEN(pkey);
  114. }
  115. static int ecx_bits(const EVP_PKEY *pkey)
  116. {
  117. if (IS25519(pkey->ameth->pkey_id)) {
  118. return X25519_BITS;
  119. } else if(ISX448(pkey->ameth->pkey_id)) {
  120. return X448_BITS;
  121. } else {
  122. return ED448_BITS;
  123. }
  124. }
  125. static int ecx_security_bits(const EVP_PKEY *pkey)
  126. {
  127. if (IS25519(pkey->ameth->pkey_id)) {
  128. return X25519_SECURITY_BITS;
  129. } else {
  130. return X448_SECURITY_BITS;
  131. }
  132. }
  133. static void ecx_free(EVP_PKEY *pkey)
  134. {
  135. ossl_ecx_key_free(pkey->pkey.ecx);
  136. }
  137. /* "parameters" are always equal */
  138. static int ecx_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
  139. {
  140. return 1;
  141. }
  142. static int ecx_key_print(BIO *bp, const EVP_PKEY *pkey, int indent,
  143. ASN1_PCTX *ctx, ecx_key_op_t op)
  144. {
  145. const ECX_KEY *ecxkey = pkey->pkey.ecx;
  146. const char *nm = OBJ_nid2ln(pkey->ameth->pkey_id);
  147. if (op == KEY_OP_PRIVATE) {
  148. if (ecxkey == NULL || ecxkey->privkey == NULL) {
  149. if (BIO_printf(bp, "%*s<INVALID PRIVATE KEY>\n", indent, "") <= 0)
  150. return 0;
  151. return 1;
  152. }
  153. if (BIO_printf(bp, "%*s%s Private-Key:\n", indent, "", nm) <= 0)
  154. return 0;
  155. if (BIO_printf(bp, "%*spriv:\n", indent, "") <= 0)
  156. return 0;
  157. if (ASN1_buf_print(bp, ecxkey->privkey, KEYLEN(pkey),
  158. indent + 4) == 0)
  159. return 0;
  160. } else {
  161. if (ecxkey == NULL) {
  162. if (BIO_printf(bp, "%*s<INVALID PUBLIC KEY>\n", indent, "") <= 0)
  163. return 0;
  164. return 1;
  165. }
  166. if (BIO_printf(bp, "%*s%s Public-Key:\n", indent, "", nm) <= 0)
  167. return 0;
  168. }
  169. if (BIO_printf(bp, "%*spub:\n", indent, "") <= 0)
  170. return 0;
  171. if (ASN1_buf_print(bp, ecxkey->pubkey, KEYLEN(pkey),
  172. indent + 4) == 0)
  173. return 0;
  174. return 1;
  175. }
  176. static int ecx_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent,
  177. ASN1_PCTX *ctx)
  178. {
  179. return ecx_key_print(bp, pkey, indent, ctx, KEY_OP_PRIVATE);
  180. }
  181. static int ecx_pub_print(BIO *bp, const EVP_PKEY *pkey, int indent,
  182. ASN1_PCTX *ctx)
  183. {
  184. return ecx_key_print(bp, pkey, indent, ctx, KEY_OP_PUBLIC);
  185. }
  186. static int ecx_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
  187. {
  188. switch (op) {
  189. case ASN1_PKEY_CTRL_SET1_TLS_ENCPT: {
  190. ECX_KEY *ecx = ossl_ecx_key_op(NULL, arg2, arg1, pkey->ameth->pkey_id,
  191. KEY_OP_PUBLIC, NULL, NULL);
  192. if (ecx != NULL) {
  193. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx);
  194. return 1;
  195. }
  196. return 0;
  197. }
  198. case ASN1_PKEY_CTRL_GET1_TLS_ENCPT:
  199. if (pkey->pkey.ecx != NULL) {
  200. unsigned char **ppt = arg2;
  201. *ppt = OPENSSL_memdup(pkey->pkey.ecx->pubkey, KEYLEN(pkey));
  202. if (*ppt != NULL)
  203. return KEYLEN(pkey);
  204. }
  205. return 0;
  206. default:
  207. return -2;
  208. }
  209. }
  210. static int ecd_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
  211. {
  212. switch (op) {
  213. case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
  214. /* We currently only support Pure EdDSA which takes no digest */
  215. *(int *)arg2 = NID_undef;
  216. return 2;
  217. default:
  218. return -2;
  219. }
  220. }
  221. static int ecx_set_priv_key(EVP_PKEY *pkey, const unsigned char *priv,
  222. size_t len)
  223. {
  224. OSSL_LIB_CTX *libctx = NULL;
  225. ECX_KEY *ecx = NULL;
  226. if (pkey->keymgmt != NULL)
  227. libctx = ossl_provider_libctx(EVP_KEYMGMT_get0_provider(pkey->keymgmt));
  228. ecx = ossl_ecx_key_op(NULL, priv, len, pkey->ameth->pkey_id,
  229. KEY_OP_PRIVATE, libctx, NULL);
  230. if (ecx != NULL) {
  231. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx);
  232. return 1;
  233. }
  234. return 0;
  235. }
  236. static int ecx_set_pub_key(EVP_PKEY *pkey, const unsigned char *pub, size_t len)
  237. {
  238. OSSL_LIB_CTX *libctx = NULL;
  239. ECX_KEY *ecx = NULL;
  240. if (pkey->keymgmt != NULL)
  241. libctx = ossl_provider_libctx(EVP_KEYMGMT_get0_provider(pkey->keymgmt));
  242. ecx = ossl_ecx_key_op(NULL, pub, len, pkey->ameth->pkey_id,
  243. KEY_OP_PUBLIC, libctx, NULL);
  244. if (ecx != NULL) {
  245. EVP_PKEY_assign(pkey, pkey->ameth->pkey_id, ecx);
  246. return 1;
  247. }
  248. return 0;
  249. }
  250. static int ecx_get_priv_key(const EVP_PKEY *pkey, unsigned char *priv,
  251. size_t *len)
  252. {
  253. const ECX_KEY *key = pkey->pkey.ecx;
  254. if (priv == NULL) {
  255. *len = KEYLENID(pkey->ameth->pkey_id);
  256. return 1;
  257. }
  258. if (key == NULL
  259. || key->privkey == NULL
  260. || *len < (size_t)KEYLENID(pkey->ameth->pkey_id))
  261. return 0;
  262. *len = KEYLENID(pkey->ameth->pkey_id);
  263. memcpy(priv, key->privkey, *len);
  264. return 1;
  265. }
  266. static int ecx_get_pub_key(const EVP_PKEY *pkey, unsigned char *pub,
  267. size_t *len)
  268. {
  269. const ECX_KEY *key = pkey->pkey.ecx;
  270. if (pub == NULL) {
  271. *len = KEYLENID(pkey->ameth->pkey_id);
  272. return 1;
  273. }
  274. if (key == NULL
  275. || *len < (size_t)KEYLENID(pkey->ameth->pkey_id))
  276. return 0;
  277. *len = KEYLENID(pkey->ameth->pkey_id);
  278. memcpy(pub, key->pubkey, *len);
  279. return 1;
  280. }
  281. static size_t ecx_pkey_dirty_cnt(const EVP_PKEY *pkey)
  282. {
  283. /*
  284. * We provide no mechanism to "update" an ECX key once it has been set,
  285. * therefore we do not have to maintain a dirty count.
  286. */
  287. return 1;
  288. }
  289. static int ecx_pkey_export_to(const EVP_PKEY *from, void *to_keydata,
  290. OSSL_FUNC_keymgmt_import_fn *importer,
  291. OSSL_LIB_CTX *libctx, const char *propq)
  292. {
  293. const ECX_KEY *key = from->pkey.ecx;
  294. OSSL_PARAM_BLD *tmpl = OSSL_PARAM_BLD_new();
  295. OSSL_PARAM *params = NULL;
  296. int selection = 0;
  297. int rv = 0;
  298. if (tmpl == NULL)
  299. return 0;
  300. /* A key must at least have a public part */
  301. if (!OSSL_PARAM_BLD_push_octet_string(tmpl, OSSL_PKEY_PARAM_PUB_KEY,
  302. key->pubkey, key->keylen))
  303. goto err;
  304. selection |= OSSL_KEYMGMT_SELECT_PUBLIC_KEY;
  305. if (key->privkey != NULL) {
  306. if (!OSSL_PARAM_BLD_push_octet_string(tmpl,
  307. OSSL_PKEY_PARAM_PRIV_KEY,
  308. key->privkey, key->keylen))
  309. goto err;
  310. selection |= OSSL_KEYMGMT_SELECT_PRIVATE_KEY;
  311. }
  312. params = OSSL_PARAM_BLD_to_param(tmpl);
  313. /* We export, the provider imports */
  314. rv = importer(to_keydata, selection, params);
  315. err:
  316. OSSL_PARAM_BLD_free(tmpl);
  317. OSSL_PARAM_free(params);
  318. return rv;
  319. }
  320. static int ecx_generic_import_from(const OSSL_PARAM params[], void *vpctx,
  321. int keytype)
  322. {
  323. EVP_PKEY_CTX *pctx = vpctx;
  324. EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(pctx);
  325. ECX_KEY *ecx = ossl_ecx_key_new(pctx->libctx, KEYNID2TYPE(keytype), 0,
  326. pctx->propquery);
  327. if (ecx == NULL) {
  328. ERR_raise(ERR_LIB_DH, ERR_R_MALLOC_FAILURE);
  329. return 0;
  330. }
  331. if (!ossl_ecx_key_fromdata(ecx, params, 1)
  332. || !EVP_PKEY_assign(pkey, keytype, ecx)) {
  333. ossl_ecx_key_free(ecx);
  334. return 0;
  335. }
  336. return 1;
  337. }
  338. static int ecx_pkey_copy(EVP_PKEY *to, EVP_PKEY *from)
  339. {
  340. ECX_KEY *ecx = from->pkey.ecx, *dupkey = NULL;
  341. int ret;
  342. if (ecx != NULL) {
  343. dupkey = ossl_ecx_key_dup(ecx, OSSL_KEYMGMT_SELECT_ALL);
  344. if (dupkey == NULL)
  345. return 0;
  346. }
  347. ret = EVP_PKEY_assign(to, from->type, dupkey);
  348. if (!ret)
  349. ossl_ecx_key_free(dupkey);
  350. return ret;
  351. }
  352. static int x25519_import_from(const OSSL_PARAM params[], void *vpctx)
  353. {
  354. return ecx_generic_import_from(params, vpctx, EVP_PKEY_X25519);
  355. }
  356. const EVP_PKEY_ASN1_METHOD ossl_ecx25519_asn1_meth = {
  357. EVP_PKEY_X25519,
  358. EVP_PKEY_X25519,
  359. 0,
  360. "X25519",
  361. "OpenSSL X25519 algorithm",
  362. ecx_pub_decode,
  363. ecx_pub_encode,
  364. ecx_pub_cmp,
  365. ecx_pub_print,
  366. NULL,
  367. ecx_priv_encode,
  368. ecx_priv_print,
  369. ecx_size,
  370. ecx_bits,
  371. ecx_security_bits,
  372. 0, 0, 0, 0,
  373. ecx_cmp_parameters,
  374. 0, 0,
  375. ecx_free,
  376. ecx_ctrl,
  377. NULL,
  378. NULL,
  379. NULL,
  380. NULL,
  381. NULL,
  382. NULL,
  383. NULL,
  384. NULL,
  385. ecx_set_priv_key,
  386. ecx_set_pub_key,
  387. ecx_get_priv_key,
  388. ecx_get_pub_key,
  389. ecx_pkey_dirty_cnt,
  390. ecx_pkey_export_to,
  391. x25519_import_from,
  392. ecx_pkey_copy,
  393. ecx_priv_decode_ex
  394. };
  395. static int x448_import_from(const OSSL_PARAM params[], void *vpctx)
  396. {
  397. return ecx_generic_import_from(params, vpctx, EVP_PKEY_X448);
  398. }
  399. const EVP_PKEY_ASN1_METHOD ossl_ecx448_asn1_meth = {
  400. EVP_PKEY_X448,
  401. EVP_PKEY_X448,
  402. 0,
  403. "X448",
  404. "OpenSSL X448 algorithm",
  405. ecx_pub_decode,
  406. ecx_pub_encode,
  407. ecx_pub_cmp,
  408. ecx_pub_print,
  409. NULL,
  410. ecx_priv_encode,
  411. ecx_priv_print,
  412. ecx_size,
  413. ecx_bits,
  414. ecx_security_bits,
  415. 0, 0, 0, 0,
  416. ecx_cmp_parameters,
  417. 0, 0,
  418. ecx_free,
  419. ecx_ctrl,
  420. NULL,
  421. NULL,
  422. NULL,
  423. NULL,
  424. NULL,
  425. NULL,
  426. NULL,
  427. NULL,
  428. ecx_set_priv_key,
  429. ecx_set_pub_key,
  430. ecx_get_priv_key,
  431. ecx_get_pub_key,
  432. ecx_pkey_dirty_cnt,
  433. ecx_pkey_export_to,
  434. x448_import_from,
  435. ecx_pkey_copy,
  436. ecx_priv_decode_ex
  437. };
  438. static int ecd_size25519(const EVP_PKEY *pkey)
  439. {
  440. return ED25519_SIGSIZE;
  441. }
  442. static int ecd_size448(const EVP_PKEY *pkey)
  443. {
  444. return ED448_SIGSIZE;
  445. }
  446. static int ecd_item_verify(EVP_MD_CTX *ctx, const ASN1_ITEM *it,
  447. const void *asn, const X509_ALGOR *sigalg,
  448. const ASN1_BIT_STRING *str, EVP_PKEY *pkey)
  449. {
  450. const ASN1_OBJECT *obj;
  451. int ptype;
  452. int nid;
  453. /* Sanity check: make sure it is ED25519/ED448 with absent parameters */
  454. X509_ALGOR_get0(&obj, &ptype, NULL, sigalg);
  455. nid = OBJ_obj2nid(obj);
  456. if ((nid != NID_ED25519 && nid != NID_ED448) || ptype != V_ASN1_UNDEF) {
  457. ERR_raise(ERR_LIB_EC, EC_R_INVALID_ENCODING);
  458. return 0;
  459. }
  460. if (!EVP_DigestVerifyInit(ctx, NULL, NULL, NULL, pkey))
  461. return 0;
  462. return 2;
  463. }
  464. static int ecd_item_sign25519(EVP_MD_CTX *ctx, const ASN1_ITEM *it,
  465. const void *asn,
  466. X509_ALGOR *alg1, X509_ALGOR *alg2,
  467. ASN1_BIT_STRING *str)
  468. {
  469. /* Set algorithms identifiers */
  470. X509_ALGOR_set0(alg1, OBJ_nid2obj(NID_ED25519), V_ASN1_UNDEF, NULL);
  471. if (alg2)
  472. X509_ALGOR_set0(alg2, OBJ_nid2obj(NID_ED25519), V_ASN1_UNDEF, NULL);
  473. /* Algorithm identifiers set: carry on as normal */
  474. return 3;
  475. }
  476. static int ecd_sig_info_set25519(X509_SIG_INFO *siginf, const X509_ALGOR *alg,
  477. const ASN1_STRING *sig)
  478. {
  479. X509_SIG_INFO_set(siginf, NID_undef, NID_ED25519, X25519_SECURITY_BITS,
  480. X509_SIG_INFO_TLS);
  481. return 1;
  482. }
  483. static int ecd_item_sign448(EVP_MD_CTX *ctx, const ASN1_ITEM *it,
  484. const void *asn,
  485. X509_ALGOR *alg1, X509_ALGOR *alg2,
  486. ASN1_BIT_STRING *str)
  487. {
  488. /* Set algorithm identifier */
  489. X509_ALGOR_set0(alg1, OBJ_nid2obj(NID_ED448), V_ASN1_UNDEF, NULL);
  490. if (alg2 != NULL)
  491. X509_ALGOR_set0(alg2, OBJ_nid2obj(NID_ED448), V_ASN1_UNDEF, NULL);
  492. /* Algorithm identifier set: carry on as normal */
  493. return 3;
  494. }
  495. static int ecd_sig_info_set448(X509_SIG_INFO *siginf, const X509_ALGOR *alg,
  496. const ASN1_STRING *sig)
  497. {
  498. X509_SIG_INFO_set(siginf, NID_undef, NID_ED448, X448_SECURITY_BITS,
  499. X509_SIG_INFO_TLS);
  500. return 1;
  501. }
  502. static int ed25519_import_from(const OSSL_PARAM params[], void *vpctx)
  503. {
  504. return ecx_generic_import_from(params, vpctx, EVP_PKEY_ED25519);
  505. }
  506. const EVP_PKEY_ASN1_METHOD ossl_ed25519_asn1_meth = {
  507. EVP_PKEY_ED25519,
  508. EVP_PKEY_ED25519,
  509. 0,
  510. "ED25519",
  511. "OpenSSL ED25519 algorithm",
  512. ecx_pub_decode,
  513. ecx_pub_encode,
  514. ecx_pub_cmp,
  515. ecx_pub_print,
  516. NULL,
  517. ecx_priv_encode,
  518. ecx_priv_print,
  519. ecd_size25519,
  520. ecx_bits,
  521. ecx_security_bits,
  522. 0, 0, 0, 0,
  523. ecx_cmp_parameters,
  524. 0, 0,
  525. ecx_free,
  526. ecd_ctrl,
  527. NULL,
  528. NULL,
  529. ecd_item_verify,
  530. ecd_item_sign25519,
  531. ecd_sig_info_set25519,
  532. NULL,
  533. NULL,
  534. NULL,
  535. ecx_set_priv_key,
  536. ecx_set_pub_key,
  537. ecx_get_priv_key,
  538. ecx_get_pub_key,
  539. ecx_pkey_dirty_cnt,
  540. ecx_pkey_export_to,
  541. ed25519_import_from,
  542. ecx_pkey_copy,
  543. ecx_priv_decode_ex
  544. };
  545. static int ed448_import_from(const OSSL_PARAM params[], void *vpctx)
  546. {
  547. return ecx_generic_import_from(params, vpctx, EVP_PKEY_ED448);
  548. }
  549. const EVP_PKEY_ASN1_METHOD ossl_ed448_asn1_meth = {
  550. EVP_PKEY_ED448,
  551. EVP_PKEY_ED448,
  552. 0,
  553. "ED448",
  554. "OpenSSL ED448 algorithm",
  555. ecx_pub_decode,
  556. ecx_pub_encode,
  557. ecx_pub_cmp,
  558. ecx_pub_print,
  559. NULL,
  560. ecx_priv_encode,
  561. ecx_priv_print,
  562. ecd_size448,
  563. ecx_bits,
  564. ecx_security_bits,
  565. 0, 0, 0, 0,
  566. ecx_cmp_parameters,
  567. 0, 0,
  568. ecx_free,
  569. ecd_ctrl,
  570. NULL,
  571. NULL,
  572. ecd_item_verify,
  573. ecd_item_sign448,
  574. ecd_sig_info_set448,
  575. NULL,
  576. NULL,
  577. NULL,
  578. ecx_set_priv_key,
  579. ecx_set_pub_key,
  580. ecx_get_priv_key,
  581. ecx_get_pub_key,
  582. ecx_pkey_dirty_cnt,
  583. ecx_pkey_export_to,
  584. ed448_import_from,
  585. ecx_pkey_copy,
  586. ecx_priv_decode_ex
  587. };
  588. static int pkey_ecx_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  589. {
  590. ECX_KEY *ecx = ossl_ecx_key_op(NULL, NULL, 0, ctx->pmeth->pkey_id,
  591. KEY_OP_PUBLIC, NULL, NULL);
  592. if (ecx != NULL) {
  593. EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, ecx);
  594. return 1;
  595. }
  596. return 0;
  597. }
  598. static int validate_ecx_derive(EVP_PKEY_CTX *ctx, unsigned char *key,
  599. size_t *keylen,
  600. const unsigned char **privkey,
  601. const unsigned char **pubkey)
  602. {
  603. const ECX_KEY *ecxkey, *peerkey;
  604. if (ctx->pkey == NULL || ctx->peerkey == NULL) {
  605. ERR_raise(ERR_LIB_EC, EC_R_KEYS_NOT_SET);
  606. return 0;
  607. }
  608. ecxkey = ctx->pkey->pkey.ecx;
  609. peerkey = EVP_PKEY_get0(ctx->peerkey);
  610. if (ecxkey == NULL || ecxkey->privkey == NULL) {
  611. ERR_raise(ERR_LIB_EC, EC_R_INVALID_PRIVATE_KEY);
  612. return 0;
  613. }
  614. if (peerkey == NULL) {
  615. ERR_raise(ERR_LIB_EC, EC_R_INVALID_PEER_KEY);
  616. return 0;
  617. }
  618. *privkey = ecxkey->privkey;
  619. *pubkey = peerkey->pubkey;
  620. return 1;
  621. }
  622. static int pkey_ecx_derive25519(EVP_PKEY_CTX *ctx, unsigned char *key,
  623. size_t *keylen)
  624. {
  625. const unsigned char *privkey, *pubkey;
  626. if (!validate_ecx_derive(ctx, key, keylen, &privkey, &pubkey)
  627. || (key != NULL
  628. && ossl_x25519(key, privkey, pubkey) == 0))
  629. return 0;
  630. *keylen = X25519_KEYLEN;
  631. return 1;
  632. }
  633. static int pkey_ecx_derive448(EVP_PKEY_CTX *ctx, unsigned char *key,
  634. size_t *keylen)
  635. {
  636. const unsigned char *privkey, *pubkey;
  637. if (!validate_ecx_derive(ctx, key, keylen, &privkey, &pubkey)
  638. || (key != NULL
  639. && ossl_x448(key, privkey, pubkey) == 0))
  640. return 0;
  641. *keylen = X448_KEYLEN;
  642. return 1;
  643. }
  644. static int pkey_ecx_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
  645. {
  646. /* Only need to handle peer key for derivation */
  647. if (type == EVP_PKEY_CTRL_PEER_KEY)
  648. return 1;
  649. return -2;
  650. }
  651. static const EVP_PKEY_METHOD ecx25519_pkey_meth = {
  652. EVP_PKEY_X25519,
  653. 0, 0, 0, 0, 0, 0, 0,
  654. pkey_ecx_keygen,
  655. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  656. pkey_ecx_derive25519,
  657. pkey_ecx_ctrl,
  658. 0
  659. };
  660. static const EVP_PKEY_METHOD ecx448_pkey_meth = {
  661. EVP_PKEY_X448,
  662. 0, 0, 0, 0, 0, 0, 0,
  663. pkey_ecx_keygen,
  664. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  665. pkey_ecx_derive448,
  666. pkey_ecx_ctrl,
  667. 0
  668. };
  669. static int pkey_ecd_digestsign25519(EVP_MD_CTX *ctx, unsigned char *sig,
  670. size_t *siglen, const unsigned char *tbs,
  671. size_t tbslen)
  672. {
  673. const ECX_KEY *edkey = EVP_MD_CTX_get_pkey_ctx(ctx)->pkey->pkey.ecx;
  674. if (sig == NULL) {
  675. *siglen = ED25519_SIGSIZE;
  676. return 1;
  677. }
  678. if (*siglen < ED25519_SIGSIZE) {
  679. ERR_raise(ERR_LIB_EC, EC_R_BUFFER_TOO_SMALL);
  680. return 0;
  681. }
  682. if (ossl_ed25519_sign(sig, tbs, tbslen, edkey->pubkey, edkey->privkey, NULL,
  683. NULL) == 0)
  684. return 0;
  685. *siglen = ED25519_SIGSIZE;
  686. return 1;
  687. }
  688. static int pkey_ecd_digestsign448(EVP_MD_CTX *ctx, unsigned char *sig,
  689. size_t *siglen, const unsigned char *tbs,
  690. size_t tbslen)
  691. {
  692. const ECX_KEY *edkey = EVP_MD_CTX_get_pkey_ctx(ctx)->pkey->pkey.ecx;
  693. if (sig == NULL) {
  694. *siglen = ED448_SIGSIZE;
  695. return 1;
  696. }
  697. if (*siglen < ED448_SIGSIZE) {
  698. ERR_raise(ERR_LIB_EC, EC_R_BUFFER_TOO_SMALL);
  699. return 0;
  700. }
  701. if (ossl_ed448_sign(edkey->libctx, sig, tbs, tbslen, edkey->pubkey,
  702. edkey->privkey, NULL, 0, edkey->propq) == 0)
  703. return 0;
  704. *siglen = ED448_SIGSIZE;
  705. return 1;
  706. }
  707. static int pkey_ecd_digestverify25519(EVP_MD_CTX *ctx, const unsigned char *sig,
  708. size_t siglen, const unsigned char *tbs,
  709. size_t tbslen)
  710. {
  711. const ECX_KEY *edkey = EVP_MD_CTX_get_pkey_ctx(ctx)->pkey->pkey.ecx;
  712. if (siglen != ED25519_SIGSIZE)
  713. return 0;
  714. return ossl_ed25519_verify(tbs, tbslen, sig, edkey->pubkey,
  715. edkey->libctx, edkey->propq);
  716. }
  717. static int pkey_ecd_digestverify448(EVP_MD_CTX *ctx, const unsigned char *sig,
  718. size_t siglen, const unsigned char *tbs,
  719. size_t tbslen)
  720. {
  721. const ECX_KEY *edkey = EVP_MD_CTX_get_pkey_ctx(ctx)->pkey->pkey.ecx;
  722. if (siglen != ED448_SIGSIZE)
  723. return 0;
  724. return ossl_ed448_verify(edkey->libctx, tbs, tbslen, sig, edkey->pubkey,
  725. NULL, 0, edkey->propq);
  726. }
  727. static int pkey_ecd_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
  728. {
  729. switch (type) {
  730. case EVP_PKEY_CTRL_MD:
  731. /* Only NULL allowed as digest */
  732. if (p2 == NULL || (const EVP_MD *)p2 == EVP_md_null())
  733. return 1;
  734. ERR_raise(ERR_LIB_EC, EC_R_INVALID_DIGEST_TYPE);
  735. return 0;
  736. case EVP_PKEY_CTRL_DIGESTINIT:
  737. return 1;
  738. }
  739. return -2;
  740. }
  741. static const EVP_PKEY_METHOD ed25519_pkey_meth = {
  742. EVP_PKEY_ED25519, EVP_PKEY_FLAG_SIGCTX_CUSTOM,
  743. 0, 0, 0, 0, 0, 0,
  744. pkey_ecx_keygen,
  745. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  746. pkey_ecd_ctrl,
  747. 0,
  748. pkey_ecd_digestsign25519,
  749. pkey_ecd_digestverify25519
  750. };
  751. static const EVP_PKEY_METHOD ed448_pkey_meth = {
  752. EVP_PKEY_ED448, EVP_PKEY_FLAG_SIGCTX_CUSTOM,
  753. 0, 0, 0, 0, 0, 0,
  754. pkey_ecx_keygen,
  755. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  756. pkey_ecd_ctrl,
  757. 0,
  758. pkey_ecd_digestsign448,
  759. pkey_ecd_digestverify448
  760. };
  761. #ifdef S390X_EC_ASM
  762. # include "s390x_arch.h"
  763. static int s390x_pkey_ecx_keygen25519(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  764. {
  765. static const unsigned char generator[] = {
  766. 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  767. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  768. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
  769. };
  770. ECX_KEY *key = ossl_ecx_key_new(ctx->libctx, ECX_KEY_TYPE_X25519, 1,
  771. ctx->propquery);
  772. unsigned char *privkey = NULL, *pubkey;
  773. if (key == NULL) {
  774. ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
  775. goto err;
  776. }
  777. pubkey = key->pubkey;
  778. privkey = ossl_ecx_key_allocate_privkey(key);
  779. if (privkey == NULL) {
  780. ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
  781. goto err;
  782. }
  783. if (RAND_priv_bytes_ex(ctx->libctx, privkey, X25519_KEYLEN, 0) <= 0)
  784. goto err;
  785. privkey[0] &= 248;
  786. privkey[31] &= 127;
  787. privkey[31] |= 64;
  788. if (s390x_x25519_mul(pubkey, generator, privkey) != 1)
  789. goto err;
  790. EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, key);
  791. return 1;
  792. err:
  793. ossl_ecx_key_free(key);
  794. return 0;
  795. }
  796. static int s390x_pkey_ecx_keygen448(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  797. {
  798. static const unsigned char generator[] = {
  799. 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  800. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  801. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  802. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  803. 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
  804. };
  805. ECX_KEY *key = ossl_ecx_key_new(ctx->libctx, ECX_KEY_TYPE_X448, 1,
  806. ctx->propquery);
  807. unsigned char *privkey = NULL, *pubkey;
  808. if (key == NULL) {
  809. ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
  810. goto err;
  811. }
  812. pubkey = key->pubkey;
  813. privkey = ossl_ecx_key_allocate_privkey(key);
  814. if (privkey == NULL) {
  815. ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
  816. goto err;
  817. }
  818. if (RAND_priv_bytes_ex(ctx->libctx, privkey, X448_KEYLEN, 0) <= 0)
  819. goto err;
  820. privkey[0] &= 252;
  821. privkey[55] |= 128;
  822. if (s390x_x448_mul(pubkey, generator, privkey) != 1)
  823. goto err;
  824. EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, key);
  825. return 1;
  826. err:
  827. ossl_ecx_key_free(key);
  828. return 0;
  829. }
  830. static int s390x_pkey_ecd_keygen25519(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  831. {
  832. static const unsigned char generator_x[] = {
  833. 0x1a, 0xd5, 0x25, 0x8f, 0x60, 0x2d, 0x56, 0xc9, 0xb2, 0xa7, 0x25, 0x95,
  834. 0x60, 0xc7, 0x2c, 0x69, 0x5c, 0xdc, 0xd6, 0xfd, 0x31, 0xe2, 0xa4, 0xc0,
  835. 0xfe, 0x53, 0x6e, 0xcd, 0xd3, 0x36, 0x69, 0x21
  836. };
  837. static const unsigned char generator_y[] = {
  838. 0x58, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
  839. 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
  840. 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66,
  841. };
  842. unsigned char x_dst[32], buff[SHA512_DIGEST_LENGTH];
  843. ECX_KEY *key = ossl_ecx_key_new(ctx->libctx, ECX_KEY_TYPE_ED25519, 1,
  844. ctx->propquery);
  845. unsigned char *privkey = NULL, *pubkey;
  846. unsigned int sz;
  847. EVP_MD *md = NULL;
  848. int rv;
  849. if (key == NULL) {
  850. ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
  851. goto err;
  852. }
  853. pubkey = key->pubkey;
  854. privkey = ossl_ecx_key_allocate_privkey(key);
  855. if (privkey == NULL) {
  856. ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
  857. goto err;
  858. }
  859. if (RAND_priv_bytes_ex(ctx->libctx, privkey, ED25519_KEYLEN, 0) <= 0)
  860. goto err;
  861. md = EVP_MD_fetch(ctx->libctx, "SHA512", ctx->propquery);
  862. if (md == NULL)
  863. goto err;
  864. rv = EVP_Digest(privkey, 32, buff, &sz, md, NULL);
  865. EVP_MD_free(md);
  866. if (!rv)
  867. goto err;
  868. buff[0] &= 248;
  869. buff[31] &= 63;
  870. buff[31] |= 64;
  871. if (s390x_ed25519_mul(x_dst, pubkey,
  872. generator_x, generator_y, buff) != 1)
  873. goto err;
  874. pubkey[31] |= ((x_dst[0] & 0x01) << 7);
  875. EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, key);
  876. return 1;
  877. err:
  878. ossl_ecx_key_free(key);
  879. return 0;
  880. }
  881. static int s390x_pkey_ecd_keygen448(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  882. {
  883. static const unsigned char generator_x[] = {
  884. 0x5e, 0xc0, 0x0c, 0xc7, 0x2b, 0xa8, 0x26, 0x26, 0x8e, 0x93, 0x00, 0x8b,
  885. 0xe1, 0x80, 0x3b, 0x43, 0x11, 0x65, 0xb6, 0x2a, 0xf7, 0x1a, 0xae, 0x12,
  886. 0x64, 0xa4, 0xd3, 0xa3, 0x24, 0xe3, 0x6d, 0xea, 0x67, 0x17, 0x0f, 0x47,
  887. 0x70, 0x65, 0x14, 0x9e, 0xda, 0x36, 0xbf, 0x22, 0xa6, 0x15, 0x1d, 0x22,
  888. 0xed, 0x0d, 0xed, 0x6b, 0xc6, 0x70, 0x19, 0x4f, 0x00
  889. };
  890. static const unsigned char generator_y[] = {
  891. 0x14, 0xfa, 0x30, 0xf2, 0x5b, 0x79, 0x08, 0x98, 0xad, 0xc8, 0xd7, 0x4e,
  892. 0x2c, 0x13, 0xbd, 0xfd, 0xc4, 0x39, 0x7c, 0xe6, 0x1c, 0xff, 0xd3, 0x3a,
  893. 0xd7, 0xc2, 0xa0, 0x05, 0x1e, 0x9c, 0x78, 0x87, 0x40, 0x98, 0xa3, 0x6c,
  894. 0x73, 0x73, 0xea, 0x4b, 0x62, 0xc7, 0xc9, 0x56, 0x37, 0x20, 0x76, 0x88,
  895. 0x24, 0xbc, 0xb6, 0x6e, 0x71, 0x46, 0x3f, 0x69, 0x00
  896. };
  897. unsigned char x_dst[57], buff[114];
  898. ECX_KEY *key = ossl_ecx_key_new(ctx->libctx, ECX_KEY_TYPE_ED448, 1,
  899. ctx->propquery);
  900. unsigned char *privkey = NULL, *pubkey;
  901. EVP_MD_CTX *hashctx = NULL;
  902. EVP_MD *md = NULL;
  903. int rv;
  904. if (key == NULL) {
  905. ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
  906. goto err;
  907. }
  908. pubkey = key->pubkey;
  909. privkey = ossl_ecx_key_allocate_privkey(key);
  910. if (privkey == NULL) {
  911. ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
  912. goto err;
  913. }
  914. if (RAND_priv_bytes_ex(ctx->libctx, privkey, ED448_KEYLEN, 0) <= 0)
  915. goto err;
  916. hashctx = EVP_MD_CTX_new();
  917. if (hashctx == NULL)
  918. goto err;
  919. md = EVP_MD_fetch(ctx->libctx, "SHAKE256", ctx->propquery);
  920. if (md == NULL)
  921. goto err;
  922. rv = EVP_DigestInit_ex(hashctx, md, NULL);
  923. EVP_MD_free(md);
  924. if (rv != 1)
  925. goto err;
  926. if (EVP_DigestUpdate(hashctx, privkey, 57) != 1)
  927. goto err;
  928. if (EVP_DigestFinalXOF(hashctx, buff, sizeof(buff)) != 1)
  929. goto err;
  930. buff[0] &= -4;
  931. buff[55] |= 0x80;
  932. buff[56] = 0;
  933. if (s390x_ed448_mul(x_dst, pubkey,
  934. generator_x, generator_y, buff) != 1)
  935. goto err;
  936. pubkey[56] |= ((x_dst[0] & 0x01) << 7);
  937. EVP_PKEY_assign(pkey, ctx->pmeth->pkey_id, key);
  938. EVP_MD_CTX_free(hashctx);
  939. return 1;
  940. err:
  941. ossl_ecx_key_free(key);
  942. EVP_MD_CTX_free(hashctx);
  943. return 0;
  944. }
  945. static int s390x_pkey_ecx_derive25519(EVP_PKEY_CTX *ctx, unsigned char *key,
  946. size_t *keylen)
  947. {
  948. const unsigned char *privkey, *pubkey;
  949. if (!validate_ecx_derive(ctx, key, keylen, &privkey, &pubkey))
  950. return 0;
  951. if (key != NULL)
  952. return s390x_x25519_mul(key, pubkey, privkey);
  953. *keylen = X25519_KEYLEN;
  954. return 1;
  955. }
  956. static int s390x_pkey_ecx_derive448(EVP_PKEY_CTX *ctx, unsigned char *key,
  957. size_t *keylen)
  958. {
  959. const unsigned char *privkey, *pubkey;
  960. if (!validate_ecx_derive(ctx, key, keylen, &privkey, &pubkey))
  961. return 0;
  962. if (key != NULL)
  963. return s390x_x448_mul(key, pubkey, privkey);
  964. *keylen = X448_KEYLEN;
  965. return 1;
  966. }
  967. static int s390x_pkey_ecd_digestsign25519(EVP_MD_CTX *ctx,
  968. unsigned char *sig, size_t *siglen,
  969. const unsigned char *tbs,
  970. size_t tbslen)
  971. {
  972. union {
  973. struct {
  974. unsigned char sig[64];
  975. unsigned char priv[32];
  976. } ed25519;
  977. unsigned long long buff[512];
  978. } param;
  979. const ECX_KEY *edkey = EVP_MD_CTX_get_pkey_ctx(ctx)->pkey->pkey.ecx;
  980. int rc;
  981. if (sig == NULL) {
  982. *siglen = ED25519_SIGSIZE;
  983. return 1;
  984. }
  985. if (*siglen < ED25519_SIGSIZE) {
  986. ERR_raise(ERR_LIB_EC, EC_R_BUFFER_TOO_SMALL);
  987. return 0;
  988. }
  989. memset(&param, 0, sizeof(param));
  990. memcpy(param.ed25519.priv, edkey->privkey, sizeof(param.ed25519.priv));
  991. rc = s390x_kdsa(S390X_EDDSA_SIGN_ED25519, &param.ed25519, tbs, tbslen);
  992. OPENSSL_cleanse(param.ed25519.priv, sizeof(param.ed25519.priv));
  993. if (rc != 0)
  994. return 0;
  995. s390x_flip_endian32(sig, param.ed25519.sig);
  996. s390x_flip_endian32(sig + 32, param.ed25519.sig + 32);
  997. *siglen = ED25519_SIGSIZE;
  998. return 1;
  999. }
  1000. static int s390x_pkey_ecd_digestsign448(EVP_MD_CTX *ctx,
  1001. unsigned char *sig, size_t *siglen,
  1002. const unsigned char *tbs,
  1003. size_t tbslen)
  1004. {
  1005. union {
  1006. struct {
  1007. unsigned char sig[128];
  1008. unsigned char priv[64];
  1009. } ed448;
  1010. unsigned long long buff[512];
  1011. } param;
  1012. const ECX_KEY *edkey = EVP_MD_CTX_get_pkey_ctx(ctx)->pkey->pkey.ecx;
  1013. int rc;
  1014. if (sig == NULL) {
  1015. *siglen = ED448_SIGSIZE;
  1016. return 1;
  1017. }
  1018. if (*siglen < ED448_SIGSIZE) {
  1019. ERR_raise(ERR_LIB_EC, EC_R_BUFFER_TOO_SMALL);
  1020. return 0;
  1021. }
  1022. memset(&param, 0, sizeof(param));
  1023. memcpy(param.ed448.priv + 64 - 57, edkey->privkey, 57);
  1024. rc = s390x_kdsa(S390X_EDDSA_SIGN_ED448, &param.ed448, tbs, tbslen);
  1025. OPENSSL_cleanse(param.ed448.priv, sizeof(param.ed448.priv));
  1026. if (rc != 0)
  1027. return 0;
  1028. s390x_flip_endian64(param.ed448.sig, param.ed448.sig);
  1029. s390x_flip_endian64(param.ed448.sig + 64, param.ed448.sig + 64);
  1030. memcpy(sig, param.ed448.sig, 57);
  1031. memcpy(sig + 57, param.ed448.sig + 64, 57);
  1032. *siglen = ED448_SIGSIZE;
  1033. return 1;
  1034. }
  1035. static int s390x_pkey_ecd_digestverify25519(EVP_MD_CTX *ctx,
  1036. const unsigned char *sig,
  1037. size_t siglen,
  1038. const unsigned char *tbs,
  1039. size_t tbslen)
  1040. {
  1041. union {
  1042. struct {
  1043. unsigned char sig[64];
  1044. unsigned char pub[32];
  1045. } ed25519;
  1046. unsigned long long buff[512];
  1047. } param;
  1048. const ECX_KEY *edkey = EVP_MD_CTX_get_pkey_ctx(ctx)->pkey->pkey.ecx;
  1049. if (siglen != ED25519_SIGSIZE)
  1050. return 0;
  1051. memset(&param, 0, sizeof(param));
  1052. s390x_flip_endian32(param.ed25519.sig, sig);
  1053. s390x_flip_endian32(param.ed25519.sig + 32, sig + 32);
  1054. s390x_flip_endian32(param.ed25519.pub, edkey->pubkey);
  1055. return s390x_kdsa(S390X_EDDSA_VERIFY_ED25519,
  1056. &param.ed25519, tbs, tbslen) == 0 ? 1 : 0;
  1057. }
  1058. static int s390x_pkey_ecd_digestverify448(EVP_MD_CTX *ctx,
  1059. const unsigned char *sig,
  1060. size_t siglen,
  1061. const unsigned char *tbs,
  1062. size_t tbslen)
  1063. {
  1064. union {
  1065. struct {
  1066. unsigned char sig[128];
  1067. unsigned char pub[64];
  1068. } ed448;
  1069. unsigned long long buff[512];
  1070. } param;
  1071. const ECX_KEY *edkey = EVP_MD_CTX_get_pkey_ctx(ctx)->pkey->pkey.ecx;
  1072. if (siglen != ED448_SIGSIZE)
  1073. return 0;
  1074. memset(&param, 0, sizeof(param));
  1075. memcpy(param.ed448.sig, sig, 57);
  1076. s390x_flip_endian64(param.ed448.sig, param.ed448.sig);
  1077. memcpy(param.ed448.sig + 64, sig + 57, 57);
  1078. s390x_flip_endian64(param.ed448.sig + 64, param.ed448.sig + 64);
  1079. memcpy(param.ed448.pub, edkey->pubkey, 57);
  1080. s390x_flip_endian64(param.ed448.pub, param.ed448.pub);
  1081. return s390x_kdsa(S390X_EDDSA_VERIFY_ED448,
  1082. &param.ed448, tbs, tbslen) == 0 ? 1 : 0;
  1083. }
  1084. static const EVP_PKEY_METHOD ecx25519_s390x_pkey_meth = {
  1085. EVP_PKEY_X25519,
  1086. 0, 0, 0, 0, 0, 0, 0,
  1087. s390x_pkey_ecx_keygen25519,
  1088. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  1089. s390x_pkey_ecx_derive25519,
  1090. pkey_ecx_ctrl,
  1091. 0
  1092. };
  1093. static const EVP_PKEY_METHOD ecx448_s390x_pkey_meth = {
  1094. EVP_PKEY_X448,
  1095. 0, 0, 0, 0, 0, 0, 0,
  1096. s390x_pkey_ecx_keygen448,
  1097. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  1098. s390x_pkey_ecx_derive448,
  1099. pkey_ecx_ctrl,
  1100. 0
  1101. };
  1102. static const EVP_PKEY_METHOD ed25519_s390x_pkey_meth = {
  1103. EVP_PKEY_ED25519, EVP_PKEY_FLAG_SIGCTX_CUSTOM,
  1104. 0, 0, 0, 0, 0, 0,
  1105. s390x_pkey_ecd_keygen25519,
  1106. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  1107. pkey_ecd_ctrl,
  1108. 0,
  1109. s390x_pkey_ecd_digestsign25519,
  1110. s390x_pkey_ecd_digestverify25519
  1111. };
  1112. static const EVP_PKEY_METHOD ed448_s390x_pkey_meth = {
  1113. EVP_PKEY_ED448, EVP_PKEY_FLAG_SIGCTX_CUSTOM,
  1114. 0, 0, 0, 0, 0, 0,
  1115. s390x_pkey_ecd_keygen448,
  1116. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  1117. pkey_ecd_ctrl,
  1118. 0,
  1119. s390x_pkey_ecd_digestsign448,
  1120. s390x_pkey_ecd_digestverify448
  1121. };
  1122. #endif
  1123. const EVP_PKEY_METHOD *ossl_ecx25519_pkey_method(void)
  1124. {
  1125. #ifdef S390X_EC_ASM
  1126. if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_X25519))
  1127. return &ecx25519_s390x_pkey_meth;
  1128. #endif
  1129. return &ecx25519_pkey_meth;
  1130. }
  1131. const EVP_PKEY_METHOD *ossl_ecx448_pkey_method(void)
  1132. {
  1133. #ifdef S390X_EC_ASM
  1134. if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_X448))
  1135. return &ecx448_s390x_pkey_meth;
  1136. #endif
  1137. return &ecx448_pkey_meth;
  1138. }
  1139. const EVP_PKEY_METHOD *ossl_ed25519_pkey_method(void)
  1140. {
  1141. #ifdef S390X_EC_ASM
  1142. if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_ED25519)
  1143. && OPENSSL_s390xcap_P.kdsa[0] & S390X_CAPBIT(S390X_EDDSA_SIGN_ED25519)
  1144. && OPENSSL_s390xcap_P.kdsa[0]
  1145. & S390X_CAPBIT(S390X_EDDSA_VERIFY_ED25519))
  1146. return &ed25519_s390x_pkey_meth;
  1147. #endif
  1148. return &ed25519_pkey_meth;
  1149. }
  1150. const EVP_PKEY_METHOD *ossl_ed448_pkey_method(void)
  1151. {
  1152. #ifdef S390X_EC_ASM
  1153. if (OPENSSL_s390xcap_P.pcc[1] & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_ED448)
  1154. && OPENSSL_s390xcap_P.kdsa[0] & S390X_CAPBIT(S390X_EDDSA_SIGN_ED448)
  1155. && OPENSSL_s390xcap_P.kdsa[0] & S390X_CAPBIT(S390X_EDDSA_VERIFY_ED448))
  1156. return &ed448_s390x_pkey_meth;
  1157. #endif
  1158. return &ed448_pkey_meth;
  1159. }