This commit introduces library for SM9 (ShangMi9) key exchange crypto algorithm. SM9 is an ID-based crypto algorithm providing asymmetric encryption, signature and key exchange capability. Within which, the key exchange algorithm has been accepted in ISO/IEC 11770-3:2021 international standard. sm9_lib.c contains mathematical algorithms used by SM9 key exchange algorithm. References: http://c.gb688.cn/bzgk/gb/showGb?type=online&hcno=B7A0D7DFF411CD0AAE76135ADE91886A http://c.gb688.cn/bzgk/gb/showGb?type=online&hcno=02A8E87248BD500747D2CD484C034EB0 https://github.com/guanzhi/GmSSL Co-developed-by: LI Shiya <lishiya1@xxxxxxxxxx> Signed-off-by: GUO Zihua <guozihua@xxxxxxxxxx> --- crypto/sm9_lib.c | 1584 ++++++++++++++++++++++++++++++++++++++++++++++ crypto/sm9_lib.h | 92 +++ 2 files changed, 1676 insertions(+) create mode 100644 crypto/sm9_lib.c create mode 100644 crypto/sm9_lib.h diff --git a/crypto/sm9_lib.c b/crypto/sm9_lib.c new file mode 100644 index 000000000000..7f8545c9e640 --- /dev/null +++ b/crypto/sm9_lib.c @@ -0,0 +1,1584 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Libraries for SM9 key exchange algorithm + * + * Copyright (c) 2023, Huawei Technology Co., Ltd. + * Authors: GUO Zihua <guozihua@xxxxxxxxxx> + */ + +#include <linux/module.h> +#include <linux/mpi.h> +#include <linux/string.h> +#include <crypto/sm9.h> + +#include "sm9_lib.h" + +unsigned int mpi_dump_to_buf(MPI a, u8 *buf, unsigned int expected_size) +{ + unsigned int written_size; + u8 *mpi_buf; + + if (expected_size < mpi_get_size(a)) + return 0; + + mpi_buf = mpi_get_buffer(a, &written_size, NULL); + if (!mpi_buf) + return 0; + memcpy(buf + (expected_size - written_size), mpi_buf, expected_size); + kfree(mpi_buf); + return expected_size; +} + +int mpi_point_jacobian_to_affine(MPI_POINT out, MPI_POINT p, MPI q) +{ + MPI z, _q; + int rc = -ENOMEM; + + if (!out) + return -EINVAL; + + z = mpi_new(0); + _q = mpi_new(0); + if (!z || !_q) + goto out_free; + + mpi_sub_ui(_q, q, 3); + mpi_powm(z, p->z, _q, q); + mpi_mulm(out->x, p->x, z, q); + + mpi_sub_ui(_q, q, 4); + mpi_powm(z, p->z, _q, q); + mpi_mulm(out->y, p->y, z, q); + + mpi_set_ui(out->z, 1); + rc = 0; + +out_free: + mpi_free(z); + mpi_free(_q); + return rc; +} +EXPORT_SYMBOL_GPL(mpi_point_jacobian_to_affine); + +int mpi_point_export(MPI_POINT P, u8 *buf, size_t size) +{ + unsigned int nbytes, x_size; + int rc; + + if (size < max(mpi_get_size(P->x), mpi_get_size(P->y)) * 2) + return -EINVAL; + + x_size = size / 2; + rc = mpi_read_buffer(P->x, buf, x_size, &nbytes, NULL); + if (rc) + return nbytes; + + rc = mpi_read_buffer(P->y, buf + x_size, x_size, &nbytes, NULL); + if (rc) + return nbytes; + return 0; +} +EXPORT_SYMBOL_GPL(mpi_point_export); + +int mpi_point_from_buf(MPI_POINT P, const u8 *buf, size_t size) +{ + size_t x_size; + MPI x, y; + + if (size % 2) + return -EINVAL; + + x_size = size / 2; + x = mpi_read_raw_data(buf, x_size); + y = mpi_read_raw_data(buf + x_size, x_size); + if (!x || !y) { + mpi_free(x); + mpi_free(y); + return -ENOMEM; + } + + mpi_set(P->x, x); + mpi_set(P->y, y); + mpi_set_ui(P->z, 1); + + mpi_free(x); + mpi_free(y); + return 0; +} +EXPORT_SYMBOL_GPL(mpi_point_from_buf); + +static void mpi_div2m(MPI out, MPI a, MPI q) +{ + mpi_set(out, a); + + if (mpi_test_bit(a, 0)) + mpi_add(out, out, q); + mpi_rshift(out, out, 1); + mpi_mod(out, out, q); +} + +static bool sm9_dim_eq(SM9_DIM_FQ2 a, SM9_DIM_FQ2 b) +{ + return !(mpi_cmp(a[0], b[0]) && mpi_cmp(a[1], b[1])); +} + +int sm9_dim_init(SM9_DIM_FQ2 dim, unsigned int nbits) +{ + if (!dim) + return -EINVAL; + + dim[0] = mpi_new(nbits); + dim[1] = mpi_new(nbits); + if (!dim[0] || !dim[1]) + return -ENOMEM; + return 0; +} + +static int sm9_dim_init_from_buf(SM9_DIM_FQ2 dim, const u8 *buf, size_t size) +{ + size_t d_size; + + if (size % 2) + return -EINVAL; + + d_size = size / 2; + dim[1] = mpi_read_raw_data(buf, d_size); + dim[0] = mpi_read_raw_data(buf + d_size, d_size); + return 0; +} + +void sm9_dim_deinit(SM9_DIM_FQ2 dim) +{ + mpi_free(dim[0]); + mpi_free(dim[1]); +} + +void sm9_dim_free(SM9_DIM_FQ2 *dim) +{ + if (!dim) + return; + + sm9_dim_deinit(*dim); + kfree(dim); +} + +SM9_DIM_FQ2 *sm9_dim_alloc(unsigned int nbits) +{ + SM9_DIM_FQ2 *res; + + res = kzalloc(sizeof(SM9_DIM_FQ2), GFP_KERNEL); + if (!res) + return NULL; + + if (sm9_dim_init(*res, nbits)) { + kfree(res); + res = NULL; + } + return res; +} + +int sm9_dim_set(SM9_DIM_FQ2 a, SM9_DIM_FQ2 b) +{ + mpi_set(a[0], b[0]); + mpi_set(a[1], b[1]); + return 0; +} + +int sm9_dim_clear(SM9_DIM_FQ2 a) +{ + memzero_explicit(a[0]->d, a[0]->alloced * BYTES_PER_MPI_LIMB); + mpi_clear(a[0]); + memzero_explicit(a[1]->d, a[1]->alloced * BYTES_PER_MPI_LIMB); + mpi_clear(a[1]); + return 0; +} + +static int sm9_dim_mulm(SM9_DIM_FQ2 out, SM9_DIM_FQ2 _a, SM9_DIM_FQ2 _b, MPI q) +{ + MPI tmp; + SM9_DIM_FQ2 a, b; + int rc; + + if (!out) + return -EINVAL; + + tmp = mpi_new(0); + if (!tmp) + return -ENOMEM; + + rc = sm9_dim_init(a, 0); + rc |= sm9_dim_init(b, 0); + if (rc) + goto out_free; + sm9_dim_set(a, _a); + sm9_dim_set(b, _b); + + mpi_mulm(out[0], a[0], b[0], q); + mpi_mulm(tmp, a[1], b[1], q); + mpi_addm(tmp, tmp, tmp, q); + mpi_subm(out[0], out[0], tmp, q); + + mpi_mulm(out[1], a[0], b[1], q); + mpi_mulm(tmp, a[1], b[0], q); + mpi_addm(out[1], out[1], tmp, q); + +out_free: + sm9_dim_deinit(a); + sm9_dim_deinit(b); + mpi_free(tmp); + return rc; +} + +static int sm9_dim_mulm_u(SM9_DIM_FQ2 out, SM9_DIM_FQ2 _a, SM9_DIM_FQ2 _b, + MPI q) +{ + MPI tmp; + SM9_DIM_FQ2 a, b; + int rc; + + if (!out) + return -EINVAL; + + tmp = mpi_new(0); + if (!tmp) + return -ENOMEM; + + rc = sm9_dim_init(a, 0); + rc |= sm9_dim_init(b, 0); + if (rc) + goto out_free; + sm9_dim_set(a, _a); + sm9_dim_set(b, _b); + + mpi_mulm(out[0], a[0], b[1], q); + mpi_mulm(tmp, a[1], b[0], q); + mpi_addm(out[0], out[0], tmp, q); + mpi_addm(out[0], out[0], out[0], q); + mpi_subm(out[0], q, out[0], q); + + mpi_mulm(out[1], a[0], b[0], q); + mpi_mulm(tmp, a[1], b[1], q); + mpi_addm(tmp, tmp, tmp, q); + mpi_subm(out[1], out[1], tmp, q); + +out_free: + sm9_dim_deinit(a); + sm9_dim_deinit(b); + mpi_free(tmp); + return 0; +} + +static int sm9_dim_mulm_mpi(SM9_DIM_FQ2 out, SM9_DIM_FQ2 P, MPI a, MPI q) +{ + mpi_mulm(out[0], P[0], a, q); + mpi_mulm(out[1], P[1], a, q); + return 0; +} + +static int sm9_dim_mulm_ui(SM9_DIM_FQ2 out, SM9_DIM_FQ2 P, unsigned int a, + MPI q) +{ + int rc; + MPI p = mpi_new(0); + + if (!p) + return -ENOMEM; + + mpi_set_ui(p, a); + rc = sm9_dim_mulm_mpi(out, P, p, q); + mpi_free(p); + return rc; +} + +static int sm9_dim_subm(SM9_DIM_FQ2 out, SM9_DIM_FQ2 a, SM9_DIM_FQ2 b, MPI q) +{ + if (!out) + return -EINVAL; + + mpi_subm(out[0], a[0], b[0], q); + mpi_subm(out[1], a[1], b[1], q); + return 0; +} + +static int sm9_dim_addm(SM9_DIM_FQ2 out, SM9_DIM_FQ2 a, SM9_DIM_FQ2 b, MPI q) +{ + if (!out) + return -EINVAL; + + mpi_addm(out[0], a[0], b[0], q); + mpi_addm(out[1], a[1], b[1], q); + return 0; +} + +static int sm9_dim_negm(SM9_DIM_FQ2 out, SM9_DIM_FQ2 a, MPI q) +{ + if (!out) + return -EINVAL; + + mpi_subm(out[0], q, a[0], q); + mpi_subm(out[1], q, a[1], q); + return 0; +} + +static int sm9_dim_div2m(SM9_DIM_FQ2 out, SM9_DIM_FQ2 a, MPI q) +{ + if (!out) + return -EINVAL; + + mpi_div2m(out[0], a[0], q); + mpi_div2m(out[1], a[1], q); + return 0; +} + +static int sm9_dim_conjugate(SM9_DIM_FQ2 out, SM9_DIM_FQ2 a, MPI q) +{ + if (!out) + return -EINVAL; + + mpi_set(out[0], a[0]); + mpi_subm(out[1], q, a[1], q); + return 0; +} + +static int sm9_dim_copy(SM9_DIM_FQ2 out, SM9_DIM_FQ2 a) +{ + if (!out) + return -EINVAL; + + mpi_set(out[0], a[0]); + mpi_set(out[1], a[1]); + return 0; +} + +static int sm9_dim_is_zero(SM9_DIM_FQ2 a) +{ + return !(mpi_cmp_ui(a[0], 0) || mpi_cmp_ui(a[1], 0)); +} + +static int sm9_dim_invm(SM9_DIM_FQ2 out, SM9_DIM_FQ2 a, MPI q, MPI q_minus_2) +{ + MPI t0, t1; + + if (!out) + return -EINVAL; + + if (!mpi_cmp_ui(a[0], 0)) { + mpi_clear(out[0]); + mpi_addm(out[1], a[1], a[1], q); + mpi_powm(out[1], out[1], q_minus_2, q); + mpi_subm(out[1], q, out[1], q); + } else if (!mpi_cmp_ui(a[1], 0)) { + mpi_clear(out[1]); + mpi_powm(out[0], q_minus_2, a[0], q); + } else { + t0 = mpi_new(0); + t1 = mpi_new(0); + if (!t0 || !t1) { + mpi_free(t0); + mpi_free(t1); + return -ENOMEM; + } + + mpi_mulm(t0, a[0], a[0], q); + mpi_mulm(t1, a[1], a[1], q); + mpi_addm(t1, t1, t1, q); + mpi_addm(t0, t0, t1, q); + mpi_powm(t0, t0, q_minus_2, q); + + mpi_mulm(out[0], a[0], t0, q); + mpi_mulm(out[1], a[1], t0, q); + mpi_subm(out[1], q, out[1], q); + + mpi_free(t0); + mpi_free(t1); + } + return 0; +} + +static size_t sm9_dim_get_size(SM9_DIM_FQ2 a) +{ + size_t size; + + size = mpi_get_size(a[0]); + size += mpi_get_size(a[1]); + return size; +} + +static ssize_t sm9_dim_to_buf_rev(SM9_DIM_FQ2 a, char *buf, size_t size) +{ + unsigned int d_size = size / 2, written_size; + + written_size = mpi_dump_to_buf(a[1], buf, d_size); + if (written_size != d_size) + return -ENOMEM; + + written_size = mpi_dump_to_buf(a[0], buf + d_size, d_size); + if (written_size != d_size) + return -ENOMEM; + return size; +} + +static int sm9_point_copy(SM9_POINT out, SM9_POINT p) +{ + if (!out) + return -EINVAL; + + if (out == p) + return 0; + + mpi_set(out->xd1, p->xd1); + mpi_set(out->xd2, p->xd2); + mpi_set(out->yd1, p->yd1); + mpi_set(out->yd2, p->yd2); + mpi_set(out->zd1, p->zd1); + mpi_set(out->zd2, p->zd2); + return 0; +} + +void sm9_point_release(SM9_POINT P) +{ + if (!P) + return; + + sm9_dim_deinit(P->x_fq2); + sm9_dim_deinit(P->y_fq2); + sm9_dim_deinit(P->z_fq2); + kfree(P); +} + +SM9_POINT sm9_point_new(unsigned int nbits) +{ + SM9_POINT res; + + res = kzalloc(sizeof(struct sm9_point_fq2), GFP_KERNEL); + if (!res) + return NULL; + + if (sm9_dim_init(res->x_fq2, nbits) || + sm9_dim_init(res->y_fq2, nbits) || + sm9_dim_init(res->z_fq2, nbits)) { + sm9_point_release(res); + return NULL; + } + return res; +} + +SM9_POINT sm9_point_from_buf(const u8 *buf, size_t size) +{ + SM9_POINT res; + size_t x_size; + int rc; + + res = kzalloc(sizeof(struct sm9_point_fq2), GFP_KERNEL); + if (!res) + return NULL; + + x_size = size / 2; + rc = sm9_dim_init_from_buf(res->x_fq2, buf, x_size); + if (rc) { + kfree(res); + return NULL; + } + + rc = sm9_dim_init_from_buf(res->y_fq2, buf + x_size, x_size); + if (rc) { + sm9_dim_deinit(res->x_fq2); + kfree(res); + return NULL; + } + + rc = sm9_dim_init(res->z_fq2, 0); + if (rc) { + sm9_dim_deinit(res->x_fq2); + sm9_dim_deinit(res->y_fq2); + kfree(res); + } + mpi_set_ui(res->zd1, 1); + return res; +} +EXPORT_SYMBOL_GPL(sm9_point_from_buf); + +static bool sm9_point_is_infinity(SM9_POINT p) +{ + return !(mpi_cmp_ui(p->zd1, 0) && mpi_cmp_ui(p->zd2, 0)); +} + +bool sm9_point_valid(SM9_POINT P, struct sm9_ctx *ctx) +{ + SM9_DIM_FQ2 x, y; + SM9_POINT Q; + MPI q = ctx->sys_cfg->q; + bool rc; + + if (sm9_dim_init(x, 0) || sm9_dim_init(y, 0)) { + sm9_dim_deinit(x); + sm9_dim_deinit(y); + return false; + } + + sm9_dim_mulm(x, P->x_fq2, P->x_fq2, q); + sm9_dim_mulm(x, x, P->x_fq2, q); + mpi_addm(x[0], x[0], ctx->sys_cfg->b, q); + + sm9_dim_mulm(y, P->y_fq2, P->y_fq2, q); + if (!sm9_dim_eq(x, y)) { + sm9_dim_deinit(x); + sm9_dim_deinit(y); + return false; + } + + Q = sm9_point_new(0); + if (!Q) { + sm9_dim_deinit(x); + sm9_dim_deinit(y); + return false; + } + sm9_point_mpi_mulm(Q, P, ctx->sys_cfg->q, ctx); + rc = sm9_point_is_infinity(Q); + + sm9_dim_deinit(x); + sm9_dim_deinit(y); + sm9_point_release(Q); + return rc; +} +EXPORT_SYMBOL_GPL(sm9_point_valid); + +static int sm9_point_addm_same(SM9_POINT out, SM9_POINT _P, struct sm9_ctx *ctx) +{ + SM9_DIM_FQ2 x2, x4, y2, y4, tmp; + SM9_POINT P; + MPI q = ctx->sys_cfg->q; + int rc; + + rc = sm9_dim_init(x2, 0); + rc |= sm9_dim_init(x4, 0); + rc |= sm9_dim_init(y2, 0); + rc |= sm9_dim_init(y4, 0); + rc |= sm9_dim_init(tmp, 0); + if (rc) + goto out_free; + + P = sm9_point_new(0); + if (!P) + goto out_free; + sm9_point_copy(P, _P); + + sm9_dim_mulm(x2, P->x_fq2, P->x_fq2, q); + sm9_dim_mulm(x4, x2, x2, q); + sm9_dim_mulm(y2, P->y_fq2, P->y_fq2, q); + sm9_dim_mulm(y4, y2, y2, q); + + /* x3 = 9 * x1^4 - 8 * x1 * y1^2 */ + sm9_dim_mulm_ui(out->x_fq2, x4, 9, q); + sm9_dim_mulm(tmp, P->x_fq2, y2, q); + sm9_dim_mulm_ui(tmp, tmp, 8, q); + sm9_dim_subm(out->x_fq2, out->x_fq2, tmp, q); + + /* y3 = 3 * x1^2 * (4 * x1 * y1^2 - x3) - 8 * y1^4 */ + sm9_dim_mulm(out->y_fq2, P->x_fq2, y2, q); + sm9_dim_mulm_ui(out->y_fq2, out->y_fq2, 4, q); + sm9_dim_subm(out->y_fq2, out->y_fq2, out->x_fq2, q); + sm9_dim_mulm(out->y_fq2, out->y_fq2, x2, q); + sm9_dim_mulm_ui(out->y_fq2, out->y_fq2, 3, q); + sm9_dim_mulm_ui(tmp, y4, 8, q); + sm9_dim_subm(out->y_fq2, out->y_fq2, tmp, q); + + /* z3 = 2 * y1 * z1 */ + sm9_dim_mulm(out->z_fq2, P->y_fq2, P->z_fq2, q); + sm9_dim_mulm_ui(out->z_fq2, out->z_fq2, 2, q); + + rc = 0; +out_free: + sm9_dim_deinit(x2); + sm9_dim_deinit(x4); + sm9_dim_deinit(y2); + sm9_dim_deinit(y4); + sm9_dim_deinit(tmp); + sm9_point_release(P); + return rc; +} + +static int sm9_point_addm_diff(SM9_POINT out, SM9_POINT _P, SM9_POINT _Q, + struct sm9_ctx *ctx) +{ + SM9_DIM_FQ2 u1, u2, s1, s2, h, h2, h3, r, tmp; + SM9_POINT P, Q; + MPI q = ctx->sys_cfg->q; + int rc; + + rc = sm9_dim_init(u1, 0); + rc |= sm9_dim_init(u2, 0); + rc |= sm9_dim_init(s1, 0); + rc |= sm9_dim_init(s2, 0); + rc |= sm9_dim_init(h, 0); + rc |= sm9_dim_init(h2, 0); + rc |= sm9_dim_init(h3, 0); + rc |= sm9_dim_init(r, 0); + rc |= sm9_dim_init(tmp, 0); + if (rc) + goto out_free; + + P = sm9_point_new(0); + Q = sm9_point_new(0); + if (!Q || !P) + goto out_free_point; + sm9_point_copy(P, _P); + sm9_point_copy(Q, _Q); + + /* u1 = x1 * z2^2 */ + sm9_dim_mulm(u1, Q->z_fq2, Q->z_fq2, q); + sm9_dim_mulm(u1, P->x_fq2, u1, q); + /* u2 = x2 * z1^2 */ + sm9_dim_mulm(u2, P->z_fq2, P->z_fq2, q); + sm9_dim_mulm(u2, Q->x_fq2, u2, q); + /* s1 = y1 * z2^3 */ + sm9_dim_mulm(s1, Q->z_fq2, Q->z_fq2, q); + sm9_dim_mulm(s1, s1, Q->z_fq2, q); + sm9_dim_mulm(s1, P->y_fq2, s1, q); + /* s2 = y2 * z1^3 */ + sm9_dim_mulm(s2, P->z_fq2, P->z_fq2, q); + sm9_dim_mulm(s2, s2, P->z_fq2, q); + sm9_dim_mulm(s2, Q->y_fq2, s2, q); + /* h = u2 - u1 */ + sm9_dim_subm(h, u2, u1, q); + /* r = s2 - s1 */ + sm9_dim_subm(r, s2, s1, q); + + /* x3 = r^2 - h^3 - 2 * u1 * h^2 */ + sm9_dim_mulm(out->x_fq2, r, r, q); + sm9_dim_mulm(out->x_fq2, r, r, q); + sm9_dim_mulm(h2, h, h, q); + sm9_dim_mulm(h3, h2, h, q); + sm9_dim_subm(out->x_fq2, out->x_fq2, h3, q); + sm9_dim_mulm(tmp, u1, h2, q); + sm9_dim_mulm_ui(tmp, tmp, 2, q); + sm9_dim_subm(out->x_fq2, out->x_fq2, tmp, q); + + /* y3 = r * (u1 * h^2 - x3) - s1 * h^3 */ + sm9_dim_mulm(out->y_fq2, u1, h2, q); + sm9_dim_subm(out->y_fq2, out->y_fq2, out->x_fq2, q); + sm9_dim_mulm(out->y_fq2, r, out->y_fq2, q); + sm9_dim_mulm(tmp, s1, h3, q); + sm9_dim_subm(out->y_fq2, out->y_fq2, tmp, q); + + /* z3 = z1 * z2 * h */ + sm9_dim_mulm(out->z_fq2, P->z_fq2, Q->z_fq2, q); + sm9_dim_mulm(out->z_fq2, out->z_fq2, h, q); + + rc = 0; +out_free_point: + sm9_point_release(P); + sm9_point_release(Q); +out_free: + sm9_dim_deinit(u1); + sm9_dim_deinit(u2); + sm9_dim_deinit(s1); + sm9_dim_deinit(s2); + sm9_dim_deinit(h); + sm9_dim_deinit(h2); + sm9_dim_deinit(h3); + sm9_dim_deinit(r); + sm9_dim_deinit(tmp); + return rc; +} + +static int sm9_point_same(SM9_POINT a, SM9_POINT b) +{ + if (a == b) + return 1; + + if (!mpi_cmp(a->xd1, b->xd1) && !mpi_cmp(a->xd2, b->xd2) && + !mpi_cmp(a->yd1, b->yd1) && !mpi_cmp(a->yd2, b->yd2) && + !mpi_cmp(a->zd1, b->zd1) && !mpi_cmp(a->zd2, b->zd2)) + return 1; + return 0; +} + +int sm9_point_addm(SM9_POINT out, SM9_POINT P, SM9_POINT Q, struct sm9_ctx *ctx) +{ + if (!out) + return -EINVAL; + + if (sm9_dim_is_zero(P->z_fq2)) { + sm9_point_copy(out, Q); + return 0; + } else if (sm9_dim_is_zero(Q->z_fq2)) { + sm9_point_copy(out, P); + return 0; + } + + if (sm9_point_same(P, Q)) + return sm9_point_addm_same(out, P, ctx); + return sm9_point_addm_diff(out, P, Q, ctx); +} +EXPORT_SYMBOL_GPL(sm9_point_addm); + +int sm9_point_mpi_mulm(SM9_POINT out, SM9_POINT _P, MPI a, struct sm9_ctx *ctx) +{ + SM9_POINT P; + int i; + + if (!out) + return -EINVAL; + + P = sm9_point_new(0); + if (!P) + return -ENOMEM; + mpi_set_ui(P->xd1, 1); + mpi_set_ui(P->yd1, 1); + mpi_set_ui(P->zd1, 0); + + for (i = mpi_get_nbits(a) - 1; i >= 0; i--) { + sm9_point_addm(P, P, P, ctx); + if (mpi_test_bit(a, i)) + sm9_point_addm(P, P, _P, ctx); + } + sm9_point_copy(out, P); + sm9_point_release(P); + return 0; +} +EXPORT_SYMBOL_GPL(sm9_point_mpi_mulm); + +int sm9_point_mpi_addm(SM9_POINT out, SM9_POINT P, MPI a, MPI q) +{ + if (!out) + return -EINVAL; + + mpi_addm(out->xd1, P->xd1, a, q); + mpi_addm(out->yd1, P->yd1, a, q); + return 0; +} +EXPORT_SYMBOL_GPL(sm9_point_mpi_addm); + +void sm9_point_clear(SM9_POINT p) +{ + sm9_dim_clear(p->x_fq2); + sm9_dim_clear(p->y_fq2); + sm9_dim_clear(p->z_fq2); +} +EXPORT_SYMBOL_GPL(sm9_point_clear); + +int sm9_dim_fq4_set(SM9_DIM_FQ4 a, SM9_DIM_FQ4 b) +{ + sm9_dim_set(a[0], b[0]); + sm9_dim_set(a[1], b[1]); + return 0; +} + +void sm9_dim_fq4_deinit(SM9_DIM_FQ4 p) +{ + sm9_dim_deinit(p[0]); + sm9_dim_deinit(p[1]); +} + +int sm9_dim_fq4_init(SM9_DIM_FQ4 p, unsigned int nbits) +{ + int i, rc; + + if (!p) + return -EINVAL; + + for (i = 0; i < 2; i++) { + rc = sm9_dim_init(p[i], 0); + if (rc) { + sm9_dim_fq4_deinit(p); + return rc; + } + } + return 0; +} + +int sm9_dim_fq4_clear(SM9_DIM_FQ4 p) +{ + sm9_dim_clear(p[0]); + sm9_dim_clear(p[1]); + return 0; +} + +static int sm9_dim_fq4_mulm(SM9_DIM_FQ4 out, SM9_DIM_FQ4 _a, SM9_DIM_FQ4 _b, + struct sm9_ctx *ctx) +{ + SM9_DIM_FQ2 tmp; + SM9_DIM_FQ4 a, b; + MPI q = ctx->sys_cfg->q; + int rc; + + rc = sm9_dim_init(tmp, 0); + rc |= sm9_dim_fq4_init(a, 0); + rc |= sm9_dim_fq4_init(b, 0); + if (rc) + goto out_free; + sm9_dim_fq4_set(a, _a); + sm9_dim_fq4_set(b, _b); + + sm9_dim_mulm(out[0], a[0], b[0], q); + sm9_dim_mulm_u(tmp, a[1], b[1], q); + sm9_dim_addm(out[0], out[0], tmp, q); + + sm9_dim_mulm(out[1], a[0], b[1], q); + sm9_dim_mulm(tmp, a[1], b[0], q); + sm9_dim_addm(out[1], out[1], tmp, q); + +out_free: + sm9_dim_fq4_deinit(a); + sm9_dim_fq4_deinit(b); + sm9_dim_deinit(tmp); + return rc; +} + +static int sm9_dim_fq4_mulm_mpi(SM9_DIM_FQ4 out, SM9_DIM_FQ4 a, MPI b, + struct sm9_ctx *ctx) +{ + sm9_dim_mulm_mpi(out[0], a[0], b, ctx->sys_cfg->q); + sm9_dim_mulm_mpi(out[1], a[1], b, ctx->sys_cfg->q); + return 0; +} + +static int sm9_dim_fq4_mulm_v(SM9_DIM_FQ4 out, SM9_DIM_FQ4 _a, SM9_DIM_FQ4 _b, + struct sm9_ctx *ctx) +{ + SM9_DIM_FQ2 tmp; + SM9_DIM_FQ4 a, b; + MPI q = ctx->sys_cfg->q; + int rc; + + rc = sm9_dim_init(tmp, 0); + rc |= sm9_dim_fq4_init(a, 0); + rc |= sm9_dim_fq4_init(b, 0); + if (rc) + goto out_free; + sm9_dim_fq4_set(a, _a); + sm9_dim_fq4_set(b, _b); + + sm9_dim_mulm_u(out[0], a[1], b[0], q); + sm9_dim_mulm_u(tmp, a[0], b[1], q); + sm9_dim_addm(out[0], out[0], tmp, q); + + sm9_dim_mulm(out[1], a[0], b[0], q); + sm9_dim_mulm_u(tmp, a[1], b[1], q); + sm9_dim_addm(out[1], out[1], tmp, q); + +out_free: + sm9_dim_fq4_deinit(a); + sm9_dim_fq4_deinit(b); + sm9_dim_deinit(tmp); + return 0; +} + +static int sm9_dim_fq4_addm(SM9_DIM_FQ4 out, SM9_DIM_FQ4 a, SM9_DIM_FQ4 b, + struct sm9_ctx *ctx) +{ + MPI q = ctx->sys_cfg->q; + + sm9_dim_addm(out[0], a[0], b[0], q); + sm9_dim_addm(out[1], a[1], b[1], q); + + return 0; +} + +static int sm9_dim_fq4_subm(SM9_DIM_FQ4 out, SM9_DIM_FQ4 a, SM9_DIM_FQ4 b, + struct sm9_ctx *ctx) +{ + sm9_dim_subm(out[0], a[0], b[0], ctx->sys_cfg->q); + sm9_dim_subm(out[1], a[1], b[1], ctx->sys_cfg->q); + return 0; +} + +static int sm9_dim_fq4_invm(SM9_DIM_FQ4 out, SM9_DIM_FQ4 a, struct sm9_ctx *ctx) +{ + SM9_DIM_FQ2 t0, t1, t2; + MPI q = ctx->sys_cfg->q; + + if (sm9_dim_init(t0, 0) || sm9_dim_init(t1, 0) || sm9_dim_init(t2, 0)) { + sm9_dim_deinit(t0); + sm9_dim_deinit(t1); + sm9_dim_deinit(t2); + return -ENOMEM; + } + + sm9_dim_mulm_u(t2, a[1], a[1], q); + sm9_dim_mulm(t0, a[0], a[0], q); + sm9_dim_subm(t2, t2, t0, q); + sm9_dim_invm(t2, t2, q, ctx->sys_cfg->q_minus_2); + + sm9_dim_mulm(t0, a[0], t2, q); + sm9_dim_negm(out[0], t0, q); + + sm9_dim_mulm(out[1], a[1], t2, q); + + sm9_dim_deinit(t0); + sm9_dim_deinit(t1); + sm9_dim_deinit(t2); + return 0; +} + +static int sm9_dim_fq4_is_zero(SM9_DIM_FQ4 a) +{ + return sm9_dim_is_zero(a[0]) && sm9_dim_is_zero(a[1]); +} + +static int sm9_dim_fq4_negm(SM9_DIM_FQ4 out, SM9_DIM_FQ4 a, struct sm9_ctx *ctx) +{ + sm9_dim_negm(out[0], a[0], ctx->sys_cfg->q); + sm9_dim_negm(out[1], a[1], ctx->sys_cfg->q); + return 0; +} + +static int sm9_dim_fq4_conjugate(SM9_DIM_FQ4 out, SM9_DIM_FQ4 a, + struct sm9_ctx *ctx) +{ + sm9_dim_set(out[0], a[0]); + sm9_dim_negm(out[1], a[1], ctx->sys_cfg->q); + return 0; +} + +static size_t sm9_dim_fq4_get_size(SM9_DIM_FQ4 a) +{ + size_t size; + + size = sm9_dim_get_size(a[0]); + size += sm9_dim_get_size(a[1]); + return size; +} + +static ssize_t sm9_dim_fq4_to_buf_rev(SM9_DIM_FQ4 a, char *buf, size_t size) +{ + ssize_t d_size = size / 2, written_size; + + written_size = sm9_dim_to_buf_rev(a[1], buf, d_size); + if (written_size < 0) + return written_size; + + written_size = sm9_dim_to_buf_rev(a[0], buf + d_size, d_size); + if (written_size < 0) + return written_size; + return size; +} + +int sm9_dim_fq12_set(SM9_DIM_FQ12 a, SM9_DIM_FQ12 b) +{ + sm9_dim_fq4_set(a[0], b[0]); + sm9_dim_fq4_set(a[1], b[1]); + sm9_dim_fq4_set(a[2], b[2]); + return 0; +} + +void sm9_dim_fq12_deinit(SM9_DIM_FQ12 d) +{ + sm9_dim_fq4_deinit(d[0]); + sm9_dim_fq4_deinit(d[1]); + sm9_dim_fq4_deinit(d[2]); +} + +int sm9_dim_fq12_init(SM9_DIM_FQ12 d, unsigned int nbits) +{ + int rc = 0, i, j; + + for (i = 0; i < 3; i++) { + for (j = 0; j < 2; j++) + sm9_dim_init(d[i][j], nbits); + } + return rc; +} + +int sm9_dim_fq12_clear(SM9_DIM_FQ12 d) +{ + int i, j; + + for (i = 0; i < 3; i++) { + for (j = 0; j < 2; j++) + sm9_dim_clear(d[i][j]); + } + return 0; +} + +static int sm9_dim_fq12_mulm(SM9_DIM_FQ12 out, SM9_DIM_FQ12 _a, SM9_DIM_FQ12 _b, + struct sm9_ctx *ctx) +{ + SM9_DIM_FQ4 tmp; + SM9_DIM_FQ12 a, b; + int rc; + + rc = sm9_dim_fq4_init(tmp, 0); + rc |= sm9_dim_fq12_init(a, 0); + rc |= sm9_dim_fq12_init(b, 0); + if (rc) + goto out_free; + sm9_dim_fq12_set(a, _a); + sm9_dim_fq12_set(b, _b); + + sm9_dim_fq4_mulm(out[0], a[0], b[0], ctx); + sm9_dim_fq4_mulm_v(tmp, a[1], b[2], ctx); + sm9_dim_fq4_addm(out[0], out[0], tmp, ctx); + sm9_dim_fq4_mulm_v(tmp, a[2], b[1], ctx); + sm9_dim_fq4_addm(out[0], out[0], tmp, ctx); + + sm9_dim_fq4_mulm(out[1], a[0], b[1], ctx); + sm9_dim_fq4_mulm(tmp, a[1], b[0], ctx); + sm9_dim_fq4_addm(out[1], out[1], tmp, ctx); + sm9_dim_fq4_mulm_v(tmp, a[2], b[2], ctx); + sm9_dim_fq4_addm(out[1], out[1], tmp, ctx); + + sm9_dim_fq4_mulm(out[2], a[0], b[2], ctx); + sm9_dim_fq4_mulm(tmp, a[1], b[1], ctx); + sm9_dim_fq4_addm(out[2], out[2], tmp, ctx); + sm9_dim_fq4_mulm(tmp, a[2], b[0], ctx); + sm9_dim_fq4_addm(out[2], out[2], tmp, ctx); + +out_free: + sm9_dim_fq12_deinit(a); + sm9_dim_fq12_deinit(b); + sm9_dim_fq4_deinit(tmp); + return rc; +} + +int sm9_dim_fq12_powm(SM9_DIM_FQ12 out, SM9_DIM_FQ12 a, MPI b, + struct sm9_ctx *ctx) +{ + int i; + SM9_DIM_FQ12 tmp; + int rc = -EINVAL; + + rc = sm9_dim_fq12_init(tmp, 0); + if (rc) + return -ENOMEM; + mpi_set_ui(tmp[0][0][0], 1); + + for (i = mpi_get_nbits(b); i >= 0; i--) { + sm9_dim_fq12_mulm(tmp, tmp, tmp, ctx); + if (mpi_test_bit(b, i)) + sm9_dim_fq12_mulm(tmp, a, tmp, ctx); + } + sm9_dim_fq12_set(out, tmp); + + sm9_dim_fq12_deinit(tmp); + return rc; +} +EXPORT_SYMBOL_GPL(sm9_dim_fq12_powm); + +static int sm9_dim_fq12_powm_ui(SM9_DIM_FQ12 out, SM9_DIM_FQ12 a, + unsigned int b, struct sm9_ctx *ctx) +{ + MPI i = NULL; + int rc; + + i = mpi_new(0); + if (!i) + return -ENOMEM; + + mpi_set_ui(i, b); + rc = sm9_dim_fq12_powm(out, a, i, ctx); + mpi_free(i); + return rc; +} + +static int sm9_dim_fq12_invm(SM9_DIM_FQ12 out, SM9_DIM_FQ12 _a, + struct sm9_ctx *ctx) +{ + SM9_DIM_FQ4 t0, t1, t2, t3; + SM9_DIM_FQ12 a; + int rc; + + rc = sm9_dim_fq4_init(t0, 0); + rc |= sm9_dim_fq4_init(t1, 0); + rc |= sm9_dim_fq4_init(t2, 0); + rc |= sm9_dim_fq4_init(t3, 0); + rc |= sm9_dim_fq12_init(a, 0); + if (rc) + goto out_free; + sm9_dim_fq12_set(a, _a); + + if (sm9_dim_fq4_is_zero(a[2])) { + sm9_dim_fq4_mulm(t0, a[0], a[0], ctx); + sm9_dim_fq4_mulm(t0, t0, a[0], ctx); + sm9_dim_fq4_mulm_v(t1, a[1], a[1], ctx); + sm9_dim_fq4_mulm(t1, t1, a[1], ctx); + sm9_dim_fq4_addm(t0, t0, t1, ctx); + sm9_dim_fq4_invm(t0, t0, ctx); + + sm9_dim_fq4_mulm(out[2], a[1], a[1], ctx); + sm9_dim_fq4_mulm(out[2], out[2], t0, ctx); + + sm9_dim_fq4_mulm(out[1], a[0], a[1], ctx); + sm9_dim_fq4_mulm(out[1], out[1], t0, ctx); + sm9_dim_fq4_negm(out[1], out[1], ctx); + + sm9_dim_fq4_mulm(out[0], a[0], a[0], ctx); + sm9_dim_fq4_mulm(out[0], out[0], t0, ctx); + rc = 0; + goto out_free; + } + + sm9_dim_fq4_mulm(t0, a[1], a[1], ctx); + sm9_dim_fq4_mulm(t1, a[0], a[2], ctx); + sm9_dim_fq4_subm(t0, t0, t1, ctx); + + sm9_dim_fq4_mulm(t1, a[0], a[1], ctx); + sm9_dim_fq4_mulm_v(t2, a[2], a[2], ctx); + sm9_dim_fq4_subm(t1, t1, t2, ctx); + + sm9_dim_fq4_mulm(t2, a[0], a[0], ctx); + sm9_dim_fq4_mulm_v(t3, a[1], a[2], ctx); + sm9_dim_fq4_subm(t2, t2, t3, ctx); + + sm9_dim_fq4_mulm(t3, t1, t1, ctx); + sm9_dim_fq4_mulm(out[0], t0, t2, ctx); + sm9_dim_fq4_subm(t3, t3, out[0], ctx); + sm9_dim_fq4_invm(t3, t3, ctx); + sm9_dim_fq4_mulm(t3, a[2], t3, ctx); + + sm9_dim_fq4_mulm(out[0], t2, t3, ctx); + sm9_dim_fq4_mulm(out[1], t1, t3, ctx); + sm9_dim_fq4_negm(out[1], out[1], ctx); + sm9_dim_fq4_mulm(out[2], t0, t3, ctx); + + rc = 0; +out_free: + sm9_dim_fq12_deinit(a); + sm9_dim_fq4_deinit(t0); + sm9_dim_fq4_deinit(t1); + sm9_dim_fq4_deinit(t2); + sm9_dim_fq4_deinit(t3); + return rc; +} + +size_t sm9_dim_fq12_get_size(SM9_DIM_FQ12 a) +{ + size_t size; + + size = sm9_dim_fq4_get_size(a[0]); + size += sm9_dim_fq4_get_size(a[1]); + size += sm9_dim_fq4_get_size(a[2]); + return size; +} +EXPORT_SYMBOL_GPL(sm9_dim_fq12_get_size); + +ssize_t sm9_dim_fq12_to_buf_rev(SM9_DIM_FQ12 a, char *buf, size_t size) +{ + ssize_t d_size = size / 3, written_size; + + if (size % 3) + return -EINVAL; + + written_size = sm9_dim_fq4_to_buf_rev(a[2], buf, d_size); + if (written_size < 0) + return written_size; + + written_size = sm9_dim_fq4_to_buf_rev(a[1], buf + d_size, d_size); + if (written_size < 0) + return written_size; + + written_size = sm9_dim_fq4_to_buf_rev(a[0], buf + 2 * d_size, d_size); + if (written_size < 0) + return written_size; + return size; +} +EXPORT_SYMBOL_GPL(sm9_dim_fq12_to_buf_rev); + +static int sm9_dim_fq12_frobenius_6(SM9_DIM_FQ12 out, SM9_DIM_FQ12 a, + struct sm9_ctx *ctx) +{ + sm9_dim_fq4_conjugate(out[0], a[0], ctx); + sm9_dim_fq4_conjugate(out[1], a[1], ctx); + sm9_dim_fq4_negm(out[1], out[1], ctx); + sm9_dim_fq4_conjugate(out[2], a[2], ctx); + return 0; +} + +static int sm9_dim_fq12_frobenius_3(SM9_DIM_FQ12 out, SM9_DIM_FQ12 a, + struct sm9_ctx *ctx) +{ + MPI q = ctx->sys_cfg->q; + SM9_DIM_FQ2 beta; + + if (sm9_dim_init(beta, 0)) + return -ENOMEM; + + mpi_set(beta[0], ctx->sys_cfg->beta); + + sm9_dim_conjugate(out[0][0], a[0][0], q); + sm9_dim_conjugate(out[0][1], a[0][1], q); + sm9_dim_mulm(out[0][1], out[0][1], beta, q); + sm9_dim_negm(out[0][1], out[0][1], q); + + sm9_dim_conjugate(out[1][0], a[1][0], q); + sm9_dim_mulm(out[1][0], out[1][0], beta, q); + sm9_dim_conjugate(out[1][1], a[1][1], q); + + sm9_dim_conjugate(out[2][0], a[2][0], q); + sm9_dim_negm(out[2][0], out[2][0], q); + sm9_dim_conjugate(out[2][1], a[2][1], q); + sm9_dim_mulm(out[2][1], out[2][1], beta, q); + + sm9_dim_deinit(beta); + return 0; +} + +static int sm9_dim_fq12_frobenius_2(SM9_DIM_FQ12 out, SM9_DIM_FQ12 a, + struct sm9_ctx *ctx) +{ + sm9_dim_fq4_conjugate(out[0], a[0], ctx); + sm9_dim_fq4_conjugate(out[1], a[1], ctx); + sm9_dim_fq4_mulm_mpi(out[1], out[1], ctx->sys_cfg->alpha2, ctx); + sm9_dim_fq4_conjugate(out[2], a[2], ctx); + sm9_dim_fq4_mulm_mpi(out[2], out[2], ctx->sys_cfg->alpha4, ctx); + return 0; +} + +static int sm9_dim_fq12_frobenius(SM9_DIM_FQ12 out, SM9_DIM_FQ12 a, + struct sm9_ctx *ctx) +{ + MPI q = ctx->sys_cfg->q; + + sm9_dim_conjugate(out[0][0], a[0][0], q); + sm9_dim_conjugate(out[0][1], a[0][1], q); + sm9_dim_mulm_mpi(out[0][1], out[0][1], ctx->sys_cfg->alpha3, q); + + sm9_dim_conjugate(out[1][0], a[1][0], q); + sm9_dim_mulm_mpi(out[1][0], out[1][0], ctx->sys_cfg->alpha1, q); + sm9_dim_conjugate(out[1][1], a[1][1], q); + sm9_dim_mulm_mpi(out[1][1], out[1][1], ctx->sys_cfg->alpha4, q); + + sm9_dim_conjugate(out[2][0], a[2][0], q); + sm9_dim_mulm_mpi(out[2][0], out[2][0], ctx->sys_cfg->alpha2, q); + sm9_dim_conjugate(out[2][1], a[2][1], q); + sm9_dim_mulm_mpi(out[2][1], out[2][1], ctx->sys_cfg->alpha5, q); + return 0; +} + +static int g_V_V_Q(SM9_DIM_FQ12 num, SM9_DIM_FQ12 den, SM9_POINT V, MPI_POINT Q, + struct sm9_ctx *ctx) +{ + SM9_DIM_FQ2 t0, t1, t2; + MPI q = ctx->sys_cfg->q; + int rc = -ENOMEM; + + if (sm9_dim_init(t0, 0) || sm9_dim_init(t1, 0) || sm9_dim_init(t2, 0)) + goto out_free; + + sm9_dim_fq12_clear(num); + sm9_dim_fq12_clear(den); + + sm9_dim_mulm(t0, V->z_fq2, V->z_fq2, q); + sm9_dim_mulm(t1, t0, V->z_fq2, q); + sm9_dim_mulm(den[0][1], t1, V->y_fq2, q); + + sm9_dim_mulm_mpi(t2, den[0][1], Q->y, q); + sm9_dim_negm(num[0][1], t2, q); + + sm9_dim_mulm(t1, V->x_fq2, V->x_fq2, q); + sm9_dim_mulm(t0, t0, t1, q); + sm9_dim_mulm_mpi(t0, t0, Q->x, q); + sm9_dim_mulm_ui(t0, t0, 3, q); + sm9_dim_div2m(num[2][0], t0, q); + + sm9_dim_mulm(t1, t1, V->x_fq2, q); + sm9_dim_mulm_ui(t1, t1, 3, q); + sm9_dim_div2m(t1, t1, q); + sm9_dim_mulm(t0, V->y_fq2, V->y_fq2, q); + sm9_dim_subm(num[0][0], t0, t1, q); + + rc = 0; + +out_free: + sm9_dim_deinit(t0); + sm9_dim_deinit(t1); + sm9_dim_deinit(t2); + return rc; +} + +static int g_U_V_Q(SM9_DIM_FQ12 num, SM9_DIM_FQ12 den, SM9_POINT U, SM9_POINT V, + MPI_POINT Q, struct sm9_ctx *ctx) +{ + SM9_DIM_FQ2 t0, t1, t2, t3, t4; + MPI q = ctx->sys_cfg->q; + int rc = -ENOMEM; + + if (sm9_dim_init(t0, 0) || sm9_dim_init(t1, 0) || sm9_dim_init(t2, 0) || + sm9_dim_init(t3, 0) || sm9_dim_init(t4, 0)) + goto out_free; + + sm9_dim_fq12_clear(num); + sm9_dim_fq12_clear(den); + + sm9_dim_mulm(t0, V->z_fq2, V->z_fq2, q); + sm9_dim_mulm(t1, t0, U->x_fq2, q); + sm9_dim_mulm(t0, t0, V->z_fq2, q); + sm9_dim_mulm(t2, U->z_fq2, U->z_fq2, q); + sm9_dim_mulm(t3, t2, V->x_fq2, q); + sm9_dim_mulm(t2, t2, U->z_fq2, q); + sm9_dim_mulm(t2, t2, V->y_fq2, q); + sm9_dim_subm(t1, t1, t3, q); + sm9_dim_mulm(t1, t1, U->z_fq2, q); + sm9_dim_mulm(t1, t1, V->z_fq2, q); + sm9_dim_mulm(den[0][1], t1, t0, q); + sm9_dim_mulm(t1, t1, V->y_fq2, q); + sm9_dim_mulm(t3, t0, U->y_fq2, q); + sm9_dim_subm(t3, t3, t2, q); + sm9_dim_mulm(t0, t0, t3, q); + sm9_dim_mulm_mpi(num[2][0], t0, Q->x, q); + sm9_dim_mulm(t3, t3, V->x_fq2, q); + sm9_dim_mulm(t3, t3, V->z_fq2, q); + sm9_dim_subm(num[0][0], t1, t3, q); + sm9_dim_mulm_mpi(t2, den[0][1], Q->y, q); + sm9_dim_negm(num[0][1], t2, q); + + rc = 0; +out_free: + sm9_dim_deinit(t0); + sm9_dim_deinit(t1); + sm9_dim_deinit(t2); + sm9_dim_deinit(t3); + sm9_dim_deinit(t4); + + return rc; +} + +static int sm9_point_pi_q(SM9_POINT out, SM9_POINT p, struct sm9_ctx *ctx) +{ + MPI q = ctx->sys_cfg->q; + + if (!out) + return -EINVAL; + + sm9_dim_conjugate(out->x_fq2, p->x_fq2, q); + sm9_dim_conjugate(out->y_fq2, p->y_fq2, q); + sm9_dim_conjugate(out->z_fq2, p->z_fq2, q); + sm9_dim_mulm_mpi(out->z_fq2, out->z_fq2, ctx->sys_cfg->pi_q_c, q); + return 0; +} + +static int sm9_point_neg_pi_q2(SM9_POINT out, SM9_POINT p, struct sm9_ctx *ctx) +{ + if (!out) + return -EINVAL; + + sm9_dim_copy(out->x_fq2, p->x_fq2); + sm9_dim_negm(out->y_fq2, p->y_fq2, ctx->sys_cfg->q); + sm9_dim_mulm_mpi(out->z_fq2, p->z_fq2, ctx->sys_cfg->pi_q2_c, + ctx->sys_cfg->q); + return 0; +} + +static int sm9_final_exponent(SM9_DIM_FQ12 out, SM9_DIM_FQ12 F, + struct sm9_ctx *ctx) +{ + const char *a2_c = "0xd8000000019062ed0000b98b0cb27659"; + const char *a3_c = "0x2400000000215d941"; + SM9_DIM_FQ12 t0, t1, t2, t3, t4, t5; + MPI a2 = NULL, a3 = NULL; + int rc = -ENOMEM; + + a2 = mpi_scanval(a2_c); + a3 = mpi_scanval(a3_c); + if (!a2 || !a3) + goto out_free_mpi; + + rc = sm9_dim_fq12_init(t0, 0); + rc |= sm9_dim_fq12_init(t1, 0); + rc |= sm9_dim_fq12_init(t2, 0); + rc |= sm9_dim_fq12_init(t3, 0); + rc |= sm9_dim_fq12_init(t4, 0); + rc |= sm9_dim_fq12_init(t5, 0); + if (rc) + goto out_free; + + sm9_dim_fq12_frobenius_6(t0, F, ctx); + sm9_dim_fq12_invm(t1, F, ctx); + sm9_dim_fq12_mulm(t0, t0, t1, ctx); + sm9_dim_fq12_frobenius_2(t1, t0, ctx); + sm9_dim_fq12_mulm(t0, t0, t1, ctx); + + sm9_dim_fq12_powm(t2, t0, a3, ctx); + sm9_dim_fq12_invm(t2, t2, ctx); + sm9_dim_fq12_frobenius(t3, t2, ctx); + sm9_dim_fq12_mulm(t3, t2, t3, ctx); + + sm9_dim_fq12_mulm(t2, t2, t3, ctx); + sm9_dim_fq12_frobenius(t4, t0, ctx); + sm9_dim_fq12_mulm(t5, t4, t0, ctx); + sm9_dim_fq12_powm_ui(t5, t5, 9, ctx); + + sm9_dim_fq12_mulm(t2, t2, t5, ctx); + sm9_dim_fq12_mulm(t5, t0, t0, ctx); + sm9_dim_fq12_mulm(t5, t5, t5, ctx); + sm9_dim_fq12_mulm(t2, t2, t5, ctx); + sm9_dim_fq12_mulm(t4, t4, t4, ctx); + sm9_dim_fq12_mulm(t4, t4, t3, ctx); + sm9_dim_fq12_frobenius_2(t3, t0, ctx); + sm9_dim_fq12_mulm(t3, t3, t4, ctx); + + sm9_dim_fq12_powm(t4, t3, a2, ctx); + sm9_dim_fq12_mulm(t2, t4, t2, ctx); + sm9_dim_fq12_frobenius_3(t3, t0, ctx); + sm9_dim_fq12_mulm(out, t3, t2, ctx); + + rc = 0; + +out_free: + sm9_dim_fq12_deinit(t0); + sm9_dim_fq12_deinit(t1); + sm9_dim_fq12_deinit(t2); + sm9_dim_fq12_deinit(t3); + sm9_dim_fq12_deinit(t4); + sm9_dim_fq12_deinit(t5); + +out_free_mpi: + mpi_free(a2); + mpi_free(a3); + return rc; +} + +int Rate_pairing(SM9_DIM_FQ12 out, SM9_POINT Q, MPI_POINT P, MPI a, + struct sm9_ctx *ctx) +{ + SM9_POINT T = NULL; + SM9_POINT Q1 = NULL, Q2 = NULL; + SM9_DIM_FQ12 f_num, f_den, g_num, g_den; + int i; + int rc = -ENOMEM; + + Q1 = sm9_point_new(0); + Q2 = sm9_point_new(0); + T = sm9_point_new(0); + if (!Q1 || !Q2 || !T || !P) + goto out_free; + + if (sm9_dim_fq12_init(f_num, 0) || sm9_dim_fq12_init(f_den, 0) || + sm9_dim_fq12_init(g_num, 0) || sm9_dim_fq12_init(g_den, 0)) + goto out_free; + + /* f = 1 */ + mpi_set_ui(f_num[0][0][0], 1); + mpi_set_ui(f_den[0][0][0], 1); + + sm9_point_copy(T, Q); + + for (i = mpi_get_nbits(a) - 2; i >= 0; i--) { + sm9_dim_fq12_mulm(f_num, f_num, f_num, ctx); + sm9_dim_fq12_mulm(f_den, f_den, f_den, ctx); + g_V_V_Q(g_num, g_den, T, P, ctx); + sm9_dim_fq12_mulm(f_num, f_num, g_num, ctx); + sm9_dim_fq12_mulm(f_den, f_den, g_den, ctx); + + sm9_point_addm(T, T, T, ctx); + + if (mpi_test_bit(a, i)) { + g_U_V_Q(g_num, g_den, T, Q, P, ctx); + sm9_dim_fq12_mulm(f_num, f_num, g_num, ctx); + sm9_dim_fq12_mulm(f_den, f_den, g_den, ctx); + sm9_point_addm(T, T, Q, ctx); + } + } + + sm9_point_pi_q(Q1, Q, ctx); + sm9_point_neg_pi_q2(Q2, Q, ctx); + + g_U_V_Q(g_num, g_den, T, Q1, P, ctx); + sm9_dim_fq12_mulm(f_num, f_num, g_num, ctx); + sm9_dim_fq12_mulm(f_den, f_den, g_den, ctx); + sm9_point_addm(T, T, Q1, ctx); + + g_U_V_Q(g_num, g_den, T, Q2, P, ctx); + sm9_dim_fq12_mulm(f_num, f_num, g_num, ctx); + sm9_dim_fq12_mulm(f_den, f_den, g_den, ctx); + sm9_point_addm(T, T, Q2, ctx); + + sm9_dim_fq12_invm(f_den, f_den, ctx); + sm9_dim_fq12_mulm(out, f_num, f_den, ctx); + + sm9_final_exponent(out, out, ctx); + + rc = 0; +out_free: + sm9_dim_fq12_deinit(f_num); + sm9_dim_fq12_deinit(f_den); + sm9_dim_fq12_deinit(g_num); + sm9_dim_fq12_deinit(g_den); + sm9_point_release(T); + sm9_point_release(Q1); + sm9_point_release(Q2); + return rc; +} + +MPI_POINT bytes_to_point(u8 *src, size_t size) +{ + MPI_POINT res; + MPI tmp; + size_t l = size / 2; + + if (size % 2) + return NULL; + + res = mpi_point_new(0); + if (!res) + return NULL; + mpi_set_ui(res->z, 1); + + tmp = mpi_read_raw_data(src, l); + if (!tmp) { + mpi_point_release(res); + return NULL; + } + mpi_set(res->x, tmp); + mpi_free(tmp); + + tmp = mpi_read_raw_data(src + l, l); + if (!tmp) { + mpi_point_release(res); + return NULL; + } + mpi_set(res->y, tmp); + mpi_free(tmp); + return res; +} + +int point_to_bytes(MPI_POINT P, u8 **out, size_t *out_size) +{ + size_t size; + unsigned int write_size; + + if (!P) + return -EINVAL; + + size = mpi_get_size(P->x); + *out = kzalloc(size * 2, GFP_KERNEL); + if (!*out) + return -ENOMEM; + + mpi_read_buffer(P->x, *out, size, &write_size, NULL); + if (write_size != size) { + kfree(*out); + *out = NULL; + return -EINVAL; + } + + mpi_read_buffer(P->y, *out + size, size, &write_size, NULL); + if (write_size != size) { + kfree(*out); + *out = NULL; + return -EINVAL; + } + + *out_size = size * 2; + return 0; +} + +int mpi_point_to_sm9_point(SM9_POINT out, MPI_POINT p) +{ + if (!out) + return -EINVAL; + + mpi_set(out->xd1, p->x); + mpi_set_ui(out->xd2, 0); + mpi_set(out->yd1, p->y); + mpi_set_ui(out->yd2, 0); + mpi_set(out->zd1, p->z); + mpi_set_ui(out->zd2, 0); + return 0; +} +EXPORT_SYMBOL_GPL(mpi_point_to_sm9_point); + +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("GUO Zihua <guozihua@xxxxxxxxxx>"); +MODULE_DESCRIPTION("SM9 generic algorithm library"); diff --git a/crypto/sm9_lib.h b/crypto/sm9_lib.h new file mode 100644 index 000000000000..27c741ca11cd --- /dev/null +++ b/crypto/sm9_lib.h @@ -0,0 +1,92 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later + * + * Header of libraries for SM9 key exchange algorithm + * + * Copyright (c) 2023, Huawei Technology Co., Ltd. + * Authors: GUO Zihua <guozihua@xxxxxxxxxx> + */ + +#include <linux/mpi.h> +#include <crypto/sm9.h> + +#ifndef _LOCAL_SM9_LIB_H +#define _LOCAL_SM9_LIB_H + +struct sm9_point_fq2 { + union { + SM9_DIM_FQ2 x_fq2; + struct { + MPI xd1; + MPI xd2; + }; + }; + union { + SM9_DIM_FQ2 y_fq2; + struct { + MPI yd1; + MPI yd2; + }; + }; + union { + SM9_DIM_FQ2 z_fq2; + struct { + MPI zd1; + MPI zd2; + }; + }; +}; + +struct sm9_sys_cfg { + u8 cid; + MPI q; + MPI q_minus_2; + MPI q2; + MPI q2_minus_2; + MPI a, b; + MPI N; + MPI N_minus_1; + unsigned int N_log_2_times_5_roundup; + size_t N_size; + unsigned int cf; + unsigned int k; + MPI_POINT P1; + SM9_POINT P2; + u8 hid; + MPI t; + MPI tr; + MPI pairing_a; + MPI pi_q_c; + MPI pi_q2_c; + MPI beta; + MPI alpha1; + MPI alpha2; + MPI alpha3; + MPI alpha4; + MPI alpha5; + + struct mpi_ec_ctx *G1; +}; + +struct sm9_ctx { + struct sm9_sys_cfg *sys_cfg; + MPI_POINT R; + MPI_POINT Ppub_s; + MPI r; + SM9_POINT de; + unsigned int hid; + char *id; + size_t id_size; + bool initiator; +}; + +int Rate_pairing(SM9_DIM_FQ12 out, SM9_POINT Q, MPI_POINT P, MPI t, + struct sm9_ctx *ctx); +MPI_POINT bytes_to_point(u8 *src, size_t size); +int point_to_bytes(MPI_POINT P, u8 **out, size_t *out_size); + +int sm9_point_mpi_addm(SM9_POINT out, SM9_POINT P, MPI a, MPI q); +int sm9_point_mpi_mulm(SM9_POINT out, SM9_POINT P, MPI a, struct sm9_ctx *ctx); +int sm9_point_addm(SM9_POINT out, SM9_POINT P, SM9_POINT Q, + struct sm9_ctx *ctx); +int mpi_point_to_sm9_point(SM9_POINT out, MPI_POINT p); +#endif -- 2.17.1
