From: David Howells <dhowells@redhat.com>
To: jmorris@namei.org
Cc: Denis Kenzior <denkenz@gmail.com>,
Marcel Holtmann <marcel@holtmann.org>,
Marcel Holtmann <marcel@holtmann.org>,
dhowells@redhat.com, denkenz@gmail.com, keyrings@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH 14/22] KEYS: asym_tpm: Implement encryption operation [ver #2]
Date: Tue, 09 Oct 2018 17:48:33 +0100 [thread overview]
Message-ID: <153910371304.12141.3922421291748583148.stgit@warthog.procyon.org.uk> (raw)
In-Reply-To: <153910360263.12141.6032694262361399627.stgit@warthog.procyon.org.uk>
From: Denis Kenzior <denkenz@gmail.com>
This patch impelements the pkey_encrypt operation. The public key
portion extracted from the TPM key blob is used. The operation is
performed entirely in software using the crypto API.
Signed-off-by: Denis Kenzior <denkenz@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Marcel Holtmann <marcel@holtmann.org>
Reviewed-by: Marcel Holtmann <marcel@holtmann.org>
---
crypto/asymmetric_keys/asym_tpm.c | 84 +++++++++++++++++++++++++++++++++++++
1 file changed, 84 insertions(+)
diff --git a/crypto/asymmetric_keys/asym_tpm.c b/crypto/asymmetric_keys/asym_tpm.c
index 837472d107d5..8edca3c4c193 100644
--- a/crypto/asymmetric_keys/asym_tpm.c
+++ b/crypto/asymmetric_keys/asym_tpm.c
@@ -165,6 +165,8 @@ static int tpm_key_query(const struct kernel_pkey_params *params,
info->max_enc_size = len;
info->max_dec_size = tk->key_len / 8;
+ info->supported_ops = KEYCTL_SUPPORTS_ENCRYPT;
+
ret = 0;
error_free_tfm:
crypto_free_akcipher(tfm);
@@ -172,6 +174,87 @@ static int tpm_key_query(const struct kernel_pkey_params *params,
return ret;
}
+/*
+ * Encryption operation is performed with the public key. Hence it is done
+ * in software
+ */
+static int tpm_key_encrypt(struct tpm_key *tk,
+ struct kernel_pkey_params *params,
+ const void *in, void *out)
+{
+ char alg_name[CRYPTO_MAX_ALG_NAME];
+ struct crypto_akcipher *tfm;
+ struct akcipher_request *req;
+ struct crypto_wait cwait;
+ struct scatterlist in_sg, out_sg;
+ uint8_t der_pub_key[PUB_KEY_BUF_SIZE];
+ uint32_t der_pub_key_len;
+ int ret;
+
+ pr_devel("==>%s()\n", __func__);
+
+ ret = determine_akcipher(params->encoding, params->hash_algo, alg_name);
+ if (ret < 0)
+ return ret;
+
+ tfm = crypto_alloc_akcipher(alg_name, 0, 0);
+ if (IS_ERR(tfm))
+ return PTR_ERR(tfm);
+
+ der_pub_key_len = derive_pub_key(tk->pub_key, tk->pub_key_len,
+ der_pub_key);
+
+ ret = crypto_akcipher_set_pub_key(tfm, der_pub_key, der_pub_key_len);
+ if (ret < 0)
+ goto error_free_tfm;
+
+ req = akcipher_request_alloc(tfm, GFP_KERNEL);
+ if (!req)
+ goto error_free_tfm;
+
+ sg_init_one(&in_sg, in, params->in_len);
+ sg_init_one(&out_sg, out, params->out_len);
+ akcipher_request_set_crypt(req, &in_sg, &out_sg, params->in_len,
+ params->out_len);
+ crypto_init_wait(&cwait);
+ akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
+ CRYPTO_TFM_REQ_MAY_SLEEP,
+ crypto_req_done, &cwait);
+
+ ret = crypto_akcipher_encrypt(req);
+ ret = crypto_wait_req(ret, &cwait);
+
+ if (ret == 0)
+ ret = req->dst_len;
+
+ akcipher_request_free(req);
+error_free_tfm:
+ crypto_free_akcipher(tfm);
+ pr_devel("<==%s() = %d\n", __func__, ret);
+ return ret;
+}
+
+/*
+ * Do encryption, decryption and signing ops.
+ */
+static int tpm_key_eds_op(struct kernel_pkey_params *params,
+ const void *in, void *out)
+{
+ struct tpm_key *tk = params->key->payload.data[asym_crypto];
+ int ret = -EOPNOTSUPP;
+
+ /* Perform the encryption calculation. */
+ switch (params->op) {
+ case kernel_pkey_encrypt:
+ ret = tpm_key_encrypt(tk, params, in, out);
+ break;
+ default:
+ BUG();
+ }
+
+ return ret;
+}
+
/*
* Parse enough information out of TPM_KEY structure:
* TPM_STRUCT_VER -> 4 bytes
@@ -329,6 +412,7 @@ struct asymmetric_key_subtype asym_tpm_subtype = {
.describe = asym_tpm_describe,
.destroy = asym_tpm_destroy,
.query = tpm_key_query,
+ .eds_op = tpm_key_eds_op,
};
EXPORT_SYMBOL_GPL(asym_tpm_subtype);
next prev parent reply other threads:[~2018-10-09 16:48 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-09 16:46 [PATCH 00/22] KEYS: Support TPM-wrapped key and crypto ops [ver #2] David Howells
2018-10-09 16:46 ` [PATCH 01/22] KEYS: Provide key type operations for asymmetric key " David Howells
2018-10-09 16:46 ` [PATCH 02/22] KEYS: Provide keyctls to drive the new key type ops for asymmetric keys " David Howells
2018-10-09 16:47 ` [PATCH 03/22] KEYS: Provide missing asymmetric key subops for new key type ops " David Howells
2018-10-09 16:47 ` [PATCH 04/22] KEYS: Make the X.509 and PKCS7 parsers supply the sig encoding type " David Howells
2018-10-09 16:47 ` [PATCH 05/22] KEYS: Provide software public key query function " David Howells
2018-10-09 16:47 ` [PATCH 06/22] KEYS: Allow the public_key struct to hold a private key " David Howells
2018-10-09 16:47 ` [PATCH 07/22] KEYS: Implement encrypt, decrypt and sign for software asymmetric " David Howells
2018-10-09 16:47 ` [PATCH 08/22] KEYS: Implement PKCS#8 RSA Private Key parser " David Howells
2018-10-09 16:47 ` [PATCH 09/22] crypto: rsa-pkcs1pad: Allow hash to be optional " David Howells
2018-10-09 16:48 ` [PATCH 10/22] KEYS: asym_tpm: add skeleton for asym_tpm " David Howells
2018-10-09 16:48 ` [PATCH 11/22] KEYS: asym_tpm: extract key size & public key " David Howells
2018-10-09 16:48 ` [PATCH 12/22] KEYS: Add parser for TPM-based keys " David Howells
2018-10-09 16:48 ` [PATCH 13/22] KEYS: asym_tpm: Implement pkey_query " David Howells
2018-10-09 16:48 ` David Howells [this message]
2018-10-09 16:48 ` [PATCH 15/22] KEYS: trusted: Expose common functionality " David Howells
2018-10-09 16:48 ` [PATCH 16/22] KEYS: Move trusted.h to include/keys " David Howells
2018-10-09 16:48 ` [PATCH 17/22] KEYS: asym_tpm: Add loadkey2 and flushspecific " David Howells
2018-10-09 16:49 ` [PATCH 18/22] KEYS: asym_tpm: Implement tpm_unbind " David Howells
2018-10-09 16:49 ` [PATCH 19/22] KEYS: asym_tpm: Implement the decrypt operation " David Howells
2018-10-09 16:49 ` [PATCH 20/22] KEYS: asym_tpm: Implement signature verification " David Howells
2018-10-09 16:49 ` [PATCH 21/22] KEYS: asym_tpm: Implement tpm_sign " David Howells
2018-10-09 16:49 ` [PATCH 22/22] KEYS: asym_tpm: Add support for the sign operation " David Howells
2018-10-09 19:26 ` [PATCH 00/22] KEYS: Support TPM-wrapped key and crypto ops " James Morris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=153910371304.12141.3922421291748583148.stgit@warthog.procyon.org.uk \
--to=dhowells@redhat.com \
--cc=denkenz@gmail.com \
--cc=jmorris@namei.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=marcel@holtmann.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).