ecp_s390x_nistp.c 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400
  1. /*
  2. * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*
  10. * EC_METHOD low level APIs are deprecated for public use, but still ok for
  11. * internal use.
  12. */
  13. #include "internal/deprecated.h"
  14. #include <stdlib.h>
  15. #include <string.h>
  16. #include <openssl/err.h>
  17. #include <openssl/rand.h>
  18. #include "ec_local.h"
  19. #include "s390x_arch.h"
  20. /* Size of parameter blocks */
  21. #define S390X_SIZE_PARAM 4096
  22. /* Size of fields in parameter blocks */
  23. #define S390X_SIZE_P256 32
  24. #define S390X_SIZE_P384 48
  25. #define S390X_SIZE_P521 80
  26. /* Offsets of fields in PCC parameter blocks */
  27. #define S390X_OFF_RES_X(n) (0 * n)
  28. #define S390X_OFF_RES_Y(n) (1 * n)
  29. #define S390X_OFF_SRC_X(n) (2 * n)
  30. #define S390X_OFF_SRC_Y(n) (3 * n)
  31. #define S390X_OFF_SCALAR(n) (4 * n)
  32. /* Offsets of fields in KDSA parameter blocks */
  33. #define S390X_OFF_R(n) (0 * n)
  34. #define S390X_OFF_S(n) (1 * n)
  35. #define S390X_OFF_H(n) (2 * n)
  36. #define S390X_OFF_K(n) (3 * n)
  37. #define S390X_OFF_X(n) (3 * n)
  38. #define S390X_OFF_RN(n) (4 * n)
  39. #define S390X_OFF_Y(n) (4 * n)
  40. static int ec_GFp_s390x_nistp_mul(const EC_GROUP *group, EC_POINT *r,
  41. const BIGNUM *scalar,
  42. size_t num, const EC_POINT *points[],
  43. const BIGNUM *scalars[],
  44. BN_CTX *ctx, unsigned int fc, int len)
  45. {
  46. unsigned char param[S390X_SIZE_PARAM];
  47. BIGNUM *x, *y;
  48. const EC_POINT *point_ptr = NULL;
  49. const BIGNUM *scalar_ptr = NULL;
  50. BN_CTX *new_ctx = NULL;
  51. int rc = -1;
  52. if (ctx == NULL) {
  53. ctx = new_ctx = BN_CTX_new_ex(group->libctx);
  54. if (ctx == NULL)
  55. return 0;
  56. }
  57. BN_CTX_start(ctx);
  58. x = BN_CTX_get(ctx);
  59. y = BN_CTX_get(ctx);
  60. if (x == NULL || y == NULL) {
  61. rc = 0;
  62. goto ret;
  63. }
  64. /*
  65. * Use PCC for EC keygen and ECDH key derivation:
  66. * scalar * generator and scalar * peer public key,
  67. * scalar in [0,order).
  68. */
  69. if ((scalar != NULL && num == 0 && BN_is_negative(scalar) == 0)
  70. || (scalar == NULL && num == 1 && BN_is_negative(scalars[0]) == 0)) {
  71. if (num == 0) {
  72. point_ptr = EC_GROUP_get0_generator(group);
  73. scalar_ptr = scalar;
  74. } else {
  75. point_ptr = points[0];
  76. scalar_ptr = scalars[0];
  77. }
  78. if (EC_POINT_is_at_infinity(group, point_ptr) == 1
  79. || BN_is_zero(scalar_ptr)) {
  80. rc = EC_POINT_set_to_infinity(group, r);
  81. goto ret;
  82. }
  83. memset(&param, 0, sizeof(param));
  84. if (group->meth->point_get_affine_coordinates(group, point_ptr,
  85. x, y, ctx) != 1
  86. || BN_bn2binpad(x, param + S390X_OFF_SRC_X(len), len) == -1
  87. || BN_bn2binpad(y, param + S390X_OFF_SRC_Y(len), len) == -1
  88. || BN_bn2binpad(scalar_ptr,
  89. param + S390X_OFF_SCALAR(len), len) == -1
  90. || s390x_pcc(fc, param) != 0
  91. || BN_bin2bn(param + S390X_OFF_RES_X(len), len, x) == NULL
  92. || BN_bin2bn(param + S390X_OFF_RES_Y(len), len, y) == NULL
  93. || group->meth->point_set_affine_coordinates(group, r,
  94. x, y, ctx) != 1)
  95. goto ret;
  96. rc = 1;
  97. }
  98. ret:
  99. /* Otherwise use default. */
  100. if (rc == -1)
  101. rc = ossl_ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
  102. OPENSSL_cleanse(param, sizeof(param));
  103. BN_CTX_end(ctx);
  104. BN_CTX_free(new_ctx);
  105. return rc;
  106. }
  107. static ECDSA_SIG *ecdsa_s390x_nistp_sign_sig(const unsigned char *dgst,
  108. int dgstlen,
  109. const BIGNUM *kinv,
  110. const BIGNUM *r,
  111. EC_KEY *eckey,
  112. unsigned int fc, int len)
  113. {
  114. unsigned char param[S390X_SIZE_PARAM];
  115. int ok = 0;
  116. BIGNUM *k;
  117. ECDSA_SIG *sig;
  118. const EC_GROUP *group;
  119. const BIGNUM *privkey;
  120. int off;
  121. group = EC_KEY_get0_group(eckey);
  122. privkey = EC_KEY_get0_private_key(eckey);
  123. if (group == NULL || privkey == NULL) {
  124. ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS);
  125. return NULL;
  126. }
  127. if (!EC_KEY_can_sign(eckey)) {
  128. ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
  129. return NULL;
  130. }
  131. k = BN_secure_new();
  132. sig = ECDSA_SIG_new();
  133. if (k == NULL || sig == NULL) {
  134. ERR_raise(ERR_LIB_EC, ERR_R_ECDSA_LIB);
  135. goto ret;
  136. }
  137. sig->r = BN_new();
  138. sig->s = BN_new();
  139. if (sig->r == NULL || sig->s == NULL) {
  140. ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
  141. goto ret;
  142. }
  143. memset(param, 0, sizeof(param));
  144. off = len - (dgstlen > len ? len : dgstlen);
  145. memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
  146. if (BN_bn2binpad(privkey, param + S390X_OFF_K(len), len) == -1) {
  147. ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
  148. goto ret;
  149. }
  150. if (r == NULL || kinv == NULL) {
  151. if (len < 0) {
  152. ERR_raise(ERR_LIB_EC, EC_R_INVALID_LENGTH);
  153. goto ret;
  154. }
  155. /*
  156. * Generate random k and copy to param block. RAND_priv_bytes_ex
  157. * is used instead of BN_priv_rand_range or BN_generate_dsa_nonce
  158. * because kdsa instruction constructs an in-range, invertible nonce
  159. * internally implementing counter-measures for RNG weakness.
  160. */
  161. if (RAND_priv_bytes_ex(eckey->libctx, param + S390X_OFF_RN(len),
  162. (size_t)len, 0) != 1) {
  163. ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED);
  164. goto ret;
  165. }
  166. } else {
  167. /* Reconstruct k = (k^-1)^-1. */
  168. if (ossl_ec_group_do_inverse_ord(group, k, kinv, NULL) == 0
  169. || BN_bn2binpad(k, param + S390X_OFF_RN(len), len) == -1) {
  170. ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
  171. goto ret;
  172. }
  173. /* Turns KDSA internal nonce-generation off. */
  174. fc |= S390X_KDSA_D;
  175. }
  176. if (s390x_kdsa(fc, param, NULL, 0) != 0) {
  177. ERR_raise(ERR_LIB_EC, ERR_R_ECDSA_LIB);
  178. goto ret;
  179. }
  180. if (BN_bin2bn(param + S390X_OFF_R(len), len, sig->r) == NULL
  181. || BN_bin2bn(param + S390X_OFF_S(len), len, sig->s) == NULL) {
  182. ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
  183. goto ret;
  184. }
  185. ok = 1;
  186. ret:
  187. OPENSSL_cleanse(param, sizeof(param));
  188. if (ok != 1) {
  189. ECDSA_SIG_free(sig);
  190. sig = NULL;
  191. }
  192. BN_clear_free(k);
  193. return sig;
  194. }
  195. static int ecdsa_s390x_nistp_verify_sig(const unsigned char *dgst, int dgstlen,
  196. const ECDSA_SIG *sig, EC_KEY *eckey,
  197. unsigned int fc, int len)
  198. {
  199. unsigned char param[S390X_SIZE_PARAM];
  200. int rc = -1;
  201. BN_CTX *ctx;
  202. BIGNUM *x, *y;
  203. const EC_GROUP *group;
  204. const EC_POINT *pubkey;
  205. int off;
  206. group = EC_KEY_get0_group(eckey);
  207. pubkey = EC_KEY_get0_public_key(eckey);
  208. if (eckey == NULL || group == NULL || pubkey == NULL || sig == NULL) {
  209. ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS);
  210. return -1;
  211. }
  212. if (!EC_KEY_can_sign(eckey)) {
  213. ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
  214. return -1;
  215. }
  216. ctx = BN_CTX_new_ex(group->libctx);
  217. if (ctx == NULL) {
  218. ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
  219. return -1;
  220. }
  221. BN_CTX_start(ctx);
  222. x = BN_CTX_get(ctx);
  223. y = BN_CTX_get(ctx);
  224. if (x == NULL || y == NULL) {
  225. ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
  226. goto ret;
  227. }
  228. memset(param, 0, sizeof(param));
  229. off = len - (dgstlen > len ? len : dgstlen);
  230. memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
  231. if (group->meth->point_get_affine_coordinates(group, pubkey,
  232. x, y, ctx) != 1
  233. || BN_bn2binpad(sig->r, param + S390X_OFF_R(len), len) == -1
  234. || BN_bn2binpad(sig->s, param + S390X_OFF_S(len), len) == -1
  235. || BN_bn2binpad(x, param + S390X_OFF_X(len), len) == -1
  236. || BN_bn2binpad(y, param + S390X_OFF_Y(len), len) == -1) {
  237. ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
  238. goto ret;
  239. }
  240. rc = s390x_kdsa(fc, param, NULL, 0) == 0 ? 1 : 0;
  241. ret:
  242. BN_CTX_end(ctx);
  243. BN_CTX_free(ctx);
  244. return rc;
  245. }
  246. #define EC_GFP_S390X_NISTP_METHOD(bits) \
  247. \
  248. static int ec_GFp_s390x_nistp##bits##_mul(const EC_GROUP *group, \
  249. EC_POINT *r, \
  250. const BIGNUM *scalar, \
  251. size_t num, \
  252. const EC_POINT *points[], \
  253. const BIGNUM *scalars[], \
  254. BN_CTX *ctx) \
  255. { \
  256. return ec_GFp_s390x_nistp_mul(group, r, scalar, num, points, \
  257. scalars, ctx, \
  258. S390X_SCALAR_MULTIPLY_P##bits, \
  259. S390X_SIZE_P##bits); \
  260. } \
  261. \
  262. static ECDSA_SIG *ecdsa_s390x_nistp##bits##_sign_sig(const unsigned \
  263. char *dgst, \
  264. int dgstlen, \
  265. const BIGNUM *kinv,\
  266. const BIGNUM *r, \
  267. EC_KEY *eckey) \
  268. { \
  269. return ecdsa_s390x_nistp_sign_sig(dgst, dgstlen, kinv, r, eckey, \
  270. S390X_ECDSA_SIGN_P##bits, \
  271. S390X_SIZE_P##bits); \
  272. } \
  273. \
  274. static int ecdsa_s390x_nistp##bits##_verify_sig(const \
  275. unsigned char *dgst, \
  276. int dgstlen, \
  277. const ECDSA_SIG *sig, \
  278. EC_KEY *eckey) \
  279. { \
  280. return ecdsa_s390x_nistp_verify_sig(dgst, dgstlen, sig, eckey, \
  281. S390X_ECDSA_VERIFY_P##bits, \
  282. S390X_SIZE_P##bits); \
  283. } \
  284. \
  285. const EC_METHOD *EC_GFp_s390x_nistp##bits##_method(void) \
  286. { \
  287. static const EC_METHOD EC_GFp_s390x_nistp##bits##_meth = { \
  288. EC_FLAGS_DEFAULT_OCT, \
  289. NID_X9_62_prime_field, \
  290. ossl_ec_GFp_simple_group_init, \
  291. ossl_ec_GFp_simple_group_finish, \
  292. ossl_ec_GFp_simple_group_clear_finish, \
  293. ossl_ec_GFp_simple_group_copy, \
  294. ossl_ec_GFp_simple_group_set_curve, \
  295. ossl_ec_GFp_simple_group_get_curve, \
  296. ossl_ec_GFp_simple_group_get_degree, \
  297. ossl_ec_group_simple_order_bits, \
  298. ossl_ec_GFp_simple_group_check_discriminant, \
  299. ossl_ec_GFp_simple_point_init, \
  300. ossl_ec_GFp_simple_point_finish, \
  301. ossl_ec_GFp_simple_point_clear_finish, \
  302. ossl_ec_GFp_simple_point_copy, \
  303. ossl_ec_GFp_simple_point_set_to_infinity, \
  304. ossl_ec_GFp_simple_point_set_affine_coordinates, \
  305. ossl_ec_GFp_simple_point_get_affine_coordinates, \
  306. NULL, /* point_set_compressed_coordinates */ \
  307. NULL, /* point2oct */ \
  308. NULL, /* oct2point */ \
  309. ossl_ec_GFp_simple_add, \
  310. ossl_ec_GFp_simple_dbl, \
  311. ossl_ec_GFp_simple_invert, \
  312. ossl_ec_GFp_simple_is_at_infinity, \
  313. ossl_ec_GFp_simple_is_on_curve, \
  314. ossl_ec_GFp_simple_cmp, \
  315. ossl_ec_GFp_simple_make_affine, \
  316. ossl_ec_GFp_simple_points_make_affine, \
  317. ec_GFp_s390x_nistp##bits##_mul, \
  318. NULL, /* precompute_mult */ \
  319. NULL, /* have_precompute_mult */ \
  320. ossl_ec_GFp_simple_field_mul, \
  321. ossl_ec_GFp_simple_field_sqr, \
  322. NULL, /* field_div */ \
  323. ossl_ec_GFp_simple_field_inv, \
  324. NULL, /* field_encode */ \
  325. NULL, /* field_decode */ \
  326. NULL, /* field_set_to_one */ \
  327. ossl_ec_key_simple_priv2oct, \
  328. ossl_ec_key_simple_oct2priv, \
  329. NULL, /* set_private */ \
  330. ossl_ec_key_simple_generate_key, \
  331. ossl_ec_key_simple_check_key, \
  332. ossl_ec_key_simple_generate_public_key, \
  333. NULL, /* keycopy */ \
  334. NULL, /* keyfinish */ \
  335. ossl_ecdh_simple_compute_key, \
  336. ossl_ecdsa_simple_sign_setup, \
  337. ecdsa_s390x_nistp##bits##_sign_sig, \
  338. ecdsa_s390x_nistp##bits##_verify_sig, \
  339. NULL, /* field_inverse_mod_ord */ \
  340. ossl_ec_GFp_simple_blind_coordinates, \
  341. ossl_ec_GFp_simple_ladder_pre, \
  342. ossl_ec_GFp_simple_ladder_step, \
  343. ossl_ec_GFp_simple_ladder_post \
  344. }; \
  345. static const EC_METHOD *ret; \
  346. \
  347. if ((OPENSSL_s390xcap_P.pcc[1] \
  348. & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P##bits)) \
  349. && (OPENSSL_s390xcap_P.kdsa[0] \
  350. & S390X_CAPBIT(S390X_ECDSA_VERIFY_P##bits)) \
  351. && (OPENSSL_s390xcap_P.kdsa[0] \
  352. & S390X_CAPBIT(S390X_ECDSA_SIGN_P##bits))) \
  353. ret = &EC_GFp_s390x_nistp##bits##_meth; \
  354. else \
  355. ret = EC_GFp_mont_method(); \
  356. \
  357. return ret; \
  358. }
  359. EC_GFP_S390X_NISTP_METHOD(256)
  360. EC_GFP_S390X_NISTP_METHOD(384)
  361. EC_GFP_S390X_NISTP_METHOD(521)