test/ectest.c

   1 /*
   2  * Copyright 2001-2017 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the OpenSSL license (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 /* ====================================================================
  11  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
  12  *
  13  * Portions of the attached software ("Contribution") are developed by
  14  * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
  15  *
  16  * The Contribution is licensed pursuant to the OpenSSL open source
  17  * license provided above.
  18  *
  19  * The elliptic curve binary polynomial software is originally written by
  20  * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems Laboratories.
  21  *
  22  */
  23
  24 #include "e_os.h"
  25 #include "testutil.h"
  26
  27 #ifndef OPENSSL_NO_EC
  28 # include <openssl/ec.h>
  29 # ifndef OPENSSL_NO_ENGINE
  30 #  include <openssl/engine.h>
  31 # endif
  32 # include <openssl/err.h>
  33 # include <openssl/obj_mac.h>
  34 # include <openssl/objects.h>
  35 # include <openssl/rand.h>
  36 # include <openssl/bn.h>
  37 # include <openssl/opensslconf.h>
  38
  39 # if defined(_MSC_VER) && defined(_MIPS_) && (_MSC_VER/100==12)
  40 /* suppress "too big too optimize" warning */
  41 #  pragma warning(disable:4959)
  42 # endif
  43
  44 static size_t crv_len = 0;
  45 static EC_builtin_curve *curves = NULL;
  46
  47 /* test multiplication with group order, long and negative scalars */
  48 static int group_order_tests(EC_GROUP *group)
  49 {
  50     BIGNUM *n1 = NULL, *n2 = NULL, *order = NULL;
  51     EC_POINT *P = NULL, *Q = NULL, *R = NULL, *S = NULL;
  52     BN_CTX *ctx = NULL;
  53     int i = 0, r = 0;
  54
  55     if (!TEST_ptr(n1 = BN_new())
  56         || !TEST_ptr(n2 = BN_new())
  57         || !TEST_ptr(order = BN_new())
  58         || !TEST_ptr(ctx = BN_CTX_new())
  59         || !TEST_ptr(P = EC_POINT_new(group))
  60         || !TEST_ptr(Q = EC_POINT_new(group))
  61         || !TEST_ptr(R = EC_POINT_new(group))
  62         || !TEST_ptr(S = EC_POINT_new(group)))
  63         goto err;
  64
  65     if (!TEST_true(EC_GROUP_get_order(group, order, ctx))
  66         || !TEST_true(EC_POINT_mul(group, Q, order, NULL, NULL, ctx))
  67         || !TEST_true(EC_POINT_is_at_infinity(group, Q))
  68         || !TEST_true(EC_GROUP_precompute_mult(group, ctx))
  69         || !TEST_true(EC_POINT_mul(group, Q, order, NULL, NULL, ctx))
  70         || !TEST_true(EC_POINT_is_at_infinity(group, Q)))
  71         goto err;
  72
  73     for (i = 1; i <= 2; i++) {
  74         const BIGNUM *scalars[6];
  75         const EC_POINT *points[6];
  76
  77         if (!TEST_true(BN_set_word(n1, i))
  78             /*
  79              * If i == 1, P will be the predefined generator for which
  80              * EC_GROUP_precompute_mult has set up precomputation.
  81              */
  82             || !TEST_true(EC_POINT_mul(group, P, n1, NULL, NULL, ctx))
  83             || !TEST_true(BN_one(n1))
  84             /* n1 = 1 - order */
  85             || !TEST_true(BN_sub(n1, n1, order))
  86             || !TEST_true(EC_POINT_mul(group, Q, NULL, P, n1, ctx))
  87             || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx))
  88
  89             /* n2 = 1 + order */
  90             || !TEST_true(BN_add(n2, order, BN_value_one()))
  91             || !TEST_true(EC_POINT_mul(group, Q, NULL, P, n2, ctx))
  92             || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx))
  93
  94             /* n2 = (1 - order) * (1 + order) = 1 - order^2 */
  95             || !TEST_true(BN_mul(n2, n1, n2, ctx))
  96             || !TEST_true(EC_POINT_mul(group, Q, NULL, P, n2, ctx))
  97             || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx)))
  98             goto err;
  99
 100         /* n2 = order^2 - 1 */
 101         BN_set_negative(n2, 0);
 102         if (!TEST_true(EC_POINT_mul(group, Q, NULL, P, n2, ctx))
 103             /* Add P to verify the result. */
 104             || !TEST_true(EC_POINT_add(group, Q, Q, P, ctx))
 105             || !TEST_true(EC_POINT_is_at_infinity(group, Q))
 106
 107             /* Exercise EC_POINTs_mul, including corner cases. */
 108             || !TEST_false(EC_POINT_is_at_infinity(group, P)))
 109             goto err;
 110
 111         scalars[0] = scalars[1] = BN_value_one();
 112         points[0]  = points[1]  = P;
 113
 114         if (!TEST_true(EC_POINTs_mul(group, R, NULL, 2, points, scalars, ctx))
 115             || !TEST_true(EC_POINT_dbl(group, S, points[0], ctx))
 116             || !TEST_int_eq(0, EC_POINT_cmp(group, R, S, ctx)))
 117             goto err;
 118
 119         scalars[0] = n1;
 120         points[0] = Q;          /* => infinity */
 121         scalars[1] = n2;
 122         points[1] = P;          /* => -P */
 123         scalars[2] = n1;
 124         points[2] = Q;          /* => infinity */
 125         scalars[3] = n2;
 126         points[3] = Q;          /* => infinity */
 127         scalars[4] = n1;
 128         points[4] = P;          /* => P */
 129         scalars[5] = n2;
 130         points[5] = Q;          /* => infinity */
 131         if (!TEST_true(EC_POINTs_mul(group, P, NULL, 6, points, scalars, ctx))
 132             || !TEST_true(EC_POINT_is_at_infinity(group, P)))
 133             goto err;
 134     }
 135
 136     r = 1;
 137 err:
 138     if (r == 0 && i != 0)
 139         TEST_info(i == 1 ? "allowing precomputation" :
 140                            "without precomputation");
 141     EC_POINT_free(P);
 142     EC_POINT_free(Q);
 143     EC_POINT_free(R);
 144     EC_POINT_free(S);
 145     BN_free(n1);
 146     BN_free(n2);
 147     BN_free(order);
 148     BN_CTX_free(ctx);
 149     return r;
 150 }
 151
 152 static int prime_field_tests(void)
 153 {
 154     BN_CTX *ctx = NULL;
 155     BIGNUM *p = NULL, *a = NULL, *b = NULL, *scalar3 = NULL;
 156     EC_GROUP *group = NULL, *tmp = NULL;
 157     EC_GROUP *P_160 = NULL, *P_192 = NULL, *P_224 = NULL,
 158              *P_256 = NULL, *P_384 = NULL, *P_521 = NULL;
 159     EC_POINT *P = NULL, *Q = NULL, *R = NULL;
 160     BIGNUM *x = NULL, *y = NULL, *z = NULL, *yplusone = NULL;
 161     const EC_POINT *points[4];
 162     const BIGNUM *scalars[4];
 163     unsigned char buf[100];
 164     size_t len, r = 0;
 165     int k;
 166
 167     if (!TEST_ptr(ctx = BN_CTX_new())
 168         || !TEST_ptr(p = BN_new())
 169         || !TEST_ptr(a = BN_new())
 170         || !TEST_ptr(b = BN_new())
 171         || !TEST_true(BN_hex2bn(&p, "17"))
 172         || !TEST_true(BN_hex2bn(&a, "1"))
 173         || !TEST_true(BN_hex2bn(&b, "1"))
 174         /*
 175          * applications should use EC_GROUP_new_curve_GFp so
 176          * that the library gets to choose the EC_METHOD
 177          */
 178         || !TEST_ptr(group = EC_GROUP_new(EC_GFp_mont_method()))
 179         || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
 180         || !TEST_ptr(tmp = EC_GROUP_new(EC_GROUP_method_of(group)))
 181         || !TEST_true(EC_GROUP_copy(tmp, group)))
 182         goto err;
 183     EC_GROUP_free(group);
 184     group = tmp;
 185     tmp = NULL;
 186
 187     if (!TEST_true(EC_GROUP_get_curve_GFp(group, p, a, b, ctx)))
 188         goto err;
 189
 190     TEST_info("Curve defined by Weierstrass equation");
 191     TEST_note("     y^2 = x^3 + a*x + b (mod p)");
 192     test_output_bignum("a", a);
 193     test_output_bignum("b", b);
 194     test_output_bignum("p", p);
 195
 196     buf[0] = 0;
 197     if (!TEST_ptr(P = EC_POINT_new(group))
 198         || !TEST_ptr(Q = EC_POINT_new(group))
 199         || !TEST_ptr(R = EC_POINT_new(group))
 200         || !TEST_true(EC_POINT_set_to_infinity(group, P))
 201         || !TEST_true(EC_POINT_is_at_infinity(group, P))
 202         || !TEST_true(EC_POINT_oct2point(group, Q, buf, 1, ctx))
 203         || !TEST_true(EC_POINT_add(group, P, P, Q, ctx))
 204         || !TEST_true(EC_POINT_is_at_infinity(group, P))
 205         || !TEST_ptr(x = BN_new())
 206         || !TEST_ptr(y = BN_new())
 207         || !TEST_ptr(z = BN_new())
 208         || !TEST_ptr(yplusone = BN_new())
 209         || !TEST_true(BN_hex2bn(&x, "D"))
 210         || !TEST_true(EC_POINT_set_compressed_coordinates_GFp(group, Q, x, 1,
 211                                                               ctx)))
 212         goto err;
 213
 214     if (!TEST_int_gt(EC_POINT_is_on_curve(group, Q, ctx), 0)) {
 215         if (!TEST_true(EC_POINT_get_affine_coordinates_GFp(group, Q, x, y,
 216                                                            ctx)))
 217             goto err;
 218         TEST_info("Point is not on curve");
 219         test_output_bignum("x", x);
 220         test_output_bignum("y", y);
 221         goto err;
 222     }
 223
 224     TEST_note("A cyclic subgroup:");
 225     k = 100;
 226     do {
 227         if (!TEST_int_ne(k--, 0))
 228             goto err;
 229
 230         if (EC_POINT_is_at_infinity(group, P)) {
 231             TEST_note("     point at infinity");
 232         } else {
 233             if (!TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y,
 234                                                                ctx)))
 235                 goto err;
 236
 237             test_output_bignum("x", x);
 238             test_output_bignum("y", y);
 239         }
 240
 241         if (!TEST_true(EC_POINT_copy(R, P))
 242             || !TEST_true(EC_POINT_add(group, P, P, Q, ctx)))
 243             goto err;
 244
 245     } while (!EC_POINT_is_at_infinity(group, P));
 246
 247     if (!TEST_true(EC_POINT_add(group, P, Q, R, ctx))
 248         || !TEST_true(EC_POINT_is_at_infinity(group, P)))
 249         goto err;
 250
 251     len =
 252         EC_POINT_point2oct(group, Q, POINT_CONVERSION_COMPRESSED, buf,
 253                            sizeof buf, ctx);
 254     if (!TEST_size_t_ne(len, 0)
 255         || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
 256         || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
 257         goto err;
 258     test_output_memory("Generator as octet string, compressed form:",
 259                        buf, len);
 260
 261     len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_UNCOMPRESSED,
 262                              buf, sizeof buf, ctx);
 263     if (!TEST_size_t_ne(len, 0)
 264         || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
 265         || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
 266         goto err;
 267     test_output_memory("Generator as octet string, uncompressed form:",
 268                        buf, len);
 269
 270     len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_HYBRID,
 271                              buf, sizeof buf, ctx);
 272     if (!TEST_size_t_ne(len, 0)
 273         || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
 274         || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
 275         goto err;
 276     test_output_memory("Generator as octet string, hybrid form:",
 277                        buf, len);
 278
 279     if (!TEST_true(EC_POINT_get_Jprojective_coordinates_GFp(group, R, x, y, z,
 280                                                             ctx)))
 281         goto err;
 282     TEST_info("A representation of the inverse of that generator in");
 283     TEST_note("Jacobian projective coordinates");
 284     test_output_bignum("x", x);
 285     test_output_bignum("y", y);
 286     test_output_bignum("z", z);
 287
 288     if (!TEST_true(EC_POINT_invert(group, P, ctx))
 289         || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx))
 290
 291     /*
 292      * Curve secp160r1 (Certicom Research SEC 2 Version 1.0, section 2.4.2,
 293      * 2000) -- not a NIST curve, but commonly used
 294      */
 295
 296         || !TEST_true(BN_hex2bn(&p,                         "FFFFFFFF"
 297                                     "FFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF"))
 298         || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
 299         || !TEST_true(BN_hex2bn(&a,                         "FFFFFFFF"
 300                                     "FFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC"))
 301         || !TEST_true(BN_hex2bn(&b,                         "1C97BEFC"
 302                                     "54BD7A8B65ACF89F81D4D4ADC565FA45"))
 303         || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
 304         || !TEST_true(BN_hex2bn(&x,                         "4A96B568"
 305                                     "8EF573284664698968C38BB913CBFC82"))
 306         || !TEST_true(BN_hex2bn(&y,                         "23a62855"
 307                                     "3168947d59dcc912042351377ac5fb32"))
 308         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
 309     /*
 310      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 311      * and therefore setting the coordinates should fail.
 312      */
 313         || !TEST_false(EC_POINT_set_affine_coordinates_GFp(group, P, x,
 314                                                            yplusone, ctx))
 315         || !TEST_true(EC_POINT_set_affine_coordinates_GFp(group, P, x, y, ctx))
 316         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 317         || !TEST_true(BN_hex2bn(&z,                       "0100000000"
 318                                     "000000000001F4C8F927AED3CA752257"))
 319         || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
 320         || !TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)))
 321         goto err;
 322     TEST_info("SEC2 curve secp160r1 -- Generator");
 323     test_output_bignum("x", x);
 324     test_output_bignum("y", y);
 325     /* G_y value taken from the standard: */
 326     if (!TEST_true(BN_hex2bn(&z,                         "23a62855"
 327                                  "3168947d59dcc912042351377ac5fb32"))
 328         || !TEST_BN_eq(y, z)
 329         || !TEST_int_eq(EC_GROUP_get_degree(group), 160)
 330         || !group_order_tests(group)
 331         || !TEST_ptr(P_160 = EC_GROUP_new(EC_GROUP_method_of(group)))
 332         || !TEST_true(EC_GROUP_copy(P_160, group))
 333
 334     /* Curve P-192 (FIPS PUB 186-2, App. 6) */
 335
 336         || !TEST_true(BN_hex2bn(&p,                 "FFFFFFFFFFFFFFFF"
 337                                     "FFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF"))
 338         || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
 339         || !TEST_true(BN_hex2bn(&a,                 "FFFFFFFFFFFFFFFF"
 340                                     "FFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC"))
 341         || !TEST_true(BN_hex2bn(&b,                 "64210519E59C80E7"
 342                                     "0FA7E9AB72243049FEB8DEECC146B9B1"))
 343         || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
 344         || !TEST_true(BN_hex2bn(&x,                 "188DA80EB03090F6"
 345                                     "7CBF20EB43A18800F4FF0AFD82FF1012"))
 346         || !TEST_true(EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1,
 347                                                               ctx))
 348         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 349         || !TEST_true(BN_hex2bn(&z,                 "FFFFFFFFFFFFFFFF"
 350                                     "FFFFFFFF99DEF836146BC9B1B4D22831"))
 351         || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
 352         || !TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)))
 353         goto err;
 354
 355     TEST_info("NIST curve P-192 -- Generator");
 356     test_output_bignum("x", x);
 357     test_output_bignum("y", y);
 358     /* G_y value taken from the standard: */
 359     if (!TEST_true(BN_hex2bn(&z,                 "07192B95FFC8DA78"
 360                                  "631011ED6B24CDD573F977A11E794811"))
 361         || !TEST_BN_eq(y, z)
 362         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
 363     /*
 364      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 365      * and therefore setting the coordinates should fail.
 366      */
 367         || !TEST_false(EC_POINT_set_affine_coordinates_GFp(group, P, x,
 368                                                            yplusone, ctx))
 369         || !TEST_int_eq(EC_GROUP_get_degree(group), 192)
 370         || !group_order_tests(group)
 371         || !TEST_ptr(P_192 = EC_GROUP_new(EC_GROUP_method_of(group)))
 372         || !TEST_true(EC_GROUP_copy(P_192, group))
 373
 374     /* Curve P-224 (FIPS PUB 186-2, App. 6) */
 375
 376         || !TEST_true(BN_hex2bn(&p,         "FFFFFFFFFFFFFFFFFFFFFFFF"
 377                                     "FFFFFFFF000000000000000000000001"))
 378         || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
 379         || !TEST_true(BN_hex2bn(&a,         "FFFFFFFFFFFFFFFFFFFFFFFF"
 380                                     "FFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE"))
 381         || !TEST_true(BN_hex2bn(&b,         "B4050A850C04B3ABF5413256"
 382                                     "5044B0B7D7BFD8BA270B39432355FFB4"))
 383         || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
 384         || !TEST_true(BN_hex2bn(&x,         "B70E0CBD6BB4BF7F321390B9"
 385                                     "4A03C1D356C21122343280D6115C1D21"))
 386         || !TEST_true(EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0,
 387                                                               ctx))
 388         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 389         || !TEST_true(BN_hex2bn(&z,         "FFFFFFFFFFFFFFFFFFFFFFFF"
 390                                     "FFFF16A2E0B8F03E13DD29455C5C2A3D"))
 391         || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
 392         || !TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)))
 393         goto err;
 394
 395     TEST_info("NIST curve P-224 -- Generator");
 396     test_output_bignum("x", x);
 397     test_output_bignum("y", y);
 398     /* G_y value taken from the standard: */
 399     if (!TEST_true(BN_hex2bn(&z,         "BD376388B5F723FB4C22DFE6"
 400                                  "CD4375A05A07476444D5819985007E34"))
 401         || !TEST_BN_eq(y, z)
 402         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
 403     /*
 404      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 405      * and therefore setting the coordinates should fail.
 406      */
 407         || !TEST_false(EC_POINT_set_affine_coordinates_GFp(group, P, x,
 408                                                            yplusone, ctx))
 409         || !TEST_int_eq(EC_GROUP_get_degree(group), 224)
 410         || !group_order_tests(group)
 411         || !TEST_ptr(P_224 = EC_GROUP_new(EC_GROUP_method_of(group)))
 412         || !TEST_true(EC_GROUP_copy(P_224, group))
 413
 414     /* Curve P-256 (FIPS PUB 186-2, App. 6) */
 415
 416         || !TEST_true(BN_hex2bn(&p, "FFFFFFFF000000010000000000000000"
 417                                     "00000000FFFFFFFFFFFFFFFFFFFFFFFF"))
 418         || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
 419         || !TEST_true(BN_hex2bn(&a, "FFFFFFFF000000010000000000000000"
 420                                     "00000000FFFFFFFFFFFFFFFFFFFFFFFC"))
 421         || !TEST_true(BN_hex2bn(&b, "5AC635D8AA3A93E7B3EBBD55769886BC"
 422                                     "651D06B0CC53B0F63BCE3C3E27D2604B"))
 423         || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
 424
 425         || !TEST_true(BN_hex2bn(&x, "6B17D1F2E12C4247F8BCE6E563A440F2"
 426                                     "77037D812DEB33A0F4A13945D898C296"))
 427         || !TEST_true(EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1,
 428                                                               ctx))
 429         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 430         || !TEST_true(BN_hex2bn(&z, "FFFFFFFF00000000FFFFFFFFFFFFFFFF"
 431                                     "BCE6FAADA7179E84F3B9CAC2FC632551"))
 432         || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
 433         || !TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)))
 434         goto err;
 435
 436     TEST_info("NIST curve P-256 -- Generator");
 437     test_output_bignum("x", x);
 438     test_output_bignum("y", y);
 439     /* G_y value taken from the standard: */
 440     if (!TEST_true(BN_hex2bn(&z, "4FE342E2FE1A7F9B8EE7EB4A7C0F9E16"
 441                                  "2BCE33576B315ECECBB6406837BF51F5"))
 442         || !TEST_BN_eq(y, z)
 443         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
 444     /*
 445      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 446      * and therefore setting the coordinates should fail.
 447      */
 448         || !TEST_false(EC_POINT_set_affine_coordinates_GFp(group, P, x,
 449                                                            yplusone, ctx))
 450         || !TEST_int_eq(EC_GROUP_get_degree(group), 256)
 451         || !group_order_tests(group)
 452         || !TEST_ptr(P_256 = EC_GROUP_new(EC_GROUP_method_of(group)))
 453         || !TEST_true(EC_GROUP_copy(P_256, group))
 454
 455     /* Curve P-384 (FIPS PUB 186-2, App. 6) */
 456
 457         || !TEST_true(BN_hex2bn(&p, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 458                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE"
 459                                     "FFFFFFFF0000000000000000FFFFFFFF"))
 460         || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
 461         || !TEST_true(BN_hex2bn(&a, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 462                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE"
 463                                     "FFFFFFFF0000000000000000FFFFFFFC"))
 464         || !TEST_true(BN_hex2bn(&b, "B3312FA7E23EE7E4988E056BE3F82D19"
 465                                     "181D9C6EFE8141120314088F5013875A"
 466                                     "C656398D8A2ED19D2A85C8EDD3EC2AEF"))
 467         || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
 468
 469         || !TEST_true(BN_hex2bn(&x, "AA87CA22BE8B05378EB1C71EF320AD74"
 470                                     "6E1D3B628BA79B9859F741E082542A38"
 471                                     "5502F25DBF55296C3A545E3872760AB7"))
 472         || !TEST_true(EC_POINT_set_compressed_coordinates_GFp(group, P, x, 1,
 473                                                               ctx))
 474         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 475         || !TEST_true(BN_hex2bn(&z, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 476                                     "FFFFFFFFFFFFFFFFC7634D81F4372DDF"
 477                                     "581A0DB248B0A77AECEC196ACCC52973"))
 478         || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
 479         || !TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)))
 480         goto err;
 481
 482     TEST_info("NIST curve P-384 -- Generator");
 483     test_output_bignum("x", x);
 484     test_output_bignum("y", y);
 485     /* G_y value taken from the standard: */
 486     if (!TEST_true(BN_hex2bn(&z, "3617DE4A96262C6F5D9E98BF9292DC29"
 487                                  "F8F41DBD289A147CE9DA3113B5F0B8C0"
 488                                  "0A60B1CE1D7E819D7A431D7C90EA0E5F"))
 489         || !TEST_BN_eq(y, z)
 490         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
 491     /*
 492      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 493      * and therefore setting the coordinates should fail.
 494      */
 495         || !TEST_false(EC_POINT_set_affine_coordinates_GFp(group, P, x,
 496                                                            yplusone, ctx))
 497         || !TEST_int_eq(EC_GROUP_get_degree(group), 384)
 498         || !group_order_tests(group)
 499         || !TEST_ptr(P_384 = EC_GROUP_new(EC_GROUP_method_of(group)))
 500         || !TEST_true(EC_GROUP_copy(P_384, group))
 501
 502     /* Curve P-521 (FIPS PUB 186-2, App. 6) */
 503         || !TEST_true(BN_hex2bn(&p,                              "1FF"
 504                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 505                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 506                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 507                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"))
 508         || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
 509         || !TEST_true(BN_hex2bn(&a,                              "1FF"
 510                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 511                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 512                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 513                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC"))
 514         || !TEST_true(BN_hex2bn(&b,                              "051"
 515                                     "953EB9618E1C9A1F929A21A0B68540EE"
 516                                     "A2DA725B99B315F3B8B489918EF109E1"
 517                                     "56193951EC7E937B1652C0BD3BB1BF07"
 518                                     "3573DF883D2C34F1EF451FD46B503F00"))
 519         || !TEST_true(EC_GROUP_set_curve_GFp(group, p, a, b, ctx))
 520         || !TEST_true(BN_hex2bn(&x,                               "C6"
 521                                     "858E06B70404E9CD9E3ECB662395B442"
 522                                     "9C648139053FB521F828AF606B4D3DBA"
 523                                     "A14B5E77EFE75928FE1DC127A2FFA8DE"
 524                                     "3348B3C1856A429BF97E7E31C2E5BD66"))
 525         || !TEST_true(EC_POINT_set_compressed_coordinates_GFp(group, P, x, 0,
 526                                                               ctx))
 527         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 528         || !TEST_true(BN_hex2bn(&z,                              "1FF"
 529                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 530                                     "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA"
 531                                     "51868783BF2F966B7FCC0148F709A5D0"
 532                                     "3BB5C9B8899C47AEBB6FB71E91386409"))
 533         || !TEST_true(EC_GROUP_set_generator(group, P, z, BN_value_one()))
 534         || !TEST_true(EC_POINT_get_affine_coordinates_GFp(group, P, x, y, ctx)))
 535         goto err;
 536
 537     TEST_info("NIST curve P-521 -- Generator");
 538     test_output_bignum("x", x);
 539     test_output_bignum("y", y);
 540     /* G_y value taken from the standard: */
 541     if (!TEST_true(BN_hex2bn(&z,                              "118"
 542                                  "39296A789A3BC0045C8A5FB42C7D1BD9"
 543                                  "98F54449579B446817AFBD17273E662C"
 544                                  "97EE72995EF42640C550B9013FAD0761"
 545                                  "353C7086A272C24088BE94769FD16650"))
 546         || !TEST_BN_eq(y, z)
 547         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
 548     /*
 549      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 550      * and therefore setting the coordinates should fail.
 551      */
 552         || !TEST_false(EC_POINT_set_affine_coordinates_GFp(group, P, x,
 553                                                            yplusone, ctx))
 554         || !TEST_int_eq(EC_GROUP_get_degree(group), 521)
 555         || !group_order_tests(group)
 556         || !TEST_ptr(P_521 = EC_GROUP_new(EC_GROUP_method_of(group)))
 557         || !TEST_true(EC_GROUP_copy(P_521, group))
 558
 559     /* more tests using the last curve */
 560
 561     /* Restore the point that got mangled in the (x, y + 1) test. */
 562         || !TEST_true(EC_POINT_set_affine_coordinates_GFp(group, P, x, y, ctx))
 563         || !TEST_true(EC_POINT_copy(Q, P))
 564         || !TEST_false(EC_POINT_is_at_infinity(group, Q))
 565         || !TEST_true(EC_POINT_dbl(group, P, P, ctx))
 566         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 567         || !TEST_true(EC_POINT_invert(group, Q, ctx))       /* P = -2Q */
 568         || !TEST_true(EC_POINT_add(group, R, P, Q, ctx))
 569         || !TEST_true(EC_POINT_add(group, R, R, Q, ctx))
 570         || !TEST_true(EC_POINT_is_at_infinity(group, R))    /* R = P + 2Q */
 571         || !TEST_false(EC_POINT_is_at_infinity(group, Q)))
 572         goto err;
 573     points[0] = Q;
 574     points[1] = Q;
 575     points[2] = Q;
 576     points[3] = Q;
 577
 578     if (!TEST_true(EC_GROUP_get_order(group, z, ctx))
 579         || !TEST_true(BN_add(y, z, BN_value_one()))
 580         || !TEST_BN_even(y)
 581         || !TEST_true(BN_rshift1(y, y)))
 582         goto err;
 583     scalars[0] = y;         /* (group order + 1)/2, so y*Q + y*Q = Q */
 584     scalars[1] = y;
 585
 586     TEST_note("combined multiplication ...");
 587
 588     /* z is still the group order */
 589     if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
 590         || !TEST_true(EC_POINTs_mul(group, R, z, 2, points, scalars, ctx))
 591         || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx))
 592         || !TEST_int_eq(0, EC_POINT_cmp(group, R, Q, ctx))
 593         || !TEST_true(BN_pseudo_rand(y, BN_num_bits(y), 0, 0))
 594         || !TEST_true(BN_add(z, z, y)))
 595         goto err;
 596     BN_set_negative(z, 1);
 597     scalars[0] = y;
 598     scalars[1] = z;         /* z = -(order + y) */
 599
 600     if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
 601         || !TEST_true(EC_POINT_is_at_infinity(group, P))
 602         || !TEST_true(BN_pseudo_rand(x, BN_num_bits(y) - 1, 0, 0))
 603         || !TEST_true(BN_add(z, x, y)))
 604         goto err;
 605     BN_set_negative(z, 1);
 606     scalars[0] = x;
 607     scalars[1] = y;
 608     scalars[2] = z;         /* z = -(x+y) */
 609
 610     if (!TEST_ptr(scalar3 = BN_new()))
 611         goto err;
 612     BN_zero(scalar3);
 613     scalars[3] = scalar3;
 614
 615     if (!TEST_true(EC_POINTs_mul(group, P, NULL, 4, points, scalars, ctx))
 616         || !TEST_true(EC_POINT_is_at_infinity(group, P)))
 617         goto err;
 618
 619     TEST_note(" ok\n");
 620
 621
 622     r = 1;
 623 err:
 624     BN_CTX_free(ctx);
 625     BN_free(p);
 626     BN_free(a);
 627     BN_free(b);
 628     EC_GROUP_free(group);
 629     EC_GROUP_free(tmp);
 630     EC_POINT_free(P);
 631     EC_POINT_free(Q);
 632     EC_POINT_free(R);
 633     BN_free(x);
 634     BN_free(y);
 635     BN_free(z);
 636     BN_free(yplusone);
 637     BN_free(scalar3);
 638
 639     EC_GROUP_free(P_160);
 640     EC_GROUP_free(P_192);
 641     EC_GROUP_free(P_224);
 642     EC_GROUP_free(P_256);
 643     EC_GROUP_free(P_384);
 644     EC_GROUP_free(P_521);
 645     return r;
 646 }
 647
 648 # ifndef OPENSSL_NO_EC2M
 649
 650 static struct c2_curve_test {
 651     const char *name;
 652     const char *p;
 653     const char *a;
 654     const char *b;
 655     const char *x;
 656     const char *y;
 657     int ybit;
 658     const char *order;
 659     const char *cof;
 660     int degree;
 661 } char2_curve_tests[] = {
 662     /* Curve K-163 (FIPS PUB 186-2, App. 6) */
 663     {
 664         "NIST curve K-163",
 665         "0800000000000000000000000000000000000000C9",
 666         "1",
 667         "1",
 668         "02FE13C0537BBC11ACAA07D793DE4E6D5E5C94EEE8",
 669         "0289070FB05D38FF58321F2E800536D538CCDAA3D9",
 670         1, "04000000000000000000020108A2E0CC0D99F8A5EF", "2", 163
 671     },
 672     /* Curve B-163 (FIPS PUB 186-2, App. 6) */
 673     {
 674         "NIST curve B-163",
 675         "0800000000000000000000000000000000000000C9",
 676         "1",
 677         "020A601907B8C953CA1481EB10512F78744A3205FD",
 678         "03F0EBA16286A2D57EA0991168D4994637E8343E36",
 679         "00D51FBC6C71A0094FA2CDD545B11C5C0C797324F1",
 680         1, "040000000000000000000292FE77E70C12A4234C33", "2", 163
 681     },
 682     /* Curve K-233 (FIPS PUB 186-2, App. 6) */
 683     {
 684         "NIST curve K-233",
 685         "020000000000000000000000000000000000000004000000000000000001",
 686         "0",
 687         "1",
 688         "017232BA853A7E731AF129F22FF4149563A419C26BF50A4C9D6EEFAD6126",
 689         "01DB537DECE819B7F70F555A67C427A8CD9BF18AEB9B56E0C11056FAE6A3",
 690         0,
 691         "008000000000000000000000000000069D5BB915BCD46EFB1AD5F173ABDF",
 692         "4", 233
 693     },
 694     /* Curve B-233 (FIPS PUB 186-2, App. 6) */
 695     {
 696         "NIST curve B-233",
 697         "020000000000000000000000000000000000000004000000000000000001",
 698         "000000000000000000000000000000000000000000000000000000000001",
 699         "0066647EDE6C332C7F8C0923BB58213B333B20E9CE4281FE115F7D8F90AD",
 700         "00FAC9DFCBAC8313BB2139F1BB755FEF65BC391F8B36F8F8EB7371FD558B",
 701         "01006A08A41903350678E58528BEBF8A0BEFF867A7CA36716F7E01F81052",
 702         1,
 703         "01000000000000000000000000000013E974E72F8A6922031D2603CFE0D7",
 704         "2", 233
 705     },
 706     /* Curve K-283 (FIPS PUB 186-2, App. 6) */
 707     {
 708         "NIST curve K-283",
 709                                                                 "08000000"
 710         "00000000000000000000000000000000000000000000000000000000000010A1",
 711         "0",
 712         "1",
 713                                                                 "0503213F"
 714         "78CA44883F1A3B8162F188E553CD265F23C1567A16876913B0C2AC2458492836",
 715                                                                 "01CCDA38"
 716         "0F1C9E318D90F95D07E5426FE87E45C0E8184698E45962364E34116177DD2259",
 717         0,
 718                                                                 "01FFFFFF"
 719         "FFFFFFFFFFFFFFFFFFFFFFFFFFFFE9AE2ED07577265DFF7F94451E061E163C61",
 720         "4", 283
 721     },
 722     /* Curve B-283 (FIPS PUB 186-2, App. 6) */
 723     {
 724         "NIST curve B-283",
 725                                                                 "08000000"
 726         "00000000000000000000000000000000000000000000000000000000000010A1",
 727                                                                 "00000000"
 728         "0000000000000000000000000000000000000000000000000000000000000001",
 729                                                                 "027B680A"
 730         "C8B8596DA5A4AF8A19A0303FCA97FD7645309FA2A581485AF6263E313B79A2F5",
 731                                                                 "05F93925"
 732         "8DB7DD90E1934F8C70B0DFEC2EED25B8557EAC9C80E2E198F8CDBECD86B12053",
 733                                                                 "03676854"
 734         "FE24141CB98FE6D4B20D02B4516FF702350EDDB0826779C813F0DF45BE8112F4",
 735         1,
 736                                                                 "03FFFFFF"
 737         "FFFFFFFFFFFFFFFFFFFFFFFFFFFFEF90399660FC938A90165B042A7CEFADB307",
 738         "2", 283
 739     },
 740     /* Curve K-409 (FIPS PUB 186-2, App. 6) */
 741     {
 742         "NIST curve K-409",
 743                                 "0200000000000000000000000000000000000000"
 744         "0000000000000000000000000000000000000000008000000000000000000001",
 745         "0",
 746         "1",
 747                                 "0060F05F658F49C1AD3AB1890F7184210EFD0987"
 748         "E307C84C27ACCFB8F9F67CC2C460189EB5AAAA62EE222EB1B35540CFE9023746",
 749                                 "01E369050B7C4E42ACBA1DACBF04299C3460782F"
 750         "918EA427E6325165E9EA10E3DA5F6C42E9C55215AA9CA27A5863EC48D8E0286B",
 751         1,
 752                                 "007FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
 753         "FFFFFFFFFFFFFE5F83B2D4EA20400EC4557D5ED3E3E7CA5B4B5C83B8E01E5FCF",
 754         "4", 409
 755     },
 756     /* Curve B-409 (FIPS PUB 186-2, App. 6) */
 757     {
 758         "NIST curve B-409",
 759                                 "0200000000000000000000000000000000000000"
 760         "0000000000000000000000000000000000000000008000000000000000000001",
 761                                 "0000000000000000000000000000000000000000"
 762         "0000000000000000000000000000000000000000000000000000000000000001",
 763                                 "0021A5C2C8EE9FEB5C4B9A753B7B476B7FD6422E"
 764         "F1F3DD674761FA99D6AC27C8A9A197B272822F6CD57A55AA4F50AE317B13545F",
 765                                 "015D4860D088DDB3496B0C6064756260441CDE4A"
 766         "F1771D4DB01FFE5B34E59703DC255A868A1180515603AEAB60794E54BB7996A7",
 767                                 "0061B1CFAB6BE5F32BBFA78324ED106A7636B9C5"
 768         "A7BD198D0158AA4F5488D08F38514F1FDF4B4F40D2181B3681C364BA0273C706",
 769         1,
 770                                 "0100000000000000000000000000000000000000"
 771         "00000000000001E2AAD6A612F33307BE5FA47C3C9E052F838164CD37D9A21173",
 772         "2", 409
 773     },
 774     /* Curve K-571 (FIPS PUB 186-2, App. 6) */
 775     {
 776         "NIST curve K-571",
 777                                                          "800000000000000"
 778         "0000000000000000000000000000000000000000000000000000000000000000"
 779         "0000000000000000000000000000000000000000000000000000000000000425",
 780         "0",
 781         "1",
 782                                                         "026EB7A859923FBC"
 783         "82189631F8103FE4AC9CA2970012D5D46024804801841CA44370958493B205E6"
 784         "47DA304DB4CEB08CBBD1BA39494776FB988B47174DCA88C7E2945283A01C8972",
 785                                                         "0349DC807F4FBF37"
 786         "4F4AEADE3BCA95314DD58CEC9F307A54FFC61EFC006D8A2C9D4979C0AC44AEA7"
 787         "4FBEBBB9F772AEDCB620B01A7BA7AF1B320430C8591984F601CD4C143EF1C7A3",
 788         0,
 789                                                         "0200000000000000"
 790         "00000000000000000000000000000000000000000000000000000000131850E1"
 791         "F19A63E4B391A8DB917F4138B630D84BE5D639381E91DEB45CFE778F637C1001",
 792         "4", 571
 793     },
 794     /* Curve B-571 (FIPS PUB 186-2, App. 6) */
 795     {
 796         "NIST curve B-571",
 797                                                          "800000000000000"
 798         "0000000000000000000000000000000000000000000000000000000000000000"
 799         "0000000000000000000000000000000000000000000000000000000000000425",
 800                                                         "0000000000000000"
 801         "0000000000000000000000000000000000000000000000000000000000000000"
 802         "0000000000000000000000000000000000000000000000000000000000000001",
 803                                                         "02F40E7E2221F295"
 804         "DE297117B7F3D62F5C6A97FFCB8CEFF1CD6BA8CE4A9A18AD84FFABBD8EFA5933"
 805         "2BE7AD6756A66E294AFD185A78FF12AA520E4DE739BACA0C7FFEFF7F2955727A",
 806                                                         "0303001D34B85629"
 807         "6C16C0D40D3CD7750A93D1D2955FA80AA5F40FC8DB7B2ABDBDE53950F4C0D293"
 808         "CDD711A35B67FB1499AE60038614F1394ABFA3B4C850D927E1E7769C8EEC2D19",
 809                                                         "037BF27342DA639B"
 810         "6DCCFFFEB73D69D78C6C27A6009CBBCA1980F8533921E8A684423E43BAB08A57"
 811         "6291AF8F461BB2A8B3531D2F0485C19B16E2F1516E23DD3C1A4827AF1B8AC15B",
 812         1,
 813                                                         "03FFFFFFFFFFFFFF"
 814         "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE661CE18"
 815         "FF55987308059B186823851EC7DD9CA1161DE93D5174D66E8382E9BB2FE84E47",
 816         "2", 571
 817     }
 818 };
 819
 820 static int char2_curve_test(int n)
 821 {
 822     int r = 0;
 823     BN_CTX *ctx = NULL;
 824     BIGNUM *p = NULL, *a = NULL, *b = NULL;
 825     BIGNUM *x = NULL, *y = NULL, *z = NULL, *cof = NULL, *yplusone = NULL;
 826     EC_GROUP *group = NULL, *variable = NULL;
 827     EC_POINT *P = NULL, *Q = NULL, *R = NULL;
 828     const EC_POINT *points[3];
 829     const BIGNUM *scalars[3];
 830     struct c2_curve_test *const test = char2_curve_tests + n;
 831
 832     if (!TEST_ptr(ctx = BN_CTX_new())
 833         || !TEST_ptr(p = BN_new())
 834         || !TEST_ptr(a = BN_new())
 835         || !TEST_ptr(b = BN_new())
 836         || !TEST_ptr(x = BN_new())
 837         || !TEST_ptr(y = BN_new())
 838         || !TEST_ptr(z = BN_new())
 839         || !TEST_ptr(yplusone = BN_new())
 840         || !TEST_true(BN_hex2bn(&p, test->p))
 841         || !TEST_true(BN_hex2bn(&a, test->a))
 842         || !TEST_true(BN_hex2bn(&b, test->b))
 843         || !TEST_true(group = EC_GROUP_new(EC_GF2m_simple_method()))
 844         || !TEST_true(EC_GROUP_set_curve_GF2m(group, p, a, b, ctx))
 845         || !TEST_ptr(P = EC_POINT_new(group))
 846         || !TEST_ptr(Q = EC_POINT_new(group))
 847         || !TEST_ptr(R = EC_POINT_new(group))
 848         || !TEST_true(BN_hex2bn(&x, test->x))
 849         || !TEST_true(BN_hex2bn(&y, test->y))
 850         || !TEST_true(BN_add(yplusone, y, BN_value_one())))
 851         goto err;
 852
 853 /* Change test based on whether binary point compression is enabled or not. */
 854 # ifdef OPENSSL_EC_BIN_PT_COMP
 855     /*
 856      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 857      * and therefore setting the coordinates should fail.
 858      */
 859     if (!TEST_false(EC_POINT_set_affine_coordinates_GF2m(group, P, x, yplusone,
 860                                                          ctx))
 861         || !TEST_true(EC_POINT_set_compressed_coordinates_GF2m(group, P, x,
 862                                                                test->y_bit,
 863                                                                ctx))
 864         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 865         || !TEST_true(BN_hex2bn(&z, test->order))
 866         || !TEST_true(BN_hex2bn(&cof, test->cof))
 867         || !TEST_true(EC_GROUP_set_generator(group, P, z, cof))
 868         || !TEST_true(EC_POINT_get_affine_coordinates_GF2m(group, P, x, y,
 869                                                            ctx)))
 870         goto err;
 871     TEST_info("%s -- Generator", test->name);
 872     test_output_bignum("x", x);
 873     test_output_bignum("y", y);
 874     /* G_y value taken from the standard: */
 875     if (!TEST_true(BN_hex2bn(&z, test->y))
 876         || !TEST_BN_eq(y, z))
 877         goto err;
 878 # else
 879     /*
 880      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
 881      * and therefore setting the coordinates should fail.
 882      */
 883     if (!TEST_false(EC_POINT_set_affine_coordinates_GF2m(group, P, x, yplusone,
 884                     ctx))
 885         || !TEST_true(EC_POINT_set_affine_coordinates_GF2m(group, P, x, y, ctx))
 886         || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 887         || !TEST_true(BN_hex2bn(&z, test->order))
 888         || !TEST_true(BN_hex2bn(&cof, test->cof))
 889         || !TEST_true(EC_GROUP_set_generator(group, P, z, cof)))
 890         goto err;
 891     TEST_info("%s -- Generator:", test->name);
 892     test_output_bignum("x", x);
 893     test_output_bignum("y", y);
 894 # endif
 895
 896     if (!TEST_int_eq(EC_GROUP_get_degree(group), test->degree)
 897         || !group_order_tests(group)
 898         || !TEST_ptr(variable = EC_GROUP_new(EC_GROUP_method_of(group)))
 899         || !TEST_true(EC_GROUP_copy(variable, group)))
 900         goto err;
 901
 902     /* more tests using the last curve */
 903     if (n == OSSL_NELEM(char2_curve_tests) - 1) {
 904         if (!TEST_true(EC_POINT_set_affine_coordinates_GF2m(group, P, x, y,
 905                                                                 ctx))
 906             || !TEST_true(EC_POINT_copy(Q, P))
 907             || !TEST_false(EC_POINT_is_at_infinity(group, Q))
 908             || !TEST_true(EC_POINT_dbl(group, P, P, ctx))
 909             || !TEST_int_gt(EC_POINT_is_on_curve(group, P, ctx), 0)
 910             || !TEST_true(EC_POINT_invert(group, Q, ctx))       /* P = -2Q */
 911             || !TEST_true(EC_POINT_add(group, R, P, Q, ctx))
 912             || !TEST_true(EC_POINT_add(group, R, R, Q, ctx))
 913             || !TEST_true(EC_POINT_is_at_infinity(group, R))   /* R = P + 2Q */
 914             || !TEST_false(EC_POINT_is_at_infinity(group, Q)))
 915             goto err;
 916
 917         points[0] = Q;
 918         points[1] = Q;
 919         points[2] = Q;
 920
 921         if (!TEST_true(BN_add(y, z, BN_value_one()))
 922             || !TEST_BN_even(y)
 923             || !TEST_true(BN_rshift1(y, y)))
 924             goto err;
 925         scalars[0] = y;         /* (group order + 1)/2, so y*Q + y*Q = Q */
 926         scalars[1] = y;
 927
 928         TEST_note("combined multiplication ...");
 929
 930         /* z is still the group order */
 931         if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
 932             || !TEST_true(EC_POINTs_mul(group, R, z, 2, points, scalars, ctx))
 933             || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx))
 934             || !TEST_int_eq(0, EC_POINT_cmp(group, R, Q, ctx)))
 935             goto err;
 936
 937         if (!TEST_true(BN_pseudo_rand(y, BN_num_bits(y), 0, 0))
 938             || !TEST_true(BN_add(z, z, y)))
 939             goto err;
 940         BN_set_negative(z, 1);
 941         scalars[0] = y;
 942         scalars[1] = z;         /* z = -(order + y) */
 943
 944         if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
 945             || !TEST_true(EC_POINT_is_at_infinity(group, P)))
 946             goto err;
 947
 948         if (!TEST_true(BN_pseudo_rand(x, BN_num_bits(y) - 1, 0, 0))
 949             || !TEST_true(BN_add(z, x, y)))
 950             goto err;
 951         BN_set_negative(z, 1);
 952         scalars[0] = x;
 953         scalars[1] = y;
 954         scalars[2] = z;         /* z = -(x+y) */
 955
 956         if (!TEST_true(EC_POINTs_mul(group, P, NULL, 3, points, scalars, ctx))
 957             || !TEST_true(EC_POINT_is_at_infinity(group, P)))
 958             goto err;;
 959     }
 960
 961     r = 1;
 962 err:
 963     BN_CTX_free(ctx);
 964     BN_free(p);
 965     BN_free(a);
 966     BN_free(b);
 967     BN_free(x);
 968     BN_free(y);
 969     BN_free(z);
 970     BN_free(yplusone);
 971     BN_free(cof);
 972     EC_POINT_free(P);
 973     EC_POINT_free(Q);
 974     EC_POINT_free(R);
 975     EC_GROUP_free(group);
 976     EC_GROUP_free(variable);
 977     return r;
 978 }
 979
 980 static int char2_field_tests(void)
 981 {
 982     BN_CTX *ctx = NULL;
 983     BIGNUM *p = NULL, *a = NULL, *b = NULL;
 984     EC_GROUP *group = NULL, *tmp = NULL;
 985     EC_POINT *P = NULL, *Q = NULL, *R = NULL;
 986     BIGNUM *x = NULL, *y = NULL, *z = NULL, *cof = NULL, *yplusone = NULL;
 987     unsigned char buf[100];
 988     size_t len;
 989     int k, r = 0;
 990
 991     if (!TEST_ptr(ctx = BN_CTX_new())
 992         || !TEST_ptr(p = BN_new())
 993         || !TEST_ptr(a = BN_new())
 994         || !TEST_ptr(b = BN_new())
 995         || !TEST_true(BN_hex2bn(&p, "13"))
 996         || !TEST_true(BN_hex2bn(&a, "3"))
 997         || !TEST_true(BN_hex2bn(&b, "1")))
 998         goto err;
 999
1000     group = EC_GROUP_new(EC_GF2m_simple_method()); /* applications should use
1001                                                     * EC_GROUP_new_curve_GF2m
1002                                                     * so that the library gets
1003                                                     * to choose the EC_METHOD */
1004     if (!TEST_ptr(group)
1005         || !TEST_true(EC_GROUP_set_curve_GF2m(group, p, a, b, ctx))
1006         || !TEST_ptr(tmp = EC_GROUP_new(EC_GROUP_method_of(group)))
1007         || !TEST_true(EC_GROUP_copy(tmp, group)))
1008         goto err;
1009     EC_GROUP_free(group);
1010     group = tmp;
1011     tmp = NULL;
1012
1013     if (!TEST_true(EC_GROUP_get_curve_GF2m(group, p, a, b, ctx)))
1014         goto err;
1015
1016     TEST_info("Curve defined by Weierstrass equation");
1017     TEST_note("     y^2 + x*y = x^3 + a*x^2 + b (mod p)");
1018     test_output_bignum("a", a);
1019     test_output_bignum("b", b);
1020     test_output_bignum("p", p);
1021
1022      if (!TEST_ptr(P = EC_POINT_new(group))
1023         || !TEST_ptr(Q = EC_POINT_new(group))
1024         || !TEST_ptr(R = EC_POINT_new(group))
1025         || !TEST_true(EC_POINT_set_to_infinity(group, P))
1026         || !TEST_true(EC_POINT_is_at_infinity(group, P)))
1027         goto err;
1028
1029     buf[0] = 0;
1030     if (!TEST_true(EC_POINT_oct2point(group, Q, buf, 1, ctx))
1031         || !TEST_true(EC_POINT_add(group, P, P, Q, ctx))
1032         || !TEST_true(EC_POINT_is_at_infinity(group, P))
1033         || !TEST_ptr(x = BN_new())
1034         || !TEST_ptr(y = BN_new())
1035         || !TEST_ptr(z = BN_new())
1036         || !TEST_ptr(cof = BN_new())
1037         || !TEST_ptr(yplusone = BN_new())
1038         || !TEST_true(BN_hex2bn(&x, "6"))
1039 /* Change test based on whether binary point compression is enabled or not. */
1040 #  ifdef OPENSSL_EC_BIN_PT_COMP
1041         || !TEST_true(EC_POINT_set_compressed_coordinates_GF2m(group, Q, x, 1,
1042                                                                ctx))
1043 #  else
1044         || !TEST_true(BN_hex2bn(&y, "8"))
1045         || !TEST_true(EC_POINT_set_affine_coordinates_GF2m(group, Q, x, y, ctx))
1046 #  endif
1047        )
1048         goto err;
1049     if (!TEST_int_gt(EC_POINT_is_on_curve(group, Q, ctx), 0)) {
1050 /* Change test based on whether binary point compression is enabled or not. */
1051 #  ifdef OPENSSL_EC_BIN_PT_COMP
1052         if (!TEST_true(EC_POINT_get_affine_coordinates_GF2m(group, Q, x, y,
1053                                                             ctx)))
1054             goto err;
1055 #  endif
1056         TEST_info("Point is not on curve");
1057         test_output_bignum("x", x);
1058         test_output_bignum("y", y);
1059         goto err;
1060     }
1061
1062     TEST_note("A cyclic subgroup:");
1063     k = 100;
1064     do {
1065         if (!TEST_int_ne(k--, 0))
1066             goto err;
1067
1068         if (EC_POINT_is_at_infinity(group, P))
1069             TEST_note("     point at infinity");
1070         else {
1071             if (!TEST_true(EC_POINT_get_affine_coordinates_GF2m(group, P, x, y,
1072                                                                 ctx)))
1073                 goto err;
1074
1075             test_output_bignum("x", x);
1076             test_output_bignum("y", y);
1077         }
1078
1079         if (!TEST_true(EC_POINT_copy(R, P))
1080             || !TEST_true(EC_POINT_add(group, P, P, Q, ctx)))
1081             goto err;
1082     }
1083     while (!EC_POINT_is_at_infinity(group, P));
1084
1085     if (!TEST_true(EC_POINT_add(group, P, Q, R, ctx))
1086         || !TEST_true(EC_POINT_is_at_infinity(group, P)))
1087         goto err;
1088
1089 /* Change test based on whether binary point compression is enabled or not. */
1090 #  ifdef OPENSSL_EC_BIN_PT_COMP
1091     len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_COMPRESSED,
1092                              buf, sizeof buf, ctx);
1093     if (!TEST_size_t_ne(len, 0)
1094         || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
1095         || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
1096         goto err;
1097     test_output_memory("Generator as octet string, compressed form:",
1098                        buf, len);
1099 #  endif
1100
1101     len = EC_POINT_point2oct(group, Q, POINT_CONVERSION_UNCOMPRESSED,
1102                              buf, sizeof buf, ctx);
1103     if (!TEST_size_t_ne(len, 0)
1104         || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
1105         || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
1106         goto err;
1107     test_output_memory("Generator as octet string, uncompressed form:",
1108                        buf, len);
1109
1110 /* Change test based on whether binary point compression is enabled or not. */
1111 #  ifdef OPENSSL_EC_BIN_PT_COMP
1112     len =
1113         EC_POINT_point2oct(group, Q, POINT_CONVERSION_HYBRID, buf, sizeof buf,
1114                            ctx);
1115     if (!TEST_size_t_ne(len, 0)
1116         || !TEST_true(EC_POINT_oct2point(group, P, buf, len, ctx))
1117         || !TEST_int_eq(0, EC_POINT_cmp(group, P, Q, ctx)))
1118         goto err;
1119     test_output_memory("Generator as octet string, hybrid form:",
1120                        buf, len);
1121 #  endif
1122
1123     if (!TEST_true(EC_POINT_invert(group, P, ctx))
1124         || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx)))
1125         goto err;
1126
1127     TEST_note("\n");
1128
1129     r = 1;
1130 err:
1131     BN_CTX_free(ctx);
1132     BN_free(p);
1133     BN_free(a);
1134     BN_free(b);
1135     EC_GROUP_free(group);
1136     EC_GROUP_free(tmp);
1137     EC_POINT_free(P);
1138     EC_POINT_free(Q);
1139     EC_POINT_free(R);
1140     BN_free(x);
1141     BN_free(y);
1142     BN_free(z);
1143     BN_free(cof);
1144     BN_free(yplusone);
1145     return r;
1146 }
1147 # endif
1148
1149 static int internal_curve_test(int n)
1150 {
1151     EC_GROUP *group = NULL;
1152     int nid = curves[n].nid;
1153
1154     if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))) {
1155         TEST_info("EC_GROUP_new_curve_name() failed with curve %s\n",
1156                   OBJ_nid2sn(nid));
1157         return 0;
1158     }
1159     if (!TEST_true(EC_GROUP_check(group, NULL))) {
1160         TEST_info("EC_GROUP_check() failed with curve %s\n", OBJ_nid2sn(nid));
1161         EC_GROUP_free(group);
1162         return 0;
1163     }
1164     EC_GROUP_free(group);
1165     return 1;
1166 }
1167
1168 static int internal_curve_test_method(int n)
1169 {
1170     int r, nid = curves[n].nid;
1171     EC_GROUP *group;
1172
1173     /*
1174      * Skip for X25519 because low level operations such as EC_POINT_mul()
1175      * are not supported for this curve
1176      */
1177     if (nid == NID_X25519)
1178         return 1;
1179     if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))) {
1180         TEST_info("Curve %s failed\n", OBJ_nid2sn(nid));
1181         return 0;
1182     }
1183     r = group_order_tests(group);
1184     EC_GROUP_free(group);
1185     return r;
1186 }
1187
1188 # ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
1189 /*
1190  * nistp_test_params contains magic numbers for testing our optimized
1191  * implementations of several NIST curves with characteristic > 3.
1192  */
1193 struct nistp_test_params {
1194     const EC_METHOD *(*meth) ();
1195     int degree;
1196     /*
1197      * Qx, Qy and D are taken from
1198      * http://csrc.nist.gov/groups/ST/toolkit/documents/Examples/ECDSA_Prime.pdf
1199      * Otherwise, values are standard curve parameters from FIPS 180-3
1200      */
1201     const char *p, *a, *b, *Qx, *Qy, *Gx, *Gy, *order, *d;
1202 };
1203
1204 static const struct nistp_test_params nistp_tests_params[] = {
1205     {
1206      /* P-224 */
1207      EC_GFp_nistp224_method,
1208      224,
1209      /* p */
1210      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001",
1211      /* a */
1212      "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE",
1213      /* b */
1214      "B4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4",
1215      /* Qx */
1216      "E84FB0B8E7000CB657D7973CF6B42ED78B301674276DF744AF130B3E",
1217      /* Qy */
1218      "4376675C6FC5612C21A0FF2D2A89D2987DF7A2BC52183B5982298555",
1219      /* Gx */
1220      "B70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21",
1221      /* Gy */
1222      "BD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34",
1223      /* order */
1224      "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D",
1225      /* d */
1226      "3F0C488E987C80BE0FEE521F8D90BE6034EC69AE11CA72AA777481E8",
1227      },
1228     {
1229      /* P-256 */
1230      EC_GFp_nistp256_method,
1231      256,
1232      /* p */
1233      "ffffffff00000001000000000000000000000000ffffffffffffffffffffffff",
1234      /* a */
1235      "ffffffff00000001000000000000000000000000fffffffffffffffffffffffc",
1236      /* b */
1237      "5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
1238      /* Qx */
1239      "b7e08afdfe94bad3f1dc8c734798ba1c62b3a0ad1e9ea2a38201cd0889bc7a19",
1240      /* Qy */
1241      "3603f747959dbf7a4bb226e41928729063adc7ae43529e61b563bbc606cc5e09",
1242      /* Gx */
1243      "6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
1244      /* Gy */
1245      "4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5",
1246      /* order */
1247      "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551",
1248      /* d */
1249      "c477f9f65c22cce20657faa5b2d1d8122336f851a508a1ed04e479c34985bf96",
1250      },
1251     {
1252      /* P-521 */
1253      EC_GFp_nistp521_method,
1254      521,
1255      /* p */
1256                                                                   "1ff"
1257      "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
1258      "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
1259      /* a */
1260                                                                   "1ff"
1261      "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
1262      "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc",
1263      /* b */
1264                                                                   "051"
1265      "953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e1"
1266      "56193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00",
1267      /* Qx */
1268                                                                  "0098"
1269      "e91eef9a68452822309c52fab453f5f117c1da8ed796b255e9ab8f6410cca16e"
1270      "59df403a6bdc6ca467a37056b1e54b3005d8ac030decfeb68df18b171885d5c4",
1271      /* Qy */
1272                                                                  "0164"
1273      "350c321aecfc1cca1ba4364c9b15656150b4b78d6a48d7d28e7f31985ef17be8"
1274      "554376b72900712c4b83ad668327231526e313f5f092999a4632fd50d946bc2e",
1275      /* Gx */
1276                                                                    "c6"
1277      "858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dba"
1278      "a14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66",
1279      /* Gy */
1280                                                                   "118"
1281      "39296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c"
1282      "97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650",
1283      /* order */
1284                                                                   "1ff"
1285      "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa"
1286      "51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409",
1287      /* d */
1288                                                                  "0100"
1289      "085f47b8e1b8b11b7eb33028c0b2888e304bfc98501955b45bba1478dc184eee"
1290      "df09b86a5f7c21994406072787205e69a63709fe35aa93ba333514b24f961722",
1291      },
1292 };
1293
1294 static int nistp_single_test(int idx)
1295 {
1296     const struct nistp_test_params *test = nistp_tests_params + idx;
1297     BN_CTX *ctx = NULL;
1298     BIGNUM *p = NULL, *a = NULL, *b = NULL, *x = NULL, *y = NULL;
1299     BIGNUM *n = NULL, *m = NULL, *order = NULL, *yplusone = NULL;
1300     EC_GROUP *NISTP = NULL;
1301     EC_POINT *G = NULL, *P = NULL, *Q = NULL, *Q_CHECK = NULL;
1302     int r = 0;
1303
1304     TEST_note("NIST curve P-%d (optimised implementation):",
1305               test->degree);
1306     if (!TEST_ptr(ctx = BN_CTX_new())
1307         || !TEST_ptr(p = BN_new())
1308         || !TEST_ptr(a = BN_new())
1309         || !TEST_ptr(b = BN_new())
1310         || !TEST_ptr(x = BN_new())
1311         || !TEST_ptr(y = BN_new())
1312         || !TEST_ptr(m = BN_new())
1313         || !TEST_ptr(n = BN_new())
1314         || !TEST_ptr(order = BN_new())
1315         || !TEST_ptr(yplusone = BN_new())
1316
1317         || !TEST_ptr(NISTP = EC_GROUP_new(test->meth()))
1318         || !TEST_true(BN_hex2bn(&p, test->p))
1319         || !TEST_int_eq(1, BN_is_prime_ex(p, BN_prime_checks, ctx, NULL))
1320         || !TEST_true(BN_hex2bn(&a, test->a))
1321         || !TEST_true(BN_hex2bn(&b, test->b))
1322         || !TEST_true(EC_GROUP_set_curve_GFp(NISTP, p, a, b, ctx))
1323         || !TEST_ptr(G = EC_POINT_new(NISTP))
1324         || !TEST_ptr(P = EC_POINT_new(NISTP))
1325         || !TEST_ptr(Q = EC_POINT_new(NISTP))
1326         || !TEST_ptr(Q_CHECK = EC_POINT_new(NISTP))
1327         || !TEST_true(BN_hex2bn(&x, test->Qx))
1328         || !TEST_true(BN_hex2bn(&y, test->Qy))
1329         || !TEST_true(BN_add(yplusone, y, BN_value_one()))
1330     /*
1331      * When (x, y) is on the curve, (x, y + 1) is, as it happens, not,
1332      * and therefore setting the coordinates should fail.
1333      */
1334         || !TEST_false(EC_POINT_set_affine_coordinates_GFp(NISTP, Q_CHECK, x,
1335                                                            yplusone, ctx))
1336         || !TEST_true(EC_POINT_set_affine_coordinates_GFp(NISTP, Q_CHECK, x, y,
1337                                                           ctx))
1338         || !TEST_true(BN_hex2bn(&x, test->Gx))
1339         || !TEST_true(BN_hex2bn(&y, test->Gy))
1340         || !TEST_true(EC_POINT_set_affine_coordinates_GFp(NISTP, G, x, y, ctx))
1341         || !TEST_true(BN_hex2bn(&order, test->order))
1342         || !TEST_true(EC_GROUP_set_generator(NISTP, G, order, BN_value_one()))
1343         || !TEST_int_eq(EC_GROUP_get_degree(NISTP), test->degree))
1344         goto err;
1345
1346     TEST_note("NIST test vectors ... ");
1347     if (!TEST_true(BN_hex2bn(&n, test->d)))
1348         goto err;
1349     /* fixed point multiplication */
1350     EC_POINT_mul(NISTP, Q, n, NULL, NULL, ctx);
1351     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
1352         goto err;
1353     /* random point multiplication */
1354     EC_POINT_mul(NISTP, Q, NULL, G, n, ctx);
1355     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
1356
1357         /* set generator to P = 2*G, where G is the standard generator */
1358         || !TEST_true(EC_POINT_dbl(NISTP, P, G, ctx))
1359         || !TEST_true(EC_GROUP_set_generator(NISTP, P, order, BN_value_one()))
1360         /* set the scalar to m=n/2, where n is the NIST test scalar */
1361         || !TEST_true(BN_rshift(m, n, 1)))
1362         goto err;
1363
1364     /* test the non-standard generator */
1365     /* fixed point multiplication */
1366     EC_POINT_mul(NISTP, Q, m, NULL, NULL, ctx);
1367     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
1368         goto err;
1369     /* random point multiplication */
1370     EC_POINT_mul(NISTP, Q, NULL, P, m, ctx);
1371     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
1372
1373     /*
1374      * We have not performed precomputation so have_precompute mult should be
1375      * false
1376      */
1377         || !TEST_false(EC_GROUP_have_precompute_mult(NISTP))
1378
1379     /* now repeat all tests with precomputation */
1380         || !TEST_true(EC_GROUP_precompute_mult(NISTP, ctx))
1381         || !TEST_true(EC_GROUP_have_precompute_mult(NISTP)))
1382         goto err;
1383
1384     /* fixed point multiplication */
1385     EC_POINT_mul(NISTP, Q, m, NULL, NULL, ctx);
1386     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
1387         goto err;
1388     /* random point multiplication */
1389     EC_POINT_mul(NISTP, Q, NULL, P, m, ctx);
1390     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx))
1391
1392     /* reset generator */
1393         || !TEST_true(EC_GROUP_set_generator(NISTP, G, order, BN_value_one())))
1394         goto err;
1395     /* fixed point multiplication */
1396     EC_POINT_mul(NISTP, Q, n, NULL, NULL, ctx);
1397     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
1398         goto err;
1399     /* random point multiplication */
1400     EC_POINT_mul(NISTP, Q, NULL, G, n, ctx);
1401     if (!TEST_int_eq(0, EC_POINT_cmp(NISTP, Q, Q_CHECK, ctx)))
1402         goto err;
1403
1404     r = group_order_tests(NISTP);
1405 err:
1406     EC_GROUP_free(NISTP);
1407     EC_POINT_free(G);
1408     EC_POINT_free(P);
1409     EC_POINT_free(Q);
1410     EC_POINT_free(Q_CHECK);
1411     BN_free(n);
1412     BN_free(m);
1413     BN_free(p);
1414     BN_free(a);
1415     BN_free(b);
1416     BN_free(x);
1417     BN_free(y);
1418     BN_free(order);
1419     BN_free(yplusone);
1420     BN_CTX_free(ctx);
1421     return r;
1422 }
1423 # endif
1424
1425 static int parameter_test(void)
1426 {
1427     EC_GROUP *group = NULL, *group2 = NULL;
1428     ECPARAMETERS *ecparameters = NULL;
1429     int r;
1430
1431     r = TEST_ptr(group = EC_GROUP_new_by_curve_name(NID_secp112r1))
1432         && TEST_ptr(ecparameters = EC_GROUP_get_ecparameters(group, NULL))
1433         && TEST_ptr(group2 = EC_GROUP_new_from_ecparameters(ecparameters))
1434         && TEST_int_eq(EC_GROUP_cmp(group, group2, NULL), 0);
1435
1436     EC_GROUP_free(group);
1437     EC_GROUP_free(group2);
1438     ECPARAMETERS_free(ecparameters);
1439     return r;
1440 }
1441
1442 static const char rnd_seed[] =
1443     "string to make the random number generator think it has entropy";
1444 #endif
1445
1446 int test_main(int argc, char *argv[])
1447 {
1448     int result = EXIT_SUCCESS;
1449 #ifndef OPENSSL_NO_EC
1450
1451     crv_len = EC_get_builtin_curves(NULL, 0);
1452     if (!TEST_ptr(curves = OPENSSL_malloc(sizeof(*curves) * crv_len))
1453         || !TEST_true(EC_get_builtin_curves(curves, crv_len)))
1454         return EXIT_FAILURE;
1455
1456     RAND_seed(rnd_seed, sizeof rnd_seed); /* or BN_generate_prime may fail */
1457
1458     ADD_TEST(parameter_test);
1459     ADD_TEST(prime_field_tests);
1460 # ifndef OPENSSL_NO_EC2M
1461     ADD_TEST(char2_field_tests);
1462     ADD_ALL_TESTS(char2_curve_test, OSSL_NELEM(char2_curve_tests));
1463 # endif
1464 # ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
1465     ADD_ALL_TESTS(nistp_single_test, OSSL_NELEM(nistp_tests_params));
1466 # endif
1467     ADD_ALL_TESTS(internal_curve_test, crv_len);
1468     ADD_ALL_TESTS(internal_curve_test_method, crv_len);
1469
1470     result = run_tests(argv[0]);
1471     OPENSSL_free(curves);
1472 #endif
1473     return result;
1474 }