* Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
*
- * Licensed under the OpenSSL license (the "License"). You may not use
+ * Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
return group->curve_name;
}
+const BIGNUM *EC_GROUP_get0_field(const EC_GROUP *group)
+{
+ return group->field;
+}
+
void EC_GROUP_set_asn1_flag(EC_GROUP *group, int flag)
{
group->asn1_flag = flag;
return group->seed_len;
}
-int EC_GROUP_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
- const BIGNUM *b, BN_CTX *ctx)
+int EC_GROUP_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
+ const BIGNUM *b, BN_CTX *ctx)
{
if (group->meth->group_set_curve == 0) {
- ECerr(EC_F_EC_GROUP_SET_CURVE_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+ ECerr(EC_F_EC_GROUP_SET_CURVE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
return group->meth->group_set_curve(group, p, a, b, ctx);
}
-int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
- BIGNUM *b, BN_CTX *ctx)
+int EC_GROUP_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b,
+ BN_CTX *ctx)
{
- if (group->meth->group_get_curve == 0) {
- ECerr(EC_F_EC_GROUP_GET_CURVE_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+ if (group->meth->group_get_curve == NULL) {
+ ECerr(EC_F_EC_GROUP_GET_CURVE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
return group->meth->group_get_curve(group, p, a, b, ctx);
}
-#ifndef OPENSSL_NO_EC2M
+#if !OPENSSL_API_3
+int EC_GROUP_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
+ const BIGNUM *b, BN_CTX *ctx)
+{
+ return EC_GROUP_set_curve(group, p, a, b, ctx);
+}
+
+int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
+ BIGNUM *b, BN_CTX *ctx)
+{
+ return EC_GROUP_get_curve(group, p, a, b, ctx);
+}
+
+# ifndef OPENSSL_NO_EC2M
int EC_GROUP_set_curve_GF2m(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
const BIGNUM *b, BN_CTX *ctx)
{
- if (group->meth->group_set_curve == 0) {
- ECerr(EC_F_EC_GROUP_SET_CURVE_GF2M,
- ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
- return 0;
- }
- return group->meth->group_set_curve(group, p, a, b, ctx);
+ return EC_GROUP_set_curve(group, p, a, b, ctx);
}
int EC_GROUP_get_curve_GF2m(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
BIGNUM *b, BN_CTX *ctx)
{
- if (group->meth->group_get_curve == 0) {
- ECerr(EC_F_EC_GROUP_GET_CURVE_GF2M,
- ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
- return 0;
- }
- return group->meth->group_get_curve(group, p, a, b, ctx);
+ return EC_GROUP_get_curve(group, p, a, b, ctx);
}
+# endif
#endif
int EC_GROUP_get_degree(const EC_GROUP *group)
y, z, ctx);
}
-int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group,
- EC_POINT *point, const BIGNUM *x,
- const BIGNUM *y, BN_CTX *ctx)
+int EC_POINT_set_affine_coordinates(const EC_GROUP *group, EC_POINT *point,
+ const BIGNUM *x, const BIGNUM *y,
+ BN_CTX *ctx)
{
- if (group->meth->point_set_affine_coordinates == 0) {
- ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP,
+ if (group->meth->point_set_affine_coordinates == NULL) {
+ ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES,
ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
if (!ec_point_is_compat(point, group)) {
- ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP,
- EC_R_INCOMPATIBLE_OBJECTS);
+ ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
if (!group->meth->point_set_affine_coordinates(group, point, x, y, ctx))
return 0;
if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
- ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP,
- EC_R_POINT_IS_NOT_ON_CURVE);
+ ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES, EC_R_POINT_IS_NOT_ON_CURVE);
return 0;
}
return 1;
}
-#ifndef OPENSSL_NO_EC2M
+#if !OPENSSL_API_3
+int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group,
+ EC_POINT *point, const BIGNUM *x,
+ const BIGNUM *y, BN_CTX *ctx)
+{
+ return EC_POINT_set_affine_coordinates(group, point, x, y, ctx);
+}
+
+# ifndef OPENSSL_NO_EC2M
int EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP *group,
EC_POINT *point, const BIGNUM *x,
const BIGNUM *y, BN_CTX *ctx)
{
- if (group->meth->point_set_affine_coordinates == 0) {
- ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M,
+ return EC_POINT_set_affine_coordinates(group, point, x, y, ctx);
+}
+# endif
+#endif
+
+int EC_POINT_get_affine_coordinates(const EC_GROUP *group,
+ const EC_POINT *point, BIGNUM *x, BIGNUM *y,
+ BN_CTX *ctx)
+{
+ if (group->meth->point_get_affine_coordinates == NULL) {
+ ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES,
ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return 0;
}
if (!ec_point_is_compat(point, group)) {
- ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M,
- EC_R_INCOMPATIBLE_OBJECTS);
+ ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES, EC_R_INCOMPATIBLE_OBJECTS);
return 0;
}
- if (!group->meth->point_set_affine_coordinates(group, point, x, y, ctx))
- return 0;
-
- if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
- ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M,
- EC_R_POINT_IS_NOT_ON_CURVE);
+ if (EC_POINT_is_at_infinity(group, point)) {
+ ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES, EC_R_POINT_AT_INFINITY);
return 0;
}
- return 1;
+ return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
}
-#endif
+#if !OPENSSL_API_3
int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group,
const EC_POINT *point, BIGNUM *x,
BIGNUM *y, BN_CTX *ctx)
{
- if (group->meth->point_get_affine_coordinates == 0) {
- ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP,
- ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
- return 0;
- }
- if (!ec_point_is_compat(point, group)) {
- ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP,
- EC_R_INCOMPATIBLE_OBJECTS);
- return 0;
- }
- return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
+ return EC_POINT_get_affine_coordinates(group, point, x, y, ctx);
}
-#ifndef OPENSSL_NO_EC2M
+# ifndef OPENSSL_NO_EC2M
int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *group,
const EC_POINT *point, BIGNUM *x,
BIGNUM *y, BN_CTX *ctx)
{
- if (group->meth->point_get_affine_coordinates == 0) {
- ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M,
- ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
- return 0;
- }
- if (!ec_point_is_compat(point, group)) {
- ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M,
- EC_R_INCOMPATIBLE_OBJECTS);
- return 0;
- }
- return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
+ return EC_POINT_get_affine_coordinates(group, point, x, y, ctx);
}
+# endif
#endif
int EC_POINT_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
size_t num, const EC_POINT *points[],
const BIGNUM *scalars[], BN_CTX *ctx)
{
- if (group->meth->mul == 0)
+ int ret = 0;
+ size_t i = 0;
+ BN_CTX *new_ctx = NULL;
+
+ if ((scalar == NULL) && (num == 0)) {
+ return EC_POINT_set_to_infinity(group, r);
+ }
+
+ if (!ec_point_is_compat(r, group)) {
+ ECerr(EC_F_EC_POINTS_MUL, EC_R_INCOMPATIBLE_OBJECTS);
+ return 0;
+ }
+ for (i = 0; i < num; i++) {
+ if (!ec_point_is_compat(points[i], group)) {
+ ECerr(EC_F_EC_POINTS_MUL, EC_R_INCOMPATIBLE_OBJECTS);
+ return 0;
+ }
+ }
+
+ if (ctx == NULL && (ctx = new_ctx = BN_CTX_secure_new()) == NULL) {
+ ECerr(EC_F_EC_POINTS_MUL, ERR_R_INTERNAL_ERROR);
+ return 0;
+ }
+
+ if (group->meth->mul != NULL)
+ ret = group->meth->mul(group, r, scalar, num, points, scalars, ctx);
+ else
/* use default */
- return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
+ ret = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
- return group->meth->mul(group, r, scalar, num, points, scalars, ctx);
+ BN_CTX_free(new_ctx);
+ return ret;
}
int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
return BN_num_bits(group->order);
}
-int EC_GROUP_do_inverse_ord(const EC_GROUP *group, BIGNUM *res,
- BIGNUM *x, BN_CTX *ctx)
+static int ec_field_inverse_mod_ord(const EC_GROUP *group, BIGNUM *r,
+ const BIGNUM *x, BN_CTX *ctx)
+{
+ BIGNUM *e = NULL;
+ BN_CTX *new_ctx = NULL;
+ int ret = 0;
+
+ if (group->mont_data == NULL)
+ return 0;
+
+ if (ctx == NULL && (ctx = new_ctx = BN_CTX_secure_new()) == NULL)
+ return 0;
+
+ BN_CTX_start(ctx);
+ if ((e = BN_CTX_get(ctx)) == NULL)
+ goto err;
+
+ /*-
+ * We want inverse in constant time, therefore we utilize the fact
+ * order must be prime and use Fermats Little Theorem instead.
+ */
+ if (!BN_set_word(e, 2))
+ goto err;
+ if (!BN_sub(e, group->order, e))
+ goto err;
+ /*-
+ * Exponent e is public.
+ * No need for scatter-gather or BN_FLG_CONSTTIME.
+ */
+ if (!BN_mod_exp_mont(r, x, e, group->order, ctx, group->mont_data))
+ goto err;
+
+ ret = 1;
+
+ err:
+ BN_CTX_end(ctx);
+ BN_CTX_free(new_ctx);
+ return ret;
+}
+
+/*-
+ * Default behavior, if group->meth->field_inverse_mod_ord is NULL:
+ * - When group->order is even, this function returns an error.
+ * - When group->order is otherwise composite, the correctness
+ * of the output is not guaranteed.
+ * - When x is outside the range [1, group->order), the correctness
+ * of the output is not guaranteed.
+ * - Otherwise, this function returns the multiplicative inverse in the
+ * range [1, group->order).
+ *
+ * EC_METHODs must implement their own field_inverse_mod_ord for
+ * other functionality.
+ */
+int ec_group_do_inverse_ord(const EC_GROUP *group, BIGNUM *res,
+ const BIGNUM *x, BN_CTX *ctx)
{
if (group->meth->field_inverse_mod_ord != NULL)
return group->meth->field_inverse_mod_ord(group, res, x, ctx);
else
- return 0;
+ return ec_field_inverse_mod_ord(group, res, x, ctx);
+}
+
+/*-
+ * Coordinate blinding for EC_POINT.
+ *
+ * The underlying EC_METHOD can optionally implement this function:
+ * underlying implementations should return 0 on errors, or 1 on
+ * success.
+ *
+ * This wrapper returns 1 in case the underlying EC_METHOD does not
+ * support coordinate blinding.
+ */
+int ec_point_blind_coordinates(const EC_GROUP *group, EC_POINT *p, BN_CTX *ctx)
+{
+ if (group->meth->blind_coordinates == NULL)
+ return 1; /* ignore if not implemented */
+
+ return group->meth->blind_coordinates(group, p, ctx);
}
projects / openssl.git / blobdiff