crypto/ec/ec_lib.c

75 static int ec_precompute_mont_data(EC_GROUP *group);
122 void EC_GROUP_free(EC_GROUP *group)
124     if (!group)
127     if (group->meth->group_finish != 0)
128         group->meth->group_finish(group);
130     EC_EX_DATA_free_all_data(&group->extra_data);
132     if (EC_GROUP_VERSION(group) && group->mont_data)
133         BN_MONT_CTX_free(group->mont_data);
135     if (group->generator != NULL)
136         EC_POINT_free(group->generator);
137     BN_free(&group->order);
138     BN_free(&group->cofactor);
140     if (group->seed)
141         OPENSSL_free(group->seed);
143     OPENSSL_free(group);
146 void EC_GROUP_clear_free(EC_GROUP *group)
148     if (!group)
151     if (group->meth->group_clear_finish != 0)
152         group->meth->group_clear_finish(group);
153     else if (group->meth->group_finish != 0)
154         group->meth->group_finish(group);
156     EC_EX_DATA_clear_free_all_data(&group->extra_data);
158     if (EC_GROUP_VERSION(group) && group->mont_data)
159         BN_MONT_CTX_free(group->mont_data);
161     if (group->generator != NULL)
162         EC_POINT_clear_free(group->generator);
163     BN_clear_free(&group->order);
164     BN_clear_free(&group->cofactor);
166     if (group->seed) {
167         OPENSSL_cleanse(group->seed, group->seed_len);
168         OPENSSL_free(group->seed);
171     OPENSSL_cleanse(group, sizeof(*group));
172     OPENSSL_free(group);
287 const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *group)
289     return group->meth;
310 static int ec_guess_cofactor(EC_GROUP *group) {
319     if (BN_num_bits(&group->order) <= (BN_num_bits(&group->field) + 1) / 2 + 3) {
321         BN_zero(&group->cofactor);
334     if (group->meth->field_type == NID_X9_62_characteristic_two_field) {
336         if (!BN_set_bit(q, BN_num_bits(&group->field) - 1))
339         if (!BN_copy(q, &group->field))
344     if (!BN_rshift1(&group->cofactor, &group->order) /* n/2 */
345         || !BN_add(&group->cofactor, &group->cofactor, q) /* q + n/2 */
347         || !BN_add(&group->cofactor, &group->cofactor, BN_value_one())
349         || !BN_div(&group->cofactor, NULL, &group->cofactor, &group->order, ctx))
358 int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
366     /* require group->field >= 1 */
367     if (BN_is_zero(&group->field) || BN_is_negative(&group->field)) {
378         || BN_num_bits(order) > BN_num_bits(&group->field) + 1) {
393     if (group->generator == NULL) {
394         group->generator = EC_POINT_new(group);
395         if (group->generator == NULL)
398     if (!EC_POINT_copy(group->generator, generator))
401     if (!BN_copy(&group->order, order))
406         if (!BN_copy(&group->cofactor, cofactor))
408     } else if (!ec_guess_cofactor(group)) {
409         BN_zero(&group->cofactor);
415      * guarded by an EC_GROUP_VERSION(group) check to avoid OOB accesses, as the
416      * group might come from the FIPS module, which does not define the
419     if (EC_GROUP_VERSION(group)) {
423          * |group->mont_data| will be NULL in this case.
425         if (BN_is_odd(&group->order))
426             return ec_precompute_mont_data(group);
428         BN_MONT_CTX_free(group->mont_data);
429         group->mont_data = NULL;
435 const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group)
437     return group->generator;
440 BN_MONT_CTX *EC_GROUP_get_mont_data(const EC_GROUP *group)
442     return EC_GROUP_VERSION(group) ? group->mont_data : NULL;
445 int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx)
447     if (!BN_copy(order, &group->order))
453 int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor,
456     if (!BN_copy(cofactor, &group->cofactor))
459     return !BN_is_zero(&group->cofactor);
462 void EC_GROUP_set_curve_name(EC_GROUP *group, int nid)
464     group->curve_name = nid;
467 int EC_GROUP_get_curve_name(const EC_GROUP *group)
469     return group->curve_name;
472 void EC_GROUP_set_asn1_flag(EC_GROUP *group, int flag)
474     group->asn1_flag &= ~EC_GROUP_ASN1_FLAG_MASK;
475     group->asn1_flag |= flag & EC_GROUP_ASN1_FLAG_MASK;
478 int EC_GROUP_get_asn1_flag(const EC_GROUP *group)
480     return group->asn1_flag & EC_GROUP_ASN1_FLAG_MASK;
483 void EC_GROUP_set_point_conversion_form(EC_GROUP *group,
486     group->asn1_form = form;
490                                                            *group)
492     return group->asn1_form;
495 size_t EC_GROUP_set_seed(EC_GROUP *group, const unsigned char *p, size_t len)
497     if (group->seed) {
498         OPENSSL_free(group->seed);
499         group->seed = NULL;
500         group->seed_len = 0;
506     if ((group->seed = OPENSSL_malloc(len)) == NULL)
508     memcpy(group->seed, p, len);
509     group->seed_len = len;
514 unsigned char *EC_GROUP_get0_seed(const EC_GROUP *group)
516     return group->seed;
519 size_t EC_GROUP_get_seed_len(const EC_GROUP *group)
521     return group->seed_len;
524 int EC_GROUP_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
527     if (group->meth->group_set_curve == 0) {
531     return group->meth->group_set_curve(group, p, a, b, ctx);
534 int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
537     if (group->meth->group_get_curve == 0) {
541     return group->meth->group_get_curve(group, p, a, b, ctx);
545 int EC_GROUP_set_curve_GF2m(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
548     if (group->meth->group_set_curve == 0) {
553     return group->meth->group_set_curve(group, p, a, b, ctx);
556 int EC_GROUP_get_curve_GF2m(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
559     if (group->meth->group_get_curve == 0) {
564     return group->meth->group_get_curve(group, p, a, b, ctx);
568 int EC_GROUP_get_degree(const EC_GROUP *group)
570     if (group->meth->group_get_degree == 0) {
574     return group->meth->group_get_degree(group);
577 int EC_GROUP_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
579     if (group->meth->group_check_discriminant == 0) {
584     return group->meth->group_check_discriminant(group, ctx);
806 EC_POINT *EC_POINT_new(const EC_GROUP *group)
810     if (group == NULL) {
814     if (group->meth->point_init == 0) {
825     ret->meth = group->meth;
873 EC_POINT *EC_POINT_dup(const EC_POINT *a, const EC_GROUP *group)
881     t = EC_POINT_new(group);
897 int EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point)
899     if (group->meth->point_set_to_infinity == 0) {
904     if (group->meth != point->meth) {
908     return group->meth->point_set_to_infinity(group, point);
911 int EC_POINT_set_Jprojective_coordinates_GFp(const EC_GROUP *group,
916     if (group->meth->point_set_Jprojective_coordinates_GFp == 0) {
921     if (group->meth != point->meth) {
926     return group->meth->point_set_Jprojective_coordinates_GFp(group, point, x,
930 int EC_POINT_get_Jprojective_coordinates_GFp(const EC_GROUP *group,
935     if (group->meth->point_get_Jprojective_coordinates_GFp == 0) {
940     if (group->meth != point->meth) {
945     return group->meth->point_get_Jprojective_coordinates_GFp(group, point, x,
949 int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group,
953     if (group->meth->point_set_affine_coordinates == 0) {
958     if (group->meth != point->meth) {
963     if (!group->meth->point_set_affine_coordinates(group, point, x, y, ctx))
966     if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
975 int EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP *group,
979     if (group->meth->point_set_affine_coordinates == 0) {
984     if (group->meth != point->meth) {
989     if (!group->meth->point_set_affine_coordinates(group, point, x, y, ctx))
992     if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
1001 int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group,
1005     if (group->meth->point_get_affine_coordinates == 0) {
1010     if (group->meth != point->meth) {
1015     return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
1019 int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *group,
1023     if (group->meth->point_get_affine_coordinates == 0) {
1028     if (group->meth != point->meth) {
1033     return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
1037 int EC_POINT_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
1040     if (group->meth->add == 0) {
1044     if ((group->meth != r->meth) || (r->meth != a->meth)
1049     return group->meth->add(group, r, a, b, ctx);
1052 int EC_POINT_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
1055     if (group->meth->dbl == 0) {
1059     if ((group->meth != r->meth) || (r->meth != a->meth)) {
1063     return group->meth->dbl(group, r, a, ctx);
1066 int EC_POINT_invert(const EC_GROUP *group, EC_POINT *a, BN_CTX *ctx)
1068     if (group->meth->invert == 0) {
1072     if (group->meth != a->meth) {
1076     return group->meth->invert(group, a, ctx);
1079 int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
1081     if (group->meth->is_at_infinity == 0) {
1086     if (group->meth != point->meth) {
1090     return group->meth->is_at_infinity(group, point);
1100 int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
1103     if (group->meth->is_on_curve == 0) {
1107     if (group->meth != point->meth) {
1111     return group->meth->is_on_curve(group, point, ctx);
1114 int EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b,
1117     if (group->meth->point_cmp == 0) {
1121     if ((group->meth != a->meth) || (a->meth != b->meth)) {
1125     return group->meth->point_cmp(group, a, b, ctx);
1128 int EC_POINT_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx)
1130     if (group->meth->make_affine == 0) {
1134     if (group->meth != point->meth) {
1138     return group->meth->make_affine(group, point, ctx);
1141 int EC_POINTs_make_affine(const EC_GROUP *group, size_t num,
1146     if (group->meth->points_make_affine == 0) {
1151         if (group->meth != points[i]->meth) {
1156     return group->meth->points_make_affine(group, num, points, ctx);
1160  * Functions for point multiplication. If group->meth->mul is 0, we use the
1165 int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
1169     if (group->meth->mul == 0)
1171         return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
1173     return group->meth->mul(group, r, scalar, num, points, scalars, ctx);
1176 int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
1187     return EC_POINTs_mul(group, r, g_scalar,
1192 int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
1194     if (group->meth->mul == 0)
1196         return ec_wNAF_precompute_mult(group, ctx);
1198     if (group->meth->precompute_mult != 0)
1199         return group->meth->precompute_mult(group, ctx);
1204 int EC_GROUP_have_precompute_mult(const EC_GROUP *group)
1206     if (group->meth->mul == 0)
1208         return ec_wNAF_have_precompute_mult(group);
1210     if (group->meth->have_precompute_mult != 0)
1211         return group->meth->have_precompute_mult(group);
1218  * ec_precompute_mont_data sets |group->mont_data| from |group->order| and
1222  * EC_GROUP_VERSION(group) returns true.
1224  * struct should always be guarded by an EC_GROUP_VERSION(group) check to avoid
1225  * OOB accesses, as the group might come from the FIPS module, which does not
1229 int ec_precompute_mont_data(EC_GROUP *group)
1234     if (group->mont_data) {
1235         BN_MONT_CTX_free(group->mont_data);
1236         group->mont_data = NULL;
1242     group->mont_data = BN_MONT_CTX_new();
1243     if (!group->mont_data)
1246     if (!BN_MONT_CTX_set(group->mont_data, &group->order, ctx)) {
1247         BN_MONT_CTX_free(group->mont_data);
1248         group->mont_data = NULL;
1269 int ec_group_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
1274     field_nid = EC_METHOD_get_field_type(EC_GROUP_method_of(group));
1278         return EC_GROUP_get_curve_GF2m(group, p, a, b, ctx);
1282         return EC_GROUP_get_curve_GFp(group, p, a, b, ctx);
1297 int ec_point_get_affine_coordinates(const EC_GROUP *group,
1303     field_nid = EC_METHOD_get_field_type(EC_GROUP_method_of(group));
1307         return EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx);
1311         return EC_POINT_get_affine_coordinates_GFp(group, point, x, y, ctx);