1/*
2 * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License").  You may not use
5 * this file except in compliance with the License.  You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10#include <openssl/crypto.h>
11#include <openssl/core_dispatch.h>
12#include <openssl/core_names.h>
13#include <openssl/params.h>
14#include <openssl/err.h>
15#include <openssl/proverr.h>
16#include "internal/cryptlib.h"
17#include "crypto/ecx.h"
18#include "prov/implementations.h"
19#include "prov/providercommon.h"
20#ifdef S390X_EC_ASM
21# include "s390x_arch.h"
22#endif
23
24static OSSL_FUNC_keyexch_newctx_fn x25519_newctx;
25static OSSL_FUNC_keyexch_newctx_fn x448_newctx;
26static OSSL_FUNC_keyexch_init_fn ecx_init;
27static OSSL_FUNC_keyexch_set_peer_fn ecx_set_peer;
28static OSSL_FUNC_keyexch_derive_fn ecx_derive;
29static OSSL_FUNC_keyexch_freectx_fn ecx_freectx;
30static OSSL_FUNC_keyexch_dupctx_fn ecx_dupctx;
31
32/*
33 * What's passed as an actual key is defined by the KEYMGMT interface.
34 * We happen to know that our KEYMGMT simply passes ECX_KEY structures, so
35 * we use that here too.
36 */
37
38typedef struct {
39    size_t keylen;
40    ECX_KEY *key;
41    ECX_KEY *peerkey;
42} PROV_ECX_CTX;
43
44static void *ecx_newctx(void *provctx, size_t keylen)
45{
46    PROV_ECX_CTX *ctx;
47
48    if (!ossl_prov_is_running())
49        return NULL;
50
51    ctx = OPENSSL_zalloc(sizeof(PROV_ECX_CTX));
52    if (ctx == NULL) {
53        ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
54        return NULL;
55    }
56
57    ctx->keylen = keylen;
58
59    return ctx;
60}
61
62static void *x25519_newctx(void *provctx)
63{
64    return ecx_newctx(provctx, X25519_KEYLEN);
65}
66
67static void *x448_newctx(void *provctx)
68{
69    return ecx_newctx(provctx, X448_KEYLEN);
70}
71
72static int ecx_init(void *vecxctx, void *vkey,
73                    ossl_unused const OSSL_PARAM params[])
74{
75    PROV_ECX_CTX *ecxctx = (PROV_ECX_CTX *)vecxctx;
76    ECX_KEY *key = vkey;
77
78    if (!ossl_prov_is_running())
79        return 0;
80
81    if (ecxctx == NULL
82            || key == NULL
83            || key->keylen != ecxctx->keylen
84            || !ossl_ecx_key_up_ref(key)) {
85        ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR);
86        return 0;
87    }
88
89    ossl_ecx_key_free(ecxctx->key);
90    ecxctx->key = key;
91
92    return 1;
93}
94
95static int ecx_set_peer(void *vecxctx, void *vkey)
96{
97    PROV_ECX_CTX *ecxctx = (PROV_ECX_CTX *)vecxctx;
98    ECX_KEY *key = vkey;
99
100    if (!ossl_prov_is_running())
101        return 0;
102
103    if (ecxctx == NULL
104            || key == NULL
105            || key->keylen != ecxctx->keylen
106            || !ossl_ecx_key_up_ref(key)) {
107        ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR);
108        return 0;
109    }
110    ossl_ecx_key_free(ecxctx->peerkey);
111    ecxctx->peerkey = key;
112
113    return 1;
114}
115
116static int ecx_derive(void *vecxctx, unsigned char *secret, size_t *secretlen,
117                      size_t outlen)
118{
119    PROV_ECX_CTX *ecxctx = (PROV_ECX_CTX *)vecxctx;
120
121    if (!ossl_prov_is_running())
122        return 0;
123
124    if (ecxctx->key == NULL
125            || ecxctx->key->privkey == NULL
126            || ecxctx->peerkey == NULL) {
127        ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_KEY);
128        return 0;
129    }
130
131    if (!ossl_assert(ecxctx->keylen == X25519_KEYLEN
132            || ecxctx->keylen == X448_KEYLEN)) {
133        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
134        return 0;
135    }
136
137    if (secret == NULL) {
138        *secretlen = ecxctx->keylen;
139        return 1;
140    }
141    if (outlen < ecxctx->keylen) {
142        ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL);
143        return 0;
144    }
145
146    if (ecxctx->keylen == X25519_KEYLEN) {
147#ifdef S390X_EC_ASM
148        if (OPENSSL_s390xcap_P.pcc[1]
149                & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_X25519)) {
150            if (s390x_x25519_mul(secret, ecxctx->peerkey->pubkey,
151                                 ecxctx->key->privkey) == 0) {
152                ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_DURING_DERIVATION);
153                return 0;
154            }
155        } else
156#endif
157        if (ossl_x25519(secret, ecxctx->key->privkey,
158                        ecxctx->peerkey->pubkey) == 0) {
159            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_DURING_DERIVATION);
160            return 0;
161        }
162    } else {
163#ifdef S390X_EC_ASM
164        if (OPENSSL_s390xcap_P.pcc[1]
165                & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_X448)) {
166            if (s390x_x448_mul(secret, ecxctx->peerkey->pubkey,
167                               ecxctx->key->privkey) == 0) {
168                ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_DURING_DERIVATION);
169                return 0;
170            }
171        } else
172#endif
173        if (ossl_x448(secret, ecxctx->key->privkey,
174                      ecxctx->peerkey->pubkey) == 0) {
175            ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_DURING_DERIVATION);
176            return 0;
177        }
178    }
179
180    *secretlen = ecxctx->keylen;
181    return 1;
182}
183
184static void ecx_freectx(void *vecxctx)
185{
186    PROV_ECX_CTX *ecxctx = (PROV_ECX_CTX *)vecxctx;
187
188    ossl_ecx_key_free(ecxctx->key);
189    ossl_ecx_key_free(ecxctx->peerkey);
190
191    OPENSSL_free(ecxctx);
192}
193
194static void *ecx_dupctx(void *vecxctx)
195{
196    PROV_ECX_CTX *srcctx = (PROV_ECX_CTX *)vecxctx;
197    PROV_ECX_CTX *dstctx;
198
199    if (!ossl_prov_is_running())
200        return NULL;
201
202    dstctx = OPENSSL_zalloc(sizeof(*srcctx));
203    if (dstctx == NULL) {
204        ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
205        return NULL;
206    }
207
208    *dstctx = *srcctx;
209    if (dstctx->key != NULL && !ossl_ecx_key_up_ref(dstctx->key)) {
210        ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR);
211        OPENSSL_free(dstctx);
212        return NULL;
213    }
214
215    if (dstctx->peerkey != NULL && !ossl_ecx_key_up_ref(dstctx->peerkey)) {
216        ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR);
217        ossl_ecx_key_free(dstctx->key);
218        OPENSSL_free(dstctx);
219        return NULL;
220    }
221
222    return dstctx;
223}
224
225const OSSL_DISPATCH ossl_x25519_keyexch_functions[] = {
226    { OSSL_FUNC_KEYEXCH_NEWCTX, (void (*)(void))x25519_newctx },
227    { OSSL_FUNC_KEYEXCH_INIT, (void (*)(void))ecx_init },
228    { OSSL_FUNC_KEYEXCH_DERIVE, (void (*)(void))ecx_derive },
229    { OSSL_FUNC_KEYEXCH_SET_PEER, (void (*)(void))ecx_set_peer },
230    { OSSL_FUNC_KEYEXCH_FREECTX, (void (*)(void))ecx_freectx },
231    { OSSL_FUNC_KEYEXCH_DUPCTX, (void (*)(void))ecx_dupctx },
232    { 0, NULL }
233};
234
235const OSSL_DISPATCH ossl_x448_keyexch_functions[] = {
236    { OSSL_FUNC_KEYEXCH_NEWCTX, (void (*)(void))x448_newctx },
237    { OSSL_FUNC_KEYEXCH_INIT, (void (*)(void))ecx_init },
238    { OSSL_FUNC_KEYEXCH_DERIVE, (void (*)(void))ecx_derive },
239    { OSSL_FUNC_KEYEXCH_SET_PEER, (void (*)(void))ecx_set_peer },
240    { OSSL_FUNC_KEYEXCH_FREECTX, (void (*)(void))ecx_freectx },
241    { OSSL_FUNC_KEYEXCH_DUPCTX, (void (*)(void))ecx_dupctx },
242    { 0, NULL }
243};
244