Thomas Gleixner | b4d0d23 | 2019-05-20 19:08:01 +0200 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0-or-later |
David Howells | 4ae71c1 | 2012-09-21 23:25:04 +0100 | [diff] [blame] | 2 | /* Signature verification with an asymmetric key |
| 3 | * |
Mauro Carvalho Chehab | 0efaaa8 | 2020-06-15 08:50:08 +0200 | [diff] [blame] | 4 | * See Documentation/crypto/asymmetric-keys.rst |
David Howells | 4ae71c1 | 2012-09-21 23:25:04 +0100 | [diff] [blame] | 5 | * |
| 6 | * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. |
| 7 | * Written by David Howells (dhowells@redhat.com) |
David Howells | 4ae71c1 | 2012-09-21 23:25:04 +0100 | [diff] [blame] | 8 | */ |
| 9 | |
David Howells | c3ce6df | 2014-09-02 13:52:15 +0100 | [diff] [blame] | 10 | #define pr_fmt(fmt) "SIG: "fmt |
David Howells | 4ae71c1 | 2012-09-21 23:25:04 +0100 | [diff] [blame] | 11 | #include <keys/asymmetric-subtype.h> |
Paul Gortmaker | 1f6a9ab | 2015-12-09 15:05:28 -0500 | [diff] [blame] | 12 | #include <linux/export.h> |
David Howells | 4ae71c1 | 2012-09-21 23:25:04 +0100 | [diff] [blame] | 13 | #include <linux/err.h> |
David Howells | 3b76456 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 14 | #include <linux/slab.h> |
David Howells | 5a30771 | 2018-10-09 17:47:07 +0100 | [diff] [blame] | 15 | #include <linux/keyctl.h> |
David Howells | 4ae71c1 | 2012-09-21 23:25:04 +0100 | [diff] [blame] | 16 | #include <crypto/public_key.h> |
David Howells | 5a30771 | 2018-10-09 17:47:07 +0100 | [diff] [blame] | 17 | #include <keys/user-type.h> |
David Howells | 4ae71c1 | 2012-09-21 23:25:04 +0100 | [diff] [blame] | 18 | #include "asymmetric_keys.h" |
| 19 | |
David Howells | 3b76456 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 20 | /* |
| 21 | * Destroy a public key signature. |
| 22 | */ |
| 23 | void public_key_signature_free(struct public_key_signature *sig) |
| 24 | { |
David Howells | a022ec0 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 25 | int i; |
| 26 | |
David Howells | 3b76456 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 27 | if (sig) { |
David Howells | a022ec0 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 28 | for (i = 0; i < ARRAY_SIZE(sig->auth_ids); i++) |
| 29 | kfree(sig->auth_ids[i]); |
David Howells | 3b76456 | 2016-04-06 16:13:33 +0100 | [diff] [blame] | 30 | kfree(sig->s); |
| 31 | kfree(sig->digest); |
| 32 | kfree(sig); |
| 33 | } |
| 34 | } |
| 35 | EXPORT_SYMBOL_GPL(public_key_signature_free); |
| 36 | |
David Howells | 4ae71c1 | 2012-09-21 23:25:04 +0100 | [diff] [blame] | 37 | /** |
David Howells | 5a30771 | 2018-10-09 17:47:07 +0100 | [diff] [blame] | 38 | * query_asymmetric_key - Get information about an aymmetric key. |
| 39 | * @params: Various parameters. |
| 40 | * @info: Where to put the information. |
| 41 | */ |
| 42 | int query_asymmetric_key(const struct kernel_pkey_params *params, |
| 43 | struct kernel_pkey_query *info) |
| 44 | { |
| 45 | const struct asymmetric_key_subtype *subtype; |
| 46 | struct key *key = params->key; |
| 47 | int ret; |
| 48 | |
| 49 | pr_devel("==>%s()\n", __func__); |
| 50 | |
| 51 | if (key->type != &key_type_asymmetric) |
| 52 | return -EINVAL; |
| 53 | subtype = asymmetric_key_subtype(key); |
| 54 | if (!subtype || |
| 55 | !key->payload.data[0]) |
| 56 | return -EINVAL; |
| 57 | if (!subtype->query) |
| 58 | return -ENOTSUPP; |
| 59 | |
| 60 | ret = subtype->query(params, info); |
| 61 | |
| 62 | pr_devel("<==%s() = %d\n", __func__, ret); |
| 63 | return ret; |
| 64 | } |
| 65 | EXPORT_SYMBOL_GPL(query_asymmetric_key); |
| 66 | |
| 67 | /** |
| 68 | * encrypt_blob - Encrypt data using an asymmetric key |
| 69 | * @params: Various parameters |
| 70 | * @data: Data blob to be encrypted, length params->data_len |
| 71 | * @enc: Encrypted data buffer, length params->enc_len |
| 72 | * |
| 73 | * Encrypt the specified data blob using the private key specified by |
| 74 | * params->key. The encrypted data is wrapped in an encoding if |
| 75 | * params->encoding is specified (eg. "pkcs1"). |
| 76 | * |
| 77 | * Returns the length of the data placed in the encrypted data buffer or an |
| 78 | * error. |
| 79 | */ |
| 80 | int encrypt_blob(struct kernel_pkey_params *params, |
| 81 | const void *data, void *enc) |
| 82 | { |
| 83 | params->op = kernel_pkey_encrypt; |
| 84 | return asymmetric_key_eds_op(params, data, enc); |
| 85 | } |
| 86 | EXPORT_SYMBOL_GPL(encrypt_blob); |
| 87 | |
| 88 | /** |
| 89 | * decrypt_blob - Decrypt data using an asymmetric key |
| 90 | * @params: Various parameters |
| 91 | * @enc: Encrypted data to be decrypted, length params->enc_len |
| 92 | * @data: Decrypted data buffer, length params->data_len |
| 93 | * |
| 94 | * Decrypt the specified data blob using the private key specified by |
| 95 | * params->key. The decrypted data is wrapped in an encoding if |
| 96 | * params->encoding is specified (eg. "pkcs1"). |
| 97 | * |
| 98 | * Returns the length of the data placed in the decrypted data buffer or an |
| 99 | * error. |
| 100 | */ |
| 101 | int decrypt_blob(struct kernel_pkey_params *params, |
| 102 | const void *enc, void *data) |
| 103 | { |
| 104 | params->op = kernel_pkey_decrypt; |
| 105 | return asymmetric_key_eds_op(params, enc, data); |
| 106 | } |
| 107 | EXPORT_SYMBOL_GPL(decrypt_blob); |
| 108 | |
| 109 | /** |
| 110 | * create_signature - Sign some data using an asymmetric key |
| 111 | * @params: Various parameters |
| 112 | * @data: Data blob to be signed, length params->data_len |
| 113 | * @enc: Signature buffer, length params->enc_len |
| 114 | * |
| 115 | * Sign the specified data blob using the private key specified by params->key. |
| 116 | * The signature is wrapped in an encoding if params->encoding is specified |
| 117 | * (eg. "pkcs1"). If the encoding needs to know the digest type, this can be |
| 118 | * passed through params->hash_algo (eg. "sha1"). |
| 119 | * |
| 120 | * Returns the length of the data placed in the signature buffer or an error. |
| 121 | */ |
| 122 | int create_signature(struct kernel_pkey_params *params, |
| 123 | const void *data, void *enc) |
| 124 | { |
| 125 | params->op = kernel_pkey_sign; |
| 126 | return asymmetric_key_eds_op(params, data, enc); |
| 127 | } |
| 128 | EXPORT_SYMBOL_GPL(create_signature); |
| 129 | |
| 130 | /** |
David Howells | 4ae71c1 | 2012-09-21 23:25:04 +0100 | [diff] [blame] | 131 | * verify_signature - Initiate the use of an asymmetric key to verify a signature |
| 132 | * @key: The asymmetric key to verify against |
| 133 | * @sig: The signature to check |
| 134 | * |
| 135 | * Returns 0 if successful or else an error. |
| 136 | */ |
| 137 | int verify_signature(const struct key *key, |
| 138 | const struct public_key_signature *sig) |
| 139 | { |
| 140 | const struct asymmetric_key_subtype *subtype; |
| 141 | int ret; |
| 142 | |
| 143 | pr_devel("==>%s()\n", __func__); |
| 144 | |
| 145 | if (key->type != &key_type_asymmetric) |
| 146 | return -EINVAL; |
| 147 | subtype = asymmetric_key_subtype(key); |
| 148 | if (!subtype || |
David Howells | 146aa8b | 2015-10-21 14:04:48 +0100 | [diff] [blame] | 149 | !key->payload.data[0]) |
David Howells | 4ae71c1 | 2012-09-21 23:25:04 +0100 | [diff] [blame] | 150 | return -EINVAL; |
| 151 | if (!subtype->verify_signature) |
| 152 | return -ENOTSUPP; |
| 153 | |
| 154 | ret = subtype->verify_signature(key, sig); |
| 155 | |
| 156 | pr_devel("<==%s() = %d\n", __func__, ret); |
| 157 | return ret; |
| 158 | } |
| 159 | EXPORT_SYMBOL_GPL(verify_signature); |