From 67ed25a8f7764e61647c3c31d09a1e60db38006b Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Wed, 16 Feb 2022 11:20:54 +0100 Subject: [PATCH 18/34] COMMON: Add post-quantum algorithm OIDs Signed-off-by: Ingo Franzki --- usr/include/include.mk | 2 +- usr/include/pqc_oids.h | 48 ++++++++++++++++++++++++++ usr/lib/common/common.mk | 3 +- usr/lib/common/globals.c | 1 + usr/lib/common/pqc_defs.h | 48 ++++++++++++++++++++++++++ usr/lib/common/pqc_supported.c | 78 ++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 178 insertions(+), 2 deletions(-) create mode 100644 usr/include/pqc_oids.h create mode 100644 usr/lib/common/pqc_defs.h create mode 100644 usr/lib/common/pqc_supported.c diff --git a/usr/include/include.mk b/usr/include/include.mk index 79e593d7..a63e043f 100644 --- a/usr/include/include.mk +++ b/usr/include/include.mk @@ -3,7 +3,7 @@ opencryptokiincludedir = ${includedir}/opencryptoki opencryptokiinclude_HEADERS = \ usr/include/apiclient.h usr/include/pkcs11types.h \ usr/include/pkcs11.h \ - usr/include/ec_curves.h + usr/include/ec_curves.h usr/include/pqc_oids.h noinst_HEADERS += \ usr/include/apictl.h usr/include/local_types.h \ diff --git a/usr/include/pqc_oids.h b/usr/include/pqc_oids.h new file mode 100644 index 00000000..0891373e --- /dev/null +++ b/usr/include/pqc_oids.h @@ -0,0 +1,48 @@ +/* + * COPYRIGHT (c) International Business Machines Corp. 2022 + * + * This program is provided under the terms of the Common Public License, + * version 1.0 (CPL-1.0). Any use, reproduction or distribution for this + * software constitutes recipient's acceptance of CPL-1.0 terms which can be + * found in the file LICENSE file or at + * https://opensource.org/licenses/cpl1.0.php + */ + + +#ifndef _PQC_OIDS_H_ +#define _PQC_OIDS_H_ + +/* + * OIDs and their DER encoding for the post-quantum crypto algorithms + * supported by OpenCryptoki: + */ + +/* Dilithium Round 2 high-security (SHAKE-256): 1.3.6.1.4.1.2.267.1.6.5 */ +#define OCK_DILITHIUM_R2_65 { 0x06, 0x0B, 0x2B, 0x06, 0x01, 0x04, \ + 0x01, 0x02, 0x82, 0x0B, 0x01, 0x06, 0x05 } + +/* Dilithium Round 2 for outbound authentication: 1.3.6.1.4.1.2.267.1.8.7 */ +#define OCK_DILITHIUM_R2_87 { 0x06, 0x0B, 0x2B, 0x06, 0x01, 0x04, \ + 0x01, 0x02, 0x82, 0x0B, 0x01, 0x08, 0x07 } + +/* Dilithium Round 3 weak (SHAKE-256): 1.3.6.1.4.1.2.267.7.4.4 */ +#define OCK_DILITHIUM_R3_44 { 0x06, 0x0B, 0x2B, 0x06, 0x01, 0x04, \ + 0x01, 0x02, 0x82, 0x0B, 0x07, 0x04, 0x04 } + +/* Dilithium Round 3 recommended (SHAKE-256): 1.3.6.1.4.1.2.267.7.6.5 */ +#define OCK_DILITHIUM_R3_65 { 0x06, 0x0B, 0x2B, 0x06, 0x01, 0x04, \ + 0x01, 0x02, 0x82, 0x0B, 0x07, 0x06, 0x05 } + +/* Dilithium Round 3 high-security (SHAKE-256): 1.3.6.1.4.1.2.267.7.8.7 */ +#define OCK_DILITHIUM_R3_87 { 0x06, 0x0B, 0x2B, 0x06, 0x01, 0x04, \ + 0x01, 0x02, 0x82, 0x0B, 0x07, 0x08, 0x07 } + +/* Kyber Round 2 768 (SHAKE-128): 1.3.6.1.4.1.2.267.5.3.3 */ +#define OCK_KYBER_R2_768 { 0x06, 0x0B, 0x2B, 0x06, 0x01, 0x04, \ + 0x01, 0x02, 0x82, 0x0B, 0x05, 0x03, 0x03 } + +/* Kyber Round 2 1024 (SHAKE-128): 1.3.6.1.4.1.2.267.5.4.4 */ +#define OCK_KYBER_R2_1024 { 0x06, 0x0B, 0x2B, 0x06, 0x01, 0x04, \ + 0x01, 0x02, 0x82, 0x0B, 0x05, 0x04, 0x04 } + +#endif // _PQC_OIDS_H_ diff --git a/usr/lib/common/common.mk b/usr/lib/common/common.mk index 6341cb74..93f1e21f 100644 --- a/usr/lib/common/common.mk +++ b/usr/lib/common/common.mk @@ -7,4 +7,5 @@ noinst_HEADERS += \ usr/lib/common/p11util.h usr/lib/common/event_client.h \ usr/lib/common/list.h usr/lib/common/tok_specific.h \ usr/lib/common/uri_enc.h usr/lib/common/uri.h \ - usr/lib/common/buffer.h usr/lib/common/pin_prompt.h + usr/lib/common/buffer.h usr/lib/common/pin_prompt.h \ + usr/lib/common/pqc_defs.h diff --git a/usr/lib/common/globals.c b/usr/lib/common/globals.c index db4d352c..5b79e785 100644 --- a/usr/lib/common/globals.c +++ b/usr/lib/common/globals.c @@ -27,6 +27,7 @@ #include "defs.h" #include "host_defs.h" #include "h_extern.h" +#include "pqc_oids.h" struct ST_FCN_LIST function_list; diff --git a/usr/lib/common/pqc_defs.h b/usr/lib/common/pqc_defs.h new file mode 100644 index 00000000..51ee1200 --- /dev/null +++ b/usr/lib/common/pqc_defs.h @@ -0,0 +1,48 @@ +/* + * COPYRIGHT (c) International Business Machines Corp. 2022 + * + * This program is provided under the terms of the Common Public License, + * version 1.0 (CPL-1.0). Any use, reproduction or distribution for this + * software constitutes recipient's acceptance of CPL-1.0 terms which can be + * found in the file LICENSE file or at + * https://opensource.org/licenses/cpl1.0.php + */ + +#ifndef _PQC_DEFS +#define _PQC_DEFS + +#include + +#include "pqc_oids.h" + +extern const CK_BYTE dilithium_r2_65[]; +extern const CK_ULONG dilithium_r2_65_len; +extern const CK_BYTE dilithium_r2_87[]; +extern const CK_ULONG dilithium_r2_87_len; +extern const CK_BYTE dilithium_r3_44[]; +extern const CK_ULONG dilithium_r3_44_len; +extern const CK_BYTE dilithium_r3_56[]; +extern const CK_ULONG dilithium_r3_56_len; +extern const CK_BYTE dilithium_r3_87[]; +extern const CK_ULONG dilithium_r3_87_len; + +extern const CK_BYTE kyber_r2_768[]; +extern const CK_ULONG kyber_r2_768_len; +extern const CK_BYTE kyber_r2_1024[]; +extern const CK_ULONG kyber_r2_1024_len; + +struct pqc_oid { + const CK_BYTE *oid; + CK_ULONG oid_len; + CK_ULONG keyform; +}; + +extern const struct pqc_oid dilithium_oids[]; +extern const struct pqc_oid kyber_oids[]; + +const struct pqc_oid *find_pqc_by_keyform(const struct pqc_oid *pqcs, + CK_ULONG keyform); +const struct pqc_oid *find_pqc_by_oid(const struct pqc_oid *pqcs, + CK_BYTE *oid, CK_ULONG oid_len); + +#endif diff --git a/usr/lib/common/pqc_supported.c b/usr/lib/common/pqc_supported.c new file mode 100644 index 00000000..4f048c33 --- /dev/null +++ b/usr/lib/common/pqc_supported.c @@ -0,0 +1,78 @@ +/* + * COPYRIGHT (c) International Business Machines Corp. 2022 + * + * This program is provided under the terms of the Common Public License, + * version 1.0 (CPL-1.0). Any use, reproduction or distribution for this + * software constitutes recipient's acceptance of CPL-1.0 terms which can be + * found in the file LICENSE file or at + * https://opensource.org/licenses/cpl1.0.php + */ + +#include +#include "pkcs11types.h" +#include "pqc_defs.h" + +const CK_BYTE dilithium_r2_65[] = OCK_DILITHIUM_R2_65; +const CK_ULONG dilithium_r2_65_len = sizeof(dilithium_r2_65); +const CK_BYTE dilithium_r2_87[] = OCK_DILITHIUM_R2_87; +const CK_ULONG dilithium_r2_87_len = sizeof(dilithium_r2_87); +const CK_BYTE dilithium_r3_44[] = OCK_DILITHIUM_R3_44; +const CK_ULONG dilithium_r3_44_len = sizeof(dilithium_r3_44); +const CK_BYTE dilithium_r3_65[] = OCK_DILITHIUM_R3_65; +const CK_ULONG dilithium_r3_65_len = sizeof(dilithium_r3_65); +const CK_BYTE dilithium_r3_87[] = OCK_DILITHIUM_R3_87; +const CK_ULONG dilithium_r3_87_len = sizeof(dilithium_r3_87); + +const struct pqc_oid dilithium_oids[] = { + { .oid = dilithium_r2_65, .oid_len = dilithium_r2_65_len, + .keyform = CK_IBM_DILITHIUM_KEYFORM_ROUND2_65 }, + { .oid = dilithium_r2_87, .oid_len = dilithium_r2_87_len, + .keyform = CK_IBM_DILITHIUM_KEYFORM_ROUND2_87 }, + { .oid = dilithium_r3_44, .oid_len = dilithium_r3_44_len, + .keyform = CK_IBM_DILITHIUM_KEYFORM_ROUND3_44 }, + { .oid = dilithium_r3_65, .oid_len = dilithium_r3_65_len, + .keyform = CK_IBM_DILITHIUM_KEYFORM_ROUND3_65 }, + { .oid = dilithium_r3_87, .oid_len = dilithium_r3_87_len, + .keyform = CK_IBM_DILITHIUM_KEYFORM_ROUND3_87 }, + { .oid = NULL, .oid_len = 0, .keyform = 0 } +}; + +const CK_BYTE kyber_r2_768[] = OCK_KYBER_R2_768; +const CK_ULONG kyber_r2_768_len = sizeof(kyber_r2_768); +const CK_BYTE kyber_r2_1024[] = OCK_KYBER_R2_1024; +const CK_ULONG kyber_r2_1024_len = sizeof(kyber_r2_1024); + +const struct pqc_oid kyber_oids[] = { + { .oid = kyber_r2_768, .oid_len = kyber_r2_768_len, + .keyform = CK_IBM_KYBER_KEYFORM_ROUND2_768 }, + { .oid = kyber_r2_1024, .oid_len = kyber_r2_1024_len, + .keyform = CK_IBM_KYBER_KEYFORM_ROUND2_1024 }, + { .oid = NULL, .oid_len = 0, .keyform = 0 } +}; + +const struct pqc_oid *find_pqc_by_keyform(const struct pqc_oid *pqcs, + CK_ULONG keyform) +{ + CK_ULONG i; + + for (i = 0; pqcs[i].oid != NULL; i++) { + if (pqcs[i].keyform == keyform) + return &pqcs[i]; + } + + return NULL; +} + +const struct pqc_oid *find_pqc_by_oid(const struct pqc_oid *pqcs, + CK_BYTE *oid, CK_ULONG oid_len) +{ + CK_ULONG i; + + for (i = 0; pqcs[i].oid != NULL; i++) { + if (pqcs[i].oid_len == oid_len && + memcmp(pqcs[i].oid, oid, oid_len) == 0) + return &pqcs[i]; + } + + return NULL; +} -- 2.16.2.windows.1