1 /* crypto/ec/ec_lib.c */
2 /*
3  * Originally written by Bodo Moeller for the OpenSSL project.
4  */
5 /* ====================================================================
6  * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  *
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in
17  *    the documentation and/or other materials provided with the
18  *    distribution.
19  *
20  * 3. All advertising materials mentioning features or use of this
21  *    software must display the following acknowledgment:
22  *    "This product includes software developed by the OpenSSL Project
23  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
24  *
25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26  *    endorse or promote products derived from this software without
27  *    prior written permission. For written permission, please contact
28  *    openssl-core@openssl.org.
29  *
30  * 5. Products derived from this software may not be called "OpenSSL"
31  *    nor may "OpenSSL" appear in their names without prior written
32  *    permission of the OpenSSL Project.
33  *
34  * 6. Redistributions of any form whatsoever must retain the following
35  *    acknowledgment:
36  *    "This product includes software developed by the OpenSSL Project
37  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
38  *
39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50  * OF THE POSSIBILITY OF SUCH DAMAGE.
51  * ====================================================================
52  *
53  * This product includes cryptographic software written by Eric Young
54  * (eay@cryptsoft.com).  This product includes software written by Tim
55  * Hudson (tjh@cryptsoft.com).
56  *
57  */
58 /* ====================================================================
59  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
60  * Binary polynomial ECC support in OpenSSL originally developed by
61  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
62  */
63 
64 #include <string.h>
65 
66 #include <openssl/err.h>
67 #include <openssl/opensslv.h>
68 
69 #include "ec_lcl.h"
70 
71 const char EC_version[] = "EC" OPENSSL_VERSION_PTEXT;
72 
73 /* functions for EC_GROUP objects */
74 
EC_GROUP_new(const EC_METHOD * meth)75 EC_GROUP *EC_GROUP_new(const EC_METHOD *meth)
76 {
77     EC_GROUP *ret;
78 
79     if (meth == NULL) {
80         ECerr(EC_F_EC_GROUP_NEW, EC_R_SLOT_FULL);
81         return NULL;
82     }
83     if (meth->group_init == 0) {
84         ECerr(EC_F_EC_GROUP_NEW, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
85         return NULL;
86     }
87 
88     ret = OPENSSL_malloc(sizeof *ret);
89     if (ret == NULL) {
90         ECerr(EC_F_EC_GROUP_NEW, ERR_R_MALLOC_FAILURE);
91         return NULL;
92     }
93 
94     ret->meth = meth;
95 
96     ret->extra_data = NULL;
97 
98     ret->generator = NULL;
99     BN_init(&ret->order);
100     BN_init(&ret->cofactor);
101 
102     ret->curve_name = 0;
103     ret->asn1_flag = 0;
104     ret->asn1_form = POINT_CONVERSION_UNCOMPRESSED;
105 
106     ret->seed = NULL;
107     ret->seed_len = 0;
108 
109     if (!meth->group_init(ret)) {
110         OPENSSL_free(ret);
111         return NULL;
112     }
113 
114     return ret;
115 }
116 
EC_GROUP_free(EC_GROUP * group)117 void EC_GROUP_free(EC_GROUP *group)
118 {
119     if (!group)
120         return;
121 
122     if (group->meth->group_finish != 0)
123         group->meth->group_finish(group);
124 
125     EC_EX_DATA_free_all_data(&group->extra_data);
126 
127     if (group->generator != NULL)
128         EC_POINT_free(group->generator);
129     BN_free(&group->order);
130     BN_free(&group->cofactor);
131 
132     if (group->seed)
133         OPENSSL_free(group->seed);
134 
135     OPENSSL_free(group);
136 }
137 
EC_GROUP_clear_free(EC_GROUP * group)138 void EC_GROUP_clear_free(EC_GROUP *group)
139 {
140     if (!group)
141         return;
142 
143     if (group->meth->group_clear_finish != 0)
144         group->meth->group_clear_finish(group);
145     else if (group->meth->group_finish != 0)
146         group->meth->group_finish(group);
147 
148     EC_EX_DATA_clear_free_all_data(&group->extra_data);
149 
150     if (group->generator != NULL)
151         EC_POINT_clear_free(group->generator);
152     BN_clear_free(&group->order);
153     BN_clear_free(&group->cofactor);
154 
155     if (group->seed) {
156         OPENSSL_cleanse(group->seed, group->seed_len);
157         OPENSSL_free(group->seed);
158     }
159 
160     OPENSSL_cleanse(group, sizeof *group);
161     OPENSSL_free(group);
162 }
163 
EC_GROUP_copy(EC_GROUP * dest,const EC_GROUP * src)164 int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
165 {
166     EC_EXTRA_DATA *d;
167 
168     if (dest->meth->group_copy == 0) {
169         ECerr(EC_F_EC_GROUP_COPY, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
170         return 0;
171     }
172     if (dest->meth != src->meth) {
173         ECerr(EC_F_EC_GROUP_COPY, EC_R_INCOMPATIBLE_OBJECTS);
174         return 0;
175     }
176     if (dest == src)
177         return 1;
178 
179     EC_EX_DATA_free_all_data(&dest->extra_data);
180 
181     for (d = src->extra_data; d != NULL; d = d->next) {
182         void *t = d->dup_func(d->data);
183 
184         if (t == NULL)
185             return 0;
186         if (!EC_EX_DATA_set_data
187             (&dest->extra_data, t, d->dup_func, d->free_func,
188              d->clear_free_func))
189             return 0;
190     }
191 
192     if (src->generator != NULL) {
193         if (dest->generator == NULL) {
194             dest->generator = EC_POINT_new(dest);
195             if (dest->generator == NULL)
196                 return 0;
197         }
198         if (!EC_POINT_copy(dest->generator, src->generator))
199             return 0;
200     } else {
201         /* src->generator == NULL */
202         if (dest->generator != NULL) {
203             EC_POINT_clear_free(dest->generator);
204             dest->generator = NULL;
205         }
206     }
207 
208     if (!BN_copy(&dest->order, &src->order))
209         return 0;
210     if (!BN_copy(&dest->cofactor, &src->cofactor))
211         return 0;
212 
213     dest->curve_name = src->curve_name;
214     dest->asn1_flag = src->asn1_flag;
215     dest->asn1_form = src->asn1_form;
216 
217     if (src->seed) {
218         if (dest->seed)
219             OPENSSL_free(dest->seed);
220         dest->seed = OPENSSL_malloc(src->seed_len);
221         if (dest->seed == NULL)
222             return 0;
223         if (!memcpy(dest->seed, src->seed, src->seed_len))
224             return 0;
225         dest->seed_len = src->seed_len;
226     } else {
227         if (dest->seed)
228             OPENSSL_free(dest->seed);
229         dest->seed = NULL;
230         dest->seed_len = 0;
231     }
232 
233     return dest->meth->group_copy(dest, src);
234 }
235 
EC_GROUP_dup(const EC_GROUP * a)236 EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
237 {
238     EC_GROUP *t = NULL;
239     int ok = 0;
240 
241     if (a == NULL)
242         return NULL;
243 
244     if ((t = EC_GROUP_new(a->meth)) == NULL)
245         return (NULL);
246     if (!EC_GROUP_copy(t, a))
247         goto err;
248 
249     ok = 1;
250 
251  err:
252     if (!ok) {
253         if (t)
254             EC_GROUP_free(t);
255         return NULL;
256     } else
257         return t;
258 }
259 
EC_GROUP_method_of(const EC_GROUP * group)260 const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *group)
261 {
262     return group->meth;
263 }
264 
EC_METHOD_get_field_type(const EC_METHOD * meth)265 int EC_METHOD_get_field_type(const EC_METHOD *meth)
266 {
267     return meth->field_type;
268 }
269 
EC_GROUP_set_generator(EC_GROUP * group,const EC_POINT * generator,const BIGNUM * order,const BIGNUM * cofactor)270 int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
271                            const BIGNUM *order, const BIGNUM *cofactor)
272 {
273     if (generator == NULL) {
274         ECerr(EC_F_EC_GROUP_SET_GENERATOR, ERR_R_PASSED_NULL_PARAMETER);
275         return 0;
276     }
277 
278     if (group->generator == NULL) {
279         group->generator = EC_POINT_new(group);
280         if (group->generator == NULL)
281             return 0;
282     }
283     if (!EC_POINT_copy(group->generator, generator))
284         return 0;
285 
286     if (order != NULL) {
287         if (!BN_copy(&group->order, order))
288             return 0;
289     } else
290         BN_zero(&group->order);
291 
292     if (cofactor != NULL) {
293         if (!BN_copy(&group->cofactor, cofactor))
294             return 0;
295     } else
296         BN_zero(&group->cofactor);
297 
298     return 1;
299 }
300 
EC_GROUP_get0_generator(const EC_GROUP * group)301 const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group)
302 {
303     return group->generator;
304 }
305 
EC_GROUP_get_order(const EC_GROUP * group,BIGNUM * order,BN_CTX * ctx)306 int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx)
307 {
308     if (!BN_copy(order, &group->order))
309         return 0;
310 
311     return !BN_is_zero(order);
312 }
313 
EC_GROUP_get_cofactor(const EC_GROUP * group,BIGNUM * cofactor,BN_CTX * ctx)314 int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor,
315                           BN_CTX *ctx)
316 {
317     if (!BN_copy(cofactor, &group->cofactor))
318         return 0;
319 
320     return !BN_is_zero(&group->cofactor);
321 }
322 
EC_GROUP_set_curve_name(EC_GROUP * group,int nid)323 void EC_GROUP_set_curve_name(EC_GROUP *group, int nid)
324 {
325     group->curve_name = nid;
326 }
327 
EC_GROUP_get_curve_name(const EC_GROUP * group)328 int EC_GROUP_get_curve_name(const EC_GROUP *group)
329 {
330     return group->curve_name;
331 }
332 
EC_GROUP_set_asn1_flag(EC_GROUP * group,int flag)333 void EC_GROUP_set_asn1_flag(EC_GROUP *group, int flag)
334 {
335     group->asn1_flag = flag;
336 }
337 
EC_GROUP_get_asn1_flag(const EC_GROUP * group)338 int EC_GROUP_get_asn1_flag(const EC_GROUP *group)
339 {
340     return group->asn1_flag;
341 }
342 
EC_GROUP_set_point_conversion_form(EC_GROUP * group,point_conversion_form_t form)343 void EC_GROUP_set_point_conversion_form(EC_GROUP *group,
344                                         point_conversion_form_t form)
345 {
346     group->asn1_form = form;
347 }
348 
EC_GROUP_get_point_conversion_form(const EC_GROUP * group)349 point_conversion_form_t EC_GROUP_get_point_conversion_form(const EC_GROUP
350                                                            *group)
351 {
352     return group->asn1_form;
353 }
354 
EC_GROUP_set_seed(EC_GROUP * group,const unsigned char * p,size_t len)355 size_t EC_GROUP_set_seed(EC_GROUP *group, const unsigned char *p, size_t len)
356 {
357     if (group->seed) {
358         OPENSSL_free(group->seed);
359         group->seed = NULL;
360         group->seed_len = 0;
361     }
362 
363     if (!len || !p)
364         return 1;
365 
366     if ((group->seed = OPENSSL_malloc(len)) == NULL)
367         return 0;
368     memcpy(group->seed, p, len);
369     group->seed_len = len;
370 
371     return len;
372 }
373 
EC_GROUP_get0_seed(const EC_GROUP * group)374 unsigned char *EC_GROUP_get0_seed(const EC_GROUP *group)
375 {
376     return group->seed;
377 }
378 
EC_GROUP_get_seed_len(const EC_GROUP * group)379 size_t EC_GROUP_get_seed_len(const EC_GROUP *group)
380 {
381     return group->seed_len;
382 }
383 
EC_GROUP_set_curve_GFp(EC_GROUP * group,const BIGNUM * p,const BIGNUM * a,const BIGNUM * b,BN_CTX * ctx)384 int EC_GROUP_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
385                            const BIGNUM *b, BN_CTX *ctx)
386 {
387     if (group->meth->group_set_curve == 0) {
388         ECerr(EC_F_EC_GROUP_SET_CURVE_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
389         return 0;
390     }
391     return group->meth->group_set_curve(group, p, a, b, ctx);
392 }
393 
EC_GROUP_get_curve_GFp(const EC_GROUP * group,BIGNUM * p,BIGNUM * a,BIGNUM * b,BN_CTX * ctx)394 int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
395                            BIGNUM *b, BN_CTX *ctx)
396 {
397     if (group->meth->group_get_curve == 0) {
398         ECerr(EC_F_EC_GROUP_GET_CURVE_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
399         return 0;
400     }
401     return group->meth->group_get_curve(group, p, a, b, ctx);
402 }
403 
404 #ifndef OPENSSL_NO_EC2M
EC_GROUP_set_curve_GF2m(EC_GROUP * group,const BIGNUM * p,const BIGNUM * a,const BIGNUM * b,BN_CTX * ctx)405 int EC_GROUP_set_curve_GF2m(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
406                             const BIGNUM *b, BN_CTX *ctx)
407 {
408     if (group->meth->group_set_curve == 0) {
409         ECerr(EC_F_EC_GROUP_SET_CURVE_GF2M,
410               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
411         return 0;
412     }
413     return group->meth->group_set_curve(group, p, a, b, ctx);
414 }
415 
EC_GROUP_get_curve_GF2m(const EC_GROUP * group,BIGNUM * p,BIGNUM * a,BIGNUM * b,BN_CTX * ctx)416 int EC_GROUP_get_curve_GF2m(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
417                             BIGNUM *b, BN_CTX *ctx)
418 {
419     if (group->meth->group_get_curve == 0) {
420         ECerr(EC_F_EC_GROUP_GET_CURVE_GF2M,
421               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
422         return 0;
423     }
424     return group->meth->group_get_curve(group, p, a, b, ctx);
425 }
426 #endif
427 
EC_GROUP_get_degree(const EC_GROUP * group)428 int EC_GROUP_get_degree(const EC_GROUP *group)
429 {
430     if (group->meth->group_get_degree == 0) {
431         ECerr(EC_F_EC_GROUP_GET_DEGREE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
432         return 0;
433     }
434     return group->meth->group_get_degree(group);
435 }
436 
EC_GROUP_check_discriminant(const EC_GROUP * group,BN_CTX * ctx)437 int EC_GROUP_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
438 {
439     if (group->meth->group_check_discriminant == 0) {
440         ECerr(EC_F_EC_GROUP_CHECK_DISCRIMINANT,
441               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
442         return 0;
443     }
444     return group->meth->group_check_discriminant(group, ctx);
445 }
446 
EC_GROUP_cmp(const EC_GROUP * a,const EC_GROUP * b,BN_CTX * ctx)447 int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx)
448 {
449     int r = 0;
450     BIGNUM *a1, *a2, *a3, *b1, *b2, *b3;
451     BN_CTX *ctx_new = NULL;
452 
453     /* compare the field types */
454     if (EC_METHOD_get_field_type(EC_GROUP_method_of(a)) !=
455         EC_METHOD_get_field_type(EC_GROUP_method_of(b)))
456         return 1;
457     /* compare the curve name (if present in both) */
458     if (EC_GROUP_get_curve_name(a) && EC_GROUP_get_curve_name(b) &&
459         EC_GROUP_get_curve_name(a) != EC_GROUP_get_curve_name(b))
460         return 1;
461 
462     if (!ctx)
463         ctx_new = ctx = BN_CTX_new();
464     if (!ctx)
465         return -1;
466 
467     BN_CTX_start(ctx);
468     a1 = BN_CTX_get(ctx);
469     a2 = BN_CTX_get(ctx);
470     a3 = BN_CTX_get(ctx);
471     b1 = BN_CTX_get(ctx);
472     b2 = BN_CTX_get(ctx);
473     b3 = BN_CTX_get(ctx);
474     if (!b3) {
475         BN_CTX_end(ctx);
476         if (ctx_new)
477             BN_CTX_free(ctx);
478         return -1;
479     }
480 
481     /*
482      * XXX This approach assumes that the external representation of curves
483      * over the same field type is the same.
484      */
485     if (!a->meth->group_get_curve(a, a1, a2, a3, ctx) ||
486         !b->meth->group_get_curve(b, b1, b2, b3, ctx))
487         r = 1;
488 
489     if (r || BN_cmp(a1, b1) || BN_cmp(a2, b2) || BN_cmp(a3, b3))
490         r = 1;
491 
492     /* XXX EC_POINT_cmp() assumes that the methods are equal */
493     if (r || EC_POINT_cmp(a, EC_GROUP_get0_generator(a),
494                           EC_GROUP_get0_generator(b), ctx))
495         r = 1;
496 
497     if (!r) {
498         /* compare the order and cofactor */
499         if (!EC_GROUP_get_order(a, a1, ctx) ||
500             !EC_GROUP_get_order(b, b1, ctx) ||
501             !EC_GROUP_get_cofactor(a, a2, ctx) ||
502             !EC_GROUP_get_cofactor(b, b2, ctx)) {
503             BN_CTX_end(ctx);
504             if (ctx_new)
505                 BN_CTX_free(ctx);
506             return -1;
507         }
508         if (BN_cmp(a1, b1) || BN_cmp(a2, b2))
509             r = 1;
510     }
511 
512     BN_CTX_end(ctx);
513     if (ctx_new)
514         BN_CTX_free(ctx);
515 
516     return r;
517 }
518 
519 /* this has 'package' visibility */
EC_EX_DATA_set_data(EC_EXTRA_DATA ** ex_data,void * data,void * (* dup_func)(void *),void (* free_func)(void *),void (* clear_free_func)(void *))520 int EC_EX_DATA_set_data(EC_EXTRA_DATA **ex_data, void *data,
521                         void *(*dup_func) (void *),
522                         void (*free_func) (void *),
523                         void (*clear_free_func) (void *))
524 {
525     EC_EXTRA_DATA *d;
526 
527     if (ex_data == NULL)
528         return 0;
529 
530     for (d = *ex_data; d != NULL; d = d->next) {
531         if (d->dup_func == dup_func && d->free_func == free_func
532             && d->clear_free_func == clear_free_func) {
533             ECerr(EC_F_EC_EX_DATA_SET_DATA, EC_R_SLOT_FULL);
534             return 0;
535         }
536     }
537 
538     if (data == NULL)
539         /* no explicit entry needed */
540         return 1;
541 
542     d = OPENSSL_malloc(sizeof *d);
543     if (d == NULL)
544         return 0;
545 
546     d->data = data;
547     d->dup_func = dup_func;
548     d->free_func = free_func;
549     d->clear_free_func = clear_free_func;
550 
551     d->next = *ex_data;
552     *ex_data = d;
553 
554     return 1;
555 }
556 
557 /* this has 'package' visibility */
EC_EX_DATA_get_data(const EC_EXTRA_DATA * ex_data,void * (* dup_func)(void *),void (* free_func)(void *),void (* clear_free_func)(void *))558 void *EC_EX_DATA_get_data(const EC_EXTRA_DATA *ex_data,
559                           void *(*dup_func) (void *),
560                           void (*free_func) (void *),
561                           void (*clear_free_func) (void *))
562 {
563     const EC_EXTRA_DATA *d;
564 
565     for (d = ex_data; d != NULL; d = d->next) {
566         if (d->dup_func == dup_func && d->free_func == free_func
567             && d->clear_free_func == clear_free_func)
568             return d->data;
569     }
570 
571     return NULL;
572 }
573 
574 /* this has 'package' visibility */
EC_EX_DATA_free_data(EC_EXTRA_DATA ** ex_data,void * (* dup_func)(void *),void (* free_func)(void *),void (* clear_free_func)(void *))575 void EC_EX_DATA_free_data(EC_EXTRA_DATA **ex_data,
576                           void *(*dup_func) (void *),
577                           void (*free_func) (void *),
578                           void (*clear_free_func) (void *))
579 {
580     EC_EXTRA_DATA **p;
581 
582     if (ex_data == NULL)
583         return;
584 
585     for (p = ex_data; *p != NULL; p = &((*p)->next)) {
586         if ((*p)->dup_func == dup_func && (*p)->free_func == free_func
587             && (*p)->clear_free_func == clear_free_func) {
588             EC_EXTRA_DATA *next = (*p)->next;
589 
590             (*p)->free_func((*p)->data);
591             OPENSSL_free(*p);
592 
593             *p = next;
594             return;
595         }
596     }
597 }
598 
599 /* this has 'package' visibility */
EC_EX_DATA_clear_free_data(EC_EXTRA_DATA ** ex_data,void * (* dup_func)(void *),void (* free_func)(void *),void (* clear_free_func)(void *))600 void EC_EX_DATA_clear_free_data(EC_EXTRA_DATA **ex_data,
601                                 void *(*dup_func) (void *),
602                                 void (*free_func) (void *),
603                                 void (*clear_free_func) (void *))
604 {
605     EC_EXTRA_DATA **p;
606 
607     if (ex_data == NULL)
608         return;
609 
610     for (p = ex_data; *p != NULL; p = &((*p)->next)) {
611         if ((*p)->dup_func == dup_func && (*p)->free_func == free_func
612             && (*p)->clear_free_func == clear_free_func) {
613             EC_EXTRA_DATA *next = (*p)->next;
614 
615             (*p)->clear_free_func((*p)->data);
616             OPENSSL_free(*p);
617 
618             *p = next;
619             return;
620         }
621     }
622 }
623 
624 /* this has 'package' visibility */
EC_EX_DATA_free_all_data(EC_EXTRA_DATA ** ex_data)625 void EC_EX_DATA_free_all_data(EC_EXTRA_DATA **ex_data)
626 {
627     EC_EXTRA_DATA *d;
628 
629     if (ex_data == NULL)
630         return;
631 
632     d = *ex_data;
633     while (d) {
634         EC_EXTRA_DATA *next = d->next;
635 
636         d->free_func(d->data);
637         OPENSSL_free(d);
638 
639         d = next;
640     }
641     *ex_data = NULL;
642 }
643 
644 /* this has 'package' visibility */
EC_EX_DATA_clear_free_all_data(EC_EXTRA_DATA ** ex_data)645 void EC_EX_DATA_clear_free_all_data(EC_EXTRA_DATA **ex_data)
646 {
647     EC_EXTRA_DATA *d;
648 
649     if (ex_data == NULL)
650         return;
651 
652     d = *ex_data;
653     while (d) {
654         EC_EXTRA_DATA *next = d->next;
655 
656         d->clear_free_func(d->data);
657         OPENSSL_free(d);
658 
659         d = next;
660     }
661     *ex_data = NULL;
662 }
663 
664 /* functions for EC_POINT objects */
665 
EC_POINT_new(const EC_GROUP * group)666 EC_POINT *EC_POINT_new(const EC_GROUP *group)
667 {
668     EC_POINT *ret;
669 
670     if (group == NULL) {
671         ECerr(EC_F_EC_POINT_NEW, ERR_R_PASSED_NULL_PARAMETER);
672         return NULL;
673     }
674     if (group->meth->point_init == 0) {
675         ECerr(EC_F_EC_POINT_NEW, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
676         return NULL;
677     }
678 
679     ret = OPENSSL_malloc(sizeof *ret);
680     if (ret == NULL) {
681         ECerr(EC_F_EC_POINT_NEW, ERR_R_MALLOC_FAILURE);
682         return NULL;
683     }
684 
685     ret->meth = group->meth;
686 
687     if (!ret->meth->point_init(ret)) {
688         OPENSSL_free(ret);
689         return NULL;
690     }
691 
692     return ret;
693 }
694 
EC_POINT_free(EC_POINT * point)695 void EC_POINT_free(EC_POINT *point)
696 {
697     if (!point)
698         return;
699 
700     if (point->meth->point_finish != 0)
701         point->meth->point_finish(point);
702     OPENSSL_free(point);
703 }
704 
EC_POINT_clear_free(EC_POINT * point)705 void EC_POINT_clear_free(EC_POINT *point)
706 {
707     if (!point)
708         return;
709 
710     if (point->meth->point_clear_finish != 0)
711         point->meth->point_clear_finish(point);
712     else if (point->meth->point_finish != 0)
713         point->meth->point_finish(point);
714     OPENSSL_cleanse(point, sizeof *point);
715     OPENSSL_free(point);
716 }
717 
EC_POINT_copy(EC_POINT * dest,const EC_POINT * src)718 int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src)
719 {
720     if (dest->meth->point_copy == 0) {
721         ECerr(EC_F_EC_POINT_COPY, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
722         return 0;
723     }
724     if (dest->meth != src->meth) {
725         ECerr(EC_F_EC_POINT_COPY, EC_R_INCOMPATIBLE_OBJECTS);
726         return 0;
727     }
728     if (dest == src)
729         return 1;
730     return dest->meth->point_copy(dest, src);
731 }
732 
EC_POINT_dup(const EC_POINT * a,const EC_GROUP * group)733 EC_POINT *EC_POINT_dup(const EC_POINT *a, const EC_GROUP *group)
734 {
735     EC_POINT *t;
736     int r;
737 
738     if (a == NULL)
739         return NULL;
740 
741     t = EC_POINT_new(group);
742     if (t == NULL)
743         return (NULL);
744     r = EC_POINT_copy(t, a);
745     if (!r) {
746         EC_POINT_free(t);
747         return NULL;
748     } else
749         return t;
750 }
751 
EC_POINT_method_of(const EC_POINT * point)752 const EC_METHOD *EC_POINT_method_of(const EC_POINT *point)
753 {
754     return point->meth;
755 }
756 
EC_POINT_set_to_infinity(const EC_GROUP * group,EC_POINT * point)757 int EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point)
758 {
759     if (group->meth->point_set_to_infinity == 0) {
760         ECerr(EC_F_EC_POINT_SET_TO_INFINITY,
761               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
762         return 0;
763     }
764     if (group->meth != point->meth) {
765         ECerr(EC_F_EC_POINT_SET_TO_INFINITY, EC_R_INCOMPATIBLE_OBJECTS);
766         return 0;
767     }
768     return group->meth->point_set_to_infinity(group, point);
769 }
770 
EC_POINT_set_Jprojective_coordinates_GFp(const EC_GROUP * group,EC_POINT * point,const BIGNUM * x,const BIGNUM * y,const BIGNUM * z,BN_CTX * ctx)771 int EC_POINT_set_Jprojective_coordinates_GFp(const EC_GROUP *group,
772                                              EC_POINT *point, const BIGNUM *x,
773                                              const BIGNUM *y, const BIGNUM *z,
774                                              BN_CTX *ctx)
775 {
776     if (group->meth->point_set_Jprojective_coordinates_GFp == 0) {
777         ECerr(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP,
778               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
779         return 0;
780     }
781     if (group->meth != point->meth) {
782         ECerr(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP,
783               EC_R_INCOMPATIBLE_OBJECTS);
784         return 0;
785     }
786     return group->meth->point_set_Jprojective_coordinates_GFp(group, point, x,
787                                                               y, z, ctx);
788 }
789 
EC_POINT_get_Jprojective_coordinates_GFp(const EC_GROUP * group,const EC_POINT * point,BIGNUM * x,BIGNUM * y,BIGNUM * z,BN_CTX * ctx)790 int EC_POINT_get_Jprojective_coordinates_GFp(const EC_GROUP *group,
791                                              const EC_POINT *point, BIGNUM *x,
792                                              BIGNUM *y, BIGNUM *z,
793                                              BN_CTX *ctx)
794 {
795     if (group->meth->point_get_Jprojective_coordinates_GFp == 0) {
796         ECerr(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP,
797               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
798         return 0;
799     }
800     if (group->meth != point->meth) {
801         ECerr(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP,
802               EC_R_INCOMPATIBLE_OBJECTS);
803         return 0;
804     }
805     return group->meth->point_get_Jprojective_coordinates_GFp(group, point, x,
806                                                               y, z, ctx);
807 }
808 
EC_POINT_set_affine_coordinates_GFp(const EC_GROUP * group,EC_POINT * point,const BIGNUM * x,const BIGNUM * y,BN_CTX * ctx)809 int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group,
810                                         EC_POINT *point, const BIGNUM *x,
811                                         const BIGNUM *y, BN_CTX *ctx)
812 {
813     if (group->meth->point_set_affine_coordinates == 0) {
814         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP,
815               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
816         return 0;
817     }
818     if (group->meth != point->meth) {
819         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP,
820               EC_R_INCOMPATIBLE_OBJECTS);
821         return 0;
822     }
823     return group->meth->point_set_affine_coordinates(group, point, x, y, ctx);
824 }
825 
826 #ifndef OPENSSL_NO_EC2M
EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP * group,EC_POINT * point,const BIGNUM * x,const BIGNUM * y,BN_CTX * ctx)827 int EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP *group,
828                                          EC_POINT *point, const BIGNUM *x,
829                                          const BIGNUM *y, BN_CTX *ctx)
830 {
831     if (group->meth->point_set_affine_coordinates == 0) {
832         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M,
833               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
834         return 0;
835     }
836     if (group->meth != point->meth) {
837         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M,
838               EC_R_INCOMPATIBLE_OBJECTS);
839         return 0;
840     }
841     return group->meth->point_set_affine_coordinates(group, point, x, y, ctx);
842 }
843 #endif
844 
EC_POINT_get_affine_coordinates_GFp(const EC_GROUP * group,const EC_POINT * point,BIGNUM * x,BIGNUM * y,BN_CTX * ctx)845 int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group,
846                                         const EC_POINT *point, BIGNUM *x,
847                                         BIGNUM *y, BN_CTX *ctx)
848 {
849     if (group->meth->point_get_affine_coordinates == 0) {
850         ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP,
851               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
852         return 0;
853     }
854     if (group->meth != point->meth) {
855         ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP,
856               EC_R_INCOMPATIBLE_OBJECTS);
857         return 0;
858     }
859     return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
860 }
861 
862 #ifndef OPENSSL_NO_EC2M
EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP * group,const EC_POINT * point,BIGNUM * x,BIGNUM * y,BN_CTX * ctx)863 int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *group,
864                                          const EC_POINT *point, BIGNUM *x,
865                                          BIGNUM *y, BN_CTX *ctx)
866 {
867     if (group->meth->point_get_affine_coordinates == 0) {
868         ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M,
869               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
870         return 0;
871     }
872     if (group->meth != point->meth) {
873         ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M,
874               EC_R_INCOMPATIBLE_OBJECTS);
875         return 0;
876     }
877     return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
878 }
879 #endif
880 
EC_POINT_add(const EC_GROUP * group,EC_POINT * r,const EC_POINT * a,const EC_POINT * b,BN_CTX * ctx)881 int EC_POINT_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
882                  const EC_POINT *b, BN_CTX *ctx)
883 {
884     if (group->meth->add == 0) {
885         ECerr(EC_F_EC_POINT_ADD, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
886         return 0;
887     }
888     if ((group->meth != r->meth) || (r->meth != a->meth)
889         || (a->meth != b->meth)) {
890         ECerr(EC_F_EC_POINT_ADD, EC_R_INCOMPATIBLE_OBJECTS);
891         return 0;
892     }
893     return group->meth->add(group, r, a, b, ctx);
894 }
895 
EC_POINT_dbl(const EC_GROUP * group,EC_POINT * r,const EC_POINT * a,BN_CTX * ctx)896 int EC_POINT_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
897                  BN_CTX *ctx)
898 {
899     if (group->meth->dbl == 0) {
900         ECerr(EC_F_EC_POINT_DBL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
901         return 0;
902     }
903     if ((group->meth != r->meth) || (r->meth != a->meth)) {
904         ECerr(EC_F_EC_POINT_DBL, EC_R_INCOMPATIBLE_OBJECTS);
905         return 0;
906     }
907     return group->meth->dbl(group, r, a, ctx);
908 }
909 
EC_POINT_invert(const EC_GROUP * group,EC_POINT * a,BN_CTX * ctx)910 int EC_POINT_invert(const EC_GROUP *group, EC_POINT *a, BN_CTX *ctx)
911 {
912     if (group->meth->invert == 0) {
913         ECerr(EC_F_EC_POINT_INVERT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
914         return 0;
915     }
916     if (group->meth != a->meth) {
917         ECerr(EC_F_EC_POINT_INVERT, EC_R_INCOMPATIBLE_OBJECTS);
918         return 0;
919     }
920     return group->meth->invert(group, a, ctx);
921 }
922 
EC_POINT_is_at_infinity(const EC_GROUP * group,const EC_POINT * point)923 int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
924 {
925     if (group->meth->is_at_infinity == 0) {
926         ECerr(EC_F_EC_POINT_IS_AT_INFINITY,
927               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
928         return 0;
929     }
930     if (group->meth != point->meth) {
931         ECerr(EC_F_EC_POINT_IS_AT_INFINITY, EC_R_INCOMPATIBLE_OBJECTS);
932         return 0;
933     }
934     return group->meth->is_at_infinity(group, point);
935 }
936 
937 /*
938  * Check whether an EC_POINT is on the curve or not. Note that the return
939  * value for this function should NOT be treated as a boolean. Return values:
940  *  1: The point is on the curve
941  *  0: The point is not on the curve
942  * -1: An error occurred
943  */
EC_POINT_is_on_curve(const EC_GROUP * group,const EC_POINT * point,BN_CTX * ctx)944 int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
945                          BN_CTX *ctx)
946 {
947     if (group->meth->is_on_curve == 0) {
948         ECerr(EC_F_EC_POINT_IS_ON_CURVE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
949         return 0;
950     }
951     if (group->meth != point->meth) {
952         ECerr(EC_F_EC_POINT_IS_ON_CURVE, EC_R_INCOMPATIBLE_OBJECTS);
953         return 0;
954     }
955     return group->meth->is_on_curve(group, point, ctx);
956 }
957 
EC_POINT_cmp(const EC_GROUP * group,const EC_POINT * a,const EC_POINT * b,BN_CTX * ctx)958 int EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b,
959                  BN_CTX *ctx)
960 {
961     if (group->meth->point_cmp == 0) {
962         ECerr(EC_F_EC_POINT_CMP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
963         return -1;
964     }
965     if ((group->meth != a->meth) || (a->meth != b->meth)) {
966         ECerr(EC_F_EC_POINT_CMP, EC_R_INCOMPATIBLE_OBJECTS);
967         return -1;
968     }
969     return group->meth->point_cmp(group, a, b, ctx);
970 }
971 
EC_POINT_make_affine(const EC_GROUP * group,EC_POINT * point,BN_CTX * ctx)972 int EC_POINT_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx)
973 {
974     if (group->meth->make_affine == 0) {
975         ECerr(EC_F_EC_POINT_MAKE_AFFINE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
976         return 0;
977     }
978     if (group->meth != point->meth) {
979         ECerr(EC_F_EC_POINT_MAKE_AFFINE, EC_R_INCOMPATIBLE_OBJECTS);
980         return 0;
981     }
982     return group->meth->make_affine(group, point, ctx);
983 }
984 
EC_POINTs_make_affine(const EC_GROUP * group,size_t num,EC_POINT * points[],BN_CTX * ctx)985 int EC_POINTs_make_affine(const EC_GROUP *group, size_t num,
986                           EC_POINT *points[], BN_CTX *ctx)
987 {
988     size_t i;
989 
990     if (group->meth->points_make_affine == 0) {
991         ECerr(EC_F_EC_POINTS_MAKE_AFFINE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
992         return 0;
993     }
994     for (i = 0; i < num; i++) {
995         if (group->meth != points[i]->meth) {
996             ECerr(EC_F_EC_POINTS_MAKE_AFFINE, EC_R_INCOMPATIBLE_OBJECTS);
997             return 0;
998         }
999     }
1000     return group->meth->points_make_affine(group, num, points, ctx);
1001 }
1002 
1003 /*
1004  * Functions for point multiplication. If group->meth->mul is 0, we use the
1005  * wNAF-based implementations in ec_mult.c; otherwise we dispatch through
1006  * methods.
1007  */
1008 
EC_POINTs_mul(const EC_GROUP * group,EC_POINT * r,const BIGNUM * scalar,size_t num,const EC_POINT * points[],const BIGNUM * scalars[],BN_CTX * ctx)1009 int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
1010                   size_t num, const EC_POINT *points[],
1011                   const BIGNUM *scalars[], BN_CTX *ctx)
1012 {
1013     if (group->meth->mul == 0)
1014         /* use default */
1015         return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
1016 
1017     return group->meth->mul(group, r, scalar, num, points, scalars, ctx);
1018 }
1019 
EC_POINT_mul(const EC_GROUP * group,EC_POINT * r,const BIGNUM * g_scalar,const EC_POINT * point,const BIGNUM * p_scalar,BN_CTX * ctx)1020 int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
1021                  const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
1022 {
1023     /* just a convenient interface to EC_POINTs_mul() */
1024 
1025     const EC_POINT *points[1];
1026     const BIGNUM *scalars[1];
1027 
1028     points[0] = point;
1029     scalars[0] = p_scalar;
1030 
1031     return EC_POINTs_mul(group, r, g_scalar,
1032                          (point != NULL
1033                           && p_scalar != NULL), points, scalars, ctx);
1034 }
1035 
EC_GROUP_precompute_mult(EC_GROUP * group,BN_CTX * ctx)1036 int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
1037 {
1038     if (group->meth->mul == 0)
1039         /* use default */
1040         return ec_wNAF_precompute_mult(group, ctx);
1041 
1042     if (group->meth->precompute_mult != 0)
1043         return group->meth->precompute_mult(group, ctx);
1044     else
1045         return 1;               /* nothing to do, so report success */
1046 }
1047 
EC_GROUP_have_precompute_mult(const EC_GROUP * group)1048 int EC_GROUP_have_precompute_mult(const EC_GROUP *group)
1049 {
1050     if (group->meth->mul == 0)
1051         /* use default */
1052         return ec_wNAF_have_precompute_mult(group);
1053 
1054     if (group->meth->have_precompute_mult != 0)
1055         return group->meth->have_precompute_mult(group);
1056     else
1057         return 0;               /* cannot tell whether precomputation has
1058                                  * been performed */
1059 }
1060