[PATCH 0/3] crypto: ecdh - register NIST P384

[PATCH 0/3] crypto: ecdh - register NIST P384

[Hui Tang]

Register NIST P384 tfm and extend the testmgr with NIST P384 test vectors.

Summary of changes:

* crypto/ecdh.c
  - fix 'ecdh_init' not unregistering NIST P192
  - add ecdh_nist_p384_init_tfm
  - register and unregister P384 tfm

* crypto/testmgr.c
  - add test vector for P384 on vector of tests

* crypto/testmgr.h
  - add test vector params for P384

Hui Tang (3):
  crypto: ecdh - fix 'ecdh_init'
  crypto: ecdh - register NIST P384 tfm
  crypto: ecdh - add test suite for NIST P384

 crypto/ecdh.c    | 44 +++++++++++++++++++++++++++++++++++++++-
 crypto/testmgr.c |  7 +++++++
 crypto/testmgr.h | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 111 insertions(+), 1 deletion(-)

--
2.8.1

[PATCH 1/3] crypto: ecdh - fix 'ecdh_init'

[Hui Tang]

NIST P192 is not unregistered if failed to register NIST P256,
actually it need to unregister the algorithms already registered.

Signed-off-by: Hui Tang <tanghui20@huawei.com>
---
 crypto/ecdh.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/crypto/ecdh.c b/crypto/ecdh.c
index 07eb34f..65fb685 100644
--- a/crypto/ecdh.c
+++ b/crypto/ecdh.c
@@ -182,7 +182,16 @@ static int ecdh_init(void)
 	ret = crypto_register_kpp(&ecdh_nist_p192);
 	ecdh_nist_p192_registered = ret == 0;
 
-	return crypto_register_kpp(&ecdh_nist_p256);
+	ret = crypto_register_kpp(&ecdh_nist_p256);
+	if (ret)
+		goto nist_p256_error;
+
+	return 0;
+
+nist_p256_error:
+	if (ecdh_nist_p192_registered)
+		crypto_unregister_kpp(&ecdh_nist_p192);
+	return ret;
 }
 
 static void ecdh_exit(void)
-- 
2.8.1

[PATCH 2/3] crypto: ecdh - register NIST P384 tfm

[Hui Tang]

Add ecdh_nist_p384_init_tfm and register and unregister P384 tfm.

Signed-off-by: Hui Tang <tanghui20@huawei.com>
---
 crypto/ecdh.c | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/crypto/ecdh.c b/crypto/ecdh.c
index 65fb685..cae79da 100644
--- a/crypto/ecdh.c
+++ b/crypto/ecdh.c
@@ -173,6 +173,31 @@ static struct kpp_alg ecdh_nist_p256 = {
 	},
 };
 
+static int ecdh_nist_p384_init_tfm(struct crypto_kpp *tfm)
+{
+	struct ecdh_ctx *ctx = ecdh_get_ctx(tfm);
+
+	ctx->curve_id = ECC_CURVE_NIST_P384;
+	ctx->ndigits = ECC_CURVE_NIST_P384_DIGITS;
+
+	return 0;
+}
+
+static struct kpp_alg ecdh_nist_p384 = {
+	.set_secret = ecdh_set_secret,
+	.generate_public_key = ecdh_compute_value,
+	.compute_shared_secret = ecdh_compute_value,
+	.max_size = ecdh_max_size,
+	.init = ecdh_nist_p384_init_tfm,
+	.base = {
+		.cra_name = "ecdh-nist-p384",
+		.cra_driver_name = "ecdh-nist-p384-generic",
+		.cra_priority = 100,
+		.cra_module = THIS_MODULE,
+		.cra_ctxsize = sizeof(struct ecdh_ctx),
+	},
+};
+
 static bool ecdh_nist_p192_registered;
 
 static int ecdh_init(void)
@@ -186,8 +211,15 @@ static int ecdh_init(void)
 	if (ret)
 		goto nist_p256_error;
 
+	ret = crypto_register_kpp(&ecdh_nist_p384);
+	if (ret)
+		goto nist_p384_error;
+
 	return 0;
 
+nist_p384_error:
+	crypto_unregister_kpp(&ecdh_nist_p256);
+
 nist_p256_error:
 	if (ecdh_nist_p192_registered)
 		crypto_unregister_kpp(&ecdh_nist_p192);
@@ -199,6 +231,7 @@ static void ecdh_exit(void)
 	if (ecdh_nist_p192_registered)
 		crypto_unregister_kpp(&ecdh_nist_p192);
 	crypto_unregister_kpp(&ecdh_nist_p256);
+	crypto_unregister_kpp(&ecdh_nist_p384);
 }
 
 subsys_initcall(ecdh_init);
-- 
2.8.1

[PATCH 3/3] crypto: ecdh - add test suite for NIST P384

[Hui Tang]

Add test vector params for NIST P384, add test vector for
NIST P384 on vector of tests.

Vector param from:
https://datatracker.ietf.org/doc/html/rfc5903#section-3.1

Signed-off-by: Hui Tang <tanghui20@huawei.com>
---
 crypto/testmgr.c |  7 +++++++
 crypto/testmgr.h | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+)

diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 10c5b3b..e79cbf6 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -4915,6 +4915,13 @@ static const struct alg_test_desc alg_test_descs[] = {
 			.kpp = __VECS(ecdh_p256_tv_template)
 		}
 	}, {
+		.alg = "ecdh-nist-p384",
+		.test = alg_test_kpp,
+		.fips_allowed = 1,
+		.suite = {
+			.kpp = __VECS(ecdh_p384_tv_template)
+		}
+	}, {
 		.alg = "ecdsa-nist-p192",
 		.test = alg_test_akcipher,
 		.suite = {
diff --git a/crypto/testmgr.h b/crypto/testmgr.h
index aead75d..3d74b518 100644
--- a/crypto/testmgr.h
+++ b/crypto/testmgr.h
@@ -2814,6 +2814,67 @@ static const struct kpp_testvec ecdh_p256_tv_template[] = {
 };
 
 /*
+ * NIST P384 test vectors from RFC5903
+ */
+static const struct kpp_testvec ecdh_p384_tv_template[] = {
+	{
+	.secret =
+#ifdef __LITTLE_ENDIAN
+	"\x02\x00" /* type */
+	"\x36\x00" /* len */
+	"\x30\x00" /* key_size */
+#else
+	"\x00\x02" /* type */
+	"\x00\x36" /* len */
+	"\x00\x30" /* key_size */
+#endif
+	"\x09\x9F\x3C\x70\x34\xD4\xA2\xC6"
+	"\x99\x88\x4D\x73\xA3\x75\xA6\x7F"
+	"\x76\x24\xEF\x7C\x6B\x3C\x0F\x16"
+	"\x06\x47\xB6\x74\x14\xDC\xE6\x55"
+	"\xE3\x5B\x53\x80\x41\xE6\x49\xEE"
+	"\x3F\xAE\xF8\x96\x78\x3A\xB1\x94",
+	.b_public =
+	"\xE5\x58\xDB\xEF\x53\xEE\xCD\xE3"
+	"\xD3\xFC\xCF\xC1\xAE\xA0\x8A\x89"
+	"\xA9\x87\x47\x5D\x12\xFD\x95\x0D"
+	"\x83\xCF\xA4\x17\x32\xBC\x50\x9D"
+	"\x0D\x1A\xC4\x3A\x03\x36\xDE\xF9"
+	"\x6F\xDA\x41\xD0\x77\x4A\x35\x71"
+	"\xDC\xFB\xEC\x7A\xAC\xF3\x19\x64"
+	"\x72\x16\x9E\x83\x84\x30\x36\x7F"
+	"\x66\xEE\xBE\x3C\x6E\x70\xC4\x16"
+	"\xDD\x5F\x0C\x68\x75\x9D\xD1\xFF"
+	"\xF8\x3F\xA4\x01\x42\x20\x9D\xFF"
+	"\x5E\xAA\xD9\x6D\xB9\xE6\x38\x6C",
+	.expected_a_public =
+	"\x66\x78\x42\xD7\xD1\x80\xAC\x2C"
+	"\xDE\x6F\x74\xF3\x75\x51\xF5\x57"
+	"\x55\xC7\x64\x5C\x20\xEF\x73\xE3"
+	"\x16\x34\xFE\x72\xB4\xC5\x5E\xE6"
+	"\xDE\x3A\xC8\x08\xAC\xB4\xBD\xB4"
+	"\xC8\x87\x32\xAE\xE9\x5F\x41\xAA"
+	"\x94\x82\xED\x1F\xC0\xEE\xB9\xCA"
+	"\xFC\x49\x84\x62\x5C\xCF\xC2\x3F"
+	"\x65\x03\x21\x49\xE0\xE1\x44\xAD"
+	"\xA0\x24\x18\x15\x35\xA0\xF3\x8E"
+	"\xEB\x9F\xCF\xF3\xC2\xC9\x47\xDA"
+	"\xE6\x9B\x4C\x63\x45\x73\xA8\x1C",
+	.expected_ss =
+	"\x11\x18\x73\x31\xC2\x79\x96\x2D"
+	"\x93\xD6\x04\x24\x3F\xD5\x92\xCB"
+	"\x9D\x0A\x92\x6F\x42\x2E\x47\x18"
+	"\x75\x21\x28\x7E\x71\x56\xC5\xC4"
+	"\xD6\x03\x13\x55\x69\xB9\xE9\xD0"
+	"\x9C\xF5\xD4\xA2\x70\xF5\x97\x46",
+	.secret_size = 54,
+	.b_public_size = 96,
+	.expected_a_public_size = 96,
+	.expected_ss_size = 48
+	}
+};
+
+/*
  * MD4 test vectors from RFC1320
  */
 static const struct hash_testvec md4_tv_template[] = {
-- 
2.8.1

Re: [PATCH 1/3] crypto: ecdh - fix 'ecdh_init'

[Herbert Xu]

On Wed, May 12, 2021 at 02:40:00PM +0800, Hui Tang wrote:
> NIST P192 is not unregistered if failed to register NIST P256,
> actually it need to unregister the algorithms already registered.
> 
> Signed-off-by: Hui Tang <tanghui20@huawei.com>
> ---
>  crypto/ecdh.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)

Thanks for catching this.  The variable ecdh_nist_p192_registered
is bogus.  You should just make it so that if p192 fails to
register then the init function aborts.  There would then be
no need to check for the registered state in the exit function.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH 1/3] crypto: ecdh - fix 'ecdh_init'

[Hui Tang]

On 2021/5/21 15:45, Herbert Xu wrote:
> On Wed, May 12, 2021 at 02:40:00PM +0800, Hui Tang wrote:
>> NIST P192 is not unregistered if failed to register NIST P256,
>> actually it need to unregister the algorithms already registered.
>>
>> Signed-off-by: Hui Tang <tanghui20@huawei.com>
>> ---
>>  crypto/ecdh.c | 11 ++++++++++-
>>  1 file changed, 10 insertions(+), 1 deletion(-)
>
> Thanks for catching this.  The variable ecdh_nist_p192_registered
> is bogus.  You should just make it so that if p192 fails to
> register then the init function aborts.  There would then be
> no need to check for the registered state in the exit function.
>

Okay, I will fix it in next version, and 'ecdsa_init' should
do the same thing too?

>

Re: [PATCH 1/3] crypto: ecdh - fix 'ecdh_init'

[Herbert Xu]

On Fri, May 21, 2021 at 04:08:10PM +0800, Hui Tang wrote:
> 
> On 2021/5/21 15:45, Herbert Xu wrote:
> > On Wed, May 12, 2021 at 02:40:00PM +0800, Hui Tang wrote:
> > > NIST P192 is not unregistered if failed to register NIST P256,
> > > actually it need to unregister the algorithms already registered.
> > > 
> > > Signed-off-by: Hui Tang <tanghui20@huawei.com>
> > > ---
> > >  crypto/ecdh.c | 11 ++++++++++-
> > >  1 file changed, 10 insertions(+), 1 deletion(-)
> > 
> > Thanks for catching this.  The variable ecdh_nist_p192_registered
> > is bogus.  You should just make it so that if p192 fails to
> > register then the init function aborts.  There would then be
> > no need to check for the registered state in the exit function.
> 
> Okay, I will fix it in next version, and 'ecdsa_init' should
> do the same thing too?

Actually, it looks like it is needed for FIPS.  We should add
a comment that p192 will fail to register in FIPS mode and that's
why there is a check for it.

Funnily enough, ecdsa has the FIPS comment but testmgr doesn't
set fips_allowed for any of them while ecdh is set but has no
comment.

Stephan, can you confirm that both ecdh-nist-p192 and ecdsa-nist-p192
should be disabled in FIPS mode?

Also, we should fix ecdh-nist-p192's entry in testmgr by removing
the ifdefs and not setting fips_allowed.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH 1/3] crypto: ecdh - fix 'ecdh_init'

[Stephan Mueller]

Am Freitag, dem 21.05.2021 um 16:13 +0800 schrieb Herbert Xu:
> On Fri, May 21, 2021 at 04:08:10PM +0800, Hui Tang wrote:
> 
> 
> Stephan, can you confirm that both ecdh-nist-p192 and ecdsa-nist-p192
> should be disabled in FIPS mode?

Confirmed with the following caveat: sigver is allowed due to legacy
considerations. Siggen / ECDH is only allowed for curves P-224 and higher.

As we introduce ECDSA today, I would not consider a legacy mode and thus
disable P-192.

Ciao
Stephan