mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2024-11-22 03:59:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
1e562deace
linux/crypto/asymmetric_keys
History
Lukas Wunner 1e562deace crypto: rsassa-pkcs1 - Migrate to sig_alg backend 
A sig_alg backend has just been introduced with the intent of moving all
asymmetric sign/verify algorithms to it one by one.

Migrate the sign/verify operations from rsa-pkcs1pad.c to a separate
rsassa-pkcs1.c which uses the new backend.

Consequently there are now two templates which build on the "rsa"
akcipher_alg:

* The existing "pkcs1pad" template, which is instantiated as an
  akcipher_instance and retains the encrypt/decrypt operations of
  RSAES-PKCS1-v1_5 (RFC 8017 sec 7.2).

* The new "pkcs1" template, which is instantiated as a sig_instance
  and contains the sign/verify operations of RSASSA-PKCS1-v1_5
  (RFC 8017 sec 8.2).

In a separate step, rsa-pkcs1pad.c could optionally be renamed to
rsaes-pkcs1.c for clarity.  Additional "oaep" and "pss" templates
could be added for RSAES-OAEP and RSASSA-PSS.

Note that it's currently allowed to allocate a "pkcs1pad(rsa)" transform
without specifying a hash algorithm.  That makes sense if the transform
is only used for encrypt/decrypt and continues to be supported.  But for
sign/verify, such transforms previously did not insert the Full Hash
Prefix into the padding.  The resulting message encoding was incompliant
with EMSA-PKCS1-v1_5 (RFC 8017 sec 9.2) and therefore nonsensical.

From here on in, it is no longer allowed to allocate a transform without
specifying a hash algorithm if the transform is used for sign/verify
operations.  This simplifies the code because the insertion of the Full
Hash Prefix is no longer optional, so various "if (digest_info)" clauses
can be removed.

There has been a previous attempt to forbid transform allocation without
specifying a hash algorithm, namely by commit c0d20d22e0 ("crypto:
rsa-pkcs1pad - Require hash to be present").  It had to be rolled back
with commit b3a8c8a5eb ("crypto: rsa-pkcs1pad: Allow hash to be
optional [ver #2]"), presumably because it broke allocation of a
transform which was solely used for encrypt/decrypt, not sign/verify.
Avoid such breakage by allowing transform allocation for encrypt/decrypt
with and without specifying a hash algorithm (and simply ignoring the
hash algorithm in the former case).

So again, specifying a hash algorithm is now mandatory for sign/verify,
but optional and ignored for encrypt/decrypt.

The new sig_alg API uses kernel buffers instead of sglists, which
avoids the overhead of copying signature and digest from sglists back
into kernel buffers.  rsassa-pkcs1.c is thus simplified quite a bit.

sig_alg is always synchronous, whereas the underlying "rsa" akcipher_alg
may be asynchronous.  So await the result of the akcipher_alg, similar
to crypto_akcipher_sync_{en,de}crypt().

As part of the migration, rename "rsa_digest_info" to "hash_prefix" to
adhere to the spec language in RFC 9580.  Otherwise keep the code
unmodified wherever possible to ease reviewing and bisecting.  Leave
several simplification and hardening opportunities to separate commits.

rsassa-pkcs1.c uses modern __free() syntax for allocation of buffers
which need to be freed by kfree_sensitive(), hence a DEFINE_FREE()
clause for kfree_sensitive() is introduced herein as a byproduct.

Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2024-10-05 13:22:04 +08:00
..
asymmetric_keys.h
asymmetric_type.c KEYS: prevent NULL pointer dereference in find_asymmetric_key() 2024-09-20 19:49:49 +03:00
Kconfig certs: Add ECDSA signature verification self-test 2024-05-14 05:01:04 +03:00
Makefile certs: Add ECDSA signature verification self-test 2024-05-14 05:01:04 +03:00
mscode_parser.c Revert "crypto: pkcs7 - remove sha1 support" 2024-03-22 19:42:20 +08:00
mscode.asn1
pkcs7_key_type.c
pkcs7_parser.c crypto: sm2 - Remove sm2 algorithm 2024-06-07 19:46:39 +08:00
pkcs7_parser.h
pkcs7_trust.c
pkcs7_verify.c
pkcs7.asn1 treewide: Add SPDX identifier to IETF ASN.1 modules 2023-10-27 18:04:28 +08:00
pkcs8_parser.c
pkcs8.asn1 treewide: Add SPDX identifier to IETF ASN.1 modules 2023-10-27 18:04:28 +08:00
public_key.c crypto: rsassa-pkcs1 - Migrate to sig_alg backend 2024-10-05 13:22:04 +08:00
restrict.c certs: Only allow certs signed by keys on the builtin keyring 2023-10-31 08:22:36 -04:00
selftest_ecdsa.c certs: Add ECDSA signature verification self-test 2024-05-14 05:01:04 +03:00
selftest_rsa.c certs: Move RSA self-test data to separate file 2024-05-14 05:01:03 +03:00
selftest.c certs: Add ECDSA signature verification self-test 2024-05-14 05:01:04 +03:00
selftest.h certs: Add ECDSA signature verification self-test 2024-05-14 05:01:04 +03:00
signature.c Revert "crypto: pkcs7 - remove sha1 support" 2024-03-22 19:42:20 +08:00
verify_pefile.c crypto: asymmetric_keys - remove redundant pointer secs 2024-01-26 16:39:32 +08:00
verify_pefile.h
x509_akid.asn1 treewide: Add SPDX identifier to IETF ASN.1 modules 2023-10-27 18:04:28 +08:00
x509_cert_parser.c crypto: sm2 - Remove sm2 algorithm 2024-06-07 19:46:39 +08:00
x509_loader.c
x509_parser.h X.509: Introduce scope-based x509_certificate allocation 2024-04-12 15:07:53 +08:00
x509_public_key.c crypto: sm2 - Remove sm2 algorithm 2024-06-07 19:46:39 +08:00
x509.asn1 treewide: Add SPDX identifier to IETF ASN.1 modules 2023-10-27 18:04:28 +08:00