1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
2 *
3 * LibTomCrypt is a library that provides various cryptographic
4 * algorithms in a highly modular and flexible manner.
5 *
6 * The library is free for all purposes without any express
7 * guarantee it works.
8 *
9 * Tom St Denis, tomstdenis@gmail.com, http://libtom.org
10 */
11
12 /* Implements ECC over Z/pZ for curve y^2 = x^3 - 3x + b
13 *
14 * All curves taken from NIST recommendation paper of July 1999
15 * Available at http://csrc.nist.gov/cryptval/dss.htm
16 */
17 #include "../../headers/tomcrypt.h"
18
19 /**
20 @file ltc_ecc_projective_add_point.c
21 ECC Crypto, Tom St Denis
22 */
23
24 #if defined(LTC_MECC) && (!defined(LTC_MECC_ACCEL) || defined(LTM_LTC_DESC))
25
26 /**
27 Add two ECC points
28 @param P The point to add
29 @param Q The point to add
30 @param R [out] The destination of the double
31 @param modulus The modulus of the field the ECC curve is in
32 @param mp The "b" value from montgomery_setup()
33 @return CRYPT_OK on success
34 */
ltc_ecc_projective_add_point(ecc_point * P,ecc_point * Q,ecc_point * R,void * modulus,void * mp)35 int ltc_ecc_projective_add_point(ecc_point *P, ecc_point *Q, ecc_point *R, void *modulus, void *mp)
36 {
37 void *t1, *t2, *x, *y, *z;
38 int err;
39
40 LTC_ARGCHK(P != NULL);
41 LTC_ARGCHK(Q != NULL);
42 LTC_ARGCHK(R != NULL);
43 LTC_ARGCHK(modulus != NULL);
44 LTC_ARGCHK(mp != NULL);
45
46 if ((err = mp_init_multi(&t1, &t2, &x, &y, &z, NULL)) != CRYPT_OK) {
47 return err;
48 }
49
50 /* should we dbl instead? */
51 if ((err = mp_sub(modulus, Q->y, t1)) != CRYPT_OK) { goto done; }
52
53 if ( (mp_cmp(P->x, Q->x) == LTC_MP_EQ) &&
54 (Q->z != NULL && mp_cmp(P->z, Q->z) == LTC_MP_EQ) &&
55 (mp_cmp(P->y, Q->y) == LTC_MP_EQ || mp_cmp(P->y, t1) == LTC_MP_EQ)) {
56 mp_clear_multi(t1, t2, x, y, z, NULL);
57 return ltc_ecc_projective_dbl_point(P, R, modulus, mp);
58 }
59
60 if ((err = mp_copy(P->x, x)) != CRYPT_OK) { goto done; }
61 if ((err = mp_copy(P->y, y)) != CRYPT_OK) { goto done; }
62 if ((err = mp_copy(P->z, z)) != CRYPT_OK) { goto done; }
63
64 /* if Z is one then these are no-operations */
65 if (Q->z != NULL) {
66 /* T1 = Z' * Z' */
67 if ((err = mp_sqr(Q->z, t1)) != CRYPT_OK) { goto done; }
68 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; }
69 /* X = X * T1 */
70 if ((err = mp_mul(t1, x, x)) != CRYPT_OK) { goto done; }
71 if ((err = mp_montgomery_reduce(x, modulus, mp)) != CRYPT_OK) { goto done; }
72 /* T1 = Z' * T1 */
73 if ((err = mp_mul(Q->z, t1, t1)) != CRYPT_OK) { goto done; }
74 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; }
75 /* Y = Y * T1 */
76 if ((err = mp_mul(t1, y, y)) != CRYPT_OK) { goto done; }
77 if ((err = mp_montgomery_reduce(y, modulus, mp)) != CRYPT_OK) { goto done; }
78 }
79
80 /* T1 = Z*Z */
81 if ((err = mp_sqr(z, t1)) != CRYPT_OK) { goto done; }
82 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; }
83 /* T2 = X' * T1 */
84 if ((err = mp_mul(Q->x, t1, t2)) != CRYPT_OK) { goto done; }
85 if ((err = mp_montgomery_reduce(t2, modulus, mp)) != CRYPT_OK) { goto done; }
86 /* T1 = Z * T1 */
87 if ((err = mp_mul(z, t1, t1)) != CRYPT_OK) { goto done; }
88 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; }
89 /* T1 = Y' * T1 */
90 if ((err = mp_mul(Q->y, t1, t1)) != CRYPT_OK) { goto done; }
91 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; }
92
93 /* Y = Y - T1 */
94 if ((err = mp_sub(y, t1, y)) != CRYPT_OK) { goto done; }
95 if (mp_cmp_d(y, 0) == LTC_MP_LT) {
96 if ((err = mp_add(y, modulus, y)) != CRYPT_OK) { goto done; }
97 }
98 /* T1 = 2T1 */
99 if ((err = mp_add(t1, t1, t1)) != CRYPT_OK) { goto done; }
100 if (mp_cmp(t1, modulus) != LTC_MP_LT) {
101 if ((err = mp_sub(t1, modulus, t1)) != CRYPT_OK) { goto done; }
102 }
103 /* T1 = Y + T1 */
104 if ((err = mp_add(t1, y, t1)) != CRYPT_OK) { goto done; }
105 if (mp_cmp(t1, modulus) != LTC_MP_LT) {
106 if ((err = mp_sub(t1, modulus, t1)) != CRYPT_OK) { goto done; }
107 }
108 /* X = X - T2 */
109 if ((err = mp_sub(x, t2, x)) != CRYPT_OK) { goto done; }
110 if (mp_cmp_d(x, 0) == LTC_MP_LT) {
111 if ((err = mp_add(x, modulus, x)) != CRYPT_OK) { goto done; }
112 }
113 /* T2 = 2T2 */
114 if ((err = mp_add(t2, t2, t2)) != CRYPT_OK) { goto done; }
115 if (mp_cmp(t2, modulus) != LTC_MP_LT) {
116 if ((err = mp_sub(t2, modulus, t2)) != CRYPT_OK) { goto done; }
117 }
118 /* T2 = X + T2 */
119 if ((err = mp_add(t2, x, t2)) != CRYPT_OK) { goto done; }
120 if (mp_cmp(t2, modulus) != LTC_MP_LT) {
121 if ((err = mp_sub(t2, modulus, t2)) != CRYPT_OK) { goto done; }
122 }
123
124 /* if Z' != 1 */
125 if (Q->z != NULL) {
126 /* Z = Z * Z' */
127 if ((err = mp_mul(z, Q->z, z)) != CRYPT_OK) { goto done; }
128 if ((err = mp_montgomery_reduce(z, modulus, mp)) != CRYPT_OK) { goto done; }
129 }
130
131 /* Z = Z * X */
132 if ((err = mp_mul(z, x, z)) != CRYPT_OK) { goto done; }
133 if ((err = mp_montgomery_reduce(z, modulus, mp)) != CRYPT_OK) { goto done; }
134
135 /* T1 = T1 * X */
136 if ((err = mp_mul(t1, x, t1)) != CRYPT_OK) { goto done; }
137 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; }
138 /* X = X * X */
139 if ((err = mp_sqr(x, x)) != CRYPT_OK) { goto done; }
140 if ((err = mp_montgomery_reduce(x, modulus, mp)) != CRYPT_OK) { goto done; }
141 /* T2 = T2 * x */
142 if ((err = mp_mul(t2, x, t2)) != CRYPT_OK) { goto done; }
143 if ((err = mp_montgomery_reduce(t2, modulus, mp)) != CRYPT_OK) { goto done; }
144 /* T1 = T1 * X */
145 if ((err = mp_mul(t1, x, t1)) != CRYPT_OK) { goto done; }
146 if ((err = mp_montgomery_reduce(t1, modulus, mp)) != CRYPT_OK) { goto done; }
147
148 /* X = Y*Y */
149 if ((err = mp_sqr(y, x)) != CRYPT_OK) { goto done; }
150 if ((err = mp_montgomery_reduce(x, modulus, mp)) != CRYPT_OK) { goto done; }
151 /* X = X - T2 */
152 if ((err = mp_sub(x, t2, x)) != CRYPT_OK) { goto done; }
153 if (mp_cmp_d(x, 0) == LTC_MP_LT) {
154 if ((err = mp_add(x, modulus, x)) != CRYPT_OK) { goto done; }
155 }
156
157 /* T2 = T2 - X */
158 if ((err = mp_sub(t2, x, t2)) != CRYPT_OK) { goto done; }
159 if (mp_cmp_d(t2, 0) == LTC_MP_LT) {
160 if ((err = mp_add(t2, modulus, t2)) != CRYPT_OK) { goto done; }
161 }
162 /* T2 = T2 - X */
163 if ((err = mp_sub(t2, x, t2)) != CRYPT_OK) { goto done; }
164 if (mp_cmp_d(t2, 0) == LTC_MP_LT) {
165 if ((err = mp_add(t2, modulus, t2)) != CRYPT_OK) { goto done; }
166 }
167 /* T2 = T2 * Y */
168 if ((err = mp_mul(t2, y, t2)) != CRYPT_OK) { goto done; }
169 if ((err = mp_montgomery_reduce(t2, modulus, mp)) != CRYPT_OK) { goto done; }
170 /* Y = T2 - T1 */
171 if ((err = mp_sub(t2, t1, y)) != CRYPT_OK) { goto done; }
172 if (mp_cmp_d(y, 0) == LTC_MP_LT) {
173 if ((err = mp_add(y, modulus, y)) != CRYPT_OK) { goto done; }
174 }
175 /* Y = Y/2 */
176 if (mp_isodd(y)) {
177 if ((err = mp_add(y, modulus, y)) != CRYPT_OK) { goto done; }
178 }
179 if ((err = mp_div_2(y, y)) != CRYPT_OK) { goto done; }
180
181 if ((err = mp_copy(x, R->x)) != CRYPT_OK) { goto done; }
182 if ((err = mp_copy(y, R->y)) != CRYPT_OK) { goto done; }
183 if ((err = mp_copy(z, R->z)) != CRYPT_OK) { goto done; }
184
185 err = CRYPT_OK;
186 done:
187 mp_clear_multi(t1, t2, x, y, z, NULL);
188 return err;
189 }
190
191 #endif
192
193 /* $Source: /cvs/libtom/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c,v $ */
194 /* $Revision: 1.16 $ */
195 /* $Date: 2007/05/12 14:32:35 $ */
196
197