2 * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 * EC_METHOD low level APIs are deprecated for public use, but still ok for
14 #include "internal/deprecated.h"
18 #include <openssl/err.h>
19 #include <openssl/rand.h>
21 #include "s390x_arch.h"
23 /* Size of parameter blocks */
24 #define S390X_SIZE_PARAM 4096
26 /* Size of fields in parameter blocks */
27 #define S390X_SIZE_P256 32
28 #define S390X_SIZE_P384 48
29 #define S390X_SIZE_P521 80
31 /* Offsets of fields in PCC parameter blocks */
32 #define S390X_OFF_RES_X(n) (0 * n)
33 #define S390X_OFF_RES_Y(n) (1 * n)
34 #define S390X_OFF_SRC_X(n) (2 * n)
35 #define S390X_OFF_SRC_Y(n) (3 * n)
36 #define S390X_OFF_SCALAR(n) (4 * n)
38 /* Offsets of fields in KDSA parameter blocks */
39 #define S390X_OFF_R(n) (0 * n)
40 #define S390X_OFF_S(n) (1 * n)
41 #define S390X_OFF_H(n) (2 * n)
42 #define S390X_OFF_K(n) (3 * n)
43 #define S390X_OFF_X(n) (3 * n)
44 #define S390X_OFF_RN(n) (4 * n)
45 #define S390X_OFF_Y(n) (4 * n)
47 static int ec_GFp_s390x_nistp_mul(const EC_GROUP *group, EC_POINT *r,
49 size_t num, const EC_POINT *points[],
50 const BIGNUM *scalars[],
51 BN_CTX *ctx, unsigned int fc, int len)
53 unsigned char param[S390X_SIZE_PARAM];
55 const EC_POINT *point_ptr = NULL;
56 const BIGNUM *scalar_ptr = NULL;
57 BN_CTX *new_ctx = NULL;
61 ctx = new_ctx = BN_CTX_new_ex(group->libctx);
70 if (x == NULL || y == NULL) {
76 * Use PCC for EC keygen and ECDH key derivation:
77 * scalar * generator and scalar * peer public key,
78 * scalar in [0,order).
80 if ((scalar != NULL && num == 0 && BN_is_negative(scalar) == 0)
81 || (scalar == NULL && num == 1 && BN_is_negative(scalars[0]) == 0)) {
84 point_ptr = EC_GROUP_get0_generator(group);
87 point_ptr = points[0];
88 scalar_ptr = scalars[0];
91 if (EC_POINT_is_at_infinity(group, point_ptr) == 1
92 || BN_is_zero(scalar_ptr)) {
93 rc = EC_POINT_set_to_infinity(group, r);
97 memset(¶m, 0, sizeof(param));
99 if (group->meth->point_get_affine_coordinates(group, point_ptr,
101 || BN_bn2binpad(x, param + S390X_OFF_SRC_X(len), len) == -1
102 || BN_bn2binpad(y, param + S390X_OFF_SRC_Y(len), len) == -1
103 || BN_bn2binpad(scalar_ptr,
104 param + S390X_OFF_SCALAR(len), len) == -1
105 || s390x_pcc(fc, param) != 0
106 || BN_bin2bn(param + S390X_OFF_RES_X(len), len, x) == NULL
107 || BN_bin2bn(param + S390X_OFF_RES_Y(len), len, y) == NULL
108 || group->meth->point_set_affine_coordinates(group, r,
116 /* Otherwise use default. */
118 rc = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
119 OPENSSL_cleanse(param + S390X_OFF_SCALAR(len), len);
121 BN_CTX_free(new_ctx);
125 static ECDSA_SIG *ecdsa_s390x_nistp_sign_sig(const unsigned char *dgst,
130 unsigned int fc, int len)
132 unsigned char param[S390X_SIZE_PARAM];
136 const EC_GROUP *group;
137 const BIGNUM *privkey;
140 group = EC_KEY_get0_group(eckey);
141 privkey = EC_KEY_get0_private_key(eckey);
142 if (group == NULL || privkey == NULL) {
143 ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, EC_R_MISSING_PARAMETERS);
147 if (!EC_KEY_can_sign(eckey)) {
148 ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG,
149 EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
154 sig = ECDSA_SIG_new();
155 if (k == NULL || sig == NULL) {
156 ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_MALLOC_FAILURE);
162 if (sig->r == NULL || sig->s == NULL) {
163 ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_MALLOC_FAILURE);
167 memset(param, 0, sizeof(param));
168 off = len - (dgstlen > len ? len : dgstlen);
169 memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
171 if (BN_bn2binpad(privkey, param + S390X_OFF_K(len), len) == -1) {
172 ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_BN_LIB);
176 if (r == NULL || kinv == NULL) {
178 * Generate random k and copy to param param block. RAND_priv_bytes_ex
179 * is used instead of BN_priv_rand_range or BN_generate_dsa_nonce
180 * because kdsa instruction constructs an in-range, invertible nonce
181 * internally implementing counter-measures for RNG weakness.
183 if (RAND_priv_bytes_ex(eckey->libctx, param + S390X_OFF_RN(len),
185 ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG,
186 EC_R_RANDOM_NUMBER_GENERATION_FAILED);
190 /* Reconstruct k = (k^-1)^-1. */
191 if (ec_group_do_inverse_ord(group, k, kinv, NULL) == 0
192 || BN_bn2binpad(k, param + S390X_OFF_RN(len), len) == -1) {
193 ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_BN_LIB);
196 /* Turns KDSA internal nonce-generation off. */
200 if (s390x_kdsa(fc, param, NULL, 0) != 0) {
201 ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_ECDSA_LIB);
205 if (BN_bin2bn(param + S390X_OFF_R(len), len, sig->r) == NULL
206 || BN_bin2bn(param + S390X_OFF_S(len), len, sig->s) == NULL) {
207 ECerr(EC_F_ECDSA_S390X_NISTP_SIGN_SIG, ERR_R_BN_LIB);
213 OPENSSL_cleanse(param + S390X_OFF_K(len), 2 * len);
222 static int ecdsa_s390x_nistp_verify_sig(const unsigned char *dgst, int dgstlen,
223 const ECDSA_SIG *sig, EC_KEY *eckey,
224 unsigned int fc, int len)
226 unsigned char param[S390X_SIZE_PARAM];
230 const EC_GROUP *group;
231 const EC_POINT *pubkey;
234 group = EC_KEY_get0_group(eckey);
235 pubkey = EC_KEY_get0_public_key(eckey);
236 if (eckey == NULL || group == NULL || pubkey == NULL || sig == NULL) {
237 ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, EC_R_MISSING_PARAMETERS);
241 if (!EC_KEY_can_sign(eckey)) {
242 ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG,
243 EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING);
247 ctx = BN_CTX_new_ex(group->libctx);
249 ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, ERR_R_MALLOC_FAILURE);
257 if (x == NULL || y == NULL) {
258 ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, ERR_R_MALLOC_FAILURE);
262 memset(param, 0, sizeof(param));
263 off = len - (dgstlen > len ? len : dgstlen);
264 memcpy(param + S390X_OFF_H(len) + off, dgst, len - off);
266 if (group->meth->point_get_affine_coordinates(group, pubkey,
268 || BN_bn2binpad(sig->r, param + S390X_OFF_R(len), len) == -1
269 || BN_bn2binpad(sig->s, param + S390X_OFF_S(len), len) == -1
270 || BN_bn2binpad(x, param + S390X_OFF_X(len), len) == -1
271 || BN_bn2binpad(y, param + S390X_OFF_Y(len), len) == -1) {
272 ECerr(EC_F_ECDSA_S390X_NISTP_VERIFY_SIG, ERR_R_BN_LIB);
276 rc = s390x_kdsa(fc, param, NULL, 0) == 0 ? 1 : 0;
283 #define EC_GFP_S390X_NISTP_METHOD(bits) \
285 static int ec_GFp_s390x_nistp##bits##_mul(const EC_GROUP *group, \
287 const BIGNUM *scalar, \
289 const EC_POINT *points[], \
290 const BIGNUM *scalars[], \
293 return ec_GFp_s390x_nistp_mul(group, r, scalar, num, points, \
295 S390X_SCALAR_MULTIPLY_P##bits, \
296 S390X_SIZE_P##bits); \
299 static ECDSA_SIG *ecdsa_s390x_nistp##bits##_sign_sig(const unsigned \
306 return ecdsa_s390x_nistp_sign_sig(dgst, dgstlen, kinv, r, eckey, \
307 S390X_ECDSA_SIGN_P##bits, \
308 S390X_SIZE_P##bits); \
311 static int ecdsa_s390x_nistp##bits##_verify_sig(const \
312 unsigned char *dgst, \
314 const ECDSA_SIG *sig, \
317 return ecdsa_s390x_nistp_verify_sig(dgst, dgstlen, sig, eckey, \
318 S390X_ECDSA_VERIFY_P##bits, \
319 S390X_SIZE_P##bits); \
322 const EC_METHOD *EC_GFp_s390x_nistp##bits##_method(void) \
324 static const EC_METHOD EC_GFp_s390x_nistp##bits##_meth = { \
325 EC_FLAGS_DEFAULT_OCT, \
326 NID_X9_62_prime_field, \
327 ec_GFp_simple_group_init, \
328 ec_GFp_simple_group_finish, \
329 ec_GFp_simple_group_clear_finish, \
330 ec_GFp_simple_group_copy, \
331 ec_GFp_simple_group_set_curve, \
332 ec_GFp_simple_group_get_curve, \
333 ec_GFp_simple_group_get_degree, \
334 ec_group_simple_order_bits, \
335 ec_GFp_simple_group_check_discriminant, \
336 ec_GFp_simple_point_init, \
337 ec_GFp_simple_point_finish, \
338 ec_GFp_simple_point_clear_finish, \
339 ec_GFp_simple_point_copy, \
340 ec_GFp_simple_point_set_to_infinity, \
341 ec_GFp_simple_point_set_affine_coordinates, \
342 ec_GFp_simple_point_get_affine_coordinates, \
343 NULL, /* point_set_compressed_coordinates */ \
344 NULL, /* point2oct */ \
345 NULL, /* oct2point */ \
348 ec_GFp_simple_invert, \
349 ec_GFp_simple_is_at_infinity, \
350 ec_GFp_simple_is_on_curve, \
352 ec_GFp_simple_make_affine, \
353 ec_GFp_simple_points_make_affine, \
354 ec_GFp_s390x_nistp##bits##_mul, \
355 NULL, /* precompute_mult */ \
356 NULL, /* have_precompute_mult */ \
357 ec_GFp_simple_field_mul, \
358 ec_GFp_simple_field_sqr, \
359 NULL, /* field_div */ \
360 ec_GFp_simple_field_inv, \
361 NULL, /* field_encode */ \
362 NULL, /* field_decode */ \
363 NULL, /* field_set_to_one */ \
364 ec_key_simple_priv2oct, \
365 ec_key_simple_oct2priv, \
366 NULL, /* set_private */ \
367 ec_key_simple_generate_key, \
368 ec_key_simple_check_key, \
369 ec_key_simple_generate_public_key, \
370 NULL, /* keycopy */ \
371 NULL, /* keyfinish */ \
372 ecdh_simple_compute_key, \
373 ecdsa_simple_sign_setup, \
374 ecdsa_s390x_nistp##bits##_sign_sig, \
375 ecdsa_s390x_nistp##bits##_verify_sig, \
376 NULL, /* field_inverse_mod_ord */ \
377 ec_GFp_simple_blind_coordinates, \
378 ec_GFp_simple_ladder_pre, \
379 ec_GFp_simple_ladder_step, \
380 ec_GFp_simple_ladder_post \
382 static const EC_METHOD *ret; \
384 if ((OPENSSL_s390xcap_P.pcc[1] \
385 & S390X_CAPBIT(S390X_SCALAR_MULTIPLY_P##bits)) \
386 && (OPENSSL_s390xcap_P.kdsa[0] \
387 & S390X_CAPBIT(S390X_ECDSA_VERIFY_P##bits)) \
388 && (OPENSSL_s390xcap_P.kdsa[0] \
389 & S390X_CAPBIT(S390X_ECDSA_SIGN_P##bits))) \
390 ret = &EC_GFp_s390x_nistp##bits##_meth; \
392 ret = EC_GFp_mont_method(); \
397 EC_GFP_S390X_NISTP_METHOD(256)
398 EC_GFP_S390X_NISTP_METHOD(384)
399 EC_GFP_S390X_NISTP_METHOD(521)