qemu

1
/*
2
 * QEMU Crypto akcipher algorithms
3
 *
4
 * Copyright (c) 2022 Bytedance
5
 * Author: lei he <helei.sig11@bytedance.com>
6
 *
7
 * This library is free software; you can redistribute it and/or
8
 * modify it under the terms of the GNU Lesser General Public
9
 * License as published by the Free Software Foundation; either
10
 * version 2.1 of the License, or (at your option) any later version.
11
 *
12
 * This library is distributed in the hope that it will be useful,
13
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15
 * Lesser General Public License for more details.
16
 *
17
 * You should have received a copy of the GNU Lesser General Public
18
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19
 *
20
 */
21

22
#include <gcrypt.h>
23

24
#include "qemu/osdep.h"
25
#include "qemu/host-utils.h"
26
#include "crypto/akcipher.h"
27
#include "crypto/random.h"
28
#include "qapi/error.h"
29
#include "sysemu/cryptodev.h"
30
#include "rsakey.h"
31

32
typedef struct QCryptoGcryptRSA {
33
    QCryptoAkCipher akcipher;
34
    gcry_sexp_t key;
35
    QCryptoRSAPaddingAlgorithm padding_alg;
36
    QCryptoHashAlgorithm hash_alg;
37
} QCryptoGcryptRSA;
38

39
static void qcrypto_gcrypt_rsa_free(QCryptoAkCipher *akcipher)
40
{
41
    QCryptoGcryptRSA *rsa = (QCryptoGcryptRSA *)akcipher;
42
    if (!rsa) {
43
        return;
44
    }
45

46
    gcry_sexp_release(rsa->key);
47
    g_free(rsa);
48
}
49

50
static QCryptoGcryptRSA *qcrypto_gcrypt_rsa_new(
51
    const QCryptoAkCipherOptionsRSA *opt,
52
    QCryptoAkCipherKeyType type,
53
    const uint8_t *key,  size_t keylen,
54
    Error **errp);
55

56
QCryptoAkCipher *qcrypto_akcipher_new(const QCryptoAkCipherOptions *opts,
57
                                      QCryptoAkCipherKeyType type,
58
                                      const uint8_t *key, size_t keylen,
59
                                      Error **errp)
60
{
61
    switch (opts->alg) {
62
    case QCRYPTO_AKCIPHER_ALG_RSA:
63
        return (QCryptoAkCipher *)qcrypto_gcrypt_rsa_new(
64
            &opts->u.rsa, type, key, keylen, errp);
65

66
    default:
67
        error_setg(errp, "Unsupported algorithm: %u", opts->alg);
68
        return NULL;
69
    }
70

71
    return NULL;
72
}
73

74
static void qcrypto_gcrypt_set_rsa_size(QCryptoAkCipher *akcipher, gcry_mpi_t n)
75
{
76
    size_t key_size = (gcry_mpi_get_nbits(n) + 7) / 8;
77
    akcipher->max_plaintext_len = key_size;
78
    akcipher->max_ciphertext_len = key_size;
79
    akcipher->max_dgst_len = key_size;
80
    akcipher->max_signature_len = key_size;
81
}
82

83
static int qcrypto_gcrypt_parse_rsa_private_key(
84
    QCryptoGcryptRSA *rsa,
85
    const uint8_t *key, size_t keylen, Error **errp)
86
{
87
    g_autoptr(QCryptoAkCipherRSAKey) rsa_key = qcrypto_akcipher_rsakey_parse(
88
        QCRYPTO_AKCIPHER_KEY_TYPE_PRIVATE, key, keylen, errp);
89
    gcry_mpi_t n = NULL, e = NULL, d = NULL, p = NULL, q = NULL, u = NULL;
90
    bool compute_mul_inv = false;
91
    int ret = -1;
92
    gcry_error_t err;
93

94
    if (!rsa_key) {
95
        return ret;
96
    }
97

98
    err = gcry_mpi_scan(&n, GCRYMPI_FMT_STD,
99
                        rsa_key->n.data, rsa_key->n.len, NULL);
100
    if (gcry_err_code(err) != 0) {
101
        error_setg(errp, "Failed to parse RSA parameter n: %s/%s",
102
                   gcry_strsource(err), gcry_strerror(err));
103
        goto cleanup;
104
    }
105

106
    err = gcry_mpi_scan(&e, GCRYMPI_FMT_STD,
107
                        rsa_key->e.data, rsa_key->e.len, NULL);
108
    if (gcry_err_code(err) != 0) {
109
        error_setg(errp, "Failed to parse RSA parameter e: %s/%s",
110
                   gcry_strsource(err), gcry_strerror(err));
111
        goto cleanup;
112
    }
113

114
    err = gcry_mpi_scan(&d, GCRYMPI_FMT_STD,
115
                        rsa_key->d.data, rsa_key->d.len, NULL);
116
    if (gcry_err_code(err) != 0) {
117
        error_setg(errp, "Failed to parse RSA parameter d: %s/%s",
118
                   gcry_strsource(err), gcry_strerror(err));
119
        goto cleanup;
120
    }
121

122
    err = gcry_mpi_scan(&p, GCRYMPI_FMT_STD,
123
                        rsa_key->p.data, rsa_key->p.len, NULL);
124
    if (gcry_err_code(err) != 0) {
125
        error_setg(errp, "Failed to parse RSA parameter p: %s/%s",
126
                   gcry_strsource(err), gcry_strerror(err));
127
        goto cleanup;
128
    }
129

130
    err = gcry_mpi_scan(&q, GCRYMPI_FMT_STD,
131
                        rsa_key->q.data, rsa_key->q.len, NULL);
132
    if (gcry_err_code(err) != 0) {
133
        error_setg(errp, "Failed to parse RSA parameter q: %s/%s",
134
                   gcry_strsource(err), gcry_strerror(err));
135
        goto cleanup;
136
    }
137

138
    if (gcry_mpi_cmp_ui(p, 0) > 0 && gcry_mpi_cmp_ui(q, 0) > 0) {
139
        compute_mul_inv = true;
140

141
        u = gcry_mpi_new(0);
142
        if (gcry_mpi_cmp(p, q) > 0) {
143
            gcry_mpi_swap(p, q);
144
        }
145
        gcry_mpi_invm(u, p, q);
146
    }
147

148
    if (compute_mul_inv) {
149
        err = gcry_sexp_build(&rsa->key, NULL,
150
            "(private-key (rsa (n %m) (e %m) (d %m) (p %m) (q %m) (u %m)))",
151
            n, e, d, p, q, u);
152
    } else {
153
        err = gcry_sexp_build(&rsa->key, NULL,
154
            "(private-key (rsa (n %m) (e %m) (d %m)))", n, e, d);
155
    }
156
    if (gcry_err_code(err) != 0) {
157
        error_setg(errp, "Failed to build RSA private key: %s/%s",
158
                   gcry_strsource(err), gcry_strerror(err));
159
        goto cleanup;
160
    }
161
    qcrypto_gcrypt_set_rsa_size((QCryptoAkCipher *)rsa,  n);
162
    ret = 0;
163

164
cleanup:
165
    gcry_mpi_release(n);
166
    gcry_mpi_release(e);
167
    gcry_mpi_release(d);
168
    gcry_mpi_release(p);
169
    gcry_mpi_release(q);
170
    gcry_mpi_release(u);
171
    return ret;
172
}
173

174
static int qcrypto_gcrypt_parse_rsa_public_key(QCryptoGcryptRSA *rsa,
175
                                               const uint8_t *key,
176
                                               size_t keylen,
177
                                               Error **errp)
178
{
179

180
    g_autoptr(QCryptoAkCipherRSAKey) rsa_key = qcrypto_akcipher_rsakey_parse(
181
        QCRYPTO_AKCIPHER_KEY_TYPE_PUBLIC, key, keylen, errp);
182
    gcry_mpi_t n = NULL, e = NULL;
183
    int ret = -1;
184
    gcry_error_t err;
185

186
    if (!rsa_key) {
187
        return ret;
188
    }
189

190
    err = gcry_mpi_scan(&n, GCRYMPI_FMT_STD,
191
                        rsa_key->n.data, rsa_key->n.len, NULL);
192
    if (gcry_err_code(err) != 0) {
193
        error_setg(errp, "Failed to parse RSA parameter n: %s/%s",
194
                   gcry_strsource(err), gcry_strerror(err));
195
        goto cleanup;
196
    }
197

198
    err = gcry_mpi_scan(&e, GCRYMPI_FMT_STD,
199
                        rsa_key->e.data, rsa_key->e.len, NULL);
200
    if (gcry_err_code(err) != 0) {
201
        error_setg(errp, "Failed to parse RSA parameter e: %s/%s",
202
                   gcry_strsource(err), gcry_strerror(err));
203
        goto cleanup;
204
    }
205

206
    err = gcry_sexp_build(&rsa->key, NULL,
207
                          "(public-key (rsa (n %m) (e %m)))", n, e);
208
    if (gcry_err_code(err) != 0) {
209
        error_setg(errp, "Failed to build RSA public key: %s/%s",
210
                   gcry_strsource(err), gcry_strerror(err));
211
        goto cleanup;
212
    }
213
    qcrypto_gcrypt_set_rsa_size((QCryptoAkCipher *)rsa, n);
214
    ret = 0;
215

216
cleanup:
217
    gcry_mpi_release(n);
218
    gcry_mpi_release(e);
219
    return ret;
220
}
221

222
static int qcrypto_gcrypt_rsa_encrypt(QCryptoAkCipher *akcipher,
223
                                      const void *in, size_t in_len,
224
                                      void *out, size_t out_len,
225
                                      Error **errp)
226
{
227
    QCryptoGcryptRSA *rsa = (QCryptoGcryptRSA *)akcipher;
228
    int ret = -1;
229
    gcry_sexp_t data_sexp = NULL, cipher_sexp = NULL;
230
    gcry_sexp_t cipher_sexp_item = NULL;
231
    gcry_mpi_t cipher_mpi = NULL;
232
    const char *result;
233
    gcry_error_t err;
234
    size_t actual_len;
235

236
    if (in_len > akcipher->max_plaintext_len) {
237
        error_setg(errp, "Plaintext length is greater than key size: %d",
238
                   akcipher->max_plaintext_len);
239
        return ret;
240
    }
241

242
    err = gcry_sexp_build(&data_sexp, NULL,
243
                          "(data (flags %s) (value %b))",
244
                          QCryptoRSAPaddingAlgorithm_str(rsa->padding_alg),
245
                          in_len, in);
246
    if (gcry_err_code(err) != 0) {
247
        error_setg(errp, "Failed to build plaintext: %s/%s",
248
                   gcry_strsource(err), gcry_strerror(err));
249
        goto cleanup;
250
    }
251

252
    err = gcry_pk_encrypt(&cipher_sexp, data_sexp, rsa->key);
253
    if (gcry_err_code(err) != 0) {
254
        error_setg(errp, "Failed to encrypt: %s/%s",
255
                   gcry_strsource(err), gcry_strerror(err));
256
        goto cleanup;
257
    }
258

259
    /* S-expression of cipher: (enc-val (rsa (a a-mpi))) */
260
    cipher_sexp_item = gcry_sexp_find_token(cipher_sexp, "a", 0);
261
    if (!cipher_sexp_item || gcry_sexp_length(cipher_sexp_item) != 2) {
262
        error_setg(errp, "Invalid ciphertext result");
263
        goto cleanup;
264
    }
265

266
    if (rsa->padding_alg == QCRYPTO_RSA_PADDING_ALG_RAW) {
267
        cipher_mpi = gcry_sexp_nth_mpi(cipher_sexp_item, 1, GCRYMPI_FMT_USG);
268
        if (!cipher_mpi) {
269
            error_setg(errp, "Invalid ciphertext result");
270
            goto cleanup;
271
        }
272
        err = gcry_mpi_print(GCRYMPI_FMT_USG, out, out_len,
273
                             &actual_len, cipher_mpi);
274
        if (gcry_err_code(err) != 0) {
275
            error_setg(errp, "Failed to print MPI: %s/%s",
276
                       gcry_strsource(err), gcry_strerror(err));
277
            goto cleanup;
278
        }
279

280
        if (actual_len > out_len) {
281
            error_setg(errp, "Ciphertext buffer length is too small");
282
            goto cleanup;
283
        }
284

285
        /* We always padding leading-zeros for RSA-RAW */
286
        if (actual_len < out_len) {
287
            memmove((uint8_t *)out + (out_len - actual_len), out, actual_len);
288
            memset(out, 0, out_len - actual_len);
289
        }
290
        ret = out_len;
291

292
    } else {
293
        result = gcry_sexp_nth_data(cipher_sexp_item, 1, &actual_len);
294
        if (!result) {
295
            error_setg(errp, "Invalid ciphertext result");
296
            goto cleanup;
297
        }
298
        if (actual_len > out_len) {
299
            error_setg(errp, "Ciphertext buffer length is too small");
300
            goto cleanup;
301
        }
302
        memcpy(out, result, actual_len);
303
        ret = actual_len;
304
    }
305

306
cleanup:
307
    gcry_sexp_release(data_sexp);
308
    gcry_sexp_release(cipher_sexp);
309
    gcry_sexp_release(cipher_sexp_item);
310
    gcry_mpi_release(cipher_mpi);
311
    return ret;
312
}
313

314
static int qcrypto_gcrypt_rsa_decrypt(QCryptoAkCipher *akcipher,
315
                                      const void *in, size_t in_len,
316
                                      void *out, size_t out_len,
317
                                      Error **errp)
318
{
319
    QCryptoGcryptRSA *rsa = (QCryptoGcryptRSA *)akcipher;
320
    int ret = -1;
321
    gcry_sexp_t data_sexp = NULL, cipher_sexp = NULL;
322
    gcry_mpi_t data_mpi = NULL;
323
    gcry_error_t err;
324
    size_t actual_len;
325
    const char *result;
326

327
    if (in_len > akcipher->max_ciphertext_len) {
328
        error_setg(errp, "Ciphertext length is greater than key size: %d",
329
                   akcipher->max_ciphertext_len);
330
        return ret;
331
    }
332

333
    err = gcry_sexp_build(&cipher_sexp, NULL,
334
                          "(enc-val (flags %s) (rsa (a %b) ))",
335
                          QCryptoRSAPaddingAlgorithm_str(rsa->padding_alg),
336
                          in_len, in);
337
    if (gcry_err_code(err) != 0) {
338
        error_setg(errp, "Failed to build ciphertext: %s/%s",
339
                   gcry_strsource(err), gcry_strerror(err));
340
        goto cleanup;
341
    }
342

343
    err = gcry_pk_decrypt(&data_sexp, cipher_sexp, rsa->key);
344
    if (gcry_err_code(err) != 0) {
345
        error_setg(errp, "Failed to decrypt: %s/%s",
346
                   gcry_strsource(err), gcry_strerror(err));
347
        goto cleanup;
348
    }
349

350
    /* S-expression of plaintext: (value plaintext) */
351
    if (rsa->padding_alg == QCRYPTO_RSA_PADDING_ALG_RAW) {
352
        data_mpi = gcry_sexp_nth_mpi(data_sexp, 1, GCRYMPI_FMT_USG);
353
        if (!data_mpi) {
354
            error_setg(errp, "Invalid plaintext result");
355
            goto cleanup;
356
        }
357
        err = gcry_mpi_print(GCRYMPI_FMT_USG, out, out_len,
358
                             &actual_len, data_mpi);
359
        if (gcry_err_code(err) != 0) {
360
            error_setg(errp, "Failed to print MPI: %s/%s",
361
                       gcry_strsource(err), gcry_strerror(err));
362
            goto cleanup;
363
        }
364
        if (actual_len > out_len) {
365
            error_setg(errp, "Plaintext buffer length is too small");
366
            goto cleanup;
367
        }
368
        /* We always padding leading-zeros for RSA-RAW */
369
        if (actual_len < out_len) {
370
            memmove((uint8_t *)out + (out_len - actual_len), out, actual_len);
371
            memset(out, 0, out_len - actual_len);
372
        }
373
        ret = out_len;
374
    } else {
375
        result = gcry_sexp_nth_data(data_sexp, 1, &actual_len);
376
        if (!result) {
377
            error_setg(errp, "Invalid plaintext result");
378
            goto cleanup;
379
        }
380
        if (actual_len > out_len) {
381
            error_setg(errp, "Plaintext buffer length is too small");
382
            goto cleanup;
383
        }
384
        memcpy(out, result, actual_len);
385
        ret = actual_len;
386
    }
387

388
cleanup:
389
    gcry_sexp_release(cipher_sexp);
390
    gcry_sexp_release(data_sexp);
391
    gcry_mpi_release(data_mpi);
392
    return ret;
393
}
394

395
static int qcrypto_gcrypt_rsa_sign(QCryptoAkCipher *akcipher,
396
                                   const void *in, size_t in_len,
397
                                   void *out, size_t out_len, Error **errp)
398
{
399
    QCryptoGcryptRSA *rsa = (QCryptoGcryptRSA *)akcipher;
400
    int ret = -1;
401
    gcry_sexp_t dgst_sexp = NULL, sig_sexp = NULL;
402
    gcry_sexp_t sig_sexp_item = NULL;
403
    const char *result;
404
    gcry_error_t err;
405
    size_t actual_len;
406

407
    if (in_len > akcipher->max_dgst_len) {
408
        error_setg(errp, "Data length is greater than key size: %d",
409
                   akcipher->max_dgst_len);
410
        return ret;
411
    }
412

413
    if (rsa->padding_alg != QCRYPTO_RSA_PADDING_ALG_PKCS1) {
414
        error_setg(errp, "Invalid padding %u", rsa->padding_alg);
415
        return ret;
416
    }
417

418
    err = gcry_sexp_build(&dgst_sexp, NULL,
419
                          "(data (flags pkcs1) (hash %s %b))",
420
                          QCryptoHashAlgorithm_str(rsa->hash_alg),
421
                          in_len, in);
422
    if (gcry_err_code(err) != 0) {
423
        error_setg(errp, "Failed to build dgst: %s/%s",
424
                   gcry_strsource(err), gcry_strerror(err));
425
        goto cleanup;
426
    }
427

428
    err = gcry_pk_sign(&sig_sexp, dgst_sexp, rsa->key);
429
    if (gcry_err_code(err) != 0) {
430
        error_setg(errp, "Failed to make signature: %s/%s",
431
                   gcry_strsource(err), gcry_strerror(err));
432
        goto cleanup;
433
    }
434

435
    /* S-expression of signature: (sig-val (rsa (s s-mpi))) */
436
    sig_sexp_item = gcry_sexp_find_token(sig_sexp, "s", 0);
437
    if (!sig_sexp_item || gcry_sexp_length(sig_sexp_item) != 2) {
438
        error_setg(errp, "Invalid signature result");
439
        goto cleanup;
440
    }
441

442
    result = gcry_sexp_nth_data(sig_sexp_item, 1, &actual_len);
443
    if (!result) {
444
        error_setg(errp, "Invalid signature result");
445
        goto cleanup;
446
    }
447

448
    if (actual_len > out_len) {
449
        error_setg(errp, "Signature buffer length is too small");
450
        goto cleanup;
451
    }
452
    memcpy(out, result, actual_len);
453
    ret = actual_len;
454

455
cleanup:
456
    gcry_sexp_release(dgst_sexp);
457
    gcry_sexp_release(sig_sexp);
458
    gcry_sexp_release(sig_sexp_item);
459

460
    return ret;
461
}
462

463
static int qcrypto_gcrypt_rsa_verify(QCryptoAkCipher *akcipher,
464
                                     const void *in, size_t in_len,
465
                                     const void *in2, size_t in2_len,
466
                                     Error **errp)
467
{
468
    QCryptoGcryptRSA *rsa = (QCryptoGcryptRSA *)akcipher;
469
    int ret = -1;
470
    gcry_sexp_t sig_sexp = NULL, dgst_sexp = NULL;
471
    gcry_error_t err;
472

473
    if (in_len > akcipher->max_signature_len) {
474
        error_setg(errp, "Signature length is greater than key size: %d",
475
                   akcipher->max_signature_len);
476
        return ret;
477
    }
478

479
    if (in2_len > akcipher->max_dgst_len) {
480
        error_setg(errp, "Data length is greater than key size: %d",
481
                   akcipher->max_dgst_len);
482
        return ret;
483
    }
484

485
    if (rsa->padding_alg != QCRYPTO_RSA_PADDING_ALG_PKCS1) {
486
        error_setg(errp, "Invalid padding %u", rsa->padding_alg);
487
        return ret;
488
    }
489

490
    err = gcry_sexp_build(&sig_sexp, NULL,
491
                          "(sig-val (rsa (s %b)))", in_len, in);
492
    if (gcry_err_code(err) != 0) {
493
        error_setg(errp, "Failed to build signature: %s/%s",
494
                   gcry_strsource(err), gcry_strerror(err));
495
        goto cleanup;
496
    }
497

498
    err = gcry_sexp_build(&dgst_sexp, NULL,
499
                          "(data (flags pkcs1) (hash %s %b))",
500
                          QCryptoHashAlgorithm_str(rsa->hash_alg),
501
                          in2_len, in2);
502
    if (gcry_err_code(err) != 0) {
503
        error_setg(errp, "Failed to build dgst: %s/%s",
504
                   gcry_strsource(err), gcry_strerror(err));
505
        goto cleanup;
506
    }
507

508
    err = gcry_pk_verify(sig_sexp, dgst_sexp, rsa->key);
509
    if (gcry_err_code(err) != 0) {
510
        error_setg(errp, "Failed to verify signature: %s/%s",
511
                   gcry_strsource(err), gcry_strerror(err));
512
        goto cleanup;
513
    }
514
    ret = 0;
515

516
cleanup:
517
    gcry_sexp_release(dgst_sexp);
518
    gcry_sexp_release(sig_sexp);
519

520
    return ret;
521
}
522

523
QCryptoAkCipherDriver gcrypt_rsa = {
524
    .encrypt = qcrypto_gcrypt_rsa_encrypt,
525
    .decrypt = qcrypto_gcrypt_rsa_decrypt,
526
    .sign = qcrypto_gcrypt_rsa_sign,
527
    .verify = qcrypto_gcrypt_rsa_verify,
528
    .free = qcrypto_gcrypt_rsa_free,
529
};
530

531
static QCryptoGcryptRSA *qcrypto_gcrypt_rsa_new(
532
    const QCryptoAkCipherOptionsRSA *opt,
533
    QCryptoAkCipherKeyType type,
534
    const uint8_t *key, size_t keylen,
535
    Error **errp)
536
{
537
    QCryptoGcryptRSA *rsa = g_new0(QCryptoGcryptRSA, 1);
538
    rsa->padding_alg = opt->padding_alg;
539
    rsa->hash_alg = opt->hash_alg;
540
    rsa->akcipher.driver = &gcrypt_rsa;
541

542
    switch (type) {
543
    case QCRYPTO_AKCIPHER_KEY_TYPE_PRIVATE:
544
        if (qcrypto_gcrypt_parse_rsa_private_key(rsa, key, keylen, errp) != 0) {
545
            goto error;
546
        }
547
        break;
548

549
    case QCRYPTO_AKCIPHER_KEY_TYPE_PUBLIC:
550
        if (qcrypto_gcrypt_parse_rsa_public_key(rsa, key, keylen, errp) != 0) {
551
            goto error;
552
        }
553
        break;
554

555
    default:
556
        error_setg(errp, "Unknown akcipher key type %d", type);
557
        goto error;
558
    }
559

560
    return rsa;
561

562
error:
563
    qcrypto_gcrypt_rsa_free((QCryptoAkCipher *)rsa);
564
    return NULL;
565
}
566

567

568
bool qcrypto_akcipher_supports(QCryptoAkCipherOptions *opts)
569
{
570
    switch (opts->alg) {
571
    case QCRYPTO_AKCIPHER_ALG_RSA:
572
        switch (opts->u.rsa.padding_alg) {
573
        case QCRYPTO_RSA_PADDING_ALG_RAW:
574
            return true;
575

576
        case QCRYPTO_RSA_PADDING_ALG_PKCS1:
577
            switch (opts->u.rsa.hash_alg) {
578
            case QCRYPTO_HASH_ALG_MD5:
579
            case QCRYPTO_HASH_ALG_SHA1:
580
            case QCRYPTO_HASH_ALG_SHA256:
581
            case QCRYPTO_HASH_ALG_SHA512:
582
                return true;
583

584
            default:
585
                return false;
586
            }
587

588
        default:
589
            return false;
590
        }
591

592
    default:
593
        return true;
594
    }
595
}
596