1 /** 2 * \file ecp_internal.h 3 * 4 * \brief Function declarations for alternative implementation of elliptic curve 5 * point arithmetic. 6 */ 7 /* 8 * Copyright The Mbed TLS Contributors 9 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 10 * 11 * This file is provided under the Apache License 2.0, or the 12 * GNU General Public License v2.0 or later. 13 * 14 * ********** 15 * Apache License 2.0: 16 * 17 * Licensed under the Apache License, Version 2.0 (the "License"); you may 18 * not use this file except in compliance with the License. 19 * You may obtain a copy of the License at 20 * 21 * http://www.apache.org/licenses/LICENSE-2.0 22 * 23 * Unless required by applicable law or agreed to in writing, software 24 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 25 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 26 * See the License for the specific language governing permissions and 27 * limitations under the License. 28 * 29 * ********** 30 * 31 * ********** 32 * GNU General Public License v2.0 or later: 33 * 34 * This program is free software; you can redistribute it and/or modify 35 * it under the terms of the GNU General Public License as published by 36 * the Free Software Foundation; either version 2 of the License, or 37 * (at your option) any later version. 38 * 39 * This program is distributed in the hope that it will be useful, 40 * but WITHOUT ANY WARRANTY; without even the implied warranty of 41 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 42 * GNU General Public License for more details. 43 * 44 * You should have received a copy of the GNU General Public License along 45 * with this program; if not, write to the Free Software Foundation, Inc., 46 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 47 * 48 * ********** 49 */ 50 51 /* 52 * References: 53 * 54 * [1] BERNSTEIN, Daniel J. Curve25519: new Diffie-Hellman speed records. 55 * <http://cr.yp.to/ecdh/curve25519-20060209.pdf> 56 * 57 * [2] CORON, Jean-S'ebastien. Resistance against differential power analysis 58 * for elliptic curve cryptosystems. In : Cryptographic Hardware and 59 * Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302. 60 * <http://link.springer.com/chapter/10.1007/3-540-48059-5_25> 61 * 62 * [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to 63 * render ECC resistant against Side Channel Attacks. IACR Cryptology 64 * ePrint Archive, 2004, vol. 2004, p. 342. 65 * <http://eprint.iacr.org/2004/342.pdf> 66 * 67 * [4] Certicom Research. SEC 2: Recommended Elliptic Curve Domain Parameters. 68 * <http://www.secg.org/sec2-v2.pdf> 69 * 70 * [5] HANKERSON, Darrel, MENEZES, Alfred J., VANSTONE, Scott. Guide to Elliptic 71 * Curve Cryptography. 72 * 73 * [6] Digital Signature Standard (DSS), FIPS 186-4. 74 * <http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf> 75 * 76 * [7] Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer 77 * Security (TLS), RFC 4492. 78 * <https://tools.ietf.org/search/rfc4492> 79 * 80 * [8] <http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html> 81 * 82 * [9] COHEN, Henri. A Course in Computational Algebraic Number Theory. 83 * Springer Science & Business Media, 1 Aug 2000 84 */ 85 86 #ifndef MBEDTLS_ECP_INTERNAL_H 87 #define MBEDTLS_ECP_INTERNAL_H 88 89 #if !defined(MBEDTLS_CONFIG_FILE) 90 #include "config.h" 91 #else 92 #include MBEDTLS_CONFIG_FILE 93 #endif 94 95 #if defined(MBEDTLS_ECP_INTERNAL_ALT) 96 97 /** 98 * \brief Indicate if the Elliptic Curve Point module extension can 99 * handle the group. 100 * 101 * \param grp The pointer to the elliptic curve group that will be the 102 * basis of the cryptographic computations. 103 * 104 * \return Non-zero if successful. 105 */ 106 unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp ); 107 108 /** 109 * \brief Initialise the Elliptic Curve Point module extension. 110 * 111 * If mbedtls_internal_ecp_grp_capable returns true for a 112 * group, this function has to be able to initialise the 113 * module for it. 114 * 115 * This module can be a driver to a crypto hardware 116 * accelerator, for which this could be an initialise function. 117 * 118 * \param grp The pointer to the group the module needs to be 119 * initialised for. 120 * 121 * \return 0 if successful. 122 */ 123 int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ); 124 125 /** 126 * \brief Frees and deallocates the Elliptic Curve Point module 127 * extension. 128 * 129 * \param grp The pointer to the group the module was initialised for. 130 */ 131 void mbedtls_internal_ecp_free( const mbedtls_ecp_group *grp ); 132 133 #if defined(ECP_SHORTWEIERSTRASS) 134 135 #if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT) 136 /** 137 * \brief Randomize jacobian coordinates: 138 * (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l. 139 * 140 * \param grp Pointer to the group representing the curve. 141 * 142 * \param pt The point on the curve to be randomised, given with Jacobian 143 * coordinates. 144 * 145 * \param f_rng A function pointer to the random number generator. 146 * 147 * \param p_rng A pointer to the random number generator state. 148 * 149 * \return 0 if successful. 150 */ 151 int mbedtls_internal_ecp_randomize_jac( const mbedtls_ecp_group *grp, 152 mbedtls_ecp_point *pt, int (*f_rng)(void *, unsigned char *, size_t), 153 void *p_rng ); 154 #endif 155 156 #if defined(MBEDTLS_ECP_ADD_MIXED_ALT) 157 /** 158 * \brief Addition: R = P + Q, mixed affine-Jacobian coordinates. 159 * 160 * The coordinates of Q must be normalized (= affine), 161 * but those of P don't need to. R is not normalized. 162 * 163 * This function is used only as a subrutine of 164 * ecp_mul_comb(). 165 * 166 * Special cases: (1) P or Q is zero, (2) R is zero, 167 * (3) P == Q. 168 * None of these cases can happen as intermediate step in 169 * ecp_mul_comb(): 170 * - at each step, P, Q and R are multiples of the base 171 * point, the factor being less than its order, so none of 172 * them is zero; 173 * - Q is an odd multiple of the base point, P an even 174 * multiple, due to the choice of precomputed points in the 175 * modified comb method. 176 * So branches for these cases do not leak secret information. 177 * 178 * We accept Q->Z being unset (saving memory in tables) as 179 * meaning 1. 180 * 181 * Cost in field operations if done by [5] 3.22: 182 * 1A := 8M + 3S 183 * 184 * \param grp Pointer to the group representing the curve. 185 * 186 * \param R Pointer to a point structure to hold the result. 187 * 188 * \param P Pointer to the first summand, given with Jacobian 189 * coordinates 190 * 191 * \param Q Pointer to the second summand, given with affine 192 * coordinates. 193 * 194 * \return 0 if successful. 195 */ 196 int mbedtls_internal_ecp_add_mixed( const mbedtls_ecp_group *grp, 197 mbedtls_ecp_point *R, const mbedtls_ecp_point *P, 198 const mbedtls_ecp_point *Q ); 199 #endif 200 201 /** 202 * \brief Point doubling R = 2 P, Jacobian coordinates. 203 * 204 * Cost: 1D := 3M + 4S (A == 0) 205 * 4M + 4S (A == -3) 206 * 3M + 6S + 1a otherwise 207 * when the implementation is based on the "dbl-1998-cmo-2" 208 * doubling formulas in [8] and standard optimizations are 209 * applied when curve parameter A is one of { 0, -3 }. 210 * 211 * \param grp Pointer to the group representing the curve. 212 * 213 * \param R Pointer to a point structure to hold the result. 214 * 215 * \param P Pointer to the point that has to be doubled, given with 216 * Jacobian coordinates. 217 * 218 * \return 0 if successful. 219 */ 220 #if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) 221 int mbedtls_internal_ecp_double_jac( const mbedtls_ecp_group *grp, 222 mbedtls_ecp_point *R, const mbedtls_ecp_point *P ); 223 #endif 224 225 /** 226 * \brief Normalize jacobian coordinates of an array of (pointers to) 227 * points. 228 * 229 * Using Montgomery's trick to perform only one inversion mod P 230 * the cost is: 231 * 1N(t) := 1I + (6t - 3)M + 1S 232 * (See for example Algorithm 10.3.4. in [9]) 233 * 234 * This function is used only as a subrutine of 235 * ecp_mul_comb(). 236 * 237 * Warning: fails (returning an error) if one of the points is 238 * zero! 239 * This should never happen, see choice of w in ecp_mul_comb(). 240 * 241 * \param grp Pointer to the group representing the curve. 242 * 243 * \param T Array of pointers to the points to normalise. 244 * 245 * \param t_len Number of elements in the array. 246 * 247 * \return 0 if successful, 248 * an error if one of the points is zero. 249 */ 250 #if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT) 251 int mbedtls_internal_ecp_normalize_jac_many( const mbedtls_ecp_group *grp, 252 mbedtls_ecp_point *T[], size_t t_len ); 253 #endif 254 255 /** 256 * \brief Normalize jacobian coordinates so that Z == 0 || Z == 1. 257 * 258 * Cost in field operations if done by [5] 3.2.1: 259 * 1N := 1I + 3M + 1S 260 * 261 * \param grp Pointer to the group representing the curve. 262 * 263 * \param pt pointer to the point to be normalised. This is an 264 * input/output parameter. 265 * 266 * \return 0 if successful. 267 */ 268 #if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT) 269 int mbedtls_internal_ecp_normalize_jac( const mbedtls_ecp_group *grp, 270 mbedtls_ecp_point *pt ); 271 #endif 272 273 #endif /* ECP_SHORTWEIERSTRASS */ 274 275 #if defined(ECP_MONTGOMERY) 276 277 #if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) 278 int mbedtls_internal_ecp_double_add_mxz( const mbedtls_ecp_group *grp, 279 mbedtls_ecp_point *R, mbedtls_ecp_point *S, const mbedtls_ecp_point *P, 280 const mbedtls_ecp_point *Q, const mbedtls_mpi *d ); 281 #endif 282 283 /** 284 * \brief Randomize projective x/z coordinates: 285 * (X, Z) -> (l X, l Z) for random l 286 * 287 * \param grp pointer to the group representing the curve 288 * 289 * \param P the point on the curve to be randomised given with 290 * projective coordinates. This is an input/output parameter. 291 * 292 * \param f_rng a function pointer to the random number generator 293 * 294 * \param p_rng a pointer to the random number generator state 295 * 296 * \return 0 if successful 297 */ 298 #if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT) 299 int mbedtls_internal_ecp_randomize_mxz( const mbedtls_ecp_group *grp, 300 mbedtls_ecp_point *P, int (*f_rng)(void *, unsigned char *, size_t), 301 void *p_rng ); 302 #endif 303 304 /** 305 * \brief Normalize Montgomery x/z coordinates: X = X/Z, Z = 1. 306 * 307 * \param grp pointer to the group representing the curve 308 * 309 * \param P pointer to the point to be normalised. This is an 310 * input/output parameter. 311 * 312 * \return 0 if successful 313 */ 314 #if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT) 315 int mbedtls_internal_ecp_normalize_mxz( const mbedtls_ecp_group *grp, 316 mbedtls_ecp_point *P ); 317 #endif 318 319 #endif /* ECP_MONTGOMERY */ 320 321 #endif /* MBEDTLS_ECP_INTERNAL_ALT */ 322 323 #endif /* ecp_internal.h */ 324 325