Date:   Sun, 16 Feb 2020 16:59:24 +0800
From:   Tianjia Zhang <tianjia.zhang@...ux.alibaba.com>
To:     herbert@...dor.apana.org.au, davem@...emloft.net,
        ebiggers@...nel.org, pvanleeuwen@...bus.com, zohar@...ux.ibm.com
Cc:     linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH 3/7] crypto: sm2 - introduce OSCCA SM2 asymmetric cipher algorithm

This new module implement the SM2 public key algorithm. It was
published by State Encryption Management Bureau, China.
List of specifications for SM2 elliptic curve public key cryptography:

* GM/T 0003.1-2012
* GM/T 0003.2-2012
* GM/T 0003.3-2012
* GM/T 0003.4-2012
* GM/T 0003.5-2012

IETF: https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
oscca: http://www.oscca.gov.cn/sca/xxgk/2010-12/17/content_1002386.shtml
scctc: http://www.gmbz.org.cn/main/bzlb.html

Signed-off-by: Tianjia Zhang <tianjia.zhang@...ux.alibaba.com>
---
 crypto/Kconfig           |   17 +
 crypto/Makefile          |    8 +
 crypto/sm2.c             | 1145 ++++++++++++++++++++++++++++++++++++++
 crypto/sm2signature.asn1 |    4 +
 include/crypto/sm2.h     |   25 +
 5 files changed, 1199 insertions(+)
 create mode 100644 crypto/sm2.c
 create mode 100644 crypto/sm2signature.asn1
 create mode 100644 include/crypto/sm2.h

diff --git a/crypto/Kconfig b/crypto/Kconfig
index 5575d48473bd..4a58673c85dd 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -264,6 +264,23 @@ config CRYPTO_ECRDSA
 	  standard algorithms (called GOST algorithms). Only signature verification
 	  is implemented.
 
+config CRYPTO_SM2
+	tristate "SM2 algorithm"
+	select CRYPTO_SM3
+	select CRYPTO_AKCIPHER
+	select CRYPTO_MANAGER
+	select MPILIB
+	select ASN1
+	help
+	  Generic implementation of the SM2 public key algorithm. It was
+	  published by State Encryption Management Bureau, China.
+	  as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012.
+
+	  References:
+	  https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
+	  http://www.oscca.gov.cn/sca/xxgk/2010-12/17/content_1002386.shtml
+	  http://www.gmbz.org.cn/main/bzlb.html
+
 config CRYPTO_CURVE25519
 	tristate "Curve25519 algorithm"
 	select CRYPTO_KPP
diff --git a/crypto/Makefile b/crypto/Makefile
index 4ca12b6044f7..b279483fba50 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -42,6 +42,14 @@ rsa_generic-y += rsa_helper.o
 rsa_generic-y += rsa-pkcs1pad.o
 obj-$(CONFIG_CRYPTO_RSA) += rsa_generic.o
 
+$(obj)/sm2signature.asn1.o: $(obj)/sm2signature.asn1.c $(obj)/sm2signature.asn1.h
+$(obj)/sm2.o: $(obj)/sm2signature.asn1.h
+
+sm2_generic-y += sm2signature.asn1.o
+sm2_generic-y += sm2.o
+
+obj-$(CONFIG_CRYPTO_SM2) += sm2_generic.o
+
 crypto_acompress-y := acompress.o
 crypto_acompress-y += scompress.o
 obj-$(CONFIG_CRYPTO_ACOMP2) += crypto_acompress.o
diff --git a/crypto/sm2.c b/crypto/sm2.c
new file mode 100644
index 000000000000..0410975554d1
--- /dev/null
+++ b/crypto/sm2.c
@@ -0,0 +1,1145 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * SM2 asymmetric public-key algorithm
+ * as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012 SM2 and
+ * described at https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
+ *
+ * Copyright (c) 2020, Alibaba Group.
+ * Authors: Tianjia Zhang <tianjia.zhang@...ux.alibaba.com>
+ */
+
+#include <linux/module.h>
+#include <linux/mpi.h>
+#include <crypto/internal/akcipher.h>
+#include <crypto/akcipher.h>
+#include <crypto/hash.h>
+#include <crypto/sm3_base.h>
+#include <crypto/rng.h>
+#include <crypto/sm2.h>
+#include "sm2signature.asn1.h"
+
+#define MPI_NBYTES(m)   ((mpi_get_nbits(m) + 7) / 8)
+
+struct ecc_domain_parms {
+	const char *desc;           /* Description of the curve.  */
+	unsigned int nbits;         /* Number of bits.  */
+	unsigned int fips:1; /* True if this is a FIPS140-2 approved curve */
+
+	/* The model describing this curve.  This is mainly used to select
+	 * the group equation.
+	 */
+	enum gcry_mpi_ec_models model;
+
+	/* The actual ECC dialect used.  This is used for curve specific
+	 * optimizations and to select encodings etc.
+	 */
+	enum ecc_dialects dialect;
+
+	const char *p;              /* The prime defining the field.  */
+	const char *a, *b;          /* The coefficients.  For Twisted Edwards
+				     * Curves b is used for d.  For Montgomery
+				     * Curves (a,b) has ((A-2)/4,B^-1).
+				     */
+	const char *n;              /* The order of the base point.  */
+	const char *g_x, *g_y;      /* Base point.  */
+	unsigned int h;             /* Cofactor.  */
+};
+
+static const struct ecc_domain_parms sm2_ecp = {
+	.desc = "sm2p256v1",
+	.nbits = 256,
+	.fips = 0,
+	.model = MPI_EC_WEIERSTRASS,
+	.dialect = ECC_DIALECT_STANDARD,
+	.p   = "0xfffffffeffffffffffffffffffffffffffffffff00000000ffffffffffffffff",
+	.a   = "0xfffffffeffffffffffffffffffffffffffffffff00000000fffffffffffffffc",
+	.b   = "0x28e9fa9e9d9f5e344d5a9e4bcf6509a7f39789f515ab8f92ddbcbd414d940e93",
+	.n   = "0xfffffffeffffffffffffffffffffffff7203df6b21c6052b53bbf40939d54123",
+	.g_x = "0x32c4ae2c1f1981195f9904466a39c9948fe30bbff2660be1715a4589334c74c7",
+	.g_y = "0xbc3736a2f4f6779c59bdcee36b692153d0a9877cc62a474002df32e52139f0a0",
+	.h = 1
+};
+
+static int sm2_ec_ctx_init(struct mpi_ec_ctx *ec)
+{
+	const struct ecc_domain_parms *ecp = &sm2_ecp;
+	MPI p, a, b;
+	MPI x, y;
+	int rc = -EINVAL;
+
+	p = mpi_scanval(ecp->p);
+	a = mpi_scanval(ecp->a);
+	b = mpi_scanval(ecp->b);
+	if (!p || !a || !b)
+		goto free_p;
+
+	x = mpi_scanval(ecp->g_x);
+	y = mpi_scanval(ecp->g_y);
+	if (!x || !y)
+		goto free;
+
+	/* mpi_ec_setup_elliptic_curve */
+	ec->G = mpi_point_new(0);
+	if (!ec->G)
+		goto free;
+
+	mpi_set(ec->G->x, x);
+	mpi_set(ec->G->y, y);
+	mpi_set_ui(ec->G->z, 1);
+
+	ec->n = mpi_scanval(ecp->n);
+	if (!ec->n) {
+		mpi_point_release(ec->G);
+		goto free;
+	}
+
+	ec->h = ecp->h;
+	ec->name = ecp->desc;
+	mpi_ec_init(ec, ecp->model, ecp->dialect, 0, p, a, b);
+
+	rc = 0;
+
+free:
+	mpi_free(x);
+	mpi_free(y);
+free_p:
+	mpi_free(p);
+	mpi_free(a);
+	mpi_free(b);
+
+	return rc;
+}
+
+static void sm2_ec_ctx_deinit(struct mpi_ec_ctx *ec)
+{
+	mpi_free(ec->n);
+	mpi_point_release(ec->G);
+
+	mpi_ec_deinit(ec);
+
+	memset(ec, 0, sizeof(*ec));
+}
+
+static int sm2_ec_ctx_reset(struct mpi_ec_ctx *ec)
+{
+	sm2_ec_ctx_deinit(ec);
+	return sm2_ec_ctx_init(ec);
+}
+
+static unsigned char *sm2_ecc_ec2os(MPI x, MPI y, MPI p, unsigned int *plen)
+{
+	int rc;
+	int pbytes = (mpi_get_nbits(p)+7)/8;
+	size_t n;
+	unsigned char *buf, *ptr;
+
+	buf = kmalloc(1 + 2*pbytes, GFP_KERNEL);
+	if (!buf)
+		return NULL;
+	*buf = 04; /* Uncompressed point. */
+	ptr = buf+1;
+	rc = mpi_print(GCRYMPI_FMT_USG, ptr, pbytes, &n, x);
+	if (rc) {
+		kfree(buf);
+		return NULL;
+	}
+	if (n < pbytes) {
+		memmove(ptr+(pbytes-n), ptr, n);
+		memset(ptr, 0, (pbytes-n));
+	}
+	ptr += pbytes;
+	rc = mpi_print(GCRYMPI_FMT_USG, ptr, pbytes, &n, y);
+	if (rc) {
+		kfree(buf);
+		return NULL;
+	}
+	if (n < pbytes) {
+		memmove(ptr+(pbytes-n), ptr, n);
+		memset(ptr, 0, (pbytes-n));
+	}
+
+	if (plen)
+		*plen = 1 + 2 * pbytes;
+	return buf;
+}
+
+/* Convert POINT into affine coordinates using the context CTX and
+ * return a newly allocated MPI.  If the conversion is not possible
+ * NULL is returned.  This function won't print an error message.
+ */
+static unsigned char *
+sm2_mpi_ec_ec2os(MPI_POINT point, struct mpi_ec_ctx *ec, unsigned int *plen)
+{
+	MPI g_x, g_y;
+	unsigned char *result;
+
+	g_x = mpi_new(0);
+	g_y = mpi_new(0);
+	if (mpi_ec_get_affine(g_x, g_y, point, ec))
+		result = NULL;
+	else
+		result = sm2_ecc_ec2os(g_x, g_y, ec->p, plen);
+	mpi_free(g_x);
+	mpi_free(g_y);
+
+	return result;
+}
+
+/* RESULT must have been initialized and is set on success to the
+ * point given by VALUE.
+ */
+static int sm2_ecc_os2ec(MPI_POINT result, MPI value)
+{
+	int rc;
+	size_t n;
+	const unsigned char *buf;
+	unsigned char *buf_memory;
+	MPI x, y;
+
+	n = (mpi_get_nbits(value)+7)/8;
+	buf_memory = kmalloc(n, GFP_KERNEL);
+	rc = mpi_print(GCRYMPI_FMT_USG, buf_memory, n, &n, value);
+	if (rc) {
+		kfree(buf_memory);
+		return rc;
+	}
+	buf = buf_memory;
+
+	if (n < 1) {
+		kfree(buf_memory);
+		return -EINVAL;
+	}
+	if (*buf != 4) {
+		kfree(buf_memory);
+		return -EINVAL; /* No support for point compression.  */
+	}
+	if (((n-1)%2)) {
+		kfree(buf_memory);
+		return -EINVAL;
+	}
+	n = (n-1)/2;
+	x = mpi_read_raw_data(buf + 1, n);
+	if (!x) {
+		kfree(buf_memory);
+		return -ENOMEM;
+	}
+	y = mpi_read_raw_data(buf + 1 + n, n);
+	kfree(buf_memory);
+	if (!y) {
+		mpi_free(x);
+		return -ENOMEM;
+	}
+
+	mpi_normalize(x);
+	mpi_normalize(y);
+
+	mpi_set(result->x, x);
+	mpi_set(result->y, y);
+	mpi_set_ui(result->z, 1);
+
+	mpi_free(x);
+	mpi_free(y);
+
+	return 0;
+}
+
+/*
+ * Generate a random secret exponent K less than Q.
+ */
+static MPI sm2_gen_k(MPI q)
+{
+	MPI k = NULL;
+	unsigned int nbits = mpi_get_nbits(q);
+	unsigned int nbytes = (nbits+7)/8;
+	char rndbuf[128];
+	int use_rng = 1;
+
+	if (nbytes > sizeof(rndbuf))
+		return NULL;
+	if (crypto_get_default_rng())
+		use_rng = 0;
+
+	for (;;) {
+
+		if (k) {
+			mpi_free(k);
+			k = NULL;
+		}
+
+		if (use_rng) {
+			if (crypto_rng_get_bytes(crypto_default_rng,
+					rndbuf, nbytes))
+				goto ret;
+		} else {
+			get_random_bytes(rndbuf, nbytes);
+		}
+
+		k = mpi_read_raw_data(rndbuf, nbytes);
+		if (!k)
+			goto ret;
+
+		/* Make sure we have the requested number of bits.  This code
+		 * looks a bit funny but it is easy to understand if you
+		 * consider that mpi_set_highbit clears all higher bits.  We
+		 * don't have a clear_highbit, thus we first set the high bit
+		 * and then clear it again.
+		 */
+		if (mpi_test_bit(k, nbits-1))
+			mpi_set_highbit(k, nbits-1);
+		else {
+			mpi_set_highbit(k, nbits-1);
+			mpi_clear_bit(k, nbits-1);
+		}
+
+		if (!(mpi_cmp(k, q) < 0))    /* check: k < q */
+			continue;
+		if (!(mpi_cmp_ui(k, 0) > 0)) /* check: k > 0 */
+			continue;
+
+		break;	/* okay */
+	}
+ret:
+	if (use_rng)
+		crypto_put_default_rng();
+	return k;
+}
+
+static MPI sm2_cipher_encode(MPI c1, MPI c3, MPI c2)
+{
+	unsigned int n;
+	unsigned char *buf, *p;
+	unsigned int nwritten;
+	int rc;
+	MPI result = NULL;
+
+	n = mpi_get_size(c1) + mpi_get_size(c3) + mpi_get_size(c2);
+
+	buf = kmalloc(n, GFP_KERNEL);
+	if (!buf)
+		return NULL;
+
+	p = buf;
+	rc = mpi_read_buffer(c1, p, mpi_get_size(c1), &nwritten, NULL);
+	if (rc)
+		goto err;
+	p += nwritten;
+	rc = mpi_read_buffer(c3, p, mpi_get_size(c3), &nwritten, NULL);
+	if (rc)
+		goto err;
+	p += nwritten;
+	rc = mpi_read_buffer(c2, p, mpi_get_size(c2), &nwritten, NULL);
+	if (rc)
+		goto err;
+
+	result = mpi_read_raw_data(buf, p + nwritten - buf);
+
+err:
+	kfree(buf);
+	return result;
+}
+
+static int sm2_cipher_decode(MPI c, MPI *c1, MPI *c3, MPI *c2)
+{
+	unsigned char *buf, *p;
+	unsigned int n;
+
+	buf = mpi_get_buffer(c, &n, NULL);
+	if (!buf)
+		return -ENOMEM;
+	if (n < 65 + SM3_DIGEST_SIZE)
+		return -EINVAL;
+
+	p = buf;
+	/* '0x04' + 2 * 256 bits */
+	*c1 = mpi_read_raw_data(p, 65);
+	p += 65;
+	*c3 = mpi_read_raw_data(p, SM3_DIGEST_SIZE);
+	p += SM3_DIGEST_SIZE;
+	*c2 = mpi_read_raw_data(p, buf + n - p);
+
+	kfree(buf);
+
+	if (!*c1 || !*c3 || !*c2) {
+		mpi_free(*c1);
+		mpi_free(*c3);
+		mpi_free(*c2);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static MPI sm2_signature_encode(MPI hash, MPI r, MPI s)
+{
+	unsigned char *buf;
+	unsigned int nwritten;
+	unsigned int n;
+	int rc;
+	MPI result = NULL;
+
+	/* both r and s are 256 bits */
+	n = SM3_DIGEST_SIZE + 32 * 2;
+	buf = kzalloc(n, GFP_KERNEL);
+	if (!buf)
+		return NULL;
+
+	rc = mpi_read_buffer(hash, buf, SM3_DIGEST_SIZE, &nwritten, NULL);
+	if (rc)
+		goto err;
+	rc = mpi_read_buffer(r, buf + SM3_DIGEST_SIZE, 32, &nwritten, NULL);
+	if (rc)
+		goto err;
+	rc = mpi_read_buffer(s, buf + SM3_DIGEST_SIZE + 32,
+			32, &nwritten, NULL);
+	if (rc)
+		goto err;
+
+	result = mpi_read_raw_data(buf, n);
+
+err:
+	kfree(buf);
+	return result;
+}
+
+struct sm2_signature_ctx {
+	MPI sig_r;
+	MPI sig_s;
+};
+
+int sm2_get_signature_r(void *context, size_t hdrlen, unsigned char tag,
+				const void *value, size_t vlen)
+{
+	struct sm2_signature_ctx *sig = context;
+
+	if (!value || !vlen)
+		return -EINVAL;
+
+	sig->sig_r = mpi_read_raw_data(value, vlen);
+	if (!sig->sig_r)
+		return -ENOMEM;
+
+	return 0;
+}
+
+int sm2_get_signature_s(void *context, size_t hdrlen, unsigned char tag,
+				const void *value, size_t vlen)
+{
+	struct sm2_signature_ctx *sig = context;
+
+	if (!value || !vlen)
+		return -EINVAL;
+
+	sig->sig_s = mpi_read_raw_data(value, vlen);
+	if (!sig->sig_s)
+		return -ENOMEM;
+
+	return 0;
+}
+
+static int sm2_z_digest_update(struct shash_desc *desc,
+			MPI m, unsigned int pbytes)
+{
+	static const unsigned char zero[32];
+	unsigned char *in;
+	unsigned int inlen;
+
+	in = mpi_get_buffer(m, &inlen, NULL);
+	if (!in)
+		return -EINVAL;
+
+	if (inlen < pbytes) {
+		/* padding with zero */
+		crypto_sm3_update(desc, zero, pbytes - inlen);
+		crypto_sm3_update(desc, in, inlen);
+	} else if (inlen > pbytes) {
+		/* skip the starting zero */
+		crypto_sm3_update(desc, in + inlen - pbytes, pbytes);
+	} else {
+		crypto_sm3_update(desc, in, inlen);
+	}
+
+	kfree(in);
+	return 0;
+}
+
+static int sm2_z_digest_update_point(struct shash_desc *desc,
+			MPI_POINT point, struct mpi_ec_ctx *ec, unsigned int pbytes)
+{
+	MPI x, y;
+	int ret = -EINVAL;
+
+	x = mpi_new(0);
+	y = mpi_new(0);
+
+	if (!mpi_ec_get_affine(x, y, point, ec) &&
+		!sm2_z_digest_update(desc, x, pbytes) &&
+		!sm2_z_digest_update(desc, y, pbytes))
+		ret = 0;
+
+	mpi_free(x);
+	mpi_free(y);
+	return ret;
+}
+
+int sm2_compute_z_digest(struct crypto_akcipher *tfm,
+			const unsigned char *id, size_t id_len,
+			unsigned char dgst[SM3_DIGEST_SIZE])
+{
+	struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
+	uint16_t bits_len;
+	unsigned char entl[2];
+	SHASH_DESC_ON_STACK(desc, NULL);
+	unsigned int pbytes;
+
+	if (id_len > (USHRT_MAX / 8) || !ec->Q)
+		return -EINVAL;
+
+	bits_len = (uint16_t)(id_len * 8);
+	entl[0] = bits_len >> 8;
+	entl[1] = bits_len & 0xff;
+
+	pbytes = MPI_NBYTES(ec->p);
+
+	/* ZA = H256(ENTLA | IDA | a | b | xG | yG | xA | yA) */
+	sm3_base_init(desc);
+	crypto_sm3_update(desc, entl, 2);
+	crypto_sm3_update(desc, id, id_len);
+
+	if (sm2_z_digest_update(desc, ec->a, pbytes) ||
+		sm2_z_digest_update(desc, ec->b, pbytes) ||
+		sm2_z_digest_update_point(desc, ec->G, ec, pbytes) ||
+		sm2_z_digest_update_point(desc, ec->Q, ec, pbytes))
+		return -EINVAL;
+
+	crypto_sm3_finup(desc, NULL, 0, dgst);
+	return 0;
+}
+EXPORT_SYMBOL(sm2_compute_z_digest);
+
+/* Key derivation function from X9.63/SECG */
+static void kdf_x9_63(const void *in, size_t inlen, void *out, size_t outlen)
+{
+	int mdlen = SM3_DIGEST_SIZE;
+	u32 counter = 1;
+	u32 counter_be;
+	unsigned char dgst[SM3_DIGEST_SIZE];
+	unsigned char *pout = out;
+	size_t rlen = outlen;
+	size_t len;
+	SHASH_DESC_ON_STACK(desc, NULL);
+
+	while (rlen > 0) {
+		counter_be = cpu_to_be32(counter);
+		counter++;
+
+		sm3_base_init(desc);
+		crypto_sm3_update(desc, in, inlen);
+		crypto_sm3_finup(desc, (const u8 *)&counter_be,
+				sizeof(counter_be), dgst);
+
+		len = mdlen < rlen ? mdlen : rlen;  /* min(mdlen, rlen) */
+		memcpy(pout, dgst, len);
+		rlen -= len;
+		pout += len;
+	}
+}
+
+static int _sm2_enc(struct mpi_ec_ctx *ec, MPI m, MPI *c1, MPI *c3, MPI *c2)
+{
+	int rc;
+	MPI k = NULL;
+	MPI x2, y2;
+	struct gcry_mpi_point kG, kP;
+	unsigned char *in = NULL;
+	unsigned int inlen;
+	unsigned int len;
+	unsigned char *x1y1 = NULL;
+	unsigned char *x2y2 = NULL;
+	unsigned char *cipher = NULL;
+	int i;
+
+	mpi_point_init(&kG);
+	mpi_point_init(&kP);
+	x2 = mpi_new(0);
+	y2 = mpi_new(0);
+
+	rc = -ENOMEM;
+	in = mpi_get_buffer(m, &inlen, NULL);
+	if (!in)
+		goto leave;
+
+	cipher = kmalloc(inlen, GFP_KERNEL);
+	if (!cipher)
+		goto leave;
+
+	/* rand k in [1, n-1] */
+	k = sm2_gen_k(ec->n);
+	if (k == NULL)
+		goto leave;
+
+	/* [k]G = (x1, y1) */
+	mpi_ec_mul_point(&kG, k, ec->G, ec);
+	x1y1 = sm2_mpi_ec_ec2os(&kG, ec, &len);
+	if (x1y1 == NULL)
+		goto leave;
+	*c1 = mpi_read_raw_data(x1y1, len);
+	if (*c1 == NULL)
+		goto leave;
+
+	/* [k]P = (x2, y2) */
+	rc = -EINVAL;
+	mpi_ec_mul_point(&kP, k, ec->Q, ec);
+	if (mpi_ec_get_affine(x2, y2, &kP, ec))
+		goto leave;
+
+	/* t = KDF(x2 || y2, klen) */
+	rc = -ENOMEM;
+	x2y2 = sm2_ecc_ec2os(x2, y2, ec->p, &len);
+	if (x2y2 == NULL)
+		goto leave;
+
+	/* skip the prefix '0x04' */
+	kdf_x9_63(x2y2 + 1, len - 1, cipher, inlen);
+
+	/* cipher = t xor in */
+	for (i = 0; i < inlen; i++)
+		cipher[i] ^= in[i];
+
+	*c2 = mpi_read_raw_data(cipher, inlen);
+	if (*c2 == NULL) {
+		rc = -ENOMEM;
+		goto leave;
+	}
+
+	/* hash(x2 || IN || y2) */
+	do {
+		SHASH_DESC_ON_STACK(desc, NULL);
+		unsigned char dgst[SM3_DIGEST_SIZE];
+
+		sm3_base_init(desc);
+		crypto_sm3_update(desc, x2y2 + 1, MPI_NBYTES(x2));
+		crypto_sm3_update(desc, in, inlen);
+		crypto_sm3_finup(desc, x2y2 + 1 + MPI_NBYTES(x2),
+				MPI_NBYTES(y2), dgst);
+
+		*c3 = mpi_read_raw_data(dgst, sizeof(dgst));
+		if (*c3 == NULL) {
+			rc = -ENOMEM;
+			goto leave;
+		}
+	} while (0);
+
+	rc = 0;
+
+leave:
+	if (rc) {
+		if (*c1)
+			mpi_free(*c1);
+		if (*c2)
+			mpi_free(*c2);
+		if (*c3)
+			mpi_free(*c3);
+		*c1 = NULL;
+		*c2 = NULL;
+		*c3 = NULL;
+	}
+
+	kfree(x2y2);
+	kfree(x1y1);
+	mpi_free(k);
+
+	kfree(cipher);
+	kfree(in);
+
+	mpi_point_free_parts(&kG);
+	mpi_point_free_parts(&kP);
+	mpi_free(x2);
+	mpi_free(y2);
+
+	return rc;
+}
+
+static int _sm2_dec(struct mpi_ec_ctx *ec, MPI c1, MPI c3, MPI c2, MPI *m)
+{
+	int rc;
+	MPI x2, y2;
+	struct gcry_mpi_point point_c1;
+	struct gcry_mpi_point kP;
+	unsigned char *x2y2 = NULL;
+	unsigned char *in = NULL;
+	unsigned int inlen;
+	unsigned char *plain = NULL;
+	unsigned int len;
+	unsigned char *hash = NULL;
+	int i;
+
+	mpi_point_init(&point_c1);
+	mpi_point_init(&kP);
+	x2 = mpi_new(0);
+	y2 = mpi_new(0);
+
+	rc = -ENOMEM;
+	in = mpi_get_buffer(c2, &inlen, NULL);
+	if (!in)
+		goto leave;
+
+	plain = kmalloc(inlen, GFP_KERNEL);
+	if (!plain)
+		goto leave;
+
+	rc = sm2_ecc_os2ec(&point_c1, c1);
+	if (rc)
+		goto leave;
+
+	rc = -EINVAL;
+	if (!mpi_ec_curve_point(&point_c1, ec))
+		goto leave;
+
+	/* [d]C1 = (x2, y2), C1 = [k]G */
+	mpi_ec_mul_point(&kP, ec->d, &point_c1, ec);
+	if (mpi_ec_get_affine(x2, y2, &kP, ec))
+		goto leave;
+
+	/* t = KDF(x2 || y2, inlen) */
+	x2y2 = sm2_ecc_ec2os(x2, y2, ec->p, &len);
+	/* skip the prefix '0x04' */
+	kdf_x9_63(x2y2 + 1, len - 1, plain, inlen);
+
+	/* plain = C2 xor t */
+	for (i = 0; i < inlen; i++)
+		plain[i] ^= in[i];
+
+	/* Hash(x2 || IN || y2) == C3 */
+	do {
+		SHASH_DESC_ON_STACK(desc, NULL);
+		unsigned char dgst[SM3_DIGEST_SIZE];
+
+		sm3_base_init(desc);
+		crypto_sm3_update(desc, x2y2 + 1, MPI_NBYTES(x2));
+		crypto_sm3_update(desc, plain, inlen);
+		crypto_sm3_finup(desc, x2y2 + 1 + MPI_NBYTES(x2),
+				MPI_NBYTES(y2), dgst);
+
+		rc = -EINVAL;
+		hash = mpi_get_buffer(c3, &len, NULL);
+		if (len != sizeof(dgst) || memcmp(dgst, hash, len) != 0)
+			goto leave;
+	} while (0);
+
+	rc = -ENOMEM;
+	*m = mpi_read_raw_data(plain, inlen);
+	if (*m == NULL)
+		goto leave;
+
+	rc = 0;
+
+leave:
+	kfree(hash);
+	kfree(x2y2);
+	if (plain) {
+		memset(plain, 0, inlen);
+		kfree(plain);
+	}
+	kfree(in);
+
+	mpi_point_free_parts(&point_c1);
+	mpi_point_free_parts(&kP);
+	mpi_free(x2);
+	mpi_free(y2);
+
+	return rc;
+}
+
+static int _sm2_sign(struct mpi_ec_ctx *ec, MPI hash, MPI *r, MPI *s)
+{
+	int rc = -EINVAL;
+	struct gcry_mpi_point kG;
+	MPI sig_r = NULL;
+	MPI sig_s = NULL;
+	MPI tmp = NULL;
+	MPI k = NULL;
+	MPI rk = NULL;
+	MPI x1 = NULL;
+
+	mpi_point_init(&kG);
+	x1 = mpi_new(0);
+	sig_r = mpi_new(0);
+	sig_s = mpi_new(0);
+	rk = mpi_new(0);
+	tmp = mpi_new(0);
+
+	for (;;) {
+		/* rand k in [1, n-1] */
+		k = sm2_gen_k(ec->n);
+		if (k == NULL)
+			goto leave;
+
+		/* [k]G = (x1, y1) */
+		mpi_ec_mul_point(&kG, k, ec->G, ec);
+		if (mpi_ec_get_affine(x1, NULL, &kG, ec))
+			goto leave;
+
+		/* r = (e + x1) % n */
+		mpi_addm(sig_r, hash, x1, ec->n);
+
+		/* r != 0 && r + k != n */
+		if (mpi_cmp_ui(sig_r, 0) == 0)
+			continue;
+		mpi_add(rk, sig_r, k);
+		if (mpi_cmp(rk, ec->n) == 0)
+			continue;
+
+		/* s = ((d + 1)^-1 * (k - rd)) % n */
+		mpi_addm(sig_s, ec->d, mpi_const(MPI_C_ONE), ec->n);
+		mpi_invm(sig_s, sig_s, ec->n);
+		mpi_mulm(tmp, sig_r, ec->d, ec->n);
+		mpi_subm(tmp, k, tmp, ec->n);
+		mpi_mulm(sig_s, sig_s, tmp, ec->n);
+
+		break;
+	}
+
+	*r = sig_r;
+	*s = sig_s;
+	rc = 0;
+
+leave:
+	if (rc) {
+		mpi_free(sig_r);
+		mpi_free(sig_s);
+	}
+	mpi_point_free_parts(&kG);
+	mpi_free(x1);
+	mpi_free(k);
+	mpi_free(rk);
+	mpi_free(tmp);
+
+	return rc;
+}
+
+static int _sm2_verify(struct mpi_ec_ctx *ec, MPI hash, MPI sig_r, MPI sig_s)
+{
+	int rc = -EINVAL;
+	struct gcry_mpi_point sG, tP;
+	MPI t = NULL;
+	MPI x1 = NULL, y1 = NULL;
+
+	mpi_point_init(&sG);
+	mpi_point_init(&tP);
+	x1 = mpi_new(0);
+	y1 = mpi_new(0);
+	t = mpi_new(0);
+
+	/* r, s in [1, n-1] */
+	if (mpi_cmp_ui(sig_r, 1) < 0 || mpi_cmp(sig_r, ec->n) > 0 ||
+		mpi_cmp_ui(sig_s, 1) < 0 || mpi_cmp(sig_s, ec->n) > 0) {
+		goto leave;
+	}
+
+	/* t = (r + s) % n, t == 0 */
+	mpi_addm(t, sig_r, sig_s, ec->n);
+	if (mpi_cmp_ui(t, 0) == 0)
+		goto leave;
+
+	/* sG + tP = (x1, y1) */
+	rc = -EBADMSG;
+	mpi_ec_mul_point(&sG, sig_s, ec->G, ec);
+	mpi_ec_mul_point(&tP, t, ec->Q, ec);
+	mpi_ec_add_points(&sG, &sG, &tP, ec);
+	if (mpi_ec_get_affine(x1, y1, &sG, ec))
+		goto leave;
+
+	/* R = (e + x1) % n */
+	mpi_addm(t, hash, x1, ec->n);
+
+	/* check R == r */
+	rc = -EKEYREJECTED;
+	if (mpi_cmp(t, sig_r))
+		goto leave;
+
+	rc = 0;
+
+leave:
+	mpi_point_free_parts(&sG);
+	mpi_point_free_parts(&tP);
+	mpi_free(x1);
+	mpi_free(y1);
+	mpi_free(t);
+
+	return rc;
+}
+
+static int sm2_enc(struct akcipher_request *req)
+{
+	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
+	struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
+	MPI m, c;
+	MPI c1 = NULL, c3 = NULL, c2 = NULL;
+	int ret = 0;
+	int sign;
+
+	if (unlikely(!ec->Q))
+		return -EINVAL;
+
+	m = mpi_read_raw_from_sgl(req->src, req->src_len);
+	if (!m)
+		return -ENOMEM;
+
+	ret = _sm2_enc(ec, m, &c1, &c3, &c2);
+	if (ret)
+		goto err_free_m;
+
+	ret = -EFAULT;
+	c = sm2_cipher_encode(c1, c3, c2);
+	if (!c)
+		goto err_free_c;
+
+	ret = mpi_write_to_sgl(c, req->dst, req->dst_len, &sign);
+	if (ret)
+		goto err_free_cipher;
+
+	if (sign < 0)
+		ret = -EBADMSG;
+
+err_free_cipher:
+	mpi_free(c);
+err_free_c:
+	mpi_free(c1);
+	mpi_free(c3);
+	mpi_free(c2);
+err_free_m:
+	mpi_free(m);
+	return ret;
+}
+
+static int sm2_dec(struct akcipher_request *req)
+{
+	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
+	struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
+	MPI m, c;
+	MPI c1 = NULL, c3 = NULL, c2 = NULL;
+	int ret = 0;
+	int sign;
+
+	if (unlikely(!ec->d))
+		return -EINVAL;
+
+	c = mpi_read_raw_from_sgl(req->src, req->src_len);
+	if (!c)
+		return -ENOMEM;
+
+	ret = sm2_cipher_decode(c, &c1, &c3, &c2);
+	if (ret)
+		goto err_free_cipher;
+
+	ret = _sm2_dec(ec, c1, c3, c2, &m);
+	if (ret)
+		goto err_free_c;
+
+	ret = mpi_write_to_sgl(m, req->dst, req->dst_len, &sign);
+	if (ret)
+		goto err_free_m;
+
+	if (sign < 0)
+		ret = -EBADMSG;
+
+err_free_m:
+	mpi_free(m);
+err_free_c:
+	mpi_free(c1);
+	mpi_free(c3);
+	mpi_free(c2);
+err_free_cipher:
+	mpi_free(c);
+	return ret;
+}
+
+static int sm2_sign(struct akcipher_request *req)
+{
+	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
+	struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
+	MPI hash, c;
+	MPI r = NULL, s = NULL;
+	int ret = 0;
+	int sign;
+
+	if (unlikely(!ec->d))
+		return -EINVAL;
+
+	hash = mpi_read_raw_from_sgl(req->src, req->src_len);
+	if (!hash)
+		return -ENOMEM;
+
+	ret = _sm2_sign(ec, hash, &r, &s);
+	if (ret)
+		goto err_free_hash;
+
+	ret = -EFAULT;
+	c = sm2_signature_encode(hash, r, s);
+	if (!c)
+		goto err_free_r;
+
+	ret = mpi_write_to_sgl(c, req->dst, req->dst_len, &sign);
+	if (ret)
+		goto err_free_c;
+
+	if (sign < 0)
+		ret = -EBADMSG;
+
+err_free_c:
+	mpi_free(c);
+err_free_r:
+	mpi_free(r);
+	mpi_free(s);
+err_free_hash:
+	mpi_free(hash);
+	return ret;
+}
+
+static int sm2_verify(struct akcipher_request *req)
+{
+	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
+	struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
+	unsigned char *buffer;
+	struct sm2_signature_ctx sig;
+	MPI hash;
+	int ret;
+
+	if (unlikely(!ec->Q))
+		return -EINVAL;
+
+	buffer = kmalloc(req->src_len + req->dst_len, GFP_KERNEL);
+	if (!buffer)
+		return -ENOMEM;
+
+	sg_pcopy_to_buffer(req->src,
+			sg_nents_for_len(req->src, req->src_len + req->dst_len),
+			buffer, req->src_len + req->dst_len, 0);
+
+	sig.sig_r = NULL;
+	sig.sig_s = NULL;
+	ret = asn1_ber_decoder(&sm2signature_decoder, &sig, buffer, req->src_len);
+	if (ret)
+		goto error;
+
+	ret = -ENOMEM;
+	hash = mpi_read_raw_data(buffer + req->src_len, req->dst_len);
+	if (!hash)
+		goto error;
+
+	ret = _sm2_verify(ec, hash, sig.sig_r, sig.sig_s);
+
+	mpi_free(hash);
+error:
+	mpi_free(sig.sig_r);
+	mpi_free(sig.sig_s);
+	kfree(buffer);
+	return ret;
+}
+
+static int sm2_set_pub_key(struct crypto_akcipher *tfm, const void *key,
+						unsigned int keylen)
+{
+	struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
+	MPI a;
+	int rc;
+
+	rc = sm2_ec_ctx_reset(ec);
+	if (rc)
+		return rc;
+
+	ec->Q = mpi_point_new(0);
+	if (!ec->Q)
+		return -ENOMEM;
+
+	/* include the uncompressed flag '0x04' */
+	rc = -ENOMEM;
+	a = mpi_read_raw_data(key, keylen);
+	if (!a)
+		goto error;
+
+	mpi_normalize(a);
+	rc = sm2_ecc_os2ec(ec->Q, a);
+	mpi_free(a);
+	if (rc)
+		goto error;
+
+	return 0;
+
+error:
+	mpi_point_release(ec->Q);
+	ec->Q = NULL;
+	return rc;
+}
+
+static int sm2_set_priv_key(struct crypto_akcipher *tfm, const void *key,
+						unsigned int keylen)
+{
+	struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
+	int rc;
+
+	rc = sm2_ec_ctx_reset(ec);
+	if (rc)
+		return rc;
+
+	ec->d = mpi_read_raw_data(key, keylen);
+	if (!ec->d)
+		return -ENOMEM;
+
+	/* compute pubkey if it not exist */
+	if (!ec->Q) {
+		ec->Q = mpi_point_new(0);
+		if (!ec->Q)
+			return -ENOMEM;
+		mpi_ec_mul_point(ec->Q, ec->d, ec->G, ec);
+	}
+
+	return 0;
+}
+
+static unsigned int sm2_max_size(struct crypto_akcipher *tfm)
+{
+	/* Unlimited max size */
+	return PAGE_SIZE;
+}
+
+static void sm2_exit_tfm(struct crypto_akcipher *tfm)
+{
+	struct mpi_ec_ctx *ec = akcipher_tfm_ctx(tfm);
+
+	mpi_ec_deinit(ec);
+}
+
+static struct akcipher_alg sm2 = {
+	.encrypt = sm2_enc,
+	.decrypt = sm2_dec,
+	.sign = sm2_sign,
+	.verify = sm2_verify,
+	.set_priv_key = sm2_set_priv_key,
+	.set_pub_key = sm2_set_pub_key,
+	.max_size = sm2_max_size,
+	.exit = sm2_exit_tfm,
+	.base = {
+		.cra_name = "sm2",
+		.cra_driver_name = "sm2-generic",
+		.cra_priority = 100,
+		.cra_module = THIS_MODULE,
+		.cra_ctxsize = sizeof(struct mpi_ec_ctx),
+	},
+};
+
+static int sm2_init(void)
+{
+	return crypto_register_akcipher(&sm2);
+}
+
+static void sm2_exit(void)
+{
+	crypto_unregister_akcipher(&sm2);
+}
+
+subsys_initcall(sm2_init);
+module_exit(sm2_exit);
+
+MODULE_ALIAS_CRYPTO("sm2");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("SM2 generic algorithm");
diff --git a/crypto/sm2signature.asn1 b/crypto/sm2signature.asn1
new file mode 100644
index 000000000000..ab8c0b754d21
--- /dev/null
+++ b/crypto/sm2signature.asn1
@@ -0,0 +1,4 @@
+Sm2Signature ::= SEQUENCE {
+	sig_r	INTEGER ({ sm2_get_signature_r }),
+	sig_s	INTEGER ({ sm2_get_signature_s })
+}
diff --git a/include/crypto/sm2.h b/include/crypto/sm2.h
new file mode 100644
index 000000000000..af452556dcd4
--- /dev/null
+++ b/include/crypto/sm2.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * sm2.h - SM2 asymmetric public-key algorithm
+ * as specified by OSCCA GM/T 0003.1-2012 -- 0003.5-2012 SM2 and
+ * described at https://tools.ietf.org/html/draft-shen-sm2-ecdsa-02
+ *
+ * Copyright (c) 2020, Alibaba Group.
+ * Written by Tianjia Zhang <tianjia.zhang@...ux.alibaba.com>
+ */
+
+#ifndef _CRYPTO_SM2_H
+#define _CRYPTO_SM2_H
+
+#include <crypto/sm3.h>
+#include <crypto/akcipher.h>
+
+/* The default user id as specified in GM/T 0009-2012 */
+#define SM2_DEFAULT_USERID "1234567812345678"
+#define SM2_DEFAULT_USERID_LEN 16
+
+extern int sm2_compute_z_digest(struct crypto_akcipher *tfm,
+			const unsigned char *id, size_t id_len,
+			unsigned char dgst[SM3_DIGEST_SIZE]);
+
+#endif /* _CRYPTO_SM2_H */
-- 
2.17.1

Powered by blists - more mailing lists