Commit | Line | Data |
---|---|---|
4ae71c1d DH |
1 | /* Signature verification with an asymmetric key |
2 | * | |
3 | * See Documentation/security/asymmetric-keys.txt | |
4 | * | |
5 | * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. | |
6 | * Written by David Howells (dhowells@redhat.com) | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or | |
9 | * modify it under the terms of the GNU General Public Licence | |
10 | * as published by the Free Software Foundation; either version | |
11 | * 2 of the Licence, or (at your option) any later version. | |
12 | */ | |
13 | ||
c3ce6dfa | 14 | #define pr_fmt(fmt) "SIG: "fmt |
4ae71c1d | 15 | #include <keys/asymmetric-subtype.h> |
1f6a9ab0 | 16 | #include <linux/export.h> |
4ae71c1d | 17 | #include <linux/err.h> |
3b764563 | 18 | #include <linux/slab.h> |
d9af2063 | 19 | #include <linux/keyctl.h> |
4ae71c1d | 20 | #include <crypto/public_key.h> |
d9af2063 | 21 | #include <keys/user-type.h> |
4ae71c1d DH |
22 | #include "asymmetric_keys.h" |
23 | ||
3b764563 DH |
24 | /* |
25 | * Destroy a public key signature. | |
26 | */ | |
27 | void public_key_signature_free(struct public_key_signature *sig) | |
28 | { | |
a022ec02 DH |
29 | int i; |
30 | ||
3b764563 | 31 | if (sig) { |
a022ec02 DH |
32 | for (i = 0; i < ARRAY_SIZE(sig->auth_ids); i++) |
33 | kfree(sig->auth_ids[i]); | |
3b764563 DH |
34 | kfree(sig->s); |
35 | kfree(sig->digest); | |
36 | kfree(sig); | |
37 | } | |
38 | } | |
39 | EXPORT_SYMBOL_GPL(public_key_signature_free); | |
40 | ||
d9af2063 DH |
41 | /** |
42 | * query_asymmetric_key - Get information about an aymmetric key. | |
43 | * @params: Various parameters. | |
44 | * @info: Where to put the information. | |
45 | */ | |
46 | int query_asymmetric_key(const struct kernel_pkey_params *params, | |
47 | struct kernel_pkey_query *info) | |
48 | { | |
49 | const struct asymmetric_key_subtype *subtype; | |
50 | struct key *key = params->key; | |
51 | int ret; | |
52 | ||
53 | pr_devel("==>%s()\n", __func__); | |
54 | ||
55 | if (key->type != &key_type_asymmetric) | |
56 | return -EINVAL; | |
57 | subtype = asymmetric_key_subtype(key); | |
58 | if (!subtype || | |
59 | !key->payload.data[0]) | |
60 | return -EINVAL; | |
61 | if (!subtype->query) | |
62 | return -ENOTSUPP; | |
63 | ||
64 | ret = subtype->query(params, info); | |
65 | ||
66 | pr_devel("<==%s() = %d\n", __func__, ret); | |
67 | return ret; | |
68 | } | |
69 | EXPORT_SYMBOL_GPL(query_asymmetric_key); | |
70 | ||
71 | /** | |
72 | * encrypt_blob - Encrypt data using an asymmetric key | |
73 | * @params: Various parameters | |
74 | * @data: Data blob to be encrypted, length params->data_len | |
75 | * @enc: Encrypted data buffer, length params->enc_len | |
76 | * | |
77 | * Encrypt the specified data blob using the private key specified by | |
78 | * params->key. The encrypted data is wrapped in an encoding if | |
79 | * params->encoding is specified (eg. "pkcs1"). | |
80 | * | |
81 | * Returns the length of the data placed in the encrypted data buffer or an | |
82 | * error. | |
83 | */ | |
84 | int encrypt_blob(struct kernel_pkey_params *params, | |
85 | const void *data, void *enc) | |
86 | { | |
87 | params->op = kernel_pkey_encrypt; | |
88 | return asymmetric_key_eds_op(params, data, enc); | |
89 | } | |
90 | EXPORT_SYMBOL_GPL(encrypt_blob); | |
91 | ||
92 | /** | |
93 | * decrypt_blob - Decrypt data using an asymmetric key | |
94 | * @params: Various parameters | |
95 | * @enc: Encrypted data to be decrypted, length params->enc_len | |
96 | * @data: Decrypted data buffer, length params->data_len | |
97 | * | |
98 | * Decrypt the specified data blob using the private key specified by | |
99 | * params->key. The decrypted data is wrapped in an encoding if | |
100 | * params->encoding is specified (eg. "pkcs1"). | |
101 | * | |
102 | * Returns the length of the data placed in the decrypted data buffer or an | |
103 | * error. | |
104 | */ | |
105 | int decrypt_blob(struct kernel_pkey_params *params, | |
106 | const void *enc, void *data) | |
107 | { | |
108 | params->op = kernel_pkey_decrypt; | |
109 | return asymmetric_key_eds_op(params, enc, data); | |
110 | } | |
111 | EXPORT_SYMBOL_GPL(decrypt_blob); | |
112 | ||
113 | /** | |
114 | * create_signature - Sign some data using an asymmetric key | |
115 | * @params: Various parameters | |
116 | * @data: Data blob to be signed, length params->data_len | |
117 | * @enc: Signature buffer, length params->enc_len | |
118 | * | |
119 | * Sign the specified data blob using the private key specified by params->key. | |
120 | * The signature is wrapped in an encoding if params->encoding is specified | |
121 | * (eg. "pkcs1"). If the encoding needs to know the digest type, this can be | |
122 | * passed through params->hash_algo (eg. "sha1"). | |
123 | * | |
124 | * Returns the length of the data placed in the signature buffer or an error. | |
125 | */ | |
126 | int create_signature(struct kernel_pkey_params *params, | |
127 | const void *data, void *enc) | |
128 | { | |
129 | params->op = kernel_pkey_sign; | |
130 | return asymmetric_key_eds_op(params, data, enc); | |
131 | } | |
132 | EXPORT_SYMBOL_GPL(create_signature); | |
133 | ||
4ae71c1d DH |
134 | /** |
135 | * verify_signature - Initiate the use of an asymmetric key to verify a signature | |
136 | * @key: The asymmetric key to verify against | |
137 | * @sig: The signature to check | |
138 | * | |
139 | * Returns 0 if successful or else an error. | |
140 | */ | |
141 | int verify_signature(const struct key *key, | |
142 | const struct public_key_signature *sig) | |
143 | { | |
144 | const struct asymmetric_key_subtype *subtype; | |
145 | int ret; | |
146 | ||
147 | pr_devel("==>%s()\n", __func__); | |
148 | ||
149 | if (key->type != &key_type_asymmetric) | |
150 | return -EINVAL; | |
151 | subtype = asymmetric_key_subtype(key); | |
152 | if (!subtype || | |
146aa8b1 | 153 | !key->payload.data[0]) |
4ae71c1d DH |
154 | return -EINVAL; |
155 | if (!subtype->verify_signature) | |
156 | return -ENOTSUPP; | |
157 | ||
158 | ret = subtype->verify_signature(key, sig); | |
159 | ||
160 | pr_devel("<==%s() = %d\n", __func__, ret); | |
161 | return ret; | |
162 | } | |
163 | EXPORT_SYMBOL_GPL(verify_signature); |