1 /* 2 * Copyright (c) 2007, 2017, Oracle and/or its affiliates. All rights reserved. 3 * Use is subject to license terms. 4 * 5 * This library is free software; you can redistribute it and/or 6 * modify it under the terms of the GNU Lesser General Public 7 * License as published by the Free Software Foundation; either 8 * version 2.1 of the License, or (at your option) any later version. 9 * 10 * This library is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 13 * Lesser General Public License for more details. 14 * 15 * You should have received a copy of the GNU Lesser General Public License 16 * along with this library; if not, write to the Free Software Foundation, 17 * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 18 * 19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 20 * or visit www.oracle.com if you need additional information or have any 21 * questions. 22 */ 23 24 /* ********************************************************************* 25 * 26 * The Original Code is the elliptic curve math library for prime field curves. 27 * 28 * The Initial Developer of the Original Code is 29 * Sun Microsystems, Inc. 30 * Portions created by the Initial Developer are Copyright (C) 2003 31 * the Initial Developer. All Rights Reserved. 32 * 33 * Contributor(s): 34 * Douglas Stebila <douglas@stebila.ca>, Sun Microsystems Laboratories 35 * 36 * Last Modified Date from the Original Code: May 2017 37 *********************************************************************** */ 38 39 #ifndef _ECP_H 40 #define _ECP_H 41 42 #include "ecl-priv.h" 43 44 /* Checks if point P(px, py) is at infinity. Uses affine coordinates. */ 45 mp_err ec_GFp_pt_is_inf_aff(const mp_int *px, const mp_int *py); 46 47 /* Sets P(px, py) to be the point at infinity. Uses affine coordinates. */ 48 mp_err ec_GFp_pt_set_inf_aff(mp_int *px, mp_int *py); 49 50 /* Computes R = P + Q where R is (rx, ry), P is (px, py) and Q is (qx, 51 * qy). Uses affine coordinates. */ 52 mp_err ec_GFp_pt_add_aff(const mp_int *px, const mp_int *py, 53 const mp_int *qx, const mp_int *qy, mp_int *rx, 54 mp_int *ry, const ECGroup *group); 55 56 /* Computes R = P - Q. Uses affine coordinates. */ 57 mp_err ec_GFp_pt_sub_aff(const mp_int *px, const mp_int *py, 58 const mp_int *qx, const mp_int *qy, mp_int *rx, 59 mp_int *ry, const ECGroup *group); 60 61 /* Computes R = 2P. Uses affine coordinates. */ 62 mp_err ec_GFp_pt_dbl_aff(const mp_int *px, const mp_int *py, mp_int *rx, 63 mp_int *ry, const ECGroup *group); 64 65 /* Validates a point on a GFp curve. */ 66 mp_err ec_GFp_validate_point(const mp_int *px, const mp_int *py, const ECGroup *group); 67 68 #ifdef ECL_ENABLE_GFP_PT_MUL_AFF 69 /* Computes R = nP where R is (rx, ry) and P is (px, py). The parameters 70 * a, b and p are the elliptic curve coefficients and the prime that 71 * determines the field GFp. Uses affine coordinates. */ 72 mp_err ec_GFp_pt_mul_aff(const mp_int *n, const mp_int *px, 73 const mp_int *py, mp_int *rx, mp_int *ry, 74 const ECGroup *group); 75 #endif 76 77 /* Converts a point P(px, py) from affine coordinates to Jacobian 78 * projective coordinates R(rx, ry, rz). */ 79 mp_err ec_GFp_pt_aff2jac(const mp_int *px, const mp_int *py, mp_int *rx, 80 mp_int *ry, mp_int *rz, const ECGroup *group); 81 82 /* Converts a point P(px, py, pz) from Jacobian projective coordinates to 83 * affine coordinates R(rx, ry). */ 84 mp_err ec_GFp_pt_jac2aff(const mp_int *px, const mp_int *py, 85 const mp_int *pz, mp_int *rx, mp_int *ry, 86 const ECGroup *group); 87 88 /* Checks if point P(px, py, pz) is at infinity. Uses Jacobian 89 * coordinates. */ 90 mp_err ec_GFp_pt_is_inf_jac(const mp_int *px, const mp_int *py, 91 const mp_int *pz); 92 93 /* Sets P(px, py, pz) to be the point at infinity. Uses Jacobian 94 * coordinates. */ 95 mp_err ec_GFp_pt_set_inf_jac(mp_int *px, mp_int *py, mp_int *pz); 96 97 /* Computes R = P + Q where R is (rx, ry, rz), P is (px, py, pz) and Q is 98 * (qx, qy, qz). Uses Jacobian coordinates. */ 99 mp_err ec_GFp_pt_add_jac_aff(const mp_int *px, const mp_int *py, 100 const mp_int *pz, const mp_int *qx, 101 const mp_int *qy, mp_int *rx, mp_int *ry, 102 mp_int *rz, const ECGroup *group); 103 104 /* Computes R = 2P. Uses Jacobian coordinates. */ 105 mp_err ec_GFp_pt_dbl_jac(const mp_int *px, const mp_int *py, 106 const mp_int *pz, mp_int *rx, mp_int *ry, 107 mp_int *rz, const ECGroup *group); 108 109 #ifdef ECL_ENABLE_GFP_PT_MUL_JAC 110 /* Computes R = nP where R is (rx, ry) and P is (px, py). The parameters 111 * a, b and p are the elliptic curve coefficients and the prime that 112 * determines the field GFp. Uses Jacobian coordinates. */ 113 mp_err ec_GFp_pt_mul_jac(const mp_int *n, const mp_int *px, 114 const mp_int *py, mp_int *rx, mp_int *ry, 115 const ECGroup *group); 116 #endif 117 118 /* Computes R(x, y) = k1 * G + k2 * P(x, y), where G is the generator 119 * (base point) of the group of points on the elliptic curve. Allows k1 = 120 * NULL or { k2, P } = NULL. Implemented using mixed Jacobian-affine 121 * coordinates. Input and output values are assumed to be NOT 122 * field-encoded and are in affine form. */ 123 mp_err 124 ec_GFp_pts_mul_jac(const mp_int *k1, const mp_int *k2, const mp_int *px, 125 const mp_int *py, mp_int *rx, mp_int *ry, 126 const ECGroup *group, int timing); 127 128 /* Computes R = nP where R is (rx, ry) and P is the base point. Elliptic 129 * curve points P and R can be identical. Uses mixed Modified-Jacobian 130 * co-ordinates for doubling and Chudnovsky Jacobian coordinates for 131 * additions. Assumes input is already field-encoded using field_enc, and 132 * returns output that is still field-encoded. Uses 5-bit window NAF 133 * method (algorithm 11) for scalar-point multiplication from Brown, 134 * Hankerson, Lopez, Menezes. Software Implementation of the NIST Elliptic 135 * Curves Over Prime Fields. The implementation includes a countermeasure 136 * that attempts to hide the size of n from timing channels. This counter- 137 * measure is enabled using the timing argument. The high-rder bits of timing 138 * must be uniformly random in order for this countermeasure to work. */ 139 mp_err 140 ec_GFp_pt_mul_jm_wNAF(const mp_int *n, const mp_int *px, const mp_int *py, 141 mp_int *rx, mp_int *ry, const ECGroup *group, 142 int timing); 143 144 #endif /* _ECP_H */ 145