test/ectest.c

   1 /*
   2  * Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved.
   3  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
   4  *
   5  * Licensed under the Apache License 2.0 (the "License").  You may not use
   6  * this file except in compliance with the License.  You can obtain a copy
   7  * in the file LICENSE in the source distribution or at
   8  * https://www.openssl.org/source/license.html
   9  */
  10
  11 /*
  12  * EC_KEY low level APIs are deprecated for public use, but still ok for
  13  * internal use.
  14  */
  15 #include "internal/deprecated.h"
  16
  17 #include <string.h>
  18 #include "internal/nelem.h"
  19 #include "testutil.h"
  20
  21 #include <openssl/ec.h>
  22 #ifndef OPENSSL_NO_ENGINE
  23 # include <openssl/engine.h>
  24 #endif
  25 #include <openssl/err.h>
  26 #include <openssl/obj_mac.h>
  27 #include <openssl/objects.h>
  28 #include <openssl/rand.h>
  29 #include <openssl/bn.h>
  30 #include <openssl/opensslconf.h>
  31 #include <openssl/core_names.h>
  32 #include <openssl/param_build.h>
  33 #include <openssl/evp.h>
  34
  35 static size_t crv_len = 0;
  36 static EC_builtin_curve *curves = NULL;
  37
  38 /* test multiplication with group order, long and negative scalars */
  39 static int group_order_tests(EC_GROUP *group)
  40 {
  41     BIGNUM *n1 = NULL, *n2 = NULL, *order = NULL;
  42     EC_POINT *P = NULL, *Q = NULL, *R = NULL, *S = NULL;
  43     const EC_POINT *G = NULL;
  44     BN_CTX *ctx = NULL;
  45     int i = 0, r = 0;
  46
  47     if (!TEST_ptr(n1 = BN_new())
  48         || !TEST_ptr(n2 = BN_new())
  49         || !TEST_ptr(order = BN_new())
  50         || !TEST_ptr(ctx = BN_CTX_new())
  51         || !TEST_ptr(G = EC_GROUP_get0_generator(group))
  52         || !TEST_ptr(P = EC_POINT_new(group))
  53         || !TEST_ptr(Q = EC_POINT_new(group))
  54         || !TEST_ptr(R = EC_POINT_new(group))
  55         || !TEST_ptr(S = EC_POINT_new(group)))
  56         goto err;
  57
  58     if (!TEST_true(EC_GROUP_get_order(group, order, ctx))
  59         || !TEST_true(EC_POINT_mul(group, Q, order, NULL, NULL, ctx))
  60         || !TEST_true(EC_POINT_is_at_infinity(group, Q))
  61 #ifndef OPENSSL_NO_DEPRECATED_3_0
  62         || !TEST_true(EC_GROUP_precompute_mult(group, ctx))
  63 #endif
  64         || !TEST_true(EC_POINT_mul(group, Q, order, NULL, NULL, ctx))
  65         || !TEST_true(EC_POINT_is_at_infinity(group, Q))
  66         || !TEST_true(EC_POINT_copy(P, G))
  67         || !TEST_true(BN_one(n1))
  68         || !TEST_true(EC_POINT_mul(group, Q, n1, NULL, NULL, ctx))
  69         || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx))
  70         || !TEST_true(BN_sub(n1, order, n1))
  71         || !TEST_true(EC_POINT_mul(group, Q, n1, NULL, NULL, ctx))
  72         || !TEST_true(EC_POINT_invert(group, Q, ctx))
  73         || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx)))
  74         goto err;
  75
  76     for (i = 1; i <= 2; i++) {
  77 #ifndef OPENSSL_NO_DEPRECATED_3_0
  78         const BIGNUM *scalars[6];
  79         const EC_POINT *points[6];
  80 #endif
  81
  82         if (!TEST_true(BN_set_word(n1, i))
  83             /*
  84              * If i == 1, P will be the predefined generator for which
  85              * EC_GROUP_precompute_mult has set up precomputation.
  86              */
  87             || !TEST_true(EC_POINT_mul(group, P, n1, NULL, NULL, ctx))
  88             || (i == 1 && !TEST_int_eq(0, EC_POINT_cmp(group, P, G, ctx)))
  89             || !TEST_true(BN_one(n1))
  90             /* n1 = 1 - order */
  91             || !TEST_true(BN_sub(n1, n1, order))
  92             || !TEST_true(EC_POINT_mul(group, Q, NULL, P, n1, ctx))
  93             || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx))
  94
  95             /* n2 = 1 + order */
  96             || !TEST_true(BN_add(n2, order, BN_value_one()))
  97             || !TEST_true(EC_POINT_mul(group, Q, NULL, P, n2, ctx))
  98             || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx))
  99
 100             /* n2 = (1 - order) * (1 + order) = 1 - order^2 */
 101             || !TEST_true(BN_mul(n2, n1, n2, ctx))
 102             || !TEST_true(EC_POINT_mul(group, Q, NULL, P, n2, ctx))
 103             || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx)))
 104             goto err;
 105
 106         /* n2 = order^2 - 1 */
 107         BN_set_negative(n2, 0);
 108         if (!TEST_true(EC_POINT_mul(group, Q, NULL, P, n2, ctx))
 109             /* Add P to verify the result. */
 110             || !TEST_true(EC_POINT_add(group, Q, Q, P, ctx))
 111             || !TEST_true(EC_POINT_is_at_infinity(group, Q))
 112             || !TEST_false(EC_POINT_is_at_infinity(group, P)))
 113             goto err;
 114
 115 #ifndef OPENSSL_NO_DEPRECATED_3_0
 116         /* Exercise EC_POINTs_mul, including corner cases. */
 117         scalars[0] = scalars[1] = BN_value_one();
 118         points[0]  = points[1]  = P;
 119
 120         if (!TEST_true(EC_POINTs_mul(group, R, NULL, 2, points, scalars, ctx))
 121             || !TEST_true(EC_POINT_dbl(group, S, points[0], ctx))
 122             || !TEST_int_eq(0, EC_POINT_cmp(group, R, S, ctx)))
 123             goto err;
 124
 125         scalars[0] = n1;
 126         points[0] = Q;          /* => infinity */
 127         scalars[1] = n2;
 128         points[1] = P;          /* => -P */
 129         scalars[2] = n1;
 130         points[2] = Q;          /* => infinity */
 131         scalars[3] = n2;
 132         points[3] = Q;          /* => infinity */
 133         scalars[4] = n1;
 134         points[4] = P;          /* => P */
 135         scalars[5] = n2;
 136         points[5] = Q;          /* => infinity */
 137         if (!TEST_true(EC_POINTs_mul(group, P, NULL, 6, points, scalars, ctx))
 138             || !TEST_true(EC_POINT_is_at_infinity(group, P)))
 139             goto err;
 140 #endif
 141     }
 142
 143     r = 1;
 144 err:
 145     if (r == 0 && i != 0)
 146         TEST_info(i == 1 ? "allowing precomputation" :
 147                            "without precomputation");
 148     EC_POINT_free(P);
 149     EC_POINT_free(Q);
 150     EC_POINT_free(R);
 151     EC_POINT_free(S);
 152     BN_free(n1);
 153     BN_free(n2);
 154     BN_free(order);
 155     BN_CTX_free(ctx);
 156     return r;
 157 }
 158
 159 static int prime_field_tests(void)
 160 {
 161     BN_CTX *ctx = NULL;
 162     BIGNUM *p = NULL, *a = NULL, *b = NULL, *scalar3 = NULL;
 163     EC_GROUP *group = NULL;
 164     EC_POINT *P = NULL, *Q = NULL, *R = NULL;
 165     BIGNUM *x = NULL, *y = NULL, *z = NULL, *yplusone = NULL;
 166 #ifndef OPENSSL_NO_DEPRECATED_3_0
 167     const EC_POINT *points[4];
 168     const BIGNUM *scalars[4];
 169 #endif
 170     unsigned char buf[100];
 171     size_t len, r = 0;
 172     int k;
 173
 174     if (!TEST_ptr(ctx = BN_CTX_new())
 175         || !TEST_ptr(p = BN_new())
 176         || !TEST_ptr(a = BN_new())
 177         || !TEST_ptr(b = BN_new())
 178         || !TEST_true(BN_hex2bn(&p, "17"))
 179         || !TEST_true(BN_hex2bn(&a, "1"))
 180         || !TEST_true(BN_hex2bn(&b, "1"))
 181         || !TEST_ptr(group = EC_GROUP_new_curve_GFp(p, a, b, ctx))
 182         || !TEST_true(EC_GROUP_get_curve(group, p, a, b, ctx)))
 183         goto err;
 184
 185     TEST_info("Curve defined by Weierstrass equation");
 186     TEST_note("     y^2 = x^3 + a*x + b (mod p)");
 187     test_output_bignum("a", a);
 188     test_output_bignum("b", b);
 189     test_output_bignum("p", p);
 190
 191     buf[0] = 0;
 192     if (!TEST_ptr(P = EC_POINT_new(group))
 193         || !TEST_ptr(Q = EC_POINT_new(group))
 194         || !TEST_ptr(R = EC_POINT_new(group))
 195         || !TEST_true(EC_POINT_set_to_infinity(group, P))
 196         || !TEST_true(EC_POINT_is_at_infinity(group, P))
 197         || !TEST_true(EC_POINT_oct2point(group, Q, buf, 1, ctx))
 198         || !TEST_true(EC_POINT_add(group, P, P, Q, ctx))
 199         || !TEST_true(EC_POINT_is_at_infinity(group, P))
 200         || !TEST_ptr(x = BN_new())
 201         || !TEST_ptr(y = BN_new())
 202         || !TEST_ptr(z = BN_new())
 203         || !TEST_ptr(yplusone = BN_new())
 204         || !TEST_true(BN_hex2bn(&x, "D"))
 205         || !TEST_true(EC_POINT_set_compressed_coordinates(group, Q, x, 1, ctx)))
 206         goto err;
 207
 208     if (!TEST_int_gt(EC_POINT_is_on_curve(group, Q, ctx), 0)) {
 209         if (!TEST_true(EC_POINT_get_affine_coordinates(group, Q, x, y, ctx)))
 210             goto err;
 211         TEST_info("Point is not on curve");
 212         test_output_bignum("x", x);
 213         test_output_bignum("y", y);
 214         goto err;
 215     }
 216
 217     TEST_note("A cyclic subgroup:");
 218     k = 100;
 219     do {
 220         if (!TEST_int_ne(k--, 0))
 221             goto err;
 222
 223         if (EC_POINT_is_at_infinity(group, P)) {
 224             TEST_note("     point at infinity");
 225         } else {
 226             if (!TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y,
 227                                                            ctx)))
 228                 goto err;
 229
 230             test_output_bignum("x", x);
 231             test_output_bignum("y", y);
 232         }
 233
 234         if (!TEST_true(EC_POINT_copy(R, P))
 235             || !TEST_true(EC_POINT_add(group, P, P, Q, ctx)))
 236             goto err;
 237
 238     } while (!EC_POINT_is_at_infinity(group, P));
 239
 240     if (!TEST_true(EC_POINT_add(group, P, Q, R, ctx))
 241         || !TEST_true(EC_POINT_is_at_infinity(group, P)))
 242         goto err;
 243
 244     len =
 245         EC_POINT_point2oct(group, Q, POINT_CONVERSION_COMPRESSED, buf,
 246                            sizeof(buf), ctx);
 247     if (!TEST_size_t_ne(len, 0)
 248         || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
 249         || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
 250         goto err;
 251     test_output_memory("Generator as octet string, compressed form:",
 252                        buf, len);
 253
 254     len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_UNCOMPRESSED,
 255                              buf, sizeof(buf), ctx);
 256     if (!TEST_size_t_ne(len, 0)
 257         || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
 258         || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
 259         goto err;
 260     test_output_memory("Generator as octet string, uncompressed form:",
 261                        buf, len);
 262
 263     len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_HYBRID,
 264                              buf, sizeof(buf), ctx);
 265     if (!TEST_size_t_ne(len, 0)
 266         || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
 267         || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
 268         goto err;
 269     test_output_memory("Generator as octet string, hybrid form:",
 270                        buf, len);
 271
 272     if (!TEST_true(EC_POINT_invert(group, P, ctx))
 273         || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx))
 274
 275     /*
 276      * Curve secp160r1 (Certicom Research SEC 2 Version 1.0, section 2.4.2,
 277      * 2000) -- not a NIST curve, but commonly used
 278      */
 279
 280         || !TEST_true(BN_hex2bn(&p,                         "FFFFFFFF"
 281                                     "FFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF"))
 282         || !TEST_int_eq(1, BN_check_prime(p, ctx, NULL))
 283         || !TEST_true(BN_hex2bn(&a,                         "FFFFFFFF"
 284                                     "FFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC"))
 285         || !TEST_true(BN_hex2bn(&b,                         "1C97BEFC"
 286                                     "54BD7A8B65ACF89F81D4D4ADC565FA45"))
 287         || !TEST_true(EC_GROUP_set_curve(group, p, a, b, ctx))
 288         || !TEST_true(BN_hex2bn(&x,                         "4A96B568"
 289                                     "8EF573284664698968C38BB913CBFC82"))
 290         || !TEST_true(BN_hex2bn(&y,                         "23a62855"
 291                                     "3168947d59dcc912042351377ac5fb32"))
 292         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
 293     /*
 294      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 295      * and therefore setting the coordinates should fail.
 296      */
 297         || !TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone,
 298                                                        ctx))
 299         || !TEST_true(EC_POINT_set_affine_coordinates(group, P, x, y, ctx))
 300         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 301         || !TEST_true(BN_hex2bn(&z,                       "0100000000"
 302                                     "000000000001F4C8F927AED3CA752257"))
 303         || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
 304         || !TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y, ctx)))
 305         goto err;
 306     TEST_info("SEC2 curve secp160r1 -- Generator");
 307     test_output_bignum("x", x);
 308     test_output_bignum("y", y);
 309     /* G_y value taken from the standard: */
 310     if (!TEST_true(BN_hex2bn(&z,                         "23a62855"
 311                                  "3168947d59dcc912042351377ac5fb32"))
 312         || !TEST_BN_eq(y, z)
 313         || !TEST_int_eq(EC_GROUP_get_degree(group), 160)
 314         || !group_order_tests(group)
 315
 316     /* Curve P-192 (FIPS PUB 186-2, App. 6) */
 317
 318         || !TEST_true(BN_hex2bn(&p,                 "FFFFFFFFFFFFFFFF"
 319                                     "FFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF"))
 320         || !TEST_int_eq(1, BN_check_prime(p, ctx, NULL))
 321         || !TEST_true(BN_hex2bn(&a,                 "FFFFFFFFFFFFFFFF"
 322                                     "FFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC"))
 323         || !TEST_true(BN_hex2bn(&b,                 "64210519E59C80E7"
 324                                     "0FA7E9AB72243049FEB8DEECC146B9B1"))
 325         || !TEST_true(EC_GROUP_set_curve(group, p, a, b, ctx))
 326         || !TEST_true(BN_hex2bn(&x,                 "188DA80EB03090F6"
 327                                     "7CBF20EB43A18800F4FF0AFD82FF1012"))
 328         || !TEST_true(EC_POINT_set_compressed_coordinates(group, P, x, 1, ctx))
 329         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 330         || !TEST_true(BN_hex2bn(&z,                 "FFFFFFFFFFFFFFFF"
 331                                     "FFFFFFFF99DEF836146BC9B1B4D22831"))
 332         || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
 333         || !TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y, ctx)))
 334         goto err;
 335
 336     TEST_info("NIST curve P-192 -- Generator");
 337     test_output_bignum("x", x);
 338     test_output_bignum("y", y);
 339     /* G_y value taken from the standard: */
 340     if (!TEST_true(BN_hex2bn(&z,                 "07192B95FFC8DA78"
 341                                  "631011ED6B24CDD573F977A11E794811"))
 342         || !TEST_BN_eq(y, z)
 343         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
 344     /*
 345      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 346      * and therefore setting the coordinates should fail.
 347      */
 348         || !TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone,
 349                                                        ctx))
 350         || !TEST_int_eq(EC_GROUP_get_degree(group), 192)
 351         || !group_order_tests(group)
 352
 353     /* Curve P-224 (FIPS PUB 186-2, App. 6) */
 354
 355         || !TEST_true(BN_hex2bn(&p,         "FFFFFFFFFFFFFFFFFFFFFFFF"
 356                                     "FFFFFFFF000000000000000000000001"))
 357         || !TEST_int_eq(1, BN_check_prime(p, ctx, NULL))
 358         || !TEST_true(BN_hex2bn(&a,         "FFFFFFFFFFFFFFFFFFFFFFFF"
 359                                     "FFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE"))
 360         || !TEST_true(BN_hex2bn(&b,         "B4050A850C04B3ABF5413256"
 361                                     "5044B0B7D7BFD8BA270B39432355FFB4"))
 362         || !TEST_true(EC_GROUP_set_curve(group, p, a, b, ctx))
 363         || !TEST_true(BN_hex2bn(&x,         "B70E0CBD6BB4BF7F321390B9"
 364                                     "4A03C1D356C21122343280D6115C1D21"))
 365         || !TEST_true(EC_POINT_set_compressed_coordinates(group, P, x, 0, ctx))
 366         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 367         || !TEST_true(BN_hex2bn(&z,         "FFFFFFFFFFFFFFFFFFFFFFFF"
 368                                     "FFFF16A2E0B8F03E13DD29455C5C2A3D"))
 369         || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
 370         || !TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y, ctx)))
 371         goto err;
 372
 373     TEST_info("NIST curve P-224 -- Generator");
 374     test_output_bignum("x", x);
 375     test_output_bignum("y", y);
 376     /* G_y value taken from the standard: */
 377     if (!TEST_true(BN_hex2bn(&z,         "BD376388B5F723FB4C22DFE6"
 378                                  "CD4375A05A07476444D5819985007E34"))
 379         || !TEST_BN_eq(y, z)
 380         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
 381     /*
 382      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 383      * and therefore setting the coordinates should fail.
 384      */
 385         || !TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone,
 386                                                        ctx))
 387         || !TEST_int_eq(EC_GROUP_get_degree(group), 224)
 388         || !group_order_tests(group)
 389
 390     /* Curve P-256 (FIPS PUB 186-2, App. 6) */
 391
 392         || !TEST_true(BN_hex2bn(&p, "FFFFFFFF000000010000000000000000"
 393                                     "00000000FFFFFFFFFFFFFFFFFFFFFFFF"))
 394         || !TEST_int_eq(1, BN_check_prime(p, ctx, NULL))
 395         || !TEST_true(BN_hex2bn(&a, "FFFFFFFF000000010000000000000000"
 396                                     "00000000FFFFFFFFFFFFFFFFFFFFFFFC"))
 397         || !TEST_true(BN_hex2bn(&b, "5AC635D8AA3A93E7B3EBBD55769886BC"
 398                                     "651D06B0CC53B0F63BCE3C3E27D2604B"))
 399         || !TEST_true(EC_GROUP_set_curve(group, p, a, b, ctx))
 400
 401         || !TEST_true(BN_hex2bn(&x, "6B17D1F2E12C4247F8BCE6E563A440F2"
 402                                     "77037D812DEB33A0F4A13945D898C296"))
 403         || !TEST_true(EC_POINT_set_compressed_coordinates(group, P, x, 1, ctx))
 404         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 405         || !TEST_true(BN_hex2bn(&z, "FFFFFFFF00000000FFFFFFFFFFFFFFFF"
 406                                     "BCE6FAADA7179E84F3B9CAC2FC632551"))
 407         || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
 408         || !TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y, ctx)))
 409         goto err;
 410
 411     TEST_info("NIST curve P-256 -- Generator");
 412     test_output_bignum("x", x);
 413     test_output_bignum("y", y);
 414     /* G_y value taken from the standard: */
 415     if (!TEST_true(BN_hex2bn(&z, "4FE342E2FE1A7F9B8EE7EB4A7C0F9E16"
 416                                  "2BCE33576B315ECECBB6406837BF51F5"))
 417         || !TEST_BN_eq(y, z)
 418         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
 419     /*
 420      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 421      * and therefore setting the coordinates should fail.
 422      */
 423         || !TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone,
 424                                                        ctx))
 425         || !TEST_int_eq(EC_GROUP_get_degree(group), 256)
 426         || !group_order_tests(group)
 427
 428     /* Curve P-384 (FIPS PUB 186-2, App. 6) */
 429
 430         || !TEST_true(BN_hex2bn(&p, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 431                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE"
 432                                     "FFFFFFFF0000000000000000FFFFFFFF"))
 433         || !TEST_int_eq(1, BN_check_prime(p, ctx, NULL))
 434         || !TEST_true(BN_hex2bn(&a, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 435                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE"
 436                                     "FFFFFFFF0000000000000000FFFFFFFC"))
 437         || !TEST_true(BN_hex2bn(&b, "B3312FA7E23EE7E4988E056BE3F82D19"
 438                                     "181D9C6EFE8141120314088F5013875A"
 439                                     "C656398D8A2ED19D2A85C8EDD3EC2AEF"))
 440         || !TEST_true(EC_GROUP_set_curve(group, p, a, b, ctx))
 441
 442         || !TEST_true(BN_hex2bn(&x, "AA87CA22BE8B05378EB1C71EF320AD74"
 443                                     "6E1D3B628BA79B9859F741E082542A38"
 444                                     "5502F25DBF55296C3A545E3872760AB7"))
 445         || !TEST_true(EC_POINT_set_compressed_coordinates(group, P, x, 1, ctx))
 446         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 447         || !TEST_true(BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 448                                     "FFFFFFFFFFFFFFFFC7634D81F4372DDF"
 449                                     "581A0DB248B0A77AECEC196ACCC52973"))
 450         || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
 451         || !TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y, ctx)))
 452         goto err;
 453
 454     TEST_info("NIST curve P-384 -- Generator");
 455     test_output_bignum("x", x);
 456     test_output_bignum("y", y);
 457     /* G_y value taken from the standard: */
 458     if (!TEST_true(BN_hex2bn(&z, "3617DE4A96262C6F5D9E98BF9292DC29"
 459                                  "F8F41DBD289A147CE9DA3113B5F0B8C0"
 460                                  "0A60B1CE1D7E819D7A431D7C90EA0E5F"))
 461         || !TEST_BN_eq(y, z)
 462         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
 463     /*
 464      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 465      * and therefore setting the coordinates should fail.
 466      */
 467         || !TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone,
 468                                                        ctx))
 469         || !TEST_int_eq(EC_GROUP_get_degree(group), 384)
 470         || !group_order_tests(group)
 471
 472     /* Curve P-521 (FIPS PUB 186-2, App. 6) */
 473         || !TEST_true(BN_hex2bn(&p,                              "1FF"
 474                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 475                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 476                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 477                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"))
 478         || !TEST_int_eq(1, BN_check_prime(p, ctx, NULL))
 479         || !TEST_true(BN_hex2bn(&a,                              "1FF"
 480                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 481                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 482                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 483                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC"))
 484         || !TEST_true(BN_hex2bn(&b,                              "051"
 485                                     "953EB9618E1C9A1F929A21A0B68540EE"
 486                                     "A2DA725B99B315F3B8B489918EF109E1"
 487                                     "56193951EC7E937B1652C0BD3BB1BF07"
 488                                     "3573DF883D2C34F1EF451FD46B503F00"))
 489         || !TEST_true(EC_GROUP_set_curve(group, p, a, b, ctx))
 490         || !TEST_true(BN_hex2bn(&x,                               "C6"
 491                                     "858E06B70404E9CD9E3ECB662395B442"
 492                                     "9C648139053FB521F828AF606B4D3DBA"
 493                                     "A14B5E77EFE75928FE1DC127A2FFA8DE"
 494                                     "3348B3C1856A429BF97E7E31C2E5BD66"))
 495         || !TEST_true(EC_POINT_set_compressed_coordinates(group, P, x, 0, ctx))
 496         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 497         || !TEST_true(BN_hex2bn(&z,                              "1FF"
 498                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 499                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA"
 500                                     "51868783BF2F966B7FCC0148F709A5D0"
 501                                     "3BB5C9B8899C47AEBB6FB71E91386409"))
 502         || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
 503         || !TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y, ctx)))
 504         goto err;
 505
 506     TEST_info("NIST curve P-521 -- Generator");
 507     test_output_bignum("x", x);
 508     test_output_bignum("y", y);
 509     /* G_y value taken from the standard: */
 510     if (!TEST_true(BN_hex2bn(&z,                              "118"
 511                                  "39296A789A3BC0045C8A5FB42C7D1BD9"
 512                                  "98F54449579B446817AFBD17273E662C"
 513                                  "97EE72995EF42640C550B9013FAD0761"
 514                                  "353C7086A272C24088BE94769FD16650"))
 515         || !TEST_BN_eq(y, z)
 516         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
 517     /*
 518      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 519      * and therefore setting the coordinates should fail.
 520      */
 521         || !TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone,
 522                                                        ctx))
 523         || !TEST_int_eq(EC_GROUP_get_degree(group), 521)
 524         || !group_order_tests(group)
 525
 526     /* more tests using the last curve */
 527
 528     /* Restore the point that got mangled in the (x, y + 1) test. */
 529         || !TEST_true(EC_POINT_set_affine_coordinates(group, P, x, y, ctx))
 530         || !TEST_true(EC_POINT_copy(Q, P))
 531         || !TEST_false(EC_POINT_is_at_infinity(group, Q))
 532         || !TEST_true(EC_POINT_dbl(group, P, P, ctx))
 533         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 534         || !TEST_true(EC_POINT_invert(group, Q, ctx))       /* P = -2Q */
 535         || !TEST_true(EC_POINT_add(group, R, P, Q, ctx))
 536         || !TEST_true(EC_POINT_add(group, R, R, Q, ctx))
 537         || !TEST_true(EC_POINT_is_at_infinity(group, R))    /* R = P + 2Q */
 538         || !TEST_false(EC_POINT_is_at_infinity(group, Q)))
 539         goto err;
 540
 541 #ifndef OPENSSL_NO_DEPRECATED_3_0
 542     TEST_note("combined multiplication ...");
 543     points[0] = Q;
 544     points[1] = Q;
 545     points[2] = Q;
 546     points[3] = Q;
 547
 548     if (!TEST_true(EC_GROUP_get_order(group, z, ctx))
 549         || !TEST_true(BN_add(y, z, BN_value_one()))
 550         || !TEST_BN_even(y)
 551         || !TEST_true(BN_rshift1(y, y)))
 552         goto err;
 553
 554     scalars[0] = y;         /* (group order + 1)/2, so y*Q + y*Q = Q */
 555     scalars[1] = y;
 556
 557     /* z is still the group order */
 558     if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
 559         || !TEST_true(EC_POINTs_mul(group, R, z, 2, points, scalars, ctx))
 560         || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx))
 561         || !TEST_int_eq(0, EC_POINT_cmp(group, R, Q, ctx))
 562         || !TEST_true(BN_rand(y, BN_num_bits(y), 0, 0))
 563         || !TEST_true(BN_add(z, z, y)))
 564         goto err;
 565     BN_set_negative(z, 1);
 566     scalars[0] = y;
 567     scalars[1] = z;         /* z = -(order + y) */
 568
 569     if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
 570         || !TEST_true(EC_POINT_is_at_infinity(group, P))
 571         || !TEST_true(BN_rand(x, BN_num_bits(y) - 1, 0, 0))
 572         || !TEST_true(BN_add(z, x, y)))
 573         goto err;
 574     BN_set_negative(z, 1);
 575     scalars[0] = x;
 576     scalars[1] = y;
 577     scalars[2] = z;         /* z = -(x+y) */
 578
 579     if (!TEST_ptr(scalar3 = BN_new()))
 580         goto err;
 581     BN_zero(scalar3);
 582     scalars[3] = scalar3;
 583
 584     if (!TEST_true(EC_POINTs_mul(group, P, NULL, 4, points, scalars, ctx))
 585         || !TEST_true(EC_POINT_is_at_infinity(group, P)))
 586         goto err;
 587 #endif
 588     TEST_note(" ok\n");
 589     r = 1;
 590 err:
 591     BN_CTX_free(ctx);
 592     BN_free(p);
 593     BN_free(a);
 594     BN_free(b);
 595     EC_GROUP_free(group);
 596     EC_POINT_free(P);
 597     EC_POINT_free(Q);
 598     EC_POINT_free(R);
 599     BN_free(x);
 600     BN_free(y);
 601     BN_free(z);
 602     BN_free(yplusone);
 603     BN_free(scalar3);
 604     return r;
 605 }
 606
 607 #ifndef OPENSSL_NO_EC2M
 608
 609 static struct c2_curve_test {
 610     const char *name;
 611     const char *p;
 612     const char *a;
 613     const char *b;
 614     const char *x;
 615     const char *y;
 616     int ybit;
 617     const char *order;
 618     const char *cof;
 619     int degree;
 620 } char2_curve_tests[] = {
 621     /* Curve K-163 (FIPS PUB 186-2, App. 6) */
 622     {
 623         "NIST curve K-163",
 624         "0800000000000000000000000000000000000000C9",
 625         "1",
 626         "1",
 627         "02FE13C0537BBC11ACAA07D793DE4E6D5E5C94EEE8",
 628         "0289070FB05D38FF58321F2E800536D538CCDAA3D9",
 629         1, "04000000000000000000020108A2E0CC0D99F8A5EF", "2", 163
 630     },
 631     /* Curve B-163 (FIPS PUB 186-2, App. 6) */
 632     {
 633         "NIST curve B-163",
 634         "0800000000000000000000000000000000000000C9",
 635         "1",
 636         "020A601907B8C953CA1481EB10512F78744A3205FD",
 637         "03F0EBA16286A2D57EA0991168D4994637E8343E36",
 638         "00D51FBC6C71A0094FA2CDD545B11C5C0C797324F1",
 639         1, "040000000000000000000292FE77E70C12A4234C33", "2", 163
 640     },
 641     /* Curve K-233 (FIPS PUB 186-2, App. 6) */
 642     {
 643         "NIST curve K-233",
 644         "020000000000000000000000000000000000000004000000000000000001",
 645         "0",
 646         "1",
 647         "017232BA853A7E731AF129F22FF4149563A419C26BF50A4C9D6EEFAD6126",
 648         "01DB537DECE819B7F70F555A67C427A8CD9BF18AEB9B56E0C11056FAE6A3",
 649         0,
 650         "008000000000000000000000000000069D5BB915BCD46EFB1AD5F173ABDF",
 651         "4", 233
 652     },
 653     /* Curve B-233 (FIPS PUB 186-2, App. 6) */
 654     {
 655         "NIST curve B-233",
 656         "020000000000000000000000000000000000000004000000000000000001",
 657         "000000000000000000000000000000000000000000000000000000000001",
 658         "0066647EDE6C332C7F8C0923BB58213B333B20E9CE4281FE115F7D8F90AD",
 659         "00FAC9DFCBAC8313BB2139F1BB755FEF65BC391F8B36F8F8EB7371FD558B",
 660         "01006A08A41903350678E58528BEBF8A0BEFF867A7CA36716F7E01F81052",
 661         1,
 662         "01000000000000000000000000000013E974E72F8A6922031D2603CFE0D7",
 663         "2", 233
 664     },
 665     /* Curve K-283 (FIPS PUB 186-2, App. 6) */
 666     {
 667         "NIST curve K-283",
 668                                                                 "08000000"
 669         "00000000000000000000000000000000000000000000000000000000000010A1",
 670         "0",
 671         "1",
 672                                                                 "0503213F"
 673         "78CA44883F1A3B8162F188E553CD265F23C1567A16876913B0C2AC2458492836",
 674                                                                 "01CCDA38"
 675         "0F1C9E318D90F95D07E5426FE87E45C0E8184698E45962364E34116177DD2259",
 676         0,
 677                                                                 "01FFFFFF"
 678         "FFFFFFFFFFFFFFFFFFFFFFFFFFFFE9AE2ED07577265DFF7F94451E061E163C61",
 679         "4", 283
 680     },
 681     /* Curve B-283 (FIPS PUB 186-2, App. 6) */
 682     {
 683         "NIST curve B-283",
 684                                                                 "08000000"
 685         "00000000000000000000000000000000000000000000000000000000000010A1",
 686                                                                 "00000000"
 687         "0000000000000000000000000000000000000000000000000000000000000001",
 688                                                                 "027B680A"
 689         "C8B8596DA5A4AF8A19A0303FCA97FD7645309FA2A581485AF6263E313B79A2F5",
 690                                                                 "05F93925"
 691         "8DB7DD90E1934F8C70B0DFEC2EED25B8557EAC9C80E2E198F8CDBECD86B12053",
 692                                                                 "03676854"
 693         "FE24141CB98FE6D4B20D02B4516FF702350EDDB0826779C813F0DF45BE8112F4",
 694         1,
 695                                                                 "03FFFFFF"
 696         "FFFFFFFFFFFFFFFFFFFFFFFFFFFFEF90399660FC938A90165B042A7CEFADB307",
 697         "2", 283
 698     },
 699     /* Curve K-409 (FIPS PUB 186-2, App. 6) */
 700     {
 701         "NIST curve K-409",
 702                                 "0200000000000000000000000000000000000000"
 703         "0000000000000000000000000000000000000000008000000000000000000001",
 704         "0",
 705         "1",
 706                                 "0060F05F658F49C1AD3AB1890F7184210EFD0987"
 707         "E307C84C27ACCFB8F9F67CC2C460189EB5AAAA62EE222EB1B35540CFE9023746",
 708                                 "01E369050B7C4E42ACBA1DACBF04299C3460782F"
 709         "918EA427E6325165E9EA10E3DA5F6C42E9C55215AA9CA27A5863EC48D8E0286B",
 710         1,
 711                                 "007FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 712         "FFFFFFFFFFFFFE5F83B2D4EA20400EC4557D5ED3E3E7CA5B4B5C83B8E01E5FCF",
 713         "4", 409
 714     },
 715     /* Curve B-409 (FIPS PUB 186-2, App. 6) */
 716     {
 717         "NIST curve B-409",
 718                                 "0200000000000000000000000000000000000000"
 719         "0000000000000000000000000000000000000000008000000000000000000001",
 720                                 "0000000000000000000000000000000000000000"
 721         "0000000000000000000000000000000000000000000000000000000000000001",
 722                                 "0021A5C2C8EE9FEB5C4B9A753B7B476B7FD6422E"
 723         "F1F3DD674761FA99D6AC27C8A9A197B272822F6CD57A55AA4F50AE317B13545F",
 724                                 "015D4860D088DDB3496B0C6064756260441CDE4A"
 725         "F1771D4DB01FFE5B34E59703DC255A868A1180515603AEAB60794E54BB7996A7",
 726                                 "0061B1CFAB6BE5F32BBFA78324ED106A7636B9C5"
 727         "A7BD198D0158AA4F5488D08F38514F1FDF4B4F40D2181B3681C364BA0273C706",
 728         1,
 729                                 "0100000000000000000000000000000000000000"
 730         "00000000000001E2AAD6A612F33307BE5FA47C3C9E052F838164CD37D9A21173",
 731         "2", 409
 732     },
 733     /* Curve K-571 (FIPS PUB 186-2, App. 6) */
 734     {
 735         "NIST curve K-571",
 736                                                          "800000000000000"
 737         "0000000000000000000000000000000000000000000000000000000000000000"
 738         "0000000000000000000000000000000000000000000000000000000000000425",
 739         "0",
 740         "1",
 741                                                         "026EB7A859923FBC"
 742         "82189631F8103FE4AC9CA2970012D5D46024804801841CA44370958493B205E6"
 743         "47DA304DB4CEB08CBBD1BA39494776FB988B47174DCA88C7E2945283A01C8972",
 744                                                         "0349DC807F4FBF37"
 745         "4F4AEADE3BCA95314DD58CEC9F307A54FFC61EFC006D8A2C9D4979C0AC44AEA7"
 746         "4FBEBBB9F772AEDCB620B01A7BA7AF1B320430C8591984F601CD4C143EF1C7A3",
 747         0,
 748                                                         "0200000000000000"
 749         "00000000000000000000000000000000000000000000000000000000131850E1"
 750         "F19A63E4B391A8DB917F4138B630D84BE5D639381E91DEB45CFE778F637C1001",
 751         "4", 571
 752     },
 753     /* Curve B-571 (FIPS PUB 186-2, App. 6) */
 754     {
 755         "NIST curve B-571",
 756                                                          "800000000000000"
 757         "0000000000000000000000000000000000000000000000000000000000000000"
 758         "0000000000000000000000000000000000000000000000000000000000000425",
 759                                                         "0000000000000000"
 760         "0000000000000000000000000000000000000000000000000000000000000000"
 761         "0000000000000000000000000000000000000000000000000000000000000001",
 762                                                         "02F40E7E2221F295"
 763         "DE297117B7F3D62F5C6A97FFCB8CEFF1CD6BA8CE4A9A18AD84FFABBD8EFA5933"
 764         "2BE7AD6756A66E294AFD185A78FF12AA520E4DE739BACA0C7FFEFF7F2955727A",
 765                                                         "0303001D34B85629"
 766         "6C16C0D40D3CD7750A93D1D2955FA80AA5F40FC8DB7B2ABDBDE53950F4C0D293"
 767         "CDD711A35B67FB1499AE60038614F1394ABFA3B4C850D927E1E7769C8EEC2D19",
 768                                                         "037BF27342DA639B"
 769         "6DCCFFFEB73D69D78C6C27A6009CBBCA1980F8533921E8A684423E43BAB08A57"
 770         "6291AF8F461BB2A8B3531D2F0485C19B16E2F1516E23DD3C1A4827AF1B8AC15B",
 771         1,
 772                                                         "03FFFFFFFFFFFFFF"
 773         "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE661CE18"
 774         "FF55987308059B186823851EC7DD9CA1161DE93D5174D66E8382E9BB2FE84E47",
 775         "2", 571
 776     }
 777 };
 778
 779 static int char2_curve_test(int n)
 780 {
 781     int r = 0;
 782     BN_CTX *ctx = NULL;
 783     BIGNUM *p = NULL, *a = NULL, *b = NULL;
 784     BIGNUM *x = NULL, *y = NULL, *z = NULL, *cof = NULL, *yplusone = NULL;
 785     EC_GROUP *group = NULL;
 786     EC_POINT *P = NULL, *Q = NULL, *R = NULL;
 787 # ifndef OPENSSL_NO_DEPRECATED_3_0
 788     const EC_POINT *points[3];
 789     const BIGNUM *scalars[3];
 790 # endif
 791     struct c2_curve_test *const test = char2_curve_tests + n;
 792
 793     if (!TEST_ptr(ctx = BN_CTX_new())
 794         || !TEST_ptr(p = BN_new())
 795         || !TEST_ptr(a = BN_new())
 796         || !TEST_ptr(b = BN_new())
 797         || !TEST_ptr(x = BN_new())
 798         || !TEST_ptr(y = BN_new())
 799         || !TEST_ptr(z = BN_new())
 800         || !TEST_ptr(yplusone = BN_new())
 801         || !TEST_true(BN_hex2bn(&p, test->p))
 802         || !TEST_true(BN_hex2bn(&a, test->a))
 803         || !TEST_true(BN_hex2bn(&b, test->b))
 804         || !TEST_true(group = EC_GROUP_new_curve_GF2m(p, a, b, ctx))
 805         || !TEST_ptr(P = EC_POINT_new(group))
 806         || !TEST_ptr(Q = EC_POINT_new(group))
 807         || !TEST_ptr(R = EC_POINT_new(group))
 808         || !TEST_true(BN_hex2bn(&x, test->x))
 809         || !TEST_true(BN_hex2bn(&y, test->y))
 810         || !TEST_true(BN_add(yplusone, y, BN_value_one())))
 811         goto err;
 812
 813 /* Change test based on whether binary point compression is enabled or not. */
 814 # ifdef OPENSSL_EC_BIN_PT_COMP
 815     /*
 816      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 817      * and therefore setting the coordinates should fail.
 818      */
 819     if (!TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone, ctx))
 820         || !TEST_true(EC_POINT_set_compressed_coordinates(group, P, x,
 821                                                           test->y_bit,
 822                                                           ctx))
 823         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 824         || !TEST_true(BN_hex2bn(&z, test->order))
 825         || !TEST_true(BN_hex2bn(&cof, test->cof))
 826         || !TEST_true(EC_GROUP_set_generator(group, P, z, cof))
 827         || !TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y, ctx)))
 828         goto err;
 829     TEST_info("%s -- Generator", test->name);
 830     test_output_bignum("x", x);
 831     test_output_bignum("y", y);
 832     /* G_y value taken from the standard: */
 833     if (!TEST_true(BN_hex2bn(&z, test->y))
 834         || !TEST_BN_eq(y, z))
 835         goto err;
 836 # else
 837     /*
 838      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 839      * and therefore setting the coordinates should fail.
 840      */
 841     if (!TEST_false(EC_POINT_set_affine_coordinates(group, P, x, yplusone, ctx))
 842         || !TEST_true(EC_POINT_set_affine_coordinates(group, P, x, y, ctx))
 843         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 844         || !TEST_true(BN_hex2bn(&z, test->order))
 845         || !TEST_true(BN_hex2bn(&cof, test->cof))
 846         || !TEST_true(EC_GROUP_set_generator(group, P, z, cof)))
 847         goto err;
 848     TEST_info("%s -- Generator:", test->name);
 849     test_output_bignum("x", x);
 850     test_output_bignum("y", y);
 851 # endif
 852
 853     if (!TEST_int_eq(EC_GROUP_get_degree(group), test->degree)
 854         || !group_order_tests(group))
 855         goto err;
 856
 857     /* more tests using the last curve */
 858     if (n == OSSL_NELEM(char2_curve_tests) - 1) {
 859         if (!TEST_true(EC_POINT_set_affine_coordinates(group, P, x, y, ctx))
 860             || !TEST_true(EC_POINT_copy(Q, P))
 861             || !TEST_false(EC_POINT_is_at_infinity(group, Q))
 862             || !TEST_true(EC_POINT_dbl(group, P, P, ctx))
 863             || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 864             || !TEST_true(EC_POINT_invert(group, Q, ctx))       /* P = -2Q */
 865             || !TEST_true(EC_POINT_add(group, R, P, Q, ctx))
 866             || !TEST_true(EC_POINT_add(group, R, R, Q, ctx))
 867             || !TEST_true(EC_POINT_is_at_infinity(group, R))   /* R = P + 2Q */
 868             || !TEST_false(EC_POINT_is_at_infinity(group, Q)))
 869             goto err;
 870
 871 # ifndef OPENSSL_NO_DEPRECATED_3_0
 872         TEST_note("combined multiplication ...");
 873         points[0] = Q;
 874         points[1] = Q;
 875         points[2] = Q;
 876
 877         if (!TEST_true(BN_add(y, z, BN_value_one()))
 878             || !TEST_BN_even(y)
 879             || !TEST_true(BN_rshift1(y, y)))
 880             goto err;
 881         scalars[0] = y;         /* (group order + 1)/2, so y*Q + y*Q = Q */
 882         scalars[1] = y;
 883
 884         /* z is still the group order */
 885         if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
 886             || !TEST_true(EC_POINTs_mul(group, R, z, 2, points, scalars, ctx))
 887             || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx))
 888             || !TEST_int_eq(0, EC_POINT_cmp(group, R, Q, ctx)))
 889             goto err;
 890
 891         if (!TEST_true(BN_rand(y, BN_num_bits(y), 0, 0))
 892             || !TEST_true(BN_add(z, z, y)))
 893             goto err;
 894         BN_set_negative(z, 1);
 895         scalars[0] = y;
 896         scalars[1] = z;         /* z = -(order + y) */
 897
 898         if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
 899             || !TEST_true(EC_POINT_is_at_infinity(group, P)))
 900             goto err;
 901
 902         if (!TEST_true(BN_rand(x, BN_num_bits(y) - 1, 0, 0))
 903             || !TEST_true(BN_add(z, x, y)))
 904             goto err;
 905         BN_set_negative(z, 1);
 906         scalars[0] = x;
 907         scalars[1] = y;
 908         scalars[2] = z;         /* z = -(x+y) */
 909
 910         if (!TEST_true(EC_POINTs_mul(group, P, NULL, 3, points, scalars, ctx))
 911             || !TEST_true(EC_POINT_is_at_infinity(group, P)))
 912             goto err;
 913 # endif
 914     }
 915
 916     r = 1;
 917 err:
 918     BN_CTX_free(ctx);
 919     BN_free(p);
 920     BN_free(a);
 921     BN_free(b);
 922     BN_free(x);
 923     BN_free(y);
 924     BN_free(z);
 925     BN_free(yplusone);
 926     BN_free(cof);
 927     EC_POINT_free(P);
 928     EC_POINT_free(Q);
 929     EC_POINT_free(R);
 930     EC_GROUP_free(group);
 931     return r;
 932 }
 933
 934 static int char2_field_tests(void)
 935 {
 936     BN_CTX *ctx = NULL;
 937     BIGNUM *p = NULL, *a = NULL, *b = NULL;
 938     EC_GROUP *group = NULL;
 939     EC_POINT *P = NULL, *Q = NULL, *R = NULL;
 940     BIGNUM *x = NULL, *y = NULL, *z = NULL, *cof = NULL, *yplusone = NULL;
 941     unsigned char buf[100];
 942     size_t len;
 943     int k, r = 0;
 944
 945     if (!TEST_ptr(ctx = BN_CTX_new())
 946         || !TEST_ptr(p = BN_new())
 947         || !TEST_ptr(a = BN_new())
 948         || !TEST_ptr(b = BN_new())
 949         || !TEST_true(BN_hex2bn(&p, "13"))
 950         || !TEST_true(BN_hex2bn(&a, "3"))
 951         || !TEST_true(BN_hex2bn(&b, "1")))
 952         goto err;
 953
 954     if (!TEST_ptr(group = EC_GROUP_new_curve_GF2m(p, a, b, ctx))
 955         || !TEST_true(EC_GROUP_get_curve(group, p, a, b, ctx)))
 956         goto err;
 957
 958     TEST_info("Curve defined by Weierstrass equation");
 959     TEST_note("     y^2 + x*y = x^3 + a*x^2 + b (mod p)");
 960     test_output_bignum("a", a);
 961     test_output_bignum("b", b);
 962     test_output_bignum("p", p);
 963
 964      if (!TEST_ptr(P = EC_POINT_new(group))
 965         || !TEST_ptr(Q = EC_POINT_new(group))
 966         || !TEST_ptr(R = EC_POINT_new(group))
 967         || !TEST_true(EC_POINT_set_to_infinity(group, P))
 968         || !TEST_true(EC_POINT_is_at_infinity(group, P)))
 969         goto err;
 970
 971     buf[0] = 0;
 972     if (!TEST_true(EC_POINT_oct2point(group, Q, buf, 1, ctx))
 973         || !TEST_true(EC_POINT_add(group, P, P, Q, ctx))
 974         || !TEST_true(EC_POINT_is_at_infinity(group, P))
 975         || !TEST_ptr(x = BN_new())
 976         || !TEST_ptr(y = BN_new())
 977         || !TEST_ptr(z = BN_new())
 978         || !TEST_ptr(cof = BN_new())
 979         || !TEST_ptr(yplusone = BN_new())
 980         || !TEST_true(BN_hex2bn(&x, "6"))
 981 /* Change test based on whether binary point compression is enabled or not. */
 982 # ifdef OPENSSL_EC_BIN_PT_COMP
 983         || !TEST_true(EC_POINT_set_compressed_coordinates(group, Q, x, 1, ctx))
 984 # else
 985         || !TEST_true(BN_hex2bn(&y, "8"))
 986         || !TEST_true(EC_POINT_set_affine_coordinates(group, Q, x, y, ctx))
 987 # endif
 988        )
 989         goto err;
 990     if (!TEST_int_gt(EC_POINT_is_on_curve(group, Q, ctx), 0)) {
 991 /* Change test based on whether binary point compression is enabled or not. */
 992 # ifdef OPENSSL_EC_BIN_PT_COMP
 993         if (!TEST_true(EC_POINT_get_affine_coordinates(group, Q, x, y, ctx)))
 994             goto err;
 995 # endif
 996         TEST_info("Point is not on curve");
 997         test_output_bignum("x", x);
 998         test_output_bignum("y", y);
 999         goto err;
1000     }
1001
1002     TEST_note("A cyclic subgroup:");
1003     k = 100;
1004     do {
1005         if (!TEST_int_ne(k--, 0))
1006             goto err;
1007
1008         if (EC_POINT_is_at_infinity(group, P))
1009             TEST_note("     point at infinity");
1010         else {
1011             if (!TEST_true(EC_POINT_get_affine_coordinates(group, P, x, y,
1012                                                            ctx)))
1013                 goto err;
1014
1015             test_output_bignum("x", x);
1016             test_output_bignum("y", y);
1017         }
1018
1019         if (!TEST_true(EC_POINT_copy(R, P))
1020             || !TEST_true(EC_POINT_add(group, P, P, Q, ctx)))
1021             goto err;
1022     }
1023     while (!EC_POINT_is_at_infinity(group, P));
1024
1025     if (!TEST_true(EC_POINT_add(group, P, Q, R, ctx))
1026         || !TEST_true(EC_POINT_is_at_infinity(group, P)))
1027         goto err;
1028
1029 /* Change test based on whether binary point compression is enabled or not. */
1030 # ifdef OPENSSL_EC_BIN_PT_COMP
1031     len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_COMPRESSED,
1032                              buf, sizeof(buf), ctx);
1033     if (!TEST_size_t_ne(len, 0)
1034         || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
1035         || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
1036         goto err;
1037     test_output_memory("Generator as octet string, compressed form:",
1038                        buf, len);
1039 # endif
1040
1041     len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_UNCOMPRESSED,
1042                              buf, sizeof(buf), ctx);
1043     if (!TEST_size_t_ne(len, 0)
1044         || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
1045         || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
1046         goto err;
1047     test_output_memory("Generator as octet string, uncompressed form:",
1048                        buf, len);
1049
1050 /* Change test based on whether binary point compression is enabled or not. */
1051 # ifdef OPENSSL_EC_BIN_PT_COMP
1052     len =
1053         EC_POINT_point2oct(group, Q, POINT_CONVERSION_HYBRID, buf, sizeof(buf),
1054                            ctx);
1055     if (!TEST_size_t_ne(len, 0)
1056         || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
1057         || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
1058         goto err;
1059     test_output_memory("Generator as octet string, hybrid form:",
1060                        buf, len);
1061 # endif
1062
1063     if (!TEST_true(EC_POINT_invert(group, P, ctx))
1064         || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx)))
1065         goto err;
1066
1067     TEST_note("\n");
1068
1069     r = 1;
1070 err:
1071     BN_CTX_free(ctx);
1072     BN_free(p);
1073     BN_free(a);
1074     BN_free(b);
1075     EC_GROUP_free(group);
1076     EC_POINT_free(P);
1077     EC_POINT_free(Q);
1078     EC_POINT_free(R);
1079     BN_free(x);
1080     BN_free(y);
1081     BN_free(z);
1082     BN_free(cof);
1083     BN_free(yplusone);
1084     return r;
1085 }
1086
1087 static int hybrid_point_encoding_test(void)
1088 {
1089     BIGNUM *x = NULL, *y = NULL;
1090     EC_GROUP *group = NULL;
1091     EC_POINT *point = NULL;
1092     unsigned char *buf = NULL;
1093     size_t len;
1094     int r = 0;
1095
1096     if (!TEST_true(BN_dec2bn(&x, "0"))
1097         || !TEST_true(BN_dec2bn(&y, "1"))
1098         || !TEST_ptr(group = EC_GROUP_new_by_curve_name(NID_sect571k1))
1099         || !TEST_ptr(point = EC_POINT_new(group))
1100         || !TEST_true(EC_POINT_set_affine_coordinates(group, point, x, y, NULL))
1101         || !TEST_size_t_ne(0, (len = EC_POINT_point2oct(group,
1102                                                         point,
1103                                                         POINT_CONVERSION_HYBRID,
1104                                                         NULL,
1105                                                         0,
1106                                                         NULL)))
1107         || !TEST_ptr(buf = OPENSSL_malloc(len))
1108         || !TEST_size_t_eq(len, EC_POINT_point2oct(group,
1109                                                    point,
1110                                                    POINT_CONVERSION_HYBRID,
1111                                                    buf,
1112                                                    len,
1113                                                    NULL)))
1114         goto err;
1115
1116     r = 1;
1117
1118     /* buf contains a valid hybrid point, check that we can decode it. */
1119     if (!TEST_true(EC_POINT_oct2point(group, point, buf, len, NULL)))
1120         r = 0;
1121
1122     /* Flip the y_bit and verify that the invalid encoding is rejected. */
1123     buf[0] ^= 1;
1124     if (!TEST_false(EC_POINT_oct2point(group, point, buf, len, NULL)))
1125         r = 0;
1126
1127 err:
1128     BN_free(x);
1129     BN_free(y);
1130     EC_GROUP_free(group);
1131     EC_POINT_free(point);
1132     OPENSSL_free(buf);
1133     return r;
1134 }
1135 #endif
1136
1137 static int internal_curve_test(int n)
1138 {
1139     EC_GROUP *group = NULL;
1140     int nid = curves[n].nid;
1141
1142     if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))) {
1143         TEST_info("EC_GROUP_new_curve_name() failed with curve %s\n",
1144                   OBJ_nid2sn(nid));
1145         return 0;
1146     }
1147     if (!TEST_true(EC_GROUP_check(group, NULL))) {
1148         TEST_info("EC_GROUP_check() failed with curve %s\n", OBJ_nid2sn(nid));
1149         EC_GROUP_free(group);
1150         return 0;
1151     }
1152     EC_GROUP_free(group);
1153     return 1;
1154 }
1155
1156 static int internal_curve_test_method(int n)
1157 {
1158     int r, nid = curves[n].nid;
1159     EC_GROUP *group;
1160
1161     if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))) {
1162         TEST_info("Curve %s failed\n", OBJ_nid2sn(nid));
1163         return 0;
1164     }
1165     r = group_order_tests(group);
1166     EC_GROUP_free(group);
1167     return r;
1168 }
1169
1170 static int group_field_test(void)
1171 {
1172     int r = 1;
1173     BIGNUM *secp521r1_field = NULL;
1174     BIGNUM *sect163r2_field = NULL;
1175     EC_GROUP *secp521r1_group = NULL;
1176     EC_GROUP *sect163r2_group = NULL;
1177
1178     BN_hex2bn(&secp521r1_field,
1179                 "01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
1180                 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
1181                 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
1182                 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
1183                 "FFFF");
1184
1185
1186     BN_hex2bn(&sect163r2_field,
1187                 "08000000000000000000000000000000"
1188                 "00000000C9");
1189
1190     secp521r1_group = EC_GROUP_new_by_curve_name(NID_secp521r1);
1191     if (BN_cmp(secp521r1_field, EC_GROUP_get0_field(secp521r1_group)))
1192       r = 0;
1193
1194     # ifndef OPENSSL_NO_EC2M
1195     sect163r2_group = EC_GROUP_new_by_curve_name(NID_sect163r2);
1196     if (BN_cmp(sect163r2_field, EC_GROUP_get0_field(sect163r2_group)))
1197       r = 0;
1198     # endif
1199
1200     EC_GROUP_free(secp521r1_group);
1201     EC_GROUP_free(sect163r2_group);
1202     BN_free(secp521r1_field);
1203     BN_free(sect163r2_field);
1204     return r;
1205 }
1206
1207 /*
1208  * nistp_test_params contains magic numbers for testing
1209  * several NIST curves with characteristic > 3.
1210  */
1211 struct nistp_test_params {
1212     const int nid;
1213     int degree;
1214     /*
1215      * Qx, Qy and D are taken from
1216      * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/ECDSA_Prime.pdf
1217      * Otherwise, values are standard curve parameters from FIPS 180-3
1218      */
1219     const char *p, *a, *b, *Qx, *Qy, *Gx, *Gy, *order, *d;
1220 };
1221
1222 static const struct nistp_test_params nistp_tests_params[] = {
1223     {
1224      /* P-224 */
1225      NID_secp224r1,
1226      224,
1227      /* p */
1228      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001",
1229      /* a */
1230      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE",
1231      /* b */
1232      "B4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4",
1233      /* Qx */
1234      "E84FB0B8E7000CB657D7973CF6B42ED78B301674276DF744AF130B3E",
1235      /* Qy */
1236      "4376675C6FC5612C21A0FF2D2A89D2987DF7A2BC52183B5982298555",
1237      /* Gx */
1238      "B70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21",
1239      /* Gy */
1240      "BD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34",
1241      /* order */
1242      "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D",
1243      /* d */
1244      "3F0C488E987C80BE0FEE521F8D90BE6034EC69AE11CA72AA777481E8",
1245      },
1246     {
1247      /* P-256 */
1248      NID_X9_62_prime256v1,
1249      256,
1250      /* p */
1251      "ffffffff00000001000000000000000000000000ffffffffffffffffffffffff",
1252      /* a */
1253      "ffffffff00000001000000000000000000000000fffffffffffffffffffffffc",
1254      /* b */
1255      "5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
1256      /* Qx */
1257      "b7e08afdfe94bad3f1dc8c734798ba1c62b3a0ad1e9ea2a38201cd0889bc7a19",
1258      /* Qy */
1259      "3603f747959dbf7a4bb226e41928729063adc7ae43529e61b563bbc606cc5e09",
1260      /* Gx */
1261      "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
1262      /* Gy */
1263      "4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5",
1264      /* order */
1265      "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551",
1266      /* d */
1267      "c477f9f65c22cce20657faa5b2d1d8122336f851a508a1ed04e479c34985bf96",
1268      },
1269     {
1270      /* P-521 */
1271      NID_secp521r1,
1272      521,
1273      /* p */
1274                                                                   "1ff"
1275      "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
1276      "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
1277      /* a */
1278                                                                   "1ff"
1279      "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
1280      "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc",
1281      /* b */
1282                                                                   "051"
1283      "953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e1"
1284      "56193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00",
1285      /* Qx */
1286                                                                  "0098"
1287      "e91eef9a68452822309c52fab453f5f117c1da8ed796b255e9ab8f6410cca16e"
1288      "59df403a6bdc6ca467a37056b1e54b3005d8ac030decfeb68df18b171885d5c4",
1289      /* Qy */
1290                                                                  "0164"
1291      "350c321aecfc1cca1ba4364c9b15656150b4b78d6a48d7d28e7f31985ef17be8"
1292      "554376b72900712c4b83ad668327231526e313f5f092999a4632fd50d946bc2e",
1293      /* Gx */
1294                                                                    "c6"
1295      "858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dba"
1296      "a14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66",
1297      /* Gy */
1298                                                                   "118"
1299      "39296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c"
1300      "97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650",
1301      /* order */
1302                                                                   "1ff"
1303      "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa"
1304      "51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409",
1305      /* d */
1306                                                                  "0100"
1307      "085f47b8e1b8b11b7eb33028c0b2888e304bfc98501955b45bba1478dc184eee"
1308      "df09b86a5f7c21994406072787205e69a63709fe35aa93ba333514b24f961722",
1309      },
1310 };
1311
1312 static int nistp_single_test(int idx)
1313 {
1314     const struct nistp_test_params *test = nistp_tests_params + idx;
1315     BN_CTX *ctx = NULL;
1316     BIGNUM *p = NULL, *a = NULL, *b = NULL, *x = NULL, *y = NULL;
1317     BIGNUM *n = NULL, *m = NULL, *order = NULL, *yplusone = NULL;
1318     EC_GROUP *NISTP = NULL;
1319     EC_POINT *G = NULL, *P = NULL, *Q = NULL, *Q_CHECK = NULL;
1320     int r = 0;
1321
1322     TEST_note("NIST curve P-%d (optimised implementation):",
1323               test->degree);
1324     if (!TEST_ptr(ctx = BN_CTX_new())
1325         || !TEST_ptr(p = BN_new())
1326         || !TEST_ptr(a = BN_new())
1327         || !TEST_ptr(b = BN_new())
1328         || !TEST_ptr(x = BN_new())
1329         || !TEST_ptr(y = BN_new())
1330         || !TEST_ptr(m = BN_new())
1331         || !TEST_ptr(n = BN_new())
1332         || !TEST_ptr(order = BN_new())
1333         || !TEST_ptr(yplusone = BN_new())
1334
1335         || !TEST_ptr(NISTP = EC_GROUP_new_by_curve_name(test->nid))
1336         || !TEST_true(BN_hex2bn(&p, test->p))
1337         || !TEST_int_eq(1, BN_check_prime(p, ctx, NULL))
1338         || !TEST_true(BN_hex2bn(&a, test->a))
1339         || !TEST_true(BN_hex2bn(&b, test->b))
1340         || !TEST_true(EC_GROUP_set_curve(NISTP, p, a, b, ctx))
1341         || !TEST_ptr(G = EC_POINT_new(NISTP))
1342         || !TEST_ptr(P = EC_POINT_new(NISTP))
1343         || !TEST_ptr(Q = EC_POINT_new(NISTP))
1344         || !TEST_ptr(Q_CHECK = EC_POINT_new(NISTP))
1345         || !TEST_true(BN_hex2bn(&x, test->Qx))
1346         || !TEST_true(BN_hex2bn(&y, test->Qy))
1347         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
1348     /*
1349      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
1350      * and therefore setting the coordinates should fail.
1351      */
1352         || !TEST_false(EC_POINT_set_affine_coordinates(NISTP, Q_CHECK, x,
1353                                                        yplusone, ctx))
1354         || !TEST_true(EC_POINT_set_affine_coordinates(NISTP, Q_CHECK, x, y,
1355                                                       ctx))
1356         || !TEST_true(BN_hex2bn(&x, test->Gx))
1357         || !TEST_true(BN_hex2bn(&y, test->Gy))
1358         || !TEST_true(EC_POINT_set_affine_coordinates(NISTP, G, x, y, ctx))
1359         || !TEST_true(BN_hex2bn(&order, test->order))
1360         || !TEST_true(EC_GROUP_set_generator(NISTP, G, order, BN_value_one()))
1361         || !TEST_int_eq(EC_GROUP_get_degree(NISTP), test->degree))
1362         goto err;
1363
1364     TEST_note("NIST test vectors ... ");
1365     if (!TEST_true(BN_hex2bn(&n, test->d)))
1366         goto err;
1367     /* fixed point multiplication */
1368     EC_POINT_mul(NISTP, Q, n, NULL, NULL, ctx);
1369     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
1370         goto err;
1371     /* random point multiplication */
1372     EC_POINT_mul(NISTP, Q, NULL, G, n, ctx);
1373     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
1374
1375         /* set generator to P = 2*G, where G is the standard generator */
1376         || !TEST_true(EC_POINT_dbl(NISTP, P, G, ctx))
1377         || !TEST_true(EC_GROUP_set_generator(NISTP, P, order, BN_value_one()))
1378         /* set the scalar to m=n/2, where n is the NIST test scalar */
1379         || !TEST_true(BN_rshift(m, n, 1)))
1380         goto err;
1381
1382     /* test the non-standard generator */
1383     /* fixed point multiplication */
1384     EC_POINT_mul(NISTP, Q, m, NULL, NULL, ctx);
1385     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
1386         goto err;
1387     /* random point multiplication */
1388     EC_POINT_mul(NISTP, Q, NULL, P, m, ctx);
1389     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
1390 #ifndef OPENSSL_NO_DEPRECATED_3_0
1391         /* We have not performed precomp so this should be false */
1392         || !TEST_false(EC_GROUP_have_precompute_mult(NISTP))
1393         /* now repeat all tests with precomputation */
1394         || !TEST_true(EC_GROUP_precompute_mult(NISTP, ctx))
1395 #endif
1396         )
1397         goto err;
1398
1399     /* fixed point multiplication */
1400     EC_POINT_mul(NISTP, Q, m, NULL, NULL, ctx);
1401     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
1402         goto err;
1403     /* random point multiplication */
1404     EC_POINT_mul(NISTP, Q, NULL, P, m, ctx);
1405     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
1406
1407     /* reset generator */
1408         || !TEST_true(EC_GROUP_set_generator(NISTP, G, order, BN_value_one())))
1409         goto err;
1410     /* fixed point multiplication */
1411     EC_POINT_mul(NISTP, Q, n, NULL, NULL, ctx);
1412     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
1413         goto err;
1414     /* random point multiplication */
1415     EC_POINT_mul(NISTP, Q, NULL, G, n, ctx);
1416     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
1417         goto err;
1418
1419     /* regression test for felem_neg bug */
1420     if (!TEST_true(BN_set_word(m, 32))
1421         || !TEST_true(BN_set_word(n, 31))
1422         || !TEST_true(EC_POINT_copy(P, G))
1423         || !TEST_true(EC_POINT_invert(NISTP, P, ctx))
1424         || !TEST_true(EC_POINT_mul(NISTP, Q, m, P, n, ctx))
1425         || !TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, G, ctx)))
1426       goto err;
1427
1428     r = 1;
1429 err:
1430     EC_GROUP_free(NISTP);
1431     EC_POINT_free(G);
1432     EC_POINT_free(P);
1433     EC_POINT_free(Q);
1434     EC_POINT_free(Q_CHECK);
1435     BN_free(n);
1436     BN_free(m);
1437     BN_free(p);
1438     BN_free(a);
1439     BN_free(b);
1440     BN_free(x);
1441     BN_free(y);
1442     BN_free(order);
1443     BN_free(yplusone);
1444     BN_CTX_free(ctx);
1445     return r;
1446 }
1447
1448 static const unsigned char p521_named[] = {
1449     0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x23,
1450 };
1451
1452 static const unsigned char p521_explicit[] = {
1453     0x30, 0x82, 0x01, 0xc3, 0x02, 0x01, 0x01, 0x30, 0x4d, 0x06, 0x07, 0x2a,
1454     0x86, 0x48, 0xce, 0x3d, 0x01, 0x01, 0x02, 0x42, 0x01, 0xff, 0xff, 0xff,
1455     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1456     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1457     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1458     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1459     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1460     0xff, 0xff, 0x30, 0x81, 0x9f, 0x04, 0x42, 0x01, 0xff, 0xff, 0xff, 0xff,
1461     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1462     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1463     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1464     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1465     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1466     0xfc, 0x04, 0x42, 0x00, 0x51, 0x95, 0x3e, 0xb9, 0x61, 0x8e, 0x1c, 0x9a,
1467     0x1f, 0x92, 0x9a, 0x21, 0xa0, 0xb6, 0x85, 0x40, 0xee, 0xa2, 0xda, 0x72,
1468     0x5b, 0x99, 0xb3, 0x15, 0xf3, 0xb8, 0xb4, 0x89, 0x91, 0x8e, 0xf1, 0x09,
1469     0xe1, 0x56, 0x19, 0x39, 0x51, 0xec, 0x7e, 0x93, 0x7b, 0x16, 0x52, 0xc0,
1470     0xbd, 0x3b, 0xb1, 0xbf, 0x07, 0x35, 0x73, 0xdf, 0x88, 0x3d, 0x2c, 0x34,
1471     0xf1, 0xef, 0x45, 0x1f, 0xd4, 0x6b, 0x50, 0x3f, 0x00, 0x03, 0x15, 0x00,
1472     0xd0, 0x9e, 0x88, 0x00, 0x29, 0x1c, 0xb8, 0x53, 0x96, 0xcc, 0x67, 0x17,
1473     0x39, 0x32, 0x84, 0xaa, 0xa0, 0xda, 0x64, 0xba, 0x04, 0x81, 0x85, 0x04,
1474     0x00, 0xc6, 0x85, 0x8e, 0x06, 0xb7, 0x04, 0x04, 0xe9, 0xcd, 0x9e, 0x3e,
1475     0xcb, 0x66, 0x23, 0x95, 0xb4, 0x42, 0x9c, 0x64, 0x81, 0x39, 0x05, 0x3f,
1476     0xb5, 0x21, 0xf8, 0x28, 0xaf, 0x60, 0x6b, 0x4d, 0x3d, 0xba, 0xa1, 0x4b,
1477     0x5e, 0x77, 0xef, 0xe7, 0x59, 0x28, 0xfe, 0x1d, 0xc1, 0x27, 0xa2, 0xff,
1478     0xa8, 0xde, 0x33, 0x48, 0xb3, 0xc1, 0x85, 0x6a, 0x42, 0x9b, 0xf9, 0x7e,
1479     0x7e, 0x31, 0xc2, 0xe5, 0xbd, 0x66, 0x01, 0x18, 0x39, 0x29, 0x6a, 0x78,
1480     0x9a, 0x3b, 0xc0, 0x04, 0x5c, 0x8a, 0x5f, 0xb4, 0x2c, 0x7d, 0x1b, 0xd9,
1481     0x98, 0xf5, 0x44, 0x49, 0x57, 0x9b, 0x44, 0x68, 0x17, 0xaf, 0xbd, 0x17,
1482     0x27, 0x3e, 0x66, 0x2c, 0x97, 0xee, 0x72, 0x99, 0x5e, 0xf4, 0x26, 0x40,
1483     0xc5, 0x50, 0xb9, 0x01, 0x3f, 0xad, 0x07, 0x61, 0x35, 0x3c, 0x70, 0x86,
1484     0xa2, 0x72, 0xc2, 0x40, 0x88, 0xbe, 0x94, 0x76, 0x9f, 0xd1, 0x66, 0x50,
1485     0x02, 0x42, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1486     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1487     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfa,
1488     0x51, 0x86, 0x87, 0x83, 0xbf, 0x2f, 0x96, 0x6b, 0x7f, 0xcc, 0x01, 0x48,
1489     0xf7, 0x09, 0xa5, 0xd0, 0x3b, 0xb5, 0xc9, 0xb8, 0x89, 0x9c, 0x47, 0xae,
1490     0xbb, 0x6f, 0xb7, 0x1e, 0x91, 0x38, 0x64, 0x09, 0x02, 0x01, 0x01,
1491 };
1492
1493 /*
1494  * This test validates a named curve's group parameters using
1495  * EC_GROUP_check_named_curve(). It also checks that modifying any of the
1496  * group parameters results in the curve not being valid.
1497  */
1498 static int check_named_curve_test(int id)
1499 {
1500     int ret = 0, nid, field_nid, has_seed;
1501     EC_GROUP *group = NULL, *gtest = NULL;
1502     const EC_POINT *group_gen = NULL;
1503     EC_POINT *other_gen = NULL;
1504     BIGNUM *group_p = NULL, *group_a = NULL, *group_b = NULL;
1505     BIGNUM *other_p = NULL, *other_a = NULL, *other_b = NULL;
1506     BIGNUM *group_cofactor = NULL, *other_cofactor = NULL;
1507     BIGNUM *other_order = NULL;
1508     const BIGNUM *group_order = NULL;
1509     BN_CTX *bn_ctx = NULL;
1510     static const unsigned char invalid_seed[] = "THIS IS NOT A VALID SEED";
1511     static size_t invalid_seed_len = sizeof(invalid_seed);
1512
1513     /* Do some setup */
1514     nid = curves[id].nid;
1515     if (!TEST_ptr(bn_ctx = BN_CTX_new())
1516         || !TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))
1517         || !TEST_ptr(gtest = EC_GROUP_dup(group))
1518         || !TEST_ptr(group_p = BN_new())
1519         || !TEST_ptr(group_a = BN_new())
1520         || !TEST_ptr(group_b = BN_new())
1521         || !TEST_ptr(group_cofactor = BN_new())
1522         || !TEST_ptr(group_gen = EC_GROUP_get0_generator(group))
1523         || !TEST_ptr(group_order = EC_GROUP_get0_order(group))
1524         || !TEST_true(EC_GROUP_get_cofactor(group, group_cofactor, NULL))
1525         || !TEST_true(EC_GROUP_get_curve(group, group_p, group_a, group_b, NULL))
1526         || !TEST_ptr(other_gen = EC_POINT_dup(group_gen, group))
1527         || !TEST_true(EC_POINT_add(group, other_gen, group_gen, group_gen, NULL))
1528         || !TEST_ptr(other_order = BN_dup(group_order))
1529         || !TEST_true(BN_add_word(other_order, 1))
1530         || !TEST_ptr(other_a = BN_dup(group_a))
1531         || !TEST_true(BN_add_word(other_a, 1))
1532         || !TEST_ptr(other_b = BN_dup(group_b))
1533         || !TEST_true(BN_add_word(other_b, 1))
1534         || !TEST_ptr(other_cofactor = BN_dup(group_cofactor))
1535         || !TEST_true(BN_add_word(other_cofactor, 1)))
1536         goto err;
1537
1538     /* Determine if the built-in curve has a seed field set */
1539     has_seed = (EC_GROUP_get_seed_len(group) > 0);
1540     field_nid = EC_GROUP_get_field_type(group);
1541     if (field_nid == NID_X9_62_characteristic_two_field) {
1542         if (!TEST_ptr(other_p = BN_dup(group_p))
1543             || !TEST_true(BN_lshift1(other_p, other_p)))
1544             goto err;
1545     } else {
1546         if (!TEST_ptr(other_p = BN_dup(group_p)))
1547             goto err;
1548         /*
1549          * Just choosing any arbitrary prime does not work..
1550          * Setting p via ec_GFp_nist_group_set_curve() needs the prime to be a
1551          * nist prime. So only select one of these as an alternate prime.
1552          */
1553         if (!TEST_ptr(BN_copy(other_p,
1554                               BN_ucmp(BN_get0_nist_prime_192(), other_p) == 0 ?
1555                                       BN_get0_nist_prime_256() :
1556                                       BN_get0_nist_prime_192())))
1557             goto err;
1558     }
1559
1560     /* Passes because this is a valid curve */
1561     if (!TEST_int_eq(EC_GROUP_check_named_curve(group, 0, NULL), nid)
1562         /* Only NIST curves pass */
1563         || !TEST_int_eq(EC_GROUP_check_named_curve(group, 1, NULL),
1564                         EC_curve_nid2nist(nid) != NULL ? nid : NID_undef))
1565         goto err;
1566
1567     /* Fail if the curve name doesn't match the parameters */
1568     EC_GROUP_set_curve_name(group, nid + 1);
1569     ERR_set_mark();
1570     if (!TEST_int_le(EC_GROUP_check_named_curve(group, 0, NULL), 0))
1571         goto err;
1572     ERR_pop_to_mark();
1573
1574     /* Restore curve name and ensure it's passing */
1575     EC_GROUP_set_curve_name(group, nid);
1576     if (!TEST_int_eq(EC_GROUP_check_named_curve(group, 0, NULL), nid))
1577         goto err;
1578
1579     if (!TEST_int_eq(EC_GROUP_set_seed(group, invalid_seed, invalid_seed_len),
1580                      invalid_seed_len))
1581         goto err;
1582
1583     if (has_seed) {
1584         /*
1585          * If the built-in curve has a seed and we set the seed to another value
1586          * then it will fail the check.
1587          */
1588         if (!TEST_int_eq(EC_GROUP_check_named_curve(group, 0, NULL), 0))
1589             goto err;
1590     } else {
1591         /*
1592          * If the built-in curve does not have a seed then setting the seed will
1593          * pass the check (as the seed is optional).
1594          */
1595         if (!TEST_int_eq(EC_GROUP_check_named_curve(group, 0, NULL), nid))
1596             goto err;
1597     }
1598     /* Pass if the seed is unknown (as it is optional) */
1599     if (!TEST_int_eq(EC_GROUP_set_seed(group, NULL, 0), 1)
1600         || !TEST_int_eq(EC_GROUP_check_named_curve(group, 0, NULL), nid))
1601         goto err;
1602
1603     /* Check that a duped group passes */
1604     if (!TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0, NULL), nid))
1605         goto err;
1606
1607     /* check that changing any generator parameter fails */
1608     if (!TEST_true(EC_GROUP_set_generator(gtest, other_gen, group_order,
1609                                           group_cofactor))
1610         || !TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0, NULL), 0)
1611         || !TEST_true(EC_GROUP_set_generator(gtest, group_gen, other_order,
1612                                              group_cofactor))
1613         || !TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0, NULL), 0)
1614         /* The order is not an optional field, so this should fail */
1615         || !TEST_false(EC_GROUP_set_generator(gtest, group_gen, NULL,
1616                                               group_cofactor))
1617         || !TEST_true(EC_GROUP_set_generator(gtest, group_gen, group_order,
1618                                              other_cofactor))
1619         || !TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0, NULL), 0)
1620         /* Check that if the cofactor is not set then it still passes */
1621         || !TEST_true(EC_GROUP_set_generator(gtest, group_gen, group_order,
1622                                              NULL))
1623         || !TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0, NULL), nid)
1624         /* check that restoring the generator passes */
1625         || !TEST_true(EC_GROUP_set_generator(gtest, group_gen, group_order,
1626                                              group_cofactor))
1627         || !TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0, NULL), nid))
1628         goto err;
1629
1630     /*
1631      * check that changing any curve parameter fails
1632      *
1633      * Setting arbitrary p, a or b might fail for some EC_GROUPs
1634      * depending on the internal EC_METHOD implementation, hence run
1635      * these tests conditionally to the success of EC_GROUP_set_curve().
1636      */
1637     ERR_set_mark();
1638     if (EC_GROUP_set_curve(gtest, other_p, group_a, group_b, NULL)) {
1639         if (!TEST_int_le(EC_GROUP_check_named_curve(gtest, 0, NULL), 0))
1640             goto err;
1641     } else {
1642         /* clear the error stack if EC_GROUP_set_curve() failed */
1643         ERR_pop_to_mark();
1644         ERR_set_mark();
1645     }
1646     if (EC_GROUP_set_curve(gtest, group_p, other_a, group_b, NULL)) {
1647         if (!TEST_int_le(EC_GROUP_check_named_curve(gtest, 0, NULL), 0))
1648             goto err;
1649     } else {
1650         /* clear the error stack if EC_GROUP_set_curve() failed */
1651         ERR_pop_to_mark();
1652         ERR_set_mark();
1653     }
1654     if (EC_GROUP_set_curve(gtest, group_p, group_a, other_b, NULL)) {
1655         if (!TEST_int_le(EC_GROUP_check_named_curve(gtest, 0, NULL), 0))
1656             goto err;
1657     } else {
1658         /* clear the error stack if EC_GROUP_set_curve() failed */
1659         ERR_pop_to_mark();
1660         ERR_set_mark();
1661     }
1662     ERR_pop_to_mark();
1663
1664     /* Check that restoring the curve parameters passes */
1665     if (!TEST_true(EC_GROUP_set_curve(gtest, group_p, group_a, group_b, NULL))
1666         || !TEST_int_eq(EC_GROUP_check_named_curve(gtest, 0, NULL), nid))
1667         goto err;
1668
1669     ret = 1;
1670 err:
1671     BN_free(group_p);
1672     BN_free(other_p);
1673     BN_free(group_a);
1674     BN_free(other_a);
1675     BN_free(group_b);
1676     BN_free(other_b);
1677     BN_free(group_cofactor);
1678     BN_free(other_cofactor);
1679     BN_free(other_order);
1680     EC_POINT_free(other_gen);
1681     EC_GROUP_free(gtest);
1682     EC_GROUP_free(group);
1683     BN_CTX_free(bn_ctx);
1684     return ret;
1685 }
1686
1687 /*
1688  * This checks the lookup capability of EC_GROUP_check_named_curve()
1689  * when the given group was created with explicit parameters.
1690  *
1691  * It is possible to retrieve an alternative alias that does not match
1692  * the original nid in this case.
1693  */
1694 static int check_named_curve_lookup_test(int id)
1695 {
1696     int ret = 0, nid, rv = 0;
1697     EC_GROUP *g = NULL , *ga = NULL;
1698     ECPARAMETERS *p = NULL, *pa = NULL;
1699     BN_CTX *ctx = NULL;
1700
1701     /* Do some setup */
1702     nid = curves[id].nid;
1703     if (!TEST_ptr(ctx = BN_CTX_new())
1704         || !TEST_ptr(g = EC_GROUP_new_by_curve_name(nid))
1705         || !TEST_ptr(p = EC_GROUP_get_ecparameters(g, NULL)))
1706         goto err;
1707
1708     /* replace with group from explicit parameters */
1709     EC_GROUP_free(g);
1710     if (!TEST_ptr(g = EC_GROUP_new_from_ecparameters(p)))
1711         goto err;
1712
1713     if (!TEST_int_gt(rv = EC_GROUP_check_named_curve(g, 0, NULL), 0))
1714         goto err;
1715     if (rv != nid) {
1716         /*
1717          * Found an alias:
1718          * fail if the returned nid is not an alias of the original group.
1719          *
1720          * The comparison here is done by comparing two explicit
1721          * parameter EC_GROUPs with EC_GROUP_cmp(), to ensure the
1722          * comparison happens with unnamed EC_GROUPs using the same
1723          * EC_METHODs.
1724          */
1725         if (!TEST_ptr(ga = EC_GROUP_new_by_curve_name(rv))
1726                 || !TEST_ptr(pa = EC_GROUP_get_ecparameters(ga, NULL)))
1727             goto err;
1728
1729         /* replace with group from explicit parameters, then compare */
1730         EC_GROUP_free(ga);
1731         if (!TEST_ptr(ga = EC_GROUP_new_from_ecparameters(pa))
1732                 || !TEST_int_eq(EC_GROUP_cmp(g, ga, ctx), 0))
1733             goto err;
1734     }
1735
1736     ret = 1;
1737
1738  err:
1739     EC_GROUP_free(g);
1740     EC_GROUP_free(ga);
1741     ECPARAMETERS_free(p);
1742     ECPARAMETERS_free(pa);
1743     BN_CTX_free(ctx);
1744
1745     return ret;
1746 }
1747
1748 /*
1749  * Sometime we cannot compare nids for equality, as the built-in curve table
1750  * includes aliases with different names for the same curve.
1751  *
1752  * This function returns TRUE (1) if the checked nids are identical, or if they
1753  * alias to the same curve. FALSE (0) otherwise.
1754  */
1755 static ossl_inline
1756 int are_ec_nids_compatible(int n1d, int n2d)
1757 {
1758     int ret = 0;
1759     switch (n1d) {
1760 #ifndef OPENSSL_NO_EC2M
1761         case NID_sect113r1:
1762         case NID_wap_wsg_idm_ecid_wtls4:
1763             ret = (n2d == NID_sect113r1 || n2d == NID_wap_wsg_idm_ecid_wtls4);
1764             break;
1765         case NID_sect163k1:
1766         case NID_wap_wsg_idm_ecid_wtls3:
1767             ret = (n2d == NID_sect163k1 || n2d == NID_wap_wsg_idm_ecid_wtls3);
1768             break;
1769         case NID_sect233k1:
1770         case NID_wap_wsg_idm_ecid_wtls10:
1771             ret = (n2d == NID_sect233k1 || n2d == NID_wap_wsg_idm_ecid_wtls10);
1772             break;
1773         case NID_sect233r1:
1774         case NID_wap_wsg_idm_ecid_wtls11:
1775             ret = (n2d == NID_sect233r1 || n2d == NID_wap_wsg_idm_ecid_wtls11);
1776             break;
1777         case NID_X9_62_c2pnb163v1:
1778         case NID_wap_wsg_idm_ecid_wtls5:
1779             ret = (n2d == NID_X9_62_c2pnb163v1
1780                    || n2d == NID_wap_wsg_idm_ecid_wtls5);
1781             break;
1782 #endif /* OPENSSL_NO_EC2M */
1783         case NID_secp112r1:
1784         case NID_wap_wsg_idm_ecid_wtls6:
1785             ret = (n2d == NID_secp112r1 || n2d == NID_wap_wsg_idm_ecid_wtls6);
1786             break;
1787         case NID_secp160r2:
1788         case NID_wap_wsg_idm_ecid_wtls7:
1789             ret = (n2d == NID_secp160r2 || n2d == NID_wap_wsg_idm_ecid_wtls7);
1790             break;
1791 #ifdef OPENSSL_NO_EC_NISTP_64_GCC_128
1792         case NID_secp224r1:
1793         case NID_wap_wsg_idm_ecid_wtls12:
1794             ret = (n2d == NID_secp224r1 || n2d == NID_wap_wsg_idm_ecid_wtls12);
1795             break;
1796 #else
1797         /*
1798          * For SEC P-224 we want to ensure that the SECP nid is returned, as
1799          * that is associated with a specialized method.
1800          */
1801         case NID_wap_wsg_idm_ecid_wtls12:
1802             ret = (n2d == NID_secp224r1);
1803             break;
1804 #endif /* def(OPENSSL_NO_EC_NISTP_64_GCC_128) */
1805
1806         default:
1807             ret = (n1d == n2d);
1808     }
1809     return ret;
1810 }
1811
1812 /*
1813  * This checks that EC_GROUP_bew_from_ecparameters() returns a "named"
1814  * EC_GROUP for built-in curves.
1815  *
1816  * Note that it is possible to retrieve an alternative alias that does not match
1817  * the original nid.
1818  *
1819  * Ensure that the OPENSSL_EC_EXPLICIT_CURVE ASN1 flag is set.
1820  */
1821 static int check_named_curve_from_ecparameters(int id)
1822 {
1823     int ret = 0, nid, tnid;
1824     EC_GROUP *group = NULL, *tgroup = NULL, *tmpg = NULL;
1825     const EC_POINT *group_gen = NULL;
1826     EC_POINT *other_gen = NULL;
1827     BIGNUM *group_cofactor = NULL, *other_cofactor = NULL;
1828     BIGNUM *other_gen_x = NULL, *other_gen_y = NULL;
1829     const BIGNUM *group_order = NULL;
1830     BIGNUM *other_order = NULL;
1831     BN_CTX *bn_ctx = NULL;
1832     static const unsigned char invalid_seed[] = "THIS IS NOT A VALID SEED";
1833     static size_t invalid_seed_len = sizeof(invalid_seed);
1834     ECPARAMETERS *params = NULL, *other_params = NULL;
1835     EC_GROUP *g_ary[8] = {NULL};
1836     EC_GROUP **g_next = &g_ary[0];
1837     ECPARAMETERS *p_ary[8] = {NULL};
1838     ECPARAMETERS **p_next = &p_ary[0];
1839
1840     /* Do some setup */
1841     nid = curves[id].nid;
1842     TEST_note("Curve %s", OBJ_nid2sn(nid));
1843     if (!TEST_ptr(bn_ctx = BN_CTX_new()))
1844         return ret;
1845     BN_CTX_start(bn_ctx);
1846
1847     if (/* Allocations */
1848         !TEST_ptr(group_cofactor = BN_CTX_get(bn_ctx))
1849         || !TEST_ptr(other_gen_x = BN_CTX_get(bn_ctx))
1850         || !TEST_ptr(other_gen_y = BN_CTX_get(bn_ctx))
1851         || !TEST_ptr(other_order = BN_CTX_get(bn_ctx))
1852         || !TEST_ptr(other_cofactor = BN_CTX_get(bn_ctx))
1853         /* Generate reference group and params */
1854         || !TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))
1855         || !TEST_ptr(params = EC_GROUP_get_ecparameters(group, NULL))
1856         || !TEST_ptr(group_gen = EC_GROUP_get0_generator(group))
1857         || !TEST_ptr(group_order = EC_GROUP_get0_order(group))
1858         || !TEST_true(EC_GROUP_get_cofactor(group, group_cofactor, NULL))
1859         /* compute `other_*` values */
1860         || !TEST_ptr(tmpg = EC_GROUP_dup(group))
1861         || !TEST_ptr(other_gen = EC_POINT_dup(group_gen, group))
1862         || !TEST_true(EC_POINT_add(group, other_gen, group_gen, group_gen, NULL))
1863         || !TEST_true(EC_POINT_get_affine_coordinates(group, other_gen,
1864                       other_gen_x, other_gen_y, bn_ctx))
1865         || !TEST_true(BN_copy(other_order, group_order))
1866         || !TEST_true(BN_add_word(other_order, 1))
1867         || !TEST_true(BN_copy(other_cofactor, group_cofactor))
1868         || !TEST_true(BN_add_word(other_cofactor, 1)))
1869         goto err;
1870
1871     EC_POINT_free(other_gen);
1872     other_gen = NULL;
1873
1874     if (!TEST_ptr(other_gen = EC_POINT_new(tmpg))
1875         || !TEST_true(EC_POINT_set_affine_coordinates(tmpg, other_gen,
1876                                                       other_gen_x, other_gen_y,
1877                                                       bn_ctx)))
1878         goto err;
1879
1880     /*
1881      * ###########################
1882      * # Actual tests start here #
1883      * ###########################
1884      */
1885
1886     /*
1887      * Creating a group from built-in explicit parameters returns a
1888      * "named" EC_GROUP
1889      */
1890     if (!TEST_ptr(tgroup = *g_next++ = EC_GROUP_new_from_ecparameters(params))
1891         || !TEST_int_ne((tnid = EC_GROUP_get_curve_name(tgroup)), NID_undef))
1892         goto err;
1893     /*
1894      * We cannot always guarantee the names match, as the built-in table
1895      * contains aliases for the same curve with different names.
1896      */
1897     if (!TEST_true(are_ec_nids_compatible(nid, tnid))) {
1898         TEST_info("nid = %s, tnid = %s", OBJ_nid2sn(nid), OBJ_nid2sn(tnid));
1899         goto err;
1900     }
1901     /* Ensure that the OPENSSL_EC_EXPLICIT_CURVE ASN1 flag is set. */
1902     if (!TEST_int_eq(EC_GROUP_get_asn1_flag(tgroup), OPENSSL_EC_EXPLICIT_CURVE))
1903         goto err;
1904
1905     /*
1906      * An invalid seed in the parameters should be ignored: expect a "named"
1907      * group.
1908      */
1909     if (!TEST_int_eq(EC_GROUP_set_seed(tmpg, invalid_seed, invalid_seed_len),
1910                      invalid_seed_len)
1911             || !TEST_ptr(other_params = *p_next++ =
1912                          EC_GROUP_get_ecparameters(tmpg, NULL))
1913             || !TEST_ptr(tgroup = *g_next++ =
1914                           EC_GROUP_new_from_ecparameters(other_params))
1915             || !TEST_int_ne((tnid = EC_GROUP_get_curve_name(tgroup)), NID_undef)
1916             || !TEST_true(are_ec_nids_compatible(nid, tnid))
1917             || !TEST_int_eq(EC_GROUP_get_asn1_flag(tgroup),
1918                             OPENSSL_EC_EXPLICIT_CURVE)) {
1919         TEST_info("nid = %s, tnid = %s", OBJ_nid2sn(nid), OBJ_nid2sn(tnid));
1920         goto err;
1921     }
1922
1923     /*
1924      * A null seed in the parameters should be ignored, as it is optional:
1925      * expect a "named" group.
1926      */
1927     if (!TEST_int_eq(EC_GROUP_set_seed(tmpg, NULL, 0), 1)
1928             || !TEST_ptr(other_params = *p_next++ =
1929                          EC_GROUP_get_ecparameters(tmpg, NULL))
1930             || !TEST_ptr(tgroup = *g_next++ =
1931                           EC_GROUP_new_from_ecparameters(other_params))
1932             || !TEST_int_ne((tnid = EC_GROUP_get_curve_name(tgroup)), NID_undef)
1933             || !TEST_true(are_ec_nids_compatible(nid, tnid))
1934             || !TEST_int_eq(EC_GROUP_get_asn1_flag(tgroup),
1935                             OPENSSL_EC_EXPLICIT_CURVE)) {
1936         TEST_info("nid = %s, tnid = %s", OBJ_nid2sn(nid), OBJ_nid2sn(tnid));
1937         goto err;
1938     }
1939
1940     /*
1941      * Check that changing any of the generator parameters does not yield a
1942      * match with the built-in curves
1943      */
1944     if (/* Other gen, same group order & cofactor */
1945         !TEST_true(EC_GROUP_set_generator(tmpg, other_gen, group_order,
1946                                           group_cofactor))
1947         || !TEST_ptr(other_params = *p_next++ =
1948                      EC_GROUP_get_ecparameters(tmpg, NULL))
1949         || !TEST_ptr(tgroup = *g_next++ =
1950                       EC_GROUP_new_from_ecparameters(other_params))
1951         || !TEST_int_eq((tnid = EC_GROUP_get_curve_name(tgroup)), NID_undef)
1952         /* Same gen & cofactor, different order */
1953         || !TEST_true(EC_GROUP_set_generator(tmpg, group_gen, other_order,
1954                                              group_cofactor))
1955         || !TEST_ptr(other_params = *p_next++ =
1956                      EC_GROUP_get_ecparameters(tmpg, NULL))
1957         || !TEST_ptr(tgroup = *g_next++ =
1958                       EC_GROUP_new_from_ecparameters(other_params))
1959         || !TEST_int_eq((tnid = EC_GROUP_get_curve_name(tgroup)), NID_undef)
1960         /* The order is not an optional field, so this should fail */
1961         || !TEST_false(EC_GROUP_set_generator(tmpg, group_gen, NULL,
1962                                               group_cofactor))
1963         /* Check that a wrong cofactor is ignored, and we still match */
1964         || !TEST_true(EC_GROUP_set_generator(tmpg, group_gen, group_order,
1965                                              other_cofactor))
1966         || !TEST_ptr(other_params = *p_next++ =
1967                      EC_GROUP_get_ecparameters(tmpg, NULL))
1968         || !TEST_ptr(tgroup = *g_next++ =
1969                       EC_GROUP_new_from_ecparameters(other_params))
1970         || !TEST_int_ne((tnid = EC_GROUP_get_curve_name(tgroup)), NID_undef)
1971         || !TEST_true(are_ec_nids_compatible(nid, tnid))
1972         || !TEST_int_eq(EC_GROUP_get_asn1_flag(tgroup),
1973                         OPENSSL_EC_EXPLICIT_CURVE)
1974         /* Check that if the cofactor is not set then it still matches */
1975         || !TEST_true(EC_GROUP_set_generator(tmpg, group_gen, group_order,
1976                                              NULL))
1977         || !TEST_ptr(other_params = *p_next++ =
1978                      EC_GROUP_get_ecparameters(tmpg, NULL))
1979         || !TEST_ptr(tgroup = *g_next++ =
1980                       EC_GROUP_new_from_ecparameters(other_params))
1981         || !TEST_int_ne((tnid = EC_GROUP_get_curve_name(tgroup)), NID_undef)
1982         || !TEST_true(are_ec_nids_compatible(nid, tnid))
1983         || !TEST_int_eq(EC_GROUP_get_asn1_flag(tgroup),
1984                         OPENSSL_EC_EXPLICIT_CURVE)
1985         /* check that restoring the generator passes */
1986         || !TEST_true(EC_GROUP_set_generator(tmpg, group_gen, group_order,
1987                                              group_cofactor))
1988         || !TEST_ptr(other_params = *p_next++ =
1989                      EC_GROUP_get_ecparameters(tmpg, NULL))
1990         || !TEST_ptr(tgroup = *g_next++ =
1991                       EC_GROUP_new_from_ecparameters(other_params))
1992         || !TEST_int_ne((tnid = EC_GROUP_get_curve_name(tgroup)), NID_undef)
1993         || !TEST_true(are_ec_nids_compatible(nid, tnid))
1994         || !TEST_int_eq(EC_GROUP_get_asn1_flag(tgroup),
1995                         OPENSSL_EC_EXPLICIT_CURVE))
1996         goto err;
1997
1998     ret = 1;
1999 err:
2000     for (g_next = &g_ary[0]; g_next < g_ary + OSSL_NELEM(g_ary); g_next++)
2001         EC_GROUP_free(*g_next);
2002     for (p_next = &p_ary[0]; p_next < p_ary + OSSL_NELEM(g_ary); p_next++)
2003         ECPARAMETERS_free(*p_next);
2004     ECPARAMETERS_free(params);
2005     EC_POINT_free(other_gen);
2006     EC_GROUP_free(tmpg);
2007     EC_GROUP_free(group);
2008     BN_CTX_end(bn_ctx);
2009     BN_CTX_free(bn_ctx);
2010     return ret;
2011 }
2012
2013
2014 static int parameter_test(void)
2015 {
2016     EC_GROUP *group = NULL, *group2 = NULL;
2017     ECPARAMETERS *ecparameters = NULL;
2018     unsigned char *buf = NULL;
2019     int r = 0, len;
2020
2021     if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(NID_secp384r1))
2022         || !TEST_ptr(ecparameters = EC_GROUP_get_ecparameters(group, NULL))
2023         || !TEST_ptr(group2 = EC_GROUP_new_from_ecparameters(ecparameters))
2024         || !TEST_int_eq(EC_GROUP_cmp(group, group2, NULL), 0))
2025         goto err;
2026
2027     EC_GROUP_free(group);
2028     group = NULL;
2029
2030     /* Test the named curve encoding, which should be default. */
2031     if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(NID_secp521r1))
2032         || !TEST_true((len = i2d_ECPKParameters(group, &buf)) >= 0)
2033         || !TEST_mem_eq(buf, len, p521_named, sizeof(p521_named)))
2034         goto err;
2035
2036     OPENSSL_free(buf);
2037     buf = NULL;
2038
2039     /*
2040      * Test the explicit encoding. P-521 requires correctly zero-padding the
2041      * curve coefficients.
2042      */
2043     EC_GROUP_set_asn1_flag(group, OPENSSL_EC_EXPLICIT_CURVE);
2044     if (!TEST_true((len = i2d_ECPKParameters(group, &buf)) >= 0)
2045         || !TEST_mem_eq(buf, len, p521_explicit, sizeof(p521_explicit)))
2046         goto err;
2047
2048     r = 1;
2049 err:
2050     EC_GROUP_free(group);
2051     EC_GROUP_free(group2);
2052     ECPARAMETERS_free(ecparameters);
2053     OPENSSL_free(buf);
2054     return r;
2055 }
2056
2057 /*-
2058  * random 256-bit explicit parameters curve, cofactor absent
2059  * order:    0x0c38d96a9f892b88772ec2e39614a82f4f (132 bit)
2060  * cofactor:   0x12bc94785251297abfafddf1565100da (125 bit)
2061  */
2062 static const unsigned char params_cf_pass[] = {
2063     0x30, 0x81, 0xcd, 0x02, 0x01, 0x01, 0x30, 0x2c, 0x06, 0x07, 0x2a, 0x86,
2064     0x48, 0xce, 0x3d, 0x01, 0x01, 0x02, 0x21, 0x00, 0xe5, 0x00, 0x1f, 0xc5,
2065     0xca, 0x71, 0x9d, 0x8e, 0xf7, 0x07, 0x4b, 0x48, 0x37, 0xf9, 0x33, 0x2d,
2066     0x71, 0xbf, 0x79, 0xe7, 0xdc, 0x91, 0xc2, 0xff, 0xb6, 0x7b, 0xc3, 0x93,
2067     0x44, 0x88, 0xe6, 0x91, 0x30, 0x44, 0x04, 0x20, 0xe5, 0x00, 0x1f, 0xc5,
2068     0xca, 0x71, 0x9d, 0x8e, 0xf7, 0x07, 0x4b, 0x48, 0x37, 0xf9, 0x33, 0x2d,
2069     0x71, 0xbf, 0x79, 0xe7, 0xdc, 0x91, 0xc2, 0xff, 0xb6, 0x7b, 0xc3, 0x93,
2070     0x44, 0x88, 0xe6, 0x8e, 0x04, 0x20, 0x18, 0x8c, 0x59, 0x57, 0xc4, 0xbc,
2071     0x85, 0x57, 0xc3, 0x66, 0x9f, 0x89, 0xd5, 0x92, 0x0d, 0x7e, 0x42, 0x27,
2072     0x07, 0x64, 0xaa, 0x26, 0xed, 0x89, 0xc4, 0x09, 0x05, 0x4d, 0xc7, 0x23,
2073     0x47, 0xda, 0x04, 0x41, 0x04, 0x1b, 0x6b, 0x41, 0x0b, 0xf9, 0xfb, 0x77,
2074     0xfd, 0x50, 0xb7, 0x3e, 0x23, 0xa3, 0xec, 0x9a, 0x3b, 0x09, 0x31, 0x6b,
2075     0xfa, 0xf6, 0xce, 0x1f, 0xff, 0xeb, 0x57, 0x93, 0x24, 0x70, 0xf3, 0xf4,
2076     0xba, 0x7e, 0xfa, 0x86, 0x6e, 0x19, 0x89, 0xe3, 0x55, 0x6d, 0x5a, 0xe9,
2077     0xc0, 0x3d, 0xbc, 0xfb, 0xaf, 0xad, 0xd4, 0x7e, 0xa6, 0xe5, 0xfa, 0x1a,
2078     0x58, 0x07, 0x9e, 0x8f, 0x0d, 0x3b, 0xf7, 0x38, 0xca, 0x02, 0x11, 0x0c,
2079     0x38, 0xd9, 0x6a, 0x9f, 0x89, 0x2b, 0x88, 0x77, 0x2e, 0xc2, 0xe3, 0x96,
2080     0x14, 0xa8, 0x2f, 0x4f
2081 };
2082
2083 /*-
2084  * random 256-bit explicit parameters curve, cofactor absent
2085  * order:    0x045a75c0c17228ebd9b169a10e34a22101 (131 bit)
2086  * cofactor:   0x2e134b4ede82649f67a2e559d361e5fe (126 bit)
2087  */
2088 static const unsigned char params_cf_fail[] = {
2089     0x30, 0x81, 0xcd, 0x02, 0x01, 0x01, 0x30, 0x2c, 0x06, 0x07, 0x2a, 0x86,
2090     0x48, 0xce, 0x3d, 0x01, 0x01, 0x02, 0x21, 0x00, 0xc8, 0x95, 0x27, 0x37,
2091     0xe8, 0xe1, 0xfd, 0xcc, 0xf9, 0x6e, 0x0c, 0xa6, 0x21, 0xc1, 0x7d, 0x6b,
2092     0x9d, 0x44, 0x42, 0xea, 0x73, 0x4e, 0x04, 0xb6, 0xac, 0x62, 0x50, 0xd0,
2093     0x33, 0xc2, 0xea, 0x13, 0x30, 0x44, 0x04, 0x20, 0xc8, 0x95, 0x27, 0x37,
2094     0xe8, 0xe1, 0xfd, 0xcc, 0xf9, 0x6e, 0x0c, 0xa6, 0x21, 0xc1, 0x7d, 0x6b,
2095     0x9d, 0x44, 0x42, 0xea, 0x73, 0x4e, 0x04, 0xb6, 0xac, 0x62, 0x50, 0xd0,
2096     0x33, 0xc2, 0xea, 0x10, 0x04, 0x20, 0xbf, 0xa6, 0xa8, 0x05, 0x1d, 0x09,
2097     0xac, 0x70, 0x39, 0xbb, 0x4d, 0xb2, 0x90, 0x8a, 0x15, 0x41, 0x14, 0x1d,
2098     0x11, 0x86, 0x9f, 0x13, 0xa2, 0x63, 0x1a, 0xda, 0x95, 0x22, 0x4d, 0x02,
2099     0x15, 0x0a, 0x04, 0x41, 0x04, 0xaf, 0x16, 0x71, 0xf9, 0xc4, 0xc8, 0x59,
2100     0x1d, 0xa3, 0x6f, 0xe7, 0xc3, 0x57, 0xa1, 0xfa, 0x9f, 0x49, 0x7c, 0x11,
2101     0x27, 0x05, 0xa0, 0x7f, 0xff, 0xf9, 0xe0, 0xe7, 0x92, 0xdd, 0x9c, 0x24,
2102     0x8e, 0xc7, 0xb9, 0x52, 0x71, 0x3f, 0xbc, 0x7f, 0x6a, 0x9f, 0x35, 0x70,
2103     0xe1, 0x27, 0xd5, 0x35, 0x8a, 0x13, 0xfa, 0xa8, 0x33, 0x3e, 0xd4, 0x73,
2104     0x1c, 0x14, 0x58, 0x9e, 0xc7, 0x0a, 0x87, 0x65, 0x8d, 0x02, 0x11, 0x04,
2105     0x5a, 0x75, 0xc0, 0xc1, 0x72, 0x28, 0xeb, 0xd9, 0xb1, 0x69, 0xa1, 0x0e,
2106     0x34, 0xa2, 0x21, 0x01
2107 };
2108
2109 /*-
2110  * Test two random 256-bit explicit parameters curves with absent cofactor.
2111  * The two curves are chosen to roughly straddle the bounds at which the lib
2112  * can compute the cofactor automatically, roughly 4*sqrt(p). So test that:
2113  *
2114  * - params_cf_pass: order is sufficiently close to p to compute cofactor
2115  * - params_cf_fail: order is too far away from p to compute cofactor
2116  *
2117  * For standards-compliant curves, cofactor is chosen as small as possible.
2118  * So you can see neither of these curves are fit for cryptographic use.
2119  *
2120  * Some standards even mandate an upper bound on the cofactor, e.g. SECG1 v2:
2121  * h <= 2**(t/8) where t is the security level of the curve, for which the lib
2122  * will always succeed in computing the cofactor. Neither of these curves
2123  * conform to that -- this is just robustness testing.
2124  */
2125 static int cofactor_range_test(void)
2126 {
2127     EC_GROUP *group = NULL;
2128     BIGNUM *cf = NULL;
2129     int ret = 0;
2130     const unsigned char *b1 = (const unsigned char *)params_cf_fail;
2131     const unsigned char *b2 = (const unsigned char *)params_cf_pass;
2132
2133     if (!TEST_ptr(group = d2i_ECPKParameters(NULL, &b1, sizeof(params_cf_fail)))
2134         || !TEST_BN_eq_zero(EC_GROUP_get0_cofactor(group))
2135         || !TEST_ptr(group = d2i_ECPKParameters(&group, &b2,
2136                                                 sizeof(params_cf_pass)))
2137         || !TEST_int_gt(BN_hex2bn(&cf, "12bc94785251297abfafddf1565100da"), 0)
2138         || !TEST_BN_eq(cf, EC_GROUP_get0_cofactor(group)))
2139         goto err;
2140     ret = 1;
2141  err:
2142     BN_free(cf);
2143     EC_GROUP_free(group);
2144     return ret;
2145 }
2146
2147 /*-
2148  * For named curves, test that:
2149  * - the lib correctly computes the cofactor if passed a NULL or zero cofactor
2150  * - a nonsensical cofactor throws an error (negative test)
2151  * - nonsensical orders throw errors (negative tests)
2152  */
2153 static int cardinality_test(int n)
2154 {
2155     int ret = 0, is_binary = 0;
2156     int nid = curves[n].nid;
2157     BN_CTX *ctx = NULL;
2158     EC_GROUP *g1 = NULL, *g2 = NULL;
2159     EC_POINT *g2_gen = NULL;
2160     BIGNUM *g1_p = NULL, *g1_a = NULL, *g1_b = NULL, *g1_x = NULL, *g1_y = NULL,
2161            *g1_order = NULL, *g1_cf = NULL, *g2_cf = NULL;
2162
2163     TEST_info("Curve %s cardinality test", OBJ_nid2sn(nid));
2164
2165     if (!TEST_ptr(ctx = BN_CTX_new())
2166         || !TEST_ptr(g1 = EC_GROUP_new_by_curve_name(nid))) {
2167         BN_CTX_free(ctx);
2168         return 0;
2169     }
2170
2171     is_binary = (EC_GROUP_get_field_type(g1) == NID_X9_62_characteristic_two_field);
2172
2173     BN_CTX_start(ctx);
2174     g1_p = BN_CTX_get(ctx);
2175     g1_a = BN_CTX_get(ctx);
2176     g1_b = BN_CTX_get(ctx);
2177     g1_x = BN_CTX_get(ctx);
2178     g1_y = BN_CTX_get(ctx);
2179     g1_order = BN_CTX_get(ctx);
2180     g1_cf = BN_CTX_get(ctx);
2181
2182     if (!TEST_ptr(g2_cf = BN_CTX_get(ctx))
2183         /* pull out the explicit curve parameters */
2184         || !TEST_true(EC_GROUP_get_curve(g1, g1_p, g1_a, g1_b, ctx))
2185         || !TEST_true(EC_POINT_get_affine_coordinates(g1,
2186                       EC_GROUP_get0_generator(g1), g1_x, g1_y, ctx))
2187         || !TEST_true(BN_copy(g1_order, EC_GROUP_get0_order(g1)))
2188         || !TEST_true(EC_GROUP_get_cofactor(g1, g1_cf, ctx))
2189         /* construct g2 manually with g1 parameters */
2190 #ifndef OPENSSL_NO_EC2M
2191         || !TEST_ptr(g2 = (is_binary) ?
2192                            EC_GROUP_new_curve_GF2m(g1_p, g1_a, g1_b, ctx) :
2193                            EC_GROUP_new_curve_GFp(g1_p, g1_a, g1_b, ctx))
2194 #else
2195         || !TEST_int_eq(0, is_binary)
2196         || !TEST_ptr(g2 = EC_GROUP_new_curve_GFp(g1_p, g1_a, g1_b, ctx))
2197 #endif
2198         || !TEST_ptr(g2_gen = EC_POINT_new(g2))
2199         || !TEST_true(EC_POINT_set_affine_coordinates(g2, g2_gen, g1_x, g1_y, ctx))
2200         /* pass NULL cofactor: lib should compute it */
2201         || !TEST_true(EC_GROUP_set_generator(g2, g2_gen, g1_order, NULL))
2202         || !TEST_true(EC_GROUP_get_cofactor(g2, g2_cf, ctx))
2203         || !TEST_BN_eq(g1_cf, g2_cf)
2204         /* pass zero cofactor: lib should compute it */
2205         || !TEST_true(BN_set_word(g2_cf, 0))
2206         || !TEST_true(EC_GROUP_set_generator(g2, g2_gen, g1_order, g2_cf))
2207         || !TEST_true(EC_GROUP_get_cofactor(g2, g2_cf, ctx))
2208         || !TEST_BN_eq(g1_cf, g2_cf)
2209         /* negative test for invalid cofactor */
2210         || !TEST_true(BN_set_word(g2_cf, 0))
2211         || !TEST_true(BN_sub(g2_cf, g2_cf, BN_value_one()))
2212         || !TEST_false(EC_GROUP_set_generator(g2, g2_gen, g1_order, g2_cf))
2213         /* negative test for NULL order */
2214         || !TEST_false(EC_GROUP_set_generator(g2, g2_gen, NULL, NULL))
2215         /* negative test for zero order */
2216         || !TEST_true(BN_set_word(g1_order, 0))
2217         || !TEST_false(EC_GROUP_set_generator(g2, g2_gen, g1_order, NULL))
2218         /* negative test for negative order */
2219         || !TEST_true(BN_set_word(g2_cf, 0))
2220         || !TEST_true(BN_sub(g2_cf, g2_cf, BN_value_one()))
2221         || !TEST_false(EC_GROUP_set_generator(g2, g2_gen, g1_order, NULL))
2222         /* negative test for too large order */
2223         || !TEST_true(BN_lshift(g1_order, g1_p, 2))
2224         || !TEST_false(EC_GROUP_set_generator(g2, g2_gen, g1_order, NULL)))
2225         goto err;
2226     ret = 1;
2227  err:
2228     EC_POINT_free(g2_gen);
2229     EC_GROUP_free(g1);
2230     EC_GROUP_free(g2);
2231     BN_CTX_end(ctx);
2232     BN_CTX_free(ctx);
2233     return ret;
2234 }
2235
2236 static int check_ec_key_field_public_range_test(int id)
2237 {
2238     int ret = 0, type = 0;
2239     const EC_POINT *pub = NULL;
2240     const EC_GROUP *group = NULL;
2241     const BIGNUM *field = NULL;
2242     BIGNUM *x = NULL, *y = NULL;
2243     EC_KEY *key = NULL;
2244
2245     if (!TEST_ptr(x = BN_new())
2246             || !TEST_ptr(y = BN_new())
2247             || !TEST_ptr(key = EC_KEY_new_by_curve_name(curves[id].nid))
2248             || !TEST_ptr(group = EC_KEY_get0_group(key))
2249             || !TEST_ptr(field = EC_GROUP_get0_field(group))
2250             || !TEST_int_gt(EC_KEY_generate_key(key), 0)
2251             || !TEST_int_gt(EC_KEY_check_key(key), 0)
2252             || !TEST_ptr(pub = EC_KEY_get0_public_key(key))
2253             || !TEST_int_gt(EC_POINT_get_affine_coordinates(group, pub, x, y,
2254                                                             NULL), 0))
2255         goto err;
2256
2257     /*
2258      * Make the public point out of range by adding the field (which will still
2259      * be the same point on the curve). The add is different for char2 fields.
2260      */
2261     type = EC_GROUP_get_field_type(group);
2262 #ifndef OPENSSL_NO_EC2M
2263     if (type == NID_X9_62_characteristic_two_field) {
2264         /* test for binary curves */
2265         if (!TEST_true(BN_GF2m_add(x, x, field)))
2266             goto err;
2267     } else
2268 #endif
2269     if (type == NID_X9_62_prime_field) {
2270         /* test for prime curves */
2271         if (!TEST_true(BN_add(x, x, field)))
2272             goto err;
2273     } else {
2274         /* this should never happen */
2275         TEST_error("Unsupported EC_METHOD field_type");
2276         goto err;
2277     }
2278     if (!TEST_int_le(EC_KEY_set_public_key_affine_coordinates(key, x, y), 0))
2279         goto err;
2280
2281     ret = 1;
2282 err:
2283     BN_free(x);
2284     BN_free(y);
2285     EC_KEY_free(key);
2286     return ret;
2287 }
2288
2289 /*
2290  * Helper for ec_point_hex2point_test
2291  *
2292  * Self-tests EC_POINT_point2hex() against EC_POINT_hex2point() for the given
2293  * (group,P) pair.
2294  *
2295  * If P is NULL use point at infinity.
2296  */
2297 static ossl_inline
2298 int ec_point_hex2point_test_helper(const EC_GROUP *group, const EC_POINT *P,
2299                                    point_conversion_form_t form,
2300                                    BN_CTX *bnctx)
2301 {
2302     int ret = 0;
2303     EC_POINT *Q = NULL, *Pinf = NULL;
2304     char *hex = NULL;
2305
2306     if (P == NULL) {
2307         /* If P is NULL use point at infinity. */
2308         if (!TEST_ptr(Pinf = EC_POINT_new(group))
2309                 || !TEST_true(EC_POINT_set_to_infinity(group, Pinf)))
2310             goto err;
2311         P = Pinf;
2312     }
2313
2314     if (!TEST_ptr(hex = EC_POINT_point2hex(group, P, form, bnctx))
2315             || !TEST_ptr(Q = EC_POINT_hex2point(group, hex, NULL, bnctx))
2316             || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, bnctx)))
2317         goto err;
2318
2319     /*
2320      * The next check is most likely superfluous, as EC_POINT_cmp should already
2321      * cover this.
2322      * Nonetheless it increases the test coverage for EC_POINT_is_at_infinity,
2323      * so we include it anyway!
2324      */
2325     if (Pinf != NULL
2326             && !TEST_true(EC_POINT_is_at_infinity(group, Q)))
2327         goto err;
2328
2329     ret = 1;
2330
2331  err:
2332     EC_POINT_free(Pinf);
2333     OPENSSL_free(hex);
2334     EC_POINT_free(Q);
2335
2336     return ret;
2337 }
2338
2339 /*
2340  * This test self-validates EC_POINT_hex2point() and EC_POINT_point2hex()
2341  */
2342 static int ec_point_hex2point_test(int id)
2343 {
2344     int ret = 0, nid;
2345     EC_GROUP *group = NULL;
2346     const EC_POINT *G = NULL;
2347     EC_POINT *P = NULL;
2348     BN_CTX * bnctx = NULL;
2349
2350     /* Do some setup */
2351     nid = curves[id].nid;
2352     if (!TEST_ptr(bnctx = BN_CTX_new())
2353             || !TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))
2354             || !TEST_ptr(G = EC_GROUP_get0_generator(group))
2355             || !TEST_ptr(P = EC_POINT_dup(G, group)))
2356         goto err;
2357
2358     if (!TEST_true(ec_point_hex2point_test_helper(group, P,
2359                                                   POINT_CONVERSION_COMPRESSED,
2360                                                   bnctx))
2361             || !TEST_true(ec_point_hex2point_test_helper(group, NULL,
2362                                                          POINT_CONVERSION_COMPRESSED,
2363                                                          bnctx))
2364             || !TEST_true(ec_point_hex2point_test_helper(group, P,
2365                                                          POINT_CONVERSION_UNCOMPRESSED,
2366                                                          bnctx))
2367             || !TEST_true(ec_point_hex2point_test_helper(group, NULL,
2368                                                          POINT_CONVERSION_UNCOMPRESSED,
2369                                                          bnctx))
2370             || !TEST_true(ec_point_hex2point_test_helper(group, P,
2371                                                          POINT_CONVERSION_HYBRID,
2372                                                          bnctx))
2373             || !TEST_true(ec_point_hex2point_test_helper(group, NULL,
2374                                                          POINT_CONVERSION_HYBRID,
2375                                                          bnctx)))
2376         goto err;
2377
2378     ret = 1;
2379
2380  err:
2381     EC_POINT_free(P);
2382     EC_GROUP_free(group);
2383     BN_CTX_free(bnctx);
2384
2385     return ret;
2386 }
2387
2388 static int do_test_custom_explicit_fromdata(EC_GROUP *group, BN_CTX *ctx,
2389                                             unsigned char *gen, int gen_size)
2390 {
2391     int ret = 0, i_out;
2392     EVP_PKEY_CTX *pctx = NULL;
2393     EVP_PKEY *pkeyparam = NULL;
2394     OSSL_PARAM_BLD *bld = NULL;
2395     const char *field_name;
2396     OSSL_PARAM *params = NULL;
2397     const OSSL_PARAM *gettable;
2398     BIGNUM *p, *a, *b;
2399     BIGNUM *p_out = NULL, *a_out = NULL, *b_out = NULL;
2400     BIGNUM *order_out = NULL, *cofactor_out = NULL;
2401     char name[80];
2402     unsigned char buf[1024];
2403     size_t buf_len, name_len;
2404 #ifndef OPENSSL_NO_EC2M
2405     unsigned int k1 = 0, k2 = 0, k3 = 0;
2406     const char *basis_name = NULL;
2407 #endif
2408
2409     p = BN_CTX_get(ctx);
2410     a = BN_CTX_get(ctx);
2411     b = BN_CTX_get(ctx);
2412
2413     if (!TEST_ptr(b)
2414         || !TEST_ptr(bld = OSSL_PARAM_BLD_new()))
2415         goto err;
2416
2417     if (EC_GROUP_get_field_type(group) == NID_X9_62_prime_field) {
2418         field_name = SN_X9_62_prime_field;
2419     } else {
2420         field_name = SN_X9_62_characteristic_two_field;
2421 #ifndef OPENSSL_NO_EC2M
2422         if (EC_GROUP_get_basis_type(group) == NID_X9_62_tpBasis) {
2423             basis_name = SN_X9_62_tpBasis;
2424             if (!TEST_true(EC_GROUP_get_trinomial_basis(group, &k1)))
2425                 goto err;
2426         } else {
2427             basis_name = SN_X9_62_ppBasis;
2428             if (!TEST_true(EC_GROUP_get_pentanomial_basis(group, &k1, &k2, &k3)))
2429                 goto err;
2430         }
2431 #endif /* OPENSSL_NO_EC2M */
2432     }
2433     if (!TEST_true(EC_GROUP_get_curve(group, p, a, b, ctx))
2434         || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(bld,
2435                           OSSL_PKEY_PARAM_EC_FIELD_TYPE, field_name, 0))
2436         || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_EC_P, p))
2437         || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_EC_A, a))
2438         || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_EC_B, b)))
2439         goto err;
2440
2441     if (EC_GROUP_get0_seed(group) != NULL) {
2442         if (!TEST_true(OSSL_PARAM_BLD_push_octet_string(bld,
2443                            OSSL_PKEY_PARAM_EC_SEED, EC_GROUP_get0_seed(group),
2444                            EC_GROUP_get_seed_len(group))))
2445             goto err;
2446     }
2447     if (EC_GROUP_get0_cofactor(group) != NULL) {
2448         if (!TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_EC_COFACTOR,
2449                                               EC_GROUP_get0_cofactor(group))))
2450             goto err;
2451     }
2452
2453     if (!TEST_true(OSSL_PARAM_BLD_push_octet_string(bld,
2454                        OSSL_PKEY_PARAM_EC_GENERATOR, gen, gen_size))
2455         || !TEST_true(OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_EC_ORDER,
2456                                              EC_GROUP_get0_order(group))))
2457         goto err;
2458
2459     if (!TEST_ptr(params = OSSL_PARAM_BLD_to_param(bld))
2460         || !TEST_ptr(pctx = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL))
2461         || !TEST_int_gt(EVP_PKEY_fromdata_init(pctx), 0)
2462         || !TEST_int_gt(EVP_PKEY_fromdata(pctx, &pkeyparam,
2463                                           EVP_PKEY_KEY_PARAMETERS, params), 0))
2464         goto err;
2465
2466     /*- Check that all the set values are retrievable -*/
2467
2468     /* There should be no match to a group name since the generator changed */
2469     if (!TEST_false(EVP_PKEY_get_utf8_string_param(pkeyparam,
2470                         OSSL_PKEY_PARAM_GROUP_NAME, name, sizeof(name),
2471                         &name_len)))
2472         goto err;
2473
2474     /* The encoding should be explicit as it has no group */
2475     if (!TEST_true(EVP_PKEY_get_utf8_string_param(pkeyparam,
2476                        OSSL_PKEY_PARAM_EC_ENCODING,
2477                        name, sizeof(name), &name_len))
2478         || !TEST_str_eq(name, OSSL_PKEY_EC_ENCODING_EXPLICIT))
2479         goto err;
2480
2481     if (!TEST_true(EVP_PKEY_get_utf8_string_param(pkeyparam,
2482                        OSSL_PKEY_PARAM_EC_FIELD_TYPE, name, sizeof(name),
2483                        &name_len))
2484         || !TEST_str_eq(name, field_name))
2485         goto err;
2486
2487     if (!TEST_true(EVP_PKEY_get_octet_string_param(pkeyparam,
2488                        OSSL_PKEY_PARAM_EC_GENERATOR, buf, sizeof(buf), &buf_len))
2489         || !TEST_mem_eq(buf, (int)buf_len, gen, gen_size))
2490         goto err;
2491
2492     if (!TEST_true(EVP_PKEY_get_bn_param(pkeyparam, OSSL_PKEY_PARAM_EC_P, &p_out))
2493         || !TEST_BN_eq(p_out, p)
2494         || !TEST_true(EVP_PKEY_get_bn_param(pkeyparam, OSSL_PKEY_PARAM_EC_A,
2495                                             &a_out))
2496         || !TEST_BN_eq(a_out, a)
2497         || !TEST_true(EVP_PKEY_get_bn_param(pkeyparam, OSSL_PKEY_PARAM_EC_B,
2498                                             &b_out))
2499         || !TEST_BN_eq(b_out, b)
2500         || !TEST_true(EVP_PKEY_get_bn_param(pkeyparam, OSSL_PKEY_PARAM_EC_ORDER,
2501                                             &order_out))
2502         || !TEST_BN_eq(order_out, EC_GROUP_get0_order(group)))
2503         goto err;
2504
2505     if (EC_GROUP_get0_cofactor(group) != NULL) {
2506         if (!TEST_true(EVP_PKEY_get_bn_param(pkeyparam,
2507                            OSSL_PKEY_PARAM_EC_COFACTOR, &cofactor_out))
2508             || !TEST_BN_eq(cofactor_out, EC_GROUP_get0_cofactor(group)))
2509             goto err;
2510     }
2511     if (EC_GROUP_get0_seed(group) != NULL) {
2512         if (!TEST_true(EVP_PKEY_get_octet_string_param(pkeyparam,
2513                            OSSL_PKEY_PARAM_EC_SEED, buf, sizeof(buf), &buf_len))
2514             || !TEST_mem_eq(buf, buf_len, EC_GROUP_get0_seed(group),
2515                             EC_GROUP_get_seed_len(group)))
2516             goto err;
2517     }
2518
2519     if (EC_GROUP_get_field_type(group) == NID_X9_62_prime_field) {
2520         /* No extra fields should be set for a prime field */
2521         if (!TEST_false(EVP_PKEY_get_int_param(pkeyparam,
2522                             OSSL_PKEY_PARAM_EC_CHAR2_M, &i_out))
2523             || !TEST_false(EVP_PKEY_get_int_param(pkeyparam,
2524                                OSSL_PKEY_PARAM_EC_CHAR2_TP_BASIS, &i_out))
2525             || !TEST_false(EVP_PKEY_get_int_param(pkeyparam,
2526                                OSSL_PKEY_PARAM_EC_CHAR2_PP_K1, &i_out))
2527             || !TEST_false(EVP_PKEY_get_int_param(pkeyparam,
2528                                OSSL_PKEY_PARAM_EC_CHAR2_PP_K2, &i_out))
2529             || !TEST_false(EVP_PKEY_get_int_param(pkeyparam,
2530                                OSSL_PKEY_PARAM_EC_CHAR2_PP_K3, &i_out))
2531             || !TEST_false(EVP_PKEY_get_utf8_string_param(pkeyparam,
2532                                OSSL_PKEY_PARAM_EC_CHAR2_TYPE, name, sizeof(name),
2533                                &name_len)))
2534             goto err;
2535     } else {
2536 #ifndef OPENSSL_NO_EC2M
2537         if (!TEST_true(EVP_PKEY_get_int_param(pkeyparam,
2538                            OSSL_PKEY_PARAM_EC_CHAR2_M, &i_out))
2539             || !TEST_int_eq(EC_GROUP_get_degree(group), i_out)
2540             || !TEST_true(EVP_PKEY_get_utf8_string_param(pkeyparam,
2541                               OSSL_PKEY_PARAM_EC_CHAR2_TYPE, name, sizeof(name),
2542                               &name_len))
2543             || !TEST_str_eq(name, basis_name))
2544             goto err;
2545
2546         if (EC_GROUP_get_basis_type(group) == NID_X9_62_tpBasis) {
2547             if (!TEST_true(EVP_PKEY_get_int_param(pkeyparam,
2548                                OSSL_PKEY_PARAM_EC_CHAR2_TP_BASIS, &i_out))
2549                 || !TEST_int_eq(k1, i_out)
2550                 || !TEST_false(EVP_PKEY_get_int_param(pkeyparam,
2551                                    OSSL_PKEY_PARAM_EC_CHAR2_PP_K1, &i_out))
2552                 || !TEST_false(EVP_PKEY_get_int_param(pkeyparam,
2553                                    OSSL_PKEY_PARAM_EC_CHAR2_PP_K2, &i_out))
2554                 || !TEST_false(EVP_PKEY_get_int_param(pkeyparam,
2555                                    OSSL_PKEY_PARAM_EC_CHAR2_PP_K3, &i_out)))
2556                 goto err;
2557         } else {
2558             if (!TEST_false(EVP_PKEY_get_int_param(pkeyparam,
2559                                 OSSL_PKEY_PARAM_EC_CHAR2_TP_BASIS, &i_out))
2560                 || !TEST_true(EVP_PKEY_get_int_param(pkeyparam,
2561                                   OSSL_PKEY_PARAM_EC_CHAR2_PP_K1, &i_out))
2562                 || !TEST_int_eq(k1, i_out)
2563                 || !TEST_true(EVP_PKEY_get_int_param(pkeyparam,
2564                                   OSSL_PKEY_PARAM_EC_CHAR2_PP_K2, &i_out))
2565                 || !TEST_int_eq(k2, i_out)
2566                 || !TEST_true(EVP_PKEY_get_int_param(pkeyparam,
2567                                   OSSL_PKEY_PARAM_EC_CHAR2_PP_K3, &i_out))
2568                 || !TEST_int_eq(k3, i_out))
2569                 goto err;
2570         }
2571 #endif /* OPENSSL_NO_EC2M */
2572     }
2573     if (!TEST_ptr(gettable = EVP_PKEY_gettable_params(pkeyparam))
2574         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_GROUP_NAME))
2575         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_ENCODING))
2576         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_FIELD_TYPE))
2577         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_P))
2578         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_A))
2579         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_B))
2580         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_GENERATOR))
2581         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_ORDER))
2582         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_COFACTOR))
2583         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_SEED))
2584 #ifndef OPENSSL_NO_EC2M
2585         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_CHAR2_M))
2586         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_CHAR2_TYPE))
2587         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_CHAR2_TP_BASIS))
2588         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_CHAR2_PP_K1))
2589         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_CHAR2_PP_K2))
2590         || !TEST_ptr(OSSL_PARAM_locate_const(gettable, OSSL_PKEY_PARAM_EC_CHAR2_PP_K3))
2591 #endif
2592         )
2593         goto err;
2594     ret = 1;
2595 err:
2596     BN_free(order_out);
2597     BN_free(cofactor_out);
2598     BN_free(a_out);
2599     BN_free(b_out);
2600     BN_free(p_out);
2601     OSSL_PARAM_free(params);
2602     OSSL_PARAM_BLD_free(bld);
2603     EVP_PKEY_free(pkeyparam);
2604     EVP_PKEY_CTX_free(pctx);
2605     return ret;
2606 }
2607
2608 /*
2609  * check the EC_METHOD respects the supplied EC_GROUP_set_generator G
2610  */
2611 static int custom_generator_test(int id)
2612 {
2613     int ret = 0, nid, bsize;
2614     EC_GROUP *group = NULL;
2615     EC_POINT *G2 = NULL, *Q1 = NULL, *Q2 = NULL;
2616     BN_CTX *ctx = NULL;
2617     BIGNUM *k = NULL;
2618     unsigned char *b1 = NULL, *b2 = NULL;
2619
2620     /* Do some setup */
2621     nid = curves[id].nid;
2622     TEST_note("Curve %s", OBJ_nid2sn(nid));
2623     if (!TEST_ptr(ctx = BN_CTX_new()))
2624         return 0;
2625
2626     BN_CTX_start(ctx);
2627
2628     if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid)))
2629         goto err;
2630
2631     /* expected byte length of encoded points */
2632     bsize = (EC_GROUP_get_degree(group) + 7) / 8;
2633     bsize = 1 + 2 * bsize; /* UNCOMPRESSED_POINT format */
2634
2635     if (!TEST_ptr(k = BN_CTX_get(ctx))
2636         /* fetch a testing scalar k != 0,1 */
2637         || !TEST_true(BN_rand(k, EC_GROUP_order_bits(group) - 1,
2638                               BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ANY))
2639         /* make k even */
2640         || !TEST_true(BN_clear_bit(k, 0))
2641         || !TEST_ptr(G2 = EC_POINT_new(group))
2642         || !TEST_ptr(Q1 = EC_POINT_new(group))
2643         /* Q1 := kG */
2644         || !TEST_true(EC_POINT_mul(group, Q1, k, NULL, NULL, ctx))
2645         /* pull out the bytes of that */
2646         || !TEST_int_eq(EC_POINT_point2oct(group, Q1,
2647                                            POINT_CONVERSION_UNCOMPRESSED, NULL,
2648                                            0, ctx), bsize)
2649         || !TEST_ptr(b1 = OPENSSL_malloc(bsize))
2650         || !TEST_int_eq(EC_POINT_point2oct(group, Q1,
2651                                            POINT_CONVERSION_UNCOMPRESSED, b1,
2652                                            bsize, ctx), bsize)
2653         /* new generator is G2 := 2G */
2654         || !TEST_true(EC_POINT_dbl(group, G2, EC_GROUP_get0_generator(group),
2655                                    ctx))
2656         || !TEST_true(EC_GROUP_set_generator(group, G2,
2657                                              EC_GROUP_get0_order(group),
2658                                              EC_GROUP_get0_cofactor(group)))
2659         || !TEST_ptr(Q2 = EC_POINT_new(group))
2660         || !TEST_true(BN_rshift1(k, k))
2661         /* Q2 := k/2 G2 */
2662         || !TEST_true(EC_POINT_mul(group, Q2, k, NULL, NULL, ctx))
2663         || !TEST_int_eq(EC_POINT_point2oct(group, Q2,
2664                                            POINT_CONVERSION_UNCOMPRESSED, NULL,
2665                                            0, ctx), bsize)
2666         || !TEST_ptr(b2 = OPENSSL_malloc(bsize))
2667         || !TEST_int_eq(EC_POINT_point2oct(group, Q2,
2668                                            POINT_CONVERSION_UNCOMPRESSED, b2,
2669                                            bsize, ctx), bsize)
2670         /* Q1 = kG = k/2 G2 = Q2 should hold */
2671         || !TEST_mem_eq(b1, bsize, b2, bsize))
2672         goto err;
2673
2674     if (!do_test_custom_explicit_fromdata(group, ctx, b1, bsize))
2675         goto err;
2676
2677     ret = 1;
2678
2679  err:
2680     EC_POINT_free(Q1);
2681     EC_POINT_free(Q2);
2682     EC_POINT_free(G2);
2683     EC_GROUP_free(group);
2684     BN_CTX_end(ctx);
2685     BN_CTX_free(ctx);
2686     OPENSSL_free(b1);
2687     OPENSSL_free(b2);
2688
2689     return ret;
2690 }
2691
2692 /*
2693  * check creation of curves from explicit params through the public API
2694  */
2695 static int custom_params_test(int id)
2696 {
2697     int ret = 0, nid, bsize;
2698     const char *curve_name = NULL;
2699     EC_GROUP *group = NULL, *altgroup = NULL;
2700     EC_POINT *G2 = NULL, *Q1 = NULL, *Q2 = NULL;
2701     const EC_POINT *Q = NULL;
2702     BN_CTX *ctx = NULL;
2703     BIGNUM *k = NULL;
2704     unsigned char *buf1 = NULL, *buf2 = NULL;
2705     const BIGNUM *z = NULL, *cof = NULL, *priv1 = NULL;
2706     BIGNUM *p = NULL, *a = NULL, *b = NULL;
2707     int is_prime = 0;
2708     EC_KEY *eckey1 = NULL, *eckey2 = NULL;
2709     EVP_PKEY *pkey1 = NULL, *pkey2 = NULL;
2710     EVP_PKEY_CTX *pctx1 = NULL, *pctx2 = NULL;
2711     size_t sslen, t;
2712     unsigned char *pub1 = NULL , *pub2 = NULL;
2713     OSSL_PARAM_BLD *param_bld = NULL;
2714     OSSL_PARAM *params1 = NULL, *params2 = NULL;
2715
2716     /* Do some setup */
2717     nid = curves[id].nid;
2718     curve_name = OBJ_nid2sn(nid);
2719     TEST_note("Curve %s", curve_name);
2720
2721     if (nid == NID_sm2)
2722         return TEST_skip("custom params not supported with SM2");
2723
2724     if (!TEST_ptr(ctx = BN_CTX_new()))
2725         return 0;
2726
2727     if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid)))
2728         goto err;
2729
2730     is_prime = EC_GROUP_get_field_type(group) == NID_X9_62_prime_field;
2731 #ifdef OPENSSL_NO_EC2M
2732     if (!is_prime) {
2733         ret = TEST_skip("binary curves not supported in this build");
2734         goto err;
2735     }
2736 #endif
2737
2738     BN_CTX_start(ctx);
2739     if (!TEST_ptr(p = BN_CTX_get(ctx))
2740             || !TEST_ptr(a = BN_CTX_get(ctx))
2741             || !TEST_ptr(b = BN_CTX_get(ctx))
2742             || !TEST_ptr(k = BN_CTX_get(ctx)))
2743         goto err;
2744
2745     /* expected byte length of encoded points */
2746     bsize = (EC_GROUP_get_degree(group) + 7) / 8;
2747     bsize = 1 + 2 * bsize; /* UNCOMPRESSED_POINT format */
2748
2749     /* extract parameters from built-in curve */
2750     if (!TEST_true(EC_GROUP_get_curve(group, p, a, b, ctx))
2751             || !TEST_ptr(G2 = EC_POINT_new(group))
2752             /* new generator is G2 := 2G */
2753             || !TEST_true(EC_POINT_dbl(group, G2,
2754                                        EC_GROUP_get0_generator(group), ctx))
2755             /* pull out the bytes of that */
2756             || !TEST_int_eq(EC_POINT_point2oct(group, G2,
2757                                                POINT_CONVERSION_UNCOMPRESSED,
2758                                                NULL, 0, ctx), bsize)
2759             || !TEST_ptr(buf1 = OPENSSL_malloc(bsize))
2760             || !TEST_int_eq(EC_POINT_point2oct(group, G2,
2761                                                POINT_CONVERSION_UNCOMPRESSED,
2762                                                buf1, bsize, ctx), bsize)
2763             || !TEST_ptr(z = EC_GROUP_get0_order(group))
2764             || !TEST_ptr(cof = EC_GROUP_get0_cofactor(group))
2765         )
2766         goto err;
2767
2768     /* create a new group using same params (but different generator) */
2769     if (is_prime) {
2770         if (!TEST_ptr(altgroup = EC_GROUP_new_curve_GFp(p, a, b, ctx)))
2771             goto err;
2772     }
2773 #ifndef OPENSSL_NO_EC2M
2774     else {
2775         if (!TEST_ptr(altgroup = EC_GROUP_new_curve_GF2m(p, a, b, ctx)))
2776             goto err;
2777     }
2778 #endif
2779
2780     /* set 2*G as the generator of altgroup */
2781     EC_POINT_free(G2); /* discard G2 as it refers to the original group */
2782     if (!TEST_ptr(G2 = EC_POINT_new(altgroup))
2783             || !TEST_true(EC_POINT_oct2point(altgroup, G2, buf1, bsize, ctx))
2784             || !TEST_int_eq(EC_POINT_is_on_curve(altgroup, G2, ctx), 1)
2785             || !TEST_true(EC_GROUP_set_generator(altgroup, G2, z, cof))
2786        )
2787         goto err;
2788
2789     /* verify math checks out */
2790     if (/* allocate temporary points on group and altgroup */
2791             !TEST_ptr(Q1 = EC_POINT_new(group))
2792             || !TEST_ptr(Q2 = EC_POINT_new(altgroup))
2793             /* fetch a testing scalar k != 0,1 */
2794             || !TEST_true(BN_rand(k, EC_GROUP_order_bits(group) - 1,
2795                                   BN_RAND_TOP_ONE, BN_RAND_BOTTOM_ANY))
2796             /* make k even */
2797             || !TEST_true(BN_clear_bit(k, 0))
2798             /* Q1 := kG on group */
2799             || !TEST_true(EC_POINT_mul(group, Q1, k, NULL, NULL, ctx))
2800             /* pull out the bytes of that */
2801             || !TEST_int_eq(EC_POINT_point2oct(group, Q1,
2802                                                POINT_CONVERSION_UNCOMPRESSED,
2803                                                NULL, 0, ctx), bsize)
2804             || !TEST_int_eq(EC_POINT_point2oct(group, Q1,
2805                                                POINT_CONVERSION_UNCOMPRESSED,
2806                                                buf1, bsize, ctx), bsize)
2807             /* k := k/2 */
2808             || !TEST_true(BN_rshift1(k, k))
2809             /* Q2 := k/2 G2 on altgroup */
2810             || !TEST_true(EC_POINT_mul(altgroup, Q2, k, NULL, NULL, ctx))
2811             /* pull out the bytes of that */
2812             || !TEST_int_eq(EC_POINT_point2oct(altgroup, Q2,
2813                                                POINT_CONVERSION_UNCOMPRESSED,
2814                                                NULL, 0, ctx), bsize)
2815             || !TEST_ptr(buf2 = OPENSSL_malloc(bsize))
2816             || !TEST_int_eq(EC_POINT_point2oct(altgroup, Q2,
2817                                                POINT_CONVERSION_UNCOMPRESSED,
2818                                                buf2, bsize, ctx), bsize)
2819             /* Q1 = kG = k/2 G2 = Q2 should hold */
2820             || !TEST_mem_eq(buf1, bsize, buf2, bsize))
2821         goto err;
2822
2823     /* create two `EC_KEY`s on altgroup */
2824     if (!TEST_ptr(eckey1 = EC_KEY_new())
2825             || !TEST_true(EC_KEY_set_group(eckey1, altgroup))
2826             || !TEST_true(EC_KEY_generate_key(eckey1))
2827             || !TEST_ptr(eckey2 = EC_KEY_new())
2828             || !TEST_true(EC_KEY_set_group(eckey2, altgroup))
2829             || !TEST_true(EC_KEY_generate_key(eckey2)))
2830         goto err;
2831
2832     /* retrieve priv1 for later */
2833     if (!TEST_ptr(priv1 = EC_KEY_get0_private_key(eckey1)))
2834         goto err;
2835
2836     /*
2837      * retrieve bytes for pub1 for later
2838      *
2839      * We compute the pub key in the original group as we will later use it to
2840      * define a provider key in the built-in group.
2841      */
2842     if (!TEST_true(EC_POINT_mul(group, Q1, priv1, NULL, NULL, ctx))
2843             || !TEST_int_eq(EC_POINT_point2oct(group, Q1,
2844                                                POINT_CONVERSION_UNCOMPRESSED,
2845                                                NULL, 0, ctx), bsize)
2846             || !TEST_ptr(pub1 = OPENSSL_malloc(bsize))
2847             || !TEST_int_eq(EC_POINT_point2oct(group, Q1,
2848                                                POINT_CONVERSION_UNCOMPRESSED,
2849                                                pub1, bsize, ctx), bsize))
2850         goto err;
2851
2852     /* retrieve bytes for pub2 for later */
2853     if (!TEST_ptr(Q = EC_KEY_get0_public_key(eckey2))
2854             || !TEST_int_eq(EC_POINT_point2oct(altgroup, Q,
2855                                                POINT_CONVERSION_UNCOMPRESSED,
2856                                                NULL, 0, ctx), bsize)
2857             || !TEST_ptr(pub2 = OPENSSL_malloc(bsize))
2858             || !TEST_int_eq(EC_POINT_point2oct(altgroup, Q,
2859                                                POINT_CONVERSION_UNCOMPRESSED,
2860                                                pub2, bsize, ctx), bsize))
2861         goto err;
2862
2863     /* create two `EVP_PKEY`s from the `EC_KEY`s */
2864     if(!TEST_ptr(pkey1 = EVP_PKEY_new())
2865             || !TEST_int_eq(EVP_PKEY_assign_EC_KEY(pkey1, eckey1), 1))
2866         goto err;
2867     eckey1 = NULL; /* ownership passed to pkey1 */
2868     if(!TEST_ptr(pkey2 = EVP_PKEY_new())
2869             || !TEST_int_eq(EVP_PKEY_assign_EC_KEY(pkey2, eckey2), 1))
2870         goto err;
2871     eckey2 = NULL; /* ownership passed to pkey2 */
2872
2873     /* Compute keyexchange in both directions */
2874     if (!TEST_ptr(pctx1 = EVP_PKEY_CTX_new(pkey1, NULL))
2875             || !TEST_int_eq(EVP_PKEY_derive_init(pctx1), 1)
2876             || !TEST_int_eq(EVP_PKEY_derive_set_peer(pctx1, pkey2), 1)
2877             || !TEST_int_eq(EVP_PKEY_derive(pctx1, NULL, &sslen), 1)
2878             || !TEST_int_gt(bsize, sslen)
2879             || !TEST_int_eq(EVP_PKEY_derive(pctx1, buf1, &sslen), 1))
2880         goto err;
2881     if (!TEST_ptr(pctx2 = EVP_PKEY_CTX_new(pkey2, NULL))
2882             || !TEST_int_eq(EVP_PKEY_derive_init(pctx2), 1)
2883             || !TEST_int_eq(EVP_PKEY_derive_set_peer(pctx2, pkey1), 1)
2884             || !TEST_int_eq(EVP_PKEY_derive(pctx2, NULL, &t), 1)
2885             || !TEST_int_gt(bsize, t)
2886             || !TEST_int_le(sslen, t)
2887             || !TEST_int_eq(EVP_PKEY_derive(pctx2, buf2, &t), 1))
2888         goto err;
2889
2890     /* Both sides should expect the same shared secret */
2891     if (!TEST_mem_eq(buf1, sslen, buf2, t))
2892         goto err;
2893
2894     /* Build parameters for provider-native keys */
2895     if (!TEST_ptr(param_bld = OSSL_PARAM_BLD_new())
2896             || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(param_bld,
2897                                                           OSSL_PKEY_PARAM_GROUP_NAME,
2898                                                           curve_name, 0))
2899             || !TEST_true(OSSL_PARAM_BLD_push_octet_string(param_bld,
2900                                                            OSSL_PKEY_PARAM_PUB_KEY,
2901                                                            pub1, bsize))
2902             || !TEST_true(OSSL_PARAM_BLD_push_BN(param_bld,
2903                                                  OSSL_PKEY_PARAM_PRIV_KEY,
2904                                                  priv1))
2905             || !TEST_ptr(params1 = OSSL_PARAM_BLD_to_param(param_bld)))
2906         goto err;
2907
2908     OSSL_PARAM_BLD_free(param_bld);
2909     if (!TEST_ptr(param_bld = OSSL_PARAM_BLD_new())
2910             || !TEST_true(OSSL_PARAM_BLD_push_utf8_string(param_bld,
2911                                                           OSSL_PKEY_PARAM_GROUP_NAME,
2912                                                           curve_name, 0))
2913             || !TEST_true(OSSL_PARAM_BLD_push_octet_string(param_bld,
2914                                                            OSSL_PKEY_PARAM_PUB_KEY,
2915                                                            pub2, bsize))
2916             || !TEST_ptr(params2 = OSSL_PARAM_BLD_to_param(param_bld)))
2917         goto err;
2918
2919     /* create two new provider-native `EVP_PKEY`s */
2920     EVP_PKEY_CTX_free(pctx2);
2921     if (!TEST_ptr(pctx2 = EVP_PKEY_CTX_new_from_name(NULL, "EC", NULL))
2922             || !TEST_true(EVP_PKEY_fromdata_init(pctx2))
2923             || !TEST_true(EVP_PKEY_fromdata(pctx2, &pkey1, EVP_PKEY_KEYPAIR,
2924                                             params1))
2925             || !TEST_true(EVP_PKEY_fromdata(pctx2, &pkey2, EVP_PKEY_PUBLIC_KEY,
2926                                             params2)))
2927         goto err;
2928
2929     /* compute keyexchange once more using the provider keys */
2930     EVP_PKEY_CTX_free(pctx1);
2931     if (!TEST_ptr(pctx1 = EVP_PKEY_CTX_new(pkey1, NULL))
2932             || !TEST_int_eq(EVP_PKEY_derive_init(pctx1), 1)
2933             || !TEST_int_eq(EVP_PKEY_derive_set_peer(pctx1, pkey2), 1)
2934             || !TEST_int_eq(EVP_PKEY_derive(pctx1, NULL, &t), 1)
2935             || !TEST_int_gt(bsize, t)
2936             || !TEST_int_le(sslen, t)
2937             || !TEST_int_eq(EVP_PKEY_derive(pctx1, buf1, &t), 1)
2938             /* compare with previous result */
2939             || !TEST_mem_eq(buf1, t, buf2, sslen))
2940         goto err;
2941
2942     ret = 1;
2943
2944  err:
2945     BN_CTX_end(ctx);
2946     BN_CTX_free(ctx);
2947     OSSL_PARAM_BLD_free(param_bld);
2948     OSSL_PARAM_free(params1);
2949     OSSL_PARAM_free(params2);
2950     EC_POINT_free(Q1);
2951     EC_POINT_free(Q2);
2952     EC_POINT_free(G2);
2953     EC_GROUP_free(group);
2954     EC_GROUP_free(altgroup);
2955     OPENSSL_free(buf1);
2956     OPENSSL_free(buf2);
2957     OPENSSL_free(pub1);
2958     OPENSSL_free(pub2);
2959     EC_KEY_free(eckey1);
2960     EC_KEY_free(eckey2);
2961     EVP_PKEY_free(pkey1);
2962     EVP_PKEY_free(pkey2);
2963     EVP_PKEY_CTX_free(pctx1);
2964     EVP_PKEY_CTX_free(pctx2);
2965
2966     return ret;
2967 }
2968
2969 int setup_tests(void)
2970 {
2971     crv_len = EC_get_builtin_curves(NULL, 0);
2972     if (!TEST_ptr(curves = OPENSSL_malloc(sizeof(*curves) * crv_len))
2973         || !TEST_true(EC_get_builtin_curves(curves, crv_len)))
2974         return 0;
2975
2976     ADD_TEST(parameter_test);
2977     ADD_TEST(cofactor_range_test);
2978     ADD_ALL_TESTS(cardinality_test, crv_len);
2979     ADD_TEST(prime_field_tests);
2980 #ifndef OPENSSL_NO_EC2M
2981     ADD_TEST(hybrid_point_encoding_test);
2982     ADD_TEST(char2_field_tests);
2983     ADD_ALL_TESTS(char2_curve_test, OSSL_NELEM(char2_curve_tests));
2984 #endif
2985     ADD_ALL_TESTS(nistp_single_test, OSSL_NELEM(nistp_tests_params));
2986     ADD_ALL_TESTS(internal_curve_test, crv_len);
2987     ADD_ALL_TESTS(internal_curve_test_method, crv_len);
2988     ADD_TEST(group_field_test);
2989     ADD_ALL_TESTS(check_named_curve_test, crv_len);
2990     ADD_ALL_TESTS(check_named_curve_lookup_test, crv_len);
2991     ADD_ALL_TESTS(check_ec_key_field_public_range_test, crv_len);
2992     ADD_ALL_TESTS(check_named_curve_from_ecparameters, crv_len);
2993     ADD_ALL_TESTS(ec_point_hex2point_test, crv_len);
2994     ADD_ALL_TESTS(custom_generator_test, crv_len);
2995     ADD_ALL_TESTS(custom_params_test, crv_len);
2996     return 1;
2997 }
2998
2999 void cleanup_tests(void)
3000 {
3001     OPENSSL_free(curves);
3002 }