crypto/openssl: add DH and DSA asym operations
authorSunila Sahu <sunila.sahu@caviumnetworks.com>
Mon, 23 Jul 2018 14:46:04 +0000 (20:16 +0530)
committerPablo de Lara <pablo.de.lara.guarch@intel.com>
Wed, 25 Jul 2018 06:22:14 +0000 (08:22 +0200)
- Add dh key generation and shared compute
- Add dsa sign and verify operation

Signed-off-by: Sunila Sahu <sunila.sahu@caviumnetworks.com>
Signed-off-by: Shally Verma <shally.verma@caviumnetworks.com>
Signed-off-by: Ashish Gupta <ashish.gupta@caviumnetworks.com>
drivers/crypto/openssl/compat.h
drivers/crypto/openssl/rte_openssl_pmd.c
drivers/crypto/openssl/rte_openssl_pmd_ops.c
drivers/crypto/openssl/rte_openssl_pmd_private.h

index 8ece808..45f9a33 100644 (file)
                rsa->n = n; rsa->e = e; rsa->d = d; ret = 0; \
        } while (0)
 
+#define set_dh_params(dh, p, g, ret) \
+       do { \
+               dh->p = p; \
+               dh->q = NULL; \
+               dh->g = g; \
+               ret = 0; \
+       } while (0)
+
+#define set_dh_priv_key(dh, priv_key, ret) \
+       do { dh->priv_key = priv_key; ret = 0; } while (0)
+
+#define set_dsa_params(dsa, p, q, g, ret) \
+       do { dsa->p = p; dsa->q = q; dsa->g = g; ret = 0; } while (0)
+
+#define get_dh_pub_key(dh, pub_key) \
+       (pub_key = dh->pub_key)
+
+#define get_dh_priv_key(dh, priv_key) \
+       (priv_key = dh->priv_key)
+
+#define set_dsa_sign(sign, r, s) \
+       do { sign->r = r; sign->s = s; } while (0)
+
+#define get_dsa_sign(sign, r, s) \
+       do { r = sign->r; s = sign->s; } while (0)
+
+#define set_dsa_keys(dsa, pub, priv, ret) \
+       do { dsa->pub_key = pub; dsa->priv_key = priv; ret = 0; } while (0)
+
+#define set_dsa_pub_key(dsa, pub_key) \
+       (dsa->pub_key = pub_key)
+
+#define get_dsa_priv_key(dsa, priv_key) \
+       (priv_key = dsa->priv_key)
+
 #else
 
 #define set_rsa_params(rsa, p, q, ret) \
 #define set_rsa_keys(rsa, n, e, d, ret) \
        (ret = !RSA_set0_key(rsa, n, e, d))
 
+#define set_dh_params(dh, p, g, ret) \
+       (ret = !DH_set0_pqg(dh, p, NULL, g))
+
+#define set_dh_priv_key(dh, priv_key, ret) \
+       (ret = !DH_set0_key(dh, NULL, priv_key))
+
+#define get_dh_pub_key(dh, pub_key) \
+       (DH_get0_key(dh_key, &pub_key, NULL))
+
+#define get_dh_priv_key(dh, priv_key) \
+       (DH_get0_key(dh_key, NULL, &priv_key))
+
+#define set_dsa_params(dsa, p, q, g, ret) \
+       (ret = !DSA_set0_pqg(dsa, p, q, g))
+
+#define set_dsa_priv_key(dsa, priv_key) \
+       (DSA_set0_key(dsa, NULL, priv_key))
+
+#define set_dsa_sign(sign, r, s) \
+       (DSA_SIG_set0(sign, r, s))
+
+#define get_dsa_sign(sign, r, s) \
+       (DSA_SIG_get0(sign, &r, &s))
+
+#define set_dsa_keys(dsa, pub, priv, ret) \
+       (ret = !DSA_set0_key(dsa, pub, priv))
+
+#define set_dsa_pub_key(dsa, pub_key) \
+       (DSA_set0_key(dsa, pub_key, NULL))
+
+#define get_dsa_priv_key(dsa, priv_key) \
+       (DSA_get0_key(dsa, NULL, &priv_key))
+
 #endif /* version < 10100000 */
 
 #endif /* __RTA_COMPAT_H__ */
index 6fa3e5a..7d263ab 100644 (file)
@@ -1546,6 +1546,230 @@ process_openssl_auth_op(struct openssl_qp *qp, struct rte_crypto_op *op,
                op->status = RTE_CRYPTO_OP_STATUS_ERROR;
 }
 
+/* process dsa sign operation */
+static int
+process_openssl_dsa_sign_op(struct rte_crypto_op *cop,
+               struct openssl_asym_session *sess)
+{
+       struct rte_crypto_dsa_op_param *op = &cop->asym->dsa;
+       DSA *dsa = sess->u.s.dsa;
+       DSA_SIG *sign = NULL;
+
+       sign = DSA_do_sign(op->message.data,
+                       op->message.length,
+                       dsa);
+
+       if (sign == NULL) {
+               OPENSSL_LOG(ERR, "%s:%d\n", __func__, __LINE__);
+               cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
+       } else {
+               const BIGNUM *r = NULL, *s = NULL;
+               get_dsa_sign(sign, r, s);
+
+               op->r.length = BN_bn2bin(r, op->r.data);
+               op->s.length = BN_bn2bin(s, op->s.data);
+               cop->status = RTE_CRYPTO_OP_STATUS_SUCCESS;
+       }
+
+       DSA_SIG_free(sign);
+
+       return 0;
+}
+
+/* process dsa verify operation */
+static int
+process_openssl_dsa_verify_op(struct rte_crypto_op *cop,
+               struct openssl_asym_session *sess)
+{
+       struct rte_crypto_dsa_op_param *op = &cop->asym->dsa;
+       DSA *dsa = sess->u.s.dsa;
+       int ret;
+       DSA_SIG *sign = DSA_SIG_new();
+       BIGNUM *r = NULL, *s = NULL;
+       BIGNUM *pub_key = NULL;
+
+       if (sign == NULL) {
+               OPENSSL_LOG(ERR, " %s:%d\n", __func__, __LINE__);
+               cop->status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED;
+               return -1;
+       }
+
+       r = BN_bin2bn(op->r.data,
+                       op->r.length,
+                       r);
+       s = BN_bin2bn(op->s.data,
+                       op->s.length,
+                       s);
+       pub_key = BN_bin2bn(op->y.data,
+                       op->y.length,
+                       pub_key);
+       if (!r || !s || !pub_key) {
+               if (r)
+                       BN_free(r);
+               if (s)
+                       BN_free(s);
+               if (pub_key)
+                       BN_free(pub_key);
+
+               cop->status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED;
+               return -1;
+       }
+       set_dsa_sign(sign, r, s);
+       set_dsa_pub_key(dsa, pub_key);
+
+       ret = DSA_do_verify(op->message.data,
+                       op->message.length,
+                       sign,
+                       dsa);
+
+       if (ret != 1)
+               cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
+       else
+               cop->status = RTE_CRYPTO_OP_STATUS_SUCCESS;
+
+       DSA_SIG_free(sign);
+
+       return 0;
+}
+
+/* process dh operation */
+static int
+process_openssl_dh_op(struct rte_crypto_op *cop,
+               struct openssl_asym_session *sess)
+{
+       struct rte_crypto_dh_op_param *op = &cop->asym->dh;
+       DH *dh_key = sess->u.dh.dh_key;
+       BIGNUM *priv_key = NULL;
+       int ret = 0;
+
+       if (sess->u.dh.key_op &
+                       (1 << RTE_CRYPTO_ASYM_OP_SHARED_SECRET_COMPUTE)) {
+               /* compute shared secret using peer public key
+                * and current private key
+                * shared secret = peer_key ^ priv_key mod p
+                */
+               BIGNUM *peer_key = NULL;
+
+               /* copy private key and peer key and compute shared secret */
+               peer_key = BN_bin2bn(op->pub_key.data,
+                               op->pub_key.length,
+                               peer_key);
+               if (peer_key == NULL) {
+                       cop->status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED;
+                       return -1;
+               }
+               priv_key = BN_bin2bn(op->priv_key.data,
+                               op->priv_key.length,
+                               priv_key);
+               if (priv_key == NULL) {
+                       BN_free(peer_key);
+                       cop->status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED;
+                       return -1;
+               }
+               set_dh_priv_key(dh_key, priv_key, ret);
+               if (ret) {
+                       OPENSSL_LOG(ERR, "Failed to set private key\n");
+                       cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
+                       BN_free(peer_key);
+                       BN_free(priv_key);
+                       return 0;
+               }
+
+               ret = DH_compute_key(
+                               op->shared_secret.data,
+                               peer_key, dh_key);
+               if (ret < 0) {
+                       cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
+                       BN_free(peer_key);
+                       /* priv key is already loaded into dh,
+                        * let's not free that directly here.
+                        * DH_free() will auto free it later.
+                        */
+                       return 0;
+               }
+               cop->status = RTE_CRYPTO_OP_STATUS_SUCCESS;
+               op->shared_secret.length = ret;
+               BN_free(peer_key);
+               return 0;
+       }
+
+       /*
+        * other options are public and private key generations.
+        *
+        * if user provides private key,
+        * then first set DH with user provided private key
+        */
+       if ((sess->u.dh.key_op &
+                       (1 << RTE_CRYPTO_ASYM_OP_PUBLIC_KEY_GENERATE)) &&
+                       !(sess->u.dh.key_op &
+                       (1 << RTE_CRYPTO_ASYM_OP_PRIVATE_KEY_GENERATE))) {
+               /* generate public key using user-provided private key
+                * pub_key = g ^ priv_key mod p
+                */
+
+               /* load private key into DH */
+               priv_key = BN_bin2bn(op->priv_key.data,
+                               op->priv_key.length,
+                               priv_key);
+               if (priv_key == NULL) {
+                       cop->status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED;
+                       return -1;
+               }
+               set_dh_priv_key(dh_key, priv_key, ret);
+               if (ret) {
+                       OPENSSL_LOG(ERR, "Failed to set private key\n");
+                       cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
+                       BN_free(priv_key);
+                       return 0;
+               }
+       }
+
+       /* generate public and private key pair.
+        *
+        * if private key already set, generates only public key.
+        *
+        * if private key is not already set, then set it to random value
+        * and update internal private key.
+        */
+       if (!DH_generate_key(dh_key)) {
+               cop->status = RTE_CRYPTO_OP_STATUS_ERROR;
+               return 0;
+       }
+
+       if (sess->u.dh.key_op & (1 << RTE_CRYPTO_ASYM_OP_PUBLIC_KEY_GENERATE)) {
+               const BIGNUM *pub_key = NULL;
+
+               OPENSSL_LOG(DEBUG, "%s:%d update public key\n",
+                               __func__, __LINE__);
+
+               /* get the generated keys */
+               get_dh_pub_key(dh_key, pub_key);
+
+               /* output public key */
+               op->pub_key.length = BN_bn2bin(pub_key,
+                               op->pub_key.data);
+       }
+
+       if (sess->u.dh.key_op &
+                       (1 << RTE_CRYPTO_ASYM_OP_PRIVATE_KEY_GENERATE)) {
+               const BIGNUM *priv_key = NULL;
+
+               OPENSSL_LOG(DEBUG, "%s:%d updated priv key\n",
+                               __func__, __LINE__);
+
+               /* get the generated keys */
+               get_dh_priv_key(dh_key, priv_key);
+
+               /* provide generated private key back to user */
+               op->priv_key.length = BN_bn2bin(priv_key,
+                               op->priv_key.data);
+       }
+
+       cop->status = RTE_CRYPTO_OP_STATUS_SUCCESS;
+
+       return 0;
+}
+
 /* process modinv operation */
 static int
 process_openssl_modinv_op(struct rte_crypto_op *cop,
@@ -1721,6 +1945,19 @@ process_asym_op(struct openssl_qp *qp, struct rte_crypto_op *op,
        case RTE_CRYPTO_ASYM_XFORM_MODINV:
                retval = process_openssl_modinv_op(op, sess);
                break;
+       case RTE_CRYPTO_ASYM_XFORM_DH:
+               retval = process_openssl_dh_op(op, sess);
+               break;
+       case RTE_CRYPTO_ASYM_XFORM_DSA:
+               if (op->asym->dsa.op_type == RTE_CRYPTO_ASYM_OP_SIGN)
+                       retval = process_openssl_dsa_sign_op(op, sess);
+               else if (op->asym->dsa.op_type ==
+                               RTE_CRYPTO_ASYM_OP_VERIFY)
+                       retval =
+                               process_openssl_dsa_verify_op(op, sess);
+               else
+                       op->status = RTE_CRYPTO_OP_STATUS_INVALID_ARGS;
+               break;
        default:
                op->status = RTE_CRYPTO_OP_STATUS_INVALID_ARGS;
                break;
index bbc203e..de22843 100644 (file)
@@ -527,6 +527,48 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = {
                },
                }
        },
+       {       /* dh */
+               .op = RTE_CRYPTO_OP_TYPE_ASYMMETRIC,
+               {.asym = {
+                       .xform_capa = {
+                               .xform_type = RTE_CRYPTO_ASYM_XFORM_DH,
+                               .op_types =
+                               ((1<<RTE_CRYPTO_ASYM_OP_PRIVATE_KEY_GENERATE) |
+                               (1 << RTE_CRYPTO_ASYM_OP_PUBLIC_KEY_GENERATE |
+                               (1 <<
+                               RTE_CRYPTO_ASYM_OP_SHARED_SECRET_COMPUTE))),
+                               {
+                               .modlen = {
+                               /* value 0 symbolizes no limit on min length */
+                               .min = 0,
+                               /* value 0 symbolizes no limit on max length */
+                               .max = 0,
+                               .increment = 1
+                               }, }
+                       }
+               },
+               }
+       },
+       {       /* dsa */
+               .op = RTE_CRYPTO_OP_TYPE_ASYMMETRIC,
+               {.asym = {
+                       .xform_capa = {
+                               .xform_type = RTE_CRYPTO_ASYM_XFORM_DSA,
+                               .op_types =
+                               ((1<<RTE_CRYPTO_ASYM_OP_SIGN) |
+                               (1 << RTE_CRYPTO_ASYM_OP_VERIFY)),
+                               {
+                               .modlen = {
+                               /* value 0 symbolizes no limit on min length */
+                               .min = 0,
+                               /* value 0 symbolizes no limit on max length */
+                               .max = 0,
+                               .increment = 1
+                               }, }
+                       }
+               },
+               }
+       },
 
        RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
 };
@@ -769,7 +811,8 @@ static int openssl_set_asym_session_parameters(
 {
        int ret = 0;
 
-       if (xform->next != NULL) {
+       if ((xform->xform_type != RTE_CRYPTO_ASYM_XFORM_DH) &&
+               (xform->next != NULL)) {
                OPENSSL_LOG(ERR, "chained xfrms are not supported on %s",
                        rte_crypto_asym_xform_strings[xform->xform_type]);
                return -1;
@@ -940,6 +983,147 @@ err_rsa:
                asym_session->xfrm_type = RTE_CRYPTO_ASYM_XFORM_MODINV;
                break;
        }
+       case RTE_CRYPTO_ASYM_XFORM_DH:
+       {
+               BIGNUM *p = NULL;
+               BIGNUM *g = NULL;
+
+               p = BN_bin2bn((const unsigned char *)
+                               xform->dh.p.data,
+                               xform->dh.p.length,
+                               p);
+               g = BN_bin2bn((const unsigned char *)
+                               xform->dh.g.data,
+                               xform->dh.g.length,
+                               g);
+               if (!p || !g)
+                       goto err_dh;
+
+               DH *dh = DH_new();
+               if (dh == NULL) {
+                       OPENSSL_LOG(ERR,
+                               "failed to allocate resources\n");
+                       goto err_dh;
+               }
+               set_dh_params(dh, p, g, ret);
+               if (ret) {
+                       DH_free(dh);
+                       goto err_dh;
+               }
+
+               /*
+                * setup xfrom for
+                * public key generate, or
+                * DH Priv key generate, or both
+                * public and private key generate
+                */
+               asym_session->u.dh.key_op = (1 << xform->dh.type);
+
+               if (xform->dh.type ==
+                       RTE_CRYPTO_ASYM_OP_PRIVATE_KEY_GENERATE) {
+                       /* check if next is pubkey */
+                       if ((xform->next != NULL) &&
+                               (xform->next->xform_type ==
+                               RTE_CRYPTO_ASYM_XFORM_DH) &&
+                               (xform->next->dh.type ==
+                               RTE_CRYPTO_ASYM_OP_PUBLIC_KEY_GENERATE)
+                               ) {
+                               /*
+                                * setup op as pub/priv key
+                                * pair generationi
+                                */
+                               asym_session->u.dh.key_op |=
+                               (1 <<
+                               RTE_CRYPTO_ASYM_OP_PUBLIC_KEY_GENERATE);
+                       }
+               }
+               asym_session->u.dh.dh_key = dh;
+               asym_session->xfrm_type = RTE_CRYPTO_ASYM_XFORM_DH;
+               break;
+
+err_dh:
+               OPENSSL_LOG(ERR, " failed to set dh params\n");
+               if (p)
+                       BN_free(p);
+               if (g)
+                       BN_free(g);
+               return -1;
+       }
+       case RTE_CRYPTO_ASYM_XFORM_DSA:
+       {
+               BIGNUM *p = NULL, *g = NULL;
+               BIGNUM *q = NULL, *priv_key = NULL;
+               BIGNUM *pub_key = BN_new();
+               BN_zero(pub_key);
+
+               p = BN_bin2bn((const unsigned char *)
+                               xform->dsa.p.data,
+                               xform->dsa.p.length,
+                               p);
+
+               g = BN_bin2bn((const unsigned char *)
+                               xform->dsa.g.data,
+                               xform->dsa.g.length,
+                               g);
+
+               q = BN_bin2bn((const unsigned char *)
+                               xform->dsa.q.data,
+                               xform->dsa.q.length,
+                               q);
+               if (!p || !q || !g)
+                       goto err_dsa;
+
+               priv_key = BN_bin2bn((const unsigned char *)
+                               xform->dsa.x.data,
+                               xform->dsa.x.length,
+                               priv_key);
+               if (priv_key == NULL)
+                       goto err_dsa;
+
+               DSA *dsa = DSA_new();
+               if (dsa == NULL) {
+                       OPENSSL_LOG(ERR,
+                               " failed to allocate resources\n");
+                       goto err_dsa;
+               }
+
+               set_dsa_params(dsa, p, q, g, ret);
+               if (ret) {
+                       DSA_free(dsa);
+                       OPENSSL_LOG(ERR, "Failed to dsa params\n");
+                       goto err_dsa;
+               }
+
+               /*
+                * openssl 1.1.0 mandate that public key can't be
+                * NULL in very first call. so set a dummy pub key.
+                * to keep consistency, lets follow same approach for
+                * both versions
+                */
+               /* just set dummy public for very 1st call */
+               set_dsa_keys(dsa, pub_key, priv_key, ret);
+               if (ret) {
+                       DSA_free(dsa);
+                       OPENSSL_LOG(ERR, "Failed to set keys\n");
+                       return -1;
+               }
+               asym_session->u.s.dsa = dsa;
+               asym_session->xfrm_type = RTE_CRYPTO_ASYM_XFORM_DSA;
+               break;
+
+err_dsa:
+               if (p)
+                       BN_free(p);
+               if (q)
+                       BN_free(q);
+               if (g)
+                       BN_free(g);
+               if (priv_key)
+                       BN_free(priv_key);
+               if (pub_key)
+                       BN_free(pub_key);
+               return -1;
+       }
        default:
                return -1;
        }
@@ -1021,6 +1205,14 @@ static void openssl_reset_asym_session(struct openssl_asym_session *sess)
                        BN_CTX_free(sess->u.m.ctx);
                }
                break;
+       case RTE_CRYPTO_ASYM_XFORM_DH:
+               if (sess->u.dh.dh_key)
+                       DH_free(sess->u.dh.dh_key);
+               break;
+       case RTE_CRYPTO_ASYM_XFORM_DSA:
+               if (sess->u.s.dsa)
+                       DSA_free(sess->u.s.dsa);
+               break;
        default:
                break;
        }
index 0ebe596..a8f2c84 100644 (file)
@@ -9,6 +9,8 @@
 #include <openssl/hmac.h>
 #include <openssl/des.h>
 #include <openssl/rsa.h>
+#include <openssl/dh.h>
+#include <openssl/dsa.h>
 
 #define CRYPTODEV_NAME_OPENSSL_PMD     crypto_openssl
 /**< Open SSL Crypto PMD device name */
@@ -159,6 +161,13 @@ struct openssl_asym_session {
                        BIGNUM *modulus;
                        BN_CTX *ctx;
                } m;
+               struct dh {
+                       DH *dh_key;
+                       uint32_t key_op;
+               } dh;
+               struct {
+                       DSA *dsa;
+               } s;
        } u;
 } __rte_cache_aligned;
 /** Set and validate OPENSSL crypto session parameters */