1*de0e0e4dSAntonio Huete Jimenez /* $OpenBSD: ecp_nist.c,v 1.19 2022/06/30 11:14:47 tb Exp $ */
2f5b1c8a1SJohn Marino /*
3f5b1c8a1SJohn Marino * Written by Nils Larsch for the OpenSSL project.
4f5b1c8a1SJohn Marino */
5f5b1c8a1SJohn Marino /* ====================================================================
6f5b1c8a1SJohn Marino * Copyright (c) 1998-2003 The OpenSSL Project. All rights reserved.
7f5b1c8a1SJohn Marino *
8f5b1c8a1SJohn Marino * Redistribution and use in source and binary forms, with or without
9f5b1c8a1SJohn Marino * modification, are permitted provided that the following conditions
10f5b1c8a1SJohn Marino * are met:
11f5b1c8a1SJohn Marino *
12f5b1c8a1SJohn Marino * 1. Redistributions of source code must retain the above copyright
13f5b1c8a1SJohn Marino * notice, this list of conditions and the following disclaimer.
14f5b1c8a1SJohn Marino *
15f5b1c8a1SJohn Marino * 2. Redistributions in binary form must reproduce the above copyright
16f5b1c8a1SJohn Marino * notice, this list of conditions and the following disclaimer in
17f5b1c8a1SJohn Marino * the documentation and/or other materials provided with the
18f5b1c8a1SJohn Marino * distribution.
19f5b1c8a1SJohn Marino *
20f5b1c8a1SJohn Marino * 3. All advertising materials mentioning features or use of this
21f5b1c8a1SJohn Marino * software must display the following acknowledgment:
22f5b1c8a1SJohn Marino * "This product includes software developed by the OpenSSL Project
23f5b1c8a1SJohn Marino * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
24f5b1c8a1SJohn Marino *
25f5b1c8a1SJohn Marino * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26f5b1c8a1SJohn Marino * endorse or promote products derived from this software without
27f5b1c8a1SJohn Marino * prior written permission. For written permission, please contact
28f5b1c8a1SJohn Marino * openssl-core@openssl.org.
29f5b1c8a1SJohn Marino *
30f5b1c8a1SJohn Marino * 5. Products derived from this software may not be called "OpenSSL"
31f5b1c8a1SJohn Marino * nor may "OpenSSL" appear in their names without prior written
32f5b1c8a1SJohn Marino * permission of the OpenSSL Project.
33f5b1c8a1SJohn Marino *
34f5b1c8a1SJohn Marino * 6. Redistributions of any form whatsoever must retain the following
35f5b1c8a1SJohn Marino * acknowledgment:
36f5b1c8a1SJohn Marino * "This product includes software developed by the OpenSSL Project
37f5b1c8a1SJohn Marino * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
38f5b1c8a1SJohn Marino *
39f5b1c8a1SJohn Marino * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40f5b1c8a1SJohn Marino * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41f5b1c8a1SJohn Marino * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42f5b1c8a1SJohn Marino * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
43f5b1c8a1SJohn Marino * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44f5b1c8a1SJohn Marino * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45f5b1c8a1SJohn Marino * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46f5b1c8a1SJohn Marino * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47f5b1c8a1SJohn Marino * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48f5b1c8a1SJohn Marino * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49f5b1c8a1SJohn Marino * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50f5b1c8a1SJohn Marino * OF THE POSSIBILITY OF SUCH DAMAGE.
51f5b1c8a1SJohn Marino * ====================================================================
52f5b1c8a1SJohn Marino *
53f5b1c8a1SJohn Marino * This product includes cryptographic software written by Eric Young
54f5b1c8a1SJohn Marino * (eay@cryptsoft.com). This product includes software written by Tim
55f5b1c8a1SJohn Marino * Hudson (tjh@cryptsoft.com).
56f5b1c8a1SJohn Marino *
57f5b1c8a1SJohn Marino */
58f5b1c8a1SJohn Marino /* ====================================================================
59f5b1c8a1SJohn Marino * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
60f5b1c8a1SJohn Marino * Portions of this software developed by SUN MICROSYSTEMS, INC.,
61f5b1c8a1SJohn Marino * and contributed to the OpenSSL project.
62f5b1c8a1SJohn Marino */
63f5b1c8a1SJohn Marino
64f5b1c8a1SJohn Marino #include <limits.h>
65f5b1c8a1SJohn Marino
66f5b1c8a1SJohn Marino #include <openssl/err.h>
67*de0e0e4dSAntonio Huete Jimenez #include <openssl/objects.h>
68*de0e0e4dSAntonio Huete Jimenez
69f5b1c8a1SJohn Marino #include "ec_lcl.h"
70f5b1c8a1SJohn Marino
71f5b1c8a1SJohn Marino const EC_METHOD *
EC_GFp_nist_method(void)72f5b1c8a1SJohn Marino EC_GFp_nist_method(void)
73f5b1c8a1SJohn Marino {
74f5b1c8a1SJohn Marino static const EC_METHOD ret = {
75f5b1c8a1SJohn Marino .flags = EC_FLAGS_DEFAULT_OCT,
76f5b1c8a1SJohn Marino .field_type = NID_X9_62_prime_field,
77f5b1c8a1SJohn Marino .group_init = ec_GFp_simple_group_init,
78f5b1c8a1SJohn Marino .group_finish = ec_GFp_simple_group_finish,
79f5b1c8a1SJohn Marino .group_clear_finish = ec_GFp_simple_group_clear_finish,
80f5b1c8a1SJohn Marino .group_copy = ec_GFp_nist_group_copy,
81f5b1c8a1SJohn Marino .group_set_curve = ec_GFp_nist_group_set_curve,
82f5b1c8a1SJohn Marino .group_get_curve = ec_GFp_simple_group_get_curve,
83f5b1c8a1SJohn Marino .group_get_degree = ec_GFp_simple_group_get_degree,
84*de0e0e4dSAntonio Huete Jimenez .group_order_bits = ec_group_simple_order_bits,
85f5b1c8a1SJohn Marino .group_check_discriminant =
86f5b1c8a1SJohn Marino ec_GFp_simple_group_check_discriminant,
87f5b1c8a1SJohn Marino .point_init = ec_GFp_simple_point_init,
88f5b1c8a1SJohn Marino .point_finish = ec_GFp_simple_point_finish,
89f5b1c8a1SJohn Marino .point_clear_finish = ec_GFp_simple_point_clear_finish,
90f5b1c8a1SJohn Marino .point_copy = ec_GFp_simple_point_copy,
91f5b1c8a1SJohn Marino .point_set_to_infinity = ec_GFp_simple_point_set_to_infinity,
92*de0e0e4dSAntonio Huete Jimenez .point_set_Jprojective_coordinates =
93*de0e0e4dSAntonio Huete Jimenez ec_GFp_simple_set_Jprojective_coordinates,
94*de0e0e4dSAntonio Huete Jimenez .point_get_Jprojective_coordinates =
95*de0e0e4dSAntonio Huete Jimenez ec_GFp_simple_get_Jprojective_coordinates,
96f5b1c8a1SJohn Marino .point_set_affine_coordinates =
97f5b1c8a1SJohn Marino ec_GFp_simple_point_set_affine_coordinates,
98f5b1c8a1SJohn Marino .point_get_affine_coordinates =
99f5b1c8a1SJohn Marino ec_GFp_simple_point_get_affine_coordinates,
100f5b1c8a1SJohn Marino .add = ec_GFp_simple_add,
101f5b1c8a1SJohn Marino .dbl = ec_GFp_simple_dbl,
102f5b1c8a1SJohn Marino .invert = ec_GFp_simple_invert,
103f5b1c8a1SJohn Marino .is_at_infinity = ec_GFp_simple_is_at_infinity,
104f5b1c8a1SJohn Marino .is_on_curve = ec_GFp_simple_is_on_curve,
105f5b1c8a1SJohn Marino .point_cmp = ec_GFp_simple_cmp,
106f5b1c8a1SJohn Marino .make_affine = ec_GFp_simple_make_affine,
107f5b1c8a1SJohn Marino .points_make_affine = ec_GFp_simple_points_make_affine,
10872c33676SMaxim Ag .mul_generator_ct = ec_GFp_simple_mul_generator_ct,
10972c33676SMaxim Ag .mul_single_ct = ec_GFp_simple_mul_single_ct,
11072c33676SMaxim Ag .mul_double_nonct = ec_GFp_simple_mul_double_nonct,
111f5b1c8a1SJohn Marino .field_mul = ec_GFp_nist_field_mul,
11272c33676SMaxim Ag .field_sqr = ec_GFp_nist_field_sqr,
11372c33676SMaxim Ag .blind_coordinates = ec_GFp_simple_blind_coordinates,
114f5b1c8a1SJohn Marino };
115f5b1c8a1SJohn Marino
116f5b1c8a1SJohn Marino return &ret;
117f5b1c8a1SJohn Marino }
118f5b1c8a1SJohn Marino
119f5b1c8a1SJohn Marino int
ec_GFp_nist_group_copy(EC_GROUP * dest,const EC_GROUP * src)120f5b1c8a1SJohn Marino ec_GFp_nist_group_copy(EC_GROUP * dest, const EC_GROUP * src)
121f5b1c8a1SJohn Marino {
122f5b1c8a1SJohn Marino dest->field_mod_func = src->field_mod_func;
123f5b1c8a1SJohn Marino
124f5b1c8a1SJohn Marino return ec_GFp_simple_group_copy(dest, src);
125f5b1c8a1SJohn Marino }
126f5b1c8a1SJohn Marino
127f5b1c8a1SJohn Marino int
ec_GFp_nist_group_set_curve(EC_GROUP * group,const BIGNUM * p,const BIGNUM * a,const BIGNUM * b,BN_CTX * ctx)128f5b1c8a1SJohn Marino ec_GFp_nist_group_set_curve(EC_GROUP *group, const BIGNUM *p,
129f5b1c8a1SJohn Marino const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
130f5b1c8a1SJohn Marino {
131f5b1c8a1SJohn Marino int ret = 0;
132f5b1c8a1SJohn Marino BN_CTX *new_ctx = NULL;
133f5b1c8a1SJohn Marino BIGNUM *tmp_bn;
134f5b1c8a1SJohn Marino
135f5b1c8a1SJohn Marino if (ctx == NULL)
136f5b1c8a1SJohn Marino if ((ctx = new_ctx = BN_CTX_new()) == NULL)
137f5b1c8a1SJohn Marino return 0;
138f5b1c8a1SJohn Marino
139f5b1c8a1SJohn Marino BN_CTX_start(ctx);
140f5b1c8a1SJohn Marino if ((tmp_bn = BN_CTX_get(ctx)) == NULL)
141f5b1c8a1SJohn Marino goto err;
142f5b1c8a1SJohn Marino
143f5b1c8a1SJohn Marino if (BN_ucmp(BN_get0_nist_prime_192(), p) == 0)
144f5b1c8a1SJohn Marino group->field_mod_func = BN_nist_mod_192;
145f5b1c8a1SJohn Marino else if (BN_ucmp(BN_get0_nist_prime_224(), p) == 0)
146f5b1c8a1SJohn Marino group->field_mod_func = BN_nist_mod_224;
147f5b1c8a1SJohn Marino else if (BN_ucmp(BN_get0_nist_prime_256(), p) == 0)
148f5b1c8a1SJohn Marino group->field_mod_func = BN_nist_mod_256;
149f5b1c8a1SJohn Marino else if (BN_ucmp(BN_get0_nist_prime_384(), p) == 0)
150f5b1c8a1SJohn Marino group->field_mod_func = BN_nist_mod_384;
151f5b1c8a1SJohn Marino else if (BN_ucmp(BN_get0_nist_prime_521(), p) == 0)
152f5b1c8a1SJohn Marino group->field_mod_func = BN_nist_mod_521;
153f5b1c8a1SJohn Marino else {
15472c33676SMaxim Ag ECerror(EC_R_NOT_A_NIST_PRIME);
155f5b1c8a1SJohn Marino goto err;
156f5b1c8a1SJohn Marino }
157f5b1c8a1SJohn Marino
158f5b1c8a1SJohn Marino ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
159f5b1c8a1SJohn Marino
160f5b1c8a1SJohn Marino err:
161f5b1c8a1SJohn Marino BN_CTX_end(ctx);
162f5b1c8a1SJohn Marino BN_CTX_free(new_ctx);
163f5b1c8a1SJohn Marino return ret;
164f5b1c8a1SJohn Marino }
165f5b1c8a1SJohn Marino
166f5b1c8a1SJohn Marino
167f5b1c8a1SJohn Marino int
ec_GFp_nist_field_mul(const EC_GROUP * group,BIGNUM * r,const BIGNUM * a,const BIGNUM * b,BN_CTX * ctx)168f5b1c8a1SJohn Marino ec_GFp_nist_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
169f5b1c8a1SJohn Marino const BIGNUM *b, BN_CTX *ctx)
170f5b1c8a1SJohn Marino {
171f5b1c8a1SJohn Marino int ret = 0;
172f5b1c8a1SJohn Marino BN_CTX *ctx_new = NULL;
173f5b1c8a1SJohn Marino
174f5b1c8a1SJohn Marino if (!group || !r || !a || !b) {
17572c33676SMaxim Ag ECerror(ERR_R_PASSED_NULL_PARAMETER);
176f5b1c8a1SJohn Marino goto err;
177f5b1c8a1SJohn Marino }
178f5b1c8a1SJohn Marino if (!ctx)
179f5b1c8a1SJohn Marino if ((ctx_new = ctx = BN_CTX_new()) == NULL)
180f5b1c8a1SJohn Marino goto err;
181f5b1c8a1SJohn Marino
182f5b1c8a1SJohn Marino if (!BN_mul(r, a, b, ctx))
183f5b1c8a1SJohn Marino goto err;
184f5b1c8a1SJohn Marino if (!group->field_mod_func(r, r, &group->field, ctx))
185f5b1c8a1SJohn Marino goto err;
186f5b1c8a1SJohn Marino
187f5b1c8a1SJohn Marino ret = 1;
188f5b1c8a1SJohn Marino err:
189f5b1c8a1SJohn Marino BN_CTX_free(ctx_new);
190f5b1c8a1SJohn Marino return ret;
191f5b1c8a1SJohn Marino }
192f5b1c8a1SJohn Marino
193f5b1c8a1SJohn Marino
194f5b1c8a1SJohn Marino int
ec_GFp_nist_field_sqr(const EC_GROUP * group,BIGNUM * r,const BIGNUM * a,BN_CTX * ctx)195f5b1c8a1SJohn Marino ec_GFp_nist_field_sqr(const EC_GROUP * group, BIGNUM * r, const BIGNUM * a,
196f5b1c8a1SJohn Marino BN_CTX * ctx)
197f5b1c8a1SJohn Marino {
198f5b1c8a1SJohn Marino int ret = 0;
199f5b1c8a1SJohn Marino BN_CTX *ctx_new = NULL;
200f5b1c8a1SJohn Marino
201f5b1c8a1SJohn Marino if (!group || !r || !a) {
20272c33676SMaxim Ag ECerror(EC_R_PASSED_NULL_PARAMETER);
203f5b1c8a1SJohn Marino goto err;
204f5b1c8a1SJohn Marino }
205f5b1c8a1SJohn Marino if (!ctx)
206f5b1c8a1SJohn Marino if ((ctx_new = ctx = BN_CTX_new()) == NULL)
207f5b1c8a1SJohn Marino goto err;
208f5b1c8a1SJohn Marino
209f5b1c8a1SJohn Marino if (!BN_sqr(r, a, ctx))
210f5b1c8a1SJohn Marino goto err;
211f5b1c8a1SJohn Marino if (!group->field_mod_func(r, r, &group->field, ctx))
212f5b1c8a1SJohn Marino goto err;
213f5b1c8a1SJohn Marino
214f5b1c8a1SJohn Marino ret = 1;
215f5b1c8a1SJohn Marino err:
216f5b1c8a1SJohn Marino BN_CTX_free(ctx_new);
217f5b1c8a1SJohn Marino return ret;
218f5b1c8a1SJohn Marino }
219