projects/linux·blob master · refs

550 lines · 14.2 KiB

1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * Cryptographic API.
4 *
5 * HMAC: Keyed-Hashing for Message Authentication (RFC2104).
6 *
7 * Copyright (c) 2002 James Morris <[email protected]>
8 * Copyright (c) 2006 Herbert Xu <[email protected]>
9 *
10 * The HMAC implementation is derived from USAGI.
11 * Copyright (c) 2002 Kazunori Miyazawa <[email protected]> / USAGI
12 */
13
14#include <crypto/hmac.h>
15#include <crypto/internal/hash.h>
16#include <linux/err.h>
17#include <linux/fips.h>
18#include <linux/kernel.h>
19#include <linux/module.h>
20#include <linux/slab.h>
21#include <linux/string.h>
22
23struct hmac_ctx {
24 struct crypto_shash *hash;
25 /* Contains 'u8 ipad[statesize];', then 'u8 opad[statesize];' */
26 u8 pads[];
27};
28
29struct ahash_hmac_ctx {
30 struct crypto_ahash *hash;
31 /* Contains 'u8 ipad[statesize];', then 'u8 opad[statesize];' */
32 u8 pads[];
33};
34
35static int hmac_setkey(struct crypto_shash *parent,
36 const u8 *inkey, unsigned int keylen)
37{
38 int bs = crypto_shash_blocksize(parent);
39 int ds = crypto_shash_digestsize(parent);
40 int ss = crypto_shash_statesize(parent);
41 struct hmac_ctx *tctx = crypto_shash_ctx(parent);
42 struct crypto_shash *hash = tctx->hash;
43 u8 *ipad = &tctx->pads[0];
44 u8 *opad = &tctx->pads[ss];
45 SHASH_DESC_ON_STACK(shash, hash);
46 int err, i;
47
48 if (fips_enabled && (keylen < 112 / 8))
49 return -EINVAL;
50
51 shash->tfm = hash;
52
53 if (keylen > bs) {
54 int err;
55
56 err = crypto_shash_digest(shash, inkey, keylen, ipad);
57 if (err)
58 return err;
59
60 keylen = ds;
61 } else
62 memcpy(ipad, inkey, keylen);
63
64 memset(ipad + keylen, 0, bs - keylen);
65 memcpy(opad, ipad, bs);
66
67 for (i = 0; i < bs; i++) {
68 ipad[i] ^= HMAC_IPAD_VALUE;
69 opad[i] ^= HMAC_OPAD_VALUE;
70 }
71
72 err = crypto_shash_init(shash) ?:
73 crypto_shash_update(shash, ipad, bs) ?:
74 crypto_shash_export(shash, ipad) ?:
75 crypto_shash_init(shash) ?:
76 crypto_shash_update(shash, opad, bs) ?:
77 crypto_shash_export(shash, opad);
78 shash_desc_zero(shash);
79 return err;
80}
81
82static int hmac_export(struct shash_desc *pdesc, void *out)
83{
84 struct shash_desc *desc = shash_desc_ctx(pdesc);
85
86 return crypto_shash_export(desc, out);
87}
88
89static int hmac_import(struct shash_desc *pdesc, const void *in)
90{
91 struct shash_desc *desc = shash_desc_ctx(pdesc);
92 const struct hmac_ctx *tctx = crypto_shash_ctx(pdesc->tfm);
93
94 desc->tfm = tctx->hash;
95
96 return crypto_shash_import(desc, in);
97}
98
99static int hmac_export_core(struct shash_desc *pdesc, void *out)
100{
101 struct shash_desc *desc = shash_desc_ctx(pdesc);
102
103 return crypto_shash_export_core(desc, out);
104}
105
106static int hmac_import_core(struct shash_desc *pdesc, const void *in)
107{
108 const struct hmac_ctx *tctx = crypto_shash_ctx(pdesc->tfm);
109 struct shash_desc *desc = shash_desc_ctx(pdesc);
110
111 desc->tfm = tctx->hash;
112 return crypto_shash_import_core(desc, in);
113}
114
115static int hmac_init(struct shash_desc *pdesc)
116{
117 const struct hmac_ctx *tctx = crypto_shash_ctx(pdesc->tfm);
118
119 return hmac_import(pdesc, &tctx->pads[0]);
120}
121
122static int hmac_update(struct shash_desc *pdesc,
123 const u8 *data, unsigned int nbytes)
124{
125 struct shash_desc *desc = shash_desc_ctx(pdesc);
126
127 return crypto_shash_update(desc, data, nbytes);
128}
129
130static int hmac_finup(struct shash_desc *pdesc, const u8 *data,
131 unsigned int nbytes, u8 *out)
132{
133
134 struct crypto_shash *parent = pdesc->tfm;
135 int ds = crypto_shash_digestsize(parent);
136 int ss = crypto_shash_statesize(parent);
137 const struct hmac_ctx *tctx = crypto_shash_ctx(parent);
138 const u8 *opad = &tctx->pads[ss];
139 struct shash_desc *desc = shash_desc_ctx(pdesc);
140
141 return crypto_shash_finup(desc, data, nbytes, out) ?:
142 crypto_shash_import(desc, opad) ?:
143 crypto_shash_finup(desc, out, ds, out);
144}
145
146static int hmac_init_tfm(struct crypto_shash *parent)
147{
148 struct crypto_shash *hash;
149 struct shash_instance *inst = shash_alg_instance(parent);
150 struct crypto_shash_spawn *spawn = shash_instance_ctx(inst);
151 struct hmac_ctx *tctx = crypto_shash_ctx(parent);
152
153 hash = crypto_spawn_shash(spawn);
154 if (IS_ERR(hash))
155 return PTR_ERR(hash);
156
157 tctx->hash = hash;
158 return 0;
159}
160
161static void hmac_exit_tfm(struct crypto_shash *parent)
162{
163 struct hmac_ctx *tctx = crypto_shash_ctx(parent);
164
165 crypto_free_shash(tctx->hash);
166}
167
168static int __hmac_create_shash(struct crypto_template *tmpl,
169 struct rtattr **tb, u32 mask)
170{
171 struct shash_instance *inst;
172 struct crypto_shash_spawn *spawn;
173 struct crypto_alg *alg;
174 struct shash_alg *salg;
175 int err;
176 int ds;
177 int ss;
178
179 inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL);
180 if (!inst)
181 return -ENOMEM;
182 spawn = shash_instance_ctx(inst);
183
184 mask |= CRYPTO_AHASH_ALG_NO_EXPORT_CORE;
185 err = crypto_grab_shash(spawn, shash_crypto_instance(inst),
186 crypto_attr_alg_name(tb[1]), 0, mask);
187 if (err)
188 goto err_free_inst;
189 salg = crypto_spawn_shash_alg(spawn);
190 alg = &salg->base;
191
192 /* The underlying hash algorithm must not require a key */
193 err = -EINVAL;
194 if (crypto_shash_alg_needs_key(salg))
195 goto err_free_inst;
196
197 ds = salg->digestsize;
198 ss = salg->statesize;
199 if (ds > alg->cra_blocksize ||
200 ss < alg->cra_blocksize)
201 goto err_free_inst;
202
203 err = crypto_inst_setname(shash_crypto_instance(inst), "hmac",
204 "hmac-shash", alg);
205 if (err)
206 goto err_free_inst;
207
208 inst->alg.base.cra_priority = alg->cra_priority;
209 inst->alg.base.cra_blocksize = alg->cra_blocksize;
210 inst->alg.base.cra_ctxsize = sizeof(struct hmac_ctx) + (ss * 2);
211
212 inst->alg.digestsize = ds;
213 inst->alg.statesize = ss;
214 inst->alg.descsize = sizeof(struct shash_desc) + salg->descsize;
215 inst->alg.init = hmac_init;
216 inst->alg.update = hmac_update;
217 inst->alg.finup = hmac_finup;
218 inst->alg.export = hmac_export;
219 inst->alg.import = hmac_import;
220 inst->alg.export_core = hmac_export_core;
221 inst->alg.import_core = hmac_import_core;
222 inst->alg.setkey = hmac_setkey;
223 inst->alg.init_tfm = hmac_init_tfm;
224 inst->alg.exit_tfm = hmac_exit_tfm;
225
226 inst->free = shash_free_singlespawn_instance;
227
228 err = shash_register_instance(tmpl, inst);
229 if (err) {
230err_free_inst:
231 shash_free_singlespawn_instance(inst);
232 }
233 return err;
234}
235
236static int hmac_setkey_ahash(struct crypto_ahash *parent,
237 const u8 *inkey, unsigned int keylen)
238{
239 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(parent);
240 struct crypto_ahash *fb = crypto_ahash_fb(tctx->hash);
241 int ds = crypto_ahash_digestsize(parent);
242 int bs = crypto_ahash_blocksize(parent);
243 int ss = crypto_ahash_statesize(parent);
244 HASH_REQUEST_ON_STACK(req, fb);
245 u8 *opad = &tctx->pads[ss];
246 u8 *ipad = &tctx->pads[0];
247 int err, i;
248
249 if (fips_enabled && (keylen < 112 / 8))
250 return -EINVAL;
251
252 ahash_request_set_callback(req, 0, NULL, NULL);
253
254 if (keylen > bs) {
255 ahash_request_set_virt(req, inkey, ipad, keylen);
256 err = crypto_ahash_digest(req);
257 if (err)
258 goto out_zero_req;
259
260 keylen = ds;
261 } else
262 memcpy(ipad, inkey, keylen);
263
264 memset(ipad + keylen, 0, bs - keylen);
265 memcpy(opad, ipad, bs);
266
267 for (i = 0; i < bs; i++) {
268 ipad[i] ^= HMAC_IPAD_VALUE;
269 opad[i] ^= HMAC_OPAD_VALUE;
270 }
271
272 ahash_request_set_virt(req, ipad, NULL, bs);
273 err = crypto_ahash_init(req) ?:
274 crypto_ahash_update(req) ?:
275 crypto_ahash_export(req, ipad);
276
277 ahash_request_set_virt(req, opad, NULL, bs);
278 err = err ?:
279 crypto_ahash_init(req) ?:
280 crypto_ahash_update(req) ?:
281 crypto_ahash_export(req, opad);
282
283out_zero_req:
284 HASH_REQUEST_ZERO(req);
285 return err;
286}
287
288static int hmac_export_ahash(struct ahash_request *preq, void *out)
289{
290 return crypto_ahash_export(ahash_request_ctx(preq), out);
291}
292
293static int hmac_import_ahash(struct ahash_request *preq, const void *in)
294{
295 struct crypto_ahash *tfm = crypto_ahash_reqtfm(preq);
296 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(tfm);
297 struct ahash_request *req = ahash_request_ctx(preq);
298
299 ahash_request_set_tfm(req, tctx->hash);
300 return crypto_ahash_import(req, in);
301}
302
303static int hmac_export_core_ahash(struct ahash_request *preq, void *out)
304{
305 return crypto_ahash_export_core(ahash_request_ctx(preq), out);
306}
307
308static int hmac_import_core_ahash(struct ahash_request *preq, const void *in)
309{
310 struct crypto_ahash *tfm = crypto_ahash_reqtfm(preq);
311 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(tfm);
312 struct ahash_request *req = ahash_request_ctx(preq);
313
314 ahash_request_set_tfm(req, tctx->hash);
315 return crypto_ahash_import_core(req, in);
316}
317
318static int hmac_init_ahash(struct ahash_request *preq)
319{
320 struct crypto_ahash *tfm = crypto_ahash_reqtfm(preq);
321 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(tfm);
322
323 return hmac_import_ahash(preq, &tctx->pads[0]);
324}
325
326static int hmac_update_ahash(struct ahash_request *preq)
327{
328 struct ahash_request *req = ahash_request_ctx(preq);
329
330 ahash_request_set_callback(req, ahash_request_flags(preq),
331 preq->base.complete, preq->base.data);
332 if (ahash_request_isvirt(preq))
333 ahash_request_set_virt(req, preq->svirt, NULL, preq->nbytes);
334 else
335 ahash_request_set_crypt(req, preq->src, NULL, preq->nbytes);
336 return crypto_ahash_update(req);
337}
338
339static int hmac_finup_finish(struct ahash_request *preq, unsigned int mask)
340{
341 struct crypto_ahash *tfm = crypto_ahash_reqtfm(preq);
342 struct ahash_request *req = ahash_request_ctx(preq);
343 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(tfm);
344 int ds = crypto_ahash_digestsize(tfm);
345 int ss = crypto_ahash_statesize(tfm);
346 const u8 *opad = &tctx->pads[ss];
347
348 ahash_request_set_callback(req, ahash_request_flags(preq) & ~mask,
349 preq->base.complete, preq->base.data);
350 ahash_request_set_virt(req, preq->result, preq->result, ds);
351 return crypto_ahash_import(req, opad) ?:
352 crypto_ahash_finup(req);
353
354}
355
356static void hmac_finup_done(void *data, int err)
357{
358 struct ahash_request *preq = data;
359
360 if (err)
361 goto out;
362
363 err = hmac_finup_finish(preq, CRYPTO_TFM_REQ_MAY_SLEEP);
364 if (err == -EINPROGRESS || err == -EBUSY)
365 return;
366
367out:
368 ahash_request_complete(preq, err);
369}
370
371static int hmac_finup_ahash(struct ahash_request *preq)
372{
373 struct ahash_request *req = ahash_request_ctx(preq);
374
375 ahash_request_set_callback(req, ahash_request_flags(preq),
376 hmac_finup_done, preq);
377 if (ahash_request_isvirt(preq))
378 ahash_request_set_virt(req, preq->svirt, preq->result,
379 preq->nbytes);
380 else
381 ahash_request_set_crypt(req, preq->src, preq->result,
382 preq->nbytes);
383 return crypto_ahash_finup(req) ?:
384 hmac_finup_finish(preq, 0);
385}
386
387static int hmac_digest_ahash(struct ahash_request *preq)
388{
389 return hmac_init_ahash(preq) ?:
390 hmac_finup_ahash(preq);
391}
392
393static int hmac_init_ahash_tfm(struct crypto_ahash *parent)
394{
395 struct ahash_instance *inst = ahash_alg_instance(parent);
396 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(parent);
397 struct crypto_ahash *hash;
398
399 hash = crypto_spawn_ahash(ahash_instance_ctx(inst));
400 if (IS_ERR(hash))
401 return PTR_ERR(hash);
402
403 if (crypto_ahash_reqsize(parent) < sizeof(struct ahash_request) +
404 crypto_ahash_reqsize(hash))
405 return -EINVAL;
406
407 tctx->hash = hash;
408 return 0;
409}
410
411static void hmac_exit_ahash_tfm(struct crypto_ahash *parent)
412{
413 struct ahash_hmac_ctx *tctx = crypto_ahash_ctx(parent);
414
415 crypto_free_ahash(tctx->hash);
416}
417
418static int hmac_create_ahash(struct crypto_template *tmpl, struct rtattr **tb,
419 u32 mask)
420{
421 struct crypto_ahash_spawn *spawn;
422 struct ahash_instance *inst;
423 struct crypto_alg *alg;
424 struct hash_alg_common *halg;
425 int ds, ss, err;
426
427 inst = kzalloc(sizeof(*inst) + sizeof(*spawn), GFP_KERNEL);
428 if (!inst)
429 return -ENOMEM;
430 spawn = ahash_instance_ctx(inst);
431
432 mask |= CRYPTO_AHASH_ALG_NO_EXPORT_CORE;
433 err = crypto_grab_ahash(spawn, ahash_crypto_instance(inst),
434 crypto_attr_alg_name(tb[1]), 0, mask);
435 if (err)
436 goto err_free_inst;
437 halg = crypto_spawn_ahash_alg(spawn);
438 alg = &halg->base;
439
440 /* The underlying hash algorithm must not require a key */
441 err = -EINVAL;
442 if (crypto_hash_alg_needs_key(halg))
443 goto err_free_inst;
444
445 ds = halg->digestsize;
446 ss = halg->statesize;
447 if (ds > alg->cra_blocksize || ss < alg->cra_blocksize)
448 goto err_free_inst;
449
450 err = crypto_inst_setname(ahash_crypto_instance(inst), tmpl->name, alg);
451 if (err)
452 goto err_free_inst;
453
454 inst->alg.halg.base.cra_flags = alg->cra_flags &
455 CRYPTO_ALG_INHERITED_FLAGS;
456 inst->alg.halg.base.cra_flags |= CRYPTO_ALG_REQ_VIRT;
457 inst->alg.halg.base.cra_priority = alg->cra_priority + 100;
458 inst->alg.halg.base.cra_blocksize = alg->cra_blocksize;
459 inst->alg.halg.base.cra_ctxsize = sizeof(struct ahash_hmac_ctx) +
460 (ss * 2);
461 inst->alg.halg.base.cra_reqsize = sizeof(struct ahash_request) +
462 alg->cra_reqsize;
463
464 inst->alg.halg.digestsize = ds;
465 inst->alg.halg.statesize = ss;
466 inst->alg.init = hmac_init_ahash;
467 inst->alg.update = hmac_update_ahash;
468 inst->alg.finup = hmac_finup_ahash;
469 inst->alg.digest = hmac_digest_ahash;
470 inst->alg.export = hmac_export_ahash;
471 inst->alg.import = hmac_import_ahash;
472 inst->alg.export_core = hmac_export_core_ahash;
473 inst->alg.import_core = hmac_import_core_ahash;
474 inst->alg.setkey = hmac_setkey_ahash;
475 inst->alg.init_tfm = hmac_init_ahash_tfm;
476 inst->alg.exit_tfm = hmac_exit_ahash_tfm;
477
478 inst->free = ahash_free_singlespawn_instance;
479
480 err = ahash_register_instance(tmpl, inst);
481 if (err) {
482err_free_inst:
483 ahash_free_singlespawn_instance(inst);
484 }
485 return err;
486}
487
488static int hmac_create(struct crypto_template *tmpl, struct rtattr **tb)
489{
490 struct crypto_attr_type *algt;
491 u32 mask;
492
493 algt = crypto_get_attr_type(tb);
494 if (IS_ERR(algt))
495 return PTR_ERR(algt);
496
497 mask = crypto_algt_inherited_mask(algt);
498
499 if (!((algt->type ^ CRYPTO_ALG_TYPE_AHASH) &
500 algt->mask & CRYPTO_ALG_TYPE_MASK))
501 return hmac_create_ahash(tmpl, tb, mask);
502
503 if ((algt->type ^ CRYPTO_ALG_TYPE_SHASH) &
504 algt->mask & CRYPTO_ALG_TYPE_MASK)
505 return -EINVAL;
506
507 return __hmac_create_shash(tmpl, tb, mask);
508}
509
510static int hmac_create_shash(struct crypto_template *tmpl, struct rtattr **tb)
511{
512 u32 mask;
513 int err;
514
515 err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_SHASH, &mask);
516 if (err)
517 return err == -EINVAL ? -ENOENT : err;
518
519 return __hmac_create_shash(tmpl, tb, mask);
520}
521
522static struct crypto_template hmac_tmpls[] = {
523 {
524 .name = "hmac",
525 .create = hmac_create,
526 .module = THIS_MODULE,
527 },
528 {
529 .name = "hmac-shash",
530 .create = hmac_create_shash,
531 .module = THIS_MODULE,
532 },
533};
534
535static int __init hmac_module_init(void)
536{
537 return crypto_register_templates(hmac_tmpls, ARRAY_SIZE(hmac_tmpls));
538}
539
540static void __exit hmac_module_exit(void)
541{
542 crypto_unregister_templates(hmac_tmpls, ARRAY_SIZE(hmac_tmpls));
543}
544
545module_init(hmac_module_init);
546module_exit(hmac_module_exit);
547
548MODULE_LICENSE("GPL");
549MODULE_DESCRIPTION("HMAC hash algorithm");
550MODULE_ALIAS_CRYPTO("hmac");