xref: /openbsd/lib/libcrypto/ec/ec_curve.c (revision 01938560)

/* $OpenBSD: ec_curve.c,v 1.36 2023/05/01 17:29:36 tb Exp $ */
/*
 * Written by Nils Larsch for the OpenSSL project.
 */
/* ====================================================================
 * Copyright (c) 1998-2010 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    openssl-core@openssl.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */
/* ====================================================================
 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 *
 * Portions of the attached software ("Contribution") are developed by
 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
 *
 * The Contribution is licensed pursuant to the OpenSSL open source
 * license provided above.
 *
 * The elliptic curve binary polynomial software is originally written by
 * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
 *
 */

#include <string.h>

#include <openssl/opensslconf.h>

#include <openssl/err.h>
#include <openssl/objects.h>

#include "ec_local.h"

/* the nist prime curves */
static const struct {
	uint8_t seed[20];
	uint8_t p[24];
	uint8_t a[24];
	uint8_t b[24];
	uint8_t x[24];
	uint8_t y[24];
	uint8_t order[24];
} _EC_NIST_PRIME_192 = {
	.seed = {
		0x30, 0x45, 0xAE, 0x6F, 0xC8, 0x42, 0x2F, 0x64, 0xED, 0x57,
		0x95, 0x28, 0xD3, 0x81, 0x20, 0xEA, 0xE1, 0x21, 0x96, 0xD5,
	},
	.p = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF,
	},
	.a = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFC,
	},
	.b = {
		0x64, 0x21, 0x05, 0x19, 0xE5, 0x9C, 0x80, 0xE7, 0x0F, 0xA7,
		0xE9, 0xAB, 0x72, 0x24, 0x30, 0x49, 0xFE, 0xB8, 0xDE, 0xEC,
		0xC1, 0x46, 0xB9, 0xB1,
	},
	.x = {
		0x18, 0x8D, 0xA8, 0x0E, 0xB0, 0x30, 0x90, 0xF6, 0x7C, 0xBF,
		0x20, 0xEB, 0x43, 0xA1, 0x88, 0x00, 0xF4, 0xFF, 0x0A, 0xFD,
		0x82, 0xFF, 0x10, 0x12,
	},
	.y = {
		0x07, 0x19, 0x2b, 0x95, 0xff, 0xc8, 0xda, 0x78, 0x63, 0x10,
		0x11, 0xed, 0x6b, 0x24, 0xcd, 0xd5, 0x73, 0xf9, 0x77, 0xa1,
		0x1e, 0x79, 0x48, 0x11,
	},
	.order = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0x99, 0xDE, 0xF8, 0x36, 0x14, 0x6B, 0xC9, 0xB1,
		0xB4, 0xD2, 0x28, 0x31,
	},
};

static const struct {
	uint8_t seed[20];
	uint8_t p[28];
	uint8_t a[28];
	uint8_t b[28];
	uint8_t x[28];
	uint8_t y[28];
	uint8_t order[28];
} _EC_NIST_PRIME_224 = {
	.seed = {
		0xBD, 0x71, 0x34, 0x47, 0x99, 0xD5, 0xC7, 0xFC, 0xDC, 0x45,
		0xB5, 0x9F, 0xA3, 0xB9, 0xAB, 0x8F, 0x6A, 0x94, 0x8B, 0xC5,
	},
	.p = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
	},
	.a = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE,
	},
	.b = {
		0xB4, 0x05, 0x0A, 0x85, 0x0C, 0x04, 0xB3, 0xAB, 0xF5, 0x41,
		0x32, 0x56, 0x50, 0x44, 0xB0, 0xB7, 0xD7, 0xBF, 0xD8, 0xBA,
		0x27, 0x0B, 0x39, 0x43, 0x23, 0x55, 0xFF, 0xB4,
	},
	.x = {
		0xB7, 0x0E, 0x0C, 0xBD, 0x6B, 0xB4, 0xBF, 0x7F, 0x32, 0x13,
		0x90, 0xB9, 0x4A, 0x03, 0xC1, 0xD3, 0x56, 0xC2, 0x11, 0x22,
		0x34, 0x32, 0x80, 0xD6, 0x11, 0x5C, 0x1D, 0x21,
	},
	.y = {
		0xbd, 0x37, 0x63, 0x88, 0xb5, 0xf7, 0x23, 0xfb, 0x4c, 0x22,
		0xdf, 0xe6, 0xcd, 0x43, 0x75, 0xa0, 0x5a, 0x07, 0x47, 0x64,
		0x44, 0xd5, 0x81, 0x99, 0x85, 0x00, 0x7e, 0x34,
	},
	.order = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0x16, 0xA2, 0xE0, 0xB8, 0xF0, 0x3E,
		0x13, 0xDD, 0x29, 0x45, 0x5C, 0x5C, 0x2A, 0x3D,
	},
};

static const struct {
	uint8_t seed[20];
	uint8_t p[48];
	uint8_t a[48];
	uint8_t b[48];
	uint8_t x[48];
	uint8_t y[48];
	uint8_t order[48];
} _EC_NIST_PRIME_384 = {
	.seed = {
		0xA3, 0x35, 0x92, 0x6A, 0xA3, 0x19, 0xA2, 0x7A, 0x1D, 0x00,
		0x89, 0x6A, 0x67, 0x73, 0xA4, 0x82, 0x7A, 0xCD, 0xAC, 0x73,
	},
	.p = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF,
	},
	.a = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFC,
	},
	.b = {
		0xB3, 0x31, 0x2F, 0xA7, 0xE2, 0x3E, 0xE7, 0xE4, 0x98, 0x8E,
		0x05, 0x6B, 0xE3, 0xF8, 0x2D, 0x19, 0x18, 0x1D, 0x9C, 0x6E,
		0xFE, 0x81, 0x41, 0x12, 0x03, 0x14, 0x08, 0x8F, 0x50, 0x13,
		0x87, 0x5A, 0xC6, 0x56, 0x39, 0x8D, 0x8A, 0x2E, 0xD1, 0x9D,
		0x2A, 0x85, 0xC8, 0xED, 0xD3, 0xEC, 0x2A, 0xEF,
	},
	.x = {
		0xAA, 0x87, 0xCA, 0x22, 0xBE, 0x8B, 0x05, 0x37, 0x8E, 0xB1,
		0xC7, 0x1E, 0xF3, 0x20, 0xAD, 0x74, 0x6E, 0x1D, 0x3B, 0x62,
		0x8B, 0xA7, 0x9B, 0x98, 0x59, 0xF7, 0x41, 0xE0, 0x82, 0x54,
		0x2A, 0x38, 0x55, 0x02, 0xF2, 0x5D, 0xBF, 0x55, 0x29, 0x6C,
		0x3A, 0x54, 0x5E, 0x38, 0x72, 0x76, 0x0A, 0xB7,
	},
	.y = {
		0x36, 0x17, 0xde, 0x4a, 0x96, 0x26, 0x2c, 0x6f, 0x5d, 0x9e,
		0x98, 0xbf, 0x92, 0x92, 0xdc, 0x29, 0xf8, 0xf4, 0x1d, 0xbd,
		0x28, 0x9a, 0x14, 0x7c, 0xe9, 0xda, 0x31, 0x13, 0xb5, 0xf0,
		0xb8, 0xc0, 0x0a, 0x60, 0xb1, 0xce, 0x1d, 0x7e, 0x81, 0x9d,
		0x7a, 0x43, 0x1d, 0x7c, 0x90, 0xea, 0x0e, 0x5f,
	},
	.order = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xC7, 0x63, 0x4D, 0x81, 0xF4, 0x37,
		0x2D, 0xDF, 0x58, 0x1A, 0x0D, 0xB2, 0x48, 0xB0, 0xA7, 0x7A,
		0xEC, 0xEC, 0x19, 0x6A, 0xCC, 0xC5, 0x29, 0x73,
	},
};

static const struct {
	uint8_t seed[20];
	uint8_t p[66];
	uint8_t a[66];
	uint8_t b[66];
	uint8_t x[66];
	uint8_t y[66];
	uint8_t order[66];
} _EC_NIST_PRIME_521 = {
	.seed = {
		0xD0, 0x9E, 0x88, 0x00, 0x29, 0x1C, 0xB8, 0x53, 0x96, 0xCC,
		0x67, 0x17, 0x39, 0x32, 0x84, 0xAA, 0xA0, 0xDA, 0x64, 0xBA,
	},
	.p = {
		0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
	},
	.a = {
		0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC,
	},
	.b = {
		0x00, 0x51, 0x95, 0x3E, 0xB9, 0x61, 0x8E, 0x1C, 0x9A, 0x1F,
		0x92, 0x9A, 0x21, 0xA0, 0xB6, 0x85, 0x40, 0xEE, 0xA2, 0xDA,
		0x72, 0x5B, 0x99, 0xB3, 0x15, 0xF3, 0xB8, 0xB4, 0x89, 0x91,
		0x8E, 0xF1, 0x09, 0xE1, 0x56, 0x19, 0x39, 0x51, 0xEC, 0x7E,
		0x93, 0x7B, 0x16, 0x52, 0xC0, 0xBD, 0x3B, 0xB1, 0xBF, 0x07,
		0x35, 0x73, 0xDF, 0x88, 0x3D, 0x2C, 0x34, 0xF1, 0xEF, 0x45,
		0x1F, 0xD4, 0x6B, 0x50, 0x3F, 0x00,
	},
	.x = {
		0x00, 0xC6, 0x85, 0x8E, 0x06, 0xB7, 0x04, 0x04, 0xE9, 0xCD,
		0x9E, 0x3E, 0xCB, 0x66, 0x23, 0x95, 0xB4, 0x42, 0x9C, 0x64,
		0x81, 0x39, 0x05, 0x3F, 0xB5, 0x21, 0xF8, 0x28, 0xAF, 0x60,
		0x6B, 0x4D, 0x3D, 0xBA, 0xA1, 0x4B, 0x5E, 0x77, 0xEF, 0xE7,
		0x59, 0x28, 0xFE, 0x1D, 0xC1, 0x27, 0xA2, 0xFF, 0xA8, 0xDE,
		0x33, 0x48, 0xB3, 0xC1, 0x85, 0x6A, 0x42, 0x9B, 0xF9, 0x7E,
		0x7E, 0x31, 0xC2, 0xE5, 0xBD, 0x66,
	},
	.y = {
		0x01, 0x18, 0x39, 0x29, 0x6a, 0x78, 0x9a, 0x3b, 0xc0, 0x04,
		0x5c, 0x8a, 0x5f, 0xb4, 0x2c, 0x7d, 0x1b, 0xd9, 0x98, 0xf5,
		0x44, 0x49, 0x57, 0x9b, 0x44, 0x68, 0x17, 0xaf, 0xbd, 0x17,
		0x27, 0x3e, 0x66, 0x2c, 0x97, 0xee, 0x72, 0x99, 0x5e, 0xf4,
		0x26, 0x40, 0xc5, 0x50, 0xb9, 0x01, 0x3f, 0xad, 0x07, 0x61,
		0x35, 0x3c, 0x70, 0x86, 0xa2, 0x72, 0xc2, 0x40, 0x88, 0xbe,
		0x94, 0x76, 0x9f, 0xd1, 0x66, 0x50,
	},
	.order = {
		0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFA, 0x51, 0x86, 0x87, 0x83, 0xBF, 0x2F,
		0x96, 0x6B, 0x7F, 0xCC, 0x01, 0x48, 0xF7, 0x09, 0xA5, 0xD0,
		0x3B, 0xB5, 0xC9, 0xB8, 0x89, 0x9C, 0x47, 0xAE, 0xBB, 0x6F,
		0xB7, 0x1E, 0x91, 0x38, 0x64, 0x09,
	},
};

/* the x9.62 prime curves (minus the nist prime curves) */
static const struct {
	uint8_t seed[20];
	uint8_t p[24];
	uint8_t a[24];
	uint8_t b[24];
	uint8_t x[24];
	uint8_t y[24];
	uint8_t order[24];
} _EC_X9_62_PRIME_192V2 = {
	.seed = {
		0x31, 0xA9, 0x2E, 0xE2, 0x02, 0x9F, 0xD1, 0x0D, 0x90, 0x1B,
		0x11, 0x3E, 0x99, 0x07, 0x10, 0xF0, 0xD2, 0x1A, 0xC6, 0xB6,
	},
	.p = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF,
	},
	.a = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFC,
	},
	.b = {
		0xCC, 0x22, 0xD6, 0xDF, 0xB9, 0x5C, 0x6B, 0x25, 0xE4, 0x9C,
		0x0D, 0x63, 0x64, 0xA4, 0xE5, 0x98, 0x0C, 0x39, 0x3A, 0xA2,
		0x16, 0x68, 0xD9, 0x53,
	},
	.x = {
		0xEE, 0xA2, 0xBA, 0xE7, 0xE1, 0x49, 0x78, 0x42, 0xF2, 0xDE,
		0x77, 0x69, 0xCF, 0xE9, 0xC9, 0x89, 0xC0, 0x72, 0xAD, 0x69,
		0x6F, 0x48, 0x03, 0x4A,
	},
	.y = {
		0x65, 0x74, 0xd1, 0x1d, 0x69, 0xb6, 0xec, 0x7a, 0x67, 0x2b,
		0xb8, 0x2a, 0x08, 0x3d, 0xf2, 0xf2, 0xb0, 0x84, 0x7d, 0xe9,
		0x70, 0xb2, 0xde, 0x15,
	},
	.order = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFE, 0x5F, 0xB1, 0xA7, 0x24, 0xDC, 0x80, 0x41, 0x86,
		0x48, 0xD8, 0xDD, 0x31,
	},
};

static const struct {
	uint8_t seed[20];
	uint8_t p[24];
	uint8_t a[24];
	uint8_t b[24];
	uint8_t x[24];
	uint8_t y[24];
	uint8_t order[24];
} _EC_X9_62_PRIME_192V3 = {
	.seed = {
		0xC4, 0x69, 0x68, 0x44, 0x35, 0xDE, 0xB3, 0x78, 0xC4, 0xB6,
		0x5C, 0xA9, 0x59, 0x1E, 0x2A, 0x57, 0x63, 0x05, 0x9A, 0x2E,
	},
	.p = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF,
	},
	.a = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFC,
	},
	.b = {
		0x22, 0x12, 0x3D, 0xC2, 0x39, 0x5A, 0x05, 0xCA, 0xA7, 0x42,
		0x3D, 0xAE, 0xCC, 0xC9, 0x47, 0x60, 0xA7, 0xD4, 0x62, 0x25,
		0x6B, 0xD5, 0x69, 0x16,
	},
	.x = {
		0x7D, 0x29, 0x77, 0x81, 0x00, 0xC6, 0x5A, 0x1D, 0xA1, 0x78,
		0x37, 0x16, 0x58, 0x8D, 0xCE, 0x2B, 0x8B, 0x4A, 0xEE, 0x8E,
		0x22, 0x8F, 0x18, 0x96,
	},
	.y = {
		0x38, 0xa9, 0x0f, 0x22, 0x63, 0x73, 0x37, 0x33, 0x4b, 0x49,
		0xdc, 0xb6, 0x6a, 0x6d, 0xc8, 0xf9, 0x97, 0x8a, 0xca, 0x76,
		0x48, 0xa9, 0x43, 0xb0,
	},
	.order = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0x7A, 0x62, 0xD0, 0x31, 0xC8, 0x3F, 0x42, 0x94,
		0xF6, 0x40, 0xEC, 0x13,
	},
};

static const struct {
	uint8_t seed[20];
	uint8_t p[30];
	uint8_t a[30];
	uint8_t b[30];
	uint8_t x[30];
	uint8_t y[30];
	uint8_t order[30];
} _EC_X9_62_PRIME_239V1 = {
	.seed = {
		0xE4, 0x3B, 0xB4, 0x60, 0xF0, 0xB8, 0x0C, 0xC0, 0xC0, 0xB0,
		0x75, 0x79, 0x8E, 0x94, 0x80, 0x60, 0xF8, 0x32, 0x1B, 0x7D,
	},
	.p = {
		0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x80, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
	},
	.a = {
		0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x80, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC,
	},
	.b = {
		0x6B, 0x01, 0x6C, 0x3B, 0xDC, 0xF1, 0x89, 0x41, 0xD0, 0xD6,
		0x54, 0x92, 0x14, 0x75, 0xCA, 0x71, 0xA9, 0xDB, 0x2F, 0xB2,
		0x7D, 0x1D, 0x37, 0x79, 0x61, 0x85, 0xC2, 0x94, 0x2C, 0x0A,
	},
	.x = {
		0x0F, 0xFA, 0x96, 0x3C, 0xDC, 0xA8, 0x81, 0x6C, 0xCC, 0x33,
		0xB8, 0x64, 0x2B, 0xED, 0xF9, 0x05, 0xC3, 0xD3, 0x58, 0x57,
		0x3D, 0x3F, 0x27, 0xFB, 0xBD, 0x3B, 0x3C, 0xB9, 0xAA, 0xAF,
	},
	.y = {
		0x7d, 0xeb, 0xe8, 0xe4, 0xe9, 0x0a, 0x5d, 0xae, 0x6e, 0x40,
		0x54, 0xca, 0x53, 0x0b, 0xa0, 0x46, 0x54, 0xb3, 0x68, 0x18,
		0xce, 0x22, 0x6b, 0x39, 0xfc, 0xcb, 0x7b, 0x02, 0xf1, 0xae,
	},
	.order = {
		0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0x7F, 0xFF, 0xFF, 0x9E, 0x5E, 0x9A, 0x9F, 0x5D,
		0x90, 0x71, 0xFB, 0xD1, 0x52, 0x26, 0x88, 0x90, 0x9D, 0x0B,
	},
};

static const struct {
	uint8_t seed[20];
	uint8_t p[30];
	uint8_t a[30];
	uint8_t b[30];
	uint8_t x[30];
	uint8_t y[30];
	uint8_t order[30];
} _EC_X9_62_PRIME_239V2 = {
	.seed = {
		0xE8, 0xB4, 0x01, 0x16, 0x04, 0x09, 0x53, 0x03, 0xCA, 0x3B,
		0x80, 0x99, 0x98, 0x2B, 0xE0, 0x9F, 0xCB, 0x9A, 0xE6, 0x16,
	},
	.p = {
		0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x80, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
	},
	.a = {
		0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x80, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC,
	},
	.b = {
		0x61, 0x7F, 0xAB, 0x68, 0x32, 0x57, 0x6C, 0xBB, 0xFE, 0xD5,
		0x0D, 0x99, 0xF0, 0x24, 0x9C, 0x3F, 0xEE, 0x58, 0xB9, 0x4B,
		0xA0, 0x03, 0x8C, 0x7A, 0xE8, 0x4C, 0x8C, 0x83, 0x2F, 0x2C,
	},
	.x = {
		0x38, 0xAF, 0x09, 0xD9, 0x87, 0x27, 0x70, 0x51, 0x20, 0xC9,
		0x21, 0xBB, 0x5E, 0x9E, 0x26, 0x29, 0x6A, 0x3C, 0xDC, 0xF2,
		0xF3, 0x57, 0x57, 0xA0, 0xEA, 0xFD, 0x87, 0xB8, 0x30, 0xE7,
	},
	.y = {
		0x5b, 0x01, 0x25, 0xe4, 0xdb, 0xea, 0x0e, 0xc7, 0x20, 0x6d,
		0xa0, 0xfc, 0x01, 0xd9, 0xb0, 0x81, 0x32, 0x9f, 0xb5, 0x55,
		0xde, 0x6e, 0xf4, 0x60, 0x23, 0x7d, 0xff, 0x8b, 0xe4, 0xba,
	},
	.order = {
		0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0x80, 0x00, 0x00, 0xCF, 0xA7, 0xE8, 0x59, 0x43,
		0x77, 0xD4, 0x14, 0xC0, 0x38, 0x21, 0xBC, 0x58, 0x20, 0x63,
	},
};

static const struct {
	uint8_t seed[20];
	uint8_t p[30];
	uint8_t a[30];
	uint8_t b[30];
	uint8_t x[30];
	uint8_t y[30];
	uint8_t order[30];
} _EC_X9_62_PRIME_239V3 = {
	.seed = {
		0x7D, 0x73, 0x74, 0x16, 0x8F, 0xFE, 0x34, 0x71, 0xB6, 0x0A,
		0x85, 0x76, 0x86, 0xA1, 0x94, 0x75, 0xD3, 0xBF, 0xA2, 0xFF,
	},
	.p = {
		0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x80, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
	},
	.a = {
		0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x80, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC,
	},
	.b = {
		0x25, 0x57, 0x05, 0xFA, 0x2A, 0x30, 0x66, 0x54, 0xB1, 0xF4,
		0xCB, 0x03, 0xD6, 0xA7, 0x50, 0xA3, 0x0C, 0x25, 0x01, 0x02,
		0xD4, 0x98, 0x87, 0x17, 0xD9, 0xBA, 0x15, 0xAB, 0x6D, 0x3E,
	},
	.x = {
		0x67, 0x68, 0xAE, 0x8E, 0x18, 0xBB, 0x92, 0xCF, 0xCF, 0x00,
		0x5C, 0x94, 0x9A, 0xA2, 0xC6, 0xD9, 0x48, 0x53, 0xD0, 0xE6,
		0x60, 0xBB, 0xF8, 0x54, 0xB1, 0xC9, 0x50, 0x5F, 0xE9, 0x5A,
	},
	.y = {
		0x16, 0x07, 0xe6, 0x89, 0x8f, 0x39, 0x0c, 0x06, 0xbc, 0x1d,
		0x55, 0x2b, 0xad, 0x22, 0x6f, 0x3b, 0x6f, 0xcf, 0xe4, 0x8b,
		0x6e, 0x81, 0x84, 0x99, 0xaf, 0x18, 0xe3, 0xed, 0x6c, 0xf3,
	},
	.order = {
		0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0x7F, 0xFF, 0xFF, 0x97, 0x5D, 0xEB, 0x41, 0xB3,
		0xA6, 0x05, 0x7C, 0x3C, 0x43, 0x21, 0x46, 0x52, 0x65, 0x51,
	},
};

static const struct {
	uint8_t seed[20];
	uint8_t p[32];
	uint8_t a[32];
	uint8_t b[32];
	uint8_t x[32];
	uint8_t y[32];
	uint8_t order[32];
} _EC_X9_62_PRIME_256V1 = {
	.seed = {
		0xC4, 0x9D, 0x36, 0x08, 0x86, 0xE7, 0x04, 0x93, 0x6A, 0x66,
		0x78, 0xE1, 0x13, 0x9D, 0x26, 0xB7, 0x81, 0x9F, 0x7E, 0x90,
	},
	.p = {
		0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF,
	},
	.a = {
		0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFC,
	},
	.b = {
		0x5A, 0xC6, 0x35, 0xD8, 0xAA, 0x3A, 0x93, 0xE7, 0xB3, 0xEB,
		0xBD, 0x55, 0x76, 0x98, 0x86, 0xBC, 0x65, 0x1D, 0x06, 0xB0,
		0xCC, 0x53, 0xB0, 0xF6, 0x3B, 0xCE, 0x3C, 0x3E, 0x27, 0xD2,
		0x60, 0x4B,
	},
	.x = {
		0x6B, 0x17, 0xD1, 0xF2, 0xE1, 0x2C, 0x42, 0x47, 0xF8, 0xBC,
		0xE6, 0xE5, 0x63, 0xA4, 0x40, 0xF2, 0x77, 0x03, 0x7D, 0x81,
		0x2D, 0xEB, 0x33, 0xA0, 0xF4, 0xA1, 0x39, 0x45, 0xD8, 0x98,
		0xC2, 0x96,
	},
	.y = {
		0x4f, 0xe3, 0x42, 0xe2, 0xfe, 0x1a, 0x7f, 0x9b, 0x8e, 0xe7,
		0xeb, 0x4a, 0x7c, 0x0f, 0x9e, 0x16, 0x2b, 0xce, 0x33, 0x57,
		0x6b, 0x31, 0x5e, 0xce, 0xcb, 0xb6, 0x40, 0x68, 0x37, 0xbf,
		0x51, 0xf5,
	},
	.order = {
		0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xBC, 0xE6, 0xFA, 0xAD,
		0xA7, 0x17, 0x9E, 0x84, 0xF3, 0xB9, 0xCA, 0xC2, 0xFC, 0x63,
		0x25, 0x51,
	},
};

/* the secg prime curves (minus the nist and x9.62 prime curves) */
static const struct {
	uint8_t seed[20];
	uint8_t p[14];
	uint8_t a[14];
	uint8_t b[14];
	uint8_t x[14];
	uint8_t y[14];
	uint8_t order[14];
} _EC_SECG_PRIME_112R1 = {
	.seed = {
		0x00, 0xF5, 0x0B, 0x02, 0x8E, 0x4D, 0x69, 0x6E, 0x67, 0x68,
		0x75, 0x61, 0x51, 0x75, 0x29, 0x04, 0x72, 0x78, 0x3F, 0xB1,
	},
	.p = {
		0xDB, 0x7C, 0x2A, 0xBF, 0x62, 0xE3, 0x5E, 0x66, 0x80, 0x76,
		0xBE, 0xAD, 0x20, 0x8B,
	},
	.a = {
		0xDB, 0x7C, 0x2A, 0xBF, 0x62, 0xE3, 0x5E, 0x66, 0x80, 0x76,
		0xBE, 0xAD, 0x20, 0x88,
	},
	.b = {
		0x65, 0x9E, 0xF8, 0xBA, 0x04, 0x39, 0x16, 0xEE, 0xDE, 0x89,
		0x11, 0x70, 0x2B, 0x22,
	},
	.x = {
		0x09, 0x48, 0x72, 0x39, 0x99, 0x5A, 0x5E, 0xE7, 0x6B, 0x55,
		0xF9, 0xC2, 0xF0, 0x98,
	},
	.y = {
		0xa8, 0x9c, 0xe5, 0xaf, 0x87, 0x24, 0xc0, 0xa2, 0x3e, 0x0e,
		0x0f, 0xf7, 0x75, 0x00,
	},
	.order = {
		0xDB, 0x7C, 0x2A, 0xBF, 0x62, 0xE3, 0x5E, 0x76, 0x28, 0xDF,
		0xAC, 0x65, 0x61, 0xC5,
	},
};

static const struct {
	uint8_t seed[20];
	uint8_t p[14];
	uint8_t a[14];
	uint8_t b[14];
	uint8_t x[14];
	uint8_t y[14];
	uint8_t order[14];
} _EC_SECG_PRIME_112R2 = {
	.seed = {
		0x00, 0x27, 0x57, 0xA1, 0x11, 0x4D, 0x69, 0x6E, 0x67, 0x68,
		0x75, 0x61, 0x51, 0x75, 0x53, 0x16, 0xC0, 0x5E, 0x0B, 0xD4,
	},
	.p = {
		0xDB, 0x7C, 0x2A, 0xBF, 0x62, 0xE3, 0x5E, 0x66, 0x80, 0x76,
		0xBE, 0xAD, 0x20, 0x8B,
	},
	.a = {
		0x61, 0x27, 0xC2, 0x4C, 0x05, 0xF3, 0x8A, 0x0A, 0xAA, 0xF6,
		0x5C, 0x0E, 0xF0, 0x2C,
	},
	.b = {
		0x51, 0xDE, 0xF1, 0x81, 0x5D, 0xB5, 0xED, 0x74, 0xFC, 0xC3,
		0x4C, 0x85, 0xD7, 0x09,
	},
	.x = {
		0x4B, 0xA3, 0x0A, 0xB5, 0xE8, 0x92, 0xB4, 0xE1, 0x64, 0x9D,
		0xD0, 0x92, 0x86, 0x43,
	},
	.y = {
		0xad, 0xcd, 0x46, 0xf5, 0x88, 0x2e, 0x37, 0x47, 0xde, 0xf3,
		0x6e, 0x95, 0x6e, 0x97,
	},
	.order = {
		0x36, 0xDF, 0x0A, 0xAF, 0xD8, 0xB8, 0xD7, 0x59, 0x7C, 0xA1,
		0x05, 0x20, 0xD0, 0x4B,
	},
};

static const struct {
	uint8_t seed[20];
	uint8_t p[16];
	uint8_t a[16];
	uint8_t b[16];
	uint8_t x[16];
	uint8_t y[16];
	uint8_t order[16];
} _EC_SECG_PRIME_128R1 = {
	.seed = {
		0x00, 0x0E, 0x0D, 0x4D, 0x69, 0x6E, 0x67, 0x68, 0x75, 0x61,
		0x51, 0x75, 0x0C, 0xC0, 0x3A, 0x44, 0x73, 0xD0, 0x36, 0x79,
	},
	.p = {
		0xFF, 0xFF, 0xFF, 0xFD, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
	},
	.a = {
		0xFF, 0xFF, 0xFF, 0xFD, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC,
	},
	.b = {
		0xE8, 0x75, 0x79, 0xC1, 0x10, 0x79, 0xF4, 0x3D, 0xD8, 0x24,
		0x99, 0x3C, 0x2C, 0xEE, 0x5E, 0xD3,
	},
	.x = {
		0x16, 0x1F, 0xF7, 0x52, 0x8B, 0x89, 0x9B, 0x2D, 0x0C, 0x28,
		0x60, 0x7C, 0xA5, 0x2C, 0x5B, 0x86,
	},
	.y = {
		0xcf, 0x5a, 0xc8, 0x39, 0x5b, 0xaf, 0xeb, 0x13, 0xc0, 0x2d,
		0xa2, 0x92, 0xdd, 0xed, 0x7a, 0x83,
	},
	.order = {
		0xFF, 0xFF, 0xFF, 0xFE, 0x00, 0x00, 0x00, 0x00, 0x75, 0xA3,
		0x0D, 0x1B, 0x90, 0x38, 0xA1, 0x15,
	},
};

static const struct {
	uint8_t seed[20];
	uint8_t p[16];
	uint8_t a[16];
	uint8_t b[16];
	uint8_t x[16];
	uint8_t y[16];
	uint8_t order[16];
} _EC_SECG_PRIME_128R2 = {
	.seed = {
		0x00, 0x4D, 0x69, 0x6E, 0x67, 0x68, 0x75, 0x61, 0x51, 0x75,
		0x12, 0xD8, 0xF0, 0x34, 0x31, 0xFC, 0xE6, 0x3B, 0x88, 0xF4,
	},
	.p = {
		0xFF, 0xFF, 0xFF, 0xFD, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
	},
	.a = {
		0xD6, 0x03, 0x19, 0x98, 0xD1, 0xB3, 0xBB, 0xFE, 0xBF, 0x59,
		0xCC, 0x9B, 0xBF, 0xF9, 0xAE, 0xE1,
	},
	.b = {
		0x5E, 0xEE, 0xFC, 0xA3, 0x80, 0xD0, 0x29, 0x19, 0xDC, 0x2C,
		0x65, 0x58, 0xBB, 0x6D, 0x8A, 0x5D,
	},
	.x = {
		0x7B, 0x6A, 0xA5, 0xD8, 0x5E, 0x57, 0x29, 0x83, 0xE6, 0xFB,
		0x32, 0xA7, 0xCD, 0xEB, 0xC1, 0x40,
	},
	.y = {
		0x27, 0xb6, 0x91, 0x6a, 0x89, 0x4d, 0x3a, 0xee, 0x71, 0x06,
		0xfe, 0x80, 0x5f, 0xc3, 0x4b, 0x44,
	},
	.order = {
		0x3F, 0xFF, 0xFF, 0xFF, 0x7F, 0xFF, 0xFF, 0xFF, 0xBE, 0x00,
		0x24, 0x72, 0x06, 0x13, 0xB5, 0xA3,
	},
};

static const struct {
	uint8_t p[21];
	uint8_t a[21];
	uint8_t b[21];
	uint8_t x[21];
	uint8_t y[21];
	uint8_t order[21];
} _EC_SECG_PRIME_160K1 = {
	.p = {
		0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xAC,
		0x73,
	},
	.a = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00,
	},
	.b  = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x07,
	},
	.x = {
		0x00, 0x3B, 0x4C, 0x38, 0x2C, 0xE3, 0x7A, 0xA1, 0x92, 0xA4,
		0x01, 0x9E, 0x76, 0x30, 0x36, 0xF4, 0xF5, 0xDD, 0x4D, 0x7E,
		0xBB,
	},
	.y = {
		0x00, 0x93, 0x8c, 0xf9, 0x35, 0x31, 0x8f, 0xdc, 0xed, 0x6b,
		0xc2, 0x82, 0x86, 0x53, 0x17, 0x33, 0xc3, 0xf0, 0x3c, 0x4f,
		0xee,
	},
	.order = {
		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x01, 0xB8, 0xFA, 0x16, 0xDF, 0xAB, 0x9A, 0xCA, 0x16, 0xB6,
		0xB3,
	},
};

static const struct {
	uint8_t seed[20];
	uint8_t p[21];
	uint8_t a[21];
	uint8_t b[21];
	uint8_t x[21];
	uint8_t y[21];
	uint8_t order[21];
} _EC_SECG_PRIME_160R1 = {
	.seed = {
		0x10, 0x53, 0xCD, 0xE4, 0x2C, 0x14, 0xD6, 0x96, 0xE6, 0x76,
		0x87, 0x56, 0x15, 0x17, 0x53, 0x3B, 0xF3, 0xF8, 0x33, 0x45,
	},
	.p = {
		0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, 0xFF, 0xFF,
		0xFF,
	},
	.a = {
		0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, 0xFF, 0xFF,
		0xFC,
	},
	.b = {
		0x00, 0x1C, 0x97, 0xBE, 0xFC, 0x54, 0xBD, 0x7A, 0x8B, 0x65,
		0xAC, 0xF8, 0x9F, 0x81, 0xD4, 0xD4, 0xAD, 0xC5, 0x65, 0xFA,
		0x45,
	},
	.x = {
		0x00, 0x4A, 0x96, 0xB5, 0x68, 0x8E, 0xF5, 0x73, 0x28, 0x46,
		0x64, 0x69, 0x89, 0x68, 0xC3, 0x8B, 0xB9, 0x13, 0xCB, 0xFC,
		0x82,
	},
	.y = {
		0x00, 0x23, 0xa6, 0x28, 0x55, 0x31, 0x68, 0x94, 0x7d, 0x59,
		0xdc, 0xc9, 0x12, 0x04, 0x23, 0x51, 0x37, 0x7a, 0xc5, 0xfb,
		0x32,
	},
	.order = {
		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x01, 0xF4, 0xC8, 0xF9, 0x27, 0xAE, 0xD3, 0xCA, 0x75, 0x22,
		0x57,
	},
};

static const struct {
	uint8_t seed[20];
	uint8_t p[21];
	uint8_t a[21];
	uint8_t b[21];
	uint8_t x[21];
	uint8_t y[21];
	uint8_t order[21];
} _EC_SECG_PRIME_160R2 = {
	.seed = {
		0xB9, 0x9B, 0x99, 0xB0, 0x99, 0xB3, 0x23, 0xE0, 0x27, 0x09,
		0xA4, 0xD6, 0x96, 0xE6, 0x76, 0x87, 0x56, 0x15, 0x17, 0x51,
	},
	.p = {
		0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xAC,
		0x73,
	},
	.a = {
		0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xAC,
		0x70,
	},
	.b = {
		0x00, 0xB4, 0xE1, 0x34, 0xD3, 0xFB, 0x59, 0xEB, 0x8B, 0xAB,
		0x57, 0x27, 0x49, 0x04, 0x66, 0x4D, 0x5A, 0xF5, 0x03, 0x88,
		0xBA,
	},
	.x = {
		0x00, 0x52, 0xDC, 0xB0, 0x34, 0x29, 0x3A, 0x11, 0x7E, 0x1F,
		0x4F, 0xF1, 0x1B, 0x30, 0xF7, 0x19, 0x9D, 0x31, 0x44, 0xCE,
		0x6D,
	},
	.y = {
		0x00, 0xfe, 0xaf, 0xfe, 0xf2, 0xe3, 0x31, 0xf2, 0x96, 0xe0,
		0x71, 0xfa, 0x0d, 0xf9, 0x98, 0x2c, 0xfe, 0xa7, 0xd4, 0x3f,
		0x2e,
	},
	.order = {
		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x35, 0x1E, 0xE7, 0x86, 0xA8, 0x18, 0xF3, 0xA1, 0xA1,
		0x6B,
	},
};

static const struct {
	uint8_t p[24];
	uint8_t a[24];
	uint8_t b[24];
	uint8_t x[24];
	uint8_t y[24];
	uint8_t order[24];
} _EC_SECG_PRIME_192K1 = {
	.p = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE,
		0xFF, 0xFF, 0xEE, 0x37,
	},
	.a = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00,
	},
	.b = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x03,
	},
	.x = {
		0xDB, 0x4F, 0xF1, 0x0E, 0xC0, 0x57, 0xE9, 0xAE, 0x26, 0xB0,
		0x7D, 0x02, 0x80, 0xB7, 0xF4, 0x34, 0x1D, 0xA5, 0xD1, 0xB1,
		0xEA, 0xE0, 0x6C, 0x7D,
	},
	.y = {
		0x9b, 0x2f, 0x2f, 0x6d, 0x9c, 0x56, 0x28, 0xa7, 0x84, 0x41,
		0x63, 0xd0, 0x15, 0xbe, 0x86, 0x34, 0x40, 0x82, 0xaa, 0x88,
		0xd9, 0x5e, 0x2f, 0x9d,
	},
	.order = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFE, 0x26, 0xF2, 0xFC, 0x17, 0x0F, 0x69, 0x46, 0x6A,
		0x74, 0xDE, 0xFD, 0x8D,
	},
};

static const struct {
	uint8_t p[29];
	uint8_t a[29];
	uint8_t b[29];
	uint8_t x[29];
	uint8_t y[29];
	uint8_t order[29];
} _EC_SECG_PRIME_224K1 = {
	.p = {
		0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xE5, 0x6D,
	},
	.a = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	},
	.b = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05,
	},
	.x = {
		0x00, 0xA1, 0x45, 0x5B, 0x33, 0x4D, 0xF0, 0x99, 0xDF, 0x30,
		0xFC, 0x28, 0xA1, 0x69, 0xA4, 0x67, 0xE9, 0xE4, 0x70, 0x75,
		0xA9, 0x0F, 0x7E, 0x65, 0x0E, 0xB6, 0xB7, 0xA4, 0x5C,
	},
	.y = {
		0x00, 0x7e, 0x08, 0x9f, 0xed, 0x7f, 0xba, 0x34, 0x42, 0x82,
		0xca, 0xfb, 0xd6, 0xf7, 0xe3, 0x19, 0xf7, 0xc0, 0xb0, 0xbd,
		0x59, 0xe2, 0xca, 0x4b, 0xdb, 0x55, 0x6d, 0x61, 0xa5,
	},
	.order = {
		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x01, 0xDC, 0xE8, 0xD2, 0xEC, 0x61,
		0x84, 0xCA, 0xF0, 0xA9, 0x71, 0x76, 0x9F, 0xB1, 0xF7,
	},
};

static const struct {
	uint8_t p[32];
	uint8_t a[32];
	uint8_t b[32];
	uint8_t x[32];
	uint8_t y[32];
	uint8_t order[32];
} _EC_SECG_PRIME_256K1 = {
	.p = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF,
		0xFC, 0x2F,
	},
	.a = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00,
	},
	.b = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x07,
	},
	.x = {
		0x79, 0xBE, 0x66, 0x7E, 0xF9, 0xDC, 0xBB, 0xAC, 0x55, 0xA0,
		0x62, 0x95, 0xCE, 0x87, 0x0B, 0x07, 0x02, 0x9B, 0xFC, 0xDB,
		0x2D, 0xCE, 0x28, 0xD9, 0x59, 0xF2, 0x81, 0x5B, 0x16, 0xF8,
		0x17, 0x98,
	},
	.y = {
		0x48, 0x3a, 0xda, 0x77, 0x26, 0xa3, 0xc4, 0x65, 0x5d, 0xa4,
		0xfb, 0xfc, 0x0e, 0x11, 0x08, 0xa8, 0xfd, 0x17, 0xb4, 0x48,
		0xa6, 0x85, 0x54, 0x19, 0x9c, 0x47, 0xd0, 0x8f, 0xfb, 0x10,
		0xd4, 0xb8,
	},
	.order = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xBA, 0xAE, 0xDC, 0xE6,
		0xAF, 0x48, 0xA0, 0x3B, 0xBF, 0xD2, 0x5E, 0x8C, 0xD0, 0x36,
		0x41, 0x41,
	},
};

/* some wap/wtls curves */
static const struct {
	uint8_t p[15];
	uint8_t a[15];
	uint8_t b[15];
	uint8_t x[15];
	uint8_t y[15];
	uint8_t order[15];
} _EC_WTLS_8 = {
	.p = {
		0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFD, 0xE7,
	},
	.a = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00,
	},
	.b = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x03,
	},
	.x = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x01,
	},
	.y = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x02,
	},
	.order = {
		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0xEC, 0xEA,
		0x55, 0x1A, 0xD8, 0x37, 0xE9,
	},
};

static const struct {
	uint8_t p[21];
	uint8_t a[21];
	uint8_t b[21];
	uint8_t x[21];
	uint8_t y[21];
	uint8_t order[21];
} _EC_WTLS_9 = {
	.p = {
		0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC, 0x80,
		0x8F,
	},
	.a = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00,
	},
	.b = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x03,
	},
	.x = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x01,
	},
	.y = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x02,
	},
	.order = {
		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x01, 0xCD, 0xC9, 0x8A, 0xE0, 0xE2, 0xDE, 0x57, 0x4A, 0xBF,
		0x33,
	},
};

static const struct {
	uint8_t p[28];
	uint8_t a[28];
	uint8_t b[28];
	uint8_t x[28];
	uint8_t y[28];
	uint8_t order[28];
} _EC_WTLS_12 = {
	.p = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
	},
	.a = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE,
	},
	.b = {
		0xB4, 0x05, 0x0A, 0x85, 0x0C, 0x04, 0xB3, 0xAB, 0xF5, 0x41,
		0x32, 0x56, 0x50, 0x44, 0xB0, 0xB7, 0xD7, 0xBF, 0xD8, 0xBA,
		0x27, 0x0B, 0x39, 0x43, 0x23, 0x55, 0xFF, 0xB4,
	},
	.x = {
		0xB7, 0x0E, 0x0C, 0xBD, 0x6B, 0xB4, 0xBF, 0x7F, 0x32, 0x13,
		0x90, 0xB9, 0x4A, 0x03, 0xC1, 0xD3, 0x56, 0xC2, 0x11, 0x22,
		0x34, 0x32, 0x80, 0xD6, 0x11, 0x5C, 0x1D, 0x21,
	},
	.y = {
		0xbd, 0x37, 0x63, 0x88, 0xb5, 0xf7, 0x23, 0xfb, 0x4c, 0x22,
		0xdf, 0xe6, 0xcd, 0x43, 0x75, 0xa0, 0x5a, 0x07, 0x47, 0x64,
		0x44, 0xd5, 0x81, 0x99, 0x85, 0x00, 0x7e, 0x34,
	},
	.order = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0x16, 0xA2, 0xE0, 0xB8, 0xF0, 0x3E,
		0x13, 0xDD, 0x29, 0x45, 0x5C, 0x5C, 0x2A, 0x3D,
	},
};

static const struct {
	uint8_t p[20];
	uint8_t a[20];
	uint8_t b[20];
	uint8_t x[20];
	uint8_t y[20];
	uint8_t order[20];
} _EC_brainpoolP160r1 = {
	.p = {
		0xE9, 0x5E, 0x4A, 0x5F, 0x73, 0x70, 0x59, 0xDC, 0x60, 0xDF,
		0xC7, 0xAD, 0x95, 0xB3, 0xD8, 0x13, 0x95, 0x15, 0x62, 0x0F,
	},
	.a = {
		0x34, 0x0E, 0x7B, 0xE2, 0xA2, 0x80, 0xEB, 0x74, 0xE2, 0xBE,
		0x61, 0xBA, 0xDA, 0x74, 0x5D, 0x97, 0xE8, 0xF7, 0xC3, 0x00,
	},
	.b = {
		0x1E, 0x58, 0x9A, 0x85, 0x95, 0x42, 0x34, 0x12, 0x13, 0x4F,
		0xAA, 0x2D, 0xBD, 0xEC, 0x95, 0xC8, 0xD8, 0x67, 0x5E, 0x58,
	},
	.x = {
		0xBE, 0xD5, 0xAF, 0x16, 0xEA, 0x3F, 0x6A, 0x4F, 0x62, 0x93,
		0x8C, 0x46, 0x31, 0xEB, 0x5A, 0xF7, 0xBD, 0xBC, 0xDB, 0xC3,
	},
	.y = {
		0x16, 0x67, 0xCB, 0x47, 0x7A, 0x1A, 0x8E, 0xC3, 0x38, 0xF9,
		0x47, 0x41, 0x66, 0x9C, 0x97, 0x63, 0x16, 0xDA, 0x63, 0x21,
	},
	.order = {
		0xE9, 0x5E, 0x4A, 0x5F, 0x73, 0x70, 0x59, 0xDC, 0x60, 0xDF,
		0x59, 0x91, 0xD4, 0x50, 0x29, 0x40, 0x9E, 0x60, 0xFC, 0x09,
	},
};

static const struct {
	uint8_t p[20];
	uint8_t a[20];
	uint8_t b[20];
	uint8_t x[20];
	uint8_t y[20];
	uint8_t order[20];
} _EC_brainpoolP160t1 = {
	.p = {
		0xE9, 0x5E, 0x4A, 0x5F, 0x73, 0x70, 0x59, 0xDC, 0x60, 0xDF,
		0xC7, 0xAD, 0x95, 0xB3, 0xD8, 0x13, 0x95, 0x15, 0x62, 0x0F,
	},
	.a = {
		0xE9, 0x5E, 0x4A, 0x5F, 0x73, 0x70, 0x59, 0xDC, 0x60, 0xDF,
		0xC7, 0xAD, 0x95, 0xB3, 0xD8, 0x13, 0x95, 0x15, 0x62, 0x0C,
	},
	.b = {
		0x7A, 0x55, 0x6B, 0x6D, 0xAE, 0x53, 0x5B, 0x7B, 0x51, 0xED,
		0x2C, 0x4D, 0x7D, 0xAA, 0x7A, 0x0B, 0x5C, 0x55, 0xF3, 0x80,
	},
	.x = {
		0xB1, 0x99, 0xB1, 0x3B, 0x9B, 0x34, 0xEF, 0xC1, 0x39, 0x7E,
		0x64, 0xBA, 0xEB, 0x05, 0xAC, 0xC2, 0x65, 0xFF, 0x23, 0x78,
	},
	.y = {
		0xAD, 0xD6, 0x71, 0x8B, 0x7C, 0x7C, 0x19, 0x61, 0xF0, 0x99,
		0x1B, 0x84, 0x24, 0x43, 0x77, 0x21, 0x52, 0xC9, 0xE0, 0xAD,
	},
	.order = {
		0xE9, 0x5E, 0x4A, 0x5F, 0x73, 0x70, 0x59, 0xDC, 0x60, 0xDF,
		0x59, 0x91, 0xD4, 0x50, 0x29, 0x40, 0x9E, 0x60, 0xFC, 0x09,
	},
};

static const struct {
	uint8_t p[24];
	uint8_t a[24];
	uint8_t b[24];
	uint8_t x[24];
	uint8_t y[24];
	uint8_t order[24];
} _EC_brainpoolP192r1 = {
	.p = {
		0xC3, 0x02, 0xF4, 0x1D, 0x93, 0x2A, 0x36, 0xCD, 0xA7, 0xA3,
		0x46, 0x30, 0x93, 0xD1, 0x8D, 0xB7, 0x8F, 0xCE, 0x47, 0x6D,
		0xE1, 0xA8, 0x62, 0x97,
	},
	.a = {
		0x6A, 0x91, 0x17, 0x40, 0x76, 0xB1, 0xE0, 0xE1, 0x9C, 0x39,
		0xC0, 0x31, 0xFE, 0x86, 0x85, 0xC1, 0xCA, 0xE0, 0x40, 0xE5,
		0xC6, 0x9A, 0x28, 0xEF,
	},
	.b = {
		0x46, 0x9A, 0x28, 0xEF, 0x7C, 0x28, 0xCC, 0xA3, 0xDC, 0x72,
		0x1D, 0x04, 0x4F, 0x44, 0x96, 0xBC, 0xCA, 0x7E, 0xF4, 0x14,
		0x6F, 0xBF, 0x25, 0xC9,
	},
	.x = {
		0xC0, 0xA0, 0x64, 0x7E, 0xAA, 0xB6, 0xA4, 0x87, 0x53, 0xB0,
		0x33, 0xC5, 0x6C, 0xB0, 0xF0, 0x90, 0x0A, 0x2F, 0x5C, 0x48,
		0x53, 0x37, 0x5F, 0xD6,
	},
	.y = {
		0x14, 0xB6, 0x90, 0x86, 0x6A, 0xBD, 0x5B, 0xB8, 0x8B, 0x5F,
		0x48, 0x28, 0xC1, 0x49, 0x00, 0x02, 0xE6, 0x77, 0x3F, 0xA2,
		0xFA, 0x29, 0x9B, 0x8F,
	},
	.order = {
		0xC3, 0x02, 0xF4, 0x1D, 0x93, 0x2A, 0x36, 0xCD, 0xA7, 0xA3,
		0x46, 0x2F, 0x9E, 0x9E, 0x91, 0x6B, 0x5B, 0xE8, 0xF1, 0x02,
		0x9A, 0xC4, 0xAC, 0xC1,
	},
};

static const struct {
	uint8_t p[24];
	uint8_t a[24];
	uint8_t b[24];
	uint8_t x[24];
	uint8_t y[24];
	uint8_t order[24];
} _EC_brainpoolP192t1 = {
	.p = {
		0xC3, 0x02, 0xF4, 0x1D, 0x93, 0x2A, 0x36, 0xCD, 0xA7, 0xA3,
		0x46, 0x30, 0x93, 0xD1, 0x8D, 0xB7, 0x8F, 0xCE, 0x47, 0x6D,
		0xE1, 0xA8, 0x62, 0x97,
	},
	.a = {
		0xC3, 0x02, 0xF4, 0x1D, 0x93, 0x2A, 0x36, 0xCD, 0xA7, 0xA3,
		0x46, 0x30, 0x93, 0xD1, 0x8D, 0xB7, 0x8F, 0xCE, 0x47, 0x6D,
		0xE1, 0xA8, 0x62, 0x94,
	},
	.b = {
		0x13, 0xD5, 0x6F, 0xFA, 0xEC, 0x78, 0x68, 0x1E, 0x68, 0xF9,
		0xDE, 0xB4, 0x3B, 0x35, 0xBE, 0xC2, 0xFB, 0x68, 0x54, 0x2E,
		0x27, 0x89, 0x7B, 0x79,
	},
	.x = {
		0x3A, 0xE9, 0xE5, 0x8C, 0x82, 0xF6, 0x3C, 0x30, 0x28, 0x2E,
		0x1F, 0xE7, 0xBB, 0xF4, 0x3F, 0xA7, 0x2C, 0x44, 0x6A, 0xF6,
		0xF4, 0x61, 0x81, 0x29,
	},
	.y = {
		0x09, 0x7E, 0x2C, 0x56, 0x67, 0xC2, 0x22, 0x3A, 0x90, 0x2A,
		0xB5, 0xCA, 0x44, 0x9D, 0x00, 0x84, 0xB7, 0xE5, 0xB3, 0xDE,
		0x7C, 0xCC, 0x01, 0xC9,
	},
	.order = {
		0xC3, 0x02, 0xF4, 0x1D, 0x93, 0x2A, 0x36, 0xCD, 0xA7, 0xA3,
		0x46, 0x2F, 0x9E, 0x9E, 0x91, 0x6B, 0x5B, 0xE8, 0xF1, 0x02,
		0x9A, 0xC4, 0xAC, 0xC1,
	},
};

static const struct {
	uint8_t p[28];
	uint8_t a[28];
	uint8_t b[28];
	uint8_t x[28];
	uint8_t y[28];
	uint8_t order[28];
} _EC_brainpoolP224r1 = {
	.p = {
		0xD7, 0xC1, 0x34, 0xAA, 0x26, 0x43, 0x66, 0x86, 0x2A, 0x18,
		0x30, 0x25, 0x75, 0xD1, 0xD7, 0x87, 0xB0, 0x9F, 0x07, 0x57,
		0x97, 0xDA, 0x89, 0xF5, 0x7E, 0xC8, 0xC0, 0xFF,
	},
	.a = {
		0x68, 0xA5, 0xE6, 0x2C, 0xA9, 0xCE, 0x6C, 0x1C, 0x29, 0x98,
		0x03, 0xA6, 0xC1, 0x53, 0x0B, 0x51, 0x4E, 0x18, 0x2A, 0xD8,
		0xB0, 0x04, 0x2A, 0x59, 0xCA, 0xD2, 0x9F, 0x43,
	},
	.b = {
		0x25, 0x80, 0xF6, 0x3C, 0xCF, 0xE4, 0x41, 0x38, 0x87, 0x07,
		0x13, 0xB1, 0xA9, 0x23, 0x69, 0xE3, 0x3E, 0x21, 0x35, 0xD2,
		0x66, 0xDB, 0xB3, 0x72, 0x38, 0x6C, 0x40, 0x0B,
	},
	.x = {
		0x0D, 0x90, 0x29, 0xAD, 0x2C, 0x7E, 0x5C, 0xF4, 0x34, 0x08,
		0x23, 0xB2, 0xA8, 0x7D, 0xC6, 0x8C, 0x9E, 0x4C, 0xE3, 0x17,
		0x4C, 0x1E, 0x6E, 0xFD, 0xEE, 0x12, 0xC0, 0x7D,
	},
	.y = {
		0x58, 0xAA, 0x56, 0xF7, 0x72, 0xC0, 0x72, 0x6F, 0x24, 0xC6,
		0xB8, 0x9E, 0x4E, 0xCD, 0xAC, 0x24, 0x35, 0x4B, 0x9E, 0x99,
		0xCA, 0xA3, 0xF6, 0xD3, 0x76, 0x14, 0x02, 0xCD,
	},
	.order = {
		0xD7, 0xC1, 0x34, 0xAA, 0x26, 0x43, 0x66, 0x86, 0x2A, 0x18,
		0x30, 0x25, 0x75, 0xD0, 0xFB, 0x98, 0xD1, 0x16, 0xBC, 0x4B,
		0x6D, 0xDE, 0xBC, 0xA3, 0xA5, 0xA7, 0x93, 0x9F,
	},
};

static const struct {
	uint8_t p[28];
	uint8_t a[28];
	uint8_t b[28];
	uint8_t x[28];
	uint8_t y[28];
	uint8_t order[28];
} _EC_brainpoolP224t1 = {
	.p = {
		0xD7, 0xC1, 0x34, 0xAA, 0x26, 0x43, 0x66, 0x86, 0x2A, 0x18,
		0x30, 0x25, 0x75, 0xD1, 0xD7, 0x87, 0xB0, 0x9F, 0x07, 0x57,
		0x97, 0xDA, 0x89, 0xF5, 0x7E, 0xC8, 0xC0, 0xFF,
	},
	.a = {
		0xD7, 0xC1, 0x34, 0xAA, 0x26, 0x43, 0x66, 0x86, 0x2A, 0x18,
		0x30, 0x25, 0x75, 0xD1, 0xD7, 0x87, 0xB0, 0x9F, 0x07, 0x57,
		0x97, 0xDA, 0x89, 0xF5, 0x7E, 0xC8, 0xC0, 0xFC,
	},
	.b = {
		0x4B, 0x33, 0x7D, 0x93, 0x41, 0x04, 0xCD, 0x7B, 0xEF, 0x27,
		0x1B, 0xF6, 0x0C, 0xED, 0x1E, 0xD2, 0x0D, 0xA1, 0x4C, 0x08,
		0xB3, 0xBB, 0x64, 0xF1, 0x8A, 0x60, 0x88, 0x8D,
	},
	.x = {
		0x6A, 0xB1, 0xE3, 0x44, 0xCE, 0x25, 0xFF, 0x38, 0x96, 0x42,
		0x4E, 0x7F, 0xFE, 0x14, 0x76, 0x2E, 0xCB, 0x49, 0xF8, 0x92,
		0x8A, 0xC0, 0xC7, 0x60, 0x29, 0xB4, 0xD5, 0x80,
	},
	.y = {
		0x03, 0x74, 0xE9, 0xF5, 0x14, 0x3E, 0x56, 0x8C, 0xD2, 0x3F,
		0x3F, 0x4D, 0x7C, 0x0D, 0x4B, 0x1E, 0x41, 0xC8, 0xCC, 0x0D,
		0x1C, 0x6A, 0xBD, 0x5F, 0x1A, 0x46, 0xDB, 0x4C,
	},
	.order = {
		0xD7, 0xC1, 0x34, 0xAA, 0x26, 0x43, 0x66, 0x86, 0x2A, 0x18,
		0x30, 0x25, 0x75, 0xD0, 0xFB, 0x98, 0xD1, 0x16, 0xBC, 0x4B,
		0x6D, 0xDE, 0xBC, 0xA3, 0xA5, 0xA7, 0x93, 0x9F,
	},
};

static const struct {
	uint8_t p[32];
	uint8_t a[32];
	uint8_t b[32];
	uint8_t x[32];
	uint8_t y[32];
	uint8_t order[32];
} _EC_brainpoolP256r1 = {
	.p = {
		0xA9, 0xFB, 0x57, 0xDB, 0xA1, 0xEE, 0xA9, 0xBC, 0x3E, 0x66,
		0x0A, 0x90, 0x9D, 0x83, 0x8D, 0x72, 0x6E, 0x3B, 0xF6, 0x23,
		0xD5, 0x26, 0x20, 0x28, 0x20, 0x13, 0x48, 0x1D, 0x1F, 0x6E,
		0x53, 0x77,
	},
	.a = {
		0x7D, 0x5A, 0x09, 0x75, 0xFC, 0x2C, 0x30, 0x57, 0xEE, 0xF6,
		0x75, 0x30, 0x41, 0x7A, 0xFF, 0xE7, 0xFB, 0x80, 0x55, 0xC1,
		0x26, 0xDC, 0x5C, 0x6C, 0xE9, 0x4A, 0x4B, 0x44, 0xF3, 0x30,
		0xB5, 0xD9,
	},
	.b = {
		0x26, 0xDC, 0x5C, 0x6C, 0xE9, 0x4A, 0x4B, 0x44, 0xF3, 0x30,
		0xB5, 0xD9, 0xBB, 0xD7, 0x7C, 0xBF, 0x95, 0x84, 0x16, 0x29,
		0x5C, 0xF7, 0xE1, 0xCE, 0x6B, 0xCC, 0xDC, 0x18, 0xFF, 0x8C,
		0x07, 0xB6,
	},
	.x = {
		0x8B, 0xD2, 0xAE, 0xB9, 0xCB, 0x7E, 0x57, 0xCB, 0x2C, 0x4B,
		0x48, 0x2F, 0xFC, 0x81, 0xB7, 0xAF, 0xB9, 0xDE, 0x27, 0xE1,
		0xE3, 0xBD, 0x23, 0xC2, 0x3A, 0x44, 0x53, 0xBD, 0x9A, 0xCE,
		0x32, 0x62,
	},
	.y = {
		0x54, 0x7E, 0xF8, 0x35, 0xC3, 0xDA, 0xC4, 0xFD, 0x97, 0xF8,
		0x46, 0x1A, 0x14, 0x61, 0x1D, 0xC9, 0xC2, 0x77, 0x45, 0x13,
		0x2D, 0xED, 0x8E, 0x54, 0x5C, 0x1D, 0x54, 0xC7, 0x2F, 0x04,
		0x69, 0x97,
	},
	.order = {
		0xA9, 0xFB, 0x57, 0xDB, 0xA1, 0xEE, 0xA9, 0xBC, 0x3E, 0x66,
		0x0A, 0x90, 0x9D, 0x83, 0x8D, 0x71, 0x8C, 0x39, 0x7A, 0xA3,
		0xB5, 0x61, 0xA6, 0xF7, 0x90, 0x1E, 0x0E, 0x82, 0x97, 0x48,
		0x56, 0xA7,
	},
};

static const struct {
	uint8_t p[32];
	uint8_t a[32];
	uint8_t b[32];
	uint8_t x[32];
	uint8_t y[32];
	uint8_t order[32];
} _EC_brainpoolP256t1 = {
	.p = {
		0xA9, 0xFB, 0x57, 0xDB, 0xA1, 0xEE, 0xA9, 0xBC, 0x3E, 0x66,
		0x0A, 0x90, 0x9D, 0x83, 0x8D, 0x72, 0x6E, 0x3B, 0xF6, 0x23,
		0xD5, 0x26, 0x20, 0x28, 0x20, 0x13, 0x48, 0x1D, 0x1F, 0x6E,
		0x53, 0x77,
	},
	.a = {
		0xA9, 0xFB, 0x57, 0xDB, 0xA1, 0xEE, 0xA9, 0xBC, 0x3E, 0x66,
		0x0A, 0x90, 0x9D, 0x83, 0x8D, 0x72, 0x6E, 0x3B, 0xF6, 0x23,
		0xD5, 0x26, 0x20, 0x28, 0x20, 0x13, 0x48, 0x1D, 0x1F, 0x6E,
		0x53, 0x74,
	},
	.b = {
		0x66, 0x2C, 0x61, 0xC4, 0x30, 0xD8, 0x4E, 0xA4, 0xFE, 0x66,
		0xA7, 0x73, 0x3D, 0x0B, 0x76, 0xB7, 0xBF, 0x93, 0xEB, 0xC4,
		0xAF, 0x2F, 0x49, 0x25, 0x6A, 0xE5, 0x81, 0x01, 0xFE, 0xE9,
		0x2B, 0x04,
	},
	.x = {
		0xA3, 0xE8, 0xEB, 0x3C, 0xC1, 0xCF, 0xE7, 0xB7, 0x73, 0x22,
		0x13, 0xB2, 0x3A, 0x65, 0x61, 0x49, 0xAF, 0xA1, 0x42, 0xC4,
		0x7A, 0xAF, 0xBC, 0x2B, 0x79, 0xA1, 0x91, 0x56, 0x2E, 0x13,
		0x05, 0xF4,
	},
	.y = {
		0x2D, 0x99, 0x6C, 0x82, 0x34, 0x39, 0xC5, 0x6D, 0x7F, 0x7B,
		0x22, 0xE1, 0x46, 0x44, 0x41, 0x7E, 0x69, 0xBC, 0xB6, 0xDE,
		0x39, 0xD0, 0x27, 0x00, 0x1D, 0xAB, 0xE8, 0xF3, 0x5B, 0x25,
		0xC9, 0xBE,
	},
	.order = {
		0xA9, 0xFB, 0x57, 0xDB, 0xA1, 0xEE, 0xA9, 0xBC, 0x3E, 0x66,
		0x0A, 0x90, 0x9D, 0x83, 0x8D, 0x71, 0x8C, 0x39, 0x7A, 0xA3,
		0xB5, 0x61, 0xA6, 0xF7, 0x90, 0x1E, 0x0E, 0x82, 0x97, 0x48,
		0x56, 0xA7,
	},
};

static const struct {
	uint8_t p[40];
	uint8_t a[40];
	uint8_t b[40];
	uint8_t x[40];
	uint8_t y[40];
	uint8_t order[40];
} _EC_brainpoolP320r1 = {
	.p = {
		0xD3, 0x5E, 0x47, 0x20, 0x36, 0xBC, 0x4F, 0xB7, 0xE1, 0x3C,
		0x78, 0x5E, 0xD2, 0x01, 0xE0, 0x65, 0xF9, 0x8F, 0xCF, 0xA6,
		0xF6, 0xF4, 0x0D, 0xEF, 0x4F, 0x92, 0xB9, 0xEC, 0x78, 0x93,
		0xEC, 0x28, 0xFC, 0xD4, 0x12, 0xB1, 0xF1, 0xB3, 0x2E, 0x27,
	},
	.a = {
		0x3E, 0xE3, 0x0B, 0x56, 0x8F, 0xBA, 0xB0, 0xF8, 0x83, 0xCC,
		0xEB, 0xD4, 0x6D, 0x3F, 0x3B, 0xB8, 0xA2, 0xA7, 0x35, 0x13,
		0xF5, 0xEB, 0x79, 0xDA, 0x66, 0x19, 0x0E, 0xB0, 0x85, 0xFF,
		0xA9, 0xF4, 0x92, 0xF3, 0x75, 0xA9, 0x7D, 0x86, 0x0E, 0xB4,
	},
	.b = {
		0x52, 0x08, 0x83, 0x94, 0x9D, 0xFD, 0xBC, 0x42, 0xD3, 0xAD,
		0x19, 0x86, 0x40, 0x68, 0x8A, 0x6F, 0xE1, 0x3F, 0x41, 0x34,
		0x95, 0x54, 0xB4, 0x9A, 0xCC, 0x31, 0xDC, 0xCD, 0x88, 0x45,
		0x39, 0x81, 0x6F, 0x5E, 0xB4, 0xAC, 0x8F, 0xB1, 0xF1, 0xA6,
	},
	.x = {
		0x43, 0xBD, 0x7E, 0x9A, 0xFB, 0x53, 0xD8, 0xB8, 0x52, 0x89,
		0xBC, 0xC4, 0x8E, 0xE5, 0xBF, 0xE6, 0xF2, 0x01, 0x37, 0xD1,
		0x0A, 0x08, 0x7E, 0xB6, 0xE7, 0x87, 0x1E, 0x2A, 0x10, 0xA5,
		0x99, 0xC7, 0x10, 0xAF, 0x8D, 0x0D, 0x39, 0xE2, 0x06, 0x11,
	},
	.y = {
		0x14, 0xFD, 0xD0, 0x55, 0x45, 0xEC, 0x1C, 0xC8, 0xAB, 0x40,
		0x93, 0x24, 0x7F, 0x77, 0x27, 0x5E, 0x07, 0x43, 0xFF, 0xED,
		0x11, 0x71, 0x82, 0xEA, 0xA9, 0xC7, 0x78, 0x77, 0xAA, 0xAC,
		0x6A, 0xC7, 0xD3, 0x52, 0x45, 0xD1, 0x69, 0x2E, 0x8E, 0xE1,
	},
	.order = {
		0xD3, 0x5E, 0x47, 0x20, 0x36, 0xBC, 0x4F, 0xB7, 0xE1, 0x3C,
		0x78, 0x5E, 0xD2, 0x01, 0xE0, 0x65, 0xF9, 0x8F, 0xCF, 0xA5,
		0xB6, 0x8F, 0x12, 0xA3, 0x2D, 0x48, 0x2E, 0xC7, 0xEE, 0x86,
		0x58, 0xE9, 0x86, 0x91, 0x55, 0x5B, 0x44, 0xC5, 0x93, 0x11,
	},
};

static const struct {
	uint8_t p[40];
	uint8_t a[40];
	uint8_t b[40];
	uint8_t x[40];
	uint8_t y[40];
	uint8_t order[40];
} _EC_brainpoolP320t1 = {
	.p = {
		0xD3, 0x5E, 0x47, 0x20, 0x36, 0xBC, 0x4F, 0xB7, 0xE1, 0x3C,
		0x78, 0x5E, 0xD2, 0x01, 0xE0, 0x65, 0xF9, 0x8F, 0xCF, 0xA6,
		0xF6, 0xF4, 0x0D, 0xEF, 0x4F, 0x92, 0xB9, 0xEC, 0x78, 0x93,
		0xEC, 0x28, 0xFC, 0xD4, 0x12, 0xB1, 0xF1, 0xB3, 0x2E, 0x27,
	},
	.a = {
		0xD3, 0x5E, 0x47, 0x20, 0x36, 0xBC, 0x4F, 0xB7, 0xE1, 0x3C,
		0x78, 0x5E, 0xD2, 0x01, 0xE0, 0x65, 0xF9, 0x8F, 0xCF, 0xA6,
		0xF6, 0xF4, 0x0D, 0xEF, 0x4F, 0x92, 0xB9, 0xEC, 0x78, 0x93,
		0xEC, 0x28, 0xFC, 0xD4, 0x12, 0xB1, 0xF1, 0xB3, 0x2E, 0x24,
	},
	.b = {
		0xA7, 0xF5, 0x61, 0xE0, 0x38, 0xEB, 0x1E, 0xD5, 0x60, 0xB3,
		0xD1, 0x47, 0xDB, 0x78, 0x20, 0x13, 0x06, 0x4C, 0x19, 0xF2,
		0x7E, 0xD2, 0x7C, 0x67, 0x80, 0xAA, 0xF7, 0x7F, 0xB8, 0xA5,
		0x47, 0xCE, 0xB5, 0xB4, 0xFE, 0xF4, 0x22, 0x34, 0x03, 0x53,
	},
	.x = {
		0x92, 0x5B, 0xE9, 0xFB, 0x01, 0xAF, 0xC6, 0xFB, 0x4D, 0x3E,
		0x7D, 0x49, 0x90, 0x01, 0x0F, 0x81, 0x34, 0x08, 0xAB, 0x10,
		0x6C, 0x4F, 0x09, 0xCB, 0x7E, 0xE0, 0x78, 0x68, 0xCC, 0x13,
		0x6F, 0xFF, 0x33, 0x57, 0xF6, 0x24, 0xA2, 0x1B, 0xED, 0x52,
	},
	.y = {
		0x63, 0xBA, 0x3A, 0x7A, 0x27, 0x48, 0x3E, 0xBF, 0x66, 0x71,
		0xDB, 0xEF, 0x7A, 0xBB, 0x30, 0xEB, 0xEE, 0x08, 0x4E, 0x58,
		0xA0, 0xB0, 0x77, 0xAD, 0x42, 0xA5, 0xA0, 0x98, 0x9D, 0x1E,
		0xE7, 0x1B, 0x1B, 0x9B, 0xC0, 0x45, 0x5F, 0xB0, 0xD2, 0xC3,
	},
	.order = {
		0xD3, 0x5E, 0x47, 0x20, 0x36, 0xBC, 0x4F, 0xB7, 0xE1, 0x3C,
		0x78, 0x5E, 0xD2, 0x01, 0xE0, 0x65, 0xF9, 0x8F, 0xCF, 0xA5,
		0xB6, 0x8F, 0x12, 0xA3, 0x2D, 0x48, 0x2E, 0xC7, 0xEE, 0x86,
		0x58, 0xE9, 0x86, 0x91, 0x55, 0x5B, 0x44, 0xC5, 0x93, 0x11,
	},
};

static const struct {
	uint8_t p[48];
	uint8_t a[48];
	uint8_t b[48];
	uint8_t x[48];
	uint8_t y[48];
	uint8_t order[48];
} _EC_brainpoolP384r1 = {
	.p = {
		0x8C, 0xB9, 0x1E, 0x82, 0xA3, 0x38, 0x6D, 0x28, 0x0F, 0x5D,
		0x6F, 0x7E, 0x50, 0xE6, 0x41, 0xDF, 0x15, 0x2F, 0x71, 0x09,
		0xED, 0x54, 0x56, 0xB4, 0x12, 0xB1, 0xDA, 0x19, 0x7F, 0xB7,
		0x11, 0x23, 0xAC, 0xD3, 0xA7, 0x29, 0x90, 0x1D, 0x1A, 0x71,
		0x87, 0x47, 0x00, 0x13, 0x31, 0x07, 0xEC, 0x53,
	},
	.a = {
		0x7B, 0xC3, 0x82, 0xC6, 0x3D, 0x8C, 0x15, 0x0C, 0x3C, 0x72,
		0x08, 0x0A, 0xCE, 0x05, 0xAF, 0xA0, 0xC2, 0xBE, 0xA2, 0x8E,
		0x4F, 0xB2, 0x27, 0x87, 0x13, 0x91, 0x65, 0xEF, 0xBA, 0x91,
		0xF9, 0x0F, 0x8A, 0xA5, 0x81, 0x4A, 0x50, 0x3A, 0xD4, 0xEB,
		0x04, 0xA8, 0xC7, 0xDD, 0x22, 0xCE, 0x28, 0x26,
	},
	.b = {
		0x04, 0xA8, 0xC7, 0xDD, 0x22, 0xCE, 0x28, 0x26, 0x8B, 0x39,
		0xB5, 0x54, 0x16, 0xF0, 0x44, 0x7C, 0x2F, 0xB7, 0x7D, 0xE1,
		0x07, 0xDC, 0xD2, 0xA6, 0x2E, 0x88, 0x0E, 0xA5, 0x3E, 0xEB,
		0x62, 0xD5, 0x7C, 0xB4, 0x39, 0x02, 0x95, 0xDB, 0xC9, 0x94,
		0x3A, 0xB7, 0x86, 0x96, 0xFA, 0x50, 0x4C, 0x11,
	},
	.x = {
		0x1D, 0x1C, 0x64, 0xF0, 0x68, 0xCF, 0x45, 0xFF, 0xA2, 0xA6,
		0x3A, 0x81, 0xB7, 0xC1, 0x3F, 0x6B, 0x88, 0x47, 0xA3, 0xE7,
		0x7E, 0xF1, 0x4F, 0xE3, 0xDB, 0x7F, 0xCA, 0xFE, 0x0C, 0xBD,
		0x10, 0xE8, 0xE8, 0x26, 0xE0, 0x34, 0x36, 0xD6, 0x46, 0xAA,
		0xEF, 0x87, 0xB2, 0xE2, 0x47, 0xD4, 0xAF, 0x1E,
	},
	.y = {
		0x8A, 0xBE, 0x1D, 0x75, 0x20, 0xF9, 0xC2, 0xA4, 0x5C, 0xB1,
		0xEB, 0x8E, 0x95, 0xCF, 0xD5, 0x52, 0x62, 0xB7, 0x0B, 0x29,
		0xFE, 0xEC, 0x58, 0x64, 0xE1, 0x9C, 0x05, 0x4F, 0xF9, 0x91,
		0x29, 0x28, 0x0E, 0x46, 0x46, 0x21, 0x77, 0x91, 0x81, 0x11,
		0x42, 0x82, 0x03, 0x41, 0x26, 0x3C, 0x53, 0x15,
	},
	.order = {
		0x8C, 0xB9, 0x1E, 0x82, 0xA3, 0x38, 0x6D, 0x28, 0x0F, 0x5D,
		0x6F, 0x7E, 0x50, 0xE6, 0x41, 0xDF, 0x15, 0x2F, 0x71, 0x09,
		0xED, 0x54, 0x56, 0xB3, 0x1F, 0x16, 0x6E, 0x6C, 0xAC, 0x04,
		0x25, 0xA7, 0xCF, 0x3A, 0xB6, 0xAF, 0x6B, 0x7F, 0xC3, 0x10,
		0x3B, 0x88, 0x32, 0x02, 0xE9, 0x04, 0x65, 0x65,
	},
};

static const struct {
	uint8_t p[48];
	uint8_t a[48];
	uint8_t b[48];
	uint8_t x[48];
	uint8_t y[48];
	uint8_t order[48];
} _EC_brainpoolP384t1 = {
	.p = {
		0x8C, 0xB9, 0x1E, 0x82, 0xA3, 0x38, 0x6D, 0x28, 0x0F, 0x5D,
		0x6F, 0x7E, 0x50, 0xE6, 0x41, 0xDF, 0x15, 0x2F, 0x71, 0x09,
		0xED, 0x54, 0x56, 0xB4, 0x12, 0xB1, 0xDA, 0x19, 0x7F, 0xB7,
		0x11, 0x23, 0xAC, 0xD3, 0xA7, 0x29, 0x90, 0x1D, 0x1A, 0x71,
		0x87, 0x47, 0x00, 0x13, 0x31, 0x07, 0xEC, 0x53,
	},
	.a = {
		0x8C, 0xB9, 0x1E, 0x82, 0xA3, 0x38, 0x6D, 0x28, 0x0F, 0x5D,
		0x6F, 0x7E, 0x50, 0xE6, 0x41, 0xDF, 0x15, 0x2F, 0x71, 0x09,
		0xED, 0x54, 0x56, 0xB4, 0x12, 0xB1, 0xDA, 0x19, 0x7F, 0xB7,
		0x11, 0x23, 0xAC, 0xD3, 0xA7, 0x29, 0x90, 0x1D, 0x1A, 0x71,
		0x87, 0x47, 0x00, 0x13, 0x31, 0x07, 0xEC, 0x50,
	},
	.b = {
		0x7F, 0x51, 0x9E, 0xAD, 0xA7, 0xBD, 0xA8, 0x1B, 0xD8, 0x26,
		0xDB, 0xA6, 0x47, 0x91, 0x0F, 0x8C, 0x4B, 0x93, 0x46, 0xED,
		0x8C, 0xCD, 0xC6, 0x4E, 0x4B, 0x1A, 0xBD, 0x11, 0x75, 0x6D,
		0xCE, 0x1D, 0x20, 0x74, 0xAA, 0x26, 0x3B, 0x88, 0x80, 0x5C,
		0xED, 0x70, 0x35, 0x5A, 0x33, 0xB4, 0x71, 0xEE,
	},
	.x = {
		0x18, 0xDE, 0x98, 0xB0, 0x2D, 0xB9, 0xA3, 0x06, 0xF2, 0xAF,
		0xCD, 0x72, 0x35, 0xF7, 0x2A, 0x81, 0x9B, 0x80, 0xAB, 0x12,
		0xEB, 0xD6, 0x53, 0x17, 0x24, 0x76, 0xFE, 0xCD, 0x46, 0x2A,
		0xAB, 0xFF, 0xC4, 0xFF, 0x19, 0x1B, 0x94, 0x6A, 0x5F, 0x54,
		0xD8, 0xD0, 0xAA, 0x2F, 0x41, 0x88, 0x08, 0xCC,
	},
	.y = {
		0x25, 0xAB, 0x05, 0x69, 0x62, 0xD3, 0x06, 0x51, 0xA1, 0x14,
		0xAF, 0xD2, 0x75, 0x5A, 0xD3, 0x36, 0x74, 0x7F, 0x93, 0x47,
		0x5B, 0x7A, 0x1F, 0xCA, 0x3B, 0x88, 0xF2, 0xB6, 0xA2, 0x08,
		0xCC, 0xFE, 0x46, 0x94, 0x08, 0x58, 0x4D, 0xC2, 0xB2, 0x91,
		0x26, 0x75, 0xBF, 0x5B, 0x9E, 0x58, 0x29, 0x28,
	},
	.order = {
		0x8C, 0xB9, 0x1E, 0x82, 0xA3, 0x38, 0x6D, 0x28, 0x0F, 0x5D,
		0x6F, 0x7E, 0x50, 0xE6, 0x41, 0xDF, 0x15, 0x2F, 0x71, 0x09,
		0xED, 0x54, 0x56, 0xB3, 0x1F, 0x16, 0x6E, 0x6C, 0xAC, 0x04,
		0x25, 0xA7, 0xCF, 0x3A, 0xB6, 0xAF, 0x6B, 0x7F, 0xC3, 0x10,
		0x3B, 0x88, 0x32, 0x02, 0xE9, 0x04, 0x65, 0x65,
	},
};

static const struct {
	uint8_t p[64];
	uint8_t a[64];
	uint8_t b[64];
	uint8_t x[64];
	uint8_t y[64];
	uint8_t order[64];
} _EC_brainpoolP512r1 = {
	.p = {
		0xAA, 0xDD, 0x9D, 0xB8, 0xDB, 0xE9, 0xC4, 0x8B, 0x3F, 0xD4,
		0xE6, 0xAE, 0x33, 0xC9, 0xFC, 0x07, 0xCB, 0x30, 0x8D, 0xB3,
		0xB3, 0xC9, 0xD2, 0x0E, 0xD6, 0x63, 0x9C, 0xCA, 0x70, 0x33,
		0x08, 0x71, 0x7D, 0x4D, 0x9B, 0x00, 0x9B, 0xC6, 0x68, 0x42,
		0xAE, 0xCD, 0xA1, 0x2A, 0xE6, 0xA3, 0x80, 0xE6, 0x28, 0x81,
		0xFF, 0x2F, 0x2D, 0x82, 0xC6, 0x85, 0x28, 0xAA, 0x60, 0x56,
		0x58, 0x3A, 0x48, 0xF3,
	},
	.a = {
		0x78, 0x30, 0xA3, 0x31, 0x8B, 0x60, 0x3B, 0x89, 0xE2, 0x32,
		0x71, 0x45, 0xAC, 0x23, 0x4C, 0xC5, 0x94, 0xCB, 0xDD, 0x8D,
		0x3D, 0xF9, 0x16, 0x10, 0xA8, 0x34, 0x41, 0xCA, 0xEA, 0x98,
		0x63, 0xBC, 0x2D, 0xED, 0x5D, 0x5A, 0xA8, 0x25, 0x3A, 0xA1,
		0x0A, 0x2E, 0xF1, 0xC9, 0x8B, 0x9A, 0xC8, 0xB5, 0x7F, 0x11,
		0x17, 0xA7, 0x2B, 0xF2, 0xC7, 0xB9, 0xE7, 0xC1, 0xAC, 0x4D,
		0x77, 0xFC, 0x94, 0xCA,
	},
	.b = {
		0x3D, 0xF9, 0x16, 0x10, 0xA8, 0x34, 0x41, 0xCA, 0xEA, 0x98,
		0x63, 0xBC, 0x2D, 0xED, 0x5D, 0x5A, 0xA8, 0x25, 0x3A, 0xA1,
		0x0A, 0x2E, 0xF1, 0xC9, 0x8B, 0x9A, 0xC8, 0xB5, 0x7F, 0x11,
		0x17, 0xA7, 0x2B, 0xF2, 0xC7, 0xB9, 0xE7, 0xC1, 0xAC, 0x4D,
		0x77, 0xFC, 0x94, 0xCA, 0xDC, 0x08, 0x3E, 0x67, 0x98, 0x40,
		0x50, 0xB7, 0x5E, 0xBA, 0xE5, 0xDD, 0x28, 0x09, 0xBD, 0x63,
		0x80, 0x16, 0xF7, 0x23,
	},
	.x = {
		0x81, 0xAE, 0xE4, 0xBD, 0xD8, 0x2E, 0xD9, 0x64, 0x5A, 0x21,
		0x32, 0x2E, 0x9C, 0x4C, 0x6A, 0x93, 0x85, 0xED, 0x9F, 0x70,
		0xB5, 0xD9, 0x16, 0xC1, 0xB4, 0x3B, 0x62, 0xEE, 0xF4, 0xD0,
		0x09, 0x8E, 0xFF, 0x3B, 0x1F, 0x78, 0xE2, 0xD0, 0xD4, 0x8D,
		0x50, 0xD1, 0x68, 0x7B, 0x93, 0xB9, 0x7D, 0x5F, 0x7C, 0x6D,
		0x50, 0x47, 0x40, 0x6A, 0x5E, 0x68, 0x8B, 0x35, 0x22, 0x09,
		0xBC, 0xB9, 0xF8, 0x22,
	},
	.y = {
		0x7D, 0xDE, 0x38, 0x5D, 0x56, 0x63, 0x32, 0xEC, 0xC0, 0xEA,
		0xBF, 0xA9, 0xCF, 0x78, 0x22, 0xFD, 0xF2, 0x09, 0xF7, 0x00,
		0x24, 0xA5, 0x7B, 0x1A, 0xA0, 0x00, 0xC5, 0x5B, 0x88, 0x1F,
		0x81, 0x11, 0xB2, 0xDC, 0xDE, 0x49, 0x4A, 0x5F, 0x48, 0x5E,
		0x5B, 0xCA, 0x4B, 0xD8, 0x8A, 0x27, 0x63, 0xAE, 0xD1, 0xCA,
		0x2B, 0x2F, 0xA8, 0xF0, 0x54, 0x06, 0x78, 0xCD, 0x1E, 0x0F,
		0x3A, 0xD8, 0x08, 0x92,
	},
	.order = {
		0xAA, 0xDD, 0x9D, 0xB8, 0xDB, 0xE9, 0xC4, 0x8B, 0x3F, 0xD4,
		0xE6, 0xAE, 0x33, 0xC9, 0xFC, 0x07, 0xCB, 0x30, 0x8D, 0xB3,
		0xB3, 0xC9, 0xD2, 0x0E, 0xD6, 0x63, 0x9C, 0xCA, 0x70, 0x33,
		0x08, 0x70, 0x55, 0x3E, 0x5C, 0x41, 0x4C, 0xA9, 0x26, 0x19,
		0x41, 0x86, 0x61, 0x19, 0x7F, 0xAC, 0x10, 0x47, 0x1D, 0xB1,
		0xD3, 0x81, 0x08, 0x5D, 0xDA, 0xDD, 0xB5, 0x87, 0x96, 0x82,
		0x9C, 0xA9, 0x00, 0x69,
	},
};

static const struct {
	uint8_t p[64];
	uint8_t a[64];
	uint8_t b[64];
	uint8_t x[64];
	uint8_t y[64];
	uint8_t order[64];
} _EC_brainpoolP512t1 = {
	.p = {
		0xAA, 0xDD, 0x9D, 0xB8, 0xDB, 0xE9, 0xC4, 0x8B, 0x3F, 0xD4,
		0xE6, 0xAE, 0x33, 0xC9, 0xFC, 0x07, 0xCB, 0x30, 0x8D, 0xB3,
		0xB3, 0xC9, 0xD2, 0x0E, 0xD6, 0x63, 0x9C, 0xCA, 0x70, 0x33,
		0x08, 0x71, 0x7D, 0x4D, 0x9B, 0x00, 0x9B, 0xC6, 0x68, 0x42,
		0xAE, 0xCD, 0xA1, 0x2A, 0xE6, 0xA3, 0x80, 0xE6, 0x28, 0x81,
		0xFF, 0x2F, 0x2D, 0x82, 0xC6, 0x85, 0x28, 0xAA, 0x60, 0x56,
		0x58, 0x3A, 0x48, 0xF3,
	},
	.a = {
		0xAA, 0xDD, 0x9D, 0xB8, 0xDB, 0xE9, 0xC4, 0x8B, 0x3F, 0xD4,
		0xE6, 0xAE, 0x33, 0xC9, 0xFC, 0x07, 0xCB, 0x30, 0x8D, 0xB3,
		0xB3, 0xC9, 0xD2, 0x0E, 0xD6, 0x63, 0x9C, 0xCA, 0x70, 0x33,
		0x08, 0x71, 0x7D, 0x4D, 0x9B, 0x00, 0x9B, 0xC6, 0x68, 0x42,
		0xAE, 0xCD, 0xA1, 0x2A, 0xE6, 0xA3, 0x80, 0xE6, 0x28, 0x81,
		0xFF, 0x2F, 0x2D, 0x82, 0xC6, 0x85, 0x28, 0xAA, 0x60, 0x56,
		0x58, 0x3A, 0x48, 0xF0,
	},
	.b = {
		0x7C, 0xBB, 0xBC, 0xF9, 0x44, 0x1C, 0xFA, 0xB7, 0x6E, 0x18,
		0x90, 0xE4, 0x68, 0x84, 0xEA, 0xE3, 0x21, 0xF7, 0x0C, 0x0B,
		0xCB, 0x49, 0x81, 0x52, 0x78, 0x97, 0x50, 0x4B, 0xEC, 0x3E,
		0x36, 0xA6, 0x2B, 0xCD, 0xFA, 0x23, 0x04, 0x97, 0x65, 0x40,
		0xF6, 0x45, 0x00, 0x85, 0xF2, 0xDA, 0xE1, 0x45, 0xC2, 0x25,
		0x53, 0xB4, 0x65, 0x76, 0x36, 0x89, 0x18, 0x0E, 0xA2, 0x57,
		0x18, 0x67, 0x42, 0x3E,
	},
	.x = {
		0x64, 0x0E, 0xCE, 0x5C, 0x12, 0x78, 0x87, 0x17, 0xB9, 0xC1,
		0xBA, 0x06, 0xCB, 0xC2, 0xA6, 0xFE, 0xBA, 0x85, 0x84, 0x24,
		0x58, 0xC5, 0x6D, 0xDE, 0x9D, 0xB1, 0x75, 0x8D, 0x39, 0xC0,
		0x31, 0x3D, 0x82, 0xBA, 0x51, 0x73, 0x5C, 0xDB, 0x3E, 0xA4,
		0x99, 0xAA, 0x77, 0xA7, 0xD6, 0x94, 0x3A, 0x64, 0xF7, 0xA3,
		0xF2, 0x5F, 0xE2, 0x6F, 0x06, 0xB5, 0x1B, 0xAA, 0x26, 0x96,
		0xFA, 0x90, 0x35, 0xDA,
	},
	.y = {
		0x5B, 0x53, 0x4B, 0xD5, 0x95, 0xF5, 0xAF, 0x0F, 0xA2, 0xC8,
		0x92, 0x37, 0x6C, 0x84, 0xAC, 0xE1, 0xBB, 0x4E, 0x30, 0x19,
		0xB7, 0x16, 0x34, 0xC0, 0x11, 0x31, 0x15, 0x9C, 0xAE, 0x03,
		0xCE, 0xE9, 0xD9, 0x93, 0x21, 0x84, 0xBE, 0xEF, 0x21, 0x6B,
		0xD7, 0x1D, 0xF2, 0xDA, 0xDF, 0x86, 0xA6, 0x27, 0x30, 0x6E,
		0xCF, 0xF9, 0x6D, 0xBB, 0x8B, 0xAC, 0xE1, 0x98, 0xB6, 0x1E,
		0x00, 0xF8, 0xB3, 0x32,
	},
	.order = {
		0xAA, 0xDD, 0x9D, 0xB8, 0xDB, 0xE9, 0xC4, 0x8B, 0x3F, 0xD4,
		0xE6, 0xAE, 0x33, 0xC9, 0xFC, 0x07, 0xCB, 0x30, 0x8D, 0xB3,
		0xB3, 0xC9, 0xD2, 0x0E, 0xD6, 0x63, 0x9C, 0xCA, 0x70, 0x33,
		0x08, 0x70, 0x55, 0x3E, 0x5C, 0x41, 0x4C, 0xA9, 0x26, 0x19,
		0x41, 0x86, 0x61, 0x19, 0x7F, 0xAC, 0x10, 0x47, 0x1D, 0xB1,
		0xD3, 0x81, 0x08, 0x5D, 0xDA, 0xDD, 0xB5, 0x87, 0x96, 0x82,
		0x9C, 0xA9, 0x00, 0x69,
	},
};

static const struct {
	uint8_t p[32];
	uint8_t a[32];
	uint8_t b[32];
	uint8_t x[32];
	uint8_t y[32];
	uint8_t order[32];
} _EC_FRP256v1 = {
	.p = {
		0xF1, 0xFD, 0x17, 0x8C, 0x0B, 0x3A, 0xD5, 0x8F, 0x10, 0x12,
		0x6D, 0xE8, 0xCE, 0x42, 0x43, 0x5B, 0x39, 0x61, 0xAD, 0xBC,
		0xAB, 0xC8, 0xCA, 0x6D, 0xE8, 0xFC, 0xF3, 0x53, 0xD8, 0x6E,
		0x9C, 0x03,
	},
	.a = {
		0xF1, 0xFD, 0x17, 0x8C, 0x0B, 0x3A, 0xD5, 0x8F, 0x10, 0x12,
		0x6D, 0xE8, 0xCE, 0x42, 0x43, 0x5B, 0x39, 0x61, 0xAD, 0xBC,
		0xAB, 0xC8, 0xCA, 0x6D, 0xE8, 0xFC, 0xF3, 0x53, 0xD8, 0x6E,
		0x9C, 0x00,
	},
	.b = {
		0xEE, 0x35, 0x3F, 0xCA, 0x54, 0x28, 0xA9, 0x30, 0x0D, 0x4A,
		0xBA, 0x75, 0x4A, 0x44, 0xC0, 0x0F, 0xDF, 0xEC, 0x0C, 0x9A,
		0xE4, 0xB1, 0xA1, 0x80, 0x30, 0x75, 0xED, 0x96, 0x7B, 0x7B,
		0xB7, 0x3F,
	},
	.x = {
		0xB6, 0xB3, 0xD4, 0xC3, 0x56, 0xC1, 0x39, 0xEB, 0x31, 0x18,
		0x3D, 0x47, 0x49, 0xD4, 0x23, 0x95, 0x8C, 0x27, 0xD2, 0xDC,
		0xAF, 0x98, 0xB7, 0x01, 0x64, 0xC9, 0x7A, 0x2D, 0xD9, 0x8F,
		0x5C, 0xFF,
	},
	.y = {
		0x61, 0x42, 0xE0, 0xF7, 0xC8, 0xB2, 0x04, 0x91, 0x1F, 0x92,
		0x71, 0xF0, 0xF3, 0xEC, 0xEF, 0x8C, 0x27, 0x01, 0xC3, 0x07,
		0xE8, 0xE4, 0xC9, 0xE1, 0x83, 0x11, 0x5A, 0x15, 0x54, 0x06,
		0x2C, 0xFB,
	},
	.order = {
		0xF1, 0xFD, 0x17, 0x8C, 0x0B, 0x3A, 0xD5, 0x8F, 0x10, 0x12,
		0x6D, 0xE8, 0xCE, 0x42, 0x43, 0x5B, 0x53, 0xDC, 0x67, 0xE1,
		0x40, 0xD2, 0xBF, 0x94, 0x1F, 0xFD, 0xD4, 0x59, 0xC6, 0xD6,
		0x55, 0xE1,
	},
};

#ifndef OPENSSL_NO_GOST
static const struct {
	uint8_t p[32];
	uint8_t a[32];
	uint8_t b[32];
	uint8_t x[32];
	uint8_t y[32];
	uint8_t order[32];
} _EC_GOST_2001_Test = {
	.p = {
		0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x04, 0x31,
	},
	.a = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x07,
	},
	.b = {
		0x5F, 0xBF, 0xF4, 0x98, 0xAA, 0x93, 0x8C, 0xE7, 0x39, 0xB8,
		0xE0, 0x22, 0xFB, 0xAF, 0xEF, 0x40, 0x56, 0x3F, 0x6E, 0x6A,
		0x34, 0x72, 0xFC, 0x2A, 0x51, 0x4C, 0x0C, 0xE9, 0xDA, 0xE2,
		0x3B, 0x7E,
	},
	.x = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x02,
	},
	.y = {
		0x08, 0xE2, 0xA8, 0xA0, 0xE6, 0x51, 0x47, 0xD4, 0xBD, 0x63,
		0x16, 0x03, 0x0E, 0x16, 0xD1, 0x9C, 0x85, 0xC9, 0x7F, 0x0A,
		0x9C, 0xA2, 0x67, 0x12, 0x2B, 0x96, 0xAB, 0xBC, 0xEA, 0x7E,
		0x8F, 0xC8,
	},
	.order = {
		0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x50, 0xFE, 0x8A, 0x18,
		0x92, 0x97, 0x61, 0x54, 0xC5, 0x9C, 0xFC, 0x19, 0x3A, 0xCC,
		0xF5, 0xB3,
	},
};

static const struct {
	uint8_t p[32];
	uint8_t a[32];
	uint8_t b[32];
	uint8_t x[32];
	uint8_t y[32];
	uint8_t order[32];
} _EC_GOST_2001_CryptoPro_A = {
	.p = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFD, 0x97,
	},
	.a = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFD, 0x94,
	},
	.b = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0xA6,
	},
	.x = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x01,
	},
	.y = {
		0x8D, 0x91, 0xE4, 0x71, 0xE0, 0x98, 0x9C, 0xDA, 0x27, 0xDF,
		0x50, 0x5A, 0x45, 0x3F, 0x2B, 0x76, 0x35, 0x29, 0x4F, 0x2D,
		0xDF, 0x23, 0xE3, 0xB1, 0x22, 0xAC, 0xC9, 0x9C, 0x9E, 0x9F,
		0x1E, 0x14,
	},
	.order = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x6C, 0x61, 0x10, 0x70,
		0x99, 0x5A, 0xD1, 0x00, 0x45, 0x84, 0x1B, 0x09, 0xB7, 0x61,
		0xB8, 0x93,
	},
};

static const struct {
	uint8_t p[32];
	uint8_t a[32];
	uint8_t b[32];
	uint8_t x[32];
	uint8_t y[32];
	uint8_t order[32];
} _EC_GOST_2001_CryptoPro_B = {
	.p = {
		0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x0C, 0x99,
	},
	.a = {
		0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x0C, 0x96,
	},
	.b = {
		0x3E, 0x1A, 0xF4, 0x19, 0xA2, 0x69, 0xA5, 0xF8, 0x66, 0xA7,
		0xD3, 0xC2, 0x5C, 0x3D, 0xF8, 0x0A, 0xE9, 0x79, 0x25, 0x93,
		0x73, 0xFF, 0x2B, 0x18, 0x2F, 0x49, 0xD4, 0xCE, 0x7E, 0x1B,
		0xBC, 0x8B,
	},
	.x = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x01,
	},
	.y = {
		0x3F, 0xA8, 0x12, 0x43, 0x59, 0xF9, 0x66, 0x80, 0xB8, 0x3D,
		0x1C, 0x3E, 0xB2, 0xC0, 0x70, 0xE5, 0xC5, 0x45, 0xC9, 0x85,
		0x8D, 0x03, 0xEC, 0xFB, 0x74, 0x4B, 0xF8, 0xD7, 0x17, 0x71,
		0x7E, 0xFC,
	},
	.order = {
		0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x5F, 0x70, 0x0C, 0xFF,
		0xF1, 0xA6, 0x24, 0xE5, 0xE4, 0x97, 0x16, 0x1B, 0xCC, 0x8A,
		0x19, 0x8F,
	},
};

static const struct {
	uint8_t p[32];
	uint8_t a[32];
	uint8_t b[32];
	uint8_t x[32];
	uint8_t y[32];
	uint8_t order[32];
} _EC_GOST_2001_CryptoPro_C = {
	.p = {
		0x9B, 0x9F, 0x60, 0x5F, 0x5A, 0x85, 0x81, 0x07, 0xAB, 0x1E,
		0xC8, 0x5E, 0x6B, 0x41, 0xC8, 0xAA, 0xCF, 0x84, 0x6E, 0x86,
		0x78, 0x90, 0x51, 0xD3, 0x79, 0x98, 0xF7, 0xB9, 0x02, 0x2D,
		0x75, 0x9B,
	},
	.a = {
		0x9B, 0x9F, 0x60, 0x5F, 0x5A, 0x85, 0x81, 0x07, 0xAB, 0x1E,
		0xC8, 0x5E, 0x6B, 0x41, 0xC8, 0xAA, 0xCF, 0x84, 0x6E, 0x86,
		0x78, 0x90, 0x51, 0xD3, 0x79, 0x98, 0xF7, 0xB9, 0x02, 0x2D,
		0x75, 0x98,
	},
	.b = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x80, 0x5A,
	},
	.x = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00,
	},
	.y = {
		0x41, 0xEC, 0xE5, 0x57, 0x43, 0x71, 0x1A, 0x8C, 0x3C, 0xBF,
		0x37, 0x83, 0xCD, 0x08, 0xC0, 0xEE, 0x4D, 0x4D, 0xC4, 0x40,
		0xD4, 0x64, 0x1A, 0x8F, 0x36, 0x6E, 0x55, 0x0D, 0xFD, 0xB3,
		0xBB, 0x67,
	},
	.order = {
		0x9B, 0x9F, 0x60, 0x5F, 0x5A, 0x85, 0x81, 0x07, 0xAB, 0x1E,
		0xC8, 0x5E, 0x6B, 0x41, 0xC8, 0xAA, 0x58, 0x2C, 0xA3, 0x51,
		0x1E, 0xDD, 0xFB, 0x74, 0xF0, 0x2F, 0x3A, 0x65, 0x98, 0x98,
		0x0B, 0xB9,
	},
};

/*
 * This curve is defined in two birationally equal forms: canonical and Twisted
 * Edwards. We do calculations in canonical (Weierstrass) form.
 */
static const struct {
	uint8_t p[32];
	uint8_t a[32];
	uint8_t b[32];
	uint8_t x[32];
	uint8_t y[32];
	uint8_t order[32];
} _EC_GOST_2012_256_TC26_A = {
	.p = {
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
		0xFD, 0x97,
	},
	.a = {
		0xc2, 0x17, 0x3f, 0x15, 0x13, 0x98, 0x16, 0x73, 0xaf, 0x48,
		0x92, 0xc2, 0x30, 0x35, 0xa2, 0x7c, 0xe2, 0x5e, 0x20, 0x13,
		0xbf, 0x95, 0xaa, 0x33, 0xb2, 0x2c, 0x65, 0x6f, 0x27, 0x7e,
		0x73, 0x35,
	},
	.b = {
		0x29, 0x5f, 0x9b, 0xae, 0x74, 0x28, 0xed, 0x9c, 0xcc, 0x20,
		0xe7, 0xc3, 0x59, 0xa9, 0xd4, 0x1a, 0x22, 0xfc, 0xcd, 0x91,
		0x08, 0xe1, 0x7b, 0xf7, 0xba, 0x93, 0x37, 0xa6, 0xf8, 0xae,
		0x95, 0x13,
	},
	.x = {
		0x91, 0xe3, 0x84, 0x43, 0xa5, 0xe8, 0x2c, 0x0d, 0x88, 0x09,
		0x23, 0x42, 0x57, 0x12, 0xb2, 0xbb, 0x65, 0x8b, 0x91, 0x96,
		0x93, 0x2e, 0x02, 0xc7, 0x8b, 0x25, 0x82, 0xfe, 0x74, 0x2d,
		0xaa, 0x28,
	},
	.y = {
		0x32, 0x87, 0x94, 0x23, 0xab, 0x1a, 0x03, 0x75, 0x89, 0x57,
		0x86, 0xc4, 0xbb, 0x46, 0xe9, 0x56, 0x5f, 0xde, 0x0b, 0x53,
		0x44, 0x76, 0x67, 0x40, 0xaf, 0x26, 0x8a, 0xdb, 0x32, 0x32,
		0x2e, 0x5c,
	},
	.order = {
		0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0xd8, 0xcd, 0xdf,
		0xc8, 0x7b, 0x66, 0x35, 0xc1, 0x15, 0xaf, 0x55, 0x6c, 0x36,
		0x0c, 0x67,
	},
};

static const struct {
	uint8_t p[64];
	uint8_t a[64];
	uint8_t b[64];
	uint8_t x[64];
	uint8_t y[64];
	uint8_t order[64];
} _EC_GOST_2012_512_Test = {
	.p = {
		0x45, 0x31, 0xac, 0xd1, 0xfe, 0x00, 0x23, 0xc7, 0x55, 0x0d,
		0x26, 0x7b, 0x6b, 0x2f, 0xee, 0x80, 0x92, 0x2b, 0x14, 0xb2,
		0xff, 0xb9, 0x0f, 0x04, 0xd4, 0xeb, 0x7c, 0x09, 0xb5, 0xd2,
		0xd1, 0x5d, 0xf1, 0xd8, 0x52, 0x74, 0x1a, 0xf4, 0x70, 0x4a,
		0x04, 0x58, 0x04, 0x7e, 0x80, 0xe4, 0x54, 0x6d, 0x35, 0xb8,
		0x33, 0x6f, 0xac, 0x22, 0x4d, 0xd8, 0x16, 0x64, 0xbb, 0xf5,
		0x28, 0xbe, 0x63, 0x73,
	},
	.a = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x07,
	},
	.b = {
		0x1c, 0xff, 0x08, 0x06, 0xa3, 0x11, 0x16, 0xda, 0x29, 0xd8,
		0xcf, 0xa5, 0x4e, 0x57, 0xeb, 0x74, 0x8b, 0xc5, 0xf3, 0x77,
		0xe4, 0x94, 0x00, 0xfd, 0xd7, 0x88, 0xb6, 0x49, 0xec, 0xa1,
		0xac, 0x43, 0x61, 0x83, 0x40, 0x13, 0xb2, 0xad, 0x73, 0x22,
		0x48, 0x0a, 0x89, 0xca, 0x58, 0xe0, 0xcf, 0x74, 0xbc, 0x9e,
		0x54, 0x0c, 0x2a, 0xdd, 0x68, 0x97, 0xfa, 0xd0, 0xa3, 0x08,
		0x4f, 0x30, 0x2a, 0xdc,
	},
	.x = {
		0x24, 0xd1, 0x9c, 0xc6, 0x45, 0x72, 0xee, 0x30, 0xf3, 0x96,
		0xbf, 0x6e, 0xbb, 0xfd, 0x7a, 0x6c, 0x52, 0x13, 0xb3, 0xb3,
		0xd7, 0x05, 0x7c, 0xc8, 0x25, 0xf9, 0x10, 0x93, 0xa6, 0x8c,
		0xd7, 0x62, 0xfd, 0x60, 0x61, 0x12, 0x62, 0xcd, 0x83, 0x8d,
		0xc6, 0xb6, 0x0a, 0xa7, 0xee, 0xe8, 0x04, 0xe2, 0x8b, 0xc8,
		0x49, 0x97, 0x7f, 0xac, 0x33, 0xb4, 0xb5, 0x30, 0xf1, 0xb1,
		0x20, 0x24, 0x8a, 0x9a,
	},
	.y = {
		0x2b, 0xb3, 0x12, 0xa4, 0x3b, 0xd2, 0xce, 0x6e, 0x0d, 0x02,
		0x06, 0x13, 0xc8, 0x57, 0xac, 0xdd, 0xcf, 0xbf, 0x06, 0x1e,
		0x91, 0xe5, 0xf2, 0xc3, 0xf3, 0x24, 0x47, 0xc2, 0x59, 0xf3,
		0x9b, 0x2c, 0x83, 0xab, 0x15, 0x6d, 0x77, 0xf1, 0x49, 0x6b,
		0xf7, 0xeb, 0x33, 0x51, 0xe1, 0xee, 0x4e, 0x43, 0xdc, 0x1a,
		0x18, 0xb9, 0x1b, 0x24, 0x64, 0x0b, 0x6d, 0xbb, 0x92, 0xcb,
		0x1a, 0xdd, 0x37, 0x1e,
	},
	.order = {
		0x45, 0x31, 0xac, 0xd1, 0xfe, 0x00, 0x23, 0xc7, 0x55, 0x0d,
		0x26, 0x7b, 0x6b, 0x2f, 0xee, 0x80, 0x92, 0x2b, 0x14, 0xb2,
		0xff, 0xb9, 0x0f, 0x04, 0xd4, 0xeb, 0x7c, 0x09, 0xb5, 0xd2,
		0xd1, 0x5d, 0xa8, 0x2f, 0x2d, 0x7e, 0xcb, 0x1d, 0xba, 0xc7,
		0x19, 0x90, 0x5c, 0x5e, 0xec, 0xc4, 0x23, 0xf1, 0xd8, 0x6e,
		0x25, 0xed, 0xbe, 0x23, 0xc5, 0x95, 0xd6, 0x44, 0xaa, 0xf1,
		0x87, 0xe6, 0xe6, 0xdf,
	},
};

static const struct {
	uint8_t p[64];
	uint8_t a[64];
	uint8_t b[64];
	uint8_t x[64];
	uint8_t y[64];
	uint8_t order[64];
} _EC_GOST_2012_512_TC26_A = {
	.p = {
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xfd, 0xc7,
	},
	.a = {
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xfd, 0xc4,
	},
	.b = {
		0xe8, 0xc2, 0x50, 0x5d, 0xed, 0xfc, 0x86, 0xdd, 0xc1, 0xbd,
		0x0b, 0x2b, 0x66, 0x67, 0xf1, 0xda, 0x34, 0xb8, 0x25, 0x74,
		0x76, 0x1c, 0xb0, 0xe8, 0x79, 0xbd, 0x08, 0x1c, 0xfd, 0x0b,
		0x62, 0x65, 0xee, 0x3c, 0xb0, 0x90, 0xf3, 0x0d, 0x27, 0x61,
		0x4c, 0xb4, 0x57, 0x40, 0x10, 0xda, 0x90, 0xdd, 0x86, 0x2e,
		0xf9, 0xd4, 0xeb, 0xee, 0x47, 0x61, 0x50, 0x31, 0x90, 0x78,
		0x5a, 0x71, 0xc7, 0x60,
	},
	.x = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x03,
	},
	.y = {
		0x75, 0x03, 0xcf, 0xe8, 0x7a, 0x83, 0x6a, 0xe3, 0xa6, 0x1b,
		0x88, 0x16, 0xe2, 0x54, 0x50, 0xe6, 0xce, 0x5e, 0x1c, 0x93,
		0xac, 0xf1, 0xab, 0xc1, 0x77, 0x80, 0x64, 0xfd, 0xcb, 0xef,
		0xa9, 0x21, 0xdf, 0x16, 0x26, 0xbe, 0x4f, 0xd0, 0x36, 0xe9,
		0x3d, 0x75, 0xe6, 0xa5, 0x0e, 0x3a, 0x41, 0xe9, 0x80, 0x28,
		0xfe, 0x5f, 0xc2, 0x35, 0xf5, 0xb8, 0x89, 0xa5, 0x89, 0xcb,
		0x52, 0x15, 0xf2, 0xa4,
	},
	.order = {
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0x27, 0xe6, 0x95, 0x32, 0xf4, 0x8d, 0x89, 0x11,
		0x6f, 0xf2, 0x2b, 0x8d, 0x4e, 0x05, 0x60, 0x60, 0x9b, 0x4b,
		0x38, 0xab, 0xfa, 0xd2, 0xb8, 0x5d, 0xca, 0xcd, 0xb1, 0x41,
		0x1f, 0x10, 0xb2, 0x75,
	},
};

static const struct {
	uint8_t p[64];
	uint8_t a[64];
	uint8_t b[64];
	uint8_t x[64];
	uint8_t y[64];
	uint8_t order[64];
} _EC_GOST_2012_512_TC26_B = {
	.p = {
		0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x6f,
	},
	.a = {
		0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x6c,
	},
	.b = {
		0x68, 0x7d, 0x1b, 0x45, 0x9d, 0xc8, 0x41, 0x45, 0x7e, 0x3e,
		0x06, 0xcf, 0x6f, 0x5e, 0x25, 0x17, 0xb9, 0x7c, 0x7d, 0x61,
		0x4a, 0xf1, 0x38, 0xbc, 0xbf, 0x85, 0xdc, 0x80, 0x6c, 0x4b,
		0x28, 0x9f, 0x3e, 0x96, 0x5d, 0x2d, 0xb1, 0x41, 0x6d, 0x21,
		0x7f, 0x8b, 0x27, 0x6f, 0xad, 0x1a, 0xb6, 0x9c, 0x50, 0xf7,
		0x8b, 0xee, 0x1f, 0xa3, 0x10, 0x6e, 0xfb, 0x8c, 0xcb, 0xc7,
		0xc5, 0x14, 0x01, 0x16,
	},
	.x = {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x02,
	},
	.y = {
		0x1a, 0x8f, 0x7e, 0xda, 0x38, 0x9b, 0x09, 0x4c, 0x2c, 0x07,
		0x1e, 0x36, 0x47, 0xa8, 0x94, 0x0f, 0x3c, 0x12, 0x3b, 0x69,
		0x75, 0x78, 0xc2, 0x13, 0xbe, 0x6d, 0xd9, 0xe6, 0xc8, 0xec,
		0x73, 0x35, 0xdc, 0xb2, 0x28, 0xfd, 0x1e, 0xdf, 0x4a, 0x39,
		0x15, 0x2c, 0xbc, 0xaa, 0xf8, 0xc0, 0x39, 0x88, 0x28, 0x04,
		0x10, 0x55, 0xf9, 0x4c, 0xee, 0xec, 0x7e, 0x21, 0x34, 0x07,
		0x80, 0xfe, 0x41, 0xbd,
	},
	.order = {
		0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x01, 0x49, 0xa1, 0xec, 0x14, 0x25, 0x65, 0xa5, 0x45,
		0xac, 0xfd, 0xb7, 0x7b, 0xd9, 0xd4, 0x0c, 0xfa, 0x8b, 0x99,
		0x67, 0x12, 0x10, 0x1b, 0xea, 0x0e, 0xc6, 0x34, 0x6c, 0x54,
		0x37, 0x4f, 0x25, 0xbd,
	},
};

/*
 * This curve is defined in two birationally equal forms: canonical and Twisted
 * Edwards. We do calculations in canonical (Weierstrass) form.
 */
static const struct {
	uint8_t p[64];
	uint8_t a[64];
	uint8_t b[64];
	uint8_t x[64];
	uint8_t y[64];
	uint8_t order[64];
} _EC_GOST_2012_512_TC26_C = {
	.p = {
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xfd, 0xc7,
	},
	.a = {
		0xdc, 0x92, 0x03, 0xe5, 0x14, 0xa7, 0x21, 0x87, 0x54, 0x85,
		0xa5, 0x29, 0xd2, 0xc7, 0x22, 0xfb, 0x18, 0x7b, 0xc8, 0x98,
		0x0e, 0xb8, 0x66, 0x64, 0x4d, 0xe4, 0x1c, 0x68, 0xe1, 0x43,
		0x06, 0x45, 0x46, 0xe8, 0x61, 0xc0, 0xe2, 0xc9, 0xed, 0xd9,
		0x2a, 0xde, 0x71, 0xf4, 0x6f, 0xcf, 0x50, 0xff, 0x2a, 0xd9,
		0x7f, 0x95, 0x1f, 0xda, 0x9f, 0x2a, 0x2e, 0xb6, 0x54, 0x6f,
		0x39, 0x68, 0x9b, 0xd3,
	},
	.b = {
		0xb4, 0xc4, 0xee, 0x28, 0xce, 0xbc, 0x6c, 0x2c, 0x8a, 0xc1,
		0x29, 0x52, 0xcf, 0x37, 0xf1, 0x6a, 0xc7, 0xef, 0xb6, 0xa9,
		0xf6, 0x9f, 0x4b, 0x57, 0xff, 0xda, 0x2e, 0x4f, 0x0d, 0xe5,
		0xad, 0xe0, 0x38, 0xcb, 0xc2, 0xff, 0xf7, 0x19, 0xd2, 0xc1,
		0x8d, 0xe0, 0x28, 0x4b, 0x8b, 0xfe, 0xf3, 0xb5, 0x2b, 0x8c,
		0xc7, 0xa5, 0xf5, 0xbf, 0x0a, 0x3c, 0x8d, 0x23, 0x19, 0xa5,
		0x31, 0x25, 0x57, 0xe1,
	},
	.x = {
		0xe2, 0xe3, 0x1e, 0xdf, 0xc2, 0x3d, 0xe7, 0xbd, 0xeb, 0xe2,
		0x41, 0xce, 0x59, 0x3e, 0xf5, 0xde, 0x22, 0x95, 0xb7, 0xa9,
		0xcb, 0xae, 0xf0, 0x21, 0xd3, 0x85, 0xf7, 0x07, 0x4c, 0xea,
		0x04, 0x3a, 0xa2, 0x72, 0x72, 0xa7, 0xae, 0x60, 0x2b, 0xf2,
		0xa7, 0xb9, 0x03, 0x3d, 0xb9, 0xed, 0x36, 0x10, 0xc6, 0xfb,
		0x85, 0x48, 0x7e, 0xae, 0x97, 0xaa, 0xc5, 0xbc, 0x79, 0x28,
		0xc1, 0x95, 0x01, 0x48,
	},
	.y = {
		0xf5, 0xce, 0x40, 0xd9, 0x5b, 0x5e, 0xb8, 0x99, 0xab, 0xbc,
		0xcf, 0xf5, 0x91, 0x1c, 0xb8, 0x57, 0x79, 0x39, 0x80, 0x4d,
		0x65, 0x27, 0x37, 0x8b, 0x8c, 0x10, 0x8c, 0x3d, 0x20, 0x90,
		0xff, 0x9b, 0xe1, 0x8e, 0x2d, 0x33, 0xe3, 0x02, 0x1e, 0xd2,
		0xef, 0x32, 0xd8, 0x58, 0x22, 0x42, 0x3b, 0x63, 0x04, 0xf7,
		0x26, 0xaa, 0x85, 0x4b, 0xae, 0x07, 0xd0, 0x39, 0x6e, 0x9a,
		0x9a, 0xdd, 0xc4, 0x0f,
	},
	.order = {
		0x3f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
		0xff, 0xff, 0xc9, 0x8c, 0xdb, 0xa4, 0x65, 0x06, 0xab, 0x00,
		0x4c, 0x33, 0xa9, 0xff, 0x51, 0x47, 0x50, 0x2c, 0xc8, 0xed,
		0xa9, 0xe7, 0xa7, 0x69, 0xa1, 0x26, 0x94, 0x62, 0x3c, 0xef,
		0x47, 0xf0, 0x23, 0xed,
	},
};
#endif

static const struct ec_list_element {
	const char *comment;
	int nid;
	int seed_len;
	int param_len;
	unsigned int cofactor;
	const uint8_t *seed;
	const uint8_t *p;
	const uint8_t *a;
	const uint8_t *b;
	const uint8_t *x;
	const uint8_t *y;
	const uint8_t *order;
} curve_list[] = {
	/* secg curves */
	{
		.comment = "SECG/WTLS curve over a 112 bit prime field",
		.nid = NID_secp112r1,
		.seed_len = sizeof(_EC_SECG_PRIME_112R1.seed),
		.param_len = sizeof(_EC_SECG_PRIME_112R1.p),
		.seed = _EC_SECG_PRIME_112R1.seed,
		.p = _EC_SECG_PRIME_112R1.p,
		.a = _EC_SECG_PRIME_112R1.a,
		.b = _EC_SECG_PRIME_112R1.b,
		.x = _EC_SECG_PRIME_112R1.x,
		.y = _EC_SECG_PRIME_112R1.y,
		.order = _EC_SECG_PRIME_112R1.order,
		.cofactor = 1,
	},
	{
		.comment = "SECG curve over a 112 bit prime field",
		.nid = NID_secp112r2,
		.seed_len = sizeof(_EC_SECG_PRIME_112R2.seed),
		.param_len = sizeof(_EC_SECG_PRIME_112R2.p),
		.seed = _EC_SECG_PRIME_112R2.seed,
		.p = _EC_SECG_PRIME_112R2.p,
		.a = _EC_SECG_PRIME_112R2.a,
		.b = _EC_SECG_PRIME_112R2.b,
		.x = _EC_SECG_PRIME_112R2.x,
		.y = _EC_SECG_PRIME_112R2.y,
		.order = _EC_SECG_PRIME_112R2.order,
		.cofactor = 4,
	},
	{
		.comment = "SECG curve over a 128 bit prime field",
		.nid = NID_secp128r1,
		.seed_len = sizeof(_EC_SECG_PRIME_128R1.seed),
		.param_len = sizeof(_EC_SECG_PRIME_128R1.p),
		.seed = _EC_SECG_PRIME_128R1.seed,
		.p = _EC_SECG_PRIME_128R1.p,
		.a = _EC_SECG_PRIME_128R1.a,
		.b = _EC_SECG_PRIME_128R1.b,
		.x = _EC_SECG_PRIME_128R1.x,
		.y = _EC_SECG_PRIME_128R1.y,
		.order = _EC_SECG_PRIME_128R1.order,
		.cofactor = 1,
	},
	{
		.comment = "SECG curve over a 128 bit prime field",
		.nid = NID_secp128r2,
		.seed_len = sizeof(_EC_SECG_PRIME_128R2.seed),
		.param_len = sizeof(_EC_SECG_PRIME_128R2.p),
		.seed = _EC_SECG_PRIME_128R2.seed,
		.p = _EC_SECG_PRIME_128R2.p,
		.a = _EC_SECG_PRIME_128R2.a,
		.b = _EC_SECG_PRIME_128R2.b,
		.x = _EC_SECG_PRIME_128R2.x,
		.y = _EC_SECG_PRIME_128R2.y,
		.order = _EC_SECG_PRIME_128R2.order,
		.cofactor = 4,
	},
	{
		.comment = "SECG curve over a 160 bit prime field",
		.nid = NID_secp160k1,
		.param_len = sizeof(_EC_SECG_PRIME_160K1.p),
		.p = _EC_SECG_PRIME_160K1.p,
		.a = _EC_SECG_PRIME_160K1.a,
		.b = _EC_SECG_PRIME_160K1.b,
		.x = _EC_SECG_PRIME_160K1.x,
		.y = _EC_SECG_PRIME_160K1.y,
		.order = _EC_SECG_PRIME_160K1.order,
		.cofactor = 1,
	},
	{
		.comment = "SECG curve over a 160 bit prime field",
		.nid = NID_secp160r1,
		.seed_len = sizeof(_EC_SECG_PRIME_160R1.seed),
		.param_len = sizeof(_EC_SECG_PRIME_160R1.p),
		.seed = _EC_SECG_PRIME_160R1.seed,
		.p = _EC_SECG_PRIME_160R1.p,
		.a = _EC_SECG_PRIME_160R1.a,
		.b = _EC_SECG_PRIME_160R1.b,
		.x = _EC_SECG_PRIME_160R1.x,
		.y = _EC_SECG_PRIME_160R1.y,
		.order = _EC_SECG_PRIME_160R1.order,
		.cofactor = 1,
	},
	{
		.comment = "SECG/WTLS curve over a 160 bit prime field",
		.nid = NID_secp160r2,
		.seed_len = sizeof(_EC_SECG_PRIME_160R2.seed),
		.param_len = sizeof(_EC_SECG_PRIME_160R2.p),
		.seed = _EC_SECG_PRIME_160R2.seed,
		.p = _EC_SECG_PRIME_160R2.p,
		.a = _EC_SECG_PRIME_160R2.a,
		.b = _EC_SECG_PRIME_160R2.b,
		.x = _EC_SECG_PRIME_160R2.x,
		.y = _EC_SECG_PRIME_160R2.y,
		.order = _EC_SECG_PRIME_160R2.order,
		.cofactor = 1,
	},
	/* SECG secp192r1 is the same as X9.62 prime192v1 and hence omitted */
	{
		.comment = "SECG curve over a 192 bit prime field",
		.nid = NID_secp192k1,
		.param_len = sizeof(_EC_SECG_PRIME_192K1.p),
		.p = _EC_SECG_PRIME_192K1.p,
		.a = _EC_SECG_PRIME_192K1.a,
		.b = _EC_SECG_PRIME_192K1.b,
		.x = _EC_SECG_PRIME_192K1.x,
		.y = _EC_SECG_PRIME_192K1.y,
		.order = _EC_SECG_PRIME_192K1.order,
		.cofactor = 1,
	},
	{
		.comment = "SECG curve over a 224 bit prime field",
		.nid = NID_secp224k1,
		.param_len = sizeof(_EC_SECG_PRIME_224K1.p),
		.p = _EC_SECG_PRIME_224K1.p,
		.a = _EC_SECG_PRIME_224K1.a,
		.b = _EC_SECG_PRIME_224K1.b,
		.x = _EC_SECG_PRIME_224K1.x,
		.y = _EC_SECG_PRIME_224K1.y,
		.order = _EC_SECG_PRIME_224K1.order,
		.cofactor = 1,
	},
	{
		.comment = "NIST/SECG curve over a 224 bit prime field",
		.nid = NID_secp224r1,
		.seed_len = sizeof(_EC_NIST_PRIME_224.seed),
		.param_len = sizeof(_EC_NIST_PRIME_224.p),
		.seed = _EC_NIST_PRIME_224.seed,
		.p = _EC_NIST_PRIME_224.p,
		.a = _EC_NIST_PRIME_224.a,
		.b = _EC_NIST_PRIME_224.b,
		.x = _EC_NIST_PRIME_224.x,
		.y = _EC_NIST_PRIME_224.y,
		.order = _EC_NIST_PRIME_224.order,
		.cofactor = 1,
	},
	{
		.comment = "SECG curve over a 256 bit prime field",
		.nid = NID_secp256k1,
		.param_len = sizeof(_EC_SECG_PRIME_256K1.p),
		.p = _EC_SECG_PRIME_256K1.p,
		.a = _EC_SECG_PRIME_256K1.a,
		.b = _EC_SECG_PRIME_256K1.b,
		.x = _EC_SECG_PRIME_256K1.x,
		.y = _EC_SECG_PRIME_256K1.y,
		.order = _EC_SECG_PRIME_256K1.order,
		.cofactor = 1,
	},
	/* SECG secp256r1 is the same as X9.62 prime256v1 and hence omitted */
	{
		.comment = "NIST/SECG curve over a 384 bit prime field",
		.nid = NID_secp384r1,
		.seed_len = sizeof(_EC_NIST_PRIME_384.seed),
		.param_len = sizeof(_EC_NIST_PRIME_384.p),
		.seed = _EC_NIST_PRIME_384.seed,
		.p = _EC_NIST_PRIME_384.p,
		.a = _EC_NIST_PRIME_384.a,
		.b = _EC_NIST_PRIME_384.b,
		.x = _EC_NIST_PRIME_384.x,
		.y = _EC_NIST_PRIME_384.y,
		.order = _EC_NIST_PRIME_384.order,
		.cofactor = 1,
	},
	{
		.comment = "NIST/SECG curve over a 521 bit prime field",
		.nid = NID_secp521r1,
		.seed_len = sizeof(_EC_NIST_PRIME_521.seed),
		.param_len = sizeof(_EC_NIST_PRIME_521.p),
		.seed = _EC_NIST_PRIME_521.seed,
		.p = _EC_NIST_PRIME_521.p,
		.a = _EC_NIST_PRIME_521.a,
		.b = _EC_NIST_PRIME_521.b,
		.x = _EC_NIST_PRIME_521.x,
		.y = _EC_NIST_PRIME_521.y,
		.order = _EC_NIST_PRIME_521.order,
		.cofactor = 1,
	},
	/* X9.62 curves */
	{
		.comment = "NIST/X9.62/SECG curve over a 192 bit prime field",
		.nid = NID_X9_62_prime192v1,
		.seed_len = sizeof(_EC_NIST_PRIME_192.seed),
		.param_len = sizeof(_EC_NIST_PRIME_192.p),
		.seed = _EC_NIST_PRIME_192.seed,
		.p = _EC_NIST_PRIME_192.p,
		.a = _EC_NIST_PRIME_192.a,
		.b = _EC_NIST_PRIME_192.b,
		.x = _EC_NIST_PRIME_192.x,
		.y = _EC_NIST_PRIME_192.y,
		.order = _EC_NIST_PRIME_192.order,
		.cofactor = 1,
	},
	{
		.comment = "X9.62 curve over a 192 bit prime field",
		.nid = NID_X9_62_prime192v2,
		.seed_len = sizeof(_EC_X9_62_PRIME_192V2.seed),
		.param_len = sizeof(_EC_X9_62_PRIME_192V2.p),
		.seed = _EC_X9_62_PRIME_192V2.seed,
		.p = _EC_X9_62_PRIME_192V2.p,
		.a = _EC_X9_62_PRIME_192V2.a,
		.b = _EC_X9_62_PRIME_192V2.b,
		.x = _EC_X9_62_PRIME_192V2.x,
		.y = _EC_X9_62_PRIME_192V2.y,
		.order = _EC_X9_62_PRIME_192V2.order,
		.cofactor = 1,
	},
	{
		.comment = "X9.62 curve over a 192 bit prime field",
		.nid = NID_X9_62_prime192v3,
		.seed_len = sizeof(_EC_X9_62_PRIME_192V3.seed),
		.param_len = sizeof(_EC_X9_62_PRIME_192V3.p),
		.seed = _EC_X9_62_PRIME_192V3.seed,
		.p = _EC_X9_62_PRIME_192V3.p,
		.a = _EC_X9_62_PRIME_192V3.a,
		.b = _EC_X9_62_PRIME_192V3.b,
		.x = _EC_X9_62_PRIME_192V3.x,
		.y = _EC_X9_62_PRIME_192V3.y,
		.order = _EC_X9_62_PRIME_192V3.order,
		.cofactor = 1,
	},
	{
		.comment = "X9.62 curve over a 239 bit prime field",
		.nid = NID_X9_62_prime239v1,
		.seed_len = sizeof(_EC_X9_62_PRIME_239V1.seed),
		.param_len = sizeof(_EC_X9_62_PRIME_239V1.p),
		.seed = _EC_X9_62_PRIME_239V1.seed,
		.p = _EC_X9_62_PRIME_239V1.p,
		.a = _EC_X9_62_PRIME_239V1.a,
		.b = _EC_X9_62_PRIME_239V1.b,
		.x = _EC_X9_62_PRIME_239V1.x,
		.y = _EC_X9_62_PRIME_239V1.y,
		.order = _EC_X9_62_PRIME_239V1.order,
		.cofactor = 1,
	},
	{
		.comment = "X9.62 curve over a 239 bit prime field",
		.nid = NID_X9_62_prime239v2,
		.seed_len = sizeof(_EC_X9_62_PRIME_239V2.seed),
		.param_len = sizeof(_EC_X9_62_PRIME_239V2.p),
		.seed = _EC_X9_62_PRIME_239V2.seed,
		.p = _EC_X9_62_PRIME_239V2.p,
		.a = _EC_X9_62_PRIME_239V2.a,
		.b = _EC_X9_62_PRIME_239V2.b,
		.x = _EC_X9_62_PRIME_239V2.x,
		.y = _EC_X9_62_PRIME_239V2.y,
		.order = _EC_X9_62_PRIME_239V2.order,
		.cofactor = 1,
	},
	{
		.comment = "X9.62 curve over a 239 bit prime field",
		.nid = NID_X9_62_prime239v3,
		.seed_len = sizeof(_EC_X9_62_PRIME_239V3.seed),
		.param_len = sizeof(_EC_X9_62_PRIME_239V3.p),
		.seed = _EC_X9_62_PRIME_239V3.seed,
		.p = _EC_X9_62_PRIME_239V3.p,
		.a = _EC_X9_62_PRIME_239V3.a,
		.b = _EC_X9_62_PRIME_239V3.b,
		.x = _EC_X9_62_PRIME_239V3.x,
		.y = _EC_X9_62_PRIME_239V3.y,
		.order = _EC_X9_62_PRIME_239V3.order,
		.cofactor = 1,
	},
	{
		.comment = "X9.62/SECG curve over a 256 bit prime field",
		.nid = NID_X9_62_prime256v1,
		.seed_len = sizeof(_EC_X9_62_PRIME_256V1.seed),
		.param_len = sizeof(_EC_X9_62_PRIME_256V1.p),
		.seed = _EC_X9_62_PRIME_256V1.seed,
		.p = _EC_X9_62_PRIME_256V1.p,
		.a = _EC_X9_62_PRIME_256V1.a,
		.b = _EC_X9_62_PRIME_256V1.b,
		.x = _EC_X9_62_PRIME_256V1.x,
		.y = _EC_X9_62_PRIME_256V1.y,
		.order = _EC_X9_62_PRIME_256V1.order,
		.cofactor = 1,
	},
	{
		.comment = "SECG/WTLS curve over a 112 bit prime field",
		.nid = NID_wap_wsg_idm_ecid_wtls6,
		.seed_len = sizeof(_EC_SECG_PRIME_112R1.seed),
		.param_len = sizeof(_EC_SECG_PRIME_112R1.p),
		.seed = _EC_SECG_PRIME_112R1.seed,
		.p = _EC_SECG_PRIME_112R1.p,
		.a = _EC_SECG_PRIME_112R1.a,
		.b = _EC_SECG_PRIME_112R1.b,
		.x = _EC_SECG_PRIME_112R1.x,
		.y = _EC_SECG_PRIME_112R1.y,
		.order = _EC_SECG_PRIME_112R1.order,
		.cofactor = 1,
	},
	{
		.comment = "SECG/WTLS curve over a 160 bit prime field",
		.nid = NID_wap_wsg_idm_ecid_wtls7,
		.seed_len = sizeof(_EC_SECG_PRIME_160R2.seed),
		.param_len = sizeof(_EC_SECG_PRIME_160R2.p),
		.seed = _EC_SECG_PRIME_160R2.seed,
		.p = _EC_SECG_PRIME_160R2.p,
		.a = _EC_SECG_PRIME_160R2.a,
		.b = _EC_SECG_PRIME_160R2.b,
		.x = _EC_SECG_PRIME_160R2.x,
		.y = _EC_SECG_PRIME_160R2.y,
		.order = _EC_SECG_PRIME_160R2.order,
		.cofactor = 1,
	},
	{
		.comment = "WTLS curve over a 112 bit prime field",
		.nid = NID_wap_wsg_idm_ecid_wtls8,
		.param_len = sizeof(_EC_WTLS_8.p),
		.p = _EC_WTLS_8.p,
		.a = _EC_WTLS_8.a,
		.b = _EC_WTLS_8.b,
		.x = _EC_WTLS_8.x,
		.y = _EC_WTLS_8.y,
		.order = _EC_WTLS_8.order,
		.cofactor = 1,
	},
	{
		.comment = "WTLS curve over a 160 bit prime field",
		.nid = NID_wap_wsg_idm_ecid_wtls9,
		.param_len = sizeof(_EC_WTLS_9.p),
		.p = _EC_WTLS_9.p,
		.a = _EC_WTLS_9.a,
		.b = _EC_WTLS_9.b,
		.x = _EC_WTLS_9.x,
		.y = _EC_WTLS_9.y,
		.order = _EC_WTLS_9.order,
		.cofactor = 1,
	},
	{
		.comment = "WTLS curve over a 224 bit prime field",
		.nid = NID_wap_wsg_idm_ecid_wtls12,
		.param_len = sizeof(_EC_WTLS_12.p),
		.p = _EC_WTLS_12.p,
		.a = _EC_WTLS_12.a,
		.b = _EC_WTLS_12.b,
		.x = _EC_WTLS_12.x,
		.y = _EC_WTLS_12.y,
		.order = _EC_WTLS_12.order,
		.cofactor = 1,
	},
	/* RFC 5639 curves */
	{
		.comment = "RFC 5639 curve over a 160 bit prime field",
		.nid = NID_brainpoolP160r1,
		.param_len = sizeof(_EC_brainpoolP160r1.p),
		.p = _EC_brainpoolP160r1.p,
		.a = _EC_brainpoolP160r1.a,
		.b = _EC_brainpoolP160r1.b,
		.x = _EC_brainpoolP160r1.x,
		.y = _EC_brainpoolP160r1.y,
		.order = _EC_brainpoolP160r1.order,
		.cofactor = 1,
	},
	{
		.comment = "RFC 5639 curve over a 160 bit prime field",
		.nid = NID_brainpoolP160t1,
		.param_len = sizeof(_EC_brainpoolP160t1.p),
		.p = _EC_brainpoolP160t1.p,
		.a = _EC_brainpoolP160t1.a,
		.b = _EC_brainpoolP160t1.b,
		.x = _EC_brainpoolP160t1.x,
		.y = _EC_brainpoolP160t1.y,
		.order = _EC_brainpoolP160t1.order,
		.cofactor = 1,
	},
	{
		.comment = "RFC 5639 curve over a 192 bit prime field",
		.nid = NID_brainpoolP192r1,
		.param_len = sizeof(_EC_brainpoolP192r1.p),
		.p = _EC_brainpoolP192r1.p,
		.a = _EC_brainpoolP192r1.a,
		.b = _EC_brainpoolP192r1.b,
		.x = _EC_brainpoolP192r1.x,
		.y = _EC_brainpoolP192r1.y,
		.order = _EC_brainpoolP192r1.order,
		.cofactor = 1,
	},
	{
		.comment = "RFC 5639 curve over a 192 bit prime field",
		.nid = NID_brainpoolP192t1,
		.param_len = sizeof(_EC_brainpoolP192t1.p),
		.p = _EC_brainpoolP192t1.p,
		.a = _EC_brainpoolP192t1.a,
		.b = _EC_brainpoolP192t1.b,
		.x = _EC_brainpoolP192t1.x,
		.y = _EC_brainpoolP192t1.y,
		.order = _EC_brainpoolP192t1.order,
		.cofactor = 1,
	},
	{
		.comment = "RFC 5639 curve over a 224 bit prime field",
		.nid = NID_brainpoolP224r1,
		.param_len = sizeof(_EC_brainpoolP224r1.p),
		.p = _EC_brainpoolP224r1.p,
		.a = _EC_brainpoolP224r1.a,
		.b = _EC_brainpoolP224r1.b,
		.x = _EC_brainpoolP224r1.x,
		.y = _EC_brainpoolP224r1.y,
		.order = _EC_brainpoolP224r1.order,
		.cofactor = 1,
	},
	{
		.comment = "RFC 5639 curve over a 224 bit prime field",
		.nid = NID_brainpoolP224t1,
		.param_len = sizeof(_EC_brainpoolP224t1.p),
		.p = _EC_brainpoolP224t1.p,
		.a = _EC_brainpoolP224t1.a,
		.b = _EC_brainpoolP224t1.b,
		.x = _EC_brainpoolP224t1.x,
		.y = _EC_brainpoolP224t1.y,
		.order = _EC_brainpoolP224t1.order,
		.cofactor = 1,
	},
	{
		.comment = "RFC 5639 curve over a 256 bit prime field",
		.nid = NID_brainpoolP256r1,
		.param_len = sizeof(_EC_brainpoolP256r1.p),
		.p = _EC_brainpoolP256r1.p,
		.a = _EC_brainpoolP256r1.a,
		.b = _EC_brainpoolP256r1.b,
		.x = _EC_brainpoolP256r1.x,
		.y = _EC_brainpoolP256r1.y,
		.order = _EC_brainpoolP256r1.order,
		.cofactor = 1,
	},
	{
		.comment = "RFC 5639 curve over a 256 bit prime field",
		.nid = NID_brainpoolP256t1,
		.param_len = sizeof(_EC_brainpoolP256t1.p),
		.p = _EC_brainpoolP256t1.p,
		.a = _EC_brainpoolP256t1.a,
		.b = _EC_brainpoolP256t1.b,
		.x = _EC_brainpoolP256t1.x,
		.y = _EC_brainpoolP256t1.y,
		.order = _EC_brainpoolP256t1.order,
		.cofactor = 1,
	},
	{
		.comment = "RFC 5639 curve over a 320 bit prime field",
		.nid = NID_brainpoolP320r1,
		.param_len = sizeof(_EC_brainpoolP320r1.p),
		.p = _EC_brainpoolP320r1.p,
		.a = _EC_brainpoolP320r1.a,
		.b = _EC_brainpoolP320r1.b,
		.x = _EC_brainpoolP320r1.x,
		.y = _EC_brainpoolP320r1.y,
		.order = _EC_brainpoolP320r1.order,
		.cofactor = 1,
	},
	{
		.comment = "RFC 5639 curve over a 320 bit prime field",
		.nid = NID_brainpoolP320t1,
		.param_len = sizeof(_EC_brainpoolP320t1.p),
		.p = _EC_brainpoolP320t1.p,
		.a = _EC_brainpoolP320t1.a,
		.b = _EC_brainpoolP320t1.b,
		.x = _EC_brainpoolP320t1.x,
		.y = _EC_brainpoolP320t1.y,
		.order = _EC_brainpoolP320t1.order,
		.cofactor = 1,
	},
	{
		.comment = "RFC 5639 curve over a 384 bit prime field",
		.nid = NID_brainpoolP384r1,
		.param_len = sizeof(_EC_brainpoolP384r1.p),
		.p = _EC_brainpoolP384r1.p,
		.a = _EC_brainpoolP384r1.a,
		.b = _EC_brainpoolP384r1.b,
		.x = _EC_brainpoolP384r1.x,
		.y = _EC_brainpoolP384r1.y,
		.order = _EC_brainpoolP384r1.order,
		.cofactor = 1,
	},
	{
		.comment = "RFC 5639 curve over a 384 bit prime field",
		.nid = NID_brainpoolP384t1,
		.param_len = sizeof(_EC_brainpoolP384t1.p),
		.p = _EC_brainpoolP384t1.p,
		.a = _EC_brainpoolP384t1.a,
		.b = _EC_brainpoolP384t1.b,
		.x = _EC_brainpoolP384t1.x,
		.y = _EC_brainpoolP384t1.y,
		.order = _EC_brainpoolP384t1.order,
		.cofactor = 1,
	},
	{
		.comment = "RFC 5639 curve over a 512 bit prime field",
		.nid = NID_brainpoolP512r1,
		.param_len = sizeof(_EC_brainpoolP512r1.p),
		.p = _EC_brainpoolP512r1.p,
		.a = _EC_brainpoolP512r1.a,
		.b = _EC_brainpoolP512r1.b,
		.x = _EC_brainpoolP512r1.x,
		.y = _EC_brainpoolP512r1.y,
		.order = _EC_brainpoolP512r1.order,
		.cofactor = 1,
	},
	{
		.comment = "RFC 5639 curve over a 512 bit prime field",
		.nid = NID_brainpoolP512t1,
		.param_len = sizeof(_EC_brainpoolP512t1.p),
		.p = _EC_brainpoolP512t1.p,
		.a = _EC_brainpoolP512t1.a,
		.b = _EC_brainpoolP512t1.b,
		.x = _EC_brainpoolP512t1.x,
		.y = _EC_brainpoolP512t1.y,
		.order = _EC_brainpoolP512t1.order,
		.cofactor = 1,
	},
	/* ANSSI */
	{
		.comment = "FRP256v1",
		.nid = NID_FRP256v1,
		.param_len = sizeof(_EC_FRP256v1.p),
		.p = _EC_FRP256v1.p,
		.a = _EC_FRP256v1.a,
		.b = _EC_FRP256v1.b,
		.x = _EC_FRP256v1.x,
		.y = _EC_FRP256v1.y,
		.order = _EC_FRP256v1.order,
		.cofactor = 1,
	},
#ifndef OPENSSL_NO_GOST
	/* GOST R 34.10-2001 */
	{
		.comment = "GOST R 34.10-2001 Test Curve",
		.nid = NID_id_GostR3410_2001_TestParamSet,
		.param_len = sizeof(_EC_GOST_2001_Test.p),
		.p = _EC_GOST_2001_Test.p,
		.a = _EC_GOST_2001_Test.a,
		.b = _EC_GOST_2001_Test.b,
		.x = _EC_GOST_2001_Test.x,
		.y = _EC_GOST_2001_Test.y,
		.order = _EC_GOST_2001_Test.order,
		.cofactor = 1,
	},
	{
		.comment = "GOST R 34.10-2001 CryptoPro-A",
		.nid = NID_id_GostR3410_2001_CryptoPro_A_ParamSet,
		.param_len = sizeof(_EC_GOST_2001_CryptoPro_A.p),
		.p = _EC_GOST_2001_CryptoPro_A.p,
		.a = _EC_GOST_2001_CryptoPro_A.a,
		.b = _EC_GOST_2001_CryptoPro_A.b,
		.x = _EC_GOST_2001_CryptoPro_A.x,
		.y = _EC_GOST_2001_CryptoPro_A.y,
		.order = _EC_GOST_2001_CryptoPro_A.order,
		.cofactor = 1,
	},
	{
		.comment = "GOST R 34.10-2001 CryptoPro-B",
		.nid = NID_id_GostR3410_2001_CryptoPro_B_ParamSet,
		.param_len = sizeof(_EC_GOST_2001_CryptoPro_B.p),
		.p = _EC_GOST_2001_CryptoPro_B.p,
		.a = _EC_GOST_2001_CryptoPro_B.a,
		.b = _EC_GOST_2001_CryptoPro_B.b,
		.x = _EC_GOST_2001_CryptoPro_B.x,
		.y = _EC_GOST_2001_CryptoPro_B.y,
		.order = _EC_GOST_2001_CryptoPro_B.order,
		.cofactor = 1,
	},
	{
		.comment = "GOST R 34.10-2001 CryptoPro-C",
		.nid = NID_id_GostR3410_2001_CryptoPro_C_ParamSet,
		.param_len = sizeof(_EC_GOST_2001_CryptoPro_C.p),
		.p = _EC_GOST_2001_CryptoPro_C.p,
		.a = _EC_GOST_2001_CryptoPro_C.a,
		.b = _EC_GOST_2001_CryptoPro_C.b,
		.x = _EC_GOST_2001_CryptoPro_C.x,
		.y = _EC_GOST_2001_CryptoPro_C.y,
		.order = _EC_GOST_2001_CryptoPro_C.order,
		.cofactor = 1,
	},
	{
		.comment = "GOST R 34.10-2001 CryptoPro-XchA",
		.nid = NID_id_GostR3410_2001_CryptoPro_XchA_ParamSet,
		.param_len = sizeof(_EC_GOST_2001_CryptoPro_A.p),
		.p = _EC_GOST_2001_CryptoPro_A.p,
		.a = _EC_GOST_2001_CryptoPro_A.a,
		.b = _EC_GOST_2001_CryptoPro_A.b,
		.x = _EC_GOST_2001_CryptoPro_A.x,
		.y = _EC_GOST_2001_CryptoPro_A.y,
		.order = _EC_GOST_2001_CryptoPro_A.order,
		.cofactor = 1,
	},
	{
		.comment = "GOST R 34.10-2001 CryptoPro-XchB",
		.nid = NID_id_GostR3410_2001_CryptoPro_XchB_ParamSet,
		.param_len = sizeof(_EC_GOST_2001_CryptoPro_C.p),
		.p = _EC_GOST_2001_CryptoPro_C.p,
		.a = _EC_GOST_2001_CryptoPro_C.a,
		.b = _EC_GOST_2001_CryptoPro_C.b,
		.x = _EC_GOST_2001_CryptoPro_C.x,
		.y = _EC_GOST_2001_CryptoPro_C.y,
		.order = _EC_GOST_2001_CryptoPro_C.order,
		.cofactor = 1,
	},
	{
		.comment = "GOST R 34.10-2012 256 TC26-A",
		.nid = NID_id_tc26_gost_3410_12_256_paramSetA,
		.param_len = sizeof(_EC_GOST_2012_256_TC26_A.p),
		.p = _EC_GOST_2012_256_TC26_A.p,
		.a = _EC_GOST_2012_256_TC26_A.a,
		.b = _EC_GOST_2012_256_TC26_A.b,
		.x = _EC_GOST_2012_256_TC26_A.x,
		.y = _EC_GOST_2012_256_TC26_A.y,
		.order = _EC_GOST_2012_256_TC26_A.order,
		.cofactor = 4,
	},
	{
		.comment = "GOST R 34.10-2012 256 TC26-B",
		.nid = NID_id_tc26_gost_3410_12_256_paramSetB,
		.param_len = sizeof(_EC_GOST_2001_CryptoPro_A.p),
		.p = _EC_GOST_2001_CryptoPro_A.p,
		.a = _EC_GOST_2001_CryptoPro_A.a,
		.b = _EC_GOST_2001_CryptoPro_A.b,
		.x = _EC_GOST_2001_CryptoPro_A.x,
		.y = _EC_GOST_2001_CryptoPro_A.y,
		.order = _EC_GOST_2001_CryptoPro_A.order,
		.cofactor = 1,
	},
	{
		.comment = "GOST R 34.10-2012 256 TC26-C",
		.nid = NID_id_tc26_gost_3410_12_256_paramSetC,
		.param_len = sizeof(_EC_GOST_2001_CryptoPro_B.p),
		.p = _EC_GOST_2001_CryptoPro_B.p,
		.a = _EC_GOST_2001_CryptoPro_B.a,
		.b = _EC_GOST_2001_CryptoPro_B.b,
		.x = _EC_GOST_2001_CryptoPro_B.x,
		.y = _EC_GOST_2001_CryptoPro_B.y,
		.order = _EC_GOST_2001_CryptoPro_B.order,
		.cofactor = 1,
	},
	{
		.comment = "GOST R 34.10-2012 256 TC26-D",
		.nid = NID_id_tc26_gost_3410_12_256_paramSetD,
		.param_len = sizeof(_EC_GOST_2001_CryptoPro_C.p),
		.p = _EC_GOST_2001_CryptoPro_C.p,
		.a = _EC_GOST_2001_CryptoPro_C.a,
		.b = _EC_GOST_2001_CryptoPro_C.b,
		.x = _EC_GOST_2001_CryptoPro_C.x,
		.y = _EC_GOST_2001_CryptoPro_C.y,
		.order = _EC_GOST_2001_CryptoPro_C.order,
		.cofactor = 1,
	},
	{
		.comment = "GOST R 34.10-2012 512 Test Curve",
		.nid = NID_id_tc26_gost_3410_12_512_paramSetTest,
		.param_len = sizeof(_EC_GOST_2012_512_Test.p),
		.p = _EC_GOST_2012_512_Test.p,
		.a = _EC_GOST_2012_512_Test.a,
		.b = _EC_GOST_2012_512_Test.b,
		.x = _EC_GOST_2012_512_Test.x,
		.y = _EC_GOST_2012_512_Test.y,
		.order = _EC_GOST_2012_512_Test.order,
		.cofactor = 1,
	},
	{
		.comment = "GOST R 34.10-2012 512 TC26-A",
		.nid = NID_id_tc26_gost_3410_12_512_paramSetA,
		.param_len = sizeof(_EC_GOST_2012_512_TC26_A.p),
		.p = _EC_GOST_2012_512_TC26_A.p,
		.a = _EC_GOST_2012_512_TC26_A.a,
		.b = _EC_GOST_2012_512_TC26_A.b,
		.x = _EC_GOST_2012_512_TC26_A.x,
		.y = _EC_GOST_2012_512_TC26_A.y,
		.order = _EC_GOST_2012_512_TC26_A.order,
		.cofactor = 1,
	},
	{
		.comment = "GOST R 34.10-2012 512 TC26-B",
		.nid = NID_id_tc26_gost_3410_12_512_paramSetB,
		.param_len = sizeof(_EC_GOST_2012_512_TC26_B.p),
		.p = _EC_GOST_2012_512_TC26_B.p,
		.a = _EC_GOST_2012_512_TC26_B.a,
		.b = _EC_GOST_2012_512_TC26_B.b,
		.x = _EC_GOST_2012_512_TC26_B.x,
		.y = _EC_GOST_2012_512_TC26_B.y,
		.order = _EC_GOST_2012_512_TC26_B.order,
		.cofactor = 1,
	},
	{
		.comment = "GOST R 34.10-2012 512 TC26-C",
		.nid = NID_id_tc26_gost_3410_12_512_paramSetC,
		.param_len = sizeof(_EC_GOST_2012_512_TC26_C.p),
		.p = _EC_GOST_2012_512_TC26_C.p,
		.a = _EC_GOST_2012_512_TC26_C.a,
		.b = _EC_GOST_2012_512_TC26_C.b,
		.x = _EC_GOST_2012_512_TC26_C.x,
		.y = _EC_GOST_2012_512_TC26_C.y,
		.order = _EC_GOST_2012_512_TC26_C.order,
		.cofactor = 4,
	},
#endif
};

#define curve_list_length (sizeof(curve_list) / sizeof(curve_list[0]))

static EC_GROUP *
ec_group_new_from_data(const struct ec_list_element *curve)
{
	EC_GROUP *group = NULL;
	EC_POINT *P = NULL;
	BN_CTX *ctx = NULL;
	BIGNUM *p, *a, *b, *x, *y, *order, *cofactor;
	int ok = 0;

	if ((ctx = BN_CTX_new()) == NULL) {
		ECerror(ERR_R_MALLOC_FAILURE);
		goto err;
	}
	BN_CTX_start(ctx);

	if ((p = BN_CTX_get(ctx)) == NULL) {
		ECerror(ERR_R_BN_LIB);
		goto err;
	}
	if ((a = BN_CTX_get(ctx)) == NULL) {
		ECerror(ERR_R_BN_LIB);
		goto err;
	}
	if ((b = BN_CTX_get(ctx)) == NULL) {
		ECerror(ERR_R_BN_LIB);
		goto err;
	}
	if ((x = BN_CTX_get(ctx)) == NULL) {
		ECerror(ERR_R_BN_LIB);
		goto err;
	}
	if ((y = BN_CTX_get(ctx)) == NULL) {
		ECerror(ERR_R_BN_LIB);
		goto err;
	}
	if ((order = BN_CTX_get(ctx)) == NULL) {
		ECerror(ERR_R_BN_LIB);
		goto err;
	}
	if ((cofactor = BN_CTX_get(ctx)) == NULL) {
		ECerror(ERR_R_BN_LIB);
		goto err;
	}

	if (BN_bin2bn(curve->p, curve->param_len, p) == NULL) {
		ECerror(ERR_R_BN_LIB);
		goto err;
	}
	if (BN_bin2bn(curve->a, curve->param_len, a) == NULL) {
		ECerror(ERR_R_BN_LIB);
		goto err;
	}
	if (BN_bin2bn(curve->b, curve->param_len, b) == NULL) {
		ECerror(ERR_R_BN_LIB);
		goto err;
	}
	if ((group = EC_GROUP_new_curve_GFp(p, a, b, ctx)) == NULL) {
		ECerror(ERR_R_EC_LIB);
		goto err;
	}

	if ((P = EC_POINT_new(group)) == NULL) {
		ECerror(ERR_R_EC_LIB);
		goto err;
	}
	if (BN_bin2bn(curve->x, curve->param_len, x) == NULL) {
		ECerror(ERR_R_BN_LIB);
		goto err;
	}
	if (BN_bin2bn(curve->y, curve->param_len, y) == NULL) {
		ECerror(ERR_R_BN_LIB);
		goto err;
	}
	if (!EC_POINT_set_affine_coordinates(group, P, x, y, ctx)) {
		ECerror(ERR_R_EC_LIB);
		goto err;
	}
	if (BN_bin2bn(curve->order, curve->param_len, order) == NULL) {
		ECerror(ERR_R_EC_LIB);
		goto err;
	}
	if (!BN_set_word(cofactor, curve->cofactor)) {
		ECerror(ERR_R_BN_LIB);
		goto err;
	}
	if (!EC_GROUP_set_generator(group, P, order, cofactor)) {
		ECerror(ERR_R_EC_LIB);
		goto err;
	}
	if (curve->seed != NULL) {
		if (!EC_GROUP_set_seed(group, curve->seed, curve->seed_len)) {
			ECerror(ERR_R_EC_LIB);
			goto err;
		}
	}
	ok = 1;
 err:
	if (!ok) {
		EC_GROUP_free(group);
		group = NULL;
	}
	EC_POINT_free(P);
	BN_CTX_end(ctx);
	BN_CTX_free(ctx);

	return group;
}

EC_GROUP *
EC_GROUP_new_by_curve_name(int nid)
{
	size_t i;
	EC_GROUP *ret = NULL;

	if (nid <= 0)
		return NULL;

	for (i = 0; i < curve_list_length; i++)
		if (curve_list[i].nid == nid) {
			ret = ec_group_new_from_data(&curve_list[i]);
			break;
		}
	if (ret == NULL) {
		ECerror(EC_R_UNKNOWN_GROUP);
		return NULL;
	}
	EC_GROUP_set_curve_name(ret, nid);

	return ret;
}

size_t
EC_get_builtin_curves(EC_builtin_curve *r, size_t nitems)
{
	size_t i, min;

	if (r == NULL || nitems == 0)
		return curve_list_length;

	min = nitems < curve_list_length ? nitems : curve_list_length;

	for (i = 0; i < min; i++) {
		r[i].nid = curve_list[i].nid;
		r[i].comment = curve_list[i].comment;
	}

	return curve_list_length;
}

static const struct {
	const char *name;
	int nid;
} nist_curves[] = {
	{ "B-163", NID_sect163r2 },
	{ "B-233", NID_sect233r1 },
	{ "B-283", NID_sect283r1 },
	{ "B-409", NID_sect409r1 },
	{ "B-571", NID_sect571r1 },
	{ "K-163", NID_sect163k1 },
	{ "K-233", NID_sect233k1 },
	{ "K-283", NID_sect283k1 },
	{ "K-409", NID_sect409k1 },
	{ "K-571", NID_sect571k1 },
	{ "P-192", NID_X9_62_prime192v1 },
	{ "P-224", NID_secp224r1 },
	{ "P-256", NID_X9_62_prime256v1 },
	{ "P-384", NID_secp384r1 },
	{ "P-521", NID_secp521r1 }
};

const char *
EC_curve_nid2nist(int nid)
{
	size_t i;

	for (i = 0; i < sizeof(nist_curves) / sizeof(nist_curves[0]); i++) {
		if (nist_curves[i].nid == nid)
			return nist_curves[i].name;
	}

	return NULL;
}

int
EC_curve_nist2nid(const char *name)
{
	size_t i;

	for (i = 0; i < sizeof(nist_curves) / sizeof(nist_curves[0]); i++) {
		if (strcmp(nist_curves[i].name, name) == 0)
			return nist_curves[i].nid;
	}

	return NID_undef;
}