/*
- * Originally written by Bodo Moeller for the OpenSSL project.
- */
-/* ====================================================================
- * Copyright (c) 1998-2003 The OpenSSL Project. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in
- * the documentation and/or other materials provided with the
- * distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- * software must display the following acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- * endorse or promote products derived from this software without
- * prior written permission. For written permission, please contact
- * openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- * nor may "OpenSSL" appear in their names without prior written
- * permission of the OpenSSL Project.
+ * Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
*
- * 6. Redistributions of any form whatsoever must retain the following
- * acknowledgment:
- * "This product includes software developed by the OpenSSL Project
- * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com). This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-/* ====================================================================
- * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
- * Binary polynomial ECC support in OpenSSL originally developed by
- * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ * Licensed under the OpenSSL license (the "License"). You may not use
+ * this file except in compliance with the License. You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
*/
#include <string.h>
}
ret->meth = meth;
- ret->order = BN_new();
- if (ret->order == NULL)
- goto err;
- ret->cofactor = BN_new();
- if (ret->cofactor == NULL)
- goto err;
+ if ((ret->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {
+ ret->order = BN_new();
+ if (ret->order == NULL)
+ goto err;
+ ret->cofactor = BN_new();
+ if (ret->cofactor == NULL)
+ goto err;
+ }
ret->asn1_flag = OPENSSL_EC_NAMED_CURVE;
ret->asn1_form = POINT_CONVERSION_UNCOMPRESSED;
if (!meth->group_init(ret))
void EC_pre_comp_free(EC_GROUP *group)
{
switch (group->pre_comp_type) {
- default:
+ case PCT_none:
break;
-#ifdef ECP_NISTZ256_REFERENCE_IMPLEMENTATION
- case pct_nistz256:
+ case PCT_nistz256:
+#ifdef ECP_NISTZ256_ASM
EC_nistz256_pre_comp_free(group->pre_comp.nistz256);
- break;
#endif
+ break;
#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
- case pct_nistp224:
+ case PCT_nistp224:
EC_nistp224_pre_comp_free(group->pre_comp.nistp224);
break;
- case pct_nistp256:
+ case PCT_nistp256:
EC_nistp256_pre_comp_free(group->pre_comp.nistp256);
break;
- case pct_nistp521:
+ case PCT_nistp521:
EC_nistp521_pre_comp_free(group->pre_comp.nistp521);
break;
+#else
+ case PCT_nistp224:
+ case PCT_nistp256:
+ case PCT_nistp521:
+ break;
#endif
- case pct_ec:
+ case PCT_ec:
EC_ec_pre_comp_free(group->pre_comp.ec);
break;
}
if (dest == src)
return 1;
+ dest->curve_name = src->curve_name;
+
/* Copy precomputed */
dest->pre_comp_type = src->pre_comp_type;
switch (src->pre_comp_type) {
- default:
+ case PCT_none:
dest->pre_comp.ec = NULL;
break;
-#ifdef ECP_NISTZ256_REFERENCE_IMPLEMENTATION
- case pct_nistz256:
+ case PCT_nistz256:
+#ifdef ECP_NISTZ256_ASM
dest->pre_comp.nistz256 = EC_nistz256_pre_comp_dup(src->pre_comp.nistz256);
- break;
#endif
+ break;
#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
- case pct_nistp224:
+ case PCT_nistp224:
dest->pre_comp.nistp224 = EC_nistp224_pre_comp_dup(src->pre_comp.nistp224);
break;
- case pct_nistp256:
+ case PCT_nistp256:
dest->pre_comp.nistp256 = EC_nistp256_pre_comp_dup(src->pre_comp.nistp256);
break;
- case pct_nistp521:
+ case PCT_nistp521:
dest->pre_comp.nistp521 = EC_nistp521_pre_comp_dup(src->pre_comp.nistp521);
break;
+#else
+ case PCT_nistp224:
+ case PCT_nistp256:
+ case PCT_nistp521:
+ break;
#endif
- case pct_ec:
+ case PCT_ec:
dest->pre_comp.ec = EC_ec_pre_comp_dup(src->pre_comp.ec);
break;
}
dest->generator = NULL;
}
- if (!BN_copy(dest->order, src->order))
- return 0;
- if (!BN_copy(dest->cofactor, src->cofactor))
- return 0;
+ if ((src->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {
+ if (!BN_copy(dest->order, src->order))
+ return 0;
+ if (!BN_copy(dest->cofactor, src->cofactor))
+ return 0;
+ }
- dest->curve_name = src->curve_name;
dest->asn1_flag = src->asn1_flag;
dest->asn1_form = src->asn1_form;
if (src->seed) {
OPENSSL_free(dest->seed);
- dest->seed = OPENSSL_malloc(src->seed_len);
- if (dest->seed == NULL)
+ if ((dest->seed = OPENSSL_malloc(src->seed_len)) == NULL) {
+ ECerr(EC_F_EC_GROUP_COPY, ERR_R_MALLOC_FAILURE);
return 0;
+ }
if (!memcpy(dest->seed, src->seed, src->seed_len))
return 0;
dest->seed_len = src->seed_len;
return NULL;
if ((t = EC_GROUP_new(a->meth)) == NULL)
- return (NULL);
+ return NULL;
if (!EC_GROUP_copy(t, a))
goto err;
return meth->field_type;
}
+static int ec_precompute_mont_data(EC_GROUP *);
+
int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
const BIGNUM *order, const BIGNUM *cofactor)
{
BN_zero(group->cofactor);
/*
- * We ignore the return value because some groups have an order with
+ * Some groups have an order with
* factors of two, which makes the Montgomery setup fail.
* |group->mont_data| will be NULL in this case.
*/
- ec_precompute_mont_data(group);
+ if (BN_is_odd(group->order)) {
+ return ec_precompute_mont_data(group);
+ }
+ BN_MONT_CTX_free(group->mont_data);
+ group->mont_data = NULL;
return 1;
}
int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx)
{
+ if (group->order == NULL)
+ return 0;
if (!BN_copy(order, group->order))
return 0;
return !BN_is_zero(order);
}
+const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group)
+{
+ return group->order;
+}
+
+int EC_GROUP_order_bits(const EC_GROUP *group)
+{
+ return group->meth->group_order_bits(group);
+}
+
int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor,
BN_CTX *ctx)
{
+
+ if (group->cofactor == NULL)
+ return 0;
if (!BN_copy(cofactor, group->cofactor))
return 0;
return !BN_is_zero(group->cofactor);
}
+const BIGNUM *EC_GROUP_get0_cofactor(const EC_GROUP *group)
+{
+ return group->cofactor;
+}
+
void EC_GROUP_set_curve_name(EC_GROUP *group, int nid)
{
group->curve_name = nid;
if (!len || !p)
return 1;
- if ((group->seed = OPENSSL_malloc(len)) == NULL)
+ if ((group->seed = OPENSSL_malloc(len)) == NULL) {
+ ECerr(EC_F_EC_GROUP_SET_SEED, ERR_R_MALLOC_FAILURE);
return 0;
+ }
memcpy(group->seed, p, len);
group->seed_len = len;
if (EC_GROUP_get_curve_name(a) && EC_GROUP_get_curve_name(b) &&
EC_GROUP_get_curve_name(a) != EC_GROUP_get_curve_name(b))
return 1;
+ if (a->meth->flags & EC_FLAGS_CUSTOM_CURVE)
+ return 0;
if (ctx == NULL)
ctx_new = ctx = BN_CTX_new();
r = 1;
if (!r) {
+ const BIGNUM *ao, *bo, *ac, *bc;
/* compare the order and cofactor */
- if (!EC_GROUP_get_order(a, a1, ctx) ||
- !EC_GROUP_get_order(b, b1, ctx) ||
- !EC_GROUP_get_cofactor(a, a2, ctx) ||
- !EC_GROUP_get_cofactor(b, b2, ctx)) {
+ ao = EC_GROUP_get0_order(a);
+ bo = EC_GROUP_get0_order(b);
+ ac = EC_GROUP_get0_cofactor(a);
+ bc = EC_GROUP_get0_cofactor(b);
+ if (ao == NULL || bo == NULL) {
BN_CTX_end(ctx);
BN_CTX_free(ctx_new);
return -1;
}
- if (BN_cmp(a1, b1) || BN_cmp(a2, b2))
+ if (BN_cmp(ao, bo) || BN_cmp(ac, bc))
r = 1;
}
ECerr(EC_F_EC_POINT_NEW, ERR_R_PASSED_NULL_PARAMETER);
return NULL;
}
- if (group->meth->point_init == 0) {
+ if (group->meth->point_init == NULL) {
ECerr(EC_F_EC_POINT_NEW, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return NULL;
}
- ret = OPENSSL_malloc(sizeof(*ret));
+ ret = OPENSSL_zalloc(sizeof(*ret));
if (ret == NULL) {
ECerr(EC_F_EC_POINT_NEW, ERR_R_MALLOC_FAILURE);
return NULL;
}
ret->meth = group->meth;
+ ret->curve_name = group->curve_name;
if (!ret->meth->point_init(ret)) {
OPENSSL_free(ret);
ECerr(EC_F_EC_POINT_COPY, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if (dest->meth != src->meth) {
+ if (dest->meth != src->meth
+ || (dest->curve_name != src->curve_name
+ && dest->curve_name != 0
+ && src->curve_name != 0)) {
ECerr(EC_F_EC_POINT_COPY, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
t = EC_POINT_new(group);
if (t == NULL)
- return (NULL);
+ return NULL;
r = EC_POINT_copy(t, a);
if (!r) {
EC_POINT_free(t);
ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if (group->meth != point->meth) {
+ if (!ec_point_is_compat(point, group)) {
ECerr(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP,
EC_R_INCOMPATIBLE_OBJECTS);
return 0;
ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if (group->meth != point->meth) {
+ if (!ec_point_is_compat(point, group)) {
ECerr(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP,
EC_R_INCOMPATIBLE_OBJECTS);
return 0;
ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if (group->meth != point->meth) {
+ if (!ec_point_is_compat(point, group)) {
ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP,
EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
- return group->meth->point_set_affine_coordinates(group, point, x, y, ctx);
+ if (!group->meth->point_set_affine_coordinates(group, point, x, y, ctx))
+ return 0;
+
+ if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
+ ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP,
+ EC_R_POINT_IS_NOT_ON_CURVE);
+ return 0;
+ }
+ return 1;
}
#ifndef OPENSSL_NO_EC2M
ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if (group->meth != point->meth) {
+ if (!ec_point_is_compat(point, group)) {
ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M,
EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
- return group->meth->point_set_affine_coordinates(group, point, x, y, ctx);
+ if (!group->meth->point_set_affine_coordinates(group, point, x, y, ctx))
+ return 0;
+
+ if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
+ ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M,
+ EC_R_POINT_IS_NOT_ON_CURVE);
+ return 0;
+ }
+ return 1;
}
#endif
ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if (group->meth != point->meth) {
+ if (!ec_point_is_compat(point, group)) {
ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP,
EC_R_INCOMPATIBLE_OBJECTS);
return 0;
ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if (group->meth != point->meth) {
+ if (!ec_point_is_compat(point, group)) {
ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M,
EC_R_INCOMPATIBLE_OBJECTS);
return 0;
ECerr(EC_F_EC_POINT_ADD, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if ((group->meth != r->meth) || (r->meth != a->meth)
- || (a->meth != b->meth)) {
+ if (!ec_point_is_compat(r, group) || !ec_point_is_compat(a, group)
+ || !ec_point_is_compat(b, group)) {
ECerr(EC_F_EC_POINT_ADD, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
ECerr(EC_F_EC_POINT_DBL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if ((group->meth != r->meth) || (r->meth != a->meth)) {
+ if (!ec_point_is_compat(r, group) || !ec_point_is_compat(a, group)) {
ECerr(EC_F_EC_POINT_DBL, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
ECerr(EC_F_EC_POINT_INVERT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if (group->meth != a->meth) {
+ if (!ec_point_is_compat(a, group)) {
ECerr(EC_F_EC_POINT_INVERT, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if (group->meth != point->meth) {
+ if (!ec_point_is_compat(point, group)) {
ECerr(EC_F_EC_POINT_IS_AT_INFINITY, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
ECerr(EC_F_EC_POINT_IS_ON_CURVE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if (group->meth != point->meth) {
+ if (!ec_point_is_compat(point, group)) {
ECerr(EC_F_EC_POINT_IS_ON_CURVE, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
ECerr(EC_F_EC_POINT_CMP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return -1;
}
- if ((group->meth != a->meth) || (a->meth != b->meth)) {
+ if (!ec_point_is_compat(a, group) || !ec_point_is_compat(b, group)) {
ECerr(EC_F_EC_POINT_CMP, EC_R_INCOMPATIBLE_OBJECTS);
return -1;
}
ECerr(EC_F_EC_POINT_MAKE_AFFINE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
- if (group->meth != point->meth) {
+ if (!ec_point_is_compat(point, group)) {
ECerr(EC_F_EC_POINT_MAKE_AFFINE, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
return 0;
}
for (i = 0; i < num; i++) {
- if (group->meth != points[i]->meth) {
+ if (!ec_point_is_compat(points[i], group)) {
ECerr(EC_F_EC_POINTS_MAKE_AFFINE, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
* ec_precompute_mont_data sets |group->mont_data| from |group->order| and
* returns one on success. On error it returns zero.
*/
-int ec_precompute_mont_data(EC_GROUP *group)
+static int ec_precompute_mont_data(EC_GROUP *group)
{
BN_CTX *ctx = BN_CTX_new();
int ret = 0;
{
return CRYPTO_get_ex_data(&key->ex_data, idx);
}
+
+int ec_group_simple_order_bits(const EC_GROUP *group)
+{
+ if (group->order == NULL)
+ return 0;
+ return BN_num_bits(group->order);
+}
+
+static int ec_field_inverse_mod_ord(const EC_GROUP *group, BIGNUM *r,
+ BIGNUM *x, BN_CTX *ctx)
+{
+ BIGNUM *exp = NULL;
+ BN_CTX *new_ctx = NULL;
+ int ret = 0;
+
+ if (ctx == NULL && (ctx = new_ctx = BN_CTX_secure_new()) == NULL)
+ return 0;
+
+ BN_CTX_start(ctx);
+ exp = BN_CTX_get(ctx);
+ if (exp == NULL)
+ goto err;
+
+ /* Check if optimized inverse is implemented */
+ if (group->mont_data != NULL) {
+ /*-
+ * We want inverse in constant time, therefore we utilize the fact
+ * order must be prime and use Fermats Little Theorem instead.
+ */
+ if (!BN_set_word(exp, 2))
+ goto err;
+ if (!BN_sub(exp, group->order, exp))
+ goto err;
+ /*-
+ * Exponent X is public.
+ * No need for scatter-gather or BN_FLG_CONSTTIME.
+ */
+ if (!BN_mod_exp_mont(r, x, exp, group->order, ctx, group->mont_data))
+ goto err;
+ /* Inverse of zero doesn't exist. Let the fallback catch it. */
+ if (BN_is_zero(r))
+ ret = 0;
+ else
+ ret = 1;
+ }
+
+ /*-
+ * Fallback to classic inverse, blinded.
+ * BN_FLG_CONSTTIME is a don't care here.
+ */
+ if (ret == 0) {
+ do {
+ if (!BN_priv_rand_range(exp, group->order))
+ goto err;
+ } while (BN_is_zero(exp));
+
+ /* r := x * exp */
+ if (!BN_mod_mul(r, x, exp, group->order, ctx))
+ goto err;
+ /* r := 1/(x * exp) */
+ if (!BN_mod_inverse(r, r, group->order, ctx))
+ goto err;
+ /* r := exp/(x * exp) = 1/x */
+ if (!BN_mod_mul(r, r, exp, group->order, ctx))
+ goto err;
+
+ ret = 1;
+ }
+
+ err:
+ BN_CTX_end(ctx);
+ BN_CTX_free(new_ctx);
+ return ret;
+}
+
+int EC_GROUP_do_inverse_ord(const EC_GROUP *group, BIGNUM *res,
+ BIGNUM *x, BN_CTX *ctx)
+{
+ if (group->meth->field_inverse_mod_ord != NULL)
+ return group->meth->field_inverse_mod_ord(group, res, x, ctx);
+ else
+ return ec_field_inverse_mod_ord(group, res, x, ctx);
+}
+
+/*-
+ * Coordinate blinding for EC_POINT.
+ *
+ * The underlying EC_METHOD can optionally implement this function:
+ * underlying implementations should return 0 on errors, or 1 on
+ * success.
+ *
+ * This wrapper returns 1 in case the underlying EC_METHOD does not
+ * support coordinate blinding.
+ */
+int ec_point_blind_coordinates(const EC_GROUP *group, EC_POINT *p, BN_CTX *ctx)
+{
+ if (group->meth->blind_coordinates == NULL)
+ return 1; /* ignore if not implemented */
+
+ return group->meth->blind_coordinates(group, p, ctx);
+}
projects / openssl.git / blobdiff