1/* 2 * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10/* 11 * EC_METHOD low level APIs are deprecated for public use, but still ok for 12 * internal use. 13 */ 14#include "internal/deprecated.h" 15 16#include <stdlib.h> 17#include <string.h> 18#include <openssl/err.h> 19#include <openssl/rand.h> 20#include "ec_local.h" 21#include "s390x_arch.h" 22 23/* Size of parameter blocks */ 24#define S390X_SIZE_PARAM 4096 25 26/* Size of fields in parameter blocks */ 27#define S390X_SIZE_P256 32 28#define S390X_SIZE_P384 48 29#define S390X_SIZE_P521 80 30 31/* Offsets of fields in PCC parameter blocks */ 32#define S390X_OFF_RES_X(n) (0 * n) 33#define S390X_OFF_RES_Y(n) (1 * n) 34#define S390X_OFF_SRC_X(n) (2 * n) 35#define S390X_OFF_SRC_Y(n) (3 * n) 36#define S390X_OFF_SCALAR(n) (4 * n) 37 38/* Offsets of fields in KDSA parameter blocks */ 39#define S390X_OFF_R(n) (0 * n) 40#define S390X_OFF_S(n) (1 * n) 41#define S390X_OFF_H(n) (2 * n) 42#define S390X_OFF_K(n) (3 * n) 43#define S390X_OFF_X(n) (3 * n) 44#define S390X_OFF_RN(n) (4 * n) 45#define S390X_OFF_Y(n) (4 * n) 46 47static int ec_GFp_s390x_nistp_mul(const EC_GROUP *group, EC_POINT *r, 48 const BIGNUM *scalar, 49 size_t num, const EC_POINT *points[], 50 const BIGNUM *scalars[], 51 BN_CTX *ctx, unsigned int fc, int len) 52{ 53 unsigned char param[S390X_SIZE_PARAM]; 54 BIGNUM *x, *y; 55 const EC_POINT *point_ptr = NULL; 56 const BIGNUM *scalar_ptr = NULL; 57 BN_CTX *new_ctx = NULL; 58 int rc = -1; 59 60 if (ctx == NULL) { 61 ctx = new_ctx = BN_CTX_new_ex(group->libctx); 62 if (ctx == NULL) 63 return 0; 64 } 65 66 BN_CTX_start(ctx); 67 68 x = BN_CTX_get(ctx); 69 y = BN_CTX_get(ctx); 70 if (x == NULL || y == NULL) { 71 rc = 0; 72 goto ret; 73 } 74 75 /* 76 * Use PCC for EC keygen and ECDH key derivation: 77 * scalar * generator and scalar * peer public key, 78 * scalar in [0,order). 79 */ 80 if ((scalar != NULL && num == 0 && BN_is_negative(scalar) == 0) 81 || (scalar == NULL && num == 1 && BN_is_negative(scalars[0]) == 0)) { 82 83 if (num == 0) { 84 point_ptr = EC_GROUP_get0_generator(group); 85 scalar_ptr = scalar; 86 } else { 87 point_ptr = points[0]; 88 scalar_ptr = scalars[0]; 89 } 90 91 if (EC_POINT_is_at_infinity(group, point_ptr) == 1 92 || BN_is_zero(scalar_ptr)) { 93 rc = EC_POINT_set_to_infinity(group, r); 94 goto ret; 95 } 96 97 memset(¶m, 0, sizeof(param)); 98 99 if (group->meth->point_get_affine_coordinates(group, point_ptr, 100 x, y, ctx) != 1 101 || BN_bn2binpad(x, param + S390X_OFF_SRC_X(len), len) == -1 102 || BN_bn2binpad(y, param + S390X_OFF_SRC_Y(len), len) == -1 103 || BN_bn2binpad(scalar_ptr, 104 param + S390X_OFF_SCALAR(len), len) == -1 105 || s390x_pcc(fc, param) != 0 106 || BN_bin2bn(param + S390X_OFF_RES_X(len), len, x) == NULL 107 || BN_bin2bn(param + S390X_OFF_RES_Y(len), len, y) == NULL 108 || group->meth->point_set_affine_coordinates(group, r, 109 x, y, ctx) != 1) 110 goto ret; 111 112 rc = 1; 113 } 114 115ret: 116 /* Otherwise use default. */ 117 if (rc == -1) 118 rc = ossl_ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx); 119 OPENSSL_cleanse(param, sizeof(param)); 120 BN_CTX_end(ctx); 121 BN_CTX_free(new_ctx); 122 return rc; 123} 124 125static ECDSA_SIG *ecdsa_s390x_nistp_sign_sig(const unsigned char *dgst, 126 int dgstlen, 127 const BIGNUM *kinv, 128 const BIGNUM *r, 129 EC_KEY *eckey, 130 unsigned int fc, int len) 131{ 132 unsigned char param[S390X_SIZE_PARAM]; 133 int ok = 0; 134 BIGNUM *k; 135 ECDSA_SIG *sig; 136 const EC_GROUP *group; 137 const BIGNUM *privkey; 138 int off; 139 140 group = EC_KEY_get0_group(eckey); 141 privkey = EC_KEY_get0_private_key(eckey); 142 if (group == NULL || privkey == NULL) { 143 ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS); 144 return NULL; 145 } 146 147 if (!EC_KEY_can_sign(eckey)) { 148 ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING); 149 return NULL; 150 } 151 152 k = BN_secure_new(); 153 sig = ECDSA_SIG_new(); 154 if (k == NULL || sig == NULL) { 155 ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); 156 goto ret; 157 } 158 159 sig->r = BN_new(); 160 sig->s = BN_new(); 161 if (sig->r == NULL || sig->s == NULL) { 162 ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); 163 goto ret; 164 } 165 166 memset(param, 0, sizeof(param)); 167 off = len - (dgstlen > len ? len : dgstlen); 168 memcpy(param + S390X_OFF_H(len) + off, dgst, len - off); 169 170 if (BN_bn2binpad(privkey, param + S390X_OFF_K(len), len) == -1) { 171 ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); 172 goto ret; 173 } 174 175 if (r == NULL || kinv == NULL) { 176 if (len < 0) { 177 ERR_raise(ERR_LIB_EC, EC_R_INVALID_LENGTH); 178 goto ret; 179 } 180 /* 181 * Generate random k and copy to param param block. RAND_priv_bytes_ex 182 * is used instead of BN_priv_rand_range or BN_generate_dsa_nonce 183 * because kdsa instruction constructs an in-range, invertible nonce 184 * internally implementing counter-measures for RNG weakness. 185 */ 186 if (RAND_priv_bytes_ex(eckey->libctx, param + S390X_OFF_RN(len), 187 (size_t)len, 0) != 1) { 188 ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED); 189 goto ret; 190 } 191 } else { 192 /* Reconstruct k = (k^-1)^-1. */ 193 if (ossl_ec_group_do_inverse_ord(group, k, kinv, NULL) == 0 194 || BN_bn2binpad(k, param + S390X_OFF_RN(len), len) == -1) { 195 ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); 196 goto ret; 197 } 198 /* Turns KDSA internal nonce-generation off. */ 199 fc |= S390X_KDSA_D; 200 } 201 202 if (s390x_kdsa(fc, param, NULL, 0) != 0) { 203 ERR_raise(ERR_LIB_EC, ERR_R_ECDSA_LIB); 204 goto ret; 205 } 206 207 if (BN_bin2bn(param + S390X_OFF_R(len), len, sig->r) == NULL 208 || BN_bin2bn(param + S390X_OFF_S(len), len, sig->s) == NULL) { 209 ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); 210 goto ret; 211 } 212 213 ok = 1; 214ret: 215 OPENSSL_cleanse(param, sizeof(param)); 216 if (ok != 1) { 217 ECDSA_SIG_free(sig); 218 sig = NULL; 219 } 220 BN_clear_free(k); 221 return sig; 222} 223 224static int ecdsa_s390x_nistp_verify_sig(const unsigned char *dgst, int dgstlen, 225 const ECDSA_SIG *sig, EC_KEY *eckey, 226 unsigned int fc, int len) 227{ 228 unsigned char param[S390X_SIZE_PARAM]; 229 int rc = -1; 230 BN_CTX *ctx; 231 BIGNUM *x, *y; 232 const EC_GROUP *group; 233 const EC_POINT *pubkey; 234 int off; 235 236 group = EC_KEY_get0_group(eckey); 237 pubkey = EC_KEY_get0_public_key(eckey); 238 if (eckey == NULL || group == NULL || pubkey == NULL || sig == NULL) { 239 ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS); 240 return -1; 241 } 242 243 if (!EC_KEY_can_sign(eckey)) { 244 ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING); 245 return -1; 246 } 247 248 ctx = BN_CTX_new_ex(group->libctx); 249 if (ctx == NULL) { 250 ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); 251 return -1; 252 } 253 254 BN_CTX_start(ctx); 255 256 x = BN_CTX_get(ctx); 257 y = BN_CTX_get(ctx); 258 if (x == NULL || y == NULL) { 259 ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE); 260 goto ret; 261 } 262 263 memset(param, 0, sizeof(param)); 264 off = len - (dgstlen > len ? len : dgstlen); 265 memcpy(param + S390X_OFF_H(len) + off, dgst, len - off); 266 267 if (group->meth->point_get_affine_coordinates(group, pubkey, 268 x, y, ctx) != 1 269 || BN_bn2binpad(sig->r, param + S390X_OFF_R(len), len) == -1 270 || BN_bn2binpad(sig->s, param + S390X_OFF_S(len), len) == -1 271 || BN_bn2binpad(x, param + S390X_OFF_X(len), len) == -1 272 || BN_bn2binpad(y, param + S390X_OFF_Y(len), len) == -1) { 273 ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB); 274 goto ret; 275 } 276 277 rc = s390x_kdsa(fc, param, NULL, 0) == 0 ? 1 : 0; 278ret: 279 BN_CTX_end(ctx); 280 BN_CTX_free(ctx); 281 return rc; 282} 283 284#define EC_GFP_S390X_NISTP_METHOD(bits) \ 285 \ 286static int ec_GFp_s390x_nistp##bits##_mul(const EC_GROUP *group, \ 287 EC_POINT *r, \ 288 const BIGNUM *scalar, \ 289 size_t num, \ 290 const EC_POINT *points[], \ 291 const BIGNUM *scalars[], \ 292 BN_CTX *ctx) \ 293{ \ 294 return ec_GFp_s390x_nistp_mul(group, r, scalar, num, points, \ 295 scalars, ctx, \ 296 S390X_SCALAR_MULTIPLY_P##bits, \ 297 S390X_SIZE_P##bits); \ 298} \ 299 \ 300static ECDSA_SIG *ecdsa_s390x_nistp##bits##_sign_sig(const unsigned \ 301 char *dgst, \ 302 int dgstlen, \ 303 const BIGNUM *kinv,\ 304 const BIGNUM *r, \ 305 EC_KEY *eckey) \ 306{ \ 307 return ecdsa_s390x_nistp_sign_sig(dgst, dgstlen, kinv, r, eckey, \ 308 S390X_ECDSA_SIGN_P##bits, \ 309 S390X_SIZE_P##bits); \ 310} \ 311 \ 312static int ecdsa_s390x_nistp##bits##_verify_sig(const \ 313 unsigned char *dgst, \ 314 int dgstlen, \ 315 const ECDSA_SIG *sig, \ 316 EC_KEY *eckey) \ 317{ \ 318 return ecdsa_s390x_nistp_verify_sig(dgst, dgstlen, sig, eckey, \ 319 S390X_ECDSA_VERIFY_P##bits, \ 320 S390X_SIZE_P##bits); \ 321} \ 322 \ 323const EC_METHOD *EC_GFp_s390x_nistp##bits##_method(void) \ 324{ \ 325 static const EC_METHOD EC_GFp_s390x_nistp##bits##_meth = { \ 326 EC_FLAGS_DEFAULT_OCT, \ 327 NID_X9_62_prime_field, \ 328 ossl_ec_GFp_simple_group_init, \ 329 ossl_ec_GFp_simple_group_finish, \ 330 ossl_ec_GFp_simple_group_clear_finish, \ 331 ossl_ec_GFp_simple_group_copy, \ 332 ossl_ec_GFp_simple_group_set_curve, \ 333 ossl_ec_GFp_simple_group_get_curve, \ 334 ossl_ec_GFp_simple_group_get_degree, \ 335 ossl_ec_group_simple_order_bits, \ 336 ossl_ec_GFp_simple_group_check_discriminant, \ 337 ossl_ec_GFp_simple_point_init, \ 338 ossl_ec_GFp_simple_point_finish, \ 339 ossl_ec_GFp_simple_point_clear_finish, \ 340 ossl_ec_GFp_simple_point_copy, \ 341 ossl_ec_GFp_simple_point_set_to_infinity, \ 342 ossl_ec_GFp_simple_point_set_affine_coordinates, \ 343 ossl_ec_GFp_simple_point_get_affine_coordinates, \ 344 NULL, /* point_set_compressed_coordinates */ \ 345 NULL, /* point2oct */ \ 346 NULL, /* oct2point */ \ 347 ossl_ec_GFp_simple_add, \ 348 ossl_ec_GFp_simple_dbl, \ 349 ossl_ec_GFp_simple_invert, \ 350 ossl_ec_GFp_simple_is_at_infinity, \ 351 ossl_ec_GFp_simple_is_on_curve, \ 352 ossl_ec_GFp_simple_cmp, \ 353 ossl_ec_GFp_simple_make_affine, \ 354 ossl_ec_GFp_simple_points_make_affine, \ 355 ec_GFp_s390x_nistp##bits##_mul, \ 356 NULL, /* precompute_mult */ \ 357 NULL, /* have_precompute_mult */ \ 358 ossl_ec_GFp_simple_field_mul, \ 359 ossl_ec_GFp_simple_field_sqr, \ 360 NULL, /* field_div */ \ 361 ossl_ec_GFp_simple_field_inv, \ 362 NULL, /* field_encode */ \ 363 NULL, /* field_decode */ \ 364 NULL, /* field_set_to_one */ \ 365 ossl_ec_key_simple_priv2oct, \ 366 ossl_ec_key_simple_oct2priv, \ 367 NULL, /* set_private */ \ 368 ossl_ec_key_simple_generate_key, \ 369 ossl_ec_key_simple_check_key, \ 370 ossl_ec_key_simple_generate_public_key, \ 371 NULL, /* keycopy */ \ 372 NULL, /* keyfinish */ \ 373 ossl_ecdh_simple_compute_key, \ 374 ossl_ecdsa_simple_sign_setup, \ 375 ecdsa_s390x_nistp##bits##_sign_sig, \ 376 ecdsa_s390x_nistp##bits##_verify_sig, \ 377 NULL, /* field_inverse_mod_ord */ \ 378 ossl_ec_GFp_simple_blind_coordinates, \ 379 ossl_ec_GFp_simple_ladder_pre, \ 380 ossl_ec_GFp_simple_ladder_step, \ 381 ossl_ec_GFp_simple_ladder_post \ 382 }; \ 383 static const EC_METHOD *ret; \ 384 \ 385 if ((OPENSSL_s390xcap_P.pcc[1] \ 386 & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P##bits)) \ 387 && (OPENSSL_s390xcap_P.kdsa[0] \ 388 & S390X_CAPBIT(S390X_ECDSA_VERIFY_P##bits)) \ 389 && (OPENSSL_s390xcap_P.kdsa[0] \ 390 & S390X_CAPBIT(S390X_ECDSA_SIGN_P##bits))) \ 391 ret = &EC_GFp_s390x_nistp##bits##_meth; \ 392 else \ 393 ret = EC_GFp_mont_method(); \ 394 \ 395 return ret; \ 396} 397 398EC_GFP_S390X_NISTP_METHOD(256) 399EC_GFP_S390X_NISTP_METHOD(384) 400EC_GFP_S390X_NISTP_METHOD(521) 401