From patchwork Wed Nov 29 16:10:35 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gowrishankar Muthukrishnan X-Patchwork-Id: 134698 X-Patchwork-Delegate: gakhil@marvell.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id DDD6943402; Wed, 29 Nov 2023 17:10:54 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id D559242E39; Wed, 29 Nov 2023 17:10:49 +0100 (CET) Received: from mx0b-0016f401.pphosted.com (mx0b-0016f401.pphosted.com [67.231.156.173]) by mails.dpdk.org (Postfix) with ESMTP id 26A5142E4B for ; Wed, 29 Nov 2023 17:10:48 +0100 (CET) Received: from pps.filterd (m0045851.ppops.net [127.0.0.1]) by mx0b-0016f401.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 3ATEsoAp022054; Wed, 29 Nov 2023 08:10:47 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=pfpt0220; bh=HCB1q7ogwg7ZFf1cZ4WUAy15zyWNnq5Fyg/W1mQ8apY=; b=K3YPSlkBQ0RoWGnjY2uAWHoGADMwQDOB7+XlzfGFvddCMvZDnKECHBDDmPkL98o+srER oU7qmCvACFFiU9eKlgJXVpnT2nb7mZPuznls/gKS3SHUNC/HdVaKO/nez54FxcDDYNGh MEEZ8KpdDN8myQSGL2ST6kwZXlTrugR8fInAqecpBCOFeNCaV98F4nwomT2GH7UdSbOI Bp8V3TzKco6XqlqYT5sp0neWOQTAb5BbxK0xjrmUQB+cHxQNQ/6di+mTJJ/1arrhSmDy tWZ3bGVF85Us64WL/blKkLGZOj4jb6MvZSOZe/iULBGqCE/0yyl9a92qtLWf9YQv+Tm6 Vw== Received: from dc5-exch02.marvell.com ([199.233.59.182]) by mx0b-0016f401.pphosted.com (PPS) with ESMTPS id 3una4dpuh6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 29 Nov 2023 08:10:47 -0800 Received: from DC5-EXCH01.marvell.com (10.69.176.38) by DC5-EXCH02.marvell.com (10.69.176.39) with Microsoft SMTP Server (TLS) id 15.0.1497.48; Wed, 29 Nov 2023 08:10:45 -0800 Received: from maili.marvell.com (10.69.176.80) by DC5-EXCH01.marvell.com (10.69.176.38) with Microsoft SMTP Server id 15.0.1497.48 via Frontend Transport; Wed, 29 Nov 2023 08:10:45 -0800 Received: from BG-LT91401.marvell.com (BG-LT91401.marvell.com [10.28.168.34]) by maili.marvell.com (Postfix) with ESMTP id AD0C53F7059; Wed, 29 Nov 2023 08:10:42 -0800 (PST) From: Gowrishankar Muthukrishnan To: CC: , Akhil Goyal , Fan Zhang , Kai Ji , "Gowrishankar Muthukrishnan" Subject: [PATCH v1 2/3] crypto/openssl: add EDDSA support Date: Wed, 29 Nov 2023 21:40:35 +0530 Message-ID: <03d11c7c6e1e523784dd2a745169e75e466802c1.1701273963.git.gmuthukrishn@marvell.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <0ae6a1afadac64050d80b0fd7712c4a6a8599e2c.1701273963.git.gmuthukrishn@marvell.com> References: <0ae6a1afadac64050d80b0fd7712c4a6a8599e2c.1701273963.git.gmuthukrishn@marvell.com> MIME-Version: 1.0 X-Proofpoint-GUID: uPmVLNbrg2uJilPam67wutUVL3dZT99u X-Proofpoint-ORIG-GUID: uPmVLNbrg2uJilPam67wutUVL3dZT99u X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.997,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2023-11-29_14,2023-11-29_01,2023-05-22_02 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Add EDDSA support in OpenSSL PMD. Signed-off-by: Gowrishankar Muthukrishnan --- For openssl library support, refer: https://github.com/openssl/openssl/commit/4f8b7c2319523f8e83b8b2fa31127832fa092552 --- drivers/crypto/openssl/openssl_pmd_private.h | 6 + drivers/crypto/openssl/rte_openssl_pmd.c | 165 +++++++++++++++++++ drivers/crypto/openssl/rte_openssl_pmd_ops.c | 80 +++++++++ 3 files changed, 251 insertions(+) diff --git a/drivers/crypto/openssl/openssl_pmd_private.h b/drivers/crypto/openssl/openssl_pmd_private.h index 334912d335..7061a1b85b 100644 --- a/drivers/crypto/openssl/openssl_pmd_private.h +++ b/drivers/crypto/openssl/openssl_pmd_private.h @@ -212,6 +212,12 @@ struct openssl_asym_session { OSSL_PARAM * params; #endif } sm2; + struct { + uint8_t curve_id; +#if (OPENSSL_VERSION_NUMBER >= 0x30000000L) + OSSL_PARAM *params; +#endif + } eddsa; } u; } __rte_cache_aligned; /** Set and validate OPENSSL crypto session parameters */ diff --git a/drivers/crypto/openssl/rte_openssl_pmd.c b/drivers/crypto/openssl/rte_openssl_pmd.c index e8cb09defc..61c1f95202 100644 --- a/drivers/crypto/openssl/rte_openssl_pmd.c +++ b/drivers/crypto/openssl/rte_openssl_pmd.c @@ -2890,6 +2890,155 @@ process_openssl_sm2_op_evp(struct rte_crypto_op *cop, return ret; } +static int +process_openssl_eddsa_op_evp(struct rte_crypto_op *cop, + struct openssl_asym_session *sess) +{ + static const char * const instance[] = {"Ed25519", "Ed25519ctx", "Ed25519ph", + "Ed448", "Ed448ph"}; + EVP_PKEY_CTX *kctx = NULL, *sctx = NULL, *cctx = NULL; + const uint8_t curve_id = sess->u.eddsa.curve_id; + struct rte_crypto_asym_op *op = cop->asym; + OSSL_PARAM *params = sess->u.eddsa.params; + OSSL_PARAM_BLD *iparam_bld = NULL; + OSSL_PARAM *iparams = NULL; + uint8_t signbuf[128] = {0}; + EVP_MD_CTX *md_ctx = NULL; + EVP_PKEY *pkey = NULL; + size_t signlen; + int ret = -1; + + cop->status = RTE_CRYPTO_OP_STATUS_ERROR; + + iparam_bld = OSSL_PARAM_BLD_new(); + if (!iparam_bld) + goto err_eddsa; + + OSSL_PARAM_BLD_push_octet_string(iparam_bld, "context-string", + op->eddsa.context.data, op->eddsa.context.length); + + OSSL_PARAM_BLD_push_utf8_string(iparam_bld, "instance", + instance[op->eddsa.instance], strlen(instance[op->eddsa.instance])); + + iparams = OSSL_PARAM_BLD_to_param(iparam_bld); + if (!iparams) + goto err_eddsa; + + switch (op->eddsa.op_type) { + case RTE_CRYPTO_ASYM_OP_SIGN: + { + if (curve_id == RTE_CRYPTO_EC_GROUP_ED25519) + kctx = EVP_PKEY_CTX_new_from_name(NULL, "ED25519", NULL); + else + kctx = EVP_PKEY_CTX_new_from_name(NULL, "ED448", NULL); + + if (kctx == NULL || EVP_PKEY_fromdata_init(kctx) <= 0 || + EVP_PKEY_fromdata(kctx, &pkey, EVP_PKEY_KEYPAIR, params) <= 0) + goto err_eddsa; + + md_ctx = EVP_MD_CTX_new(); + if (!md_ctx) + goto err_eddsa; + + sctx = EVP_PKEY_CTX_new_from_pkey(NULL, pkey, NULL); + if (!sctx) + goto err_eddsa; + + EVP_MD_CTX_set_pkey_ctx(md_ctx, sctx); + +#if (OPENSSL_VERSION_NUMBER >= 0x30300000L) + if (!EVP_DigestSignInit_ex(md_ctx, NULL, NULL, NULL, NULL, pkey, iparams)) + goto err_eddsa; +#else + if (op->eddsa.instance == RTE_CRYPTO_EDCURVE_25519 || + op->eddsa.instance == RTE_CRYPTO_EDCURVE_448) { + if (!EVP_DigestSignInit(md_ctx, NULL, NULL, NULL, pkey)) + goto err_eddsa; + } else + goto err_eddsa; +#endif + + if (!EVP_DigestSign(md_ctx, NULL, &signlen, op->eddsa.message.data, + op->eddsa.message.length)) + goto err_eddsa; + + if (signlen > RTE_DIM(signbuf)) + goto err_eddsa; + + if (!EVP_DigestSign(md_ctx, signbuf, &signlen, op->eddsa.message.data, + op->eddsa.message.length)) + goto err_eddsa; + + memcpy(op->eddsa.sign.data, &signbuf[0], signlen); + op->eddsa.sign.length = signlen; + } + break; + case RTE_CRYPTO_ASYM_OP_VERIFY: + { + if (curve_id == RTE_CRYPTO_EC_GROUP_ED25519) + kctx = EVP_PKEY_CTX_new_from_name(NULL, "ED25519", NULL); + else + kctx = EVP_PKEY_CTX_new_from_name(NULL, "ED448", NULL); + + if (kctx == NULL || EVP_PKEY_fromdata_init(kctx) <= 0 || + EVP_PKEY_fromdata(kctx, &pkey, EVP_PKEY_PUBLIC_KEY, params) <= 0) + goto err_eddsa; + + md_ctx = EVP_MD_CTX_new(); + if (!md_ctx) + goto err_eddsa; + + sctx = EVP_PKEY_CTX_new_from_pkey(NULL, pkey, NULL); + if (!sctx) + goto err_eddsa; + + EVP_MD_CTX_set_pkey_ctx(md_ctx, sctx); + +#if (OPENSSL_VERSION_NUMBER >= 0x30300000L) + if (!EVP_DigestVerifyInit_ex(md_ctx, NULL, NULL, NULL, NULL, pkey, iparams)) + goto err_eddsa; +#else + if (op->eddsa.instance == RTE_CRYPTO_EDCURVE_25519 || + op->eddsa.instance == RTE_CRYPTO_EDCURVE_448) { + if (!EVP_DigestVerifyInit(md_ctx, NULL, NULL, NULL, pkey)) + goto err_eddsa; + } else + goto err_eddsa; +#endif + + signlen = op->eddsa.sign.length; + memcpy(&signbuf[0], op->eddsa.sign.data, op->eddsa.sign.length); + + ret = EVP_DigestVerify(md_ctx, signbuf, signlen, op->eddsa.message.data, + op->eddsa.message.length); + if (ret == 0) + goto err_eddsa; + } + break; + default: + /* allow ops with invalid args to be pushed to + * completion queue + */ + cop->status = RTE_CRYPTO_OP_STATUS_INVALID_ARGS; + goto err_eddsa; + } + + ret = 0; + cop->status = RTE_CRYPTO_OP_STATUS_SUCCESS; +err_eddsa: + OSSL_PARAM_BLD_free(iparam_bld); + + if (sctx) + EVP_PKEY_CTX_free(sctx); + + if (cctx) + EVP_PKEY_CTX_free(cctx); + + if (pkey) + EVP_PKEY_free(pkey); + + return ret; +} #else static int process_openssl_rsa_op(struct rte_crypto_op *cop, @@ -2998,6 +3147,15 @@ process_openssl_sm2_op(struct rte_crypto_op *cop, RTE_SET_USED(sess); return -ENOTSUP; } + +static int +process_openssl_eddsa_op(struct rte_crypto_op *cop, + struct openssl_asym_session *sess) +{ + RTE_SET_USED(cop); + RTE_SET_USED(sess); + return -ENOTSUP; +} #endif static int @@ -3053,6 +3211,13 @@ process_asym_op(struct openssl_qp *qp, struct rte_crypto_op *op, retval = process_openssl_sm2_op_evp(op, sess); #else retval = process_openssl_sm2_op(op, sess); +#endif + break; + case RTE_CRYPTO_ASYM_XFORM_EDDSA: +#if (OPENSSL_VERSION_NUMBER >= 0x30000000L) + retval = process_openssl_eddsa_op_evp(op, sess); +#else + retval = process_openssl_eddsa_op(op, sess); #endif break; default: diff --git a/drivers/crypto/openssl/rte_openssl_pmd_ops.c b/drivers/crypto/openssl/rte_openssl_pmd_ops.c index b16baaa08f..36c4c68da9 100644 --- a/drivers/crypto/openssl/rte_openssl_pmd_ops.c +++ b/drivers/crypto/openssl/rte_openssl_pmd_ops.c @@ -610,6 +610,20 @@ static const struct rte_cryptodev_capabilities openssl_pmd_capabilities[] = { } } }, + { /* EDDSA */ + .op = RTE_CRYPTO_OP_TYPE_ASYMMETRIC, + {.asym = { + .xform_capa = { + .xform_type = RTE_CRYPTO_ASYM_XFORM_EDDSA, + .hash_algos = (1 << RTE_CRYPTO_AUTH_SHA512 | + 1 << RTE_CRYPTO_AUTH_SHAKE_256), + .op_types = + ((1<= 0x30000000L) + OSSL_PARAM_BLD *param_bld = NULL; + OSSL_PARAM *params = NULL; + int ret = -1; + + asym_session->u.eddsa.curve_id = xform->ec.curve_id; + + param_bld = OSSL_PARAM_BLD_new(); + if (!param_bld) { + OPENSSL_LOG(ERR, "failed to allocate params\n"); + goto err_eddsa; + } + + ret = OSSL_PARAM_BLD_push_utf8_string(param_bld, + OSSL_PKEY_PARAM_GROUP_NAME, "ED25519", sizeof("ED25519")); + if (!ret) { + OPENSSL_LOG(ERR, "failed to push params\n"); + goto err_eddsa; + } + + ret = OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_PKEY_PARAM_PRIV_KEY, + xform->ec.pkey.data, xform->ec.pkey.length); + if (!ret) { + OPENSSL_LOG(ERR, "failed to push params\n"); + goto err_eddsa; + } + + ret = OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_PKEY_PARAM_PUB_KEY, + xform->ec.qcomp.data, xform->ec.qcomp.length); + if (!ret) { + OPENSSL_LOG(ERR, "failed to push params\n"); + goto err_eddsa; + } + + params = OSSL_PARAM_BLD_to_param(param_bld); + if (!params) { + OPENSSL_LOG(ERR, "failed to push params\n"); + goto err_eddsa; + } + + asym_session->u.eddsa.params = params; + OSSL_PARAM_BLD_free(param_bld); + + asym_session->xfrm_type = RTE_CRYPTO_ASYM_XFORM_EDDSA; + break; +err_eddsa: + if (param_bld) + OSSL_PARAM_BLD_free(param_bld); + + if (asym_session->u.eddsa.params) + OSSL_PARAM_free(asym_session->u.eddsa.params); + + return -1; +#else + OPENSSL_LOG(WARNING, "EDDSA unsupported for OpenSSL Version < 3.0"); + return -ENOTSUP; #endif } default: @@ -1511,6 +1585,12 @@ static void openssl_reset_asym_session(struct openssl_asym_session *sess) #if (OPENSSL_VERSION_NUMBER >= 0x30000000L) OSSL_PARAM_free(sess->u.sm2.params); #endif + break; + case RTE_CRYPTO_ASYM_XFORM_EDDSA: +#if (OPENSSL_VERSION_NUMBER >= 0x30000000L) + OSSL_PARAM_free(sess->u.eddsa.params); +#endif + break; default: break; }