1*de0e0e4dSAntonio Huete Jimenez /* $OpenBSD: ecp_oct.c,v 1.14 2021/04/20 17:32:57 tb Exp $ */
2f5b1c8a1SJohn Marino /* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
3f5b1c8a1SJohn Marino * for the OpenSSL project.
4f5b1c8a1SJohn Marino * Includes code written by Bodo Moeller for the OpenSSL project.
5f5b1c8a1SJohn Marino */
6f5b1c8a1SJohn Marino /* ====================================================================
7f5b1c8a1SJohn Marino * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
8f5b1c8a1SJohn Marino *
9f5b1c8a1SJohn Marino * Redistribution and use in source and binary forms, with or without
10f5b1c8a1SJohn Marino * modification, are permitted provided that the following conditions
11f5b1c8a1SJohn Marino * are met:
12f5b1c8a1SJohn Marino *
13f5b1c8a1SJohn Marino * 1. Redistributions of source code must retain the above copyright
14f5b1c8a1SJohn Marino * notice, this list of conditions and the following disclaimer.
15f5b1c8a1SJohn Marino *
16f5b1c8a1SJohn Marino * 2. Redistributions in binary form must reproduce the above copyright
17f5b1c8a1SJohn Marino * notice, this list of conditions and the following disclaimer in
18f5b1c8a1SJohn Marino * the documentation and/or other materials provided with the
19f5b1c8a1SJohn Marino * distribution.
20f5b1c8a1SJohn Marino *
21f5b1c8a1SJohn Marino * 3. All advertising materials mentioning features or use of this
22f5b1c8a1SJohn Marino * software must display the following acknowledgment:
23f5b1c8a1SJohn Marino * "This product includes software developed by the OpenSSL Project
24f5b1c8a1SJohn Marino * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
25f5b1c8a1SJohn Marino *
26f5b1c8a1SJohn Marino * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27f5b1c8a1SJohn Marino * endorse or promote products derived from this software without
28f5b1c8a1SJohn Marino * prior written permission. For written permission, please contact
29f5b1c8a1SJohn Marino * openssl-core@openssl.org.
30f5b1c8a1SJohn Marino *
31f5b1c8a1SJohn Marino * 5. Products derived from this software may not be called "OpenSSL"
32f5b1c8a1SJohn Marino * nor may "OpenSSL" appear in their names without prior written
33f5b1c8a1SJohn Marino * permission of the OpenSSL Project.
34f5b1c8a1SJohn Marino *
35f5b1c8a1SJohn Marino * 6. Redistributions of any form whatsoever must retain the following
36f5b1c8a1SJohn Marino * acknowledgment:
37f5b1c8a1SJohn Marino * "This product includes software developed by the OpenSSL Project
38f5b1c8a1SJohn Marino * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
39f5b1c8a1SJohn Marino *
40f5b1c8a1SJohn Marino * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41f5b1c8a1SJohn Marino * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42f5b1c8a1SJohn Marino * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43f5b1c8a1SJohn Marino * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
44f5b1c8a1SJohn Marino * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45f5b1c8a1SJohn Marino * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46f5b1c8a1SJohn Marino * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47f5b1c8a1SJohn Marino * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48f5b1c8a1SJohn Marino * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49f5b1c8a1SJohn Marino * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50f5b1c8a1SJohn Marino * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51f5b1c8a1SJohn Marino * OF THE POSSIBILITY OF SUCH DAMAGE.
52f5b1c8a1SJohn Marino * ====================================================================
53f5b1c8a1SJohn Marino *
54f5b1c8a1SJohn Marino * This product includes cryptographic software written by Eric Young
55f5b1c8a1SJohn Marino * (eay@cryptsoft.com). This product includes software written by Tim
56f5b1c8a1SJohn Marino * Hudson (tjh@cryptsoft.com).
57f5b1c8a1SJohn Marino *
58f5b1c8a1SJohn Marino */
59f5b1c8a1SJohn Marino /* ====================================================================
60f5b1c8a1SJohn Marino * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
61f5b1c8a1SJohn Marino * Portions of this software developed by SUN MICROSYSTEMS, INC.,
62f5b1c8a1SJohn Marino * and contributed to the OpenSSL project.
63f5b1c8a1SJohn Marino */
64f5b1c8a1SJohn Marino
65f5b1c8a1SJohn Marino #include <openssl/err.h>
66f5b1c8a1SJohn Marino
67f5b1c8a1SJohn Marino #include "ec_lcl.h"
68f5b1c8a1SJohn Marino
69f5b1c8a1SJohn Marino int
ec_GFp_simple_set_compressed_coordinates(const EC_GROUP * group,EC_POINT * point,const BIGNUM * x_,int y_bit,BN_CTX * ctx)70f5b1c8a1SJohn Marino ec_GFp_simple_set_compressed_coordinates(const EC_GROUP * group,
71f5b1c8a1SJohn Marino EC_POINT * point, const BIGNUM * x_, int y_bit, BN_CTX * ctx)
72f5b1c8a1SJohn Marino {
73f5b1c8a1SJohn Marino BN_CTX *new_ctx = NULL;
74f5b1c8a1SJohn Marino BIGNUM *tmp1, *tmp2, *x, *y;
75f5b1c8a1SJohn Marino int ret = 0;
76f5b1c8a1SJohn Marino
77f5b1c8a1SJohn Marino /* clear error queue */
78f5b1c8a1SJohn Marino ERR_clear_error();
79f5b1c8a1SJohn Marino
80f5b1c8a1SJohn Marino if (ctx == NULL) {
81f5b1c8a1SJohn Marino ctx = new_ctx = BN_CTX_new();
82f5b1c8a1SJohn Marino if (ctx == NULL)
83f5b1c8a1SJohn Marino return 0;
84f5b1c8a1SJohn Marino }
85f5b1c8a1SJohn Marino y_bit = (y_bit != 0);
86f5b1c8a1SJohn Marino
87f5b1c8a1SJohn Marino BN_CTX_start(ctx);
88f5b1c8a1SJohn Marino if ((tmp1 = BN_CTX_get(ctx)) == NULL)
89f5b1c8a1SJohn Marino goto err;
90f5b1c8a1SJohn Marino if ((tmp2 = BN_CTX_get(ctx)) == NULL)
91f5b1c8a1SJohn Marino goto err;
92f5b1c8a1SJohn Marino if ((x = BN_CTX_get(ctx)) == NULL)
93f5b1c8a1SJohn Marino goto err;
94f5b1c8a1SJohn Marino if ((y = BN_CTX_get(ctx)) == NULL)
95f5b1c8a1SJohn Marino goto err;
96f5b1c8a1SJohn Marino
97f5b1c8a1SJohn Marino /*
98f5b1c8a1SJohn Marino * Recover y. We have a Weierstrass equation y^2 = x^3 + a*x + b, so
99f5b1c8a1SJohn Marino * y is one of the square roots of x^3 + a*x + b.
100f5b1c8a1SJohn Marino */
101f5b1c8a1SJohn Marino
102f5b1c8a1SJohn Marino /* tmp1 := x^3 */
103f5b1c8a1SJohn Marino if (!BN_nnmod(x, x_, &group->field, ctx))
104f5b1c8a1SJohn Marino goto err;
105f5b1c8a1SJohn Marino if (group->meth->field_decode == 0) {
106f5b1c8a1SJohn Marino /* field_{sqr,mul} work on standard representation */
107f5b1c8a1SJohn Marino if (!group->meth->field_sqr(group, tmp2, x_, ctx))
108f5b1c8a1SJohn Marino goto err;
109f5b1c8a1SJohn Marino if (!group->meth->field_mul(group, tmp1, tmp2, x_, ctx))
110f5b1c8a1SJohn Marino goto err;
111f5b1c8a1SJohn Marino } else {
112f5b1c8a1SJohn Marino if (!BN_mod_sqr(tmp2, x_, &group->field, ctx))
113f5b1c8a1SJohn Marino goto err;
114f5b1c8a1SJohn Marino if (!BN_mod_mul(tmp1, tmp2, x_, &group->field, ctx))
115f5b1c8a1SJohn Marino goto err;
116f5b1c8a1SJohn Marino }
117f5b1c8a1SJohn Marino
118f5b1c8a1SJohn Marino /* tmp1 := tmp1 + a*x */
119f5b1c8a1SJohn Marino if (group->a_is_minus3) {
120f5b1c8a1SJohn Marino if (!BN_mod_lshift1_quick(tmp2, x, &group->field))
121f5b1c8a1SJohn Marino goto err;
122f5b1c8a1SJohn Marino if (!BN_mod_add_quick(tmp2, tmp2, x, &group->field))
123f5b1c8a1SJohn Marino goto err;
124f5b1c8a1SJohn Marino if (!BN_mod_sub_quick(tmp1, tmp1, tmp2, &group->field))
125f5b1c8a1SJohn Marino goto err;
126f5b1c8a1SJohn Marino } else {
127f5b1c8a1SJohn Marino if (group->meth->field_decode) {
128f5b1c8a1SJohn Marino if (!group->meth->field_decode(group, tmp2, &group->a, ctx))
129f5b1c8a1SJohn Marino goto err;
130f5b1c8a1SJohn Marino if (!BN_mod_mul(tmp2, tmp2, x, &group->field, ctx))
131f5b1c8a1SJohn Marino goto err;
132f5b1c8a1SJohn Marino } else {
133f5b1c8a1SJohn Marino /* field_mul works on standard representation */
134f5b1c8a1SJohn Marino if (!group->meth->field_mul(group, tmp2, &group->a, x, ctx))
135f5b1c8a1SJohn Marino goto err;
136f5b1c8a1SJohn Marino }
137f5b1c8a1SJohn Marino
138f5b1c8a1SJohn Marino if (!BN_mod_add_quick(tmp1, tmp1, tmp2, &group->field))
139f5b1c8a1SJohn Marino goto err;
140f5b1c8a1SJohn Marino }
141f5b1c8a1SJohn Marino
142f5b1c8a1SJohn Marino /* tmp1 := tmp1 + b */
143f5b1c8a1SJohn Marino if (group->meth->field_decode) {
144f5b1c8a1SJohn Marino if (!group->meth->field_decode(group, tmp2, &group->b, ctx))
145f5b1c8a1SJohn Marino goto err;
146f5b1c8a1SJohn Marino if (!BN_mod_add_quick(tmp1, tmp1, tmp2, &group->field))
147f5b1c8a1SJohn Marino goto err;
148f5b1c8a1SJohn Marino } else {
149f5b1c8a1SJohn Marino if (!BN_mod_add_quick(tmp1, tmp1, &group->b, &group->field))
150f5b1c8a1SJohn Marino goto err;
151f5b1c8a1SJohn Marino }
152f5b1c8a1SJohn Marino
153f5b1c8a1SJohn Marino if (!BN_mod_sqrt(y, tmp1, &group->field, ctx)) {
154f5b1c8a1SJohn Marino unsigned long err = ERR_peek_last_error();
155f5b1c8a1SJohn Marino
156f5b1c8a1SJohn Marino if (ERR_GET_LIB(err) == ERR_LIB_BN && ERR_GET_REASON(err) == BN_R_NOT_A_SQUARE) {
157f5b1c8a1SJohn Marino ERR_clear_error();
15872c33676SMaxim Ag ECerror(EC_R_INVALID_COMPRESSED_POINT);
159f5b1c8a1SJohn Marino } else
16072c33676SMaxim Ag ECerror(ERR_R_BN_LIB);
161f5b1c8a1SJohn Marino goto err;
162f5b1c8a1SJohn Marino }
163f5b1c8a1SJohn Marino if (y_bit != BN_is_odd(y)) {
164f5b1c8a1SJohn Marino if (BN_is_zero(y)) {
165f5b1c8a1SJohn Marino int kron;
166f5b1c8a1SJohn Marino
167f5b1c8a1SJohn Marino kron = BN_kronecker(x, &group->field, ctx);
168f5b1c8a1SJohn Marino if (kron == -2)
169f5b1c8a1SJohn Marino goto err;
170f5b1c8a1SJohn Marino
171f5b1c8a1SJohn Marino if (kron == 1)
17272c33676SMaxim Ag ECerror(EC_R_INVALID_COMPRESSION_BIT);
173f5b1c8a1SJohn Marino else
174f5b1c8a1SJohn Marino /*
175f5b1c8a1SJohn Marino * BN_mod_sqrt() should have cought this
176f5b1c8a1SJohn Marino * error (not a square)
177f5b1c8a1SJohn Marino */
17872c33676SMaxim Ag ECerror(EC_R_INVALID_COMPRESSED_POINT);
179f5b1c8a1SJohn Marino goto err;
180f5b1c8a1SJohn Marino }
181f5b1c8a1SJohn Marino if (!BN_usub(y, &group->field, y))
182f5b1c8a1SJohn Marino goto err;
183f5b1c8a1SJohn Marino }
184f5b1c8a1SJohn Marino if (y_bit != BN_is_odd(y)) {
18572c33676SMaxim Ag ECerror(ERR_R_INTERNAL_ERROR);
186f5b1c8a1SJohn Marino goto err;
187f5b1c8a1SJohn Marino }
188*de0e0e4dSAntonio Huete Jimenez if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
189f5b1c8a1SJohn Marino goto err;
190f5b1c8a1SJohn Marino
191f5b1c8a1SJohn Marino ret = 1;
192f5b1c8a1SJohn Marino
193f5b1c8a1SJohn Marino err:
194f5b1c8a1SJohn Marino BN_CTX_end(ctx);
195f5b1c8a1SJohn Marino BN_CTX_free(new_ctx);
196f5b1c8a1SJohn Marino return ret;
197f5b1c8a1SJohn Marino }
198f5b1c8a1SJohn Marino
199f5b1c8a1SJohn Marino
200f5b1c8a1SJohn Marino size_t
ec_GFp_simple_point2oct(const EC_GROUP * group,const EC_POINT * point,point_conversion_form_t form,unsigned char * buf,size_t len,BN_CTX * ctx)201f5b1c8a1SJohn Marino ec_GFp_simple_point2oct(const EC_GROUP * group, const EC_POINT * point, point_conversion_form_t form,
202f5b1c8a1SJohn Marino unsigned char *buf, size_t len, BN_CTX * ctx)
203f5b1c8a1SJohn Marino {
204f5b1c8a1SJohn Marino size_t ret;
205f5b1c8a1SJohn Marino BN_CTX *new_ctx = NULL;
206f5b1c8a1SJohn Marino int used_ctx = 0;
207f5b1c8a1SJohn Marino BIGNUM *x, *y;
208f5b1c8a1SJohn Marino size_t field_len, i, skip;
209f5b1c8a1SJohn Marino
210f5b1c8a1SJohn Marino if ((form != POINT_CONVERSION_COMPRESSED)
211f5b1c8a1SJohn Marino && (form != POINT_CONVERSION_UNCOMPRESSED)
212f5b1c8a1SJohn Marino && (form != POINT_CONVERSION_HYBRID)) {
21372c33676SMaxim Ag ECerror(EC_R_INVALID_FORM);
214f5b1c8a1SJohn Marino goto err;
215f5b1c8a1SJohn Marino }
216f5b1c8a1SJohn Marino if (EC_POINT_is_at_infinity(group, point) > 0) {
217f5b1c8a1SJohn Marino /* encodes to a single 0 octet */
218f5b1c8a1SJohn Marino if (buf != NULL) {
219f5b1c8a1SJohn Marino if (len < 1) {
22072c33676SMaxim Ag ECerror(EC_R_BUFFER_TOO_SMALL);
221f5b1c8a1SJohn Marino return 0;
222f5b1c8a1SJohn Marino }
223f5b1c8a1SJohn Marino buf[0] = 0;
224f5b1c8a1SJohn Marino }
225f5b1c8a1SJohn Marino return 1;
226f5b1c8a1SJohn Marino }
227f5b1c8a1SJohn Marino /* ret := required output buffer length */
228f5b1c8a1SJohn Marino field_len = BN_num_bytes(&group->field);
229f5b1c8a1SJohn Marino ret = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;
230f5b1c8a1SJohn Marino
231f5b1c8a1SJohn Marino /* if 'buf' is NULL, just return required length */
232f5b1c8a1SJohn Marino if (buf != NULL) {
233f5b1c8a1SJohn Marino if (len < ret) {
23472c33676SMaxim Ag ECerror(EC_R_BUFFER_TOO_SMALL);
235f5b1c8a1SJohn Marino goto err;
236f5b1c8a1SJohn Marino }
237f5b1c8a1SJohn Marino if (ctx == NULL) {
238f5b1c8a1SJohn Marino ctx = new_ctx = BN_CTX_new();
239f5b1c8a1SJohn Marino if (ctx == NULL)
240f5b1c8a1SJohn Marino return 0;
241f5b1c8a1SJohn Marino }
242f5b1c8a1SJohn Marino BN_CTX_start(ctx);
243f5b1c8a1SJohn Marino used_ctx = 1;
244f5b1c8a1SJohn Marino if ((x = BN_CTX_get(ctx)) == NULL)
245f5b1c8a1SJohn Marino goto err;
246f5b1c8a1SJohn Marino if ((y = BN_CTX_get(ctx)) == NULL)
247f5b1c8a1SJohn Marino goto err;
248f5b1c8a1SJohn Marino
249*de0e0e4dSAntonio Huete Jimenez if (!EC_POINT_get_affine_coordinates(group, point, x, y, ctx))
250f5b1c8a1SJohn Marino goto err;
251f5b1c8a1SJohn Marino
252f5b1c8a1SJohn Marino if ((form == POINT_CONVERSION_COMPRESSED || form == POINT_CONVERSION_HYBRID) && BN_is_odd(y))
253f5b1c8a1SJohn Marino buf[0] = form + 1;
254f5b1c8a1SJohn Marino else
255f5b1c8a1SJohn Marino buf[0] = form;
256f5b1c8a1SJohn Marino
257f5b1c8a1SJohn Marino i = 1;
258f5b1c8a1SJohn Marino
259f5b1c8a1SJohn Marino skip = field_len - BN_num_bytes(x);
260f5b1c8a1SJohn Marino if (skip > field_len) {
26172c33676SMaxim Ag ECerror(ERR_R_INTERNAL_ERROR);
262f5b1c8a1SJohn Marino goto err;
263f5b1c8a1SJohn Marino }
264f5b1c8a1SJohn Marino while (skip > 0) {
265f5b1c8a1SJohn Marino buf[i++] = 0;
266f5b1c8a1SJohn Marino skip--;
267f5b1c8a1SJohn Marino }
268f5b1c8a1SJohn Marino skip = BN_bn2bin(x, buf + i);
269f5b1c8a1SJohn Marino i += skip;
270f5b1c8a1SJohn Marino if (i != 1 + field_len) {
27172c33676SMaxim Ag ECerror(ERR_R_INTERNAL_ERROR);
272f5b1c8a1SJohn Marino goto err;
273f5b1c8a1SJohn Marino }
274f5b1c8a1SJohn Marino if (form == POINT_CONVERSION_UNCOMPRESSED || form == POINT_CONVERSION_HYBRID) {
275f5b1c8a1SJohn Marino skip = field_len - BN_num_bytes(y);
276f5b1c8a1SJohn Marino if (skip > field_len) {
27772c33676SMaxim Ag ECerror(ERR_R_INTERNAL_ERROR);
278f5b1c8a1SJohn Marino goto err;
279f5b1c8a1SJohn Marino }
280f5b1c8a1SJohn Marino while (skip > 0) {
281f5b1c8a1SJohn Marino buf[i++] = 0;
282f5b1c8a1SJohn Marino skip--;
283f5b1c8a1SJohn Marino }
284f5b1c8a1SJohn Marino skip = BN_bn2bin(y, buf + i);
285f5b1c8a1SJohn Marino i += skip;
286f5b1c8a1SJohn Marino }
287f5b1c8a1SJohn Marino if (i != ret) {
28872c33676SMaxim Ag ECerror(ERR_R_INTERNAL_ERROR);
289f5b1c8a1SJohn Marino goto err;
290f5b1c8a1SJohn Marino }
291f5b1c8a1SJohn Marino }
292f5b1c8a1SJohn Marino if (used_ctx)
293f5b1c8a1SJohn Marino BN_CTX_end(ctx);
294f5b1c8a1SJohn Marino BN_CTX_free(new_ctx);
295f5b1c8a1SJohn Marino return ret;
296f5b1c8a1SJohn Marino
297f5b1c8a1SJohn Marino err:
298f5b1c8a1SJohn Marino if (used_ctx)
299f5b1c8a1SJohn Marino BN_CTX_end(ctx);
300f5b1c8a1SJohn Marino BN_CTX_free(new_ctx);
301f5b1c8a1SJohn Marino return 0;
302f5b1c8a1SJohn Marino }
303f5b1c8a1SJohn Marino
304f5b1c8a1SJohn Marino
305f5b1c8a1SJohn Marino int
ec_GFp_simple_oct2point(const EC_GROUP * group,EC_POINT * point,const unsigned char * buf,size_t len,BN_CTX * ctx)306f5b1c8a1SJohn Marino ec_GFp_simple_oct2point(const EC_GROUP * group, EC_POINT * point,
307f5b1c8a1SJohn Marino const unsigned char *buf, size_t len, BN_CTX * ctx)
308f5b1c8a1SJohn Marino {
309f5b1c8a1SJohn Marino point_conversion_form_t form;
310f5b1c8a1SJohn Marino int y_bit;
311f5b1c8a1SJohn Marino BN_CTX *new_ctx = NULL;
312f5b1c8a1SJohn Marino BIGNUM *x, *y;
313f5b1c8a1SJohn Marino size_t field_len, enc_len;
314f5b1c8a1SJohn Marino int ret = 0;
315f5b1c8a1SJohn Marino
316f5b1c8a1SJohn Marino if (len == 0) {
31772c33676SMaxim Ag ECerror(EC_R_BUFFER_TOO_SMALL);
318f5b1c8a1SJohn Marino return 0;
319f5b1c8a1SJohn Marino }
320f5b1c8a1SJohn Marino form = buf[0];
321f5b1c8a1SJohn Marino y_bit = form & 1;
322f5b1c8a1SJohn Marino form = form & ~1U;
323f5b1c8a1SJohn Marino if ((form != 0) && (form != POINT_CONVERSION_COMPRESSED)
324f5b1c8a1SJohn Marino && (form != POINT_CONVERSION_UNCOMPRESSED)
325f5b1c8a1SJohn Marino && (form != POINT_CONVERSION_HYBRID)) {
32672c33676SMaxim Ag ECerror(EC_R_INVALID_ENCODING);
327f5b1c8a1SJohn Marino return 0;
328f5b1c8a1SJohn Marino }
329f5b1c8a1SJohn Marino if ((form == 0 || form == POINT_CONVERSION_UNCOMPRESSED) && y_bit) {
33072c33676SMaxim Ag ECerror(EC_R_INVALID_ENCODING);
331f5b1c8a1SJohn Marino return 0;
332f5b1c8a1SJohn Marino }
333f5b1c8a1SJohn Marino if (form == 0) {
334f5b1c8a1SJohn Marino if (len != 1) {
33572c33676SMaxim Ag ECerror(EC_R_INVALID_ENCODING);
336f5b1c8a1SJohn Marino return 0;
337f5b1c8a1SJohn Marino }
338f5b1c8a1SJohn Marino return EC_POINT_set_to_infinity(group, point);
339f5b1c8a1SJohn Marino }
340f5b1c8a1SJohn Marino field_len = BN_num_bytes(&group->field);
341f5b1c8a1SJohn Marino enc_len = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;
342f5b1c8a1SJohn Marino
343f5b1c8a1SJohn Marino if (len != enc_len) {
34472c33676SMaxim Ag ECerror(EC_R_INVALID_ENCODING);
345f5b1c8a1SJohn Marino return 0;
346f5b1c8a1SJohn Marino }
347f5b1c8a1SJohn Marino if (ctx == NULL) {
348f5b1c8a1SJohn Marino ctx = new_ctx = BN_CTX_new();
349f5b1c8a1SJohn Marino if (ctx == NULL)
350f5b1c8a1SJohn Marino return 0;
351f5b1c8a1SJohn Marino }
352f5b1c8a1SJohn Marino BN_CTX_start(ctx);
353f5b1c8a1SJohn Marino if ((x = BN_CTX_get(ctx)) == NULL)
354f5b1c8a1SJohn Marino goto err;
355f5b1c8a1SJohn Marino if ((y = BN_CTX_get(ctx)) == NULL)
356f5b1c8a1SJohn Marino goto err;
357f5b1c8a1SJohn Marino
358f5b1c8a1SJohn Marino if (!BN_bin2bn(buf + 1, field_len, x))
359f5b1c8a1SJohn Marino goto err;
360f5b1c8a1SJohn Marino if (BN_ucmp(x, &group->field) >= 0) {
36172c33676SMaxim Ag ECerror(EC_R_INVALID_ENCODING);
362f5b1c8a1SJohn Marino goto err;
363f5b1c8a1SJohn Marino }
364f5b1c8a1SJohn Marino if (form == POINT_CONVERSION_COMPRESSED) {
365*de0e0e4dSAntonio Huete Jimenez /*
366*de0e0e4dSAntonio Huete Jimenez * EC_POINT_set_compressed_coordinates checks that the point
367*de0e0e4dSAntonio Huete Jimenez * is on the curve as required by X9.62.
368*de0e0e4dSAntonio Huete Jimenez */
369*de0e0e4dSAntonio Huete Jimenez if (!EC_POINT_set_compressed_coordinates(group, point, x, y_bit, ctx))
370f5b1c8a1SJohn Marino goto err;
371f5b1c8a1SJohn Marino } else {
372f5b1c8a1SJohn Marino if (!BN_bin2bn(buf + 1 + field_len, field_len, y))
373f5b1c8a1SJohn Marino goto err;
374f5b1c8a1SJohn Marino if (BN_ucmp(y, &group->field) >= 0) {
37572c33676SMaxim Ag ECerror(EC_R_INVALID_ENCODING);
376f5b1c8a1SJohn Marino goto err;
377f5b1c8a1SJohn Marino }
378f5b1c8a1SJohn Marino if (form == POINT_CONVERSION_HYBRID) {
379f5b1c8a1SJohn Marino if (y_bit != BN_is_odd(y)) {
38072c33676SMaxim Ag ECerror(EC_R_INVALID_ENCODING);
381f5b1c8a1SJohn Marino goto err;
382f5b1c8a1SJohn Marino }
383f5b1c8a1SJohn Marino }
384*de0e0e4dSAntonio Huete Jimenez /*
385*de0e0e4dSAntonio Huete Jimenez * EC_POINT_set_affine_coordinates checks that the point is
386*de0e0e4dSAntonio Huete Jimenez * on the curve as required by X9.62.
387*de0e0e4dSAntonio Huete Jimenez */
388*de0e0e4dSAntonio Huete Jimenez if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
389f5b1c8a1SJohn Marino goto err;
390f5b1c8a1SJohn Marino }
391f5b1c8a1SJohn Marino
392f5b1c8a1SJohn Marino ret = 1;
393f5b1c8a1SJohn Marino
394f5b1c8a1SJohn Marino err:
395f5b1c8a1SJohn Marino BN_CTX_end(ctx);
396f5b1c8a1SJohn Marino BN_CTX_free(new_ctx);
397f5b1c8a1SJohn Marino return ret;
398f5b1c8a1SJohn Marino }
399