[PATCH v3 0/3] crypto: rsa - generalize ASN.1 sequences

[PATCH v3 0/3] crypto: rsa - generalize ASN.1 sequences

[Tudor Ambarus]

v2 patch set can be found here:
  http://www.mail-archive.com/linux-crypto%40vger.kernel.org/msg18269.html

Changes to v2 patch set:

- "crypto: add CONFIG_ symbol for rsa helper"
	- removed. The drivers will select the CRYPTO_RSA symbol instead.

Tudor Ambarus (3):
  crypto: rsa - generalize ASN.1 sequences
  crypto: rsa_helper - add raw integer parser actions
  crypto: rsa_helper - export symbols for asn1 structures

 crypto/rsa.c                  |  75 ++++-----
 crypto/rsa_helper.c           | 351 +++++++++++++++++++++++++++++++++++++-----
 include/crypto/internal/rsa.h |  59 ++++++-
 3 files changed, 407 insertions(+), 78 deletions(-)

-- 
1.8.3.1

[PATCH v3 1/3] crypto: rsa - generalize ASN.1 sequences

[Tudor Ambarus]

Use common ASN.1 sequences for all RSA implementations.

Give hardware RSA implementations the chance to use
the RSA's software implementation parser even if they
are likely to want to use raw integers.

The parser expects a context that contains at the first address
a pointer to a struct rsa_asn1_action instance that has function
pointers to specific parser actions (return MPI or raw integer keys),
followed by a key representation structure (for MPI or raw integers).

This approach has the advantage that users can select specific
parser actions by using a general parser with function pointers
to specific actions.

Signed-off-by: Tudor Ambarus <tudor-dan.ambarus@nxp.com>
---
 crypto/rsa.c                  |  60 ++++++++++-----
 crypto/rsa_helper.c           | 166 ++++++++++++++++++++++++++++++++----------
 include/crypto/internal/rsa.h |  31 ++++++--
 3 files changed, 194 insertions(+), 63 deletions(-)

diff --git a/crypto/rsa.c b/crypto/rsa.c
index 77d737f..7cb0153 100644
--- a/crypto/rsa.c
+++ b/crypto/rsa.c
@@ -19,7 +19,7 @@
  * RSAEP function [RFC3447 sec 5.1.1]
  * c = m^e mod n;
  */
-static int _rsa_enc(const struct rsa_key *key, MPI c, MPI m)
+static int _rsa_enc(const struct rsa_mpi_key *key, MPI c, MPI m)
 {
 	/* (1) Validate 0 <= m < n */
 	if (mpi_cmp_ui(m, 0) < 0 || mpi_cmp(m, key->n) >= 0)
@@ -33,7 +33,7 @@ static int _rsa_enc(const struct rsa_key *key, MPI c, MPI m)
  * RSADP function [RFC3447 sec 5.1.2]
  * m = c^d mod n;
  */
-static int _rsa_dec(const struct rsa_key *key, MPI m, MPI c)
+static int _rsa_dec(const struct rsa_mpi_key *key, MPI m, MPI c)
 {
 	/* (1) Validate 0 <= c < n */
 	if (mpi_cmp_ui(c, 0) < 0 || mpi_cmp(c, key->n) >= 0)
@@ -47,7 +47,7 @@ static int _rsa_dec(const struct rsa_key *key, MPI m, MPI c)
  * RSASP1 function [RFC3447 sec 5.2.1]
  * s = m^d mod n
  */
-static int _rsa_sign(const struct rsa_key *key, MPI s, MPI m)
+static int _rsa_sign(const struct rsa_mpi_key *key, MPI s, MPI m)
 {
 	/* (1) Validate 0 <= m < n */
 	if (mpi_cmp_ui(m, 0) < 0 || mpi_cmp(m, key->n) >= 0)
@@ -61,7 +61,7 @@ static int _rsa_sign(const struct rsa_key *key, MPI s, MPI m)
  * RSAVP1 function [RFC3447 sec 5.2.2]
  * m = s^e mod n;
  */
-static int _rsa_verify(const struct rsa_key *key, MPI m, MPI s)
+static int _rsa_verify(const struct rsa_mpi_key *key, MPI m, MPI s)
 {
 	/* (1) Validate 0 <= s < n */
 	if (mpi_cmp_ui(s, 0) < 0 || mpi_cmp(s, key->n) >= 0)
@@ -71,15 +71,17 @@ static int _rsa_verify(const struct rsa_key *key, MPI m, MPI s)
 	return mpi_powm(m, s, key->e, key->n);
 }
 
-static inline struct rsa_key *rsa_get_key(struct crypto_akcipher *tfm)
+static inline struct rsa_mpi_key *rsa_get_key(struct crypto_akcipher *tfm)
 {
-	return akcipher_tfm_ctx(tfm);
+	struct rsa_ctx *ctx = akcipher_tfm_ctx(tfm);
+
+	return &ctx->key;
 }
 
 static int rsa_enc(struct akcipher_request *req)
 {
 	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
-	const struct rsa_key *pkey = rsa_get_key(tfm);
+	const struct rsa_mpi_key *pkey = rsa_get_key(tfm);
 	MPI m, c = mpi_alloc(0);
 	int ret = 0;
 	int sign;
@@ -118,7 +120,7 @@ err_free_c:
 static int rsa_dec(struct akcipher_request *req)
 {
 	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
-	const struct rsa_key *pkey = rsa_get_key(tfm);
+	const struct rsa_mpi_key *pkey = rsa_get_key(tfm);
 	MPI c, m = mpi_alloc(0);
 	int ret = 0;
 	int sign;
@@ -156,7 +158,7 @@ err_free_m:
 static int rsa_sign(struct akcipher_request *req)
 {
 	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
-	const struct rsa_key *pkey = rsa_get_key(tfm);
+	const struct rsa_mpi_key *pkey = rsa_get_key(tfm);
 	MPI m, s = mpi_alloc(0);
 	int ret = 0;
 	int sign;
@@ -195,7 +197,7 @@ err_free_s:
 static int rsa_verify(struct akcipher_request *req)
 {
 	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
-	const struct rsa_key *pkey = rsa_get_key(tfm);
+	const struct rsa_mpi_key *pkey = rsa_get_key(tfm);
 	MPI s, m = mpi_alloc(0);
 	int ret = 0;
 	int sign;
@@ -251,15 +253,16 @@ static int rsa_check_key_length(unsigned int len)
 static int rsa_set_pub_key(struct crypto_akcipher *tfm, const void *key,
 			   unsigned int keylen)
 {
-	struct rsa_key *pkey = akcipher_tfm_ctx(tfm);
+	struct rsa_ctx *ctx = akcipher_tfm_ctx(tfm);
+	struct rsa_mpi_key *pkey = &ctx->key;
 	int ret;
 
-	ret = rsa_parse_pub_key(pkey, key, keylen);
+	ret = rsa_parse_mpi_pub_key(ctx, key, keylen);
 	if (ret)
 		return ret;
 
 	if (rsa_check_key_length(mpi_get_size(pkey->n) << 3)) {
-		rsa_free_key(pkey);
+		rsa_free_mpi_key(pkey);
 		ret = -EINVAL;
 	}
 	return ret;
@@ -268,15 +271,16 @@ static int rsa_set_pub_key(struct crypto_akcipher *tfm, const void *key,
 static int rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key,
 			    unsigned int keylen)
 {
-	struct rsa_key *pkey = akcipher_tfm_ctx(tfm);
+	struct rsa_ctx *ctx = akcipher_tfm_ctx(tfm);
+	struct rsa_mpi_key *pkey = &ctx->key;
 	int ret;
 
-	ret = rsa_parse_priv_key(pkey, key, keylen);
+	ret = rsa_parse_mpi_priv_key(ctx, key, keylen);
 	if (ret)
 		return ret;
 
 	if (rsa_check_key_length(mpi_get_size(pkey->n) << 3)) {
-		rsa_free_key(pkey);
+		rsa_free_mpi_key(pkey);
 		ret = -EINVAL;
 	}
 	return ret;
@@ -284,16 +288,31 @@ static int rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key,
 
 static int rsa_max_size(struct crypto_akcipher *tfm)
 {
-	struct rsa_key *pkey = akcipher_tfm_ctx(tfm);
+	struct rsa_mpi_key *pkey = rsa_get_key(tfm);
 
 	return pkey->n ? mpi_get_size(pkey->n) : -EINVAL;
 }
 
+static const struct rsa_asn1_action rsa_action = {
+	.get_n = rsa_get_mpi_n,
+	.get_e = rsa_get_mpi_e,
+	.get_d = rsa_get_mpi_d,
+};
+
+static int rsa_init_tfm(struct crypto_akcipher *tfm)
+{
+	struct rsa_ctx *ctx = akcipher_tfm_ctx(tfm);
+
+	ctx->action = &rsa_action;
+
+	return 0;
+}
+
 static void rsa_exit_tfm(struct crypto_akcipher *tfm)
 {
-	struct rsa_key *pkey = akcipher_tfm_ctx(tfm);
+	struct rsa_mpi_key *pkey = rsa_get_key(tfm);
 
-	rsa_free_key(pkey);
+	rsa_free_mpi_key(pkey);
 }
 
 static struct akcipher_alg rsa = {
@@ -304,13 +323,14 @@ static struct akcipher_alg rsa = {
 	.set_priv_key = rsa_set_priv_key,
 	.set_pub_key = rsa_set_pub_key,
 	.max_size = rsa_max_size,
+	.init = rsa_init_tfm,
 	.exit = rsa_exit_tfm,
 	.base = {
 		.cra_name = "rsa",
 		.cra_driver_name = "rsa-generic",
 		.cra_priority = 100,
 		.cra_module = THIS_MODULE,
-		.cra_ctxsize = sizeof(struct rsa_key),
+		.cra_ctxsize = sizeof(struct rsa_ctx),
 	},
 };
 
diff --git a/crypto/rsa_helper.c b/crypto/rsa_helper.c
index d226f48..0149ed3 100644
--- a/crypto/rsa_helper.c
+++ b/crypto/rsa_helper.c
@@ -21,7 +21,95 @@
 int rsa_get_n(void *context, size_t hdrlen, unsigned char tag,
 	      const void *value, size_t vlen)
 {
-	struct rsa_key *key = context;
+	const struct rsa_asn1_action **action = context;
+
+	if ((*action)->get_n)
+		return (*action)->get_n(context, value, vlen);
+
+	return 0;
+}
+
+int rsa_get_e(void *context, size_t hdrlen, unsigned char tag,
+	      const void *value, size_t vlen)
+{
+	const struct rsa_asn1_action **action = context;
+
+	if ((*action)->get_e)
+		return (*action)->get_e(context, value, vlen);
+
+	return 0;
+}
+
+int rsa_get_d(void *context, size_t hdrlen, unsigned char tag,
+	      const void *value, size_t vlen)
+{
+	const struct rsa_asn1_action **action = context;
+
+	if ((*action)->get_d)
+		return (*action)->get_d(context, value, vlen);
+
+	return 0;
+}
+
+int rsa_get_p(void *context, size_t hdrlen, unsigned char tag,
+	      const void *value, size_t vlen)
+{
+	const struct rsa_asn1_action **action = context;
+
+	if ((*action)->get_p)
+		return (*action)->get_p(context, value, vlen);
+
+	return 0;
+}
+
+int rsa_get_q(void *context, size_t hdrlen, unsigned char tag,
+	      const void *value, size_t vlen)
+{
+	const struct rsa_asn1_action **action = context;
+
+	if ((*action)->get_q)
+		return (*action)->get_q(context, value, vlen);
+
+	return 0;
+}
+
+int rsa_get_dp(void *context, size_t hdrlen, unsigned char tag,
+	       const void *value, size_t vlen)
+{
+	const struct rsa_asn1_action **action = context;
+
+	if ((*action)->get_dp)
+		return (*action)->get_dp(context, value, vlen);
+
+	return 0;
+}
+
+int rsa_get_dq(void *context, size_t hdrlen, unsigned char tag,
+	       const void *value, size_t vlen)
+{
+	const struct rsa_asn1_action **action = context;
+
+	if ((*action)->get_dq)
+		return (*action)->get_dq(context, value, vlen);
+
+	return 0;
+}
+
+int rsa_get_qinv(void *context, size_t hdrlen, unsigned char tag,
+		 const void *value, size_t vlen)
+{
+	const struct rsa_asn1_action **action = context;
+
+	if ((*action)->get_qinv)
+		return (*action)->get_qinv(context, value, vlen);
+
+	return 0;
+}
+
+int rsa_get_mpi_n(void *context, const void *value, size_t vlen)
+{
+	struct rsa_ctx *ctx = context;
+	struct rsa_mpi_key *key = &ctx->key;
 
 	key->n = mpi_read_raw_data(value, vlen);
 
@@ -38,11 +126,12 @@ int rsa_get_n(void *context, size_t hdrlen, unsigned char tag,
 	}
 	return 0;
 }
+EXPORT_SYMBOL_GPL(rsa_get_mpi_n);
 
-int rsa_get_e(void *context, size_t hdrlen, unsigned char tag,
-	      const void *value, size_t vlen)
+int rsa_get_mpi_e(void *context, const void *value, size_t vlen)
 {
-	struct rsa_key *key = context;
+	struct rsa_ctx *ctx = context;
+	struct rsa_mpi_key *key = &ctx->key;
 
 	key->e = mpi_read_raw_data(value, vlen);
 
@@ -51,11 +140,12 @@ int rsa_get_e(void *context, size_t hdrlen, unsigned char tag,
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(rsa_get_mpi_e);
 
-int rsa_get_d(void *context, size_t hdrlen, unsigned char tag,
-	      const void *value, size_t vlen)
+int rsa_get_mpi_d(void *context, const void *value, size_t vlen)
 {
-	struct rsa_key *key = context;
+	struct rsa_ctx *ctx = context;
+	struct rsa_mpi_key *key = &ctx->key;
 
 	key->d = mpi_read_raw_data(value, vlen);
 
@@ -72,8 +162,14 @@ int rsa_get_d(void *context, size_t hdrlen, unsigned char tag,
 	}
 	return 0;
 }
+EXPORT_SYMBOL_GPL(rsa_get_mpi_d);
 
-static void free_mpis(struct rsa_key *key)
+/**
+ * rsa_free_mpi_key() - frees rsa key allocated by rsa_parse_key()
+ *
+ * @rsa_mpi_key:	struct rsa_mpi_key key representation
+ */
+void rsa_free_mpi_key(struct rsa_mpi_key *key)
 {
 	mpi_free(key->n);
 	mpi_free(key->e);
@@ -82,68 +178,64 @@ static void free_mpis(struct rsa_key *key)
 	key->e = NULL;
 	key->d = NULL;
 }
+EXPORT_SYMBOL_GPL(rsa_free_mpi_key);
 
 /**
- * rsa_free_key() - frees rsa key allocated by rsa_parse_key()
+ * rsa_parse_mpi_pub_key() - extracts an RSA public key from BER encoded buffer
+ *			     and stores it in the provided context.
  *
- * @rsa_key:	struct rsa_key key representation
- */
-void rsa_free_key(struct rsa_key *key)
-{
-	free_mpis(key);
-}
-EXPORT_SYMBOL_GPL(rsa_free_key);
-
-/**
- * rsa_parse_pub_key() - extracts an rsa public key from BER encoded buffer
- *			 and stores it in the provided struct rsa_key
- *
- * @rsa_key:	struct rsa_key key representation
+ * @rsa_ctx:	RSA internal context
  * @key:	key in BER format
  * @key_len:	length of key
  *
  * Return:	0 on success or error code in case of error
  */
-int rsa_parse_pub_key(struct rsa_key *rsa_key, const void *key,
-		      unsigned int key_len)
+int rsa_parse_mpi_pub_key(struct rsa_ctx *ctx, const void *key,
+			  unsigned int key_len)
 {
+	struct rsa_mpi_key *rsa_key = &ctx->key;
 	int ret;
 
-	free_mpis(rsa_key);
-	ret = asn1_ber_decoder(&rsapubkey_decoder, rsa_key, key, key_len);
+	/* Free the old key if any */
+	rsa_free_mpi_key(rsa_key);
+
+	ret = asn1_ber_decoder(&rsapubkey_decoder, ctx, key, key_len);
 	if (ret < 0)
 		goto error;
 
 	return 0;
 error:
-	free_mpis(rsa_key);
+	rsa_free_mpi_key(rsa_key);
 	return ret;
 }
-EXPORT_SYMBOL_GPL(rsa_parse_pub_key);
+EXPORT_SYMBOL_GPL(rsa_parse_mpi_pub_key);
 
 /**
- * rsa_parse_pub_key() - extracts an rsa private key from BER encoded buffer
- *			 and stores it in the provided struct rsa_key
+ * rsa_parse_mpi_priv_key() - extracts an RSA private key from BER encoded
+ *			      buffer and stores it in the provided context.
  *
- * @rsa_key:	struct rsa_key key representation
+ * @rsa_ctx:	RSA internal context
  * @key:	key in BER format
  * @key_len:	length of key
  *
  * Return:	0 on success or error code in case of error
  */
-int rsa_parse_priv_key(struct rsa_key *rsa_key, const void *key,
-		       unsigned int key_len)
+int rsa_parse_mpi_priv_key(struct rsa_ctx *ctx, const void *key,
+			   unsigned int key_len)
 {
+	struct rsa_mpi_key *rsa_key = &ctx->key;
 	int ret;
 
-	free_mpis(rsa_key);
-	ret = asn1_ber_decoder(&rsaprivkey_decoder, rsa_key, key, key_len);
+	/* Free the old key if any */
+	rsa_free_mpi_key(rsa_key);
+
+	ret = asn1_ber_decoder(&rsaprivkey_decoder, ctx, key, key_len);
 	if (ret < 0)
 		goto error;
 
 	return 0;
 error:
-	free_mpis(rsa_key);
+	rsa_free_mpi_key(rsa_key);
 	return ret;
 }
-EXPORT_SYMBOL_GPL(rsa_parse_priv_key);
+EXPORT_SYMBOL_GPL(rsa_parse_mpi_priv_key);
diff --git a/include/crypto/internal/rsa.h b/include/crypto/internal/rsa.h
index c7585bd..f8ef7b1 100644
--- a/include/crypto/internal/rsa.h
+++ b/include/crypto/internal/rsa.h
@@ -14,19 +14,38 @@
 #define _RSA_HELPER_
 #include <linux/mpi.h>
 
-struct rsa_key {
+struct rsa_asn1_action {
+	int (*get_n)(void *context, const void *value, size_t vlen);
+	int (*get_e)(void *context, const void *value, size_t vlen);
+	int (*get_d)(void *context, const void *value, size_t vlen);
+	int (*get_p)(void *context, const void *value, size_t vlen);
+	int (*get_q)(void *context, const void *value, size_t vlen);
+	int (*get_dp)(void *context, const void *value, size_t vlen);
+	int (*get_dq)(void *context, const void *value, size_t vlen);
+	int (*get_qinv)(void *context, const void *value, size_t vlen);
+};
+
+struct rsa_mpi_key {
 	MPI n;
 	MPI e;
 	MPI d;
 };
 
-int rsa_parse_pub_key(struct rsa_key *rsa_key, const void *key,
-		      unsigned int key_len);
+struct rsa_ctx {
+	const struct rsa_asn1_action *action;
+	struct rsa_mpi_key key;
+};
+
+int rsa_get_mpi_n(void *context, const void *value, size_t vlen);
+int rsa_get_mpi_e(void *context, const void *value, size_t vlen);
+int rsa_get_mpi_d(void *context, const void *value, size_t vlen);
 
-int rsa_parse_priv_key(struct rsa_key *rsa_key, const void *key,
-		       unsigned int key_len);
+void rsa_free_mpi_key(struct rsa_mpi_key *key);
 
-void rsa_free_key(struct rsa_key *rsa_key);
+int rsa_parse_mpi_pub_key(struct rsa_ctx *ctx, const void *key,
+			  unsigned int key_len);
+int rsa_parse_mpi_priv_key(struct rsa_ctx *ctx, const void *key,
+			   unsigned int key_len);
 
 extern struct crypto_template rsa_pkcs1pad_tmpl;
 #endif
-- 
1.8.3.1

Re: [PATCH v3 1/3] crypto: rsa - generalize ASN.1 sequences

[Herbert Xu]

On Wed, Apr 06, 2016 at 04:37:04PM +0300, Tudor Ambarus wrote:
> Use common ASN.1 sequences for all RSA implementations.
> 
> Give hardware RSA implementations the chance to use
> the RSA's software implementation parser even if they
> are likely to want to use raw integers.
> 
> The parser expects a context that contains at the first address
> a pointer to a struct rsa_asn1_action instance that has function
> pointers to specific parser actions (return MPI or raw integer keys),
> followed by a key representation structure (for MPI or raw integers).
> 
> This approach has the advantage that users can select specific
> parser actions by using a general parser with function pointers
> to specific actions.

I don't understand why we need different parsing functions in the
first place.  Can't they just return raw integers always?

You can then trivially convert the raw integers to MPI, no?

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

RE: [PATCH v3 1/3] crypto: rsa - generalize ASN.1 sequences

[Tudor-Dan Ambarus]

> On Wed, Apr 06, 2016 at 04:37:04PM +0300, Tudor Ambarus wrote:
> > This approach has the advantage that users can select specific
> > parser actions by using a general parser with function pointers
> > to specific actions.
> 
> I don't understand why we need different parsing functions in the
> first place.  Can't they just return raw integers always?
> 
> You can then trivially convert the raw integers to MPI, no?

We need different parsing functions so that we don't allocate duplicate buffers for the same data.

You need to allocate buffers when getting the raw integers and you need to allocate other (duplicate) buffers when converting the raw integers to MPI.

Using the proposed API each user can select the format of data he wants, eliminating the need of a double conversion (with its drawbacks: duplicate buffers, unnecessary cycles).

Thanks,
ta

Re: [PATCH v3 1/3] crypto: rsa - generalize ASN.1 sequences

[Herbert Xu]

On Fri, Apr 15, 2016 at 02:32:42PM +0000, Tudor-Dan Ambarus wrote:
> > On Wed, Apr 06, 2016 at 04:37:04PM +0300, Tudor Ambarus wrote:
> > > This approach has the advantage that users can select specific
> > > parser actions by using a general parser with function pointers
> > > to specific actions.
> > 
> > I don't understand why we need different parsing functions in the
> > first place.  Can't they just return raw integers always?
> > 
> > You can then trivially convert the raw integers to MPI, no?
> 
> We need different parsing functions so that we don't allocate duplicate buffers for the same data.
> 
> You need to allocate buffers when getting the raw integers and you need to allocate other (duplicate) buffers when converting the raw integers to MPI.
> 
> Using the proposed API each user can select the format of data he wants, eliminating the need of a double conversion (with its drawbacks: duplicate buffers, unnecessary cycles).

The double allocation only happens with software RSA, right? I
don't really think that is going to matter considering how slow
it is, no?

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

RE: [PATCH v3 1/3] crypto: rsa - generalize ASN.1 sequences

[Tudor-Dan Ambarus]

> On Fri, Apr 15, 2016 at 02:32:42PM +0000, Tudor-Dan Ambarus wrote:
> > > On Wed, Apr 06, 2016 at 04:37:04PM +0300, Tudor Ambarus wrote:
> > > > This approach has the advantage that users can select specific
> > > > parser actions by using a general parser with function pointers
> > > > to specific actions.
> > >
> > > I don't understand why we need different parsing functions in the
> > > first place.  Can't they just return raw integers always?
> > >
> > > You can then trivially convert the raw integers to MPI, no?
> >
> > We need different parsing functions so that we don't allocate duplicate
> buffers for the same data.
> >
> > You need to allocate buffers when getting the raw integers and you need
> to allocate other (duplicate) buffers when converting the raw integers to
> MPI.
> >
> > Using the proposed API each user can select the format of data he wants,
> eliminating the need of a double conversion (with its drawbacks: duplicate
> buffers, unnecessary cycles).
> 
> The double allocation only happens with software RSA, right? I
> don't really think that is going to matter considering how slow
> it is, no?

The double allocation happens only with software RSA. I can't estimate the performance hit for the double conversion. Naturally is to parse the data only once. Plus, my suggestion is simple, faster and doesn't waste resources.

Thanks,
ta

RE: [PATCH v3 1/3] crypto: rsa - generalize ASN.1 sequences

[Tudor-Dan Ambarus]

Hi Herbert,

> > On Fri, Apr 15, 2016 at 02:32:42PM +0000, Tudor-Dan Ambarus wrote:
> > > > On Wed, Apr 06, 2016 at 04:37:04PM +0300, Tudor Ambarus wrote:
> > > > > This approach has the advantage that users can select specific
> > > > > parser actions by using a general parser with function pointers
> > > > > to specific actions.
> > > >
> > > > I don't understand why we need different parsing functions in the
> > > > first place.  Can't they just return raw integers always?
> > > >
> > > > You can then trivially convert the raw integers to MPI, no?
> > >
> > > We need different parsing functions so that we don't allocate duplicate
> > buffers for the same data.
> > >
> > > You need to allocate buffers when getting the raw integers and you need
> > to allocate other (duplicate) buffers when converting the raw integers to
> > MPI.
> > >
> > > Using the proposed API each user can select the format of data he
> wants,
> > eliminating the need of a double conversion (with its drawbacks:
> duplicate
> > buffers, unnecessary cycles).
> >
> > The double allocation only happens with software RSA, right? I
> > don't really think that is going to matter considering how slow
> > it is, no?
> 
> The double allocation happens only with software RSA. I can't estimate the
> performance hit for the double conversion. Naturally is to parse the data
> only once. Plus, my suggestion is simple, faster and doesn't waste
> resources.

Do you want me to address some suggestions, or do you intend to apply this patch set?

Thanks,
ta

Re: [PATCH v3 1/3] crypto: rsa - generalize ASN.1 sequences

[Herbert Xu]

On Mon, Apr 25, 2016 at 05:54:44AM +0000, Tudor-Dan Ambarus wrote:
>
> Do you want me to address some suggestions, or do you intend to apply this patch set?

Please ensure that we have exactly one parser for the RSA keys.
It should just return the raw integer with no other processing.

The software RSA implementation can then do the MPI conversion
on top.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

[PATCH v3 2/3] crypto: rsa_helper - add raw integer parser actions

[Tudor Ambarus]

Dedicated to RSA (hardware) implementations that want to use
raw integers instead of MPI keys.

Signed-off-by: Tudor Ambarus <tudor-dan.ambarus@nxp.com>
---
 crypto/rsa.c                  |  15 ----
 crypto/rsa_helper.c           | 182 ++++++++++++++++++++++++++++++++++++++++++
 include/crypto/internal/rsa.h |  28 +++++++
 3 files changed, 210 insertions(+), 15 deletions(-)

diff --git a/crypto/rsa.c b/crypto/rsa.c
index 7cb0153..37ac189 100644
--- a/crypto/rsa.c
+++ b/crypto/rsa.c
@@ -235,21 +235,6 @@ err_free_m:
 	return ret;
 }
 
-static int rsa_check_key_length(unsigned int len)
-{
-	switch (len) {
-	case 512:
-	case 1024:
-	case 1536:
-	case 2048:
-	case 3072:
-	case 4096:
-		return 0;
-	}
-
-	return -EINVAL;
-}
-
 static int rsa_set_pub_key(struct crypto_akcipher *tfm, const void *key,
 			   unsigned int keylen)
 {
diff --git a/crypto/rsa_helper.c b/crypto/rsa_helper.c
index 0149ed3..df1f480 100644
--- a/crypto/rsa_helper.c
+++ b/crypto/rsa_helper.c
@@ -14,6 +14,9 @@
 #include <linux/export.h>
 #include <linux/err.h>
 #include <linux/fips.h>
+#include <linux/slab.h>
+#include <linux/dma-mapping.h>
+#include <linux/device.h>
 #include <crypto/internal/rsa.h>
 #include "rsapubkey-asn1.h"
 #include "rsaprivkey-asn1.h"
@@ -239,3 +242,182 @@ error:
 	return ret;
 }
 EXPORT_SYMBOL_GPL(rsa_parse_mpi_priv_key);
+
+int rsa_check_key_length(unsigned int len)
+{
+	switch (len) {
+	case 512:
+	case 1024:
+	case 1536:
+	case 2048:
+	case 3072:
+	case 4096:
+		return 0;
+	}
+
+	return -EINVAL;
+}
+EXPORT_SYMBOL_GPL(rsa_check_key_length);
+
+void raw_rsa_free_key(struct rsa_raw_key *key)
+{
+	kzfree(key->d);
+	key->d = NULL;
+
+	kfree(key->e);
+	key->e = NULL;
+
+	kfree(key->n);
+	key->n = NULL;
+
+	key->n_sz = 0;
+	key->e_sz = 0;
+}
+EXPORT_SYMBOL_GPL(raw_rsa_free_key);
+
+void raw_rsa_free_coherent_key(struct device *dev, struct rsa_raw_key *key)
+{
+	if (key->d) {
+		memset(key->d, '\0', key->n_sz);
+		dma_free_coherent(dev, key->n_sz, key->d, key->dma_d);
+		key->d = NULL;
+	}
+
+	if (key->e) {
+		dma_free_coherent(dev, key->n_sz, key->e, key->dma_e);
+		key->e = NULL;
+	}
+
+	if (key->n) {
+		dma_free_coherent(dev, key->n_sz, key->n, key->dma_n);
+		key->n = NULL;
+	}
+
+	key->n_sz = 0;
+	key->e_sz = 0;
+}
+EXPORT_SYMBOL_GPL(raw_rsa_free_coherent_key);
+
+int raw_rsa_get_n(void *context, const void *value, size_t vlen)
+{
+	struct rsa_raw_ctx *ctx = context;
+	struct rsa_raw_key *key = &ctx->key;
+	const char *ptr = value;
+	int ret = -EINVAL;
+
+	while (!*ptr && vlen) {
+		ptr++;
+		vlen--;
+	}
+
+	key->n_sz = vlen;
+	/* In FIPS mode only allow key size 2K & 3K */
+	if (fips_enabled && (key->n_sz != 256 && key->n_sz != 384)) {
+		dev_err(ctx->dev, "RSA: key size not allowed in FIPS mode\n");
+		goto err;
+	}
+	/* invalid key size provided */
+	ret = rsa_check_key_length(key->n_sz << 3);
+	if (ret)
+		goto err;
+
+	if (key->is_coherent)
+		key->n = kzalloc(key->n_sz, key->flags);
+	else
+		key->n = dma_zalloc_coherent(ctx->dev, key->n_sz, &key->dma_n,
+					     key->flags);
+
+	if (!key->n) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	memcpy(key->n, ptr, key->n_sz);
+
+	return 0;
+err:
+	key->n_sz = 0;
+	key->n = NULL;
+	return ret;
+}
+EXPORT_SYMBOL_GPL(raw_rsa_get_n);
+
+int raw_rsa_get_e(void *context, const void *value, size_t vlen)
+{
+	struct rsa_raw_ctx *ctx = context;
+	struct rsa_raw_key *key = &ctx->key;
+	const char *ptr = value;
+	size_t offset = 0;
+
+	while (!*ptr && vlen) {
+		ptr++;
+		vlen--;
+	}
+
+	key->e_sz = vlen;
+
+	if (!key->n_sz || !vlen || vlen > key->n_sz) {
+		key->e = NULL;
+		return -EINVAL;
+	}
+
+	if (key->is_coherent) {
+		key->e = kzalloc(key->e_sz, key->flags);
+	} else {
+		key->e = dma_zalloc_coherent(ctx->dev, key->n_sz, &key->dma_e,
+					     key->flags);
+		offset = key->n_sz - vlen;
+	}
+
+	if (!key->e)
+		return -ENOMEM;
+
+	memcpy(key->e + offset, ptr, vlen);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(raw_rsa_get_e);
+
+int raw_rsa_get_d(void *context, const void *value, size_t vlen)
+{
+	struct rsa_raw_ctx *ctx = context;
+	struct rsa_raw_key *key = &ctx->key;
+	const char *ptr = value;
+	size_t offset = 0;
+	int ret = -EINVAL;
+
+	while (!*ptr && vlen) {
+		ptr++;
+		vlen--;
+	}
+
+	if (!key->n_sz || !vlen || vlen > key->n_sz)
+		goto err;
+
+	/* In FIPS mode only allow key size 2K & 3K */
+	if (fips_enabled && (vlen != 256 && vlen != 384)) {
+		dev_err(ctx->dev, "RSA: key size not allowed in FIPS mode\n");
+		goto err;
+	}
+
+	if (key->is_coherent) {
+		key->d = kzalloc(key->n_sz, key->flags);
+	} else {
+		key->d = dma_zalloc_coherent(ctx->dev, key->n_sz, &key->dma_d,
+					     key->flags);
+		offset = key->n_sz - vlen;
+	}
+
+	if (!key->d) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	memcpy(key->d + offset, ptr, vlen);
+
+	return 0;
+err:
+	key->d = NULL;
+	return ret;
+}
+EXPORT_SYMBOL_GPL(raw_rsa_get_d);
diff --git a/include/crypto/internal/rsa.h b/include/crypto/internal/rsa.h
index f8ef7b1..854b9b7 100644
--- a/include/crypto/internal/rsa.h
+++ b/include/crypto/internal/rsa.h
@@ -31,11 +31,30 @@ struct rsa_mpi_key {
 	MPI d;
 };
 
+struct rsa_raw_key {
+	u8 *n;
+	u8 *e;
+	u8 *d;
+	dma_addr_t dma_n;
+	dma_addr_t dma_e;
+	dma_addr_t dma_d;
+	size_t n_sz;
+	size_t e_sz;
+	bool is_coherent;
+	gfp_t flags;
+};
+
 struct rsa_ctx {
 	const struct rsa_asn1_action *action;
 	struct rsa_mpi_key key;
 };
 
+struct rsa_raw_ctx {
+	const struct rsa_asn1_action *action;
+	struct rsa_raw_key key;
+	struct device *dev;
+};
+
 int rsa_get_mpi_n(void *context, const void *value, size_t vlen);
 int rsa_get_mpi_e(void *context, const void *value, size_t vlen);
 int rsa_get_mpi_d(void *context, const void *value, size_t vlen);
@@ -47,5 +66,14 @@ int rsa_parse_mpi_pub_key(struct rsa_ctx *ctx, const void *key,
 int rsa_parse_mpi_priv_key(struct rsa_ctx *ctx, const void *key,
 			   unsigned int key_len);
 
+int rsa_check_key_length(unsigned int len);
+
+void raw_rsa_free_key(struct rsa_raw_key *key);
+void raw_rsa_free_coherent_key(struct device *dev, struct rsa_raw_key *key);
+
+int raw_rsa_get_n(void *context, const void *value, size_t vlen);
+int raw_rsa_get_e(void *context, const void *value, size_t vlen);
+int raw_rsa_get_d(void *context, const void *value, size_t vlen);
+
 extern struct crypto_template rsa_pkcs1pad_tmpl;
 #endif
-- 
1.8.3.1

Re: [PATCH v3 2/3] crypto: rsa_helper - add raw integer parser actions

[Stephan Mueller]

Am Mittwoch, 6. April 2016, 16:37:05 schrieb Tudor Ambarus:

Hi Tudor,

> Dedicated to RSA (hardware) implementations that want to use
> raw integers instead of MPI keys.
> 
> Signed-off-by: Tudor Ambarus <tudor-dan.ambarus@nxp.com>
> ---
>  crypto/rsa.c                  |  15 ----
>  crypto/rsa_helper.c           | 182
> ++++++++++++++++++++++++++++++++++++++++++ include/crypto/internal/rsa.h | 
> 28 +++++++
>  3 files changed, 210 insertions(+), 15 deletions(-)
> 
> diff --git a/crypto/rsa.c b/crypto/rsa.c
> index 7cb0153..37ac189 100644
> --- a/crypto/rsa.c
> +++ b/crypto/rsa.c
> @@ -235,21 +235,6 @@ err_free_m:
>  	return ret;
>  }
> 
> -static int rsa_check_key_length(unsigned int len)
> -{
> -	switch (len) {
> -	case 512:
> -	case 1024:
> -	case 1536:
> -	case 2048:
> -	case 3072:
> -	case 4096:
> -		return 0;
> -	}
> -
> -	return -EINVAL;
> -}
> -
>  static int rsa_set_pub_key(struct crypto_akcipher *tfm, const void *key,
>  			   unsigned int keylen)
>  {
> diff --git a/crypto/rsa_helper.c b/crypto/rsa_helper.c
> index 0149ed3..df1f480 100644
> --- a/crypto/rsa_helper.c
> +++ b/crypto/rsa_helper.c
> @@ -14,6 +14,9 @@
>  #include <linux/export.h>
>  #include <linux/err.h>
>  #include <linux/fips.h>
> +#include <linux/slab.h>
> +#include <linux/dma-mapping.h>
> +#include <linux/device.h>
>  #include <crypto/internal/rsa.h>
>  #include "rsapubkey-asn1.h"
>  #include "rsaprivkey-asn1.h"
> @@ -239,3 +242,182 @@ error:
>  	return ret;
>  }
>  EXPORT_SYMBOL_GPL(rsa_parse_mpi_priv_key);
> +
> +int rsa_check_key_length(unsigned int len)
> +{
> +	switch (len) {
> +	case 512:
> +	case 1024:
> +	case 1536:
> +	case 2048:
> +	case 3072:
> +	case 4096:
> +		return 0;
> +	}
> +
> +	return -EINVAL;
> +}
> +EXPORT_SYMBOL_GPL(rsa_check_key_length);

I assume we can remove that length check in the future and you just ported it 
to be en-par with the feature set of the current implementation?
> +
> +void raw_rsa_free_key(struct rsa_raw_key *key)
> +{
> +	kzfree(key->d);
> +	key->d = NULL;
> +
> +	kfree(key->e);
> +	key->e = NULL;
> +
> +	kfree(key->n);
> +	key->n = NULL;
> +
> +	key->n_sz = 0;
> +	key->e_sz = 0;
> +}
> +EXPORT_SYMBOL_GPL(raw_rsa_free_key);
> +
> +void raw_rsa_free_coherent_key(struct device *dev, struct rsa_raw_key *key)
> +{
> +	if (key->d) {
> +		memset(key->d, '\0', key->n_sz);

memzero_explicit, please

> +		dma_free_coherent(dev, key->n_sz, key->d, key->dma_d);
> +		key->d = NULL;
> +	}
> +
> +	if (key->e) {
> +		dma_free_coherent(dev, key->n_sz, key->e, key->dma_e);
> +		key->e = NULL;
> +	}
> +
> +	if (key->n) {
> +		dma_free_coherent(dev, key->n_sz, key->n, key->dma_n);
> +		key->n = NULL;
> +	}
> +
> +	key->n_sz = 0;
> +	key->e_sz = 0;
> +}
> +EXPORT_SYMBOL_GPL(raw_rsa_free_coherent_key);
> +
> +int raw_rsa_get_n(void *context, const void *value, size_t vlen)
> +{
> +	struct rsa_raw_ctx *ctx = context;
> +	struct rsa_raw_key *key = &ctx->key;
> +	const char *ptr = value;
> +	int ret = -EINVAL;
> +
> +	while (!*ptr && vlen) {
> +		ptr++;
> +		vlen--;
> +	}
> +
> +	key->n_sz = vlen;
> +	/* In FIPS mode only allow key size 2K & 3K */

Again, this only excludes 4k as this should be done in a subsequent patch, 
right?

> +	if (fips_enabled && (key->n_sz != 256 && key->n_sz != 384)) {
> +		dev_err(ctx->dev, "RSA: key size not allowed in FIPS mode\n");
> +		goto err;
> +	}
> +	/* invalid key size provided */
> +	ret = rsa_check_key_length(key->n_sz << 3);
> +	if (ret)
> +		goto err;
> +
> +	if (key->is_coherent)
> +		key->n = kzalloc(key->n_sz, key->flags);
> +	else
> +		key->n = dma_zalloc_coherent(ctx->dev, key->n_sz, &key->dma_n,
> +					     key->flags);
> +
> +	if (!key->n) {
> +		ret = -ENOMEM;
> +		goto err;
> +	}
> +
> +	memcpy(key->n, ptr, key->n_sz);
> +
> +	return 0;
> +err:
> +	key->n_sz = 0;
> +	key->n = NULL;
> +	return ret;
> +}
> +EXPORT_SYMBOL_GPL(raw_rsa_get_n);
> +
> +int raw_rsa_get_e(void *context, const void *value, size_t vlen)
> +{
> +	struct rsa_raw_ctx *ctx = context;
> +	struct rsa_raw_key *key = &ctx->key;
> +	const char *ptr = value;
> +	size_t offset = 0;
> +
> +	while (!*ptr && vlen) {
> +		ptr++;
> +		vlen--;
> +	}
> +
> +	key->e_sz = vlen;
> +
> +	if (!key->n_sz || !vlen || vlen > key->n_sz) {
> +		key->e = NULL;
> +		return -EINVAL;
> +	}
> +
> +	if (key->is_coherent) {
> +		key->e = kzalloc(key->e_sz, key->flags);
> +	} else {
> +		key->e = dma_zalloc_coherent(ctx->dev, key->n_sz, &key->dma_e,
> +					     key->flags);
> +		offset = key->n_sz - vlen;
> +	}
> +
> +	if (!key->e)
> +		return -ENOMEM;
> +
> +	memcpy(key->e + offset, ptr, vlen);
> +
> +	return 0;
> +}
> +EXPORT_SYMBOL_GPL(raw_rsa_get_e);
> +
> +int raw_rsa_get_d(void *context, const void *value, size_t vlen)
> +{
> +	struct rsa_raw_ctx *ctx = context;
> +	struct rsa_raw_key *key = &ctx->key;
> +	const char *ptr = value;
> +	size_t offset = 0;
> +	int ret = -EINVAL;
> +
> +	while (!*ptr && vlen) {
> +		ptr++;
> +		vlen--;
> +	}
> +
> +	if (!key->n_sz || !vlen || vlen > key->n_sz)
> +		goto err;
> +
> +	/* In FIPS mode only allow key size 2K & 3K */
> +	if (fips_enabled && (vlen != 256 && vlen != 384)) {
> +		dev_err(ctx->dev, "RSA: key size not allowed in FIPS mode\n");
> +		goto err;
> +	}
> +
> +	if (key->is_coherent) {
> +		key->d = kzalloc(key->n_sz, key->flags);
> +	} else {
> +		key->d = dma_zalloc_coherent(ctx->dev, key->n_sz, &key->dma_d,
> +					     key->flags);
> +		offset = key->n_sz - vlen;
> +	}
> +
> +	if (!key->d) {
> +		ret = -ENOMEM;
> +		goto err;
> +	}
> +
> +	memcpy(key->d + offset, ptr, vlen);
> +
> +	return 0;
> +err:
> +	key->d = NULL;
> +	return ret;
> +}
> +EXPORT_SYMBOL_GPL(raw_rsa_get_d);
> diff --git a/include/crypto/internal/rsa.h b/include/crypto/internal/rsa.h
> index f8ef7b1..854b9b7 100644
> --- a/include/crypto/internal/rsa.h
> +++ b/include/crypto/internal/rsa.h
> @@ -31,11 +31,30 @@ struct rsa_mpi_key {
>  	MPI d;
>  };
> 
> +struct rsa_raw_key {
> +	u8 *n;
> +	u8 *e;
> +	u8 *d;
> +	dma_addr_t dma_n;
> +	dma_addr_t dma_e;
> +	dma_addr_t dma_d;
> +	size_t n_sz;
> +	size_t e_sz;
> +	bool is_coherent;
> +	gfp_t flags;
> +};
> +
>  struct rsa_ctx {
>  	const struct rsa_asn1_action *action;
>  	struct rsa_mpi_key key;
>  };
> 
> +struct rsa_raw_ctx {
> +	const struct rsa_asn1_action *action;
> +	struct rsa_raw_key key;
> +	struct device *dev;
> +};
> +
>  int rsa_get_mpi_n(void *context, const void *value, size_t vlen);
>  int rsa_get_mpi_e(void *context, const void *value, size_t vlen);
>  int rsa_get_mpi_d(void *context, const void *value, size_t vlen);
> @@ -47,5 +66,14 @@ int rsa_parse_mpi_pub_key(struct rsa_ctx *ctx, const void
> *key, int rsa_parse_mpi_priv_key(struct rsa_ctx *ctx, const void *key,
>  			   unsigned int key_len);
> 
> +int rsa_check_key_length(unsigned int len);
> +
> +void raw_rsa_free_key(struct rsa_raw_key *key);
> +void raw_rsa_free_coherent_key(struct device *dev, struct rsa_raw_key
> *key); +
> +int raw_rsa_get_n(void *context, const void *value, size_t vlen);
> +int raw_rsa_get_e(void *context, const void *value, size_t vlen);
> +int raw_rsa_get_d(void *context, const void *value, size_t vlen);
> +
>  extern struct crypto_template rsa_pkcs1pad_tmpl;
>  #endif


Ciao
Stephan

RE: [PATCH v3 2/3] crypto: rsa_helper - add raw integer parser actions

[Tudor-Dan Ambarus]

Hi Stephan,

I was out of office, sorry for the delay.

> Am Mittwoch, 6. April 2016, 16:37:05 schrieb Tudor Ambarus:
> 
> > +int rsa_check_key_length(unsigned int len)
> > +{
> > +	switch (len) {
> > +	case 512:
> > +	case 1024:
> > +	case 1536:
> > +	case 2048:
> > +	case 3072:
> > +	case 4096:
> > +		return 0;
> > +	}
> > +
> > +	return -EINVAL;
> > +}
> > +EXPORT_SYMBOL_GPL(rsa_check_key_length);
> 
> I assume we can remove that length check in the future and you just ported
> it
> to be en-par with the feature set of the current implementation?

Yes, this is how we agreed. Removing this limitation is a fix for the current implementation and should be treated in an explicit patch. It's not in the scope of this patch set, we will do it later.

> > +void raw_rsa_free_coherent_key(struct device *dev, struct rsa_raw_key
> *key)
> > +{
> > +	if (key->d) {
> > +		memset(key->d, '\0', key->n_sz);
> 
> memzero_explicit, please

I don't think this is really needed. memzero_explicit is used only on stack variables that get cleared just before they go out of scope.

> 
> > +		dma_free_coherent(dev, key->n_sz, key->d, key->dma_d);
> > +		key->d = NULL;
> > +	}
> > +
> > +	if (key->e) {
> > +		dma_free_coherent(dev, key->n_sz, key->e, key->dma_e);
> > +		key->e = NULL;
> > +	}
> > +
> > +	if (key->n) {
> > +		dma_free_coherent(dev, key->n_sz, key->n, key->dma_n);
> > +		key->n = NULL;
> > +	}
> > +
> > +	key->n_sz = 0;
> > +	key->e_sz = 0;
> > +}
> > +EXPORT_SYMBOL_GPL(raw_rsa_free_coherent_key);
> > +
> > +int raw_rsa_get_n(void *context, const void *value, size_t vlen)
> > +{
> > +	struct rsa_raw_ctx *ctx = context;
> > +	struct rsa_raw_key *key = &ctx->key;
> > +	const char *ptr = value;
> > +	int ret = -EINVAL;
> > +
> > +	while (!*ptr && vlen) {
> > +		ptr++;
> > +		vlen--;
> > +	}
> > +
> > +	key->n_sz = vlen;
> > +	/* In FIPS mode only allow key size 2K & 3K */
> 
> Again, this only excludes 4k as this should be done in a subsequent patch,
> right?

Yes, this will be addressed in an explicit patch. It's an update that is not in the scope of this patch set.

Stephan, thank you for the review!

ta

Re: [PATCH v3 2/3] crypto: rsa_helper - add raw integer parser actions

[Stephan Mueller]

Am Donnerstag, 14. April 2016, 15:25:17 schrieb Tudor-Dan Ambarus:

Hi Tudor,

> > 
> > > +{
> > > +	if (key->d) {
> > > +		memset(key->d, '\0', key->n_sz);
> > 
> > memzero_explicit, please
> 
> I don't think this is really needed. memzero_explicit is used only on stack
> variables that get cleared just before they go out of scope.

Are you so sure that a compiler is not getting smart on seeing a memset 
followed by a free without marking the pointer as volatile? You free the 
pointer immediately after memset(). I would not want to bet anything that a 
compiler would leave the memset for non-volatile pointers.

Besides, memzero_expicit does not cost anything -- it does not add any 
instruction but convinces the compiler to not optimize it away.

Ciao
Stephan

Re: [PATCH v3 2/3] crypto: rsa_helper - add raw integer parser actions

[Herbert Xu]

On Thu, Apr 14, 2016 at 05:38:08PM +0200, Stephan Mueller wrote:
>
> > I don't think this is really needed. memzero_explicit is used only on stack
> > variables that get cleared just before they go out of scope.
> 
> Are you so sure that a compiler is not getting smart on seeing a memset 
> followed by a free without marking the pointer as volatile? You free the 
> pointer immediately after memset(). I would not want to bet anything that a 
> compiler would leave the memset for non-volatile pointers.
> 
> Besides, memzero_expicit does not cost anything -- it does not add any 
> instruction but convinces the compiler to not optimize it away.

memzero_explicit is only meant for stack pointers, so there is
no need to use it here.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH v3 2/3] crypto: rsa_helper - add raw integer parser actions

[Jeffrey Walton]

> +int rsa_check_key_length(unsigned int len)
> +{
> +       switch (len) {
> +       case 512:
> +       case 1024:
> +       case 1536:
> +       case 2048:
> +       case 3072:
> +       case 4096:
> +               return 0;
> +       }
> +
> +       return -EINVAL;
> +}

That's an unusual restriction.

> +       key->n_sz = vlen;
> +       /* In FIPS mode only allow key size 2K & 3K */
> +       if (fips_enabled && (key->n_sz != 256 && key->n_sz != 384)) {
> +               dev_err(ctx->dev, "RSA: key size not allowed in FIPS mode\n");
> +               goto err;
> +       }

That's an unusual restriction, too. As far as I know, FIPS does not
place that restriction.

Jeff

Re: [PATCH v3 2/3] crypto: rsa_helper - add raw integer parser actions

[Stephan Mueller]

Am Freitag, 8. April 2016, 12:54:10 schrieb Jeffrey Walton:

Hi Jeffrey,

> > +int rsa_check_key_length(unsigned int len)
> > +{
> > +       switch (len) {
> > +       case 512:
> > +       case 1024:
> > +       case 1536:
> > +       case 2048:
> > +       case 3072:
> > +       case 4096:
> > +               return 0;
> > +       }
> > +
> > +       return -EINVAL;
> > +}
> 
> That's an unusual restriction.
> 
> > +       key->n_sz = vlen;
> > +       /* In FIPS mode only allow key size 2K & 3K */
> > +       if (fips_enabled && (key->n_sz != 256 && key->n_sz != 384)) {
> > +               dev_err(ctx->dev, "RSA: key size not allowed in FIPS
> > mode\n"); +               goto err;
> > +       }
> 
> That's an unusual restriction, too. As far as I know, FIPS does not
> place that restriction.

It does, see SP80-131A and the requirements on CAVS.

Very lately they added 4k too, hence my question.
> 
> Jeff


Ciao
Stephan

Re: [PATCH v3 2/3] crypto: rsa_helper - add raw integer parser actions

[Jeffrey Walton]

On Fri, Apr 8, 2016 at 12:55 PM, Stephan Mueller <smueller@chronox.de> wrote:
> Am Freitag, 8. April 2016, 12:54:10 schrieb Jeffrey Walton:
>
> Hi Jeffrey,
>
>> > +int rsa_check_key_length(unsigned int len)
>> > +{
>> > +       switch (len) {
>> > +       case 512:
>> > +       case 1024:
>> > +       case 1536:
>> > +       case 2048:
>> > +       case 3072:
>> > +       case 4096:
>> > +               return 0;
>> > +       }
>> > +
>> > +       return -EINVAL;
>> > +}
>>
>> That's an unusual restriction.
>>
>> > +       key->n_sz = vlen;
>> > +       /* In FIPS mode only allow key size 2K & 3K */
>> > +       if (fips_enabled && (key->n_sz != 256 && key->n_sz != 384)) {
>> > +               dev_err(ctx->dev, "RSA: key size not allowed in FIPS
>> > mode\n"); +               goto err;
>> > +       }
>>
>> That's an unusual restriction, too. As far as I know, FIPS does not
>> place that restriction.
>
> It does, see SP80-131A and the requirements on CAVS.

I believe the controlling document is SP800-56B. SP800-131 is just a
guide, and it digests the information from SP800-56B. For current FIPS
140 requirements (SP800-56B), RSA is a Finite Filed (FF) system, and
the requirement is |N| >= 2048.

Also, I did not see the restriction listed in SP800-131A Rev 1. Cf.,
http://csrc.nist.gov/publications/drafts/800-131A/sp800-131a_r1_draft.pdf.

Jeff

Re: [PATCH v3 2/3] crypto: rsa_helper - add raw integer parser actions

[Stephan Mueller]

Am Freitag, 8. April 2016, 13:09:02 schrieb Jeffrey Walton:

Hi Jeffrey,

> On Fri, Apr 8, 2016 at 12:55 PM, Stephan Mueller <smueller@chronox.de> 
wrote:
> > Am Freitag, 8. April 2016, 12:54:10 schrieb Jeffrey Walton:
> > 
> > Hi Jeffrey,
> > 
> >> > +int rsa_check_key_length(unsigned int len)
> >> > +{
> >> > +       switch (len) {
> >> > +       case 512:
> >> > +       case 1024:
> >> > +       case 1536:
> >> > +       case 2048:
> >> > +       case 3072:
> >> > +       case 4096:
> >> > +               return 0;
> >> > +       }
> >> > +
> >> > +       return -EINVAL;
> >> > +}
> >> 
> >> That's an unusual restriction.
> >> 
> >> > +       key->n_sz = vlen;
> >> > +       /* In FIPS mode only allow key size 2K & 3K */
> >> > +       if (fips_enabled && (key->n_sz != 256 && key->n_sz != 384)) {
> >> > +               dev_err(ctx->dev, "RSA: key size not allowed in FIPS
> >> > mode\n"); +               goto err;
> >> > +       }
> >> 
> >> That's an unusual restriction, too. As far as I know, FIPS does not
> >> place that restriction.
> > 
> > It does, see SP80-131A and the requirements on CAVS.
> 
> I believe the controlling document is SP800-56B. SP800-131 is just a
> guide, and it digests the information from SP800-56B. For current FIPS
> 140 requirements (SP800-56B), RSA is a Finite Filed (FF) system, and
> the requirement is |N| >= 2048.

To be clear, SP800-131A requires that only 2k or higher is allowed. The second 
constraint comes in with CAVS: you can only test 2k and 3k (and lately 4k) 
RSA. As the requirement is to have CAVS certs, you can therefore only get 
2k/3k/4k CAVS certs.

> 
> Also, I did not see the restriction listed in SP800-131A Rev 1. Cf.,
> http://csrc.nist.gov/publications/drafts/800-131A/sp800-131a_r1_draft.pdf.
> 
> Jeff


Ciao
Stephan

[PATCH v3 3/3] crypto: rsa_helper - export symbols for asn1 structures

[Tudor Ambarus]

Export rsapubkey_decoder and rsaprivkey_decoder structures,
since they can (will) be used by caam and qat drivers.

Signed-off-by: Tudor Ambarus <tudor-dan.ambarus@nxp.com>
---
 crypto/rsa_helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/crypto/rsa_helper.c b/crypto/rsa_helper.c
index df1f480..d81a0ec 100644
--- a/crypto/rsa_helper.c
+++ b/crypto/rsa_helper.c
@@ -21,6 +21,9 @@
 #include "rsapubkey-asn1.h"
 #include "rsaprivkey-asn1.h"
 
+EXPORT_SYMBOL_GPL(rsapubkey_decoder);
+EXPORT_SYMBOL_GPL(rsaprivkey_decoder);
+
 int rsa_get_n(void *context, size_t hdrlen, unsigned char tag,
 	      const void *value, size_t vlen)
 {
-- 
1.8.3.1