generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

add support for elliptic curves over binary fields

Browse Source 
Submitted by: Duglas Stebila <douglas.stebila@sun.com>,
              Sheueling Chang <sheueling.chang@sun.com>

(CHANGES entries by Bodo Moeller)
This commit is contained in:
Bodo Möller 2002-08-02 13:42:24 +00:00
parent 714df32e33
commit 7793f30e09
17 changed files with 3283 additions and 147 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
CHANGES
View File

@ -4,6 +4,70 @@
Changes between 0.9.7 and 0.9.8 [xx XXX 2002]
*) Add named elliptic curves over binary fields from X9.62, SECG,
and WAP/WTLS; add OIDs that were still missing.
[Sheueling Chang Shantz and Douglas Stebila
(Sun Microsystems Laboratories)]
*) Extend the EC library for elliptic curves over binary fields
(new files ec2_smpl.c, ec2_smpt.c, ec2_mult.c in crypto/ec/).
New EC_METHOD:
EC_GF2m_simple_method
New API functions:
EC_GROUP_new_curve_GF2m
EC_GROUP_set_curve_GF2m
EC_GROUP_get_curve_GF2m
EC_POINT_set_Jprojective_coordinates_GF2m
EC_POINT_get_Jprojective_coordinates_GF2m
EC_POINT_set_affine_coordinates_GF2m
EC_POINT_get_affine_coordinates_GF2m
EC_POINT_set_compressed_coordinates_GF2m
Point compression for binary fields is disabled by default for
patent reasons (compile with OPENSSL_EC_BIN_PT_COMP defined to
enable it).
As binary polynomials are represented as BIGNUMs, various members
of the EC_GROUP and EC_POINT data structures can be shared
between the implementations for prime fields and binary fields;
the above ..._GF2m functions (except for EX_GROUP_new_curve_GF2m)
are essentially identical to their ..._GFp counterparts.
(For simplicity, '..._GFp' prefix has been dropped from various
internal method names.)
An internal 'field_div' method (similar to 'field_mul' and
'field_sqr') has been added; this is used only for binary fields.
[Sheueling Chang Shantz and Douglas Stebila
(Sun Microsystems Laboratories)]
*) Optionally dispatch EC_PONT_mul(), EC_POINT_precompute_mult()
through methods ('mul', 'precompute_mult').
The generic implementations (now internally called 'ec_wNAF_mul'
and 'ec_wNAF_precomputed_mult') remain the default if these
methods are undefined.
[Sheueling Chang Shantz and Douglas Stebila
(Sun Microsystems Laboratories)]
*) New function EC_GROUP_get_degree, which is defined through
EC_METHOD. For curves over prime fields, this returns the bit
length of the modulus.
[Sheueling Chang Shantz and Douglas Stebila
(Sun Microsystems Laboratories)]
*) New functions EC_GROUP_dup, EC_POINT_dup.
(These simply call ..._new and ..._copy).
[Sheueling Chang Shantz and Douglas Stebila
(Sun Microsystems Laboratories)]
*) Add binary polynomial arithmetic software in crypto/bn/bn_gf2m.c.
Polynomials are represented as BIGNUMs (where the sign bit is not
used) in the following functions [macros]:
@ -56,9 +120,6 @@ TBD ... OPENSSL_NO_SUN_DIV ... --Bodo
[Sheueling Chang Shantz and Douglas Stebila
(Sun Microsystems Laboratories)]
*) Add more WAP/WTLS elliptic curve OIDs.
[Douglas Stebila <douglas.stebila@sun.com>]
*) Add new error code 'ERR_R_DISABLED' that can be used when some
functionality is disabled at compile-time.
[Douglas Stebila <douglas.stebila@sun.com>]

18
crypto/ec/Makefile.ssl
View File

@ -24,10 +24,10 @@ APPS=
LIB=$(TOP)/libcrypto.a
LIBSRC= ec_lib.c ecp_smpl.c ecp_mont.c ecp_recp.c ecp_nist.c ec_cvt.c ec_mult.c \
ec_err.c ec_curve.c ec_check.c ec_print.c ec_asn1.c
ec_err.c ec_curve.c ec_check.c ec_print.c ec_asn1.c ec2_smpl.c ec2_mult.c
LIBOBJ= ec_lib.o ecp_smpl.o ecp_mont.o ecp_recp.o ecp_nist.o ec_cvt.o ec_mult.o \
ec_err.o ec_curve.o ec_check.o ec_print.o ec_asn1.o
ec_err.o ec_curve.o ec_check.o ec_print.o ec_asn1.o ec2_smpl.o ec2_mult.o
SRC= $(LIBSRC)
@ -176,3 +176,17 @@ ecp_smpl.o: ../../include/openssl/obj_mac.h ../../include/openssl/opensslconf.h
ecp_smpl.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
ecp_smpl.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
ecp_smpl.o: ../../include/openssl/symhacks.h ec_lcl.h ecp_smpl.c
ec2_smpl.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
ec2_smpl.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
ec2_smpl.o: ../../include/openssl/ec.h ../../include/openssl/err.h
ec2_smpl.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
ec2_smpl.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
ec2_smpl.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
ec2_smpl.o: ec_lcl.h ec2_smpl.c ec2_smpt.c
ec2_mult.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
ec2_mult.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
ec2_mult.o: ../../include/openssl/ec.h ../../include/openssl/err.h
ec2_mult.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
ec2_mult.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
ec2_mult.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
ec2_mult.o: ec_lcl.h ec2_mult.c

127
crypto/ec/ec.h
View File

@ -52,6 +52,32 @@
* Hudson (tjh@cryptsoft.com).
*
*/
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
*
* Portions of the attached software ("Contribution") are developed by
* SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
*
* The Contribution is licensed pursuant to the OpenSSL open source
* license provided above.
*
* In addition, Sun covenants to all licensees who provide a reciprocal
* covenant with respect to their own patents if any, not to sue under
* current and future patent claims necessarily infringed by the making,
* using, practicing, selling, offering for sale and/or otherwise
* disposing of the Contribution as delivered hereunder
* (or portions thereof), provided that such covenant shall not apply:
* 1) for code that a licensee deletes from the Contribution;
* 2) separates from the Contribution; or
* 3) for infringements caused by:
* i) the modification of the Contribution or
* ii) the combination of the Contribution with other software or
* devices where such combination causes the infringement.
*
* The elliptic curve binary polynomial software is originally written by
* Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
*
*/
#ifndef HEADER_EC_H
#define HEADER_EC_H
@ -103,11 +129,17 @@ const EC_METHOD *EC_GFp_recp_method(void); /* TODO */
const EC_METHOD *EC_GFp_nist_method(void); /* TODO */
#endif
/* EC_METHODs for curves over GF(2^m).
* EC_GF2m_simple_method provides the basis for the optimized methods.
*/
const EC_METHOD *EC_GF2m_simple_method(void);
EC_GROUP *EC_GROUP_new(const EC_METHOD *);
void EC_GROUP_free(EC_GROUP *);
void EC_GROUP_clear_free(EC_GROUP *);
int EC_GROUP_copy(EC_GROUP *, const EC_GROUP *);
EC_GROUP *EC_GROUP_dup(const EC_GROUP *);
const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *);
int EC_METHOD_get_field_type(const EC_METHOD *);
@ -130,12 +162,12 @@ unsigned char *EC_GROUP_get0_seed(const EC_GROUP *);
size_t EC_GROUP_get_seed_len(const EC_GROUP *);
size_t EC_GROUP_set_seed(EC_GROUP *, const unsigned char *, size_t len);
/* We don't have types for field specifications and field elements in general.
* Otherwise we could declare
* int EC_GROUP_set_curve(EC_GROUP *, .....);
*/
int EC_GROUP_set_curve_GFp(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
int EC_GROUP_get_curve_GFp(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
int EC_GROUP_set_curve_GF2m(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
int EC_GROUP_get_curve_GF2m(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
int EC_GROUP_get_degree(const EC_GROUP *);
/* EC_GROUP_check() returns 1 if 'group' defines a valid group, 0 otherwise */
int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx);
@ -143,9 +175,10 @@ int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx);
* elliptic curve is not zero, 0 otherwise */
int EC_GROUP_check_discriminant(const EC_GROUP *, BN_CTX *);
/* EC_GROUP_new_GFp() calls EC_GROUP_new() and EC_GROUP_set_GFp()
/* EC_GROUP_new_GF*() calls EC_GROUP_new() and EC_GROUP_set_GF*()
* after choosing an appropriate EC_METHOD */
EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
EC_GROUP *EC_GROUP_new_curve_GF2m(const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
/* EC_GROUP_new_by_nid() and EC_GROUP_new_by_name() also set
* generator and order */
@ -181,15 +214,66 @@ EC_GROUP *EC_GROUP_new_by_name(int name);
#define EC_GROUP_SECG_PRIME_384R1 NID_secp384r1
#define EC_GROUP_SECG_PRIME_521R1 NID_secp521r1
#define EC_GROUP_WTLS_6 NID_wap_wsg_idm_ecid_wtls6
#define EC_GROUP_WTLS_7 NID_secp160r1
#define EC_GROUP_WTLS_7 NID_wap_wsg_idm_ecid_wtls7
#define EC_GROUP_WTLS_8 NID_wap_wsg_idm_ecid_wtls8
#define EC_GROUP_WTLS_9 NID_wap_wsg_idm_ecid_wtls9
#define EC_GROUP_WTLS_12 NID_secp224r1
#define EC_GROUP_WTLS_12 NID_wap_wsg_idm_ecid_wtls12
#define EC_GROUP_NIST_CHAR2_K163 NID_sect163k1
#define EC_GROUP_NIST_CHAR2_B163 NID_sect163r2
#define EC_GROUP_NIST_CHAR2_K233 NID_sect233k1
#define EC_GROUP_NIST_CHAR2_B233 NID_sect233r1
#define EC_GROUP_NIST_CHAR2_K283 NID_sect283k1
#define EC_GROUP_NIST_CHAR2_B283 NID_sect283r1
#define EC_GROUP_NIST_CHAR2_K409 NID_sect409k1
#define EC_GROUP_NIST_CHAR2_B409 NID_sect409r1
#define EC_GROUP_NIST_CHAR2_K571 NID_sect571k1
#define EC_GROUP_NIST_CHAR2_B571 NID_sect571r1
#define EC_GROUP_X9_62_CHAR2_163V1 NID_X9_62_c2pnb163v1
#define EC_GROUP_X9_62_CHAR2_163V2 NID_X9_62_c2pnb163v2
#define EC_GROUP_X9_62_CHAR2_163V3 NID_X9_62_c2pnb163v3
#define EC_GROUP_X9_62_CHAR2_176V1 NID_X9_62_c2pnb176v1
#define EC_GROUP_X9_62_CHAR2_191V1 NID_X9_62_c2tnb191v1
#define EC_GROUP_X9_62_CHAR2_191V2 NID_X9_62_c2tnb191v2
#define EC_GROUP_X9_62_CHAR2_191V3 NID_X9_62_c2tnb191v3
#define EC_GROUP_X9_62_CHAR2_208W1 NID_X9_62_c2pnb208w1
#define EC_GROUP_X9_62_CHAR2_239V1 NID_X9_62_c2tnb239v1
#define EC_GROUP_X9_62_CHAR2_239V2 NID_X9_62_c2tnb239v2
#define EC_GROUP_X9_62_CHAR2_239V3 NID_X9_62_c2tnb239v3
#define EC_GROUP_X9_62_CHAR2_272W1 NID_X9_62_c2pnb272w1
#define EC_GROUP_X9_62_CHAR2_304W1 NID_X9_62_c2pnb304w1
#define EC_GROUP_X9_62_CHAR2_359V1 NID_X9_62_c2tnb359v1
#define EC_GROUP_X9_62_CHAR2_368W1 NID_X9_62_c2pnb368w1
#define EC_GROUP_X9_62_CHAR2_431R1 NID_X9_62_c2tnb431r1
#define EC_GROUP_SECG_CHAR2_113R1 NID_sect113r1
#define EC_GROUP_SECG_CHAR2_113R2 NID_sect113r2
#define EC_GROUP_SECG_CHAR2_131R1 NID_sect131r1
#define EC_GROUP_SECG_CHAR2_131R2 NID_sect131r2
#define EC_GROUP_SECG_CHAR2_163K1 NID_sect163k1
#define EC_GROUP_SECG_CHAR2_163R1 NID_sect163r1
#define EC_GROUP_SECG_CHAR2_163R2 NID_sect163r2
#define EC_GROUP_SECG_CHAR2_193R1 NID_sect193r1
#define EC_GROUP_SECG_CHAR2_193R2 NID_sect193r2
#define EC_GROUP_SECG_CHAR2_233K1 NID_sect233k1
#define EC_GROUP_SECG_CHAR2_233R1 NID_sect233r1
#define EC_GROUP_SECG_CHAR2_239K1 NID_sect239k1
#define EC_GROUP_SECG_CHAR2_283K1 NID_sect283k1
#define EC_GROUP_SECG_CHAR2_283R1 NID_sect283r1
#define EC_GROUP_SECG_CHAR2_409K1 NID_sect409k1
#define EC_GROUP_SECG_CHAR2_409R1 NID_sect409r1
#define EC_GROUP_SECG_CHAR2_571K1 NID_sect571k1
#define EC_GROUP_SECG_CHAR2_571R1 NID_sect571r1
#define EC_GROUP_WTLS_1 NID_wap_wsg_idm_ecid_wtls1
#define EC_GROUP_WTLS_3 NID_wap_wsg_idm_ecid_wtls3
#define EC_GROUP_WTLS_4 NID_wap_wsg_idm_ecid_wtls4
#define EC_GROUP_WTLS_5 NID_wap_wsg_idm_ecid_wtls5
#define EC_GROUP_WTLS_10 NID_wap_wsg_idm_ecid_wtls10
#define EC_GROUP_WTLS_11 NID_wap_wsg_idm_ecid_wtls11
EC_POINT *EC_POINT_new(const EC_GROUP *);
void EC_POINT_free(EC_POINT *);
void EC_POINT_clear_free(EC_POINT *);
int EC_POINT_copy(EC_POINT *, const EC_POINT *);
EC_POINT *EC_POINT_dup(const EC_POINT *, const EC_GROUP *);
const EC_METHOD *EC_POINT_method_of(const EC_POINT *);
@ -205,6 +289,17 @@ int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *, const EC_POINT *,
int EC_POINT_set_compressed_coordinates_GFp(const EC_GROUP *, EC_POINT *,
const BIGNUM *x, int y_bit, BN_CTX *);
int EC_POINT_set_Jprojective_coordinates_GF2m(const EC_GROUP *, EC_POINT *,
const BIGNUM *x, const BIGNUM *y, const BIGNUM *z, BN_CTX *);
int EC_POINT_get_Jprojective_coordinates_GF2m(const EC_GROUP *, const EC_POINT *,
BIGNUM *x, BIGNUM *y, BIGNUM *z, BN_CTX *);
int EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP *, EC_POINT *,
const BIGNUM *x, const BIGNUM *y, BN_CTX *);
int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *, const EC_POINT *,
BIGNUM *x, BIGNUM *y, BN_CTX *);
int EC_POINT_set_compressed_coordinates_GF2m(const EC_GROUP *, EC_POINT *,
const BIGNUM *x, int y_bit, BN_CTX *);
size_t EC_POINT_point2oct(const EC_GROUP *, const EC_POINT *, point_conversion_form_t form,
unsigned char *buf, size_t len, BN_CTX *);
int EC_POINT_oct2point(const EC_GROUP *, EC_POINT *,
@ -309,6 +404,12 @@ void ERR_load_EC_strings(void);
#define EC_F_EC_ASN1_GROUP2PKPARAMETERS 162
#define EC_F_EC_ASN1_PARAMETERS2GROUP 157
#define EC_F_EC_ASN1_PKPARAMETERS2GROUP 163
#define EC_F_EC_GF2M_SIMPLE_GROUP_CHECK_DISCRIMINANT 168
#define EC_F_EC_GF2M_SIMPLE_OCT2POINT 169
#define EC_F_EC_GF2M_SIMPLE_POINT2OCT 170
#define EC_F_EC_GF2M_SIMPLE_POINT_GET_AFFINE_COORDINATES_GF2M 171
#define EC_F_EC_GF2M_SIMPLE_POINT_SET_AFFINE_COORDINATES_GF2M 172
#define EC_F_EC_GF2M_SIMPLE_SET_COMPRESSED_COORDINATES_GF2M 185
#define EC_F_EC_GFP_MONT_FIELD_DECODE 133
#define EC_F_EC_GFP_MONT_FIELD_ENCODE 134
#define EC_F_EC_GFP_MONT_FIELD_MUL 131
@ -328,15 +429,19 @@ void ERR_load_EC_strings(void);
#define EC_F_EC_GROUP_COPY 106
#define EC_F_EC_GROUP_GET0_GENERATOR 139
#define EC_F_EC_GROUP_GET_COFACTOR 140
#define EC_F_EC_GROUP_GET_CURVE_GF2M 173
#define EC_F_EC_GROUP_GET_CURVE_GFP 130
#define EC_F_EC_GROUP_GET_DEGREE 174
#define EC_F_EC_GROUP_GET_EXTRA_DATA 107
#define EC_F_EC_GROUP_GET_ORDER 141
#define EC_F_EC_GROUP_GROUP2NID 147
#define EC_F_EC_GROUP_NEW 108
#define EC_F_EC_GROUP_NEW_BY_NAME 144
#define EC_F_EC_GROUP_NEW_BY_NID 146
#define EC_F_EC_GROUP_NEW_GF2M_FROM_HEX 175
#define EC_F_EC_GROUP_NEW_GFP_FROM_HEX 148
#define EC_F_EC_GROUP_PRECOMPUTE_MULT 142
#define EC_F_EC_GROUP_SET_CURVE_GF2M 176
#define EC_F_EC_GROUP_SET_CURVE_GFP 109
#define EC_F_EC_GROUP_SET_EXTRA_DATA 110
#define EC_F_EC_GROUP_SET_GENERATOR 111
@ -346,18 +451,26 @@ void ERR_load_EC_strings(void);
#define EC_F_EC_POINT_CMP 113
#define EC_F_EC_POINT_COPY 114
#define EC_F_EC_POINT_DBL 115
#define EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M 177
#define EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP 116
#define EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GF2M 178
#define EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP 117
#define EC_F_EC_POINT_IS_AT_INFINITY 118
#define EC_F_EC_POINT_IS_ON_CURVE 119
#define EC_F_EC_POINT_MAKE_AFFINE 120
#define EC_F_EC_POINT_MUL 179
#define EC_F_EC_POINT_NEW 121
#define EC_F_EC_POINT_OCT2POINT 122
#define EC_F_EC_POINT_POINT2OCT 123
#define EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M 180
#define EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP 124
#define EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GF2M 181
#define EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GFP 125
#define EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GF2M 182
#define EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP 126
#define EC_F_EC_POINT_SET_TO_INFINITY 127
#define EC_F_EC_WNAF_MUL 183
#define EC_F_EC_WNAF_PRECOMPUTE_MULT 184
#define EC_F_GFP_MONT_GROUP_SET_CURVE_GFP 135
#define EC_F_I2D_ECDSAPARAMETERS 158
#define EC_F_I2D_ECPARAMETERS 164

387
crypto/ec/ec2_mult.c Normal file
View File

@ -0,0 +1,387 @@
/* crypto/ec/ec2_mult.c */
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
*
* The Elliptic Curve Public-Key Crypto Library (ECC Code) included
* herein is developed by SUN MICROSYSTEMS, INC., and is contributed
* to the OpenSSL project.
*
* The ECC Code is licensed pursuant to the OpenSSL open source
* license provided below.
*
* In addition, Sun covenants to all licensees who provide a reciprocal
* covenant with respect to their own patents if any, not to sue under
* current and future patent claims necessarily infringed by the making,
* using, practicing, selling, offering for sale and/or otherwise
* disposing of the ECC Code as delivered hereunder (or portions thereof),
* provided that such covenant shall not apply:
* 1) for code that a licensee deletes from the ECC Code;
* 2) separates from the ECC Code; or
* 3) for infringements caused by:
* i) the modification of the ECC Code or
* ii) the combination of the ECC Code with other software or
* devices where such combination causes the infringement.
*
* The software is originally written by Sheueling Chang Shantz and
* Douglas Stebila of Sun Microsystems Laboratories.
*
*/
/* ====================================================================
* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
#include <openssl/err.h>
#include "ec_lcl.h"
/* Compute the x-coordinate x/z for the point 2*(x/z) in Montgomery projective
* coordinates.
* Uses algorithm Mdouble in appendix of
* Lopez, J. and Dahab, R. "Fast multiplication on elliptic curves over
* GF(2^m) without precomputation".
* modified to not require precomputation of c=b^{2^{m-1}}.
*/
static int Mdouble(const EC_GROUP *group, BIGNUM *x, BIGNUM *z, BN_CTX *ctx)
{
BIGNUM *t1;
int ret = 0;
/* Since Mdouble is static we can guarantee that ctx != NULL. */
BN_CTX_start(ctx);
t1 = BN_CTX_get(ctx);
if (t1 == NULL) goto err;
if (!group->meth->field_sqr(group, x, x, ctx)) goto err;
if (!group->meth->field_sqr(group, t1, z, ctx)) goto err;
if (!group->meth->field_mul(group, z, x, t1, ctx)) goto err;
if (!group->meth->field_sqr(group, x, x, ctx)) goto err;
if (!group->meth->field_sqr(group, t1, t1, ctx)) goto err;
if (!group->meth->field_mul(group, t1, &group->b, t1, ctx)) goto err;
if (!BN_GF2m_add(x, x, t1)) goto err;
ret = 1;
err:
BN_CTX_end(ctx);
return ret;
}
/* Compute the x-coordinate x1/z1 for the point (x1/z1)+(x2/x2) in Montgomery
* projective coordinates.
* Uses algorithm Madd in appendix of
* Lopex, J. and Dahab, R. "Fast multiplication on elliptic curves over
* GF(2^m) without precomputation".
*/
static int Madd(const EC_GROUP *group, const BIGNUM *x, BIGNUM *x1, BIGNUM *z1,
const BIGNUM *x2, const BIGNUM *z2, BN_CTX *ctx)
{
BIGNUM *t1, *t2;
int ret = 0;
/* Since Madd is static we can guarantee that ctx != NULL. */
BN_CTX_start(ctx);
t1 = BN_CTX_get(ctx);
t2 = BN_CTX_get(ctx);
if (t2 == NULL) goto err;
if (!BN_copy(t1, x)) goto err;
if (!group->meth->field_mul(group, x1, x1, z2, ctx)) goto err;
if (!group->meth->field_mul(group, z1, z1, x2, ctx)) goto err;
if (!group->meth->field_mul(group, t2, x1, z1, ctx)) goto err;
if (!BN_GF2m_add(z1, z1, x1)) goto err;
if (!group->meth->field_sqr(group, z1, z1, ctx)) goto err;
if (!group->meth->field_mul(group, x1, z1, t1, ctx)) goto err;
if (!BN_GF2m_add(x1, x1, t2)) goto err;
ret = 1;
err:
BN_CTX_end(ctx);
return ret;
}
/* Compute the affine coordinates x2, y2=z2 for the point (x1/z1) and (x2/x2) in
* Montgomery projective coordinates.
* Uses algorithm Mxy in appendix of
* Lopex, J. and Dahab, R. "Fast multiplication on elliptic curves over
* GF(2^m) without precomputation".
* Returns:
* 0 on error
* 1 if return value should be the point at infinity
* 2 otherwise
*/
static int Mxy(const EC_GROUP *group, const BIGNUM *x, const BIGNUM *y, BIGNUM *x1,
BIGNUM *z1, BIGNUM *x2, BIGNUM *z2, BN_CTX *ctx)
{
BIGNUM *t3, *t4, *t5;
int ret = 0;
if (BN_is_zero(z1))
{
if (!BN_zero(x2)) return 0;
if (!BN_zero(z2)) return 0;
return 1;
}
if (BN_is_zero(z2))
{
if (!BN_copy(x2, x)) return 0;
if (!BN_GF2m_add(z2, x, y)) return 0;
return 2;
}
/* Since Mxy is static we can guarantee that ctx != NULL. */
BN_CTX_start(ctx);
t3 = BN_CTX_get(ctx);
t4 = BN_CTX_get(ctx);
t5 = BN_CTX_get(ctx);
if (t5 == NULL) goto err;
if (!BN_one(t5)) goto err;
if (!group->meth->field_mul(group, t3, z1, z2, ctx)) goto err;
if (!group->meth->field_mul(group, z1, z1, x, ctx)) goto err;
if (!BN_GF2m_add(z1, z1, x1)) goto err;
if (!group->meth->field_mul(group, z2, z2, x, ctx)) goto err;
if (!group->meth->field_mul(group, x1, z2, x1, ctx)) goto err;
if (!BN_GF2m_add(z2, z2, x2)) goto err;
if (!group->meth->field_mul(group, z2, z2, z1, ctx)) goto err;
if (!group->meth->field_sqr(group, t4, x, ctx)) goto err;
if (!BN_GF2m_add(t4, t4, y)) goto err;
if (!group->meth->field_mul(group, t4, t4, t3, ctx)) goto err;
if (!BN_GF2m_add(t4, t4, z2)) goto err;
if (!group->meth->field_mul(group, t3, t3, x, ctx)) goto err;
if (!group->meth->field_div(group, t3, t5, t3, ctx)) goto err;
if (!group->meth->field_mul(group, t4, t3, t4, ctx)) goto err;
if (!group->meth->field_mul(group, x2, x1, t3, ctx)) goto err;
if (!BN_GF2m_add(z2, x2, x)) goto err;
if (!group->meth->field_mul(group, z2, z2, t4, ctx)) goto err;
if (!BN_GF2m_add(z2, z2, y)) goto err;
ret = 2;
err:
BN_CTX_end(ctx);
return ret;
}
/* Computes scalar*point and stores the result in r.
* point can not equal r.
* Uses algorithm 2P of
* Lopex, J. and Dahab, R. "Fast multiplication on elliptic curves over
* GF(2^m) without precomputation".
*/
static int point_multiply(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
const EC_POINT *point, BN_CTX *ctx)
{
BIGNUM *x1, *x2, *z1, *z2;
int ret = 0, i, j;
BN_ULONG mask;
if (r == point)
{
ECerr(EC_F_EC_POINT_MUL, EC_R_INVALID_ARGUMENT);
return 0;
}
/* if result should be point at infinity */
if ((scalar == NULL) || BN_is_zero(scalar) || (point == NULL) ||
EC_POINT_is_at_infinity(group, point))
{
return EC_POINT_set_to_infinity(group, r);
}
/* only support affine coordinates */
if (!point->Z_is_one) return 0;
/* Since point_multiply is static we can guarantee that ctx != NULL. */
BN_CTX_start(ctx);
x1 = BN_CTX_get(ctx);
z1 = BN_CTX_get(ctx);
if (z1 == NULL) goto err;
x2 = &r->X;
z2 = &r->Y;
if (!BN_GF2m_mod_arr(x1, &point->X, group->poly)) goto err; /* x1 = x */
if (!BN_one(z1)) goto err; /* z1 = 1 */
if (!group->meth->field_sqr(group, z2, x1, ctx)) goto err; /* z2 = x1^2 = x^2 */
if (!group->meth->field_sqr(group, x2, z2, ctx)) goto err;
if (!BN_GF2m_add(x2, x2, &group->b)) goto err; /* x2 = x^4 + b */
/* find top most bit and go one past it */
i = scalar->top - 1; j = BN_BITS2 - 1;
mask = BN_TBIT;
while (!(scalar->d[i] & mask)) { mask >>= 1; j--; }
mask >>= 1; j--;
/* if top most bit was at word break, go to next word */
if (!mask)
{
i--; j = BN_BITS2 - 1;
mask = BN_TBIT;
}
for (; i >= 0; i--)
{
for (; j >= 0; j--)
{
if (scalar->d[i] & mask)
{
if (!Madd(group, &point->X, x1, z1, x2, z2, ctx)) goto err;
if (!Mdouble(group, x2, z2, ctx)) goto err;
}
else
{
if (!Madd(group, &point->X, x2, z2, x1, z1, ctx)) goto err;
if (!Mdouble(group, x1, z1, ctx)) goto err;
}
mask >>= 1;
}
j = BN_BITS2 - 1;
mask = BN_TBIT;
}
/* convert out of "projective" coordinates */
i = Mxy(group, &point->X, &point->Y, x1, z1, x2, z2, ctx);
if (i == 0) goto err;
else if (i == 1)
{
if (!EC_POINT_set_to_infinity(group, r)) goto err;
}
else
{
if (!BN_one(&r->Z)) goto err;
r->Z_is_one = 1;
}
/* GF(2^m) field elements should always have BIGNUM::neg = 0 */
r->X.neg = 0;
r->Y.neg = 0;
ret = 1;
err:
BN_CTX_end(ctx);
return ret;
}
/* Computes the sum
* scalar*group->generator + scalars[0]*points[0] + ... + scalars[num-1]*points[num-1]
* gracefully ignoring NULL scalar values.
*/
int ec_GF2m_mont_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx)
{
BN_CTX *new_ctx = NULL;
int ret = 0, i;
EC_POINT *p=NULL;
if (ctx == NULL)
{
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
return 0;
}
/* This implementation is more efficient than the wNAF implementation for 2
* or fewer points. Use the ec_wNAF_mul implementation 3 or more points.
*/
if ((scalar && (num > 1)) || (num > 2))
{
ret = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
goto err;
}
if ((p = EC_POINT_new(group)) == NULL) goto err;
if (!EC_POINT_set_to_infinity(group, r)) goto err;
if (scalar)
{
if (!point_multiply(group, p, scalar, group->generator, ctx)) goto err;
if (scalar->neg) if (!group->meth->invert(group, p, ctx)) goto err;
if (!group->meth->add(group, r, r, p, ctx)) goto err;
}
for (i = 0; i < num; i++)
{
if (!point_multiply(group, p, scalars[i], points[i], ctx)) goto err;
if (scalars[i]->neg) if (!group->meth->invert(group, p, ctx)) goto err;
if (!group->meth->add(group, r, r, p, ctx)) goto err;
}
ret = 1;
err:
if (p) EC_POINT_free(p);
if (new_ctx != NULL)
BN_CTX_free(new_ctx);
return ret;
}
/* Precomputation for point multiplication. */
int ec_GF2m_mont_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
{
/* There is no precomputation to do for Montgomery scalar multiplication but
* since this implementation falls back to the wNAF multiplication for more than
* two points, call the wNAF implementation's precompute.
*/
return ec_wNAF_precompute_mult(group, ctx);
}

980
crypto/ec/ec2_smpl.c Normal file
View File

@ -0,0 +1,980 @@
/* crypto/ec/ec2_smpl.c */
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
*
* The Elliptic Curve Public-Key Crypto Library (ECC Code) included
* herein is developed by SUN MICROSYSTEMS, INC., and is contributed
* to the OpenSSL project.
*
* The ECC Code is licensed pursuant to the OpenSSL open source
* license provided below.
*
* In addition, Sun covenants to all licensees who provide a reciprocal
* covenant with respect to their own patents if any, not to sue under
* current and future patent claims necessarily infringed by the making,
* using, practicing, selling, offering for sale and/or otherwise
* disposing of the ECC Code as delivered hereunder (or portions thereof),
* provided that such covenant shall not apply:
* 1) for code that a licensee deletes from the ECC Code;
* 2) separates from the ECC Code; or
* 3) for infringements caused by:
* i) the modification of the ECC Code or
* ii) the combination of the ECC Code with other software or
* devices where such combination causes the infringement.
*
* The software is originally written by Sheueling Chang Shantz and
* Douglas Stebila of Sun Microsystems Laboratories.
*
*/
/* ====================================================================
* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
#include <openssl/err.h>
#include "ec_lcl.h"
const EC_METHOD *EC_GF2m_simple_method(void)
{
static const EC_METHOD ret = {
NID_X9_62_characteristic_two_field,
ec_GF2m_simple_group_init,
ec_GF2m_simple_group_finish,
ec_GF2m_simple_group_clear_finish,
ec_GF2m_simple_group_copy,
ec_GF2m_simple_group_set_curve_GF2m,
ec_GF2m_simple_group_get_curve_GF2m,
ec_GF2m_simple_group_get_degree,
ec_GF2m_simple_group_check_discriminant,
ec_GF2m_simple_point_init,
ec_GF2m_simple_point_finish,
ec_GF2m_simple_point_clear_finish,
ec_GF2m_simple_point_copy,
ec_GF2m_simple_point_set_to_infinity,
0 /* set_Jprojective_coordinates_GF2m */,
0 /* get_Jprojective_coordinates_GF2m */,
ec_GF2m_simple_point_set_affine_coordinates_GF2m,
ec_GF2m_simple_point_get_affine_coordinates_GF2m,
ec_GF2m_simple_set_compressed_coordinates_GF2m,
ec_GF2m_simple_point2oct,
ec_GF2m_simple_oct2point,
ec_GF2m_simple_add,
ec_GF2m_simple_dbl,
ec_GF2m_simple_invert,
ec_GF2m_mont_mul,
ec_GF2m_mont_precompute_mult,
ec_GF2m_simple_is_at_infinity,
ec_GF2m_simple_is_on_curve,
ec_GF2m_simple_cmp,
ec_GF2m_simple_make_affine,
ec_GF2m_simple_points_make_affine,
ec_GF2m_simple_field_mul,
ec_GF2m_simple_field_sqr,
ec_GF2m_simple_field_div,
0 /* field_encode */,
0 /* field_decode */,
0 /* field_set_to_one */ };
return &ret;
}
/* Initialize a GF(2^m)-based EC_GROUP structure.
* Note that all other members are handled by EC_GROUP_new.
*/
int ec_GF2m_simple_group_init(EC_GROUP *group)
{
BN_init(&group->field);
BN_init(&group->a);
BN_init(&group->b);
return 1;
}
/* Free a GF(2^m)-based EC_GROUP structure.
* Note that all other members are handled by EC_GROUP_free.
*/
void ec_GF2m_simple_group_finish(EC_GROUP *group)
{
BN_free(&group->field);
BN_free(&group->a);
BN_free(&group->b);
}
/* Clear and free a GF(2^m)-based EC_GROUP structure.
* Note that all other members are handled by EC_GROUP_clear_free.
*/
void ec_GF2m_simple_group_clear_finish(EC_GROUP *group)
{
BN_clear_free(&group->field);
BN_clear_free(&group->a);
BN_clear_free(&group->b);
group->poly[0] = 0;
group->poly[1] = 0;
group->poly[2] = 0;
group->poly[3] = 0;
group->poly[4] = 0;
}
/* Copy a GF(2^m)-based EC_GROUP structure.
* Note that all other members are handled by EC_GROUP_copy.
*/
int ec_GF2m_simple_group_copy(EC_GROUP *dest, const EC_GROUP *src)
{
int i;
if (!BN_copy(&dest->field, &src->field)) return 0;
if (!BN_copy(&dest->a, &src->a)) return 0;
if (!BN_copy(&dest->b, &src->b)) return 0;
dest->poly[0] = src->poly[0];
dest->poly[1] = src->poly[1];
dest->poly[2] = src->poly[2];
dest->poly[3] = src->poly[3];
dest->poly[4] = src->poly[4];
bn_wexpand(&dest->a, (dest->poly[0] + BN_BITS2 - 1) / BN_BITS2);
bn_wexpand(&dest->b, (dest->poly[0] + BN_BITS2 - 1) / BN_BITS2);
for (i = dest->a.top; i < dest->a.dmax; i++) dest->a.d[i] = 0;
for (i = dest->b.top; i < dest->b.dmax; i++) dest->b.d[i] = 0;
return 1;
}
/* Set the curve parameters of an EC_GROUP structure. */
int ec_GF2m_simple_group_set_curve_GF2m(EC_GROUP *group,
const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
{
int ret = 0, i;
/* group->field */
if (!BN_copy(&group->field, p)) goto err;
i = BN_GF2m_poly2arr(&group->field, group->poly, 5);
if ((i != 5) && (i != 3)) goto err;
/* group->a */
if (!BN_GF2m_mod_arr(&group->a, a, group->poly)) goto err;
bn_wexpand(&group->a, (group->poly[0] + BN_BITS2 - 1) / BN_BITS2);
for (i = group->a.top; i < group->a.dmax; i++) group->a.d[i] = 0;
/* group->b */
if (!BN_GF2m_mod_arr(&group->b, b, group->poly)) goto err;
bn_wexpand(&group->b, (group->poly[0] + BN_BITS2 - 1) / BN_BITS2);
for (i = group->b.top; i < group->b.dmax; i++) group->b.d[i] = 0;
ret = 1;
err:
return ret;
}
/* Get the curve parameters of an EC_GROUP structure.
* If p, a, or b are NULL then there values will not be set but the method will return with success.
*/
int ec_GF2m_simple_group_get_curve_GF2m(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
{
int ret = 0;
if (p != NULL)
{
if (!BN_copy(p, &group->field)) return 0;
}
if (a != NULL || b != NULL)
{
if (a != NULL)
{
if (!BN_copy(a, &group->a)) goto err;
}
if (b != NULL)
{
if (!BN_copy(b, &group->b)) goto err;
}
}
ret = 1;
err:
return ret;
}
/* Gets the degree of the field. For a curve over GF(2^m) this is the value m. */
int ec_GF2m_simple_group_get_degree(const EC_GROUP *group)
{
return BN_num_bits(&group->field)-1;
}
/* Checks the discriminant of the curve.
* y^2 + x*y = x^3 + a*x^2 + b is an elliptic curve <=> b != 0 (mod p)
*/
int ec_GF2m_simple_group_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
{
int ret = 0;
BIGNUM *b;
BN_CTX *new_ctx = NULL;
if (ctx == NULL)
{
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
{
ECerr(EC_F_EC_GF2M_SIMPLE_GROUP_CHECK_DISCRIMINANT, ERR_R_MALLOC_FAILURE);
goto err;
}
}
BN_CTX_start(ctx);
b = BN_CTX_get(ctx);
if (b == NULL) goto err;
if (!BN_GF2m_mod_arr(b, &group->b, group->poly)) goto err;
/* check the discriminant:
* y^2 + x*y = x^3 + a*x^2 + b is an elliptic curve <=> b != 0 (mod p)
*/
if (BN_is_zero(b)) goto err;
ret = 1;
err:
BN_CTX_end(ctx);
if (new_ctx != NULL)
BN_CTX_free(new_ctx);
return ret;
}
/* Initializes an EC_POINT. */
int ec_GF2m_simple_point_init(EC_POINT *point)
{
BN_init(&point->X);
BN_init(&point->Y);
BN_init(&point->Z);
return 1;
}
/* Frees an EC_POINT. */
void ec_GF2m_simple_point_finish(EC_POINT *point)
{
BN_free(&point->X);
BN_free(&point->Y);
BN_free(&point->Z);
}
/* Clears and frees an EC_POINT. */
void ec_GF2m_simple_point_clear_finish(EC_POINT *point)
{
BN_clear_free(&point->X);
BN_clear_free(&point->Y);
BN_clear_free(&point->Z);
point->Z_is_one = 0;
}
/* Copy the contents of one EC_POINT into another. Assumes dest is initialized. */
int ec_GF2m_simple_point_copy(EC_POINT *dest, const EC_POINT *src)
{
if (!BN_copy(&dest->X, &src->X)) return 0;
if (!BN_copy(&dest->Y, &src->Y)) return 0;
if (!BN_copy(&dest->Z, &src->Z)) return 0;
dest->Z_is_one = src->Z_is_one;
return 1;
}
/* Set an EC_POINT to the point at infinity.
* A point at infinity is represented by having Z=0.
*/
int ec_GF2m_simple_point_set_to_infinity(const EC_GROUP *group, EC_POINT *point)
{
point->Z_is_one = 0;
return (BN_zero(&point->Z));
}
/* Set the coordinates of an EC_POINT using affine coordinates.
* Note that the simple implementation only uses affine coordinates.
*/
int ec_GF2m_simple_point_set_affine_coordinates_GF2m(const EC_GROUP *group, EC_POINT *point,
const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx)
{
int ret = 0;
if (x == NULL || y == NULL)
{
ECerr(EC_F_EC_GF2M_SIMPLE_POINT_SET_AFFINE_COORDINATES_GF2M, ERR_R_PASSED_NULL_PARAMETER);
return 0;
}
if (!BN_copy(&point->X, x)) goto err;
if (!BN_copy(&point->Y, y)) goto err;
if (!BN_copy(&point->Z, BN_value_one())) goto err;
point->Z_is_one = 1;
ret = 1;
err:
return ret;
}
/* Gets the affine coordinates of an EC_POINT.
* Note that the simple implementation only uses affine coordinates.
*/
int ec_GF2m_simple_point_get_affine_coordinates_GF2m(const EC_GROUP *group, const EC_POINT *point,
BIGNUM *x, BIGNUM *y, BN_CTX *ctx)
{
int ret = 0;
if (EC_POINT_is_at_infinity(group, point))
{
ECerr(EC_F_EC_GF2M_SIMPLE_POINT_GET_AFFINE_COORDINATES_GF2M, EC_R_POINT_AT_INFINITY);
return 0;
}
if (BN_cmp(&point->Z, BN_value_one()))
{
ECerr(EC_F_EC_GF2M_SIMPLE_POINT_GET_AFFINE_COORDINATES_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
if (x != NULL)
{
if (!BN_copy(x, &point->X)) goto err;
}
if (y != NULL)
{
if (!BN_copy(y, &point->Y)) goto err;
}
ret = 1;
err:
return ret;
}
/* Include patented algorithms. */
#include "ec2_smpt.c"
/* Converts an EC_POINT to an octet string.
* If buf is NULL, the encoded length will be returned.
* If the length len of buf is smaller than required an error will be returned.
*
* The point compression section of this function is patented by Certicom Corp.
* under US Patent 6,141,420. Point compression is disabled by default and can
* be enabled by defining the preprocessor macro OPENSSL_EC_BIN_PT_COMP at
* Configure-time.
*/
size_t ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point, point_conversion_form_t form,
unsigned char *buf, size_t len, BN_CTX *ctx)
{
size_t ret;
BN_CTX *new_ctx = NULL;
int used_ctx = 0;
BIGNUM *x, *y, *yxi;
size_t field_len, i, skip;
#ifndef OPENSSL_EC_BIN_PT_COMP
if ((form == POINT_CONVERSION_COMPRESSED) || (form == POINT_CONVERSION_HYBRID))
{
ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_DISABLED);
goto err;
}
#endif
if ((form != POINT_CONVERSION_COMPRESSED)
&& (form != POINT_CONVERSION_UNCOMPRESSED)
&& (form != POINT_CONVERSION_HYBRID))
{
ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_INVALID_FORM);
goto err;
}
if (EC_POINT_is_at_infinity(group, point))
{
/* encodes to a single 0 octet */
if (buf != NULL)
{
if (len < 1)
{
ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
return 0;
}
buf[0] = 0;
}
return 1;
}
/* ret := required output buffer length */
field_len = (EC_GROUP_get_degree(group) + 7) / 8;
ret = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2*field_len;
/* if 'buf' is NULL, just return required length */
if (buf != NULL)
{
if (len < ret)
{
ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
goto err;
}
if (ctx == NULL)
{
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
return 0;
}
BN_CTX_start(ctx);
used_ctx = 1;
x = BN_CTX_get(ctx);
y = BN_CTX_get(ctx);
yxi = BN_CTX_get(ctx);
if (yxi == NULL) goto err;
if (!EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
buf[0] = form;
#ifdef OPENSSL_EC_BIN_PT_COMP
if ((form != POINT_CONVERSION_UNCOMPRESSED) && !BN_is_zero(x))
{
if (!group->meth->field_div(group, yxi, y, x, ctx)) goto err;
if (BN_is_odd(yxi)) buf[0]++;
}
#endif
i = 1;
skip = field_len - BN_num_bytes(x);
if (skip > field_len)
{
ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
goto err;
}
while (skip > 0)
{
buf[i++] = 0;
skip--;
}
skip = BN_bn2bin(x, buf + i);
i += skip;
if (i != 1 + field_len)
{
ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
goto err;
}
if (form == POINT_CONVERSION_UNCOMPRESSED || form == POINT_CONVERSION_HYBRID)
{
skip = field_len - BN_num_bytes(y);
if (skip > field_len)
{
ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
goto err;
}
while (skip > 0)
{
buf[i++] = 0;
skip--;
}
skip = BN_bn2bin(y, buf + i);
i += skip;
}
if (i != ret)
{
ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
goto err;
}
}
if (used_ctx)
BN_CTX_end(ctx);
if (new_ctx != NULL)
BN_CTX_free(new_ctx);
return ret;
err:
if (used_ctx)
BN_CTX_end(ctx);
if (new_ctx != NULL)
BN_CTX_free(new_ctx);
return 0;
}
/* Converts an octet string representation to an EC_POINT.
* Note that the simple implementation only uses affine coordinates.
*/
int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
const unsigned char *buf, size_t len, BN_CTX *ctx)
{
point_conversion_form_t form;
int y_bit;
BN_CTX *new_ctx = NULL;
BIGNUM *x, *y, *yxi;
size_t field_len, enc_len;
int ret = 0;
if (len == 0)
{
ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_BUFFER_TOO_SMALL);
return 0;
}
form = buf[0];
y_bit = form & 1;
form = form & ~1;
if ((form != 0) && (form != POINT_CONVERSION_COMPRESSED)
&& (form != POINT_CONVERSION_UNCOMPRESSED)
&& (form != POINT_CONVERSION_HYBRID))
{
ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
return 0;
}
if ((form == 0 || form == POINT_CONVERSION_UNCOMPRESSED) && y_bit)
{
ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
return 0;
}
if (form == 0)
{
if (len != 1)
{
ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
return 0;
}
return EC_POINT_set_to_infinity(group, point);
}
field_len = (EC_GROUP_get_degree(group) + 7) / 8;
enc_len = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2*field_len;
if (len != enc_len)
{
ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
return 0;
}
if (ctx == NULL)
{
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
return 0;
}
BN_CTX_start(ctx);
x = BN_CTX_get(ctx);
y = BN_CTX_get(ctx);
yxi = BN_CTX_get(ctx);
if (yxi == NULL) goto err;
if (!BN_bin2bn(buf + 1, field_len, x)) goto err;
if (BN_ucmp(x, &group->field) >= 0)
{
ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
goto err;
}
if (form == POINT_CONVERSION_COMPRESSED)
{
if (!EC_POINT_set_compressed_coordinates_GF2m(group, point, x, y_bit, ctx)) goto err;
}
else
{
if (!BN_bin2bn(buf + 1 + field_len, field_len, y)) goto err;
if (BN_ucmp(y, &group->field) >= 0)
{
ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
goto err;
}
if (form == POINT_CONVERSION_HYBRID)
{
if (!group->meth->field_div(group, yxi, y, x, ctx)) goto err;
if (y_bit != BN_is_odd(yxi))
{
ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
goto err;
}
}
if (!EC_POINT_set_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
}
if (!EC_POINT_is_on_curve(group, point, ctx)) /* test required by X9.62 */
{
ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
goto err;
}
ret = 1;
err:
BN_CTX_end(ctx);
if (new_ctx != NULL)
BN_CTX_free(new_ctx);
return ret;
}
/* Computes a + b and stores the result in r. r could be a or b, a could be b.
* Uses algorithm A.10.2 of IEEE P1363.
*/
int ec_GF2m_simple_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, const EC_POINT *b, BN_CTX *ctx)
{
BN_CTX *new_ctx = NULL;
BIGNUM *x0, *y0, *x1, *y1, *x2, *y2, *s, *t;
int ret = 0;
if (EC_POINT_is_at_infinity(group, a))
{
if (!EC_POINT_copy(r, b)) return 0;
return 1;
}
if (EC_POINT_is_at_infinity(group, b))
{
if (!EC_POINT_copy(r, a)) return 0;
return 1;
}
if (ctx == NULL)
{
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
return 0;
}
BN_CTX_start(ctx);
x0 = BN_CTX_get(ctx);
y0 = BN_CTX_get(ctx);
x1 = BN_CTX_get(ctx);
y1 = BN_CTX_get(ctx);
x2 = BN_CTX_get(ctx);
y2 = BN_CTX_get(ctx);
s = BN_CTX_get(ctx);
t = BN_CTX_get(ctx);
if (t == NULL) goto err;
if (a->Z_is_one)
{
if (!BN_copy(x0, &a->X)) goto err;
if (!BN_copy(y0, &a->Y)) goto err;
}
else
{
if (!EC_POINT_get_affine_coordinates_GF2m(group, a, x0, y0, ctx)) goto err;
}
if (b->Z_is_one)
{
if (!BN_copy(x1, &b->X)) goto err;
if (!BN_copy(y1, &b->Y)) goto err;
}
else
{
if (!EC_POINT_get_affine_coordinates_GF2m(group, b, x1, y1, ctx)) goto err;
}
if (BN_GF2m_cmp(x0, x1))
{
if (!BN_GF2m_add(t, x0, x1)) goto err;
if (!BN_GF2m_add(s, y0, y1)) goto err;
if (!group->meth->field_div(group, s, s, t, ctx)) goto err;
if (!group->meth->field_sqr(group, x2, s, ctx)) goto err;
if (!BN_GF2m_add(x2, x2, &group->a)) goto err;
if (!BN_GF2m_add(x2, x2, s)) goto err;
if (!BN_GF2m_add(x2, x2, t)) goto err;
}
else
{
if (BN_GF2m_cmp(y0, y1) || BN_is_zero(x1))
{
if (!EC_POINT_set_to_infinity(group, r)) goto err;
ret = 1;
goto err;
}
if (!group->meth->field_div(group, s, y1, x1, ctx)) goto err;
if (!BN_GF2m_add(s, s, x1)) goto err;
if (!group->meth->field_sqr(group, x2, s, ctx)) goto err;
if (!BN_GF2m_add(x2, x2, s)) goto err;
if (!BN_GF2m_add(x2, x2, &group->a)) goto err;
}
if (!BN_GF2m_add(y2, x1, x2)) goto err;
if (!group->meth->field_mul(group, y2, y2, s, ctx)) goto err;
if (!BN_GF2m_add(y2, y2, x2)) goto err;
if (!BN_GF2m_add(y2, y2, y1)) goto err;
if (!EC_POINT_set_affine_coordinates_GF2m(group, r, x2, y2, ctx)) goto err;
ret = 1;
err:
BN_CTX_end(ctx);
if (new_ctx != NULL)
BN_CTX_free(new_ctx);
return ret;
}
/* Computes 2 * a and stores the result in r. r could be a.
* Uses algorithm A.10.2 of IEEE P1363.
*/
int ec_GF2m_simple_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, BN_CTX *ctx)
{
return ec_GF2m_simple_add(group, r, a, a, ctx);
}
int ec_GF2m_simple_invert(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx)
{
if (EC_POINT_is_at_infinity(group, point) || BN_is_zero(&point->Y))
/* point is its own inverse */
return 1;
if (!EC_POINT_make_affine(group, point, ctx)) return 0;
return BN_GF2m_add(&point->Y, &point->X, &point->Y);
}
/* Indicates whether the given point is the point at infinity. */
int ec_GF2m_simple_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
{
return BN_is_zero(&point->Z);
}
/* Determines whether the given EC_POINT is an actual point on the curve defined
* in the EC_GROUP. A point is valid if it satisfies the Weierstrass equation:
* y^2 + x*y = x^3 + a*x^2 + b.
*/
int ec_GF2m_simple_is_on_curve(const EC_GROUP *group, const EC_POINT *point, BN_CTX *ctx)
{
BN_CTX *new_ctx = NULL;
BIGNUM *rh, *lh, *tmp1;
int ret = -1;
if (EC_POINT_is_at_infinity(group, point))
return 1;
/* only support affine coordinates */
if (!point->Z_is_one) goto err;
if (ctx == NULL)
{
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
return -1;
}
BN_CTX_start(ctx);
rh = BN_CTX_get(ctx);
lh = BN_CTX_get(ctx);
tmp1 = BN_CTX_get(ctx);
if (tmp1 == NULL) goto err;
/* We have a curve defined by a Weierstrass equation
* y^2 + x*y = x^3 + a*x^2 + b.
* To test this, we add up the right-hand side in 'rh'
* and the left-hand side in 'lh'.
*/
/* rh := X^3 */
if (!group->meth->field_sqr(group, tmp1, &point->X, ctx)) goto err;
if (!group->meth->field_mul(group, rh, tmp1, &point->X, ctx)) goto err;
/* rh := rh + a*X^2 */
if (!group->meth->field_mul(group, tmp1, tmp1, &group->a, ctx)) goto err;
if (!BN_GF2m_add(rh, rh, tmp1)) goto err;
/* rh := rh + b */
if (!BN_GF2m_add(rh, rh, &group->b)) goto err;
/* lh := Y^2 */
if (!group->meth->field_sqr(group, lh, &point->Y, ctx)) goto err;
/* lh := lh + x*y */
if (!group->meth->field_mul(group, tmp1, &point->X, &point->Y, ctx)) goto err;
if (!BN_GF2m_add(lh, lh, tmp1)) goto err;
ret = (0 == BN_GF2m_cmp(lh, rh));
err:
if (ctx) BN_CTX_end(ctx);
if (new_ctx) BN_CTX_free(new_ctx);
return ret;
}
/* Indicates whether two points are equal.
* Return values:
* -1 error
* 0 equal (in affine coordinates)
* 1 not equal
*/
int ec_GF2m_simple_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b, BN_CTX *ctx)
{
BIGNUM *aX, *aY, *bX, *bY;
BN_CTX *new_ctx = NULL;
int ret = -1;
if (EC_POINT_is_at_infinity(group, a))
{
return EC_POINT_is_at_infinity(group, b) ? 0 : 1;
}
if (a->Z_is_one && b->Z_is_one)
{
return ((BN_cmp(&a->X, &b->X) == 0) && BN_cmp(&a->Y, &b->Y) == 0) ? 0 : 1;
}
if (ctx == NULL)
{
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
return -1;
}
BN_CTX_start(ctx);
aX = BN_CTX_get(ctx);
aY = BN_CTX_get(ctx);
bX = BN_CTX_get(ctx);
bY = BN_CTX_get(ctx);
if (bY == NULL) goto err;
if (!EC_POINT_get_affine_coordinates_GF2m(group, a, aX, aY, ctx)) goto err;
if (!EC_POINT_get_affine_coordinates_GF2m(group, b, bX, bY, ctx)) goto err;
ret = ((BN_cmp(aX, bX) == 0) && BN_cmp(aY, bY) == 0) ? 0 : 1;
err:
if (ctx) BN_CTX_end(ctx);
if (new_ctx) BN_CTX_free(new_ctx);
return ret;
}
/* Forces the given EC_POINT to internally use affine coordinates. */
int ec_GF2m_simple_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx)
{
BN_CTX *new_ctx = NULL;
BIGNUM *x, *y;
int ret = 0;
if (point->Z_is_one || EC_POINT_is_at_infinity(group, point))
return 1;
if (ctx == NULL)
{
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
return 0;
}
BN_CTX_start(ctx);
x = BN_CTX_get(ctx);
y = BN_CTX_get(ctx);
if (y == NULL) goto err;
if (!EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
if (!BN_copy(&point->X, x)) goto err;
if (!BN_copy(&point->Y, y)) goto err;
if (!BN_one(&point->Z)) goto err;
ret = 1;
err:
if (ctx) BN_CTX_end(ctx);
if (new_ctx) BN_CTX_free(new_ctx);
return ret;
}
/* Forces each of the EC_POINTs in the given array to use affine coordinates. */
int ec_GF2m_simple_points_make_affine(const EC_GROUP *group, size_t num, EC_POINT *points[], BN_CTX *ctx)
{
size_t i;
for (i = 0; i < num; i++)
{
if (!group->meth->make_affine(group, points[i], ctx)) return 0;
}
return 1;
}
/* Wrapper to simple binary polynomial field multiplication implementation. */
int ec_GF2m_simple_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
{
return BN_GF2m_mod_mul_arr(r, a, b, group->poly, ctx);
}
/* Wrapper to simple binary polynomial field squaring implementation. */
int ec_GF2m_simple_field_sqr(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
{
return BN_GF2m_mod_sqr_arr(r, a, group->poly, ctx);
}
/* Wrapper to simple binary polynomial field division implementation. */
int ec_GF2m_simple_field_div(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
{
return BN_GF2m_mod_div(r, a, b, &group->field, ctx);
}

125
crypto/ec/ec2_smpt.c Normal file
View File

@ -0,0 +1,125 @@
/* crypto/ec/ec2_smpt.c */
/* This code was originally written by Douglas Stebila
* <dstebila@student.math.uwaterloo.ca> for the OpenSSL project.
*/
/* ====================================================================
* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
/* Calaculates and sets the affine coordinates of an EC_POINT from the given
* compressed coordinates. Uses algorithm 2.3.4 of SEC 1.
* Note that the simple implementation only uses affine coordinates.
*
* This algorithm is patented by Certicom Corp. under US Patent 6,141,420.
* This function is disabled by default and can be enabled by defining the
* preprocessor macro OPENSSL_EC_BIN_PT_COMP at Configure-time.
*/
int ec_GF2m_simple_set_compressed_coordinates_GF2m(const EC_GROUP *group, EC_POINT *point,
const BIGNUM *x_, int y_bit, BN_CTX *ctx)
{
#ifndef OPENSSL_EC_BIN_PT_COMP
ECerr(EC_F_EC_GF2M_SIMPLE_SET_COMPRESSED_COORDINATES_GF2M, ERR_R_DISABLED);
return 0;
#else
BN_CTX *new_ctx = NULL;
BIGNUM *tmp, *x, *y, *z;
int ret = 0, z0;
if (ctx == NULL)
{
ctx = new_ctx = BN_CTX_new();
if (ctx == NULL)
return 0;
}
y_bit = (y_bit != 0) ? 1 : 0;
BN_CTX_start(ctx);
tmp = BN_CTX_get(ctx);
x = BN_CTX_get(ctx);
y = BN_CTX_get(ctx);
z = BN_CTX_get(ctx);
if (z == NULL) goto err;
if (!BN_GF2m_mod_arr(x, x_, group->poly)) goto err;
if (BN_is_zero(x))
{
if (!BN_GF2m_mod_sqrt_arr(y, &group->b, group->poly, ctx)) goto err;
}
else
{
if (!group->meth->field_sqr(group, tmp, x, ctx)) goto err;
if (!group->meth->field_div(group, tmp, &group->b, tmp, ctx)) goto err;
if (!BN_GF2m_add(tmp, &group->a, tmp)) goto err;
if (!BN_GF2m_add(tmp, x, tmp)) goto err;
if (!BN_GF2m_mod_solve_quad_arr(z, tmp, group->poly, ctx)) goto err;
z0 = (BN_is_odd(z)) ? 1 : 0;
if (!group->meth->field_mul(group, y, x, z, ctx)) goto err;
if (z0 != y_bit)
{
if (!BN_GF2m_add(y, y, x)) goto err;
}
}
if (!EC_POINT_set_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
ret = 1;
err:
BN_CTX_end(ctx);
if (new_ctx != NULL)
BN_CTX_free(new_ctx);
return ret;
#endif
}

660
crypto/ec/ec_curve.c
View File

@ -52,6 +52,32 @@
* Hudson (tjh@cryptsoft.com).
*
*/
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
*
* Portions of the attached software ("Contribution") are developed by
* SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
*
* The Contribution is licensed pursuant to the OpenSSL open source
* license provided above.
*
* In addition, Sun covenants to all licensees who provide a reciprocal
* covenant with respect to their own patents if any, not to sue under
* current and future patent claims necessarily infringed by the making,
* using, practicing, selling, offering for sale and/or otherwise
* disposing of the Contribution as delivered hereunder
* (or portions thereof), provided that such covenant shall not apply:
* 1) for code that a licensee deletes from the Contribution;
* 2) separates from the Contribution; or
* 3) for infringements caused by:
* i) the modification of the Contribution or
* ii) the combination of the Contribution with other software or
* devices where such combination causes the infringement.
*
* The elliptic curve binary polynomial software is originally written by
* Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
*
*/
#include "ec_lcl.h"
#include <openssl/err.h>
@ -191,12 +217,6 @@
"79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798",0,\
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141",1
/* some wap/wtls curves */
#define _EC_GROUP_WTLS_6 \
"DB7C2ABF62E35E668076BEAD208B",\
"DB7C2ABF62E35E668076BEAD2088",\
"659EF8BA043916EEDE8911702B22",\
"09487239995A5EE76B55F9C2F098",0,\
"DB7C2ABF62E35E7628DFAC6561C5",1
#define _EC_GROUP_WTLS_8 \
"FFFFFFFFFFFFFFFFFFFFFFFFFDE7",\
"0",\
@ -209,6 +229,264 @@
"3",\
"1",0,\
"0100000000000000000001CDC98AE0E2DE574ABF33",1
#define _EC_GROUP_WTLS_12 \
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001", \
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE", \
"B4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4", \
"B70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21", 0, \
"FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D", 1
/* #define _EC_GROUP_EXAMPLE_CHAR2_CURVE \
* "prime polynomial", "a", "b", "base point x-coord", "base point y-coord", "order", "cofactor"
*/
#define _EC_GROUP_SECG_CHAR2_113R1 \
"020000000000000000000000000201", \
"003088250CA6E7C7FE649CE85820F7", \
"00E8BEE4D3E2260744188BE0E9C723", \
"009D73616F35F4AB1407D73562C10F", \
"00A52830277958EE84D1315ED31886", \
"0100000000000000D9CCEC8A39E56F", 2
#define _EC_GROUP_SECG_CHAR2_113R2 \
"020000000000000000000000000201", \
"00689918DBEC7E5A0DD6DFC0AA55C7", \
"0095E9A9EC9B297BD4BF36E059184F", \
"01A57A6A7B26CA5EF52FCDB8164797", \
"00B3ADC94ED1FE674C06E695BABA1D", \
"010000000000000108789B2496AF93", 2
#define _EC_GROUP_SECG_CHAR2_131R1 \
"080000000000000000000000000000010D", \
"07A11B09A76B562144418FF3FF8C2570B8", \
"0217C05610884B63B9C6C7291678F9D341", \
"0081BAF91FDF9833C40F9C181343638399", \
"078C6E7EA38C001F73C8134B1B4EF9E150", \
"0400000000000000023123953A9464B54D", 2
#define _EC_GROUP_SECG_CHAR2_131R2 \
"080000000000000000000000000000010D", \
"03E5A88919D7CAFCBF415F07C2176573B2", \
"04B8266A46C55657AC734CE38F018F2192", \
"0356DCD8F2F95031AD652D23951BB366A8", \
"0648F06D867940A5366D9E265DE9EB240F", \
"0400000000000000016954A233049BA98F", 2
#define _EC_GROUP_SECG_CHAR2_163K1 \
"0800000000000000000000000000000000000000C9", \
"1", \
"1", \
"02FE13C0537BBC11ACAA07D793DE4E6D5E5C94EEE8", \
"0289070FB05D38FF58321F2E800536D538CCDAA3D9", \
"04000000000000000000020108A2E0CC0D99F8A5EF", 2
#define _EC_GROUP_SECG_CHAR2_163R1 \
"0800000000000000000000000000000000000000C9", \
"07B6882CAAEFA84F9554FF8428BD88E246D2782AE2", \
"0713612DCDDCB40AAB946BDA29CA91F73AF958AFD9", \
"0369979697AB43897789566789567F787A7876A654", \
"00435EDB42EFAFB2989D51FEFCE3C80988F41FF883", \
"03FFFFFFFFFFFFFFFFFFFF48AAB689C29CA710279B", 2
#define _EC_GROUP_SECG_CHAR2_163R2 \
"0800000000000000000000000000000000000000C9", \
"1", \
"020A601907B8C953CA1481EB10512F78744A3205FD", \
"03F0EBA16286A2D57EA0991168D4994637E8343E36", \
"00D51FBC6C71A0094FA2CDD545B11C5C0C797324F1", \
"040000000000000000000292FE77E70C12A4234C33", 2
#define _EC_GROUP_SECG_CHAR2_193R1 \
"02000000000000000000000000000000000000000000008001", \
"0017858FEB7A98975169E171F77B4087DE098AC8A911DF7B01", \
"00FDFB49BFE6C3A89FACADAA7A1E5BBC7CC1C2E5D831478814", \
"01F481BC5F0FF84A74AD6CDF6FDEF4BF6179625372D8C0C5E1", \
"0025E399F2903712CCF3EA9E3A1AD17FB0B3201B6AF7CE1B05", \
"01000000000000000000000000C7F34A778F443ACC920EBA49", 2
#define _EC_GROUP_SECG_CHAR2_193R2 \
"02000000000000000000000000000000000000000000008001", \
"0163F35A5137C2CE3EA6ED8667190B0BC43ECD69977702709B", \
"00C9BB9E8927D4D64C377E2AB2856A5B16E3EFB7F61D4316AE", \
"00D9B67D192E0367C803F39E1A7E82CA14A651350AAE617E8F", \
"01CE94335607C304AC29E7DEFBD9CA01F596F927224CDECF6C", \
"010000000000000000000000015AAB561B005413CCD4EE99D5", 2
#define _EC_GROUP_SECG_CHAR2_233K1 \
"020000000000000000000000000000000000000004000000000000000001", \
"0", \
"1", \
"017232BA853A7E731AF129F22FF4149563A419C26BF50A4C9D6EEFAD6126", \
"01DB537DECE819B7F70F555A67C427A8CD9BF18AEB9B56E0C11056FAE6A3", \
"008000000000000000000000000000069D5BB915BCD46EFB1AD5F173ABDF", 4
#define _EC_GROUP_SECG_CHAR2_233R1 \
"020000000000000000000000000000000000000004000000000000000001", \
"000000000000000000000000000000000000000000000000000000000001", \
"0066647EDE6C332C7F8C0923BB58213B333B20E9CE4281FE115F7D8F90AD", \
"00FAC9DFCBAC8313BB2139F1BB755FEF65BC391F8B36F8F8EB7371FD558B", \
"01006A08A41903350678E58528BEBF8A0BEFF867A7CA36716F7E01F81052", \
"01000000000000000000000000000013E974E72F8A6922031D2603CFE0D7", 2
#define _EC_GROUP_SECG_CHAR2_239K1 \
"800000000000000000004000000000000000000000000000000000000001", \
"0", \
"1", \
"29A0B6A887A983E9730988A68727A8B2D126C44CC2CC7B2A6555193035DC", \
"76310804F12E549BDB011C103089E73510ACB275FC312A5DC6B76553F0CA", \
"2000000000000000000000000000005A79FEC67CB6E91F1C1DA800E478A5", 4
#define _EC_GROUP_SECG_CHAR2_283K1 \
"0800000000000000000000000000000000000000000000000000000000000000000010A1", \
"0", \
"1", \
"0503213F78CA44883F1A3B8162F188E553CD265F23C1567A16876913B0C2AC2458492836", \
"01CCDA380F1C9E318D90F95D07E5426FE87E45C0E8184698E45962364E34116177DD2259", \
"01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE9AE2ED07577265DFF7F94451E061E163C61", 4
#define _EC_GROUP_SECG_CHAR2_283R1 \
"0800000000000000000000000000000000000000000000000000000000000000000010A1", \
"000000000000000000000000000000000000000000000000000000000000000000000001", \
"027B680AC8B8596DA5A4AF8A19A0303FCA97FD7645309FA2A581485AF6263E313B79A2F5", \
"05F939258DB7DD90E1934F8C70B0DFEC2EED25B8557EAC9C80E2E198F8CDBECD86B12053", \
"03676854FE24141CB98FE6D4B20D02B4516FF702350EDDB0826779C813F0DF45BE8112F4", \
"03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEF90399660FC938A90165B042A7CEFADB307", 2
#define _EC_GROUP_SECG_CHAR2_409K1 \
"02000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000001", \
"0", \
"1", \
"0060F05F658F49C1AD3AB1890F7184210EFD0987E307C84C27ACCFB8F9F67CC2C460189EB5AAAA62EE222EB1B35540CFE9023746", \
"01E369050B7C4E42ACBA1DACBF04299C3460782F918EA427E6325165E9EA10E3DA5F6C42E9C55215AA9CA27A5863EC48D8E0286B", \
"007FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE5F83B2D4EA20400EC4557D5ED3E3E7CA5B4B5C83B8E01E5FCF", 4
#define _EC_GROUP_SECG_CHAR2_409R1 \
"02000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000001", \
"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001", \
"0021A5C2C8EE9FEB5C4B9A753B7B476B7FD6422EF1F3DD674761FA99D6AC27C8A9A197B272822F6CD57A55AA4F50AE317B13545F", \
"015D4860D088DDB3496B0C6064756260441CDE4AF1771D4DB01FFE5B34E59703DC255A868A1180515603AEAB60794E54BB7996A7", \
"0061B1CFAB6BE5F32BBFA78324ED106A7636B9C5A7BD198D0158AA4F5488D08F38514F1FDF4B4F40D2181B3681C364BA0273C706", \
"010000000000000000000000000000000000000000000000000001E2AAD6A612F33307BE5FA47C3C9E052F838164CD37D9A21173", 2
#define _EC_GROUP_SECG_CHAR2_571K1 \
"80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000425", \
"0", \
"1", \
"026EB7A859923FBC82189631F8103FE4AC9CA2970012D5D46024804801841CA44370958493B205E647DA304DB4CEB08CBBD1BA39494776FB988B47174DCA88C7E2945283A01C8972", \
"0349DC807F4FBF374F4AEADE3BCA95314DD58CEC9F307A54FFC61EFC006D8A2C9D4979C0AC44AEA74FBEBBB9F772AEDCB620B01A7BA7AF1B320430C8591984F601CD4C143EF1C7A3", \
"020000000000000000000000000000000000000000000000000000000000000000000000131850E1F19A63E4B391A8DB917F4138B630D84BE5D639381E91DEB45CFE778F637C1001", 4
#define _EC_GROUP_SECG_CHAR2_571R1 \
"80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000425", \
"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001", \
"02F40E7E2221F295DE297117B7F3D62F5C6A97FFCB8CEFF1CD6BA8CE4A9A18AD84FFABBD8EFA59332BE7AD6756A66E294AFD185A78FF12AA520E4DE739BACA0C7FFEFF7F2955727A", \
"0303001D34B856296C16C0D40D3CD7750A93D1D2955FA80AA5F40FC8DB7B2ABDBDE53950F4C0D293CDD711A35B67FB1499AE60038614F1394ABFA3B4C850D927E1E7769C8EEC2D19", \
"037BF27342DA639B6DCCFFFEB73D69D78C6C27A6009CBBCA1980F8533921E8A684423E43BAB08A576291AF8F461BB2A8B3531D2F0485C19B16E2F1516E23DD3C1A4827AF1B8AC15B", \
"03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE661CE18FF55987308059B186823851EC7DD9CA1161DE93D5174D66E8382E9BB2FE84E47", 2
#define _EC_GROUP_X9_62_CHAR2_163V1 \
"0800000000000000000000000000000000000000C9", \
"072546B5435234A422E0789675F432C89435DE5242", \
"00C9517D06D5240D3CFF38C74B20B6CD4D6F9DD4D9", \
"07AF69989546103D79329FCC3D74880F33BBE803CB", \
"0190C402D65BCC2B845337BC52352774E879B94B0D", \
"0400000000000000000001E60FC8821CC74DAEAFC1", 2
#define _EC_GROUP_X9_62_CHAR2_163V2 \
"0800000000000000000000000000000000000000C9", \
"0108B39E77C4B108BED981ED0E890E117C511CF072", \
"0667ACEB38AF4E488C407433FFAE4F1C811638DF20", \
"0024266E4EB5106D0A964D92C4860E2671DB9B6CC5", \
"01F64F1C0280E19A062003DBAECEAEDEC1CE141D41", \
"03FFFFFFFFFFFFFFFFFFFDF64DE1151ADBB78F10A7", 2
#define _EC_GROUP_X9_62_CHAR2_163V3 \
"0800000000000000000000000000000000000000C9", \
"07A526C63D3E25A256A007699F5447E32AE456B50E", \
"03F7061798EB99E238FD6F1BF95B48FEEB4854252B", \
"02F9F87B7C574D0BDECF8A22E6524775F98CDEBDCB", \
"01D42417D750A363F61E455807D047059CA039ACFE", \
"03FFFFFFFFFFFFFFFFFFFE1AEE140F110AFF961309", 2
#define _EC_GROUP_X9_62_CHAR2_176V1 \
"0100000000000000000000000000000000080000000007", \
"E4E6DB2995065C407D9D39B8D0967B96704BA8E9C90B", \
"5DDA470ABE6414DE8EC133AE28E9BBD7FCEC0AE0FFF2", \
"8D16C2866798B600F9F08BB4A8E860F3298CE04A5798", \
"6FA4539C2DADDDD6BAB5167D61B436E1D92BB16A562C", \
"00010092537397ECA4F6145799D62B0A19CE06FE26AD", 0xFF6E
#define _EC_GROUP_X9_62_CHAR2_191V1 \
"800000000000000000000000000000000000000000000201", \
"2866537B676752636A68F56554E12640276B649EF7526267", \
"2E45EF571F00786F67B0081B9495A3D95462F5DE0AA185EC", \
"36B3DAF8A23206F9C4F299D7B21A9C369137F2C84AE1AA0D", \
"765BE73433B3F95E332932E70EA245CA2418EA0EF98018FB", \
"40000000000000000000000004A20E90C39067C893BBB9A5", 2
#define _EC_GROUP_X9_62_CHAR2_191V2 \
"800000000000000000000000000000000000000000000201", \
"401028774D7777C7B7666D1366EA432071274F89FF01E718", \
"0620048D28BCBD03B6249C99182B7C8CD19700C362C46A01", \
"3809B2B7CC1B28CC5A87926AAD83FD28789E81E2C9E3BF10", \
"17434386626D14F3DBF01760D9213A3E1CF37AEC437D668A", \
"20000000000000000000000050508CB89F652824E06B8173", 4
#define _EC_GROUP_X9_62_CHAR2_191V3 \
"800000000000000000000000000000000000000000000201", \
"6C01074756099122221056911C77D77E77A777E7E7E77FCB", \
"71FE1AF926CF847989EFEF8DB459F66394D90F32AD3F15E8", \
"375D4CE24FDE434489DE8746E71786015009E66E38A926DD", \
"545A39176196575D985999366E6AD34CE0A77CD7127B06BE", \
"155555555555555555555555610C0B196812BFB6288A3EA3", 6
#define _EC_GROUP_X9_62_CHAR2_208W1 \
"010000000000000000000000000000000800000000000000000007", \
"0000000000000000000000000000000000000000000000000000", \
"C8619ED45A62E6212E1160349E2BFA844439FAFC2A3FD1638F9E", \
"89FDFBE4ABE193DF9559ECF07AC0CE78554E2784EB8C1ED1A57A", \
"0F55B51A06E78E9AC38A035FF520D8B01781BEB1A6BB08617DE3", \
"000101BAF95C9723C57B6C21DA2EFF2D5ED588BDD5717E212F9D", 0xFE48
#define _EC_GROUP_X9_62_CHAR2_239V1 \
"800000000000000000000000000000000000000000000000001000000001", \
"32010857077C5431123A46B808906756F543423E8D27877578125778AC76", \
"790408F2EEDAF392B012EDEFB3392F30F4327C0CA3F31FC383C422AA8C16", \
"57927098FA932E7C0A96D3FD5B706EF7E5F5C156E16B7E7C86038552E91D", \
"61D8EE5077C33FECF6F1A16B268DE469C3C7744EA9A971649FC7A9616305", \
"2000000000000000000000000000000F4D42FFE1492A4993F1CAD666E447", 4
#define _EC_GROUP_X9_62_CHAR2_239V2 \
"800000000000000000000000000000000000000000000000001000000001", \
"4230017757A767FAE42398569B746325D45313AF0766266479B75654E65F", \
"5037EA654196CFF0CD82B2C14A2FCF2E3FF8775285B545722F03EACDB74B", \
"28F9D04E900069C8DC47A08534FE76D2B900B7D7EF31F5709F200C4CA205", \
"5667334C45AFF3B5A03BAD9DD75E2C71A99362567D5453F7FA6E227EC833", \
"1555555555555555555555555555553C6F2885259C31E3FCDF154624522D", 6
#define _EC_GROUP_X9_62_CHAR2_239V3 \
"800000000000000000000000000000000000000000000000001000000001", \
"01238774666A67766D6676F778E676B66999176666E687666D8766C66A9F", \
"6A941977BA9F6A435199ACFC51067ED587F519C5ECB541B8E44111DE1D40", \
"70F6E9D04D289C4E89913CE3530BFDE903977D42B146D539BF1BDE4E9C92", \
"2E5A0EAF6E5E1305B9004DCE5C0ED7FE59A35608F33837C816D80B79F461", \
"0CCCCCCCCCCCCCCCCCCCCCCCCCCCCCAC4912D2D9DF903EF9888B8A0E4CFF", 0xA
#define _EC_GROUP_X9_62_CHAR2_272W1 \
"010000000000000000000000000000000000000000000000000000010000000000000B", \
"91A091F03B5FBA4AB2CCF49C4EDD220FB028712D42BE752B2C40094DBACDB586FB20", \
"7167EFC92BB2E3CE7C8AAAFF34E12A9C557003D7C73A6FAF003F99F6CC8482E540F7", \
"6108BABB2CEEBCF787058A056CBE0CFE622D7723A289E08A07AE13EF0D10D171DD8D", \
"10C7695716851EEF6BA7F6872E6142FBD241B830FF5EFCACECCAB05E02005DDE9D23", \
"000100FAF51354E0E39E4892DF6E319C72C8161603FA45AA7B998A167B8F1E629521", 0xFF06
#define _EC_GROUP_X9_62_CHAR2_304W1 \
"010000000000000000000000000000000000000000000000000000000000000000000000000807", \
"FD0D693149A118F651E6DCE6802085377E5F882D1B510B44160074C1288078365A0396C8E681", \
"BDDB97E555A50A908E43B01C798EA5DAA6788F1EA2794EFCF57166B8C14039601E55827340BE", \
"197B07845E9BE2D96ADB0F5F3C7F2CFFBD7A3EB8B6FEC35C7FD67F26DDF6285A644F740A2614", \
"E19FBEB76E0DA171517ECF401B50289BF014103288527A9B416A105E80260B549FDC1B92C03B", \
"000101D556572AABAC800101D556572AABAC8001022D5C91DD173F8FB561DA6899164443051D", 0xFE2E
#define _EC_GROUP_X9_62_CHAR2_359V1 \
"800000000000000000000000000000000000000000000000000000000000000000000000100000000000000001", \
"5667676A654B20754F356EA92017D946567C46675556F19556A04616B567D223A5E05656FB549016A96656A557", \
"2472E2D0197C49363F1FE7F5B6DB075D52B6947D135D8CA445805D39BC345626089687742B6329E70680231988", \
"3C258EF3047767E7EDE0F1FDAA79DAEE3841366A132E163ACED4ED2401DF9C6BDCDE98E8E707C07A2239B1B097", \
"53D7E08529547048121E9C95F3791DD804963948F34FAE7BF44EA82365DC7868FE57E4AE2DE211305A407104BD", \
"01AF286BCA1AF286BCA1AF286BCA1AF286BCA1AF286BC9FB8F6B85C556892C20A7EB964FE7719E74F490758D3B", 0x4C
#define _EC_GROUP_X9_62_CHAR2_368W1 \
"0100000000000000000000000000000000000000000000000000000000000000000000002000000000000000000007", \
"E0D2EE25095206F5E2A4F9ED229F1F256E79A0E2B455970D8D0D865BD94778C576D62F0AB7519CCD2A1A906AE30D", \
"FC1217D4320A90452C760A58EDCD30C8DD069B3C34453837A34ED50CB54917E1C2112D84D164F444F8F74786046A", \
"1085E2755381DCCCE3C1557AFA10C2F0C0C2825646C5B34A394CBCFA8BC16B22E7E789E927BE216F02E1FB136A5F", \
"7B3EB1BDDCBA62D5D8B2059B525797FC73822C59059C623A45FF3843CEE8F87CD1855ADAA81E2A0750B80FDA2310", \
"00010090512DA9AF72B08349D98A5DD4C7B0532ECA51CE03E2D10F3B7AC579BD87E909AE40A6F131E9CFCE5BD967", 0xFF70
#define _EC_GROUP_X9_62_CHAR2_431R1 \
"800000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000001", \
"1A827EF00DD6FC0E234CAF046C6A5D8A85395B236CC4AD2CF32A0CADBDC9DDF620B0EB9906D0957F6C6FEACD615468DF104DE296CD8F", \
"10D9B4A3D9047D8B154359ABFB1B7F5485B04CEB868237DDC9DEDA982A679A5A919B626D4E50A8DD731B107A9962381FB5D807BF2618", \
"120FC05D3C67A99DE161D2F4092622FECA701BE4F50F4758714E8A87BBF2A658EF8C21E7C5EFE965361F6C2999C0C247B0DBD70CE6B7", \
"20D0AF8903A96F8D5FA2C255745D3C451B302C9346D9B7E485E7BCE41F6B591F3E8F6ADDCBB0BC4C2F947A7DE1A89B625D6A598B3760", \
"0340340340340340340340340340340340340340340340340340340323C313FAB50589703B5EC68D3587FEC60D161CC149C1AD4A91", 0x2760
#define _EC_GROUP_WTLS_1 \
"020000000000000000000000000201", \
"1", \
"1", \
"01667979A40BA497E5D5C270780617", \
"00F44B4AF1ECC2630E08785CEBCC15", \
"00FFFFFFFFFFFFFFFDBF91AF6DEA73", 2
static EC_GROUP *ec_group_new_GFp_from_hex(const char *prime_in,
const char *a_in, const char *b_in,
@ -256,6 +534,54 @@ err:
return(group);
}
static EC_GROUP *ec_group_new_GF2m_from_hex(const char *prime_in,
const char *a_in, const char *b_in,
const char *x_in, const char *y_in, const char *order_in, const BN_ULONG cofac_in)
{
EC_GROUP *group=NULL;
EC_POINT *P=NULL;
BN_CTX *ctx=NULL;
BIGNUM *prime=NULL,*a=NULL,*b=NULL,*x=NULL,*y=NULL,*order=NULL;
int ok=0;
if ((ctx = BN_CTX_new()) == NULL) goto bn_err;
if ((prime = BN_new()) == NULL || (a = BN_new()) == NULL || (b = BN_new()) == NULL ||
(x = BN_new()) == NULL || (y = BN_new()) == NULL || (order = BN_new()) == NULL) goto bn_err;
if (!BN_hex2bn(&prime, prime_in)) goto bn_err;
if (!BN_hex2bn(&a, a_in)) goto bn_err;
if (!BN_hex2bn(&b, b_in)) goto bn_err;
if ((group = EC_GROUP_new_curve_GF2m(prime, a, b, ctx)) == NULL) goto err;
if ((P = EC_POINT_new(group)) == NULL) goto err;
if (!BN_hex2bn(&x, x_in)) goto bn_err;
if (!BN_hex2bn(&y, y_in)) goto bn_err;
if (!EC_POINT_set_affine_coordinates_GF2m(group, P, x, y, ctx)) goto err;
if (!BN_hex2bn(&order, order_in)) goto bn_err;
if (!BN_set_word(x, cofac_in)) goto bn_err;
if (!EC_GROUP_set_generator(group, P, order, x)) goto err;
ok=1;
bn_err:
if (!ok)
ECerr(EC_F_EC_GROUP_NEW_GF2M_FROM_HEX, ERR_R_BN_LIB);
err:
if (!ok)
{
EC_GROUP_free(group);
group = NULL;
}
if (P) EC_POINT_free(P);
if (ctx) BN_CTX_free(ctx);
if (prime) BN_free(prime);
if (a) BN_free(a);
if (b) BN_free(b);
if (order) BN_free(order);
if (x) BN_free(x);
if (y) BN_free(y);
return(group);
}
EC_GROUP *EC_GROUP_new_by_name(int name)
{
EC_GROUP *ret = NULL;
@ -263,87 +589,273 @@ EC_GROUP *EC_GROUP_new_by_name(int name)
{
case EC_GROUP_NO_CURVE:
return NULL;
/* some nist curves */
case EC_GROUP_NIST_PRIME_224: /* EC_GROUP_NIST_PRIME_224 == EC_GROUP_SECG_PRIME_224R1 */
ret = ec_group_new_GFp_from_hex(_EC_GROUP_NIST_PRIME_224);
break;
case EC_GROUP_NIST_PRIME_384: /* EC_GROUP_NIST_PRIME_384 == EC_GROUP_SECG_PRIME_384R1 */
ret = ec_group_new_GFp_from_hex(_EC_GROUP_NIST_PRIME_384);
break;
case EC_GROUP_NIST_PRIME_521: /* EC_GROUP_NIST_PRIME_521 == EC_GROUP_SECG_PRIME_521R1 */
ret = ec_group_new_GFp_from_hex(_EC_GROUP_NIST_PRIME_521);
break;
/* x9.62 prime curves */
case EC_GROUP_X9_62_PRIME_192V1: /* == EC_GROUP_NIST_PRIME_192 == EC_GROUP_SECG_PRIME_192R1 */
ret = ec_group_new_GFp_from_hex(_EC_GROUP_NIST_PRIME_192);
break;
case EC_GROUP_X9_62_PRIME_192V2:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_X9_62_PRIME_192V2);
break;
case EC_GROUP_X9_62_PRIME_192V3:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_X9_62_PRIME_192V3);
break;
case EC_GROUP_X9_62_PRIME_239V1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_X9_62_PRIME_239V1);
break;
case EC_GROUP_X9_62_PRIME_239V2:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_X9_62_PRIME_239V2);
break;
case EC_GROUP_X9_62_PRIME_239V3:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_X9_62_PRIME_239V3);
break;
case EC_GROUP_X9_62_PRIME_256V1: /* == EC_GROUP_NIST_PRIME_256 == EC_GROUP_SECG_PRIME_256R1 */
ret = ec_group_new_GFp_from_hex(_EC_GROUP_X9_62_PRIME_256V1);
break;
/* the remaining secg curves */
/* prime field curves */
/* prime field curves of degree 112 */
case EC_GROUP_SECG_PRIME_112R1:
case EC_GROUP_WTLS_6:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_112R1);
break;
case EC_GROUP_SECG_PRIME_112R2:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_112R2);
break;
case EC_GROUP_SECG_PRIME_128R1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_128R1);
break;
case EC_GROUP_SECG_PRIME_128R2:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_128R2);
break;
case EC_GROUP_SECG_PRIME_160K1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_160K1);
break;
case EC_GROUP_SECG_PRIME_160R1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_160R1);
break;
case EC_GROUP_SECG_PRIME_160R2:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_160R2);
break;
case EC_GROUP_SECG_PRIME_192K1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_192K1);
break;
case EC_GROUP_SECG_PRIME_224K1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_224K1);
break;
case EC_GROUP_SECG_PRIME_256K1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_256K1);
break;
/* some wap/wtls curves */
case EC_GROUP_WTLS_6:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_WTLS_6);
break;
case EC_GROUP_WTLS_8:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_WTLS_8);
break;
/* prime field curves of degree 128 */
case EC_GROUP_SECG_PRIME_128R1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_128R1);
break;
case EC_GROUP_SECG_PRIME_128R2:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_128R2);
break;
/* prime field curves of degree 160 */
case EC_GROUP_SECG_PRIME_160K1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_160K1);
break;
case EC_GROUP_SECG_PRIME_160R1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_160R1);
break;
case EC_GROUP_SECG_PRIME_160R2:
case EC_GROUP_WTLS_7:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_160R2);
break;
case EC_GROUP_WTLS_9:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_WTLS_9);
break;
/* prime field curves of degree 192 */
case EC_GROUP_SECG_PRIME_192K1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_192K1);
break;
case EC_GROUP_X9_62_PRIME_192V1: /* == EC_GROUP_NIST_PRIME_192 == EC_GROUP_SECG_PRIME_192R1 */
ret = ec_group_new_GFp_from_hex(_EC_GROUP_NIST_PRIME_192);
break;
case EC_GROUP_X9_62_PRIME_192V2:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_X9_62_PRIME_192V2);
break;
case EC_GROUP_X9_62_PRIME_192V3:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_X9_62_PRIME_192V3);
break;
/* prime field curves of degree 224 */
case EC_GROUP_SECG_PRIME_224K1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_224K1);
break;
case EC_GROUP_SECG_PRIME_224R1: /* == EC_GROUP_NIST_PRIME_224 */
ret = ec_group_new_GFp_from_hex(_EC_GROUP_NIST_PRIME_224);
break;
case EC_GROUP_WTLS_12:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_WTLS_12);
break;
/* prime field curves of degree 239 */
case EC_GROUP_X9_62_PRIME_239V1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_X9_62_PRIME_239V1);
break;
case EC_GROUP_X9_62_PRIME_239V2:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_X9_62_PRIME_239V2);
break;
case EC_GROUP_X9_62_PRIME_239V3:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_X9_62_PRIME_239V3);
break;
/* prime field curves of degree 256 */
case EC_GROUP_SECG_PRIME_256K1:
ret = ec_group_new_GFp_from_hex(_EC_GROUP_SECG_PRIME_256K1);
break;
case EC_GROUP_SECG_PRIME_256R1: /* == EC_GROUP_NIST_PRIME_256 == EC_GROUP_X9_62_PRIME_256V1 */
ret = ec_group_new_GFp_from_hex(_EC_GROUP_X9_62_PRIME_256V1);
break;
/* prime field curves of degree 384 */
case EC_GROUP_SECG_PRIME_384R1: /* == EC_GROUP_NIST_PRIME_384 */
ret = ec_group_new_GFp_from_hex(_EC_GROUP_NIST_PRIME_384);
break;
/* prime field curves of degree 521 */
case EC_GROUP_SECG_PRIME_521R1: /* == EC_GROUP_NIST_PRIME_521 */
ret = ec_group_new_GFp_from_hex(_EC_GROUP_NIST_PRIME_521);
break;
/* characteristic two field curves */
/* binary curves of degree 113 */
case EC_GROUP_SECG_CHAR2_113R1:
case EC_GROUP_WTLS_4:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_113R1);
break;
case EC_GROUP_SECG_CHAR2_113R2:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_113R2);
break;
case EC_GROUP_WTLS_1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_WTLS_1);
break;
/* binary curves of degree 131 */
case EC_GROUP_SECG_CHAR2_131R1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_131R1);
break;
case EC_GROUP_SECG_CHAR2_131R2:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_131R2);
break;
/* binary curves of degree 163 */
case EC_GROUP_SECG_CHAR2_163K1: /* == EC_GROUP_NIST_CHAR2_K163 */
case EC_GROUP_WTLS_3:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_163K1);
break;
case EC_GROUP_SECG_CHAR2_163R1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_163R1);
break;
case EC_GROUP_SECG_CHAR2_163R2: /* == EC_GROUP_NIST_CHAR2_B163 */
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_163R2);
break;
case EC_GROUP_X9_62_CHAR2_163V1:
case EC_GROUP_WTLS_5:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_163V1);
break;
case EC_GROUP_X9_62_CHAR2_163V2:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_163V2);
break;
case EC_GROUP_X9_62_CHAR2_163V3:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_163V3);
break;
/* binary curves of degree 176 */
case EC_GROUP_X9_62_CHAR2_176V1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_176V1);
break;
/* binary curves of degree 191 */
case EC_GROUP_X9_62_CHAR2_191V1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_191V1);
break;
case EC_GROUP_X9_62_CHAR2_191V2:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_191V2);
break;
case EC_GROUP_X9_62_CHAR2_191V3:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_191V3);
break;
/* binary curves of degree 193 */
case EC_GROUP_SECG_CHAR2_193R1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_193R1);
break;
case EC_GROUP_SECG_CHAR2_193R2:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_193R2);
break;
/* binary curves of degree 208 */
case EC_GROUP_X9_62_CHAR2_208W1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_208W1);
break;
/* binary curves of degree 233 */
case EC_GROUP_SECG_CHAR2_233K1: /* == EC_GROUP_NIST_CHAR2_K233 */
case EC_GROUP_WTLS_10:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_233K1);
break;
case EC_GROUP_SECG_CHAR2_233R1: /* == EC_GROUP_NIST_CHAR2_B233 */
case EC_GROUP_WTLS_11:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_233R1);
break;
/* binary curves of degree 239 */
case EC_GROUP_SECG_CHAR2_239K1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_239K1);
break;
case EC_GROUP_X9_62_CHAR2_239V1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_239V1);
break;
case EC_GROUP_X9_62_CHAR2_239V2:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_239V2);
break;
case EC_GROUP_X9_62_CHAR2_239V3:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_239V3);
break;
/* binary curves of degree 272 */
case EC_GROUP_X9_62_CHAR2_272W1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_272W1);
break;
/* binary curves of degree 283 */
case EC_GROUP_SECG_CHAR2_283K1: /* == EC_GROUP_NIST_CHAR2_K283 */
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_283K1);
break;
case EC_GROUP_SECG_CHAR2_283R1: /* == EC_GROUP_NIST_CHAR2_B283 */
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_283R1);
break;
/* binary curves of degree 304 */
case EC_GROUP_X9_62_CHAR2_304W1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_304W1);
break;
/* binary curves of degree 359 */
case EC_GROUP_X9_62_CHAR2_359V1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_359V1);
break;
/* binary curves of degree 368 */
case EC_GROUP_X9_62_CHAR2_368W1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_368W1);
break;
/* binary curves of degree 409 */
case EC_GROUP_SECG_CHAR2_409K1: /* == EC_GROUP_NIST_CHAR2_K409 */
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_409K1);
break;
case EC_GROUP_SECG_CHAR2_409R1: /* == EC_GROUP_NIST_CHAR2_B409 */
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_409R1);
break;
/* binary curves of degree 431 */
case EC_GROUP_X9_62_CHAR2_431R1:
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_X9_62_CHAR2_431R1);
break;
/* binary curves of degree 571 */
case EC_GROUP_SECG_CHAR2_571K1: /* == EC_GROUP_NIST_CHAR2_K571 */
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_571K1);
break;
case EC_GROUP_SECG_CHAR2_571R1: /* == EC_GROUP_NIST_CHAR2_B571 */
ret = ec_group_new_GF2m_from_hex(_EC_GROUP_SECG_CHAR2_571R1);
break;
}
if (ret == NULL)

46
crypto/ec/ec_cvt.c
View File

@ -52,6 +52,32 @@
* Hudson (tjh@cryptsoft.com).
*
*/
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
*
* Portions of the attached software ("Contribution") are developed by
* SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
*
* The Contribution is licensed pursuant to the OpenSSL open source
* license provided above.
*
* In addition, Sun covenants to all licensees who provide a reciprocal
* covenant with respect to their own patents if any, not to sue under
* current and future patent claims necessarily infringed by the making,
* using, practicing, selling, offering for sale and/or otherwise
* disposing of the Contribution as delivered hereunder
* (or portions thereof), provided that such covenant shall not apply:
* 1) for code that a licensee deletes from the Contribution;
* 2) separates from the Contribution; or
* 3) for infringements caused by:
* i) the modification of the Contribution or
* ii) the combination of the Contribution with other software or
* devices where such combination causes the infringement.
*
* The elliptic curve binary polynomial software is originally written by
* Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
*
*/
#include "ec_lcl.h"
@ -78,3 +104,23 @@ EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a, const BIGNUM
return ret;
}
EC_GROUP *EC_GROUP_new_curve_GF2m(const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
{
const EC_METHOD *meth;
EC_GROUP *ret;
meth = EC_GF2m_simple_method();
ret = EC_GROUP_new(meth);
if (ret == NULL)
return NULL;
if (!EC_GROUP_set_curve_GF2m(ret, p, a, b, ctx))
{
EC_GROUP_clear_free(ret);
return NULL;
}
return ret;
}

18
crypto/ec/ec_err.c
View File

@ -78,6 +78,12 @@ static ERR_STRING_DATA EC_str_functs[]=
{ERR_PACK(0,EC_F_EC_ASN1_GROUP2PKPARAMETERS,0), "EC_ASN1_group2pkparameters"},
{ERR_PACK(0,EC_F_EC_ASN1_PARAMETERS2GROUP,0), "EC_ASN1_PARAMETERS2GROUP"},
{ERR_PACK(0,EC_F_EC_ASN1_PKPARAMETERS2GROUP,0), "EC_ASN1_pkparameters2group"},
{ERR_PACK(0,EC_F_EC_GF2M_SIMPLE_GROUP_CHECK_DISCRIMINANT,0), "ec_GF2m_simple_group_check_discriminant"},
{ERR_PACK(0,EC_F_EC_GF2M_SIMPLE_OCT2POINT,0), "ec_GF2m_simple_oct2point"},
{ERR_PACK(0,EC_F_EC_GF2M_SIMPLE_POINT2OCT,0), "ec_GF2m_simple_point2oct"},
{ERR_PACK(0,EC_F_EC_GF2M_SIMPLE_POINT_GET_AFFINE_COORDINATES_GF2M,0), "ec_GF2m_simple_point_get_affine_coordinates_GF2m"},
{ERR_PACK(0,EC_F_EC_GF2M_SIMPLE_POINT_SET_AFFINE_COORDINATES_GF2M,0), "ec_GF2m_simple_point_set_affine_coordinates_GF2m"},
{ERR_PACK(0,EC_F_EC_GF2M_SIMPLE_SET_COMPRESSED_COORDINATES_GF2M,0), "ec_GF2m_simple_set_compressed_coordinates_GF2m"},
{ERR_PACK(0,EC_F_EC_GFP_MONT_FIELD_DECODE,0), "ec_GFp_mont_field_decode"},
{ERR_PACK(0,EC_F_EC_GFP_MONT_FIELD_ENCODE,0), "ec_GFp_mont_field_encode"},
{ERR_PACK(0,EC_F_EC_GFP_MONT_FIELD_MUL,0), "ec_GFp_mont_field_mul"},
@ -97,15 +103,19 @@ static ERR_STRING_DATA EC_str_functs[]=
{ERR_PACK(0,EC_F_EC_GROUP_COPY,0), "EC_GROUP_copy"},
{ERR_PACK(0,EC_F_EC_GROUP_GET0_GENERATOR,0), "EC_GROUP_get0_generator"},
{ERR_PACK(0,EC_F_EC_GROUP_GET_COFACTOR,0), "EC_GROUP_get_cofactor"},
{ERR_PACK(0,EC_F_EC_GROUP_GET_CURVE_GF2M,0), "EC_GROUP_get_curve_GF2m"},
{ERR_PACK(0,EC_F_EC_GROUP_GET_CURVE_GFP,0), "EC_GROUP_get_curve_GFp"},
{ERR_PACK(0,EC_F_EC_GROUP_GET_DEGREE,0), "EC_GROUP_get_degree"},
{ERR_PACK(0,EC_F_EC_GROUP_GET_EXTRA_DATA,0), "EC_GROUP_get_extra_data"},
{ERR_PACK(0,EC_F_EC_GROUP_GET_ORDER,0), "EC_GROUP_get_order"},
{ERR_PACK(0,EC_F_EC_GROUP_GROUP2NID,0), "EC_GROUP_GROUP2NID"},
{ERR_PACK(0,EC_F_EC_GROUP_NEW,0), "EC_GROUP_new"},
{ERR_PACK(0,EC_F_EC_GROUP_NEW_BY_NAME,0), "EC_GROUP_new_by_name"},
{ERR_PACK(0,EC_F_EC_GROUP_NEW_BY_NID,0), "EC_GROUP_new_by_nid"},
{ERR_PACK(0,EC_F_EC_GROUP_NEW_GF2M_FROM_HEX,0), "EC_GROUP_NEW_GF2M_FROM_HEX"},
{ERR_PACK(0,EC_F_EC_GROUP_NEW_GFP_FROM_HEX,0), "EC_GROUP_NEW_GFP_FROM_HEX"},
{ERR_PACK(0,EC_F_EC_GROUP_PRECOMPUTE_MULT,0), "EC_GROUP_precompute_mult"},
{ERR_PACK(0,EC_F_EC_GROUP_SET_CURVE_GF2M,0), "EC_GROUP_set_curve_GF2m"},
{ERR_PACK(0,EC_F_EC_GROUP_SET_CURVE_GFP,0), "EC_GROUP_set_curve_GFp"},
{ERR_PACK(0,EC_F_EC_GROUP_SET_EXTRA_DATA,0), "EC_GROUP_set_extra_data"},
{ERR_PACK(0,EC_F_EC_GROUP_SET_GENERATOR,0), "EC_GROUP_set_generator"},
@ -115,18 +125,26 @@ static ERR_STRING_DATA EC_str_functs[]=
{ERR_PACK(0,EC_F_EC_POINT_CMP,0), "EC_POINT_cmp"},
{ERR_PACK(0,EC_F_EC_POINT_COPY,0), "EC_POINT_copy"},
{ERR_PACK(0,EC_F_EC_POINT_DBL,0), "EC_POINT_dbl"},
{ERR_PACK(0,EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M,0), "EC_POINT_get_affine_coordinates_GF2m"},
{ERR_PACK(0,EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP,0), "EC_POINT_get_affine_coordinates_GFp"},
{ERR_PACK(0,EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GF2M,0), "EC_POINT_get_Jprojective_coordinates_GF2m"},
{ERR_PACK(0,EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP,0), "EC_POINT_get_Jprojective_coordinates_GFp"},
{ERR_PACK(0,EC_F_EC_POINT_IS_AT_INFINITY,0), "EC_POINT_is_at_infinity"},
{ERR_PACK(0,EC_F_EC_POINT_IS_ON_CURVE,0), "EC_POINT_is_on_curve"},
{ERR_PACK(0,EC_F_EC_POINT_MAKE_AFFINE,0), "EC_POINT_make_affine"},
{ERR_PACK(0,EC_F_EC_POINT_MUL,0), "EC_POINT_mul"},
{ERR_PACK(0,EC_F_EC_POINT_NEW,0), "EC_POINT_new"},
{ERR_PACK(0,EC_F_EC_POINT_OCT2POINT,0), "EC_POINT_oct2point"},
{ERR_PACK(0,EC_F_EC_POINT_POINT2OCT,0), "EC_POINT_point2oct"},
{ERR_PACK(0,EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M,0), "EC_POINT_set_affine_coordinates_GF2m"},
{ERR_PACK(0,EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP,0), "EC_POINT_set_affine_coordinates_GFp"},
{ERR_PACK(0,EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GF2M,0), "EC_POINT_set_compressed_coordinates_GF2m"},
{ERR_PACK(0,EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GFP,0), "EC_POINT_set_compressed_coordinates_GFp"},
{ERR_PACK(0,EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GF2M,0), "EC_POINT_set_Jprojective_coordinates_GF2m"},
{ERR_PACK(0,EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP,0), "EC_POINT_set_Jprojective_coordinates_GFp"},
{ERR_PACK(0,EC_F_EC_POINT_SET_TO_INFINITY,0), "EC_POINT_set_to_infinity"},
{ERR_PACK(0,EC_F_EC_WNAF_MUL,0), "ec_wNAF_mul"},
{ERR_PACK(0,EC_F_EC_WNAF_PRECOMPUTE_MULT,0), "ec_wNAF_precompute_mult"},
{ERR_PACK(0,EC_F_GFP_MONT_GROUP_SET_CURVE_GFP,0), "GFP_MONT_GROUP_SET_CURVE_GFP"},
{ERR_PACK(0,EC_F_I2D_ECDSAPARAMETERS,0), "i2d_ECDSAParameters"},
{ERR_PACK(0,EC_F_I2D_ECPARAMETERS,0), "i2d_ECParameters"},

113
crypto/ec/ec_lcl.h
View File

@ -52,6 +52,32 @@
* Hudson (tjh@cryptsoft.com).
*
*/
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
*
* Portions of the attached software ("Contribution") are developed by
* SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
*
* The Contribution is licensed pursuant to the OpenSSL open source
* license provided above.
*
* In addition, Sun covenants to all licensees who provide a reciprocal
* covenant with respect to their own patents if any, not to sue under
* current and future patent claims necessarily infringed by the making,
* using, practicing, selling, offering for sale and/or otherwise
* disposing of the Contribution as delivered hereunder
* (or portions thereof), provided that such covenant shall not apply:
* 1) for code that a licensee deletes from the Contribution;
* 2) separates from the Contribution; or
* 3) for infringements caused by:
* i) the modification of the Contribution or
* ii) the combination of the Contribution with other software or
* devices where such combination causes the infringement.
*
* The elliptic curve binary polynomial software is originally written by
* Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
*
*/
#include <stdlib.h>
@ -73,9 +99,13 @@ struct ec_method_st {
void (*group_clear_finish)(EC_GROUP *);
int (*group_copy)(EC_GROUP *, const EC_GROUP *);
/* used by EC_GROUP_set_curve_GFp and EC_GROUP_get_curve_GFp: */
int (*group_set_curve_GFp)(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
int (*group_get_curve_GFp)(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
/* used by EC_GROUP_set_curve_GFp, EC_GROUP_get_curve_GFp, */
/* EC_GROUP_set_curve_GF2m, and EC_GROUP_get_curve_GF2m: */
int (*group_set_curve)(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
int (*group_get_curve)(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
/* used by EC_GROUP_get_degree: */
int (*group_get_degree)(const EC_GROUP *);
/* used by EC_GROUP_check: */
int (*group_check_discriminant)(const EC_GROUP *, BN_CTX *);
@ -89,18 +119,20 @@ struct ec_method_st {
/* used by EC_POINT_set_to_infinity,
* EC_POINT_set_Jprojective_coordinates_GFp, EC_POINT_get_Jprojective_coordinates_GFp,
* EC_POINT_set_affine_coordinates_GFp, EC_POINT_get_affine_coordinates_GFp,
* EC_POINT_set_compressed_coordinates_GFp:
* EC_POINT_set_compressed_coordinates_GFp, EC_POINT_set_Jprojective_coordinates_GF2m,
* EC_POINT_get_Jprojective_coordinates_GF2m, EC_POINT_set_affine_coordinates_GF2m,
* EC_POINT_get_affine_coordinates_GF2m, and EC_POINT_set_compressed_coordinates_GF2m:
*/
int (*point_set_to_infinity)(const EC_GROUP *, EC_POINT *);
int (*point_set_Jprojective_coordinates_GFp)(const EC_GROUP *, EC_POINT *,
int (*point_set_Jprojective_coordinates)(const EC_GROUP *, EC_POINT *,
const BIGNUM *x, const BIGNUM *y, const BIGNUM *z, BN_CTX *);
int (*point_get_Jprojective_coordinates_GFp)(const EC_GROUP *, const EC_POINT *,
int (*point_get_Jprojective_coordinates)(const EC_GROUP *, const EC_POINT *,
BIGNUM *x, BIGNUM *y, BIGNUM *z, BN_CTX *);
int (*point_set_affine_coordinates_GFp)(const EC_GROUP *, EC_POINT *,
int (*point_set_affine_coordinates)(const EC_GROUP *, EC_POINT *,
const BIGNUM *x, const BIGNUM *y, BN_CTX *);
int (*point_get_affine_coordinates_GFp)(const EC_GROUP *, const EC_POINT *,
int (*point_get_affine_coordinates)(const EC_GROUP *, const EC_POINT *,
BIGNUM *x, BIGNUM *y, BN_CTX *);
int (*point_set_compressed_coordinates_GFp)(const EC_GROUP *, EC_POINT *,
int (*point_set_compressed_coordinates)(const EC_GROUP *, EC_POINT *,
const BIGNUM *x, int y_bit, BN_CTX *);
/* used by EC_POINT_point2oct, EC_POINT_oct2point: */
@ -114,6 +146,11 @@ struct ec_method_st {
int (*dbl)(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, BN_CTX *);
int (*invert)(const EC_GROUP *, EC_POINT *, BN_CTX *);
/* used by EC_POINTs_mul, EC_POINT_mul, EC_POINT_precompute_mult: */
int (*mul)(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
int (*precompute_mult)(EC_GROUP *group, BN_CTX *);
/* used by EC_POINT_is_at_infinity, EC_POINT_is_on_curve, EC_POINT_cmp: */
int (*is_at_infinity)(const EC_GROUP *, const EC_POINT *);
int (*is_on_curve)(const EC_GROUP *, const EC_POINT *, BN_CTX *);
@ -126,11 +163,12 @@ struct ec_method_st {
/* internal functions */
/* 'field_mul' and 'field_sqr' can be used by 'add' and 'dbl' so that
/* 'field_mul', 'field_sqr', and 'field_div' can be used by 'add' and 'dbl' so that
* the same implementations of point operations can be used with different
* optimized implementations of expensive field operations: */
int (*field_mul)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
int (*field_sqr)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *);
int (*field_div)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
int (*field_encode)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *); /* e.g. to Montgomery */
int (*field_decode)(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *); /* e.g. from Montgomery */
@ -165,6 +203,12 @@ struct ec_group_st {
* irreducible polynomial defining the field.
*/
unsigned int poly[5]; /* Field specification for curves over GF(2^m).
* The irreducible f(t) is then of the form:
* t^poly[0] + t^poly[1] + ... + t^poly[k]
* where m = poly[0] > poly[1] > ... > poly[k] = 0.
*/
BIGNUM a, b; /* Curve coefficients.
* (Here the assumption is that BIGNUMs can be used
* or abused for all kinds of fields, not just GF(p).)
@ -213,6 +257,11 @@ struct ec_point_st {
/* method functions in ec_mult.c */
int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
int ec_wNAF_precompute_mult(EC_GROUP *group, BN_CTX *);
/* method functions in ecp_smpl.c */
int ec_GFp_simple_group_init(EC_GROUP *);
void ec_GFp_simple_group_finish(EC_GROUP *);
@ -220,6 +269,7 @@ void ec_GFp_simple_group_clear_finish(EC_GROUP *);
int ec_GFp_simple_group_copy(EC_GROUP *, const EC_GROUP *);
int ec_GFp_simple_group_set_curve_GFp(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
int ec_GFp_simple_group_get_curve_GFp(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
int ec_GFp_simple_group_get_degree(const EC_GROUP *);
int ec_GFp_simple_group_check_discriminant(const EC_GROUP *, BN_CTX *);
int ec_GFp_simple_point_init(EC_POINT *);
void ec_GFp_simple_point_finish(EC_POINT *);
@ -283,3 +333,46 @@ void ec_GFp_nist_group_clear_finish(EC_GROUP *);
int ec_GFp_nist_group_copy(EC_GROUP *, const EC_GROUP *);
int ec_GFp_nist_field_mul(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
int ec_GFp_nist_field_sqr(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *);
/* method functions in ec2_smpl.c */
int ec_GF2m_simple_group_init(EC_GROUP *);
void ec_GF2m_simple_group_finish(EC_GROUP *);
void ec_GF2m_simple_group_clear_finish(EC_GROUP *);
int ec_GF2m_simple_group_copy(EC_GROUP *, const EC_GROUP *);
int ec_GF2m_simple_group_set_curve_GF2m(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
int ec_GF2m_simple_group_get_curve_GF2m(const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *);
int ec_GF2m_simple_group_get_degree(const EC_GROUP *);
int ec_GF2m_simple_group_check_discriminant(const EC_GROUP *, BN_CTX *);
int ec_GF2m_simple_point_init(EC_POINT *);
void ec_GF2m_simple_point_finish(EC_POINT *);
void ec_GF2m_simple_point_clear_finish(EC_POINT *);
int ec_GF2m_simple_point_copy(EC_POINT *, const EC_POINT *);
int ec_GF2m_simple_point_set_to_infinity(const EC_GROUP *, EC_POINT *);
int ec_GF2m_simple_point_set_affine_coordinates_GF2m(const EC_GROUP *, EC_POINT *,
const BIGNUM *x, const BIGNUM *y, BN_CTX *);
int ec_GF2m_simple_point_get_affine_coordinates_GF2m(const EC_GROUP *, const EC_POINT *,
BIGNUM *x, BIGNUM *y, BN_CTX *);
int ec_GF2m_simple_set_compressed_coordinates_GF2m(const EC_GROUP *, EC_POINT *,
const BIGNUM *x, int y_bit, BN_CTX *);
size_t ec_GF2m_simple_point2oct(const EC_GROUP *, const EC_POINT *, point_conversion_form_t form,
unsigned char *buf, size_t len, BN_CTX *);
int ec_GF2m_simple_oct2point(const EC_GROUP *, EC_POINT *,
const unsigned char *buf, size_t len, BN_CTX *);
int ec_GF2m_simple_add(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, const EC_POINT *b, BN_CTX *);
int ec_GF2m_simple_dbl(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, BN_CTX *);
int ec_GF2m_simple_invert(const EC_GROUP *, EC_POINT *, BN_CTX *);
int ec_GF2m_simple_is_at_infinity(const EC_GROUP *, const EC_POINT *);
int ec_GF2m_simple_is_on_curve(const EC_GROUP *, const EC_POINT *, BN_CTX *);
int ec_GF2m_simple_cmp(const EC_GROUP *, const EC_POINT *a, const EC_POINT *b, BN_CTX *);
int ec_GF2m_simple_make_affine(const EC_GROUP *, EC_POINT *, BN_CTX *);
int ec_GF2m_simple_points_make_affine(const EC_GROUP *, size_t num, EC_POINT *[], BN_CTX *);
int ec_GF2m_simple_field_mul(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
int ec_GF2m_simple_field_sqr(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *);
int ec_GF2m_simple_field_div(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
/* method functions in ec2_mult.c */
int ec_GF2m_mont_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
int ec_GF2m_mont_precompute_mult(EC_GROUP *group, BN_CTX *ctx);

192
crypto/ec/ec_lib.c
View File

@ -52,6 +52,11 @@
* Hudson (tjh@cryptsoft.com).
*
*/
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
* Binary polynomial ECC support in OpenSSL originally developed by
* SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
*/
#include <string.h>
@ -243,6 +248,28 @@ int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
}
EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
{
EC_GROUP *t = NULL;
int ok = 0;
if (a == NULL) return NULL;
if ((t = EC_GROUP_new(a->meth)) == NULL) return(NULL);
if (!EC_GROUP_copy(t, a)) goto err;
ok = 1;
err:
if (!ok)
{
if (t) EC_GROUP_free(t);
return NULL;
}
else return t;
}
const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *group)
{
return group->meth;
@ -380,23 +407,56 @@ size_t EC_GROUP_get_seed_len(const EC_GROUP *group)
int EC_GROUP_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
{
if (group->meth->group_set_curve_GFp == 0)
if (group->meth->group_set_curve == 0)
{
ECerr(EC_F_EC_GROUP_SET_CURVE_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
return group->meth->group_set_curve_GFp(group, p, a, b, ctx);
return group->meth->group_set_curve(group, p, a, b, ctx);
}
int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
{
if (group->meth->group_get_curve_GFp == 0)
if (group->meth->group_get_curve == 0)
{
ECerr(EC_F_EC_GROUP_GET_CURVE_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
return group->meth->group_get_curve_GFp(group, p, a, b, ctx);
return group->meth->group_get_curve(group, p, a, b, ctx);
}
int EC_GROUP_set_curve_GF2m(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
{
if (group->meth->group_set_curve == 0)
{
ECerr(EC_F_EC_GROUP_SET_CURVE_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
return group->meth->group_set_curve(group, p, a, b, ctx);
}
int EC_GROUP_get_curve_GF2m(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
{
if (group->meth->group_get_curve == 0)
{
ECerr(EC_F_EC_GROUP_GET_CURVE_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
return group->meth->group_get_curve(group, p, a, b, ctx);
}
int EC_GROUP_get_degree(const EC_GROUP *group)
{
if (group->meth->group_get_degree == 0)
{
ECerr(EC_F_EC_GROUP_GET_DEGREE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
return group->meth->group_get_degree(group);
}
@ -551,6 +611,25 @@ int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src)
}
EC_POINT *EC_POINT_dup(const EC_POINT *a, const EC_GROUP *group)
{
EC_POINT *t;
int r;
if (a == NULL) return NULL;
t = EC_POINT_new(group);
if (t == NULL) return(NULL);
r = EC_POINT_copy(t, a);
if (!r)
{
EC_POINT_free(t);
return NULL;
}
else return t;
}
const EC_METHOD *EC_POINT_method_of(const EC_POINT *point)
{
return point->meth;
@ -576,7 +655,7 @@ int EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point)
int EC_POINT_set_Jprojective_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
const BIGNUM *x, const BIGNUM *y, const BIGNUM *z, BN_CTX *ctx)
{
if (group->meth->point_set_Jprojective_coordinates_GFp == 0)
if (group->meth->point_set_Jprojective_coordinates == 0)
{
ECerr(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
@ -586,14 +665,14 @@ int EC_POINT_set_Jprojective_coordinates_GFp(const EC_GROUP *group, EC_POINT *po
ECerr(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
return group->meth->point_set_Jprojective_coordinates_GFp(group, point, x, y, z, ctx);
return group->meth->point_set_Jprojective_coordinates(group, point, x, y, z, ctx);
}
int EC_POINT_get_Jprojective_coordinates_GFp(const EC_GROUP *group, const EC_POINT *point,
BIGNUM *x, BIGNUM *y, BIGNUM *z, BN_CTX *ctx)
{
if (group->meth->point_get_Jprojective_coordinates_GFp == 0)
if (group->meth->point_get_Jprojective_coordinates == 0)
{
ECerr(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
@ -603,14 +682,14 @@ int EC_POINT_get_Jprojective_coordinates_GFp(const EC_GROUP *group, const EC_POI
ECerr(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
return group->meth->point_get_Jprojective_coordinates_GFp(group, point, x, y, z, ctx);
return group->meth->point_get_Jprojective_coordinates(group, point, x, y, z, ctx);
}
int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx)
{
if (group->meth->point_set_affine_coordinates_GFp == 0)
if (group->meth->point_set_affine_coordinates == 0)
{
ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
@ -620,14 +699,14 @@ int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
return group->meth->point_set_affine_coordinates_GFp(group, point, x, y, ctx);
return group->meth->point_set_affine_coordinates(group, point, x, y, ctx);
}
int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group, const EC_POINT *point,
BIGNUM *x, BIGNUM *y, BN_CTX *ctx)
{
if (group->meth->point_get_affine_coordinates_GFp == 0)
if (group->meth->point_get_affine_coordinates == 0)
{
ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
@ -637,14 +716,14 @@ int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group, const EC_POINT *p
ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
return group->meth->point_get_affine_coordinates_GFp(group, point, x, y, ctx);
return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
}
int EC_POINT_set_compressed_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
const BIGNUM *x, int y_bit, BN_CTX *ctx)
{
if (group->meth->point_set_compressed_coordinates_GFp == 0)
if (group->meth->point_set_compressed_coordinates == 0)
{
ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
@ -654,7 +733,92 @@ int EC_POINT_set_compressed_coordinates_GFp(const EC_GROUP *group, EC_POINT *poi
ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GFP, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
return group->meth->point_set_compressed_coordinates_GFp(group, point, x, y_bit, ctx);
return group->meth->point_set_compressed_coordinates(group, point, x, y_bit, ctx);
}
int EC_POINT_set_Jprojective_coordinates_GF2m(const EC_GROUP *group, EC_POINT *point,
const BIGNUM *x, const BIGNUM *y, const BIGNUM *z, BN_CTX *ctx)
{
if (group->meth->point_set_Jprojective_coordinates == 0)
{
ECerr(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
if (group->meth != point->meth)
{
ECerr(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GF2M, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
return group->meth->point_set_Jprojective_coordinates(group, point, x, y, z, ctx);
}
int EC_POINT_get_Jprojective_coordinates_GF2m(const EC_GROUP *group, const EC_POINT *point,
BIGNUM *x, BIGNUM *y, BIGNUM *z, BN_CTX *ctx)
{
if (group->meth->point_get_Jprojective_coordinates == 0)
{
ECerr(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
if (group->meth != point->meth)
{
ECerr(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GF2M, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
return group->meth->point_get_Jprojective_coordinates(group, point, x, y, z, ctx);
}
int EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP *group, EC_POINT *point,
const BIGNUM *x, const BIGNUM *y, BN_CTX *ctx)
{
if (group->meth->point_set_affine_coordinates == 0)
{
ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
if (group->meth != point->meth)
{
ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
return group->meth->point_set_affine_coordinates(group, point, x, y, ctx);
}
int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *group, const EC_POINT *point,
BIGNUM *x, BIGNUM *y, BN_CTX *ctx)
{
if (group->meth->point_get_affine_coordinates == 0)
{
ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
if (group->meth != point->meth)
{
ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
}
int EC_POINT_set_compressed_coordinates_GF2m(const EC_GROUP *group, EC_POINT *point,
const BIGNUM *x, int y_bit, BN_CTX *ctx)
{
if (group->meth->point_set_compressed_coordinates == 0)
{
ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GF2M, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
if (group->meth != point->meth)
{
ECerr(EC_F_EC_POINT_SET_COMPRESSED_COORDINATES_GF2M, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
return group->meth->point_set_compressed_coordinates(group, point, x, y_bit, ctx);
}

48
crypto/ec/ec_mult.c
View File

@ -52,6 +52,11 @@
* Hudson (tjh@cryptsoft.com).
*
*/
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
* Portions of this software developed by SUN MICROSYSTEMS, INC.,
* and contributed to the OpenSSL project.
*/
#include <openssl/err.h>
@ -209,7 +214,7 @@ static signed char *compute_wNAF(const BIGNUM *scalar, int w, size_t *ret_len)
* scalar*generator
* in the addition if scalar != NULL
*/
int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx)
{
BN_CTX *new_ctx = NULL;
@ -235,7 +240,7 @@ int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
generator = EC_GROUP_get0_generator(group);
if (generator == NULL)
{
ECerr(EC_F_EC_POINTS_MUL, EC_R_UNDEFINED_GENERATOR);
ECerr(EC_F_EC_WNAF_MUL, EC_R_UNDEFINED_GENERATOR);
return 0;
}
}
@ -244,7 +249,7 @@ int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
{
if (group->meth != points[i]->meth)
{
ECerr(EC_F_EC_POINTS_MUL, EC_R_INCOMPATIBLE_OBJECTS);
ECerr(EC_F_EC_WNAF_MUL, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
}
@ -294,7 +299,7 @@ int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
}
if (!(v == val + num_val))
{
ECerr(EC_F_EC_POINTS_MUL, ERR_R_INTERNAL_ERROR);
ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);
goto err;
}
@ -438,6 +443,20 @@ int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
}
/* Generic multiplication method.
* If group->meth does not provide a multiplication method, default to ec_wNAF_mul;
* otherwise use the group->meth's multiplication.
*/
int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx)
{
if (group->meth->mul == 0)
return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
else
return group->meth->mul(group, r, scalar, num, points, scalars, ctx);
}
int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar, const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
{
const EC_POINT *points[1];
@ -450,7 +469,7 @@ int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar, con
}
int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
int ec_wNAF_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
{
const EC_POINT *generator;
BN_CTX *new_ctx = NULL;
@ -460,7 +479,7 @@ int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
generator = EC_GROUP_get0_generator(group);
if (generator == NULL)
{
ECerr(EC_F_EC_GROUP_PRECOMPUTE_MULT, EC_R_UNDEFINED_GENERATOR);
ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, EC_R_UNDEFINED_GENERATOR);
return 0;
}
@ -478,7 +497,7 @@ int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
if (!EC_GROUP_get_order(group, order, ctx)) return 0;
if (BN_is_zero(order))
{
ECerr(EC_F_EC_GROUP_PRECOMPUTE_MULT, EC_R_UNKNOWN_ORDER);
ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, EC_R_UNKNOWN_ORDER);
goto err;
}
@ -492,3 +511,18 @@ int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
BN_CTX_free(new_ctx);
return ret;
}
/* Generic multiplicaiton precomputation method.
* If group->meth does not provide a multiplication method, default to ec_wNAF_mul and do its
* precomputation; otherwise use the group->meth's precomputation if it exists.
*/
int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
{
if (group->meth->mul == 0)
return ec_wNAF_precompute_mult(group, ctx);
else if (group->meth->precompute_mult != 0)
return group->meth->precompute_mult(group, ctx);
else
return 1;
}

9
crypto/ec/ecp_mont.c
View File

@ -52,6 +52,11 @@
* Hudson (tjh@cryptsoft.com).
*
*/
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
* Portions of this software developed by SUN MICROSYSTEMS, INC.,
* and contributed to the OpenSSL project.
*/
#include <openssl/err.h>
@ -68,6 +73,7 @@ const EC_METHOD *EC_GFp_mont_method(void)
ec_GFp_mont_group_copy,
ec_GFp_mont_group_set_curve_GFp,
ec_GFp_simple_group_get_curve_GFp,
ec_GFp_simple_group_get_degree,
ec_GFp_simple_group_check_discriminant,
ec_GFp_simple_point_init,
ec_GFp_simple_point_finish,
@ -84,6 +90,8 @@ const EC_METHOD *EC_GFp_mont_method(void)
ec_GFp_simple_add,
ec_GFp_simple_dbl,
ec_GFp_simple_invert,
0 /* mul */,
0 /* precompute_mult */,
ec_GFp_simple_is_at_infinity,
ec_GFp_simple_is_on_curve,
ec_GFp_simple_cmp,
@ -91,6 +99,7 @@ const EC_METHOD *EC_GFp_mont_method(void)
ec_GFp_simple_points_make_affine,
ec_GFp_mont_field_mul,
ec_GFp_mont_field_sqr,
0 /* field_div */,
ec_GFp_mont_field_encode,
ec_GFp_mont_field_decode,
ec_GFp_mont_field_set_to_one };

9
crypto/ec/ecp_nist.c
View File

@ -52,6 +52,11 @@
* Hudson (tjh@cryptsoft.com).
*
*/
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
* Portions of this software developed by SUN MICROSYSTEMS, INC.,
* and contributed to the OpenSSL project.
*/
#include "ec_lcl.h"
@ -65,6 +70,7 @@ const EC_METHOD *EC_GFp_nist_method(void)
ec_GFp_nist_group_copy,
ec_GFp_nist_group_set_curve_GFp,
ec_GFp_simple_group_get_curve_GFp,
ec_GFp_simple_group_get_degree,
ec_GFp_simple_group_set_generator,
ec_GFp_simple_group_get0_generator,
ec_GFp_simple_group_get_order,
@ -85,6 +91,8 @@ const EC_METHOD *EC_GFp_nist_method(void)
ec_GFp_simple_add,
ec_GFp_simple_dbl,
ec_GFp_simple_invert,
0 /* mul */,
0 /* precompute_mult */,
ec_GFp_simple_is_at_infinity,
ec_GFp_simple_is_on_curve,
ec_GFp_simple_cmp,
@ -92,6 +100,7 @@ const EC_METHOD *EC_GFp_nist_method(void)
ec_GFp_simple_points_make_affine,
ec_GFp_nist_field_mul,
ec_GFp_nist_field_sqr,
0 /* field_div */,
0 /* field_encode */,
0 /* field_decode */,
0 /* field_set_to_one */ };

9
crypto/ec/ecp_recp.c
View File

@ -52,6 +52,11 @@
* Hudson (tjh@cryptsoft.com).
*
*/
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
* Portions of this software developed by SUN MICROSYSTEMS, INC.,
* and contributed to the OpenSSL project.
*/
#include "ec_lcl.h"
@ -65,6 +70,7 @@ const EC_METHOD *EC_GFp_recp_method(void)
ec_GFp_recp_group_copy,
ec_GFp_recp_group_set_curve_GFp,
ec_GFp_simple_group_get_curve_GFp,
ec_GFp_simple_group_get_degree,
ec_GFp_simple_group_set_generator,
ec_GFp_simple_group_get0_generator,
ec_GFp_simple_group_get_order,
@ -85,6 +91,8 @@ const EC_METHOD *EC_GFp_recp_method(void)
ec_GFp_simple_add,
ec_GFp_simple_dbl,
ec_GFp_simple_invert,
0 /* mul */,
0 /* precompute_mult */,
ec_GFp_simple_is_at_infinity,
ec_GFp_simple_is_on_curve,
ec_GFp_simple_cmp,
@ -92,6 +100,7 @@ const EC_METHOD *EC_GFp_recp_method(void)
ec_GFp_simple_points_make_affine,
ec_GFp_recp_field_mul,
ec_GFp_recp_field_sqr,
0 /* field_div */,
0 /* field_encode */,
0 /* field_decode */,
0 /* field_set_to_one */ };

15
crypto/ec/ecp_smpl.c
View File

@ -54,6 +54,11 @@
* Hudson (tjh@cryptsoft.com).
*
*/
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
* Portions of this software developed by SUN MICROSYSTEMS, INC.,
* and contributed to the OpenSSL project.
*/
#include <openssl/err.h>
#include <openssl/symhacks.h>
@ -70,6 +75,7 @@ const EC_METHOD *EC_GFp_simple_method(void)
ec_GFp_simple_group_copy,
ec_GFp_simple_group_set_curve_GFp,
ec_GFp_simple_group_get_curve_GFp,
ec_GFp_simple_group_get_degree,
ec_GFp_simple_group_check_discriminant,
ec_GFp_simple_point_init,
ec_GFp_simple_point_finish,
@ -86,6 +92,8 @@ const EC_METHOD *EC_GFp_simple_method(void)
ec_GFp_simple_add,
ec_GFp_simple_dbl,
ec_GFp_simple_invert,
0 /* mul */,
0 /* precompute_mult */,
ec_GFp_simple_is_at_infinity,
ec_GFp_simple_is_on_curve,
ec_GFp_simple_cmp,
@ -93,6 +101,7 @@ const EC_METHOD *EC_GFp_simple_method(void)
ec_GFp_simple_points_make_affine,
ec_GFp_simple_field_mul,
ec_GFp_simple_field_sqr,
0 /* field_div */,
0 /* field_encode */,
0 /* field_decode */,
0 /* field_set_to_one */ };
@ -245,6 +254,12 @@ int ec_GFp_simple_group_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *
}
int ec_GFp_simple_group_get_degree(const EC_GROUP *group)
{
return BN_num_bits(&group->field);
}
int ec_GFp_simple_group_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
{
int ret = 0;

607
crypto/ec/ectest.c
View File

@ -52,6 +52,32 @@
* Hudson (tjh@cryptsoft.com).
*
*/
/* ====================================================================
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
*
* Portions of the attached software ("Contribution") are developed by
* SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
*
* The Contribution is licensed pursuant to the OpenSSL open source
* license provided above.
*
* In addition, Sun covenants to all licensees who provide a reciprocal
* covenant with respect to their own patents if any, not to sue under
* current and future patent claims necessarily infringed by the making,
* using, practicing, selling, offering for sale and/or otherwise
* disposing of the Contribution as delivered hereunder
* (or portions thereof), provided that such covenant shall not apply:
* 1) for code that a licensee deletes from the Contribution;
* 2) separates from the Contribution; or
* 3) for infringements caused by:
* i) the modification of the Contribution or
* ii) the combination of the Contribution with other software or
* devices where such combination causes the infringement.
*
* The elliptic curve binary polynomial software is originally written by
* Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
*
*/
#include <stdio.h>
#include <stdlib.h>
@ -67,6 +93,7 @@ int main(int argc, char * argv[]) { puts("Elliptic curves are disabled."); retur
#include <openssl/ec.h>
#include <openssl/engine.h>
#include <openssl/err.h>
#include <openssl/obj_mac.h>
#define ABORT do { \
fflush(stdout); \
@ -80,37 +107,40 @@ static void timings(EC_GROUP *group, int multi, BN_CTX *ctx)
{
clock_t clck;
int i, j;
BIGNUM *s, *s0;
BIGNUM *s;
BIGNUM *r[10], *r0[10];
EC_POINT *P;
s = BN_new();
s0 = BN_new();
if (s == NULL || s0 == NULL) ABORT;
if (s == NULL) ABORT;
if (!EC_GROUP_get_curve_GFp(group, s, NULL, NULL, ctx)) ABORT;
fprintf(stdout, "Timings for %d bit prime, ", (int)BN_num_bits(s));
fprintf(stdout, "Timings for %d-bit field, ", EC_GROUP_get_degree(group));
if (!EC_GROUP_get_order(group, s, ctx)) ABORT;
fprintf(stdout, "%d bit scalars ", (int)BN_num_bits(s));
fprintf(stdout, "%d-bit scalars ", (int)BN_num_bits(s));
fflush(stdout);
P = EC_POINT_new(group);
if (P == NULL) ABORT;
EC_POINT_copy(P, EC_GROUP_get0_generator(group));
for (i = 0; i < 10; i++)
{
if ((r[i] = BN_new()) == NULL) ABORT;
if (!BN_pseudo_rand(r[i], BN_num_bits(s), 0, 0)) ABORT;
if (multi)
{
if ((r0[i] = BN_new()) == NULL) ABORT;
if (!BN_pseudo_rand(r0[i], BN_num_bits(s), 0, 0)) ABORT;
}
}
clck = clock();
for (i = 0; i < 10; i++)
{
if (!BN_pseudo_rand(s, BN_num_bits(s), 0, 0)) ABORT;
if (multi)
{
if (!BN_pseudo_rand(s0, BN_num_bits(s), 0, 0)) ABORT;
}
for (j = 0; j < 10; j++)
{
if (!EC_POINT_mul(group, P, s, multi ? P : NULL, multi ? s0 : NULL, ctx)) ABORT;
if (!EC_POINT_mul(group, P, r[i], multi ? P : NULL, multi ? r0[i] : NULL, ctx)) ABORT;
}
fprintf(stdout, ".");
fflush(stdout);
}
fprintf(stdout, "\n");
@ -136,11 +166,15 @@ static void timings(EC_GROUP *group, int multi, BN_CTX *ctx)
EC_POINT_free(P);
BN_free(s);
BN_free(s0);
for (i = 0; i < 10; i++)
{
BN_free(r[i]);
if (multi) BN_free(r0[i]);
}
}
#endif
int main(int argc, char *argv[])
void prime_field_tests()
{
BN_CTX *ctx = NULL;
BIGNUM *p, *a, *b;
@ -152,20 +186,6 @@ int main(int argc, char *argv[])
size_t i, len;
int k;
/* enable memory leak checking unless explicitly disabled */
if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
{
CRYPTO_malloc_debug_init();
CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
}
else
{
/* OPENSSL_DEBUG_MEMORY=off */
CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
}
CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
ERR_load_crypto_strings();
#if 1 /* optional */
ctx = BN_CTX_new();
if (!ctx) ABORT;
@ -333,6 +353,10 @@ int main(int argc, char *argv[])
/* G_y value taken from the standard: */
if (!BN_hex2bn(&z, "07192B95FFC8DA78631011ED6B24CDD573F977A11E794811")) ABORT;
if (0 != BN_cmp(y, z)) ABORT;
fprintf(stdout, "verify degree ...");
if (EC_GROUP_get_degree(group) != 192) ABORT;
fprintf(stdout, " ok\n");
fprintf(stdout, "verify group order ...");
fflush(stdout);
@ -374,6 +398,10 @@ int main(int argc, char *argv[])
if (!BN_hex2bn(&z, "BD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34")) ABORT;
if (0 != BN_cmp(y, z)) ABORT;
fprintf(stdout, "verify degree ...");
if (EC_GROUP_get_degree(group) != 224) ABORT;
fprintf(stdout, " ok\n");
fprintf(stdout, "verify group order ...");
fflush(stdout);
if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
@ -415,6 +443,10 @@ int main(int argc, char *argv[])
if (!BN_hex2bn(&z, "4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5")) ABORT;
if (0 != BN_cmp(y, z)) ABORT;
fprintf(stdout, "verify degree ...");
if (EC_GROUP_get_degree(group) != 256) ABORT;
fprintf(stdout, " ok\n");
fprintf(stdout, "verify group order ...");
fflush(stdout);
if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
@ -461,6 +493,10 @@ int main(int argc, char *argv[])
"7CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F")) ABORT;
if (0 != BN_cmp(y, z)) ABORT;
fprintf(stdout, "verify degree ...");
if (EC_GROUP_get_degree(group) != 384) ABORT;
fprintf(stdout, " ok\n");
fprintf(stdout, "verify group order ...");
fflush(stdout);
if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
@ -513,6 +549,10 @@ int main(int argc, char *argv[])
"7086A272C24088BE94769FD16650")) ABORT;
if (0 != BN_cmp(y, z)) ABORT;
fprintf(stdout, "verify degree ...");
if (EC_GROUP_get_degree(group) != 521) ABORT;
fprintf(stdout, " ok\n");
fprintf(stdout, "verify group order ...");
fflush(stdout);
if (!EC_GROUP_get_order(group, z, ctx)) ABORT;
@ -623,6 +663,513 @@ int main(int argc, char *argv[])
if (P_384) EC_GROUP_free(P_384);
if (P_521) EC_GROUP_free(P_521);
}
/* Change test based on whether binary point compression is enabled or not. */
#ifdef OPENSSL_EC_BIN_PT_COMP
#define CHAR2_CURVE_TEST_INTERNAL(_name, _p, _a, _b, _x, _y, _y_bit, _order, _cof, _degree, _variable) \
if (!BN_hex2bn(&x, _x)) ABORT; \
if (!EC_POINT_set_compressed_coordinates_GF2m(group, P, x, _y_bit, ctx)) ABORT; \
if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
if (!BN_hex2bn(&z, _order)) ABORT; \
if (!BN_hex2bn(&cof, _cof)) ABORT; \
if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
if (!EC_POINT_get_affine_coordinates_GF2m(group, P, x, y, ctx)) ABORT; \
fprintf(stdout, "\n%s -- Generator:\n x = 0x", _name); \
BN_print_fp(stdout, x); \
fprintf(stdout, "\n y = 0x"); \
BN_print_fp(stdout, y); \
fprintf(stdout, "\n"); \
/* G_y value taken from the standard: */ \
if (!BN_hex2bn(&z, _y)) ABORT; \
if (0 != BN_cmp(y, z)) ABORT;
#else
#define CHAR2_CURVE_TEST_INTERNAL(_name, _p, _a, _b, _x, _y, _y_bit, _order, _cof, _degree, _variable) \
if (!BN_hex2bn(&x, _x)) ABORT; \
if (!BN_hex2bn(&y, _y)) ABORT; \
if (!EC_POINT_set_affine_coordinates_GF2m(group, P, x, y, ctx)) ABORT; \
if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT; \
if (!BN_hex2bn(&z, _order)) ABORT; \
if (!BN_hex2bn(&cof, _cof)) ABORT; \
if (!EC_GROUP_set_generator(group, P, z, cof)) ABORT; \
fprintf(stdout, "\n%s -- Generator:\n x = 0x", _name); \
BN_print_fp(stdout, x); \
fprintf(stdout, "\n y = 0x"); \
BN_print_fp(stdout, y); \
fprintf(stdout, "\n");
#endif
#define CHAR2_CURVE_TEST(_name, _p, _a, _b, _x, _y, _y_bit, _order, _cof, _degree, _variable) \
if (!BN_hex2bn(&p, _p)) ABORT; \
if (!BN_hex2bn(&a, _a)) ABORT; \
if (!BN_hex2bn(&b, _b)) ABORT; \
if (!EC_GROUP_set_curve_GF2m(group, p, a, b, ctx)) ABORT; \
CHAR2_CURVE_TEST_INTERNAL(_name, _p, _a, _b, _x, _y, _y_bit, _order, _cof, _degree, _variable) \
fprintf(stdout, "verify degree ..."); \
if (EC_GROUP_get_degree(group) != _degree) ABORT; \
fprintf(stdout, " ok\n"); \
fprintf(stdout, "verify group order ..."); \
fflush(stdout); \
if (!EC_GROUP_get_order(group, z, ctx)) ABORT; \
if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT; \
if (!EC_POINT_is_at_infinity(group, Q)) ABORT; \
fprintf(stdout, "."); \
fflush(stdout); \
if (!EC_GROUP_precompute_mult(group, ctx)) ABORT; \
if (!EC_POINT_mul(group, Q, z, NULL, NULL, ctx)) ABORT; \
if (!EC_POINT_is_at_infinity(group, Q)) ABORT; \
fprintf(stdout, " ok\n"); \
if (!(_variable = EC_GROUP_new(EC_GROUP_method_of(group)))) ABORT; \
if (!EC_GROUP_copy(_variable, group)) ABORT;
void char2_field_tests()
{
BN_CTX *ctx = NULL;
BIGNUM *p, *a, *b;
EC_GROUP *group;
EC_GROUP *C2_K163 = NULL, *C2_K233 = NULL, *C2_K283 = NULL, *C2_K409 = NULL, *C2_K571 = NULL;
EC_GROUP *C2_B163 = NULL, *C2_B233 = NULL, *C2_B283 = NULL, *C2_B409 = NULL, *C2_B571 = NULL;
EC_POINT *P, *Q, *R;
BIGNUM *x, *y, *z, *cof;
unsigned char buf[100];
size_t i, len;
int k;
#if 1 /* optional */
ctx = BN_CTX_new();
if (!ctx) ABORT;
#endif
p = BN_new();
a = BN_new();
b = BN_new();
if (!p || !a || !b) ABORT;
if (!BN_hex2bn(&p, "13")) ABORT;
if (!BN_hex2bn(&a, "3")) ABORT;
if (!BN_hex2bn(&b, "1")) ABORT;
group = EC_GROUP_new(EC_GF2m_simple_method()); /* applications should use EC_GROUP_new_curve_GFp
* so that the library gets to choose the EC_METHOD */
if (!group) ABORT;
if (!EC_GROUP_set_curve_GF2m(group, p, a, b, ctx)) ABORT;
{
EC_GROUP *tmp;
tmp = EC_GROUP_new(EC_GROUP_method_of(group));
if (!tmp) ABORT;
if (!EC_GROUP_copy(tmp, group));
EC_GROUP_free(group);
group = tmp;
}
if (!EC_GROUP_get_curve_GF2m(group, p, a, b, ctx)) ABORT;
fprintf(stdout, "Curve defined by Weierstrass equation\n y^2 + x*y = x^3 + a*x^2 + b (mod 0x");
BN_print_fp(stdout, p);
fprintf(stdout, ")\n a = 0x");
BN_print_fp(stdout, a);
fprintf(stdout, "\n b = 0x");
BN_print_fp(stdout, b);
fprintf(stdout, "\n");
P = EC_POINT_new(group);
Q = EC_POINT_new(group);
R = EC_POINT_new(group);
if (!P || !Q || !R) ABORT;
if (!EC_POINT_set_to_infinity(group, P)) ABORT;
if (!EC_POINT_is_at_infinity(group, P)) ABORT;
buf[0] = 0;
if (!EC_POINT_oct2point(group, Q, buf, 1, ctx)) ABORT;
if (!EC_POINT_add(group, P, P, Q, ctx)) ABORT;
if (!EC_POINT_is_at_infinity(group, P)) ABORT;
x = BN_new();
y = BN_new();
z = BN_new();
cof = BN_new();
if (!x || !y || !z || !cof) ABORT;
if (!BN_hex2bn(&x, "6")) ABORT;
/* Change test based on whether binary point compression is enabled or not. */
#ifdef OPENSSL_EC_BIN_PT_COMP
if (!EC_POINT_set_compressed_coordinates_GF2m(group, Q, x, 1, ctx)) ABORT;
#else
if (!BN_hex2bn(&y, "8")) ABORT;
if (!EC_POINT_set_affine_coordinates_GF2m(group, Q, x, y, ctx)) ABORT;
#endif
if (!EC_POINT_is_on_curve(group, Q, ctx))
{
/* Change test based on whether binary point compression is enabled or not. */
#ifdef OPENSSL_EC_BIN_PT_COMP
if (!EC_POINT_get_affine_coordinates_GF2m(group, Q, x, y, ctx)) ABORT;
#endif
fprintf(stderr, "Point is not on curve: x = 0x");
BN_print_fp(stderr, x);
fprintf(stderr, ", y = 0x");
BN_print_fp(stderr, y);
fprintf(stderr, "\n");
ABORT;
}
fprintf(stdout, "A cyclic subgroup:\n");
k = 100;
do
{
if (k-- == 0) ABORT;
if (EC_POINT_is_at_infinity(group, P))
fprintf(stdout, " point at infinity\n");
else
{
if (!EC_POINT_get_affine_coordinates_GF2m(group, P, x, y, ctx)) ABORT;
fprintf(stdout, " x = 0x");
BN_print_fp(stdout, x);
fprintf(stdout, ", y = 0x");
BN_print_fp(stdout, y);
fprintf(stdout, "\n");
}
if (!EC_POINT_copy(R, P)) ABORT;
if (!EC_POINT_add(group, P, P, Q, ctx)) ABORT;
}
while (!EC_POINT_is_at_infinity(group, P));
if (!EC_POINT_add(group, P, Q, R, ctx)) ABORT;
if (!EC_POINT_is_at_infinity(group, P)) ABORT;
/* Change test based on whether binary point compression is enabled or not. */
#ifdef OPENSSL_EC_BIN_PT_COMP
len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_COMPRESSED, buf, sizeof buf, ctx);
if (len == 0) ABORT;
if (!EC_POINT_oct2point(group, P, buf, len, ctx)) ABORT;
if (0 != EC_POINT_cmp(group, P, Q, ctx)) ABORT;
fprintf(stdout, "Generator as octet string, compressed form:\n ");
for (i = 0; i < len; i++) fprintf(stdout, "%02X", buf[i]);
#endif
len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_UNCOMPRESSED, buf, sizeof buf, ctx);
if (len == 0) ABORT;
if (!EC_POINT_oct2point(group, P, buf, len, ctx)) ABORT;
if (0 != EC_POINT_cmp(group, P, Q, ctx)) ABORT;
fprintf(stdout, "\nGenerator as octet string, uncompressed form:\n ");
for (i = 0; i < len; i++) fprintf(stdout, "%02X", buf[i]);
/* Change test based on whether binary point compression is enabled or not. */
#ifdef OPENSSL_EC_BIN_PT_COMP
len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_HYBRID, buf, sizeof buf, ctx);
if (len == 0) ABORT;
if (!EC_POINT_oct2point(group, P, buf, len, ctx)) ABORT;
if (0 != EC_POINT_cmp(group, P, Q, ctx)) ABORT;
fprintf(stdout, "\nGenerator as octet string, hybrid form:\n ");
for (i = 0; i < len; i++) fprintf(stdout, "%02X", buf[i]);
#endif
fprintf(stdout, "\n");
if (!EC_POINT_invert(group, P, ctx)) ABORT;
if (0 != EC_POINT_cmp(group, P, R, ctx)) ABORT;
/* Curve K-163 (FIPS PUB 186-2, App. 6) */
CHAR2_CURVE_TEST
(
"NIST curve K-163",
"0800000000000000000000000000000000000000C9",
"1",
"1",
"02FE13C0537BBC11ACAA07D793DE4E6D5E5C94EEE8",
"0289070FB05D38FF58321F2E800536D538CCDAA3D9",
1,
"04000000000000000000020108A2E0CC0D99F8A5EF",
"2",
163,
C2_K163
);
/* Curve B-163 (FIPS PUB 186-2, App. 6) */
CHAR2_CURVE_TEST
(
"NIST curve B-163",
"0800000000000000000000000000000000000000C9",
"1",
"020A601907B8C953CA1481EB10512F78744A3205FD",
"03F0EBA16286A2D57EA0991168D4994637E8343E36",
"00D51FBC6C71A0094FA2CDD545B11C5C0C797324F1",
1,
"040000000000000000000292FE77E70C12A4234C33",
"2",
163,
C2_B163
);
/* Curve K-233 (FIPS PUB 186-2, App. 6) */
CHAR2_CURVE_TEST
(
"NIST curve K-233",
"020000000000000000000000000000000000000004000000000000000001",
"0",
"1",
"017232BA853A7E731AF129F22FF4149563A419C26BF50A4C9D6EEFAD6126",
"01DB537DECE819B7F70F555A67C427A8CD9BF18AEB9B56E0C11056FAE6A3",
0,
"008000000000000000000000000000069D5BB915BCD46EFB1AD5F173ABDF",
"4",
233,
C2_K233
);
/* Curve B-233 (FIPS PUB 186-2, App. 6) */
CHAR2_CURVE_TEST
(
"NIST curve B-233",
"020000000000000000000000000000000000000004000000000000000001",
"000000000000000000000000000000000000000000000000000000000001",
"0066647EDE6C332C7F8C0923BB58213B333B20E9CE4281FE115F7D8F90AD",
"00FAC9DFCBAC8313BB2139F1BB755FEF65BC391F8B36F8F8EB7371FD558B",
"01006A08A41903350678E58528BEBF8A0BEFF867A7CA36716F7E01F81052",
1,
"01000000000000000000000000000013E974E72F8A6922031D2603CFE0D7",
"2",
233,
C2_B233
);
/* Curve K-283 (FIPS PUB 186-2, App. 6) */
CHAR2_CURVE_TEST
(
"NIST curve K-283",
"0800000000000000000000000000000000000000000000000000000000000000000010A1",
"0",
"1",
"0503213F78CA44883F1A3B8162F188E553CD265F23C1567A16876913B0C2AC2458492836",
"01CCDA380F1C9E318D90F95D07E5426FE87E45C0E8184698E45962364E34116177DD2259",
0,
"01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE9AE2ED07577265DFF7F94451E061E163C61",
"4",
283,
C2_K283
);
/* Curve B-283 (FIPS PUB 186-2, App. 6) */
CHAR2_CURVE_TEST
(
"NIST curve B-283",
"0800000000000000000000000000000000000000000000000000000000000000000010A1",
"000000000000000000000000000000000000000000000000000000000000000000000001",
"027B680AC8B8596DA5A4AF8A19A0303FCA97FD7645309FA2A581485AF6263E313B79A2F5",
"05F939258DB7DD90E1934F8C70B0DFEC2EED25B8557EAC9C80E2E198F8CDBECD86B12053",
"03676854FE24141CB98FE6D4B20D02B4516FF702350EDDB0826779C813F0DF45BE8112F4",
1,
"03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEF90399660FC938A90165B042A7CEFADB307",
"2",
283,
C2_B283
);
/* Curve K-409 (FIPS PUB 186-2, App. 6) */
CHAR2_CURVE_TEST
(
"NIST curve K-409",
"02000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000001",
"0",
"1",
"0060F05F658F49C1AD3AB1890F7184210EFD0987E307C84C27ACCFB8F9F67CC2C460189EB5AAAA62EE222EB1B35540CFE9023746",
"01E369050B7C4E42ACBA1DACBF04299C3460782F918EA427E6325165E9EA10E3DA5F6C42E9C55215AA9CA27A5863EC48D8E0286B",
1,
"007FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE5F83B2D4EA20400EC4557D5ED3E3E7CA5B4B5C83B8E01E5FCF",
"4",
409,
C2_K409
);
/* Curve B-409 (FIPS PUB 186-2, App. 6) */
CHAR2_CURVE_TEST
(
"NIST curve B-409",
"02000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000001",
"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
"0021A5C2C8EE9FEB5C4B9A753B7B476B7FD6422EF1F3DD674761FA99D6AC27C8A9A197B272822F6CD57A55AA4F50AE317B13545F",
"015D4860D088DDB3496B0C6064756260441CDE4AF1771D4DB01FFE5B34E59703DC255A868A1180515603AEAB60794E54BB7996A7",
"0061B1CFAB6BE5F32BBFA78324ED106A7636B9C5A7BD198D0158AA4F5488D08F38514F1FDF4B4F40D2181B3681C364BA0273C706",
1,
"010000000000000000000000000000000000000000000000000001E2AAD6A612F33307BE5FA47C3C9E052F838164CD37D9A21173",
"2",
409,
C2_B409
);
/* Curve K-571 (FIPS PUB 186-2, App. 6) */
CHAR2_CURVE_TEST
(
"NIST curve K-571",
"80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000425",
"0",
"1",
"026EB7A859923FBC82189631F8103FE4AC9CA2970012D5D46024804801841CA44370958493B205E647DA304DB4CEB08CBBD1BA39494776FB988B47174DCA88C7E2945283A01C8972",
"0349DC807F4FBF374F4AEADE3BCA95314DD58CEC9F307A54FFC61EFC006D8A2C9D4979C0AC44AEA74FBEBBB9F772AEDCB620B01A7BA7AF1B320430C8591984F601CD4C143EF1C7A3",
0,
"020000000000000000000000000000000000000000000000000000000000000000000000131850E1F19A63E4B391A8DB917F4138B630D84BE5D639381E91DEB45CFE778F637C1001",
"4",
571,
C2_K571
);
/* Curve B-571 (FIPS PUB 186-2, App. 6) */
CHAR2_CURVE_TEST
(
"NIST curve B-571",
"80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000425",
"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
"02F40E7E2221F295DE297117B7F3D62F5C6A97FFCB8CEFF1CD6BA8CE4A9A18AD84FFABBD8EFA59332BE7AD6756A66E294AFD185A78FF12AA520E4DE739BACA0C7FFEFF7F2955727A",
"0303001D34B856296C16C0D40D3CD7750A93D1D2955FA80AA5F40FC8DB7B2ABDBDE53950F4C0D293CDD711A35B67FB1499AE60038614F1394ABFA3B4C850D927E1E7769C8EEC2D19",
"037BF27342DA639B6DCCFFFEB73D69D78C6C27A6009CBBCA1980F8533921E8A684423E43BAB08A576291AF8F461BB2A8B3531D2F0485C19B16E2F1516E23DD3C1A4827AF1B8AC15B",
1,
"03FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE661CE18FF55987308059B186823851EC7DD9CA1161DE93D5174D66E8382E9BB2FE84E47",
"2",
571,
C2_B571
);
/* more tests using the last curve */
if (!EC_POINT_copy(Q, P)) ABORT;
if (EC_POINT_is_at_infinity(group, Q)) ABORT;
if (!EC_POINT_dbl(group, P, P, ctx)) ABORT;
if (!EC_POINT_is_on_curve(group, P, ctx)) ABORT;
if (!EC_POINT_invert(group, Q, ctx)) ABORT; /* P = -2Q */
if (!EC_POINT_add(group, R, P, Q, ctx)) ABORT;
if (!EC_POINT_add(group, R, R, Q, ctx)) ABORT;
if (!EC_POINT_is_at_infinity(group, R)) ABORT; /* R = P + 2Q */
{
const EC_POINT *points[3];
const BIGNUM *scalars[3];
if (EC_POINT_is_at_infinity(group, Q)) ABORT;
points[0] = Q;
points[1] = Q;
points[2] = Q;
if (!BN_add(y, z, BN_value_one())) ABORT;
if (BN_is_odd(y)) ABORT;
if (!BN_rshift1(y, y)) ABORT;
scalars[0] = y; /* (group order + 1)/2, so y*Q + y*Q = Q */
scalars[1] = y;
fprintf(stdout, "combined multiplication ...");
fflush(stdout);
/* z is still the group order */
if (!EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx)) ABORT;
if (!EC_POINTs_mul(group, R, z, 2, points, scalars, ctx)) ABORT;
if (0 != EC_POINT_cmp(group, P, R, ctx)) ABORT;
if (0 != EC_POINT_cmp(group, R, Q, ctx)) ABORT;
fprintf(stdout, ".");
fflush(stdout);
if (!BN_pseudo_rand(y, BN_num_bits(y), 0, 0)) ABORT;
if (!BN_add(z, z, y)) ABORT;
z->neg = 1;
scalars[0] = y;
scalars[1] = z; /* z = -(order + y) */
if (!EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx)) ABORT;
if (!EC_POINT_is_at_infinity(group, P)) ABORT;
fprintf(stdout, ".");
fflush(stdout);
if (!BN_pseudo_rand(x, BN_num_bits(y) - 1, 0, 0)) ABORT;
if (!BN_add(z, x, y)) ABORT;
z->neg = 1;
scalars[0] = x;
scalars[1] = y;
scalars[2] = z; /* z = -(x+y) */
if (!EC_POINTs_mul(group, P, NULL, 3, points, scalars, ctx)) ABORT;
if (!EC_POINT_is_at_infinity(group, P)) ABORT;
fprintf(stdout, " ok\n\n");
}
#if 0
timings(C2_K163, 0, ctx);
timings(C2_K163, 1, ctx);
timings(C2_B163, 0, ctx);
timings(C2_B163, 1, ctx);
timings(C2_K233, 0, ctx);
timings(C2_K233, 1, ctx);
timings(C2_B233, 0, ctx);
timings(C2_B233, 1, ctx);
timings(C2_K283, 0, ctx);
timings(C2_K283, 1, ctx);
timings(C2_B283, 0, ctx);
timings(C2_B283, 1, ctx);
timings(C2_K409, 0, ctx);
timings(C2_K409, 1, ctx);
timings(C2_B409, 0, ctx);
timings(C2_B409, 1, ctx);
timings(C2_K571, 0, ctx);
timings(C2_K571, 1, ctx);
timings(C2_B571, 0, ctx);
timings(C2_B571, 1, ctx);
#endif
if (ctx)
BN_CTX_free(ctx);
BN_free(p); BN_free(a); BN_free(b);
EC_GROUP_free(group);
EC_POINT_free(P);
EC_POINT_free(Q);
EC_POINT_free(R);
BN_free(x); BN_free(y); BN_free(z); BN_free(cof);
if (C2_K163) EC_GROUP_free(C2_K163);
if (C2_B163) EC_GROUP_free(C2_B163);
if (C2_K233) EC_GROUP_free(C2_K233);
if (C2_B233) EC_GROUP_free(C2_B233);
if (C2_K283) EC_GROUP_free(C2_K283);
if (C2_B283) EC_GROUP_free(C2_B283);
if (C2_K409) EC_GROUP_free(C2_K409);
if (C2_B409) EC_GROUP_free(C2_B409);
if (C2_K571) EC_GROUP_free(C2_K571);
if (C2_B571) EC_GROUP_free(C2_B571);
}
static const char rnd_seed[] = "string to make the random number generator think it has entropy";
int main(int argc, char *argv[])
{
/* enable memory leak checking unless explicitly disabled */
if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
{
CRYPTO_malloc_debug_init();
CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
}
else
{
/* OPENSSL_DEBUG_MEMORY=off */
CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
}
CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
ERR_load_crypto_strings();
RAND_seed(rnd_seed, sizeof rnd_seed); /* or BN_generate_prime may fail */
prime_field_tests();
char2_field_tests();
ENGINE_cleanup();
CRYPTO_cleanup_all_ex_data();
ERR_free_strings();