Message-ID: <20251205173923.31740-1-git@danielhodges.dev>
Date: Fri,  5 Dec 2025 12:39:18 -0500
From: Daniel Hodges <git@...ielhodges.dev>
To: ast@...nel.org,
	daniel@...earbox.net,
	andrii@...nel.org,
	vadim.fedorenko@...ux.dev
Cc: martin.lau@...ux.dev,
	eddyz87@...il.com,
	song@...nel.org,
	yonghong.song@...ux.dev,
	john.fastabend@...il.com,
	kpsingh@...nel.org,
	sdf@...ichev.me,
	haoluo@...gle.com,
	jolsa@...nel.org,
	herbert@...dor.apana.org.au,
	davem@...emloft.net,
	shuah@...nel.org,
	bpf@...r.kernel.org,
	linux-crypto@...r.kernel.org,
	linux-kselftest@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Daniel Hodges <git@...ielhodges.dev>
Subject: [PATCH bpf-next v2 0/5] Add cryptographic hash and signature verification kfuncs to BPF

This series extends BPF's cryptographic capabilities by adding kfuncs for
SHA hashing and ECDSA signature verification. These functions enable BPF
programs to perform cryptographic operations for use cases such as content
verification, integrity checking, and data authentication.

BPF programs increasingly need to verify data integrity and authenticity in
networking, security, and observability contexts. While BPF already supports
symmetric encryption/decryption, it lacks support for:

1. Cryptographic hashing - needed for content verification, fingerprinting,
   and preparing message digests for signature operations
2. Asymmetric signature verification - needed to verify signed data without
   requiring the signing key in the datapath

These capabilities enable use cases such as:
- Verifying signed network packets or application data in XDP/TC programs
- Implementing integrity checks in tracing and security monitoring
- Building zero-trust security models where BPF programs verify credentials
- Content-addressed storage and deduplication in BPF-based filesystems

Implementation:

The implementation follows BPF's existing crypto patterns:
1. Uses bpf_dynptr for safe memory access without page fault risks
2. Leverages the kernel's existing crypto library (lib/crypto/sha256.c and
   crypto/ecdsa.c) rather than reimplementing algorithms
3. Provides context-based API for ECDSA to enable key reuse and support
   multiple program types (syscall, XDP, TC)
4. Includes comprehensive selftests with NIST test vectors

Patch 1: crypto: Add BPF hash algorithm type registration module
  - Adds bpf_crypto_shash module in crypto/ subsystem
  - Registers hash type with BPF crypto infrastructure
  - Enables hash algorithm access through unified bpf_crypto_type interface
  - Implements callbacks: alloc_tfm, free_tfm, hash, digestsize, get_flags
  - Manages shash_desc lifecycle internally

Patch 2: bpf: Add SHA hash kfunc for cryptographic hashing
  - Adds bpf_crypto_hash() kfunc for SHA-256/384/512
  - Extends bpf_crypto_type structure with hash operations
  - Updates bpf_crypto_ctx_create() to support keyless operations
  - Protected by CONFIG_CRYPTO_HASH2 guards
  - Uses kernel's crypto library implementations

Patch 3: selftests/bpf: Add tests for bpf_crypto_hash kfunc
  - Tests basic functionality with NIST "abc" test vectors
  - Validates error handling for invalid parameters (zero-length input)
  - Ensures correct hash output for SHA-256, SHA-384, and SHA-512
  - Adds CONFIG_CRYPTO_HASH2 and CONFIG_CRYPTO_SHA512 to selftest config

Patch 4: bpf: Add ECDSA signature verification kfuncs
  - Context-based API: bpf_ecdsa_ctx_create/acquire/release pattern
  - Supports NIST curves (P-256, P-384, P-521)
  - Adds bpf_ecdsa_verify() for signature verification
  - Includes size query functions: keysize, digestsize, maxsize
  - Enables use in non-sleepable contexts via pre-allocated contexts
  - Uses crypto_sig API with p1363 format (r || s signatures)

Patch 5: selftests/bpf: Add tests for ECDSA signature verification
  - Tests valid signature acceptance with RFC 6979 test vectors for P-256
  - Tests invalid signature rejection
  - Tests size query functions (keysize, digestsize, maxsize)
  - Uses well-known NIST test vectors with "sample" message

v2:

- Fixed redundant __bpf_dynptr_is_rdonly() checks (Vadim)
- Added BPF hash algorithm type registration module in crypto/ subsystem
- Added CONFIG_CRYPTO_HASH2 guards around bpf_crypto_hash() kfunc and its
  BTF registration, matching the pattern used for CONFIG_CRYPTO_ECDSA
- Added mandatory digestsize validation for hash operations

Test Results
============

All tests pass on x86_64 for both crypto_hash and ecdsa_verify test suites.

Daniel Hodges (5):
  crypto: Add BPF hash algorithm type registration module
  bpf: Add SHA hash kfunc for cryptographic hashing
  selftests/bpf: Add tests for bpf_crypto_hash kfunc
  bpf: Add ECDSA signature verification kfuncs
  selftests/bpf: Add tests for ECDSA signature verification kfuncs

 crypto/Makefile                               |   3 +
 crypto/bpf_crypto_shash.c                     |  94 ++++++
 include/linux/bpf_crypto.h                    |   2 +
 kernel/bpf/crypto.c                                | 306 ++++++++++++++++++++-
 tools/testing/selftests/bpf/config                 |   2 +
 .../testing/selftests/bpf/prog_tests/crypto_hash.c | 158 +++++++++++
 .../selftests/bpf/prog_tests/ecdsa_verify.c        |  74 +++++
 tools/testing/selftests/bpf/progs/crypto_hash.c    | 141 ++++++++++
 tools/testing/selftests/bpf/progs/ecdsa_verify.c   | 159 +++++++++++
 9 files changed, 931 insertions(+), 8 deletions(-)
 create mode 100644 crypto/bpf_crypto_shash.c
 create mode 100644 tools/testing/selftests/bpf/prog_tests/crypto_hash.c
 create mode 100644 tools/testing/selftests/bpf/prog_tests/ecdsa_verify.c
 create mode 100644 tools/testing/selftests/bpf/progs/crypto_hash.c
 create mode 100644 tools/testing/selftests/bpf/progs/ecdsa_verify.c

-- 
2.51.0

Powered by blists - more mailing lists