fips/rand/fips_drbg_ec.c

   1 /* fips/rand/fips_drbg_ec.c */
   2 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
   3  * project.
   4  */
   5 /* ====================================================================
   6  * Copyright (c) 2011 The OpenSSL Project.  All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in
  17  *    the documentation and/or other materials provided with the
  18  *    distribution.
  19  *
  20  * 3. All advertising materials mentioning features or use of this
  21  *    software must display the following acknowledgment:
  22  *    "This product includes software developed by the OpenSSL Project
  23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  24  *
  25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  26  *    endorse or promote products derived from this software without
  27  *    prior written permission. For written permission, please contact
  28  *    licensing@OpenSSL.org.
  29  *
  30  * 5. Products derived from this software may not be called "OpenSSL"
  31  *    nor may "OpenSSL" appear in their names without prior written
  32  *    permission of the OpenSSL Project.
  33  *
  34  * 6. Redistributions of any form whatsoever must retain the following
  35  *    acknowledgment:
  36  *    "This product includes software developed by the OpenSSL Project
  37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  38  *
  39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  50  * OF THE POSSIBILITY OF SUCH DAMAGE.
  51  * ====================================================================
  52  */
  53
  54 #define OPENSSL_FIPSAPI
  55
  56 #include <stdlib.h>
  57 #include <string.h>
  58 #include <openssl/crypto.h>
  59 #include <openssl/fips.h>
  60 #include <openssl/fips_rand.h>
  61 #include <openssl/bn.h>
  62 #include "fips_rand_lcl.h"
  63
  64 /*#define EC_DRBG_TRACE*/
  65
  66 #ifdef EC_DRBG_TRACE
  67 static void hexprint(FILE *out, const unsigned char *buf, int buflen)
  68         {
  69         int i;
  70         fprintf(out, "\t");
  71         for (i = 0; i < buflen; i++)
  72                 fprintf(out, "%02X", buf[i]);
  73         fprintf(out, "\n");
  74         }
  75 static void bnprint(FILE *out, const char *name, const BIGNUM *b)
  76         {
  77         unsigned char *tmp;
  78         int len;
  79         len = BN_num_bytes(b);
  80         tmp = OPENSSL_malloc(len);
  81         BN_bn2bin(b, tmp);
  82         fprintf(out, "%s\n", name);
  83         hexprint(out, tmp, len);
  84         OPENSSL_free(tmp);
  85         }
  86 #if 0
  87 static void ecprint(FILE *out, EC_GROUP *grp, EC_POINT *pt)
  88         {
  89         BIGNUM *x, *y;
  90         x = BN_new();
  91         y = BN_new();
  92         EC_POINT_get_affine_coordinates_GFp(grp, pt, x, y, NULL);
  93         bnprint(out, "\tPoint X: ", x);
  94         bnprint(out, "\tPoint Y: ", y);
  95         BN_free(x);
  96         BN_free(y);
  97         }
  98 #endif
  99 #endif
 100
 101 /* This is Hash_df from SP 800-90 10.4.1 */
 102
 103 static int hash_df(DRBG_CTX *dctx, unsigned char *out,
 104                         const unsigned char *in1, size_t in1len,
 105                         const unsigned char *in2, size_t in2len,
 106                         const unsigned char *in3, size_t in3len)
 107         {
 108         DRBG_EC_CTX *ectx = &dctx->d.ec;
 109         EVP_MD_CTX *mctx = &ectx->mctx;
 110         unsigned char *vtmp = ectx->vtmp;
 111         unsigned char tmp[6];
 112         size_t mdlen = M_EVP_MD_size(ectx->md);
 113         /* Standard only ever needs seedlen bytes which is always less than
 114          * maximum permitted so no need to check length.
 115          */
 116         size_t outlen = dctx->seedlen;
 117         size_t nbits = (outlen << 3) - ectx->exbits;
 118         tmp[0] = 1;
 119         tmp[1] = (nbits >> 24) & 0xff;
 120         tmp[2] = (nbits >> 16) & 0xff;
 121         tmp[3] = (nbits >> 8) & 0xff;
 122         tmp[4] = nbits & 0xff;
 123         if (!in1)
 124                 {
 125                 tmp[5] = (unsigned char)in1len;
 126                 in1 = tmp + 5;
 127                 in1len = 1;
 128                 }
 129         for (;;)
 130                 {
 131                 if (!FIPS_digestinit(mctx, ectx->md))
 132                         return 0;
 133                 if (!FIPS_digestupdate(mctx, tmp, 5))
 134                         return 0;
 135                 if (in1 && !FIPS_digestupdate(mctx, in1, in1len))
 136                         return 0;
 137                 if (in2 && !FIPS_digestupdate(mctx, in2, in2len))
 138                         return 0;
 139                 if (in3 && !FIPS_digestupdate(mctx, in3, in3len))
 140                         return 0;
 141                 if (outlen < mdlen)
 142                         {
 143                         if (!FIPS_digestfinal(mctx, vtmp, NULL))
 144                                 return 0;
 145                         memcpy(out, vtmp, outlen);
 146                         OPENSSL_cleanse(vtmp, mdlen);
 147                         return 1;
 148                         }
 149                 else if(!FIPS_digestfinal(mctx, out, NULL))
 150                         return 0;
 151
 152                 outlen -= mdlen;
 153                 if (outlen == 0)
 154                         return 1;
 155                 tmp[0]++;
 156                 out += mdlen;
 157                 }
 158         }
 159
 160 static int bn2binpad(unsigned char *to, size_t tolen, BIGNUM *b)
 161         {
 162         size_t blen;
 163         blen = BN_num_bytes(b);
 164         /* If BIGNUM length greater than buffer, mask to get rightmost
 165          * bytes. NB: modifies b but this doesn't matter for our purposes.
 166          */
 167         if (blen > tolen)
 168                 {
 169                 BN_mask_bits(b, tolen << 3);
 170                 /* Update length because mask operation might create leading
 171                  * zeroes.
 172                  */
 173                 blen = BN_num_bytes(b);
 174                 }
 175         /* If b length smaller than buffer pad with zeroes */
 176         if (blen < tolen)
 177                 {
 178                 memset(to, 0, tolen - blen);
 179                 to += tolen - blen;
 180                 }
 181
 182         /* This call cannot fail */
 183         BN_bn2bin(b, to);
 184         return 1;
 185         }
 186 /* Convert buffer to a BIGNUM discarding extra bits if necessary */
 187 static int bin2bnbits(DRBG_CTX *dctx, BIGNUM *r, const unsigned char *buf)
 188         {
 189         DRBG_EC_CTX *ectx = &dctx->d.ec;
 190         if (!BN_bin2bn(buf, dctx->seedlen, r))
 191                 return 0;
 192         /* If we have extra bits right shift off the end of r */
 193         if (ectx->exbits)
 194                 {
 195                 if (!BN_rshift(r, r, ectx->exbits))
 196                         return 0;
 197                 }
 198         return 1;
 199         }
 200
 201 /* Calculate r = phi(s * P) or r= phi(s * Q) */
 202
 203 static int drbg_ec_mul(DRBG_EC_CTX *ectx, BIGNUM *r, const BIGNUM *s, int use_q)
 204         {
 205         if (use_q)
 206                 {
 207                 if (!EC_POINT_mul(ectx->curve, ectx->ptmp,
 208                                                 NULL, ectx->Q, s, ectx->bctx))
 209                         return 0;
 210                 }
 211         else
 212                 {
 213                 if (!EC_POINT_mul(ectx->curve, ectx->ptmp,
 214                                                 s, NULL, NULL, ectx->bctx))
 215                         return 0;
 216                 }
 217         /* Get x coordinate of result */
 218         if (!EC_POINT_get_affine_coordinates_GFp(ectx->curve, ectx->ptmp, r,
 219                                                         NULL, ectx->bctx))
 220                 return 0;
 221         return 0;
 222         }
 223
 224 static int drbg_ec_instantiate(DRBG_CTX *dctx,
 225                                 const unsigned char *ent, size_t ent_len,
 226                                 const unsigned char *nonce, size_t nonce_len,
 227                                 const unsigned char *pstr, size_t pstr_len)
 228         {
 229         DRBG_EC_CTX *ectx = &dctx->d.ec;
 230         if (!hash_df(dctx, ectx->sbuf,
 231                         ent, ent_len, nonce, nonce_len, pstr, pstr_len))
 232                 return 0;
 233         if (!bin2bnbits(dctx, ectx->s, ectx->sbuf))
 234                 return 0;
 235         return 1;
 236         }
 237
 238
 239 static int drbg_ec_reseed(DRBG_CTX *dctx,
 240                                 const unsigned char *ent, size_t ent_len,
 241                                 const unsigned char *adin, size_t adin_len)
 242         {
 243         DRBG_EC_CTX *ectx = &dctx->d.ec;
 244         /* Check if we have a deferred s = s * P */
 245         if (ectx->sp_defer)
 246                 {
 247                 if (drbg_ec_mul(ectx, ectx->s, ectx->s, 0))
 248                         return 0;
 249                 ectx->sp_defer = 0;
 250                 }
 251         /* Convert s value to a binary buffer. Save it to tbuf as we are
 252          * about to overwrite it.
 253          */
 254         if (ectx->exbits)
 255                 BN_lshift(ectx->s, ectx->s, ectx->exbits);
 256         bn2binpad(ectx->tbuf, dctx->seedlen, ectx->s);
 257         if (!hash_df(dctx, ectx->sbuf, ectx->tbuf, dctx->seedlen,
 258                         ent, ent_len, adin, adin_len))
 259                 return 0;
 260         if (!bin2bnbits(dctx, ectx->s, ectx->sbuf))
 261                 return 0;
 262         dctx->reseed_counter = 0;
 263         return 1;
 264         }
 265
 266 static int drbg_ec_generate(DRBG_CTX *dctx,
 267                                 unsigned char *out, size_t outlen,
 268                                 const unsigned char *adin, size_t adin_len)
 269         {
 270         DRBG_EC_CTX *ectx = &dctx->d.ec;
 271         BIGNUM *t, *r;
 272         BIGNUM *s = ectx->s;
 273         /* special case: check reseed interval */
 274         if (out == NULL)
 275                 {
 276                 size_t nb = (outlen + dctx->blocklength - 1)/dctx->blocklength;
 277                 if (dctx->reseed_counter + nb > dctx->reseed_interval)
 278                         dctx->status = DRBG_STATUS_RESEED;
 279                 return 1;
 280                 }
 281         /* Check if we have a deferred s = s * P */
 282         if (ectx->sp_defer)
 283                 {
 284                 if (drbg_ec_mul(ectx, s, s, 0))
 285                         goto err;
 286                 ectx->sp_defer = 0;
 287                 }
 288
 289         BN_CTX_start(ectx->bctx);
 290         t = BN_CTX_get(ectx->bctx);
 291         r = BN_CTX_get(ectx->bctx);
 292         if (!r)
 293                 goto err;
 294         if (adin && adin_len)
 295                 {
 296                 size_t i;
 297                 /* Convert s to buffer */
 298                 if (ectx->exbits)
 299                         BN_lshift(ectx->s, ectx->s, ectx->exbits);
 300                 bn2binpad(ectx->sbuf, dctx->seedlen, ectx->s);
 301                 /* Step 2 */
 302                 if (!hash_df(dctx, ectx->tbuf, adin, adin_len,
 303                                 NULL, 0, NULL, 0))
 304                         goto err;
 305                 /* Step 5 */
 306                 for (i = 0; i < dctx->seedlen; i++)
 307                         ectx->tbuf[i] ^= ectx->sbuf[i];
 308                 if (!bin2bnbits(dctx, t, ectx->tbuf))
 309                         return 0;
 310                 }
 311         else
 312                 if (!BN_copy(t, ectx->s))
 313                         goto err;
 314
 315 #ifdef EC_DRBG_TRACE
 316         bnprint(stderr, "s at start of generate: ", ectx->s);
 317 #endif
 318
 319         for (;;)
 320                 {
 321                 /* Step #6, calculate s = t * P */
 322                 if (drbg_ec_mul(ectx, s, t, 0))
 323                         goto err;
 324 #ifdef EC_DRBG_TRACE
 325                 bnprint(stderr, "s in generate: ", ectx->s);
 326 #endif
 327                 /* Step #7, calculate r = s * Q */
 328                 if (drbg_ec_mul(ectx, r, s, 1))
 329                         goto err;
 330 #ifdef EC_DRBG_TRACE
 331         bnprint(stderr, "r in generate is: ", r);
 332 #endif
 333                 dctx->reseed_counter++;
 334                 /* Get rightmost bits of r to output buffer */
 335
 336                 if (!(dctx->flags & DRBG_FLAG_TEST) && !dctx->lb_valid)
 337                         {
 338                         if (!bn2binpad(dctx->lb, dctx->blocklength, r))
 339                                 goto err;
 340                         dctx->lb_valid = 1;
 341                         continue;
 342                         }
 343                 if (outlen < dctx->blocklength)
 344                         {
 345                         if (!bn2binpad(ectx->vtmp, dctx->blocklength, r))
 346                                 goto err;
 347                         if (!fips_drbg_cprng_test(dctx, ectx->vtmp))
 348                                 goto err;
 349                         memcpy(out, ectx->vtmp, outlen);
 350                         break;
 351                         }
 352                 else
 353                         {
 354                         if (!bn2binpad(out, dctx->blocklength, r))
 355                                 goto err;
 356                         if (!fips_drbg_cprng_test(dctx, out))
 357                                 goto err;
 358                         }
 359                 outlen -= dctx->blocklength;
 360                 if (!outlen)
 361                         break;
 362                 out += dctx->blocklength;
 363 #ifdef EC_DRBG_TRACE
 364                 fprintf(stderr, "Random bits written:\n");
 365                 hexprint(stderr, out, dctx->blocklength);
 366 #endif
 367                 }
 368         /* Defer s = s * P until we need it */
 369         ectx->sp_defer = 1;
 370 #ifdef EC_DRBG_TRACE
 371         bnprint(stderr, "s after generate is: ", s);
 372 #endif
 373         BN_CTX_end(ectx->bctx);
 374         return 1;
 375         err:
 376         BN_CTX_end(ectx->bctx);
 377         return 0;
 378         }
 379
 380 static int drbg_ec_uninstantiate(DRBG_CTX *dctx)
 381         {
 382         DRBG_EC_CTX *ectx = &dctx->d.ec;
 383         EVP_MD_CTX_cleanup(&ectx->mctx);
 384         EC_GROUP_free(ectx->curve);
 385         EC_POINT_free(ectx->Q);
 386         EC_POINT_free(ectx->ptmp);
 387         BN_clear_free(ectx->s);
 388         BN_CTX_free(ectx->bctx);
 389         OPENSSL_cleanse(&dctx->d.ec, sizeof(DRBG_EC_CTX));
 390         return 1;
 391         }
 392
 393 /* Q points from SP 800-90 A.1, P is generator */
 394
 395 __fips_constseg
 396 static const unsigned char p_256_qx[] = {
 397         0xc9,0x74,0x45,0xf4,0x5c,0xde,0xf9,0xf0,0xd3,0xe0,0x5e,0x1e,
 398         0x58,0x5f,0xc2,0x97,0x23,0x5b,0x82,0xb5,0xbe,0x8f,0xf3,0xef,
 399         0xca,0x67,0xc5,0x98,0x52,0x01,0x81,0x92
 400 };
 401 __fips_constseg
 402 static const unsigned char p_256_qy[] = {
 403         0xb2,0x8e,0xf5,0x57,0xba,0x31,0xdf,0xcb,0xdd,0x21,0xac,0x46,
 404         0xe2,0xa9,0x1e,0x3c,0x30,0x4f,0x44,0xcb,0x87,0x05,0x8a,0xda,
 405         0x2c,0xb8,0x15,0x15,0x1e,0x61,0x00,0x46
 406 };
 407
 408 __fips_constseg
 409 static const unsigned char p_384_qx[] = {
 410         0x8e,0x72,0x2d,0xe3,0x12,0x5b,0xdd,0xb0,0x55,0x80,0x16,0x4b,
 411         0xfe,0x20,0xb8,0xb4,0x32,0x21,0x6a,0x62,0x92,0x6c,0x57,0x50,
 412         0x2c,0xee,0xde,0x31,0xc4,0x78,0x16,0xed,0xd1,0xe8,0x97,0x69,
 413         0x12,0x41,0x79,0xd0,0xb6,0x95,0x10,0x64,0x28,0x81,0x50,0x65
 414 };
 415 __fips_constseg
 416 static const unsigned char p_384_qy[] = {
 417         0x02,0x3b,0x16,0x60,0xdd,0x70,0x1d,0x08,0x39,0xfd,0x45,0xee,
 418         0xc3,0x6f,0x9e,0xe7,0xb3,0x2e,0x13,0xb3,0x15,0xdc,0x02,0x61,
 419         0x0a,0xa1,0xb6,0x36,0xe3,0x46,0xdf,0x67,0x1f,0x79,0x0f,0x84,
 420         0xc5,0xe0,0x9b,0x05,0x67,0x4d,0xbb,0x7e,0x45,0xc8,0x03,0xdd
 421 };
 422
 423 __fips_constseg
 424 static const unsigned char p_521_qx[] = {
 425         0x01,0xb9,0xfa,0x3e,0x51,0x8d,0x68,0x3c,0x6b,0x65,0x76,0x36,
 426         0x94,0xac,0x8e,0xfb,0xae,0xc6,0xfa,0xb4,0x4f,0x22,0x76,0x17,
 427         0x1a,0x42,0x72,0x65,0x07,0xdd,0x08,0xad,0xd4,0xc3,0xb3,0xf4,
 428         0xc1,0xeb,0xc5,0xb1,0x22,0x2d,0xdb,0xa0,0x77,0xf7,0x22,0x94,
 429         0x3b,0x24,0xc3,0xed,0xfa,0x0f,0x85,0xfe,0x24,0xd0,0xc8,0xc0,
 430         0x15,0x91,0xf0,0xbe,0x6f,0x63
 431 };
 432 __fips_constseg
 433 static const unsigned char p_521_qy[] = {
 434         0x01,0xf3,0xbd,0xba,0x58,0x52,0x95,0xd9,0xa1,0x11,0x0d,0x1d,
 435         0xf1,0xf9,0x43,0x0e,0xf8,0x44,0x2c,0x50,0x18,0x97,0x6f,0xf3,
 436         0x43,0x7e,0xf9,0x1b,0x81,0xdc,0x0b,0x81,0x32,0xc8,0xd5,0xc3,
 437         0x9c,0x32,0xd0,0xe0,0x04,0xa3,0x09,0x2b,0x7d,0x32,0x7c,0x0e,
 438         0x7a,0x4d,0x26,0xd2,0xc7,0xb6,0x9b,0x58,0xf9,0x06,0x66,0x52,
 439         0x91,0x1e,0x45,0x77,0x79,0xde
 440 };
 441
 442 int fips_drbg_ec_init(DRBG_CTX *dctx)
 443         {
 444         const EVP_MD *md;
 445         const unsigned char *Q_x, *Q_y;
 446         BIGNUM *x, *y;
 447         size_t ptlen;
 448         int md_nid = dctx->type & 0xffff;
 449         int curve_nid = dctx->type >> 16;
 450         DRBG_EC_CTX *ectx = &dctx->d.ec;
 451         md = FIPS_get_digestbynid(md_nid);
 452         if (!md)
 453                 return -2;
 454
 455         /* These are taken from SP 800-90 10.3.1 table 4 */
 456         switch (curve_nid)
 457                 {
 458                 case NID_X9_62_prime256v1:
 459                 dctx->strength = 128;
 460                 dctx->seedlen = 32;
 461                 dctx->blocklength = 30;
 462                 ectx->exbits = 0;
 463                 Q_x = p_256_qx;
 464                 Q_y = p_256_qy;
 465                 ptlen = sizeof(p_256_qx);
 466                 break;
 467
 468                 case NID_secp384r1:
 469                 if (md_nid == NID_sha1)
 470                         return -2;
 471                 dctx->strength = 192;
 472                 dctx->seedlen = 48;
 473                 dctx->blocklength = 46;
 474                 ectx->exbits = 0;
 475                 Q_x = p_384_qx;
 476                 Q_y = p_384_qy;
 477                 ptlen = sizeof(p_384_qx);
 478                 break;
 479
 480                 case NID_secp521r1:
 481                 if (md_nid == NID_sha1 || md_nid == NID_sha224)
 482                         return -2;
 483                 dctx->strength = 256;
 484                 dctx->seedlen = 66;
 485                 dctx->blocklength = 63;
 486                 ectx->exbits = 7;
 487                 Q_x = p_521_qx;
 488                 Q_y = p_521_qy;
 489                 ptlen = sizeof(p_521_qx);
 490                 break;
 491
 492                 default:
 493                 return -2;
 494                 }
 495
 496         dctx->flags |= DRBG_CUSTOM_RESEED;
 497         dctx->reseed_counter = 0;
 498         dctx->instantiate = drbg_ec_instantiate;
 499         dctx->reseed = drbg_ec_reseed;
 500         dctx->generate = drbg_ec_generate;
 501         dctx->uninstantiate = drbg_ec_uninstantiate;
 502
 503         ectx->md = md;
 504         EVP_MD_CTX_init(&ectx->mctx);
 505
 506         dctx->min_entropy = dctx->strength / 8;
 507         dctx->max_entropy = 2 << 10;
 508
 509         dctx->min_nonce = dctx->min_entropy / 2;
 510         dctx->max_nonce = 2 << 10;
 511
 512         dctx->max_pers = 2 << 10;
 513         dctx->max_adin = 2 << 10;
 514
 515         dctx->reseed_interval = 1<<24;
 516         dctx->max_request = dctx->reseed_interval * dctx->blocklength;
 517
 518         /* Setup internal structures */
 519         ectx->bctx = BN_CTX_new();
 520         if (!ectx->bctx)
 521                 return 0;
 522         BN_CTX_start(ectx->bctx);
 523
 524         ectx->s = BN_new();
 525
 526         ectx->curve = EC_GROUP_new_by_curve_name(curve_nid);
 527
 528         ectx->Q = EC_POINT_new(ectx->curve);
 529         ectx->ptmp = EC_POINT_new(ectx->curve);
 530
 531         ectx->sp_defer = 0;
 532
 533         x = BN_CTX_get(ectx->bctx);
 534         y = BN_CTX_get(ectx->bctx);
 535
 536         if (!ectx->s || !ectx->curve || !ectx->Q || !y)
 537                 goto err;
 538
 539         if (!BN_bin2bn(Q_x, ptlen, x) || !BN_bin2bn(Q_y, ptlen, y))
 540                 goto err;
 541         if (!EC_POINT_set_affine_coordinates_GFp(ectx->curve, ectx->Q,
 542                                                         x, y, ectx->bctx))
 543                 goto err;
 544
 545         BN_CTX_end(ectx->bctx);
 546
 547         return 1;
 548         err:
 549         BN_CTX_end(ectx->bctx);
 550         drbg_ec_uninstantiate(dctx);
 551         return 0;
 552         }