xref: /openssl/crypto/ec/ecp_s390x_nistp.c (revision 556009c5)
1 /*
2  * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 /*
11  * EC_METHOD low level APIs are deprecated for public use, but still ok for
12  * internal use.
13  */
14 #include "internal/deprecated.h"
15 
16 #include <stdlib.h>
17 #include <string.h>
18 #include <openssl/err.h>
19 #include <openssl/rand.h>
20 #include "ec_local.h"
21 #include "s390x_arch.h"
22 
23 /* Size of parameter blocks */
24 #define S390X_SIZE_PARAM                4096
25 
26 /* Size of fields in parameter blocks */
27 #define S390X_SIZE_P256                 32
28 #define S390X_SIZE_P384                 48
29 #define S390X_SIZE_P521                 80
30 
31 /* Offsets of fields in PCC parameter blocks */
32 #define S390X_OFF_RES_X(n)              (0 * n)
33 #define S390X_OFF_RES_Y(n)              (1 * n)
34 #define S390X_OFF_SRC_X(n)              (2 * n)
35 #define S390X_OFF_SRC_Y(n)              (3 * n)
36 #define S390X_OFF_SCALAR(n)             (4 * n)
37 
38 /* Offsets of fields in KDSA parameter blocks */
39 #define S390X_OFF_R(n)                  (0 * n)
40 #define S390X_OFF_S(n)                  (1 * n)
41 #define S390X_OFF_H(n)                  (2 * n)
42 #define S390X_OFF_K(n)                  (3 * n)
43 #define S390X_OFF_X(n)                  (3 * n)
44 #define S390X_OFF_RN(n)                 (4 * n)
45 #define S390X_OFF_Y(n)                  (4 * n)
46 
ec_GFp_s390x_nistp_mul(const EC_GROUP * group,EC_POINT * r,const BIGNUM * scalar,size_t num,const EC_POINT * points[],const BIGNUM * scalars[],BN_CTX * ctx,unsigned int fc,int len)47 static int ec_GFp_s390x_nistp_mul(const EC_GROUP *group, EC_POINT *r,
48                                   const BIGNUM *scalar,
49                                   size_t num, const EC_POINT *points[],
50                                   const BIGNUM *scalars[],
51                                   BN_CTX *ctx, unsigned int fc, int len)
52 {
53     unsigned char param[S390X_SIZE_PARAM];
54     BIGNUM *x, *y;
55     const EC_POINT *point_ptr = NULL;
56     const BIGNUM *scalar_ptr = NULL;
57     BN_CTX *new_ctx = NULL;
58     int rc = -1;
59 
60     if (ctx == NULL) {
61         ctx = new_ctx = BN_CTX_new_ex(group->libctx);
62         if (ctx == NULL)
63             return 0;
64     }
65 
66     BN_CTX_start(ctx);
67 
68     x = BN_CTX_get(ctx);
69     y = BN_CTX_get(ctx);
70     if (x == NULL || y == NULL) {
71         rc = 0;
72         goto ret;
73     }
74 
75     /*
76      * Use PCC for EC keygen and ECDH key derivation:
77      * scalar * generator and scalar * peer public key,
78      * scalar in [0,order).
79      */
80     if ((scalar != NULL && num == 0 && BN_is_negative(scalar) == 0)
81         || (scalar == NULL && num == 1 && BN_is_negative(scalars[0]) == 0)) {
82 
83         if (num == 0) {
84             point_ptr = EC_GROUP_get0_generator(group);
85             scalar_ptr = scalar;
86         } else {
87             point_ptr = points[0];
88             scalar_ptr = scalars[0];
89         }
90 
91         if (EC_POINT_is_at_infinity(group, point_ptr) == 1
92             || BN_is_zero(scalar_ptr)) {
93             rc = EC_POINT_set_to_infinity(group, r);
94             goto ret;
95         }
96 
97         memset(&param, 0, sizeof(param));
98 
99         if (group->meth->point_get_affine_coordinates(group, point_ptr,
100                                                       x, y, ctx) != 1
101             || BN_bn2binpad(x, param + S390X_OFF_SRC_X(len), len) == -1
102             || BN_bn2binpad(y, param + S390X_OFF_SRC_Y(len), len) == -1
103             || BN_bn2binpad(scalar_ptr,
104                             param + S390X_OFF_SCALAR(len), len) == -1
105             || s390x_pcc(fc, param) != 0
106             || BN_bin2bn(param + S390X_OFF_RES_X(len), len, x) == NULL
107             || BN_bin2bn(param + S390X_OFF_RES_Y(len), len, y) == NULL
108             || group->meth->point_set_affine_coordinates(group, r,
109                                                          x, y, ctx) != 1)
110             goto ret;
111 
112         rc = 1;
113     }
114 
115 ret:
116     /* Otherwise use default. */
117     if (rc == -1)
118         rc = ossl_ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
119     OPENSSL_cleanse(param, sizeof(param));
120     BN_CTX_end(ctx);
121     BN_CTX_free(new_ctx);
122     return rc;
123 }
124 
ecdsa_s390x_nistp_sign_sig(const unsigned char * dgst,int dgstlen,const BIGNUM * kinv,const BIGNUM * r,EC_KEY * eckey,unsigned int fc,int len)125 static ECDSA_SIG *ecdsa_s390x_nistp_sign_sig(const unsigned char *dgst,
126                                              int dgstlen,
127                                              const BIGNUM *kinv,
128                                              const BIGNUM *r,
129                                              EC_KEY *eckey,
130                                              unsigned int fc, int len)
131 {
132     unsigned char param[S390X_SIZE_PARAM];
133     int ok = 0;
134     BIGNUM *k;
135     ECDSA_SIG *sig;
136     const EC_GROUP *group;
137     const BIGNUM *privkey;
138     int off;
139 
140     group = EC_KEY_get0_group(eckey);
141     privkey = EC_KEY_get0_private_key(eckey);
142     if (group == NULL || privkey == NULL) {
143         ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS);
144         return NULL;
145     }
146 
147     if (!EC_KEY_can_sign(eckey)) {
148         ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
149         return NULL;
150     }
151 
152     k = BN_secure_new();
153     sig = ECDSA_SIG_new();
154     if (k == NULL || sig == NULL) {
155         ERR_raise(ERR_LIB_EC, ERR_R_ECDSA_LIB);
156         goto ret;
157     }
158 
159     sig->r = BN_new();
160     sig->s = BN_new();
161     if (sig->r == NULL || sig->s == NULL) {
162         ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
163         goto ret;
164     }
165 
166     memset(param, 0, sizeof(param));
167     off = len - (dgstlen > len ? len : dgstlen);
168     memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
169 
170     if (BN_bn2binpad(privkey, param + S390X_OFF_K(len), len) == -1) {
171         ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
172         goto ret;
173     }
174 
175     if (r == NULL || kinv == NULL) {
176         if (len < 0) {
177             ERR_raise(ERR_LIB_EC, EC_R_INVALID_LENGTH);
178             goto ret;
179         }
180         /*
181          * Generate random k and copy to param block. RAND_priv_bytes_ex
182          * is used instead of BN_priv_rand_range or BN_generate_dsa_nonce
183          * because kdsa instruction constructs an in-range, invertible nonce
184          * internally implementing counter-measures for RNG weakness.
185          */
186          if (RAND_priv_bytes_ex(eckey->libctx, param + S390X_OFF_RN(len),
187                                 (size_t)len, 0) != 1) {
188              ERR_raise(ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED);
189              goto ret;
190          }
191     } else {
192         /* Reconstruct k = (k^-1)^-1. */
193         if (ossl_ec_group_do_inverse_ord(group, k, kinv, NULL) == 0
194             || BN_bn2binpad(k, param + S390X_OFF_RN(len), len) == -1) {
195             ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
196             goto ret;
197         }
198         /* Turns KDSA internal nonce-generation off. */
199         fc |= S390X_KDSA_D;
200     }
201 
202     if (s390x_kdsa(fc, param, NULL, 0) != 0) {
203         ERR_raise(ERR_LIB_EC, ERR_R_ECDSA_LIB);
204         goto ret;
205     }
206 
207     if (BN_bin2bn(param + S390X_OFF_R(len), len, sig->r) == NULL
208         || BN_bin2bn(param + S390X_OFF_S(len), len, sig->s) == NULL) {
209         ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
210         goto ret;
211     }
212 
213     ok = 1;
214 ret:
215     OPENSSL_cleanse(param, sizeof(param));
216     if (ok != 1) {
217         ECDSA_SIG_free(sig);
218         sig = NULL;
219     }
220     BN_clear_free(k);
221     return sig;
222 }
223 
ecdsa_s390x_nistp_verify_sig(const unsigned char * dgst,int dgstlen,const ECDSA_SIG * sig,EC_KEY * eckey,unsigned int fc,int len)224 static int ecdsa_s390x_nistp_verify_sig(const unsigned char *dgst, int dgstlen,
225                                         const ECDSA_SIG *sig, EC_KEY *eckey,
226                                         unsigned int fc, int len)
227 {
228     unsigned char param[S390X_SIZE_PARAM];
229     int rc = -1;
230     BN_CTX *ctx;
231     BIGNUM *x, *y;
232     const EC_GROUP *group;
233     const EC_POINT *pubkey;
234     int off;
235 
236     group = EC_KEY_get0_group(eckey);
237     pubkey = EC_KEY_get0_public_key(eckey);
238     if (eckey == NULL || group == NULL || pubkey == NULL || sig == NULL) {
239         ERR_raise(ERR_LIB_EC, EC_R_MISSING_PARAMETERS);
240         return -1;
241     }
242 
243     if (!EC_KEY_can_sign(eckey)) {
244         ERR_raise(ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
245         return -1;
246     }
247 
248     ctx = BN_CTX_new_ex(group->libctx);
249     if (ctx == NULL) {
250         ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
251         return -1;
252     }
253 
254     BN_CTX_start(ctx);
255 
256     x = BN_CTX_get(ctx);
257     y = BN_CTX_get(ctx);
258     if (x == NULL || y == NULL) {
259         ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
260         goto ret;
261     }
262 
263     memset(param, 0, sizeof(param));
264     off = len - (dgstlen > len ? len : dgstlen);
265     memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
266 
267     if (group->meth->point_get_affine_coordinates(group, pubkey,
268                                                   x, y, ctx) != 1
269         || BN_bn2binpad(sig->r, param + S390X_OFF_R(len), len) == -1
270         || BN_bn2binpad(sig->s, param + S390X_OFF_S(len), len) == -1
271         || BN_bn2binpad(x, param + S390X_OFF_X(len), len) == -1
272         || BN_bn2binpad(y, param + S390X_OFF_Y(len), len) == -1) {
273         ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
274         goto ret;
275     }
276 
277     rc = s390x_kdsa(fc, param, NULL, 0) == 0 ? 1 : 0;
278 ret:
279     BN_CTX_end(ctx);
280     BN_CTX_free(ctx);
281     return rc;
282 }
283 
284 #define EC_GFP_S390X_NISTP_METHOD(bits)                                 \
285                                                                         \
286 static int ec_GFp_s390x_nistp##bits##_mul(const EC_GROUP *group,        \
287                                           EC_POINT *r,                  \
288                                           const BIGNUM *scalar,         \
289                                           size_t num,                   \
290                                           const EC_POINT *points[],     \
291                                           const BIGNUM *scalars[],      \
292                                           BN_CTX *ctx)                  \
293 {                                                                       \
294     return ec_GFp_s390x_nistp_mul(group, r, scalar, num, points,        \
295                                   scalars, ctx,                         \
296                                   S390X_SCALAR_MULTIPLY_P##bits,        \
297                                   S390X_SIZE_P##bits);                  \
298 }                                                                       \
299                                                                         \
300 static ECDSA_SIG *ecdsa_s390x_nistp##bits##_sign_sig(const unsigned     \
301                                                      char *dgst,        \
302                                                      int dgstlen,       \
303                                                      const BIGNUM *kinv,\
304                                                      const BIGNUM *r,   \
305                                                      EC_KEY *eckey)     \
306 {                                                                       \
307     return ecdsa_s390x_nistp_sign_sig(dgst, dgstlen, kinv, r, eckey,    \
308                                       S390X_ECDSA_SIGN_P##bits,         \
309                                       S390X_SIZE_P##bits);              \
310 }                                                                       \
311                                                                         \
312 static int ecdsa_s390x_nistp##bits##_verify_sig(const                   \
313                                                 unsigned char *dgst,    \
314                                                 int dgstlen,            \
315                                                 const ECDSA_SIG *sig,   \
316                                                 EC_KEY *eckey)          \
317 {                                                                       \
318     return ecdsa_s390x_nistp_verify_sig(dgst, dgstlen, sig, eckey,      \
319                                         S390X_ECDSA_VERIFY_P##bits,     \
320                                         S390X_SIZE_P##bits);            \
321 }                                                                       \
322                                                                         \
323 const EC_METHOD *EC_GFp_s390x_nistp##bits##_method(void)                \
324 {                                                                       \
325     static const EC_METHOD EC_GFp_s390x_nistp##bits##_meth = {          \
326         EC_FLAGS_DEFAULT_OCT,                                           \
327         NID_X9_62_prime_field,                                          \
328         ossl_ec_GFp_simple_group_init,                                  \
329         ossl_ec_GFp_simple_group_finish,                                \
330         ossl_ec_GFp_simple_group_clear_finish,                          \
331         ossl_ec_GFp_simple_group_copy,                                  \
332         ossl_ec_GFp_simple_group_set_curve,                             \
333         ossl_ec_GFp_simple_group_get_curve,                             \
334         ossl_ec_GFp_simple_group_get_degree,                            \
335         ossl_ec_group_simple_order_bits,                                \
336         ossl_ec_GFp_simple_group_check_discriminant,                    \
337         ossl_ec_GFp_simple_point_init,                                  \
338         ossl_ec_GFp_simple_point_finish,                                \
339         ossl_ec_GFp_simple_point_clear_finish,                          \
340         ossl_ec_GFp_simple_point_copy,                                  \
341         ossl_ec_GFp_simple_point_set_to_infinity,                       \
342         ossl_ec_GFp_simple_point_set_affine_coordinates,                \
343         ossl_ec_GFp_simple_point_get_affine_coordinates,                \
344         NULL, /* point_set_compressed_coordinates */                    \
345         NULL, /* point2oct */                                           \
346         NULL, /* oct2point */                                           \
347         ossl_ec_GFp_simple_add,                                         \
348         ossl_ec_GFp_simple_dbl,                                         \
349         ossl_ec_GFp_simple_invert,                                      \
350         ossl_ec_GFp_simple_is_at_infinity,                              \
351         ossl_ec_GFp_simple_is_on_curve,                                 \
352         ossl_ec_GFp_simple_cmp,                                         \
353         ossl_ec_GFp_simple_make_affine,                                 \
354         ossl_ec_GFp_simple_points_make_affine,                          \
355         ec_GFp_s390x_nistp##bits##_mul,                                 \
356         NULL, /* precompute_mult */                                     \
357         NULL, /* have_precompute_mult */                                \
358         ossl_ec_GFp_simple_field_mul,                                   \
359         ossl_ec_GFp_simple_field_sqr,                                   \
360         NULL, /* field_div */                                           \
361         ossl_ec_GFp_simple_field_inv,                                   \
362         NULL, /* field_encode */                                        \
363         NULL, /* field_decode */                                        \
364         NULL, /* field_set_to_one */                                    \
365         ossl_ec_key_simple_priv2oct,                                    \
366         ossl_ec_key_simple_oct2priv,                                    \
367         NULL, /* set_private */                                         \
368         ossl_ec_key_simple_generate_key,                                \
369         ossl_ec_key_simple_check_key,                                   \
370         ossl_ec_key_simple_generate_public_key,                         \
371         NULL, /* keycopy */                                             \
372         NULL, /* keyfinish */                                           \
373         ossl_ecdh_simple_compute_key,                                   \
374         ossl_ecdsa_simple_sign_setup,                                   \
375         ecdsa_s390x_nistp##bits##_sign_sig,                             \
376         ecdsa_s390x_nistp##bits##_verify_sig,                           \
377         NULL, /* field_inverse_mod_ord */                               \
378         ossl_ec_GFp_simple_blind_coordinates,                           \
379         ossl_ec_GFp_simple_ladder_pre,                                  \
380         ossl_ec_GFp_simple_ladder_step,                                 \
381         ossl_ec_GFp_simple_ladder_post                                  \
382     };                                                                  \
383     static const EC_METHOD *ret;                                        \
384                                                                         \
385     if ((OPENSSL_s390xcap_P.pcc[1]                                      \
386          & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P##bits))                 \
387         && (OPENSSL_s390xcap_P.kdsa[0]                                  \
388             & S390X_CAPBIT(S390X_ECDSA_VERIFY_P##bits))                 \
389         && (OPENSSL_s390xcap_P.kdsa[0]                                  \
390             & S390X_CAPBIT(S390X_ECDSA_SIGN_P##bits)))                  \
391         ret = &EC_GFp_s390x_nistp##bits##_meth;                         \
392     else                                                                \
393         ret = EC_GFp_mont_method();                                     \
394                                                                         \
395     return ret;                                                         \
396 }
397 
398 EC_GFP_S390X_NISTP_METHOD(256)
399 EC_GFP_S390X_NISTP_METHOD(384)
400 EC_GFP_S390X_NISTP_METHOD(521)
401