xref: /illumos-gate/usr/src/uts/common/crypto/io/ecc.c (revision 3ec36537)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /*
26  * Copyright 2010 Nexenta Systems, Inc.  All rights reserved.
27  */
28 
29 #include <sys/types.h>
30 #include <sys/systm.h>
31 #include <sys/param.h>
32 #include <sys/modctl.h>
33 #include <sys/ddi.h>
34 #include <sys/crypto/spi.h>
35 #include <sys/crypto/impl.h>
36 #include <sys/crypto/ioctladmin.h>
37 #include <sys/sysmacros.h>
38 #include <sys/strsun.h>
39 #include <sys/sha1.h>
40 #include <sys/random.h>
41 #include <sys/conf.h>
42 #include <sys/devops.h>
43 #include <sys/sunddi.h>
44 #include <sys/varargs.h>
45 #include <sys/kmem.h>
46 #include <sys/kstat.h>
47 
48 #include <des/des_impl.h>
49 #include <ecc/ecc_impl.h>
50 
51 #define	CKD_NULL		0x00000001
52 
53 extern struct mod_ops mod_cryptoops;
54 
55 /*
56  * Module linkage information for the kernel.
57  */
58 static struct modlcrypto modlcrypto = {
59 	&mod_cryptoops,
60 	"EC Kernel SW Provider"
61 };
62 
63 static struct modlinkage modlinkage = {
64 	MODREV_1,
65 	(void *)&modlcrypto,
66 	NULL
67 };
68 
69 /*
70  * CSPI information (entry points, provider info, etc.)
71  */
72 typedef enum ecc_mech_type {
73 	EC_KEY_PAIR_GEN_MECH_INFO_TYPE,	/* SUN_CKM_EC_KEY_PAIR_GEN */
74 	ECDSA_MECH_INFO_TYPE,		/* SUN_CKM_ECDSA */
75 	ECDSA_SHA1_MECH_INFO_TYPE,	/* SUN_CKM_ECDSA_SHA1 */
76 	ECDH1_DERIVE_MECH_INFO_TYPE	/* SUN_CKM_ECDH1_DERIVE */
77 } ecc_mech_type_t;
78 
79 /*
80  * Context for ECDSA mechanism.
81  */
82 typedef struct ecc_ctx {
83 	ecc_mech_type_t	mech_type;
84 	crypto_key_t *key;
85 	size_t keychunk_size;
86 	ECParams ecparams;
87 } ecc_ctx_t;
88 
89 /*
90  * Context for ECDSA_SHA1 mechanism.
91  */
92 typedef struct digest_ecc_ctx {
93 	ecc_mech_type_t	mech_type;
94 	crypto_key_t *key;
95 	size_t keychunk_size;
96 	ECParams ecparams;
97 	union {
98 		SHA1_CTX sha1ctx;
99 	} dctx_u;
100 } digest_ecc_ctx_t;
101 
102 #define	sha1_ctx	dctx_u.sha1ctx
103 
104 /*
105  * Mechanism info structure passed to KCF during registration.
106  */
107 static crypto_mech_info_t ecc_mech_info_tab[] = {
108 	/* EC_KEY_PAIR_GEN */
109 	{SUN_CKM_EC_KEY_PAIR_GEN, EC_KEY_PAIR_GEN_MECH_INFO_TYPE,
110 	    CRYPTO_FG_GENERATE_KEY_PAIR, EC_MIN_KEY_LEN, EC_MAX_KEY_LEN,
111 	    CRYPTO_KEYSIZE_UNIT_IN_BITS},
112 	/* ECDH */
113 	{SUN_CKM_ECDH1_DERIVE, ECDH1_DERIVE_MECH_INFO_TYPE, CRYPTO_FG_DERIVE,
114 	    EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CRYPTO_KEYSIZE_UNIT_IN_BITS},
115 	/* ECDSA */
116 	{SUN_CKM_ECDSA, ECDSA_MECH_INFO_TYPE,
117 	    CRYPTO_FG_SIGN | CRYPTO_FG_VERIFY |
118 	    CRYPTO_FG_SIGN_ATOMIC | CRYPTO_FG_VERIFY_ATOMIC,
119 	    EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CRYPTO_KEYSIZE_UNIT_IN_BITS},
120 	/* ECDSA_SHA1 */
121 	{SUN_CKM_ECDSA_SHA1, ECDSA_SHA1_MECH_INFO_TYPE,
122 	    CRYPTO_FG_SIGN | CRYPTO_FG_VERIFY |
123 	    CRYPTO_FG_SIGN_ATOMIC | CRYPTO_FG_VERIFY_ATOMIC,
124 	    EC_MIN_KEY_LEN, EC_MAX_KEY_LEN, CRYPTO_KEYSIZE_UNIT_IN_BITS}
125 };
126 
127 static void ecc_provider_status(crypto_provider_handle_t, uint_t *);
128 
129 static crypto_control_ops_t ecc_control_ops = {
130 	ecc_provider_status
131 };
132 
133 static int ecc_sign_init(crypto_ctx_t *, crypto_mechanism_t *,
134     crypto_key_t *, crypto_spi_ctx_template_t, crypto_req_handle_t);
135 static int ecc_sign(crypto_ctx_t *, crypto_data_t *, crypto_data_t *,
136     crypto_req_handle_t);
137 static int ecc_sign_update(crypto_ctx_t *, crypto_data_t *,
138     crypto_req_handle_t);
139 static int ecc_sign_final(crypto_ctx_t *, crypto_data_t *,
140     crypto_req_handle_t);
141 static int ecc_sign_atomic(crypto_provider_handle_t, crypto_session_id_t,
142     crypto_mechanism_t *, crypto_key_t *, crypto_data_t *, crypto_data_t *,
143     crypto_spi_ctx_template_t, crypto_req_handle_t);
144 
145 static crypto_sign_ops_t ecc_sign_ops = {
146 	ecc_sign_init,
147 	ecc_sign,
148 	ecc_sign_update,
149 	ecc_sign_final,
150 	ecc_sign_atomic,
151 	NULL,
152 	NULL,
153 	NULL
154 };
155 
156 static int ecc_verify_init(crypto_ctx_t *, crypto_mechanism_t *,
157     crypto_key_t *, crypto_spi_ctx_template_t, crypto_req_handle_t);
158 static int ecc_verify(crypto_ctx_t *, crypto_data_t *, crypto_data_t *,
159     crypto_req_handle_t);
160 static int ecc_verify_update(crypto_ctx_t *, crypto_data_t *,
161     crypto_req_handle_t);
162 static int ecc_verify_final(crypto_ctx_t *, crypto_data_t *,
163     crypto_req_handle_t);
164 static int ecc_verify_atomic(crypto_provider_handle_t, crypto_session_id_t,
165     crypto_mechanism_t *, crypto_key_t *, crypto_data_t *,
166     crypto_data_t *, crypto_spi_ctx_template_t, crypto_req_handle_t);
167 
168 static crypto_verify_ops_t ecc_verify_ops = {
169 	ecc_verify_init,
170 	ecc_verify,
171 	ecc_verify_update,
172 	ecc_verify_final,
173 	ecc_verify_atomic,
174 	NULL,
175 	NULL,
176 	NULL
177 };
178 
179 static int ecc_nostore_key_generate_pair(crypto_provider_handle_t,
180     crypto_session_id_t, crypto_mechanism_t *, crypto_object_attribute_t *,
181     uint_t, crypto_object_attribute_t *, uint_t, crypto_object_attribute_t *,
182     uint_t, crypto_object_attribute_t *, uint_t, crypto_req_handle_t);
183 static int ecc_nostore_key_derive(crypto_provider_handle_t,
184     crypto_session_id_t, crypto_mechanism_t *, crypto_key_t *,
185     crypto_object_attribute_t *, uint_t, crypto_object_attribute_t *,
186     uint_t, crypto_req_handle_t);
187 
188 static crypto_nostore_key_ops_t ecc_nostore_key_ops = {
189 	NULL,
190 	ecc_nostore_key_generate_pair,
191 	ecc_nostore_key_derive
192 };
193 
194 static crypto_ops_t ecc_crypto_ops = {
195 	&ecc_control_ops,
196 	NULL,
197 	NULL,
198 	NULL,
199 	&ecc_sign_ops,
200 	&ecc_verify_ops,
201 	NULL,
202 	NULL,
203 	NULL,
204 	NULL,
205 	NULL,
206 	NULL,
207 	NULL,
208 	NULL,
209 	NULL,
210 	&ecc_nostore_key_ops,
211 	NULL,
212 };
213 
214 static crypto_provider_info_t ecc_prov_info = {
215 	CRYPTO_SPI_VERSION_4,
216 	"EC Software Provider",
217 	CRYPTO_SW_PROVIDER,
218 	{&modlinkage},
219 	NULL,
220 	&ecc_crypto_ops,
221 	sizeof (ecc_mech_info_tab)/sizeof (crypto_mech_info_t),
222 	ecc_mech_info_tab
223 };
224 
225 static crypto_kcf_provider_handle_t ecc_prov_handle = 0;
226 
227 static int ecc_sign_common(ecc_ctx_t *, crypto_data_t *, crypto_data_t *,
228     crypto_req_handle_t);
229 static int ecc_verify_common(ecc_ctx_t *, crypto_data_t *, crypto_data_t *,
230     crypto_req_handle_t);
231 static int find_attr(crypto_object_attribute_t *, uint_t, uint64_t);
232 static int get_template_attr_ulong(crypto_object_attribute_t *,
233     uint_t, uint64_t, ulong_t *);
234 static void ecc_free_context(crypto_ctx_t *);
235 static void free_ecparams(ECParams *, boolean_t);
236 static void free_ecprivkey(ECPrivateKey *);
237 
238 int
_init(void)239 _init(void)
240 {
241 	int ret;
242 
243 	if ((ret = mod_install(&modlinkage)) != 0)
244 		return (ret);
245 
246 	/* Register with KCF.  If the registration fails, remove the module. */
247 	if (crypto_register_provider(&ecc_prov_info, &ecc_prov_handle)) {
248 		(void) mod_remove(&modlinkage);
249 		return (EACCES);
250 	}
251 
252 	return (0);
253 }
254 
255 int
_fini(void)256 _fini(void)
257 {
258 	/* Unregister from KCF if module is registered */
259 	if (ecc_prov_handle != 0) {
260 		if (crypto_unregister_provider(ecc_prov_handle))
261 			return (EBUSY);
262 
263 		ecc_prov_handle = 0;
264 	}
265 
266 	return (mod_remove(&modlinkage));
267 }
268 
269 int
_info(struct modinfo * modinfop)270 _info(struct modinfo *modinfop)
271 {
272 	return (mod_info(&modlinkage, modinfop));
273 }
274 
275 /* ARGSUSED */
276 static void
ecc_provider_status(crypto_provider_handle_t provider,uint_t * status)277 ecc_provider_status(crypto_provider_handle_t provider, uint_t *status)
278 {
279 	*status = CRYPTO_PROVIDER_READY;
280 }
281 
282 /*
283  * Return the index of an attribute of specified type found in
284  * the specified array of attributes. If the attribute cannot
285  * found, return -1.
286  */
287 static int
find_attr(crypto_object_attribute_t * attr,uint_t nattr,uint64_t attr_type)288 find_attr(crypto_object_attribute_t *attr, uint_t nattr, uint64_t attr_type)
289 {
290 	int i;
291 
292 	for (i = 0; i < nattr; i++)
293 		if (attr[i].oa_value != NULL && attr[i].oa_type == attr_type)
294 			return (i);
295 	return (-1);
296 }
297 
298 /*
299  * Common function used by the get_template_attr_*() family of
300  * functions. Returns the value of the specified attribute of specified
301  * length. Returns CRYPTO_SUCCESS on success, CRYPTO_ATTRIBUTE_VALUE_INVALID
302  * if the length of the attribute does not match the specified length,
303  * or CRYPTO_ARGUMENTS_BAD if the attribute cannot be found.
304  */
305 static int
get_template_attr_scalar_common(crypto_object_attribute_t * template,uint_t nattr,uint64_t attr_type,void * value,size_t value_len)306 get_template_attr_scalar_common(crypto_object_attribute_t *template,
307     uint_t nattr, uint64_t attr_type, void *value, size_t value_len)
308 {
309 	size_t oa_value_len;
310 	size_t offset = 0;
311 	int attr_idx;
312 
313 	if ((attr_idx = find_attr(template, nattr, attr_type)) == -1)
314 		return (CRYPTO_ARGUMENTS_BAD);
315 
316 	oa_value_len = template[attr_idx].oa_value_len;
317 	if (oa_value_len != value_len) {
318 		return (CRYPTO_ATTRIBUTE_VALUE_INVALID);
319 	}
320 
321 do_copy:
322 	bcopy(template[attr_idx].oa_value, (uchar_t *)value + offset,
323 	    oa_value_len);
324 
325 	return (CRYPTO_SUCCESS);
326 }
327 
328 /*
329  * Get the value of a ulong_t attribute from the specified template.
330  */
331 static int
get_template_attr_ulong(crypto_object_attribute_t * template,uint_t nattr,uint64_t attr_type,ulong_t * attr_value)332 get_template_attr_ulong(crypto_object_attribute_t *template,
333     uint_t nattr, uint64_t attr_type, ulong_t *attr_value)
334 {
335 	return (get_template_attr_scalar_common(template, nattr,
336 	    attr_type, attr_value, sizeof (ulong_t)));
337 }
338 
339 /*
340  * Called from init routines to do basic sanity checks. Init routines,
341  * e.g. sign_init should fail rather than subsequent operations.
342  */
343 static int
check_mech_and_key(ecc_mech_type_t mech_type,crypto_key_t * key,ulong_t class)344 check_mech_and_key(ecc_mech_type_t mech_type, crypto_key_t *key, ulong_t class)
345 {
346 	int rv = CRYPTO_SUCCESS;
347 	uchar_t *foo;
348 	ssize_t point_len;
349 	ssize_t value_len;
350 
351 	if (mech_type != ECDSA_SHA1_MECH_INFO_TYPE &&
352 	    mech_type != ECDSA_MECH_INFO_TYPE)
353 		return (CRYPTO_MECHANISM_INVALID);
354 
355 	if (key->ck_format != CRYPTO_KEY_ATTR_LIST) {
356 		return (CRYPTO_KEY_TYPE_INCONSISTENT);
357 	}
358 
359 	switch (class) {
360 	case CKO_PUBLIC_KEY:
361 		if ((rv = crypto_get_key_attr(key, CKA_EC_POINT, &foo,
362 		    &point_len)) != CRYPTO_SUCCESS) {
363 			return (CRYPTO_TEMPLATE_INCOMPLETE);
364 		}
365 		if (point_len < CRYPTO_BITS2BYTES(EC_MIN_KEY_LEN) * 2 + 1 ||
366 		    point_len > CRYPTO_BITS2BYTES(EC_MAX_KEY_LEN) * 2 + 1)
367 			return (CRYPTO_KEY_SIZE_RANGE);
368 		break;
369 
370 	case CKO_PRIVATE_KEY:
371 		if ((rv = crypto_get_key_attr(key, CKA_VALUE, &foo,
372 		    &value_len)) != CRYPTO_SUCCESS) {
373 			return (CRYPTO_TEMPLATE_INCOMPLETE);
374 		}
375 		if (value_len < CRYPTO_BITS2BYTES(EC_MIN_KEY_LEN) ||
376 		    value_len > CRYPTO_BITS2BYTES(EC_MAX_KEY_LEN))
377 			return (CRYPTO_KEY_SIZE_RANGE);
378 		break;
379 
380 	default:
381 		return (CRYPTO_TEMPLATE_INCONSISTENT);
382 	}
383 
384 	return (rv);
385 }
386 
387 /*
388  * This function guarantees to return non-zero random numbers.
389  * This is needed as the /dev/urandom kernel interface,
390  * random_get_pseudo_bytes(), may return zeros.
391  */
392 int
ecc_knzero_random_generator(uint8_t * ran_out,size_t ran_len)393 ecc_knzero_random_generator(uint8_t *ran_out, size_t ran_len)
394 {
395 	int rv;
396 	size_t ebc = 0; /* count of extra bytes in extrarand */
397 	size_t i = 0;
398 	uint8_t extrarand[32];
399 	size_t extrarand_len;
400 
401 	if ((rv = random_get_pseudo_bytes(ran_out, ran_len)) != 0)
402 		return (rv);
403 
404 	/*
405 	 * Walk through the returned random numbers pointed by ran_out,
406 	 * and look for any random number which is zero.
407 	 * If we find zero, call random_get_pseudo_bytes() to generate
408 	 * another 32 random numbers pool. Replace any zeros in ran_out[]
409 	 * from the random number in pool.
410 	 */
411 	while (i < ran_len) {
412 		if (ran_out[i] != 0) {
413 			i++;
414 			continue;
415 		}
416 
417 		/*
418 		 * Note that it is 'while' so we are guaranteed a
419 		 * non-zero value on exit.
420 		 */
421 		if (ebc == 0) {
422 			/* refresh extrarand */
423 			extrarand_len = sizeof (extrarand);
424 			if ((rv = random_get_pseudo_bytes(extrarand,
425 			    extrarand_len)) != 0) {
426 				return (rv);
427 			}
428 
429 			ebc = extrarand_len;
430 		}
431 		/* Replace zero with byte from extrarand. */
432 		-- ebc;
433 
434 		/*
435 		 * The new random byte zero/non-zero will be checked in
436 		 * the next pass through the loop.
437 		 */
438 		ran_out[i] = extrarand[ebc];
439 	}
440 
441 	return (CRYPTO_SUCCESS);
442 }
443 
444 static void
ecc_free_context(crypto_ctx_t * ctx)445 ecc_free_context(crypto_ctx_t *ctx)
446 {
447 	ecc_ctx_t *ctxp = ctx->cc_provider_private;
448 
449 	if (ctxp != NULL) {
450 		bzero(ctxp->key, ctxp->keychunk_size);
451 		kmem_free(ctxp->key, ctxp->keychunk_size);
452 
453 		free_ecparams(&ctxp->ecparams, B_FALSE);
454 
455 		if (ctxp->mech_type == ECDSA_MECH_INFO_TYPE)
456 			kmem_free(ctxp, sizeof (ecc_ctx_t));
457 		else
458 			kmem_free(ctxp, sizeof (digest_ecc_ctx_t));
459 
460 		ctx->cc_provider_private = NULL;
461 	}
462 }
463 
464 /* ARGSUSED */
465 static int
ecc_sign_verify_common_init(crypto_ctx_t * ctx,crypto_mechanism_t * mechanism,crypto_key_t * key,crypto_spi_ctx_template_t ctx_template,crypto_req_handle_t req)466 ecc_sign_verify_common_init(crypto_ctx_t *ctx, crypto_mechanism_t *mechanism,
467     crypto_key_t *key, crypto_spi_ctx_template_t ctx_template,
468     crypto_req_handle_t req)
469 {
470 	int rv;
471 	int kmflag;
472 	ecc_ctx_t *ctxp;
473 	digest_ecc_ctx_t *dctxp;
474 	ecc_mech_type_t mech_type = mechanism->cm_type;
475 	uchar_t *params;
476 	ssize_t params_len;
477 	ECParams  *ecparams;
478 	SECKEYECParams params_item;
479 
480 	if (crypto_get_key_attr(key, CKA_EC_PARAMS, (void *) &params,
481 	    &params_len)) {
482 		return (CRYPTO_ARGUMENTS_BAD);
483 	}
484 
485 	/* ASN1 check */
486 	if (params[0] != 0x06 ||
487 	    params[1] != params_len - 2) {
488 		return (CRYPTO_ATTRIBUTE_VALUE_INVALID);
489 	}
490 	params_item.data = params;
491 	params_item.len = (uint_t)params_len;
492 	kmflag = crypto_kmflag(req);
493 	if (EC_DecodeParams(&params_item, &ecparams, kmflag) != SECSuccess) {
494 		/* bad curve OID */
495 		return (CRYPTO_ARGUMENTS_BAD);
496 	}
497 
498 	/*
499 	 * Allocate an ECC context.
500 	 */
501 	switch (mech_type) {
502 	case ECDSA_SHA1_MECH_INFO_TYPE:
503 		dctxp = kmem_zalloc(sizeof (digest_ecc_ctx_t), kmflag);
504 		ctxp = (ecc_ctx_t *)dctxp;
505 		break;
506 	default:
507 		ctxp = kmem_zalloc(sizeof (ecc_ctx_t), kmflag);
508 		break;
509 	}
510 
511 	if (ctxp == NULL) {
512 		free_ecparams(ecparams, B_TRUE);
513 		return (CRYPTO_HOST_MEMORY);
514 	}
515 
516 	if ((rv = crypto_copy_key_to_ctx(key, &ctxp->key, &ctxp->keychunk_size,
517 	    kmflag)) != CRYPTO_SUCCESS) {
518 		switch (mech_type) {
519 		case ECDSA_SHA1_MECH_INFO_TYPE:
520 			kmem_free(dctxp, sizeof (digest_ecc_ctx_t));
521 			break;
522 		default:
523 			kmem_free(ctxp, sizeof (ecc_ctx_t));
524 			break;
525 		}
526 		free_ecparams(ecparams, B_TRUE);
527 		return (rv);
528 	}
529 	ctxp->mech_type = mech_type;
530 	ctxp->ecparams = *ecparams;
531 	kmem_free(ecparams, sizeof (ECParams));
532 
533 	switch (mech_type) {
534 	case ECDSA_SHA1_MECH_INFO_TYPE:
535 		SHA1Init(&(dctxp->sha1_ctx));
536 		break;
537 	}
538 
539 	ctx->cc_provider_private = ctxp;
540 
541 	return (CRYPTO_SUCCESS);
542 }
543 
544 /* ARGSUSED */
545 static int
ecc_sign_init(crypto_ctx_t * ctx,crypto_mechanism_t * mechanism,crypto_key_t * key,crypto_spi_ctx_template_t ctx_template,crypto_req_handle_t req)546 ecc_sign_init(crypto_ctx_t *ctx, crypto_mechanism_t *mechanism,
547     crypto_key_t *key, crypto_spi_ctx_template_t ctx_template,
548     crypto_req_handle_t req)
549 {
550 	int rv;
551 
552 	ecc_mech_type_t mech_type = mechanism->cm_type;
553 
554 	if ((rv = check_mech_and_key(mech_type, key,
555 	    CKO_PRIVATE_KEY)) != CRYPTO_SUCCESS)
556 		return (rv);
557 
558 	rv = ecc_sign_verify_common_init(ctx, mechanism, key,
559 	    ctx_template, req);
560 
561 	return (rv);
562 }
563 
564 /* ARGSUSED */
565 static int
ecc_verify_init(crypto_ctx_t * ctx,crypto_mechanism_t * mechanism,crypto_key_t * key,crypto_spi_ctx_template_t ctx_template,crypto_req_handle_t req)566 ecc_verify_init(crypto_ctx_t *ctx, crypto_mechanism_t *mechanism,
567     crypto_key_t *key, crypto_spi_ctx_template_t ctx_template,
568     crypto_req_handle_t req)
569 {
570 	int rv;
571 
572 	ecc_mech_type_t mech_type = mechanism->cm_type;
573 
574 	if ((rv = check_mech_and_key(mech_type, key,
575 	    CKO_PUBLIC_KEY)) != CRYPTO_SUCCESS)
576 		return (rv);
577 
578 	rv = ecc_sign_verify_common_init(ctx, mechanism, key,
579 	    ctx_template, req);
580 
581 	return (rv);
582 }
583 
584 #define	SHA1_DIGEST_SIZE 20
585 
586 #define	INIT_RAW_CRYPTO_DATA(data, base, len, cd_len)	\
587 	(data).cd_format = CRYPTO_DATA_RAW;		\
588 	(data).cd_offset = 0;				\
589 	(data).cd_raw.iov_base = (char *)base;		\
590 	(data).cd_raw.iov_len = len;			\
591 	(data).cd_length = cd_len;
592 
593 static int
ecc_digest_svrfy_common(digest_ecc_ctx_t * ctxp,crypto_data_t * data,crypto_data_t * signature,uchar_t flag,crypto_req_handle_t req)594 ecc_digest_svrfy_common(digest_ecc_ctx_t *ctxp, crypto_data_t *data,
595     crypto_data_t *signature, uchar_t flag, crypto_req_handle_t req)
596 {
597 	int rv = CRYPTO_FAILED;
598 	uchar_t digest[SHA1_DIGEST_LENGTH];
599 	crypto_data_t der_cd;
600 	ecc_mech_type_t mech_type;
601 
602 	ASSERT(flag & CRYPTO_DO_SIGN || flag & CRYPTO_DO_VERIFY);
603 	ASSERT(data != NULL || (flag & CRYPTO_DO_FINAL));
604 
605 	mech_type = ctxp->mech_type;
606 	if (mech_type != ECDSA_SHA1_MECH_INFO_TYPE)
607 		return (CRYPTO_MECHANISM_INVALID);
608 
609 	/* Don't digest if only returning length of signature. */
610 	if (signature->cd_length > 0) {
611 		if (mech_type == ECDSA_SHA1_MECH_INFO_TYPE) {
612 			rv = crypto_digest_data(data, &(ctxp->sha1_ctx),
613 			    digest, (void (*)())SHA1Update,
614 			    (void (*)())SHA1Final, flag | CRYPTO_DO_SHA1);
615 			if (rv != CRYPTO_SUCCESS)
616 				return (rv);
617 		}
618 	}
619 
620 	INIT_RAW_CRYPTO_DATA(der_cd, digest, SHA1_DIGEST_SIZE,
621 	    SHA1_DIGEST_SIZE);
622 
623 	if (flag & CRYPTO_DO_SIGN) {
624 		rv = ecc_sign_common((ecc_ctx_t *)ctxp, &der_cd, signature,
625 		    req);
626 	} else
627 		rv = ecc_verify_common((ecc_ctx_t *)ctxp, &der_cd, signature,
628 		    req);
629 
630 	return (rv);
631 }
632 
633 /*
634  * This is a single-part signing routine. It does not
635  * compute a hash before signing.
636  */
637 static int
ecc_sign_common(ecc_ctx_t * ctx,crypto_data_t * data,crypto_data_t * signature,crypto_req_handle_t req)638 ecc_sign_common(ecc_ctx_t *ctx, crypto_data_t *data, crypto_data_t *signature,
639     crypto_req_handle_t req)
640 {
641 	int rv = CRYPTO_FAILED;
642 	SECStatus ss;
643 	uchar_t *param;
644 	uchar_t *private;
645 	ssize_t param_len;
646 	ssize_t private_len;
647 	uchar_t tmp_data[EC_MAX_DIGEST_LEN];
648 	uchar_t signed_data[EC_MAX_SIG_LEN];
649 	ECPrivateKey ECkey;
650 	SECItem signature_item;
651 	SECItem digest_item;
652 	crypto_key_t *key = ctx->key;
653 	int kmflag;
654 
655 	if ((rv = crypto_get_key_attr(key, CKA_EC_PARAMS, &param,
656 	    &param_len)) != CRYPTO_SUCCESS) {
657 		return (rv);
658 	}
659 
660 	if (data->cd_length > sizeof (tmp_data))
661 		return (CRYPTO_DATA_LEN_RANGE);
662 
663 	if ((rv = crypto_get_input_data(data, &digest_item.data, tmp_data))
664 	    != CRYPTO_SUCCESS) {
665 		return (rv);
666 	}
667 	digest_item.len = data->cd_length;
668 
669 	/* structure assignment */
670 	ECkey.ecParams = ctx->ecparams;
671 
672 	if ((rv = crypto_get_key_attr(key, CKA_VALUE, &private,
673 	    &private_len)) != CRYPTO_SUCCESS) {
674 		return (rv);
675 	}
676 	ECkey.privateValue.data = private;
677 	ECkey.privateValue.len = (uint_t)private_len;
678 
679 	signature_item.data = signed_data;
680 	signature_item.len = sizeof (signed_data);
681 
682 	kmflag = crypto_kmflag(req);
683 	if ((ss = ECDSA_SignDigest(&ECkey, &signature_item, &digest_item,
684 	    kmflag)) != SECSuccess) {
685 		if (ss == SECBufferTooSmall)
686 			return (CRYPTO_BUFFER_TOO_SMALL);
687 
688 		return (CRYPTO_FAILED);
689 	}
690 
691 	if (rv == CRYPTO_SUCCESS) {
692 		/* copy out the signature */
693 		if ((rv = crypto_put_output_data(signed_data,
694 		    signature, signature_item.len)) != CRYPTO_SUCCESS)
695 			return (rv);
696 
697 		signature->cd_length = signature_item.len;
698 	}
699 
700 	return (rv);
701 }
702 
703 /* ARGSUSED */
704 static int
ecc_sign(crypto_ctx_t * ctx,crypto_data_t * data,crypto_data_t * signature,crypto_req_handle_t req)705 ecc_sign(crypto_ctx_t *ctx, crypto_data_t *data, crypto_data_t *signature,
706     crypto_req_handle_t req)
707 {
708 	int rv;
709 	ecc_ctx_t *ctxp;
710 
711 	ASSERT(ctx->cc_provider_private != NULL);
712 	ctxp = ctx->cc_provider_private;
713 
714 	switch (ctxp->mech_type) {
715 	case ECDSA_SHA1_MECH_INFO_TYPE:
716 		rv = ecc_digest_svrfy_common((digest_ecc_ctx_t *)ctxp, data,
717 		    signature, CRYPTO_DO_SIGN | CRYPTO_DO_UPDATE |
718 		    CRYPTO_DO_FINAL, req);
719 		break;
720 	default:
721 		rv = ecc_sign_common(ctxp, data, signature, req);
722 		break;
723 	}
724 
725 	if (rv != CRYPTO_BUFFER_TOO_SMALL)
726 		ecc_free_context(ctx);
727 
728 	return (rv);
729 }
730 
731 /* ARGSUSED */
732 static int
ecc_sign_update(crypto_ctx_t * ctx,crypto_data_t * data,crypto_req_handle_t req)733 ecc_sign_update(crypto_ctx_t *ctx, crypto_data_t *data, crypto_req_handle_t req)
734 {
735 	int rv;
736 	digest_ecc_ctx_t *ctxp;
737 	ecc_mech_type_t mech_type;
738 
739 	ASSERT(ctx->cc_provider_private != NULL);
740 	ctxp = ctx->cc_provider_private;
741 	mech_type = ctxp->mech_type;
742 
743 	if (mech_type == ECDSA_MECH_INFO_TYPE) {
744 		ecc_free_context(ctx);
745 		return (CRYPTO_MECHANISM_INVALID);
746 	}
747 
748 	if (mech_type == ECDSA_SHA1_MECH_INFO_TYPE)
749 		rv = crypto_digest_data(data, &(ctxp->sha1_ctx), NULL,
750 		    (void (*)())SHA1Update, (void (*)())SHA1Final,
751 		    CRYPTO_DO_SHA1 | CRYPTO_DO_UPDATE);
752 
753 	if (rv != CRYPTO_SUCCESS)
754 		ecc_free_context(ctx);
755 
756 	return (rv);
757 }
758 
759 /* ARGSUSED */
760 static int
ecc_sign_final(crypto_ctx_t * ctx,crypto_data_t * signature,crypto_req_handle_t req)761 ecc_sign_final(crypto_ctx_t *ctx, crypto_data_t *signature,
762     crypto_req_handle_t req)
763 {
764 	int rv;
765 	digest_ecc_ctx_t *ctxp;
766 
767 	ASSERT(ctx->cc_provider_private != NULL);
768 	ctxp = ctx->cc_provider_private;
769 
770 	rv = ecc_digest_svrfy_common(ctxp, NULL, signature, CRYPTO_DO_SIGN |
771 	    CRYPTO_DO_FINAL, req);
772 	if (rv != CRYPTO_BUFFER_TOO_SMALL)
773 		ecc_free_context(ctx);
774 
775 	return (rv);
776 }
777 
778 /* ARGSUSED */
779 static int
ecc_sign_atomic(crypto_provider_handle_t provider,crypto_session_id_t session_id,crypto_mechanism_t * mechanism,crypto_key_t * key,crypto_data_t * data,crypto_data_t * signature,crypto_spi_ctx_template_t ctx_template,crypto_req_handle_t req)780 ecc_sign_atomic(crypto_provider_handle_t provider,
781     crypto_session_id_t session_id, crypto_mechanism_t *mechanism,
782     crypto_key_t *key, crypto_data_t *data, crypto_data_t *signature,
783     crypto_spi_ctx_template_t ctx_template, crypto_req_handle_t req)
784 {
785 	int rv;
786 	ecc_mech_type_t mech_type = mechanism->cm_type;
787 	uchar_t *params;
788 	ssize_t params_len;
789 	ECParams  *ecparams;
790 	SECKEYECParams params_item;
791 	int kmflag;
792 
793 	if ((rv = check_mech_and_key(mech_type, key,
794 	    CKO_PRIVATE_KEY)) != CRYPTO_SUCCESS)
795 		return (rv);
796 
797 	if (crypto_get_key_attr(key, CKA_EC_PARAMS, (void *) &params,
798 	    &params_len)) {
799 		return (CRYPTO_ARGUMENTS_BAD);
800 	}
801 
802 	/* ASN1 check */
803 	if (params[0] != 0x06 ||
804 	    params[1] != params_len - 2) {
805 		return (CRYPTO_ATTRIBUTE_VALUE_INVALID);
806 	}
807 	params_item.data = params;
808 	params_item.len = (uint_t)params_len;
809 	kmflag = crypto_kmflag(req);
810 	if (EC_DecodeParams(&params_item, &ecparams, kmflag) != SECSuccess) {
811 		/* bad curve OID */
812 		return (CRYPTO_ARGUMENTS_BAD);
813 	}
814 
815 	if (mechanism->cm_type == ECDSA_MECH_INFO_TYPE) {
816 		ecc_ctx_t ctx;
817 
818 		ctx.mech_type = mech_type;
819 		/* structure assignment */
820 		ctx.ecparams = *ecparams;
821 		ctx.key = key;
822 		rv = ecc_sign_common(&ctx, data, signature, req);
823 	} else {
824 		digest_ecc_ctx_t dctx;
825 
826 		dctx.mech_type = mech_type;
827 		/* structure assignment */
828 		dctx.ecparams = *ecparams;
829 		dctx.key = key;
830 		SHA1Init(&(dctx.sha1_ctx));
831 
832 		rv = ecc_digest_svrfy_common(&dctx, data, signature,
833 		    CRYPTO_DO_SIGN | CRYPTO_DO_UPDATE | CRYPTO_DO_FINAL, req);
834 	}
835 	free_ecparams(ecparams, B_TRUE);
836 
837 	return (rv);
838 }
839 
840 static int
ecc_verify_common(ecc_ctx_t * ctx,crypto_data_t * data,crypto_data_t * signature,crypto_req_handle_t req)841 ecc_verify_common(ecc_ctx_t *ctx, crypto_data_t *data, crypto_data_t *signature,
842     crypto_req_handle_t req)
843 {
844 	int rv = CRYPTO_FAILED;
845 	uchar_t *param;
846 	uchar_t *public;
847 	ssize_t param_len;
848 	ssize_t public_len;
849 	uchar_t tmp_data[EC_MAX_DIGEST_LEN];
850 	uchar_t signed_data[EC_MAX_SIG_LEN];
851 	ECPublicKey ECkey;
852 	SECItem signature_item;
853 	SECItem digest_item;
854 	crypto_key_t *key = ctx->key;
855 	int kmflag;
856 
857 	if ((rv = crypto_get_key_attr(key, CKA_EC_PARAMS, &param,
858 	    &param_len)) != CRYPTO_SUCCESS) {
859 		return (rv);
860 	}
861 
862 	if (signature->cd_length > sizeof (signed_data)) {
863 		return (CRYPTO_SIGNATURE_LEN_RANGE);
864 	}
865 
866 	if ((rv = crypto_get_input_data(signature, &signature_item.data,
867 	    signed_data)) != CRYPTO_SUCCESS) {
868 		return (rv);
869 	}
870 	signature_item.len = signature->cd_length;
871 
872 	if (data->cd_length > sizeof (tmp_data))
873 		return (CRYPTO_DATA_LEN_RANGE);
874 
875 	if ((rv = crypto_get_input_data(data, &digest_item.data, tmp_data))
876 	    != CRYPTO_SUCCESS) {
877 		return (rv);
878 	}
879 	digest_item.len = data->cd_length;
880 
881 	/* structure assignment */
882 	ECkey.ecParams = ctx->ecparams;
883 
884 	if ((rv = crypto_get_key_attr(key, CKA_EC_POINT, &public,
885 	    &public_len)) != CRYPTO_SUCCESS) {
886 		return (rv);
887 	}
888 	ECkey.publicValue.data = public;
889 	ECkey.publicValue.len = (uint_t)public_len;
890 
891 	kmflag = crypto_kmflag(req);
892 	if (ECDSA_VerifyDigest(&ECkey, &signature_item, &digest_item, kmflag)
893 	    != SECSuccess) {
894 		rv = CRYPTO_SIGNATURE_INVALID;
895 	} else {
896 		rv = CRYPTO_SUCCESS;
897 	}
898 
899 	return (rv);
900 }
901 
902 /* ARGSUSED */
903 static int
ecc_verify(crypto_ctx_t * ctx,crypto_data_t * data,crypto_data_t * signature,crypto_req_handle_t req)904 ecc_verify(crypto_ctx_t *ctx, crypto_data_t *data, crypto_data_t *signature,
905     crypto_req_handle_t req)
906 {
907 	int rv;
908 	ecc_ctx_t *ctxp;
909 
910 	ASSERT(ctx->cc_provider_private != NULL);
911 	ctxp = ctx->cc_provider_private;
912 
913 	switch (ctxp->mech_type) {
914 	case ECDSA_SHA1_MECH_INFO_TYPE:
915 		rv = ecc_digest_svrfy_common((digest_ecc_ctx_t *)ctxp, data,
916 		    signature, CRYPTO_DO_VERIFY | CRYPTO_DO_UPDATE |
917 		    CRYPTO_DO_FINAL, req);
918 		break;
919 	default:
920 		rv = ecc_verify_common(ctxp, data, signature, req);
921 		break;
922 	}
923 
924 	ecc_free_context(ctx);
925 	return (rv);
926 }
927 
928 /* ARGSUSED */
929 static int
ecc_verify_update(crypto_ctx_t * ctx,crypto_data_t * data,crypto_req_handle_t req)930 ecc_verify_update(crypto_ctx_t *ctx, crypto_data_t *data,
931     crypto_req_handle_t req)
932 {
933 	int rv;
934 	digest_ecc_ctx_t *ctxp;
935 
936 	ASSERT(ctx->cc_provider_private != NULL);
937 	ctxp = ctx->cc_provider_private;
938 
939 	switch (ctxp->mech_type) {
940 	case ECDSA_SHA1_MECH_INFO_TYPE:
941 		rv = crypto_digest_data(data, &(ctxp->sha1_ctx), NULL,
942 		    (void (*)())SHA1Update, (void (*)())SHA1Final,
943 		    CRYPTO_DO_SHA1 | CRYPTO_DO_UPDATE);
944 		break;
945 	default:
946 		rv = CRYPTO_MECHANISM_INVALID;
947 	}
948 
949 	if (rv != CRYPTO_SUCCESS)
950 		ecc_free_context(ctx);
951 
952 	return (rv);
953 }
954 
955 /* ARGSUSED */
956 static int
ecc_verify_final(crypto_ctx_t * ctx,crypto_data_t * signature,crypto_req_handle_t req)957 ecc_verify_final(crypto_ctx_t *ctx, crypto_data_t *signature,
958     crypto_req_handle_t req)
959 {
960 	int rv;
961 	digest_ecc_ctx_t *ctxp;
962 
963 	ASSERT(ctx->cc_provider_private != NULL);
964 	ctxp = ctx->cc_provider_private;
965 
966 	rv = ecc_digest_svrfy_common(ctxp, NULL, signature,
967 	    CRYPTO_DO_VERIFY | CRYPTO_DO_FINAL, req);
968 
969 	ecc_free_context(ctx);
970 
971 	return (rv);
972 }
973 
974 
975 /* ARGSUSED */
976 static int
ecc_verify_atomic(crypto_provider_handle_t provider,crypto_session_id_t session_id,crypto_mechanism_t * mechanism,crypto_key_t * key,crypto_data_t * data,crypto_data_t * signature,crypto_spi_ctx_template_t ctx_template,crypto_req_handle_t req)977 ecc_verify_atomic(crypto_provider_handle_t provider,
978     crypto_session_id_t session_id, crypto_mechanism_t *mechanism,
979     crypto_key_t *key, crypto_data_t *data, crypto_data_t *signature,
980     crypto_spi_ctx_template_t ctx_template, crypto_req_handle_t req)
981 {
982 	int rv;
983 	ecc_mech_type_t mech_type = mechanism->cm_type;
984 	uchar_t *params;
985 	ssize_t params_len;
986 	ECParams  *ecparams;
987 	SECKEYECParams params_item;
988 	int kmflag;
989 
990 	if ((rv = check_mech_and_key(mech_type, key,
991 	    CKO_PUBLIC_KEY)) != CRYPTO_SUCCESS)
992 		return (rv);
993 
994 	if (crypto_get_key_attr(key, CKA_EC_PARAMS, (void *) &params,
995 	    &params_len)) {
996 		return (CRYPTO_ARGUMENTS_BAD);
997 	}
998 
999 	/* ASN1 check */
1000 	if (params[0] != 0x06 ||
1001 	    params[1] != params_len - 2) {
1002 		return (CRYPTO_ATTRIBUTE_VALUE_INVALID);
1003 	}
1004 	params_item.data = params;
1005 	params_item.len = (uint_t)params_len;
1006 	kmflag = crypto_kmflag(req);
1007 	if (EC_DecodeParams(&params_item, &ecparams, kmflag) != SECSuccess) {
1008 		/* bad curve OID */
1009 		return (CRYPTO_ARGUMENTS_BAD);
1010 	}
1011 
1012 	if (mechanism->cm_type == ECDSA_MECH_INFO_TYPE) {
1013 		ecc_ctx_t ctx;
1014 
1015 		ctx.mech_type = mech_type;
1016 		/* structure assignment */
1017 		ctx.ecparams = *ecparams;
1018 		ctx.key = key;
1019 		rv = ecc_verify_common(&ctx, data, signature, req);
1020 	} else {
1021 		digest_ecc_ctx_t dctx;
1022 
1023 		dctx.mech_type = mech_type;
1024 		/* structure assignment */
1025 		dctx.ecparams = *ecparams;
1026 		dctx.key = key;
1027 		SHA1Init(&(dctx.sha1_ctx));
1028 
1029 		rv = ecc_digest_svrfy_common(&dctx, data, signature,
1030 		    CRYPTO_DO_VERIFY | CRYPTO_DO_UPDATE | CRYPTO_DO_FINAL, req);
1031 	}
1032 	free_ecparams(ecparams, B_TRUE);
1033 	return (rv);
1034 }
1035 
1036 /* ARGSUSED */
1037 static int
ecc_nostore_key_generate_pair(crypto_provider_handle_t provider,crypto_session_id_t session_id,crypto_mechanism_t * mechanism,crypto_object_attribute_t * pub_template,uint_t pub_attribute_count,crypto_object_attribute_t * pri_template,uint_t pri_attribute_count,crypto_object_attribute_t * pub_out_template,uint_t pub_out_attribute_count,crypto_object_attribute_t * pri_out_template,uint_t pri_out_attribute_count,crypto_req_handle_t req)1038 ecc_nostore_key_generate_pair(crypto_provider_handle_t provider,
1039     crypto_session_id_t session_id, crypto_mechanism_t *mechanism,
1040     crypto_object_attribute_t *pub_template, uint_t pub_attribute_count,
1041     crypto_object_attribute_t *pri_template, uint_t pri_attribute_count,
1042     crypto_object_attribute_t *pub_out_template, uint_t pub_out_attribute_count,
1043     crypto_object_attribute_t *pri_out_template, uint_t pri_out_attribute_count,
1044     crypto_req_handle_t req)
1045 {
1046 	int rv = CRYPTO_SUCCESS;
1047 	ECPrivateKey *privKey;	/* contains both public and private values */
1048 	ECParams *ecparams;
1049 	SECKEYECParams params_item;
1050 	ulong_t pub_key_type = ~0UL, pub_class = ~0UL;
1051 	ulong_t pri_key_type = ~0UL, pri_class = ~0UL;
1052 	int params_idx, value_idx, point_idx;
1053 	uchar_t *params = NULL;
1054 	unsigned params_len;
1055 	uchar_t *value = NULL;
1056 	uchar_t *point = NULL;
1057 	int valuelen;
1058 	int pointlen;
1059 	int xylen;
1060 	int kmflag;
1061 
1062 	if (mechanism->cm_type != EC_KEY_PAIR_GEN_MECH_INFO_TYPE) {
1063 		return (CRYPTO_MECHANISM_INVALID);
1064 	}
1065 
1066 	/* optional */
1067 	(void) get_template_attr_ulong(pub_template,
1068 	    pub_attribute_count, CKA_CLASS, &pub_class);
1069 
1070 	/* optional */
1071 	(void) get_template_attr_ulong(pri_template,
1072 	    pri_attribute_count, CKA_CLASS, &pri_class);
1073 
1074 	/* optional */
1075 	(void) get_template_attr_ulong(pub_template,
1076 	    pub_attribute_count, CKA_KEY_TYPE, &pub_key_type);
1077 
1078 	/* optional */
1079 	(void) get_template_attr_ulong(pri_template,
1080 	    pri_attribute_count, CKA_KEY_TYPE, &pri_key_type);
1081 
1082 	if (pub_class != ~0UL && pub_class != CKO_PUBLIC_KEY) {
1083 		return (CRYPTO_TEMPLATE_INCONSISTENT);
1084 	}
1085 	pub_class = CKO_PUBLIC_KEY;
1086 
1087 	if (pri_class != ~0UL && pri_class != CKO_PRIVATE_KEY) {
1088 		return (CRYPTO_TEMPLATE_INCONSISTENT);
1089 	}
1090 	pri_class = CKO_PRIVATE_KEY;
1091 
1092 	if (pub_key_type != ~0UL && pub_key_type != CKK_EC) {
1093 		return (CRYPTO_TEMPLATE_INCONSISTENT);
1094 	}
1095 	pub_key_type = CKK_EC;
1096 
1097 	if (pri_key_type != ~0UL && pri_key_type != CKK_EC) {
1098 		return (CRYPTO_TEMPLATE_INCONSISTENT);
1099 	}
1100 	pri_key_type = CKK_EC;
1101 
1102 	/* public output template must contain CKA_EC_POINT attribute */
1103 	if ((point_idx = find_attr(pub_out_template, pub_out_attribute_count,
1104 	    CKA_EC_POINT)) == -1) {
1105 		return (CRYPTO_TEMPLATE_INCOMPLETE);
1106 	}
1107 
1108 	/* private output template must contain CKA_VALUE attribute */
1109 	if ((value_idx = find_attr(pri_out_template, pri_out_attribute_count,
1110 	    CKA_VALUE)) == -1) {
1111 		return (CRYPTO_TEMPLATE_INCOMPLETE);
1112 	}
1113 
1114 	if ((params_idx = find_attr(pub_template, pub_attribute_count,
1115 	    CKA_EC_PARAMS)) == -1) {
1116 		return (CRYPTO_TEMPLATE_INCOMPLETE);
1117 	}
1118 
1119 	params = (uchar_t *)pub_template[params_idx].oa_value;
1120 	params_len = pub_template[params_idx].oa_value_len;
1121 
1122 	value = (uchar_t *)pri_out_template[value_idx].oa_value;
1123 	valuelen = (int)pri_out_template[value_idx].oa_value_len;
1124 	point = (uchar_t *)pub_out_template[point_idx].oa_value;
1125 	pointlen = (int)pub_out_template[point_idx].oa_value_len;
1126 
1127 	/* ASN1 check */
1128 	if (params[0] != 0x06 ||
1129 	    params[1] != params_len - 2) {
1130 		return (CRYPTO_ATTRIBUTE_VALUE_INVALID);
1131 	}
1132 	params_item.data = params;
1133 	params_item.len = params_len;
1134 	kmflag = crypto_kmflag(req);
1135 	if (EC_DecodeParams(&params_item, &ecparams, kmflag) != SECSuccess) {
1136 		/* bad curve OID */
1137 		return (CRYPTO_ARGUMENTS_BAD);
1138 	}
1139 
1140 	if (EC_NewKey(ecparams, &privKey, kmflag) != SECSuccess) {
1141 		free_ecparams(ecparams, B_TRUE);
1142 		return (CRYPTO_FAILED);
1143 	}
1144 
1145 	xylen = privKey->publicValue.len;
1146 	/* ASSERT that xylen - 1 is divisible by 2 */
1147 	if (xylen > pointlen) {
1148 		rv = CRYPTO_BUFFER_TOO_SMALL;
1149 		goto out;
1150 	}
1151 
1152 	if (privKey->privateValue.len > valuelen) {
1153 		rv = CRYPTO_BUFFER_TOO_SMALL;
1154 		goto out;
1155 	}
1156 	bcopy(privKey->privateValue.data, value, privKey->privateValue.len);
1157 	pri_out_template[value_idx].oa_value_len = privKey->privateValue.len;
1158 
1159 	bcopy(privKey->publicValue.data, point, xylen);
1160 	pub_out_template[point_idx].oa_value_len = xylen;
1161 
1162 out:
1163 	free_ecprivkey(privKey);
1164 	free_ecparams(ecparams, B_TRUE);
1165 	return (rv);
1166 }
1167 
1168 /* ARGSUSED */
1169 static int
ecc_nostore_key_derive(crypto_provider_handle_t provider,crypto_session_id_t session_id,crypto_mechanism_t * mechanism,crypto_key_t * base_key,crypto_object_attribute_t * in_attrs,uint_t in_attr_count,crypto_object_attribute_t * out_attrs,uint_t out_attr_count,crypto_req_handle_t req)1170 ecc_nostore_key_derive(crypto_provider_handle_t provider,
1171     crypto_session_id_t session_id, crypto_mechanism_t *mechanism,
1172     crypto_key_t *base_key, crypto_object_attribute_t *in_attrs,
1173     uint_t in_attr_count, crypto_object_attribute_t *out_attrs,
1174     uint_t out_attr_count, crypto_req_handle_t req)
1175 {
1176 	int rv = CRYPTO_SUCCESS;
1177 	int params_idx, value_idx = -1, out_value_idx = -1;
1178 	ulong_t key_type;
1179 	ulong_t key_len;
1180 	crypto_object_attribute_t *attrs;
1181 	ECParams *ecparams;
1182 	SECKEYECParams params_item;
1183 	CK_ECDH1_DERIVE_PARAMS *mech_param;
1184 	SECItem public_value_item, private_value_item, secret_item;
1185 	int kmflag;
1186 
1187 	if (mechanism->cm_type != ECDH1_DERIVE_MECH_INFO_TYPE) {
1188 		return (CRYPTO_MECHANISM_INVALID);
1189 	}
1190 
1191 	ASSERT(IS_P2ALIGNED(mechanism->cm_param, sizeof (uint64_t)));
1192 	/* LINTED: pointer alignment */
1193 	mech_param = (CK_ECDH1_DERIVE_PARAMS *)mechanism->cm_param;
1194 	if (mech_param->kdf != CKD_NULL) {
1195 		return (CRYPTO_MECHANISM_PARAM_INVALID);
1196 	}
1197 
1198 	if ((base_key->ck_format != CRYPTO_KEY_ATTR_LIST) ||
1199 	    (base_key->ck_count == 0)) {
1200 		return (CRYPTO_ARGUMENTS_BAD);
1201 	}
1202 
1203 	if ((rv = get_template_attr_ulong(in_attrs, in_attr_count,
1204 	    CKA_KEY_TYPE, &key_type)) != CRYPTO_SUCCESS) {
1205 		return (rv);
1206 	}
1207 
1208 	switch (key_type) {
1209 	case CKK_DES:
1210 		key_len = DES_KEYSIZE;
1211 		break;
1212 	case CKK_DES2:
1213 		key_len = DES2_KEYSIZE;
1214 		break;
1215 	case CKK_DES3:
1216 		key_len = DES3_KEYSIZE;
1217 		break;
1218 	case CKK_RC4:
1219 	case CKK_AES:
1220 	case CKK_GENERIC_SECRET:
1221 		if ((rv = get_template_attr_ulong(in_attrs, in_attr_count,
1222 		    CKA_VALUE_LEN, &key_len)) != CRYPTO_SUCCESS) {
1223 			return (rv);
1224 		}
1225 		break;
1226 	default:
1227 		key_len = 0;
1228 	}
1229 
1230 	attrs = base_key->ck_attrs;
1231 	if ((value_idx = find_attr(attrs, base_key->ck_count,
1232 	    CKA_VALUE)) == -1) {
1233 		return (CRYPTO_TEMPLATE_INCOMPLETE);
1234 	}
1235 
1236 	if ((params_idx = find_attr(attrs, base_key->ck_count,
1237 	    CKA_EC_PARAMS)) == -1) {
1238 		return (CRYPTO_TEMPLATE_INCOMPLETE);
1239 	}
1240 
1241 	private_value_item.data = (uchar_t *)attrs[value_idx].oa_value;
1242 	private_value_item.len = attrs[value_idx].oa_value_len;
1243 
1244 	params_item.len = attrs[params_idx].oa_value_len;
1245 	params_item.data = (uchar_t *)attrs[params_idx].oa_value;
1246 
1247 	/* ASN1 check */
1248 	if (params_item.data[0] != 0x06 ||
1249 	    params_item.data[1] != params_item.len - 2) {
1250 		return (CRYPTO_ATTRIBUTE_VALUE_INVALID);
1251 	}
1252 	kmflag = crypto_kmflag(req);
1253 	if (EC_DecodeParams(&params_item, &ecparams, kmflag) != SECSuccess) {
1254 		/* bad curve OID */
1255 		return (CRYPTO_ARGUMENTS_BAD);
1256 	}
1257 
1258 	public_value_item.data = (uchar_t *)mech_param->pPublicData;
1259 	public_value_item.len = mech_param->ulPublicDataLen;
1260 
1261 	if ((out_value_idx = find_attr(out_attrs, out_attr_count,
1262 	    CKA_VALUE)) == -1) {
1263 		rv = CRYPTO_TEMPLATE_INCOMPLETE;
1264 		goto out;
1265 	}
1266 	secret_item.data = NULL;
1267 	secret_item.len = 0;
1268 
1269 	if (ECDH_Derive(&public_value_item, ecparams, &private_value_item,
1270 	    B_FALSE, &secret_item, kmflag) != SECSuccess) {
1271 		free_ecparams(ecparams, B_TRUE);
1272 		return (CRYPTO_FAILED);
1273 	} else {
1274 		rv = CRYPTO_SUCCESS;
1275 	}
1276 
1277 	if (key_len == 0)
1278 		key_len = secret_item.len;
1279 
1280 	if (key_len > secret_item.len) {
1281 		rv = CRYPTO_ATTRIBUTE_VALUE_INVALID;
1282 		goto out;
1283 	}
1284 	if (key_len > out_attrs[out_value_idx].oa_value_len) {
1285 		rv = CRYPTO_BUFFER_TOO_SMALL;
1286 		goto out;
1287 	}
1288 	bcopy(secret_item.data + secret_item.len - key_len,
1289 	    (uchar_t *)out_attrs[out_value_idx].oa_value, key_len);
1290 	out_attrs[out_value_idx].oa_value_len = key_len;
1291 out:
1292 	free_ecparams(ecparams, B_TRUE);
1293 	SECITEM_FreeItem(&secret_item, B_FALSE);
1294 	return (rv);
1295 }
1296 
1297 static void
free_ecparams(ECParams * params,boolean_t freeit)1298 free_ecparams(ECParams *params, boolean_t freeit)
1299 {
1300 	SECITEM_FreeItem(&params->fieldID.u.prime, B_FALSE);
1301 	SECITEM_FreeItem(&params->curve.a, B_FALSE);
1302 	SECITEM_FreeItem(&params->curve.b, B_FALSE);
1303 	SECITEM_FreeItem(&params->curve.seed, B_FALSE);
1304 	SECITEM_FreeItem(&params->base, B_FALSE);
1305 	SECITEM_FreeItem(&params->order, B_FALSE);
1306 	SECITEM_FreeItem(&params->DEREncoding, B_FALSE);
1307 	SECITEM_FreeItem(&params->curveOID, B_FALSE);
1308 	if (freeit)
1309 		kmem_free(params, sizeof (ECParams));
1310 }
1311 
1312 static void
free_ecprivkey(ECPrivateKey * key)1313 free_ecprivkey(ECPrivateKey *key)
1314 {
1315 	free_ecparams(&key->ecParams, B_FALSE);
1316 	SECITEM_FreeItem(&key->publicValue, B_FALSE);
1317 	bzero(key->privateValue.data, key->privateValue.len);
1318 	SECITEM_FreeItem(&key->privateValue, B_FALSE);
1319 	SECITEM_FreeItem(&key->version, B_FALSE);
1320 	kmem_free(key, sizeof (ECPrivateKey));
1321 }
1322