blob: 5758ca9799e20c4f22ad482da88b8e6ad497c358 [file] [log] [blame]
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +01001/*
Manuel Pégourié-Gonnard32b04c12013-12-02 15:49:09 +01002 * Elliptic curves over GF(p): generic functions
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +01003 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +010018 */
19
20/*
21 * References:
22 *
Manuel Pégourié-Gonnard883f3132012-11-02 09:40:25 +010023 * SEC1 http://www.secg.org/index.php?action=secg,docs_secg
Manuel Pégourié-Gonnardd070f512012-11-08 17:40:51 +010024 * GECC = Guide to Elliptic Curve Cryptography - Hankerson, Menezes, Vanstone
Manuel Pégourié-Gonnard62aad142012-11-10 00:27:12 +010025 * FIPS 186-3 http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf
Manuel Pégourié-Gonnard1a967282013-02-09 17:03:58 +010026 * RFC 4492 for the related TLS structures and constants
Nicholas Wilson08f3ef12015-11-10 13:10:01 +000027 * RFC 7748 for the Curve448 and Curve25519 curve definitions
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +020028 *
Manuel Pégourié-Gonnard07894332015-06-23 00:18:41 +020029 * [Curve25519] http://cr.yp.to/ecdh/curve25519-20060209.pdf
Manuel Pégourié-Gonnardfe0af402013-12-04 18:14:55 +010030 *
Manuel Pégourié-Gonnard998930a2015-04-03 13:48:06 +020031 * [2] CORON, Jean-S'ebastien. Resistance against differential power analysis
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +020032 * for elliptic curve cryptosystems. In : Cryptographic Hardware and
33 * Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302.
34 * <http://link.springer.com/chapter/10.1007/3-540-48059-5_25>
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +010035 *
Manuel Pégourié-Gonnard998930a2015-04-03 13:48:06 +020036 * [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +010037 * render ECC resistant against Side Channel Attacks. IACR Cryptology
38 * ePrint Archive, 2004, vol. 2004, p. 342.
39 * <http://eprint.iacr.org/2004/342.pdf>
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +010040 */
41
Gilles Peskinedb09ef62020-06-03 01:43:33 +020042#include "common.h"
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +010043
Andrzej Kurekc470b6b2019-01-31 08:20:20 -050044/**
45 * \brief Function level alternative implementation.
46 *
47 * The MBEDTLS_ECP_INTERNAL_ALT macro enables alternative implementations to
48 * replace certain functions in this module. The alternative implementations are
49 * typically hardware accelerators and need to activate the hardware before the
50 * computation starts and deactivate it after it finishes. The
51 * mbedtls_internal_ecp_init() and mbedtls_internal_ecp_free() functions serve
52 * this purpose.
53 *
54 * To preserve the correct functionality the following conditions must hold:
55 *
56 * - The alternative implementation must be activated by
57 * mbedtls_internal_ecp_init() before any of the replaceable functions is
58 * called.
59 * - mbedtls_internal_ecp_free() must \b only be called when the alternative
60 * implementation is activated.
61 * - mbedtls_internal_ecp_init() must \b not be called when the alternative
62 * implementation is activated.
63 * - Public functions must not return while the alternative implementation is
64 * activated.
65 * - Replaceable functions are guarded by \c MBEDTLS_ECP_XXX_ALT macros and
66 * before calling them an \code if( mbedtls_internal_ecp_grp_capable( grp ) )
67 * \endcode ensures that the alternative implementation supports the current
68 * group.
69 */
70#if defined(MBEDTLS_ECP_INTERNAL_ALT)
71#endif
72
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020073#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +010074
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000075#include "mbedtls/ecp.h"
Janos Follath430d3372016-11-03 14:25:37 +000076#include "mbedtls/threading.h"
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050077#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000078#include "mbedtls/error.h"
Paul Bakker6e339b52013-07-03 13:37:05 +020079
Janos Follath8c70e812021-06-24 14:48:38 +010080#include "bn_mul.h"
Gilles Peskine80ba8502021-04-03 20:36:37 +020081#include "ecp_invasive.h"
82
Rich Evans00ab4702015-02-06 13:43:58 +000083#include <string.h>
84
Janos Follathb0697532016-08-18 12:38:46 +010085#if !defined(MBEDTLS_ECP_ALT)
86
Andrzej Kurekc470b6b2019-01-31 08:20:20 -050087/* Parameter validation macros based on platform_util.h */
88#define ECP_VALIDATE_RET( cond ) \
89 MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_ECP_BAD_INPUT_DATA )
90#define ECP_VALIDATE( cond ) \
91 MBEDTLS_INTERNAL_VALIDATE( cond )
92
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020093#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000094#include "mbedtls/platform.h"
Paul Bakker6e339b52013-07-03 13:37:05 +020095#else
Rich Evans00ab4702015-02-06 13:43:58 +000096#include <stdlib.h>
Manuel Pégourié-Gonnard981732b2015-02-17 15:46:45 +000097#include <stdio.h>
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020098#define mbedtls_printf printf
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020099#define mbedtls_calloc calloc
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200100#define mbedtls_free free
Paul Bakker6e339b52013-07-03 13:37:05 +0200101#endif
102
Gilles Peskine6a2fb612021-05-24 22:25:04 +0200103#include "ecp_internal_alt.h"
Janos Follathb0697532016-08-18 12:38:46 +0100104
Manuel Pégourié-Gonnard0223ab92015-10-05 11:40:01 +0100105#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
106 !defined(inline) && !defined(__cplusplus)
Paul Bakker6a6087e2013-10-28 18:53:08 +0100107#define inline __inline
Manuel Pégourié-Gonnard20af64d2015-07-07 18:33:39 +0200108#endif
Paul Bakker6a6087e2013-10-28 18:53:08 +0100109
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200110#if defined(MBEDTLS_SELF_TEST)
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +0100111/*
Manuel Pégourié-Gonnard91814812013-11-21 20:23:55 +0100112 * Counts of point addition and doubling, and field multiplications.
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +0200113 * Used to test resistance of point multiplication to simple timing attacks.
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +0100114 */
Manuel Pégourié-Gonnard43863ee2013-12-01 16:51:27 +0100115static unsigned long add_count, dbl_count, mul_count;
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +0100116#endif
117
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +0200118#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard054433c2017-03-22 11:18:33 +0100119/*
120 * Maximum number of "basic operations" to be done in a row.
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +0200121 *
122 * Default value 0 means that ECC operations will not yield.
123 * Note that regardless of the value of ecp_max_ops, always at
124 * least one step is performed before yielding.
125 *
126 * Setting ecp_max_ops=1 can be suitable for testing purposes
127 * as it will interrupt computation at all possible points.
Manuel Pégourié-Gonnard054433c2017-03-22 11:18:33 +0100128 */
129static unsigned ecp_max_ops = 0;
130
131/*
132 * Set ecp_max_ops
133 */
134void mbedtls_ecp_set_max_ops( unsigned max_ops )
135{
136 ecp_max_ops = max_ops;
137}
Manuel Pégourié-Gonnard510d5ca2017-03-08 11:41:47 +0100138
139/*
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200140 * Check if restart is enabled
141 */
Manuel Pégourié-Gonnardb843b152018-10-16 10:41:31 +0200142int mbedtls_ecp_restart_is_enabled( void )
Manuel Pégourié-Gonnarda0c5bcc2017-04-21 11:33:57 +0200143{
144 return( ecp_max_ops != 0 );
145}
146
147/*
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +0200148 * Restart sub-context for ecp_mul_comb()
Manuel Pégourié-Gonnard510d5ca2017-03-08 11:41:47 +0100149 */
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +0200150struct mbedtls_ecp_restart_mul
151{
Manuel Pégourié-Gonnard8962ddb2017-03-14 12:11:21 +0100152 mbedtls_ecp_point R; /* current intermediate result */
Manuel Pégourié-Gonnardc5d844b2017-03-15 13:06:28 +0100153 size_t i; /* current index in various loops, 0 outside */
Manuel Pégourié-Gonnardc9c0aa62017-03-16 14:53:26 +0100154 mbedtls_ecp_point *T; /* table for precomputed points */
155 unsigned char T_size; /* number of points in table T */
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +0200156 enum { /* what were we doing last time we returned? */
157 ecp_rsm_init = 0, /* nothing so far, dummy initial state */
158 ecp_rsm_pre_dbl, /* precompute 2^n multiples */
Manuel Pégourié-Gonnard45fd0162017-03-22 08:24:42 +0100159 ecp_rsm_pre_norm_dbl, /* normalize precomputed 2^n multiples */
160 ecp_rsm_pre_add, /* precompute remaining points by adding */
161 ecp_rsm_pre_norm_add, /* normalize all precomputed points */
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +0200162 ecp_rsm_comb_core, /* ecp_mul_comb_core() */
Manuel Pégourié-Gonnard45fd0162017-03-22 08:24:42 +0100163 ecp_rsm_final_norm, /* do the final normalization */
Manuel Pégourié-Gonnard2fad7ae2017-03-14 13:13:13 +0100164 } state;
Manuel Pégourié-Gonnard77af79a2017-03-14 10:58:00 +0100165};
Manuel Pégourié-Gonnard510d5ca2017-03-08 11:41:47 +0100166
167/*
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +0200168 * Init restart_mul sub-context
Manuel Pégourié-Gonnard510d5ca2017-03-08 11:41:47 +0100169 */
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +0200170static void ecp_restart_rsm_init( mbedtls_ecp_restart_mul_ctx *ctx )
Manuel Pégourié-Gonnard77af79a2017-03-14 10:58:00 +0100171{
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +0200172 mbedtls_ecp_point_init( &ctx->R );
173 ctx->i = 0;
174 ctx->T = NULL;
175 ctx->T_size = 0;
176 ctx->state = ecp_rsm_init;
Manuel Pégourié-Gonnard77af79a2017-03-14 10:58:00 +0100177}
178
179/*
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +0200180 * Free the components of a restart_mul sub-context
Manuel Pégourié-Gonnard77af79a2017-03-14 10:58:00 +0100181 */
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +0200182static void ecp_restart_rsm_free( mbedtls_ecp_restart_mul_ctx *ctx )
Manuel Pégourié-Gonnard77af79a2017-03-14 10:58:00 +0100183{
Manuel Pégourié-Gonnardc9c0aa62017-03-16 14:53:26 +0100184 unsigned char i;
185
Manuel Pégourié-Gonnard77af79a2017-03-14 10:58:00 +0100186 if( ctx == NULL )
187 return;
Manuel Pégourié-Gonnard78d564a2017-03-14 11:48:38 +0100188
Manuel Pégourié-Gonnard8962ddb2017-03-14 12:11:21 +0100189 mbedtls_ecp_point_free( &ctx->R );
Manuel Pégourié-Gonnard2fad7ae2017-03-14 13:13:13 +0100190
Manuel Pégourié-Gonnard31f0ef72017-05-17 10:05:58 +0200191 if( ctx->T != NULL )
192 {
Manuel Pégourié-Gonnardc9c0aa62017-03-16 14:53:26 +0100193 for( i = 0; i < ctx->T_size; i++ )
194 mbedtls_ecp_point_free( ctx->T + i );
195 mbedtls_free( ctx->T );
196 }
197
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +0200198 ecp_restart_rsm_init( ctx );
Manuel Pégourié-Gonnard77af79a2017-03-14 10:58:00 +0100199}
Manuel Pégourié-Gonnard2fad7ae2017-03-14 13:13:13 +0100200
201/*
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +0200202 * Restart context for ecp_muladd()
203 */
204struct mbedtls_ecp_restart_muladd
205{
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +0200206 mbedtls_ecp_point mP; /* mP value */
207 mbedtls_ecp_point R; /* R intermediate result */
208 enum { /* what should we do next? */
209 ecp_rsma_mul1 = 0, /* first multiplication */
210 ecp_rsma_mul2, /* second multiplication */
211 ecp_rsma_add, /* addition */
212 ecp_rsma_norm, /* normalization */
213 } state;
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +0200214};
215
216/*
217 * Init restart_muladd sub-context
218 */
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +0200219static void ecp_restart_ma_init( mbedtls_ecp_restart_muladd_ctx *ctx )
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +0200220{
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +0200221 mbedtls_ecp_point_init( &ctx->mP );
222 mbedtls_ecp_point_init( &ctx->R );
223 ctx->state = ecp_rsma_mul1;
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +0200224}
225
226/*
227 * Free the components of a restart_muladd sub-context
228 */
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +0200229static void ecp_restart_ma_free( mbedtls_ecp_restart_muladd_ctx *ctx )
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +0200230{
231 if( ctx == NULL )
232 return;
233
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +0200234 mbedtls_ecp_point_free( &ctx->mP );
235 mbedtls_ecp_point_free( &ctx->R );
236
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +0200237 ecp_restart_ma_init( ctx );
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +0200238}
239
240/*
Manuel Pégourié-Gonnardb739a712017-04-19 10:11:56 +0200241 * Initialize a restart context
242 */
243void mbedtls_ecp_restart_init( mbedtls_ecp_restart_ctx *ctx )
244{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500245 ECP_VALIDATE( ctx != NULL );
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +0200246 ctx->ops_done = 0;
247 ctx->depth = 0;
248 ctx->rsm = NULL;
249 ctx->ma = NULL;
Manuel Pégourié-Gonnardb739a712017-04-19 10:11:56 +0200250}
251
252/*
253 * Free the components of a restart context
254 */
255void mbedtls_ecp_restart_free( mbedtls_ecp_restart_ctx *ctx )
256{
257 if( ctx == NULL )
258 return;
259
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +0200260 ecp_restart_rsm_free( ctx->rsm );
Manuel Pégourié-Gonnardb739a712017-04-19 10:11:56 +0200261 mbedtls_free( ctx->rsm );
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +0200262
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +0200263 ecp_restart_ma_free( ctx->ma );
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +0200264 mbedtls_free( ctx->ma );
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +0200265
266 mbedtls_ecp_restart_init( ctx );
Manuel Pégourié-Gonnardb739a712017-04-19 10:11:56 +0200267}
268
269/*
Manuel Pégourié-Gonnard2fad7ae2017-03-14 13:13:13 +0100270 * Check if we can do the next step
271 */
Manuel Pégourié-Gonnardc7511482017-04-20 16:31:00 +0200272int mbedtls_ecp_check_budget( const mbedtls_ecp_group *grp,
273 mbedtls_ecp_restart_ctx *rs_ctx,
274 unsigned ops )
Manuel Pégourié-Gonnard2fad7ae2017-03-14 13:13:13 +0100275{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500276 ECP_VALIDATE_RET( grp != NULL );
277
Manuel Pégourié-Gonnard646393b2017-04-20 10:03:45 +0200278 if( rs_ctx != NULL && ecp_max_ops != 0 )
Manuel Pégourié-Gonnard2fad7ae2017-03-14 13:13:13 +0100279 {
Manuel Pégourié-Gonnarde6854492017-03-20 14:35:19 +0100280 /* scale depending on curve size: the chosen reference is 256-bit,
281 * and multiplication is quadratic. Round to the closest integer. */
282 if( grp->pbits >= 512 )
283 ops *= 4;
284 else if( grp->pbits >= 384 )
285 ops *= 2;
286
Hanno Beckerb10c6602018-10-26 13:50:13 +0100287 /* Avoid infinite loops: always allow first step.
288 * Because of that, however, it's not generally true
289 * that ops_done <= ecp_max_ops, so the check
290 * ops_done > ecp_max_ops below is mandatory. */
291 if( ( rs_ctx->ops_done != 0 ) &&
292 ( rs_ctx->ops_done > ecp_max_ops ||
293 ops > ecp_max_ops - rs_ctx->ops_done ) )
294 {
Manuel Pégourié-Gonnard2fad7ae2017-03-14 13:13:13 +0100295 return( MBEDTLS_ERR_ECP_IN_PROGRESS );
Hanno Beckerb10c6602018-10-26 13:50:13 +0100296 }
Manuel Pégourié-Gonnard2fad7ae2017-03-14 13:13:13 +0100297
Manuel Pégourié-Gonnarde6854492017-03-20 14:35:19 +0100298 /* update running count */
Manuel Pégourié-Gonnard646393b2017-04-20 10:03:45 +0200299 rs_ctx->ops_done += ops;
Manuel Pégourié-Gonnard2fad7ae2017-03-14 13:13:13 +0100300 }
301
302 return( 0 );
303}
304
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +0200305/* Call this when entering a function that needs its own sub-context */
Manuel Pégourié-Gonnarda58e0112018-10-16 10:42:47 +0200306#define ECP_RS_ENTER( SUB ) do { \
307 /* reset ops count for this call if top-level */ \
308 if( rs_ctx != NULL && rs_ctx->depth++ == 0 ) \
309 rs_ctx->ops_done = 0; \
310 \
311 /* set up our own sub-context if needed */ \
312 if( mbedtls_ecp_restart_is_enabled() && \
313 rs_ctx != NULL && rs_ctx->SUB == NULL ) \
314 { \
315 rs_ctx->SUB = mbedtls_calloc( 1, sizeof( *rs_ctx->SUB ) ); \
316 if( rs_ctx->SUB == NULL ) \
317 return( MBEDTLS_ERR_ECP_ALLOC_FAILED ); \
318 \
319 ecp_restart_## SUB ##_init( rs_ctx->SUB ); \
320 } \
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +0200321} while( 0 )
322
323/* Call this when leaving a function that needs its own sub-context */
Manuel Pégourié-Gonnarda58e0112018-10-16 10:42:47 +0200324#define ECP_RS_LEAVE( SUB ) do { \
325 /* clear our sub-context when not in progress (done or error) */ \
326 if( rs_ctx != NULL && rs_ctx->SUB != NULL && \
327 ret != MBEDTLS_ERR_ECP_IN_PROGRESS ) \
328 { \
329 ecp_restart_## SUB ##_free( rs_ctx->SUB ); \
330 mbedtls_free( rs_ctx->SUB ); \
331 rs_ctx->SUB = NULL; \
332 } \
333 \
334 if( rs_ctx != NULL ) \
335 rs_ctx->depth--; \
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +0200336} while( 0 )
337
338#else /* MBEDTLS_ECP_RESTARTABLE */
339
340#define ECP_RS_ENTER( sub ) (void) rs_ctx;
341#define ECP_RS_LEAVE( sub ) (void) rs_ctx;
342
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +0200343#endif /* MBEDTLS_ECP_RESTARTABLE */
Manuel Pégourié-Gonnard054433c2017-03-22 11:18:33 +0100344
Hanno Becker466df6e2022-01-10 11:16:51 +0000345static void mpi_init_many( mbedtls_mpi *arr, unsigned size )
346{
347 while( size-- )
348 mbedtls_mpi_init( arr++ );
349}
350
351static void mpi_free_many( mbedtls_mpi *arr, unsigned size )
352{
353 while( size-- )
354 mbedtls_mpi_free( arr++ );
355}
356
Manuel Pégourié-Gonnard7c94d8b2013-12-04 23:15:46 +0100357/*
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200358 * List of supported curves:
359 * - internal ID
Christoph M. Wintersteigercb310732019-02-15 15:50:38 +0000360 * - TLS NamedCurve ID (RFC 4492 sec. 5.1.1, RFC 7071 sec. 2, RFC 8446 sec. 4.2.7)
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200361 * - size in bits
Manuel Pégourié-Gonnard8195c1a2013-10-07 19:40:41 +0200362 * - readable name
Gergely Budaie40c4692014-01-22 11:22:20 +0100363 *
Manuel Pégourié-Gonnardac719412014-02-04 14:48:50 +0100364 * Curves are listed in order: largest curves first, and for a given size,
Gilles Peskineae270bf2021-06-02 00:05:29 +0200365 * fastest curves first.
Manuel Pégourié-Gonnard88db5da2015-06-15 14:34:59 +0200366 *
Gilles Peskineae270bf2021-06-02 00:05:29 +0200367 * Reminder: update profiles in x509_crt.c and ssl_tls.c when adding a new curve!
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200368 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200369static const mbedtls_ecp_curve_info ecp_supported_curves[] =
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200370{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200371#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
372 { MBEDTLS_ECP_DP_SECP521R1, 25, 521, "secp521r1" },
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200373#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200374#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
375 { MBEDTLS_ECP_DP_BP512R1, 28, 512, "brainpoolP512r1" },
Gergely Budaie40c4692014-01-22 11:22:20 +0100376#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200377#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
378 { MBEDTLS_ECP_DP_SECP384R1, 24, 384, "secp384r1" },
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200379#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200380#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
381 { MBEDTLS_ECP_DP_BP384R1, 27, 384, "brainpoolP384r1" },
Gergely Budaie40c4692014-01-22 11:22:20 +0100382#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200383#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
384 { MBEDTLS_ECP_DP_SECP256R1, 23, 256, "secp256r1" },
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200385#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200386#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
387 { MBEDTLS_ECP_DP_SECP256K1, 22, 256, "secp256k1" },
Manuel Pégourié-Gonnardac719412014-02-04 14:48:50 +0100388#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200389#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
390 { MBEDTLS_ECP_DP_BP256R1, 26, 256, "brainpoolP256r1" },
Gergely Budaie40c4692014-01-22 11:22:20 +0100391#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200392#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
393 { MBEDTLS_ECP_DP_SECP224R1, 21, 224, "secp224r1" },
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200394#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200395#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
396 { MBEDTLS_ECP_DP_SECP224K1, 20, 224, "secp224k1" },
Manuel Pégourié-Gonnard9bcff392014-01-10 18:26:48 +0100397#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200398#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
399 { MBEDTLS_ECP_DP_SECP192R1, 19, 192, "secp192r1" },
Manuel Pégourié-Gonnardac719412014-02-04 14:48:50 +0100400#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200401#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
402 { MBEDTLS_ECP_DP_SECP192K1, 18, 192, "secp192k1" },
Manuel Pégourié-Gonnard9bcff392014-01-10 18:26:48 +0100403#endif
Gilles Peskine360e2c42020-07-24 02:03:20 +0200404#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
Christoph M. Wintersteiger86e36c42018-12-06 17:27:31 +0000405 { MBEDTLS_ECP_DP_CURVE25519, 29, 256, "x25519" },
Christoph M. Wintersteigerc9f737b2018-10-25 13:03:05 +0100406#endif
Gilles Peskine360e2c42020-07-24 02:03:20 +0200407#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
408 { MBEDTLS_ECP_DP_CURVE448, 30, 448, "x448" },
409#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200410 { MBEDTLS_ECP_DP_NONE, 0, 0, NULL },
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200411};
Manuel Pégourié-Gonnardac719412014-02-04 14:48:50 +0100412
Manuel Pégourié-Gonnardba782bb2014-07-08 13:31:34 +0200413#define ECP_NB_CURVES sizeof( ecp_supported_curves ) / \
414 sizeof( ecp_supported_curves[0] )
415
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200416static mbedtls_ecp_group_id ecp_supported_grp_id[ECP_NB_CURVES];
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200417
418/*
Manuel Pégourié-Gonnardda179e42013-09-18 15:31:24 +0200419 * List of supported curves and associated info
420 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200421const mbedtls_ecp_curve_info *mbedtls_ecp_curve_list( void )
Manuel Pégourié-Gonnardda179e42013-09-18 15:31:24 +0200422{
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200423 return( ecp_supported_curves );
Manuel Pégourié-Gonnardda179e42013-09-18 15:31:24 +0200424}
425
426/*
Manuel Pégourié-Gonnardac719412014-02-04 14:48:50 +0100427 * List of supported curves, group ID only
428 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200429const mbedtls_ecp_group_id *mbedtls_ecp_grp_id_list( void )
Manuel Pégourié-Gonnardac719412014-02-04 14:48:50 +0100430{
431 static int init_done = 0;
432
433 if( ! init_done )
434 {
435 size_t i = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200436 const mbedtls_ecp_curve_info *curve_info;
Manuel Pégourié-Gonnardac719412014-02-04 14:48:50 +0100437
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200438 for( curve_info = mbedtls_ecp_curve_list();
439 curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
Manuel Pégourié-Gonnardac719412014-02-04 14:48:50 +0100440 curve_info++ )
441 {
442 ecp_supported_grp_id[i++] = curve_info->grp_id;
443 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200444 ecp_supported_grp_id[i] = MBEDTLS_ECP_DP_NONE;
Manuel Pégourié-Gonnardac719412014-02-04 14:48:50 +0100445
446 init_done = 1;
447 }
448
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200449 return( ecp_supported_grp_id );
Manuel Pégourié-Gonnardac719412014-02-04 14:48:50 +0100450}
451
452/*
453 * Get the curve info for the internal identifier
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +0200454 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200455const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_grp_id( mbedtls_ecp_group_id grp_id )
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +0200456{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200457 const mbedtls_ecp_curve_info *curve_info;
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +0200458
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200459 for( curve_info = mbedtls_ecp_curve_list();
460 curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +0200461 curve_info++ )
462 {
463 if( curve_info->grp_id == grp_id )
464 return( curve_info );
465 }
466
467 return( NULL );
468}
469
470/*
471 * Get the curve info from the TLS identifier
472 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200473const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_tls_id( uint16_t tls_id )
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +0200474{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200475 const mbedtls_ecp_curve_info *curve_info;
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +0200476
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200477 for( curve_info = mbedtls_ecp_curve_list();
478 curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +0200479 curve_info++ )
480 {
481 if( curve_info->tls_id == tls_id )
482 return( curve_info );
483 }
484
485 return( NULL );
486}
487
488/*
Manuel Pégourié-Gonnard0267e3d2013-11-30 15:10:14 +0100489 * Get the curve info from the name
490 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200491const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_name( const char *name )
Manuel Pégourié-Gonnard0267e3d2013-11-30 15:10:14 +0100492{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200493 const mbedtls_ecp_curve_info *curve_info;
Manuel Pégourié-Gonnard0267e3d2013-11-30 15:10:14 +0100494
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500495 if( name == NULL )
496 return( NULL );
497
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200498 for( curve_info = mbedtls_ecp_curve_list();
499 curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
Manuel Pégourié-Gonnard0267e3d2013-11-30 15:10:14 +0100500 curve_info++ )
501 {
Manuel Pégourié-Gonnardcb46fd82015-05-28 17:06:07 +0200502 if( strcmp( curve_info->name, name ) == 0 )
Manuel Pégourié-Gonnard0267e3d2013-11-30 15:10:14 +0100503 return( curve_info );
504 }
505
506 return( NULL );
507}
508
509/*
Manuel Pégourié-Gonnard7c94d8b2013-12-04 23:15:46 +0100510 * Get the type of a curve
Manuel Pégourié-Gonnard312d2e82013-12-04 11:08:01 +0100511 */
Janos Follathdf9295b2019-02-26 12:36:52 +0000512mbedtls_ecp_curve_type mbedtls_ecp_get_type( const mbedtls_ecp_group *grp )
Manuel Pégourié-Gonnard312d2e82013-12-04 11:08:01 +0100513{
Manuel Pégourié-Gonnard7c94d8b2013-12-04 23:15:46 +0100514 if( grp->G.X.p == NULL )
Janos Follathdf9295b2019-02-26 12:36:52 +0000515 return( MBEDTLS_ECP_TYPE_NONE );
Manuel Pégourié-Gonnard7c94d8b2013-12-04 23:15:46 +0100516
517 if( grp->G.Y.p == NULL )
Janos Follathdf9295b2019-02-26 12:36:52 +0000518 return( MBEDTLS_ECP_TYPE_MONTGOMERY );
Manuel Pégourié-Gonnard7c94d8b2013-12-04 23:15:46 +0100519 else
Janos Follathdf9295b2019-02-26 12:36:52 +0000520 return( MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS );
Manuel Pégourié-Gonnard312d2e82013-12-04 11:08:01 +0100521}
522
523/*
Manuel Pégourié-Gonnardb505c272012-11-05 17:27:54 +0100524 * Initialize (the components of) a point
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +0100525 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200526void mbedtls_ecp_point_init( mbedtls_ecp_point *pt )
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +0100527{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500528 ECP_VALIDATE( pt != NULL );
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +0100529
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200530 mbedtls_mpi_init( &pt->X );
531 mbedtls_mpi_init( &pt->Y );
532 mbedtls_mpi_init( &pt->Z );
Manuel Pégourié-Gonnardb505c272012-11-05 17:27:54 +0100533}
534
535/*
536 * Initialize (the components of) a group
537 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200538void mbedtls_ecp_group_init( mbedtls_ecp_group *grp )
Manuel Pégourié-Gonnardb505c272012-11-05 17:27:54 +0100539{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500540 ECP_VALIDATE( grp != NULL );
Manuel Pégourié-Gonnardb505c272012-11-05 17:27:54 +0100541
Manuel Pégourié-Gonnard95e2eca2018-06-20 10:29:47 +0200542 grp->id = MBEDTLS_ECP_DP_NONE;
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +0200543 mbedtls_mpi_init( &grp->P );
544 mbedtls_mpi_init( &grp->A );
545 mbedtls_mpi_init( &grp->B );
546 mbedtls_ecp_point_init( &grp->G );
547 mbedtls_mpi_init( &grp->N );
548 grp->pbits = 0;
549 grp->nbits = 0;
550 grp->h = 0;
551 grp->modp = NULL;
552 grp->t_pre = NULL;
553 grp->t_post = NULL;
554 grp->t_data = NULL;
555 grp->T = NULL;
556 grp->T_size = 0;
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +0100557}
558
559/*
Manuel Pégourié-Gonnardb8c6e0e2013-07-01 13:40:52 +0200560 * Initialize (the components of) a key pair
561 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200562void mbedtls_ecp_keypair_init( mbedtls_ecp_keypair *key )
Manuel Pégourié-Gonnardb8c6e0e2013-07-01 13:40:52 +0200563{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500564 ECP_VALIDATE( key != NULL );
Manuel Pégourié-Gonnardb8c6e0e2013-07-01 13:40:52 +0200565
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200566 mbedtls_ecp_group_init( &key->grp );
567 mbedtls_mpi_init( &key->d );
568 mbedtls_ecp_point_init( &key->Q );
Manuel Pégourié-Gonnardb8c6e0e2013-07-01 13:40:52 +0200569}
570
571/*
Manuel Pégourié-Gonnard1e8c8ec2012-10-31 19:24:21 +0100572 * Unallocate (the components of) a point
573 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200574void mbedtls_ecp_point_free( mbedtls_ecp_point *pt )
Manuel Pégourié-Gonnard1e8c8ec2012-10-31 19:24:21 +0100575{
576 if( pt == NULL )
577 return;
578
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200579 mbedtls_mpi_free( &( pt->X ) );
580 mbedtls_mpi_free( &( pt->Y ) );
581 mbedtls_mpi_free( &( pt->Z ) );
Manuel Pégourié-Gonnard1e8c8ec2012-10-31 19:24:21 +0100582}
583
584/*
kXuanba9cb762021-04-08 14:32:06 +0800585 * Check that the comb table (grp->T) is static initialized.
586 */
587static int ecp_group_is_static_comb_table( const mbedtls_ecp_group *grp ) {
588#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1
589 return grp->T != NULL && grp->T_size == 0;
590#else
591 (void) grp;
592 return 0;
593#endif
594}
595
596/*
Manuel Pégourié-Gonnard1e8c8ec2012-10-31 19:24:21 +0100597 * Unallocate (the components of) a group
598 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200599void mbedtls_ecp_group_free( mbedtls_ecp_group *grp )
Manuel Pégourié-Gonnard1e8c8ec2012-10-31 19:24:21 +0100600{
Manuel Pégourié-Gonnard161ef962013-09-17 19:13:10 +0200601 size_t i;
602
Manuel Pégourié-Gonnard1e8c8ec2012-10-31 19:24:21 +0100603 if( grp == NULL )
604 return;
605
Manuel Pégourié-Gonnard1f82b042013-12-06 12:51:50 +0100606 if( grp->h != 1 )
607 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200608 mbedtls_mpi_free( &grp->P );
609 mbedtls_mpi_free( &grp->A );
610 mbedtls_mpi_free( &grp->B );
611 mbedtls_ecp_point_free( &grp->G );
612 mbedtls_mpi_free( &grp->N );
Manuel Pégourié-Gonnard1f82b042013-12-06 12:51:50 +0100613 }
Manuel Pégourié-Gonnardc9727702013-09-16 18:56:28 +0200614
kXuanba9cb762021-04-08 14:32:06 +0800615 if( !ecp_group_is_static_comb_table(grp) && grp->T != NULL )
Manuel Pégourié-Gonnard161ef962013-09-17 19:13:10 +0200616 {
617 for( i = 0; i < grp->T_size; i++ )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200618 mbedtls_ecp_point_free( &grp->T[i] );
619 mbedtls_free( grp->T );
Manuel Pégourié-Gonnard161ef962013-09-17 19:13:10 +0200620 }
621
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500622 mbedtls_platform_zeroize( grp, sizeof( mbedtls_ecp_group ) );
Manuel Pégourié-Gonnard1e8c8ec2012-10-31 19:24:21 +0100623}
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +0100624
Manuel Pégourié-Gonnard883f3132012-11-02 09:40:25 +0100625/*
Manuel Pégourié-Gonnardb8c6e0e2013-07-01 13:40:52 +0200626 * Unallocate (the components of) a key pair
627 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200628void mbedtls_ecp_keypair_free( mbedtls_ecp_keypair *key )
Manuel Pégourié-Gonnardb8c6e0e2013-07-01 13:40:52 +0200629{
Paul Bakker66d5d072014-06-17 16:39:18 +0200630 if( key == NULL )
Manuel Pégourié-Gonnardb8c6e0e2013-07-01 13:40:52 +0200631 return;
632
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200633 mbedtls_ecp_group_free( &key->grp );
634 mbedtls_mpi_free( &key->d );
635 mbedtls_ecp_point_free( &key->Q );
Manuel Pégourié-Gonnardb8c6e0e2013-07-01 13:40:52 +0200636}
637
638/*
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +0200639 * Copy the contents of a point
640 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200641int mbedtls_ecp_copy( mbedtls_ecp_point *P, const mbedtls_ecp_point *Q )
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +0200642{
Janos Follath24eed8d2019-11-22 13:21:35 +0000643 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500644 ECP_VALIDATE_RET( P != NULL );
645 ECP_VALIDATE_RET( Q != NULL );
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +0200646
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200647 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->X, &Q->X ) );
648 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->Y, &Q->Y ) );
649 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->Z, &Q->Z ) );
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +0200650
651cleanup:
652 return( ret );
653}
654
655/*
656 * Copy the contents of a group object
657 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200658int mbedtls_ecp_group_copy( mbedtls_ecp_group *dst, const mbedtls_ecp_group *src )
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +0200659{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500660 ECP_VALIDATE_RET( dst != NULL );
661 ECP_VALIDATE_RET( src != NULL );
662
663 return( mbedtls_ecp_group_load( dst, src->id ) );
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +0200664}
665
666/*
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +0100667 * Set point to zero
668 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200669int mbedtls_ecp_set_zero( mbedtls_ecp_point *pt )
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +0100670{
Janos Follath24eed8d2019-11-22 13:21:35 +0000671 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500672 ECP_VALIDATE_RET( pt != NULL );
Manuel Pégourié-Gonnard1c2782c2012-11-19 20:16:28 +0100673
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200674 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->X , 1 ) );
675 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Y , 1 ) );
676 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z , 0 ) );
Manuel Pégourié-Gonnard1c2782c2012-11-19 20:16:28 +0100677
678cleanup:
679 return( ret );
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +0100680}
681
682/*
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +0100683 * Tell if a point is zero
684 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200685int mbedtls_ecp_is_zero( mbedtls_ecp_point *pt )
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +0100686{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500687 ECP_VALIDATE_RET( pt != NULL );
688
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200689 return( mbedtls_mpi_cmp_int( &pt->Z, 0 ) == 0 );
Manuel Pégourié-Gonnard6545ca72013-01-26 16:05:22 +0100690}
691
692/*
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500693 * Compare two points lazily
Manuel Pégourié-Gonnard6029a852015-08-11 15:44:41 +0200694 */
695int mbedtls_ecp_point_cmp( const mbedtls_ecp_point *P,
696 const mbedtls_ecp_point *Q )
697{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500698 ECP_VALIDATE_RET( P != NULL );
699 ECP_VALIDATE_RET( Q != NULL );
700
Manuel Pégourié-Gonnard6029a852015-08-11 15:44:41 +0200701 if( mbedtls_mpi_cmp_mpi( &P->X, &Q->X ) == 0 &&
702 mbedtls_mpi_cmp_mpi( &P->Y, &Q->Y ) == 0 &&
703 mbedtls_mpi_cmp_mpi( &P->Z, &Q->Z ) == 0 )
704 {
705 return( 0 );
706 }
707
708 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
709}
710
711/*
Manuel Pégourié-Gonnard847395a2012-11-05 13:13:44 +0100712 * Import a non-zero point from ASCII strings
713 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200714int mbedtls_ecp_point_read_string( mbedtls_ecp_point *P, int radix,
Manuel Pégourié-Gonnard847395a2012-11-05 13:13:44 +0100715 const char *x, const char *y )
716{
Janos Follath24eed8d2019-11-22 13:21:35 +0000717 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500718 ECP_VALIDATE_RET( P != NULL );
719 ECP_VALIDATE_RET( x != NULL );
720 ECP_VALIDATE_RET( y != NULL );
Manuel Pégourié-Gonnard847395a2012-11-05 13:13:44 +0100721
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200722 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &P->X, radix, x ) );
723 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &P->Y, radix, y ) );
724 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &P->Z, 1 ) );
Manuel Pégourié-Gonnard847395a2012-11-05 13:13:44 +0100725
726cleanup:
727 return( ret );
728}
729
730/*
Janos Follath7caf8e42019-02-20 12:00:22 +0000731 * Export a point into unsigned binary data (SEC1 2.3.3 and RFC7748)
Manuel Pégourié-Gonnarde19feb52012-11-24 14:10:14 +0100732 */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500733int mbedtls_ecp_point_write_binary( const mbedtls_ecp_group *grp,
734 const mbedtls_ecp_point *P,
735 int format, size_t *olen,
736 unsigned char *buf, size_t buflen )
Manuel Pégourié-Gonnarde19feb52012-11-24 14:10:14 +0100737{
Janos Follath28eb06d2019-02-26 10:53:34 +0000738 int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnarde19feb52012-11-24 14:10:14 +0100739 size_t plen;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500740 ECP_VALIDATE_RET( grp != NULL );
741 ECP_VALIDATE_RET( P != NULL );
742 ECP_VALIDATE_RET( olen != NULL );
743 ECP_VALIDATE_RET( buf != NULL );
744 ECP_VALIDATE_RET( format == MBEDTLS_ECP_PF_UNCOMPRESSED ||
745 format == MBEDTLS_ECP_PF_COMPRESSED );
Manuel Pégourié-Gonnard37d218a2012-11-24 15:19:55 +0100746
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200747 plen = mbedtls_mpi_size( &grp->P );
Manuel Pégourié-Gonnarde19feb52012-11-24 14:10:14 +0100748
Gilles Peskinee8c04fe2018-09-14 17:44:21 +0200749#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
Gilles Peskine59970052019-02-28 13:12:06 +0100750 (void) format; /* Montgomery curves always use the same point format */
Janos Follathdf9295b2019-02-26 12:36:52 +0000751 if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
Manuel Pégourié-Gonnard37d218a2012-11-24 15:19:55 +0100752 {
Janos Follath7caf8e42019-02-20 12:00:22 +0000753 *olen = plen;
Manuel Pégourié-Gonnard37d218a2012-11-24 15:19:55 +0100754 if( buflen < *olen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200755 return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnard37d218a2012-11-24 15:19:55 +0100756
Janos Follath7caf8e42019-02-20 12:00:22 +0000757 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary_le( &P->X, buf, plen ) );
Manuel Pégourié-Gonnard37d218a2012-11-24 15:19:55 +0100758 }
Janos Follath7caf8e42019-02-20 12:00:22 +0000759#endif
Gilles Peskinee8c04fe2018-09-14 17:44:21 +0200760#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
Janos Follathdf9295b2019-02-26 12:36:52 +0000761 if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
Manuel Pégourié-Gonnard37d218a2012-11-24 15:19:55 +0100762 {
Janos Follath7caf8e42019-02-20 12:00:22 +0000763 /*
764 * Common case: P == 0
765 */
766 if( mbedtls_mpi_cmp_int( &P->Z, 0 ) == 0 )
767 {
768 if( buflen < 1 )
769 return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnard37d218a2012-11-24 15:19:55 +0100770
Janos Follath7caf8e42019-02-20 12:00:22 +0000771 buf[0] = 0x00;
772 *olen = 1;
Manuel Pégourié-Gonnard37d218a2012-11-24 15:19:55 +0100773
Janos Follath7caf8e42019-02-20 12:00:22 +0000774 return( 0 );
775 }
776
777 if( format == MBEDTLS_ECP_PF_UNCOMPRESSED )
778 {
779 *olen = 2 * plen + 1;
780
781 if( buflen < *olen )
782 return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
783
784 buf[0] = 0x04;
785 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->X, buf + 1, plen ) );
786 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->Y, buf + 1 + plen, plen ) );
787 }
788 else if( format == MBEDTLS_ECP_PF_COMPRESSED )
789 {
790 *olen = plen + 1;
791
792 if( buflen < *olen )
793 return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
794
795 buf[0] = 0x02 + mbedtls_mpi_get_bit( &P->Y, 0 );
796 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->X, buf + 1, plen ) );
797 }
Manuel Pégourié-Gonnard37d218a2012-11-24 15:19:55 +0100798 }
Janos Follath7caf8e42019-02-20 12:00:22 +0000799#endif
Manuel Pégourié-Gonnarde19feb52012-11-24 14:10:14 +0100800
801cleanup:
802 return( ret );
803}
804
805/*
Janos Follath59b813c2019-02-13 10:44:06 +0000806 * Import a point from unsigned binary data (SEC1 2.3.4 and RFC7748)
Manuel Pégourié-Gonnard5e402d82012-11-24 16:19:42 +0100807 */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500808int mbedtls_ecp_point_read_binary( const mbedtls_ecp_group *grp,
809 mbedtls_ecp_point *pt,
810 const unsigned char *buf, size_t ilen )
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100811{
Janos Follath28eb06d2019-02-26 10:53:34 +0000812 int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard5e402d82012-11-24 16:19:42 +0100813 size_t plen;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500814 ECP_VALIDATE_RET( grp != NULL );
815 ECP_VALIDATE_RET( pt != NULL );
816 ECP_VALIDATE_RET( buf != NULL );
Manuel Pégourié-Gonnard5e402d82012-11-24 16:19:42 +0100817
Paul Bakker82788fb2014-10-20 13:59:19 +0200818 if( ilen < 1 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200819 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard67dbe1e2014-07-08 13:09:24 +0200820
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200821 plen = mbedtls_mpi_size( &grp->P );
Manuel Pégourié-Gonnard5e402d82012-11-24 16:19:42 +0100822
Gilles Peskinee8c04fe2018-09-14 17:44:21 +0200823#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
Janos Follathdf9295b2019-02-26 12:36:52 +0000824 if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
Janos Follath59b813c2019-02-13 10:44:06 +0000825 {
826 if( plen != ilen )
827 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard5246ee52014-03-19 16:18:38 +0100828
Janos Follath59b813c2019-02-13 10:44:06 +0000829 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary_le( &pt->X, buf, plen ) );
830 mbedtls_mpi_free( &pt->Y );
Manuel Pégourié-Gonnard5e402d82012-11-24 16:19:42 +0100831
Janos Follath59b813c2019-02-13 10:44:06 +0000832 if( grp->id == MBEDTLS_ECP_DP_CURVE25519 )
Janos Follathffbd7e82019-02-25 11:35:20 +0000833 /* Set most significant bit to 0 as prescribed in RFC7748 §5 */
Janos Follath59b813c2019-02-13 10:44:06 +0000834 MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &pt->X, plen * 8 - 1, 0 ) );
Janos Follath28eb06d2019-02-26 10:53:34 +0000835
836 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z, 1 ) );
Janos Follath59b813c2019-02-13 10:44:06 +0000837 }
838#endif
Gilles Peskinee8c04fe2018-09-14 17:44:21 +0200839#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
Janos Follathdf9295b2019-02-26 12:36:52 +0000840 if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
Janos Follath59b813c2019-02-13 10:44:06 +0000841 {
842 if( buf[0] == 0x00 )
843 {
844 if( ilen == 1 )
845 return( mbedtls_ecp_set_zero( pt ) );
846 else
847 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
848 }
849
850 if( buf[0] != 0x04 )
851 return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
852
853 if( ilen != 2 * plen + 1 )
854 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
855
856 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &pt->X, buf + 1, plen ) );
857 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &pt->Y,
858 buf + 1 + plen, plen ) );
Janos Follath28eb06d2019-02-26 10:53:34 +0000859 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z, 1 ) );
Janos Follath59b813c2019-02-13 10:44:06 +0000860 }
861#endif
Manuel Pégourié-Gonnard5e402d82012-11-24 16:19:42 +0100862
863cleanup:
864 return( ret );
865}
866
867/*
Manuel Pégourié-Gonnard00794052013-02-09 19:00:07 +0100868 * Import a point from a TLS ECPoint record (RFC 4492)
869 * struct {
870 * opaque point <1..2^8-1>;
871 * } ECPoint;
872 */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500873int mbedtls_ecp_tls_read_point( const mbedtls_ecp_group *grp,
874 mbedtls_ecp_point *pt,
875 const unsigned char **buf, size_t buf_len )
Manuel Pégourié-Gonnard00794052013-02-09 19:00:07 +0100876{
877 unsigned char data_len;
Manuel Pégourié-Gonnard98f51812013-02-10 13:38:29 +0100878 const unsigned char *buf_start;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500879 ECP_VALIDATE_RET( grp != NULL );
880 ECP_VALIDATE_RET( pt != NULL );
881 ECP_VALIDATE_RET( buf != NULL );
882 ECP_VALIDATE_RET( *buf != NULL );
Manuel Pégourié-Gonnard00794052013-02-09 19:00:07 +0100883
884 /*
Manuel Pégourié-Gonnard67dbe1e2014-07-08 13:09:24 +0200885 * We must have at least two bytes (1 for length, at least one for data)
Manuel Pégourié-Gonnard00794052013-02-09 19:00:07 +0100886 */
887 if( buf_len < 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200888 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard00794052013-02-09 19:00:07 +0100889
Manuel Pégourié-Gonnard98f51812013-02-10 13:38:29 +0100890 data_len = *(*buf)++;
Manuel Pégourié-Gonnard00794052013-02-09 19:00:07 +0100891 if( data_len < 1 || data_len > buf_len - 1 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200892 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard00794052013-02-09 19:00:07 +0100893
Manuel Pégourié-Gonnard98f51812013-02-10 13:38:29 +0100894 /*
895 * Save buffer start for read_binary and update buf
896 */
897 buf_start = *buf;
898 *buf += data_len;
899
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500900 return( mbedtls_ecp_point_read_binary( grp, pt, buf_start, data_len ) );
Manuel Pégourié-Gonnard00794052013-02-09 19:00:07 +0100901}
902
903/*
904 * Export a point as a TLS ECPoint record (RFC 4492)
905 * struct {
906 * opaque point <1..2^8-1>;
907 * } ECPoint;
908 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200909int mbedtls_ecp_tls_write_point( const mbedtls_ecp_group *grp, const mbedtls_ecp_point *pt,
Manuel Pégourié-Gonnard420f1eb2013-02-10 12:22:46 +0100910 int format, size_t *olen,
911 unsigned char *buf, size_t blen )
Manuel Pégourié-Gonnard00794052013-02-09 19:00:07 +0100912{
Janos Follath24eed8d2019-11-22 13:21:35 +0000913 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500914 ECP_VALIDATE_RET( grp != NULL );
915 ECP_VALIDATE_RET( pt != NULL );
916 ECP_VALIDATE_RET( olen != NULL );
917 ECP_VALIDATE_RET( buf != NULL );
918 ECP_VALIDATE_RET( format == MBEDTLS_ECP_PF_UNCOMPRESSED ||
919 format == MBEDTLS_ECP_PF_COMPRESSED );
Manuel Pégourié-Gonnard420f1eb2013-02-10 12:22:46 +0100920
Manuel Pégourié-Gonnard00794052013-02-09 19:00:07 +0100921 /*
Manuel Pégourié-Gonnard420f1eb2013-02-10 12:22:46 +0100922 * buffer length must be at least one, for our length byte
Manuel Pégourié-Gonnard00794052013-02-09 19:00:07 +0100923 */
Manuel Pégourié-Gonnard420f1eb2013-02-10 12:22:46 +0100924 if( blen < 1 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200925 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard00794052013-02-09 19:00:07 +0100926
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200927 if( ( ret = mbedtls_ecp_point_write_binary( grp, pt, format,
Manuel Pégourié-Gonnard420f1eb2013-02-10 12:22:46 +0100928 olen, buf + 1, blen - 1) ) != 0 )
929 return( ret );
930
931 /*
932 * write length to the first byte and update total length
933 */
Paul Bakkerb9cfaa02013-10-11 18:58:55 +0200934 buf[0] = (unsigned char) *olen;
Manuel Pégourié-Gonnard420f1eb2013-02-10 12:22:46 +0100935 ++*olen;
936
Paul Bakkerd8bb8262014-06-17 14:06:49 +0200937 return( 0 );
Manuel Pégourié-Gonnard00794052013-02-09 19:00:07 +0100938}
939
940/*
Manuel Pégourié-Gonnard1a967282013-02-09 17:03:58 +0100941 * Set a group from an ECParameters record (RFC 4492)
942 */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500943int mbedtls_ecp_tls_read_group( mbedtls_ecp_group *grp,
944 const unsigned char **buf, size_t len )
945{
Janos Follath24eed8d2019-11-22 13:21:35 +0000946 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500947 mbedtls_ecp_group_id grp_id;
948 ECP_VALIDATE_RET( grp != NULL );
949 ECP_VALIDATE_RET( buf != NULL );
950 ECP_VALIDATE_RET( *buf != NULL );
951
952 if( ( ret = mbedtls_ecp_tls_read_group_id( &grp_id, buf, len ) ) != 0 )
953 return( ret );
954
955 return( mbedtls_ecp_group_load( grp, grp_id ) );
956}
957
958/*
959 * Read a group id from an ECParameters record (RFC 4492) and convert it to
960 * mbedtls_ecp_group_id.
961 */
962int mbedtls_ecp_tls_read_group_id( mbedtls_ecp_group_id *grp,
963 const unsigned char **buf, size_t len )
Manuel Pégourié-Gonnard1a967282013-02-09 17:03:58 +0100964{
Manuel Pégourié-Gonnardf24b4a72013-09-23 18:14:50 +0200965 uint16_t tls_id;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200966 const mbedtls_ecp_curve_info *curve_info;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500967 ECP_VALIDATE_RET( grp != NULL );
968 ECP_VALIDATE_RET( buf != NULL );
969 ECP_VALIDATE_RET( *buf != NULL );
Manuel Pégourié-Gonnard1a967282013-02-09 17:03:58 +0100970
971 /*
972 * We expect at least three bytes (see below)
973 */
974 if( len < 3 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200975 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard1a967282013-02-09 17:03:58 +0100976
977 /*
978 * First byte is curve_type; only named_curve is handled
979 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200980 if( *(*buf)++ != MBEDTLS_ECP_TLS_NAMED_CURVE )
981 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard1a967282013-02-09 17:03:58 +0100982
983 /*
Manuel Pégourié-Gonnardb3258872013-02-10 12:06:19 +0100984 * Next two bytes are the namedcurve value
Manuel Pégourié-Gonnard1a967282013-02-09 17:03:58 +0100985 */
Manuel Pégourié-Gonnardf24b4a72013-09-23 18:14:50 +0200986 tls_id = *(*buf)++;
987 tls_id <<= 8;
988 tls_id |= *(*buf)++;
989
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200990 if( ( curve_info = mbedtls_ecp_curve_info_from_tls_id( tls_id ) ) == NULL )
991 return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnardf24b4a72013-09-23 18:14:50 +0200992
Andrzej Kurekc470b6b2019-01-31 08:20:20 -0500993 *grp = curve_info->grp_id;
994
995 return( 0 );
Manuel Pégourié-Gonnardb3258872013-02-10 12:06:19 +0100996}
997
998/*
999 * Write the ECParameters record corresponding to a group (RFC 4492)
1000 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001001int mbedtls_ecp_tls_write_group( const mbedtls_ecp_group *grp, size_t *olen,
Manuel Pégourié-Gonnardb3258872013-02-10 12:06:19 +01001002 unsigned char *buf, size_t blen )
1003{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001004 const mbedtls_ecp_curve_info *curve_info;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05001005 ECP_VALIDATE_RET( grp != NULL );
1006 ECP_VALIDATE_RET( buf != NULL );
1007 ECP_VALIDATE_RET( olen != NULL );
Manuel Pégourié-Gonnardf24b4a72013-09-23 18:14:50 +02001008
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001009 if( ( curve_info = mbedtls_ecp_curve_info_from_grp_id( grp->id ) ) == NULL )
1010 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard70380392013-09-16 16:19:53 +02001011
Manuel Pégourié-Gonnardb3258872013-02-10 12:06:19 +01001012 /*
1013 * We are going to write 3 bytes (see below)
1014 */
1015 *olen = 3;
1016 if( blen < *olen )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001017 return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
Manuel Pégourié-Gonnardb3258872013-02-10 12:06:19 +01001018
1019 /*
1020 * First byte is curve_type, always named_curve
1021 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001022 *buf++ = MBEDTLS_ECP_TLS_NAMED_CURVE;
Manuel Pégourié-Gonnardb3258872013-02-10 12:06:19 +01001023
1024 /*
1025 * Next two bytes are the namedcurve value
1026 */
Joe Subbianid0687852021-07-21 15:22:47 +01001027 MBEDTLS_PUT_UINT16_BE( curve_info->tls_id, buf, 0 );
Manuel Pégourié-Gonnardb3258872013-02-10 12:06:19 +01001028
Paul Bakkerd8bb8262014-06-17 14:06:49 +02001029 return( 0 );
Manuel Pégourié-Gonnarda5402fe2012-11-07 20:24:05 +01001030}
Manuel Pégourié-Gonnardab38b702012-11-05 17:34:55 +01001031
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +02001032/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001033 * Wrapper around fast quasi-modp functions, with fall-back to mbedtls_mpi_mod_mpi.
1034 * See the documentation of struct mbedtls_ecp_group.
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +02001035 *
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001036 * This function is in the critial loop for mbedtls_ecp_mul, so pay attention to perf.
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +02001037 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001038static int ecp_modp( mbedtls_mpi *N, const mbedtls_ecp_group *grp )
Manuel Pégourié-Gonnard70380392013-09-16 16:19:53 +02001039{
Janos Follath24eed8d2019-11-22 13:21:35 +00001040 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +02001041
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +02001042 if( grp->modp == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001043 return( mbedtls_mpi_mod_mpi( N, N, &grp->P ) );
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +02001044
1045 /* N->s < 0 is a much faster test, which fails only if N is 0 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001046 if( ( N->s < 0 && mbedtls_mpi_cmp_int( N, 0 ) != 0 ) ||
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +02001047 mbedtls_mpi_bitlen( N ) > 2 * grp->pbits )
Manuel Pégourié-Gonnard70380392013-09-16 16:19:53 +02001048 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001049 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard70380392013-09-16 16:19:53 +02001050 }
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +02001051
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001052 MBEDTLS_MPI_CHK( grp->modp( N ) );
Manuel Pégourié-Gonnard70380392013-09-16 16:19:53 +02001053
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +02001054 /* N->s < 0 is a much faster test, which fails only if N is 0 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001055 while( N->s < 0 && mbedtls_mpi_cmp_int( N, 0 ) != 0 )
1056 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &grp->P ) );
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +02001057
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001058 while( mbedtls_mpi_cmp_mpi( N, &grp->P ) >= 0 )
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +02001059 /* we known P, N and the result are positive */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001060 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( N, N, &grp->P ) );
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +02001061
Manuel Pégourié-Gonnardcae6f3e2013-10-23 20:19:57 +02001062cleanup:
1063 return( ret );
Manuel Pégourié-Gonnard70380392013-09-16 16:19:53 +02001064}
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +02001065
Manuel Pégourié-Gonnard847395a2012-11-05 13:13:44 +01001066/*
Manuel Pégourié-Gonnard47123252012-11-10 14:44:24 +01001067 * Fast mod-p functions expect their argument to be in the 0..p^2 range.
Manuel Pégourié-Gonnarddada4da2012-11-10 14:23:17 +01001068 *
Manuel Pégourié-Gonnard47123252012-11-10 14:44:24 +01001069 * In order to guarantee that, we need to ensure that operands of
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001070 * mbedtls_mpi_mul_mpi are in the 0..p range. So, after each operation we will
Manuel Pégourié-Gonnarddada4da2012-11-10 14:23:17 +01001071 * bring the result back to this range.
1072 *
Manuel Pégourié-Gonnard47123252012-11-10 14:44:24 +01001073 * The following macros are shortcuts for doing that.
Manuel Pégourié-Gonnarddada4da2012-11-10 14:23:17 +01001074 */
1075
1076/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001077 * Reduce a mbedtls_mpi mod p in-place, general case, to use after mbedtls_mpi_mul_mpi
Manuel Pégourié-Gonnard84d1aea2012-11-09 02:09:38 +01001078 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001079#if defined(MBEDTLS_SELF_TEST)
Manuel Pégourié-Gonnard91814812013-11-21 20:23:55 +01001080#define INC_MUL_COUNT mul_count++;
1081#else
1082#define INC_MUL_COUNT
1083#endif
1084
Hanno Becker1eeca412018-10-15 12:01:35 +01001085#define MOD_MUL( N ) \
1086 do \
1087 { \
1088 MBEDTLS_MPI_CHK( ecp_modp( &(N), grp ) ); \
1089 INC_MUL_COUNT \
1090 } while( 0 )
Manuel Pégourié-Gonnard84d1aea2012-11-09 02:09:38 +01001091
Gilles Peskine3b3b34f2019-07-18 21:08:27 +02001092static inline int mbedtls_mpi_mul_mod( const mbedtls_ecp_group *grp,
1093 mbedtls_mpi *X,
1094 const mbedtls_mpi *A,
1095 const mbedtls_mpi *B )
1096{
Janos Follath24eed8d2019-11-22 13:21:35 +00001097 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine3b3b34f2019-07-18 21:08:27 +02001098 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( X, A, B ) );
1099 MOD_MUL( *X );
1100cleanup:
1101 return( ret );
1102}
1103
Manuel Pégourié-Gonnard84d1aea2012-11-09 02:09:38 +01001104/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001105 * Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_sub_mpi
Manuel Pégourié-Gonnardc9e387c2013-10-17 17:15:35 +02001106 * N->s < 0 is a very fast test, which fails only if N is 0
Manuel Pégourié-Gonnard84d1aea2012-11-09 02:09:38 +01001107 */
Hanno Beckerce29ae82022-01-04 04:55:11 +00001108#define MOD_SUB( N ) \
1109 do { \
1110 while( (N)->s < 0 && mbedtls_mpi_cmp_int( (N), 0 ) != 0 ) \
1111 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( (N), (N), &grp->P ) ); \
1112 } while( 0 )
Manuel Pégourié-Gonnard84d1aea2012-11-09 02:09:38 +01001113
Steven Cooremane5388962021-03-01 14:04:53 +01001114#if ( defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) && \
1115 !( defined(MBEDTLS_ECP_NO_FALLBACK) && \
1116 defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) && \
1117 defined(MBEDTLS_ECP_ADD_MIXED_ALT) ) ) || \
1118 ( defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) && \
1119 !( defined(MBEDTLS_ECP_NO_FALLBACK) && \
1120 defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) ) )
Gilles Peskine3b3b34f2019-07-18 21:08:27 +02001121static inline int mbedtls_mpi_sub_mod( const mbedtls_ecp_group *grp,
1122 mbedtls_mpi *X,
1123 const mbedtls_mpi *A,
1124 const mbedtls_mpi *B )
1125{
Janos Follath24eed8d2019-11-22 13:21:35 +00001126 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine3b3b34f2019-07-18 21:08:27 +02001127 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( X, A, B ) );
Hanno Beckerce29ae82022-01-04 04:55:11 +00001128 MOD_SUB( X );
Gilles Peskine3b3b34f2019-07-18 21:08:27 +02001129cleanup:
1130 return( ret );
1131}
Steven Cooremane5388962021-03-01 14:04:53 +01001132#endif /* All functions referencing mbedtls_mpi_sub_mod() are alt-implemented without fallback */
Gilles Peskine3b3b34f2019-07-18 21:08:27 +02001133
Manuel Pégourié-Gonnard84d1aea2012-11-09 02:09:38 +01001134/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001135 * Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_add_mpi and mbedtls_mpi_mul_int.
Manuel Pégourié-Gonnardc9e387c2013-10-17 17:15:35 +02001136 * We known P, N and the result are positive, so sub_abs is correct, and
1137 * a bit faster.
Manuel Pégourié-Gonnard84d1aea2012-11-09 02:09:38 +01001138 */
Hanno Beckerce29ae82022-01-04 04:55:11 +00001139#define MOD_ADD( N ) \
1140 while( mbedtls_mpi_cmp_mpi( (N), &grp->P ) >= 0 ) \
1141 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( (N), (N), &grp->P ) )
Manuel Pégourié-Gonnard84d1aea2012-11-09 02:09:38 +01001142
Gilles Peskine3b3b34f2019-07-18 21:08:27 +02001143static inline int mbedtls_mpi_add_mod( const mbedtls_ecp_group *grp,
1144 mbedtls_mpi *X,
1145 const mbedtls_mpi *A,
1146 const mbedtls_mpi *B )
1147{
Janos Follath24eed8d2019-11-22 13:21:35 +00001148 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine3b3b34f2019-07-18 21:08:27 +02001149 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( X, A, B ) );
Hanno Beckerce29ae82022-01-04 04:55:11 +00001150 MOD_ADD( X );
Gilles Peskine3b3b34f2019-07-18 21:08:27 +02001151cleanup:
1152 return( ret );
1153}
1154
Hanno Becker02b35bd2022-01-01 06:54:25 +00001155static inline int mbedtls_mpi_mul_int_mod( const mbedtls_ecp_group *grp,
1156 mbedtls_mpi *X,
1157 const mbedtls_mpi *A,
1158 mbedtls_mpi_uint c )
1159{
1160 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1161
1162 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( X, A, c ) );
Hanno Beckerce29ae82022-01-04 04:55:11 +00001163 MOD_ADD( X );
Hanno Becker02b35bd2022-01-01 06:54:25 +00001164cleanup:
1165 return( ret );
1166}
1167
Hanno Beckerce29ae82022-01-04 04:55:11 +00001168static inline int mbedtls_mpi_sub_int_mod( const mbedtls_ecp_group *grp,
1169 mbedtls_mpi *X,
1170 const mbedtls_mpi *A,
1171 mbedtls_mpi_uint c )
1172{
1173 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1174
1175 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( X, A, c ) );
1176 MOD_SUB( X );
1177cleanup:
1178 return( ret );
1179}
1180
1181#define MPI_ECP_SUB_INT( X, A, c ) \
1182 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int_mod( grp, X, A, c ) )
1183
Steven Cooremane5388962021-03-01 14:04:53 +01001184#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) && \
1185 !( defined(MBEDTLS_ECP_NO_FALLBACK) && \
1186 defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) && \
1187 defined(MBEDTLS_ECP_ADD_MIXED_ALT) )
Gilles Peskine3b3b34f2019-07-18 21:08:27 +02001188static inline int mbedtls_mpi_shift_l_mod( const mbedtls_ecp_group *grp,
1189 mbedtls_mpi *X,
1190 size_t count )
1191{
Janos Follath24eed8d2019-11-22 13:21:35 +00001192 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine3b3b34f2019-07-18 21:08:27 +02001193 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( X, count ) );
Hanno Beckerce29ae82022-01-04 04:55:11 +00001194 MOD_ADD( X );
Gilles Peskine3b3b34f2019-07-18 21:08:27 +02001195cleanup:
1196 return( ret );
1197}
Steven Cooremane5388962021-03-01 14:04:53 +01001198#endif /* All functions referencing mbedtls_mpi_shift_l_mod() are alt-implemented without fallback */
Gilles Peskine3b3b34f2019-07-18 21:08:27 +02001199
Hanno Becker595616e2022-01-05 08:28:24 +00001200/*
1201 * Macro wrappers around ECP modular arithmetic
1202 *
1203 * Currently, these wrappers are defined via the bignum module.
1204 */
1205
1206#define MPI_ECP_ADD( X, A, B ) \
Hanno Beckerce29ae82022-01-04 04:55:11 +00001207 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, X, A, B ) )
1208
Hanno Becker595616e2022-01-05 08:28:24 +00001209#define MPI_ECP_SUB( X, A, B ) \
Hanno Beckerce29ae82022-01-04 04:55:11 +00001210 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, X, A, B ) )
1211
Hanno Becker595616e2022-01-05 08:28:24 +00001212#define MPI_ECP_MUL( X, A, B ) \
Hanno Beckerce29ae82022-01-04 04:55:11 +00001213 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, X, A, B ) )
1214
Hanno Becker595616e2022-01-05 08:28:24 +00001215#define MPI_ECP_SQR( X, A ) \
Hanno Becker885ed402022-01-04 06:43:50 +00001216 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, X, A, A ) )
1217
Hanno Becker595616e2022-01-05 08:28:24 +00001218#define MPI_ECP_MUL_INT( X, A, c ) \
Hanno Beckerce29ae82022-01-04 04:55:11 +00001219 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int_mod( grp, X, A, c ) )
1220
Hanno Becker595616e2022-01-05 08:28:24 +00001221#define MPI_ECP_INV( dst, src ) \
Hanno Beckerce29ae82022-01-04 04:55:11 +00001222 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( (dst), (src), &grp->P ) )
1223
Hanno Becker595616e2022-01-05 08:28:24 +00001224#define MPI_ECP_MOV( X, A ) \
Hanno Beckerce29ae82022-01-04 04:55:11 +00001225 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( X, A ) )
1226
Hanno Becker595616e2022-01-05 08:28:24 +00001227#define MPI_ECP_SHIFT_L( X, count ) \
Hanno Beckerce29ae82022-01-04 04:55:11 +00001228 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l_mod( grp, X, count ) )
1229
Hanno Becker595616e2022-01-05 08:28:24 +00001230#define MPI_ECP_LSET( X, c ) \
1231 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( X, c ) )
1232
1233#define MPI_ECP_CMP_INT( X, c ) \
1234 mbedtls_mpi_cmp_int( X, c )
1235
1236#define MPI_ECP_CMP( X, Y ) \
1237 mbedtls_mpi_cmp_mpi( X, Y )
1238
1239/* Needs f_rng, p_rng to be defined. */
1240#define MPI_ECP_RAND( X ) \
1241 MBEDTLS_MPI_CHK( mbedtls_mpi_random( (X), 2, &grp->P, f_rng, p_rng ) )
1242
1243/* Conditional negation
1244 * Needs grp and a temporary MPI tmp to be defined. */
1245#define MPI_ECP_COND_NEG( X, cond ) \
1246 do \
1247 { \
1248 unsigned char nonzero = mbedtls_mpi_cmp_int( (X), 0 ) != 0; \
1249 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &tmp, &grp->P, (X) ) ); \
1250 MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( (X), &tmp, \
1251 nonzero & cond ) ); \
1252 } while( 0 )
1253
Hanno Beckerc27a0e02022-01-06 05:56:34 +00001254#define MPI_ECP_NEG( X ) MPI_ECP_COND_NEG( (X), 1 )
1255
1256#define MPI_ECP_VALID( X ) \
1257 ( (X)->p != NULL )
1258
1259#define MPI_ECP_COND_ASSIGN( X, Y, cond ) \
1260 MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( (X), (Y), (cond) ) )
1261
1262#define MPI_ECP_COND_SWAP( X, Y, cond ) \
1263 MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( (X), (Y), (cond) ) )
1264
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02001265#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
Manuel Pégourié-Gonnard7c94d8b2013-12-04 23:15:46 +01001266/*
1267 * For curves in short Weierstrass form, we do all the internal operations in
1268 * Jacobian coordinates.
1269 *
1270 * For multiplication, we'll use a comb method with coutermeasueres against
1271 * SPA, hence timing attacks.
1272 */
1273
Manuel Pégourié-Gonnard84d1aea2012-11-09 02:09:38 +01001274/*
Manuel Pégourié-Gonnard1c2782c2012-11-19 20:16:28 +01001275 * Normalize jacobian coordinates so that Z == 0 || Z == 1 (GECC 3.2.1)
Manuel Pégourié-Gonnard04a02252013-11-20 22:57:38 +01001276 * Cost: 1N := 1I + 3M + 1S
Manuel Pégourié-Gonnardd070f512012-11-08 17:40:51 +01001277 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001278static int ecp_normalize_jac( const mbedtls_ecp_group *grp, mbedtls_ecp_point *pt )
Manuel Pégourié-Gonnardd070f512012-11-08 17:40:51 +01001279{
Hanno Becker595616e2022-01-05 08:28:24 +00001280 if( MPI_ECP_CMP_INT( &pt->Z, 0 ) == 0 )
Manuel Pégourié-Gonnardd070f512012-11-08 17:40:51 +01001281 return( 0 );
Manuel Pégourié-Gonnardd070f512012-11-08 17:40:51 +01001282
Janos Follathb0697532016-08-18 12:38:46 +01001283#if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT)
Manuel Pégourié-Gonnardebac5d32017-08-23 16:23:36 +02001284 if( mbedtls_internal_ecp_grp_capable( grp ) )
1285 return( mbedtls_internal_ecp_normalize_jac( grp, pt ) );
Janos Follath372697b2016-10-28 16:53:11 +01001286#endif /* MBEDTLS_ECP_NORMALIZE_JAC_ALT */
Manuel Pégourié-Gonnardebac5d32017-08-23 16:23:36 +02001287
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01001288#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT)
1289 return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
1290#else
1291 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker76f897d2022-01-02 12:47:34 +00001292 mbedtls_mpi T;
1293 mbedtls_mpi_init( &T );
Manuel Pégourié-Gonnardd070f512012-11-08 17:40:51 +01001294
Hanno Beckerce29ae82022-01-04 04:55:11 +00001295 MPI_ECP_INV( &T, &pt->Z ); /* T <- 1 / Z */
1296 MPI_ECP_MUL( &pt->Y, &pt->Y, &T ); /* Y' <- Y*T = Y / Z */
Hanno Becker885ed402022-01-04 06:43:50 +00001297 MPI_ECP_SQR( &T, &T ); /* T <- T^2 = 1 / Z^2 */
Hanno Beckerce29ae82022-01-04 04:55:11 +00001298 MPI_ECP_MUL( &pt->X, &pt->X, &T ); /* X <- X * T = X / Z^2 */
1299 MPI_ECP_MUL( &pt->Y, &pt->Y, &T ); /* Y'' <- Y' * T = Y / Z^3 */
Manuel Pégourié-Gonnardd070f512012-11-08 17:40:51 +01001300
Hanno Becker595616e2022-01-05 08:28:24 +00001301 MPI_ECP_LSET( &pt->Z, 1 );
Manuel Pégourié-Gonnardd070f512012-11-08 17:40:51 +01001302
1303cleanup:
1304
Hanno Becker76f897d2022-01-02 12:47:34 +00001305 mbedtls_mpi_free( &T );
Manuel Pégourié-Gonnardd070f512012-11-08 17:40:51 +01001306
1307 return( ret );
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01001308#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT) */
Manuel Pégourié-Gonnardd070f512012-11-08 17:40:51 +01001309}
1310
1311/*
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001312 * Normalize jacobian coordinates of an array of (pointers to) points,
Manuel Pégourié-Gonnard3680c822012-11-21 18:49:45 +01001313 * using Montgomery's trick to perform only one inversion mod P.
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001314 * (See for example Cohen's "A Course in Computational Algebraic Number
1315 * Theory", Algorithm 10.3.4.)
1316 *
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +02001317 * Warning: fails (returning an error) if one of the points is zero!
Manuel Pégourié-Gonnard7a949d32013-12-05 10:26:01 +01001318 * This should never happen, see choice of w in ecp_mul_comb().
Manuel Pégourié-Gonnard04a02252013-11-20 22:57:38 +01001319 *
1320 * Cost: 1N(t) := 1I + (6t - 3)M + 1S
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001321 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001322static int ecp_normalize_jac_many( const mbedtls_ecp_group *grp,
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001323 mbedtls_ecp_point *T[], size_t T_size )
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001324{
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001325 if( T_size < 2 )
Manuel Pégourié-Gonnard3c0b4ea2013-12-02 19:44:41 +01001326 return( ecp_normalize_jac( grp, *T ) );
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001327
Janos Follathb0697532016-08-18 12:38:46 +01001328#if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT)
Manuel Pégourié-Gonnardebac5d32017-08-23 16:23:36 +02001329 if( mbedtls_internal_ecp_grp_capable( grp ) )
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001330 return( mbedtls_internal_ecp_normalize_jac_many( grp, T, T_size ) );
Janos Follathb0697532016-08-18 12:38:46 +01001331#endif
1332
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01001333#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT)
1334 return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
1335#else
1336 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1337 size_t i;
Hanno Beckerb8442cd2022-01-04 06:32:11 +00001338 mbedtls_mpi *c, t;
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01001339
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001340 if( ( c = mbedtls_calloc( T_size, sizeof( mbedtls_mpi ) ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02001341 return( MBEDTLS_ERR_ECP_ALLOC_FAILED );
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001342
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +02001343 for( i = 0; i < T_size; i++ )
1344 mbedtls_mpi_init( &c[i] );
1345
Hanno Beckerb8442cd2022-01-04 06:32:11 +00001346 mbedtls_mpi_init( &t );
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001347
1348 /*
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001349 * c[i] = Z_0 * ... * Z_i, i = 0,..,n := T_size-1
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001350 */
Hanno Beckerce29ae82022-01-04 04:55:11 +00001351 MPI_ECP_MOV( &c[0], &T[0]->Z );
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001352 for( i = 1; i < T_size; i++ )
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001353 {
Hanno Beckerce29ae82022-01-04 04:55:11 +00001354 MPI_ECP_MUL( &c[i], &c[i-1], &T[i]->Z );
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001355 }
1356
1357 /*
Hanno Beckerb8442cd2022-01-04 06:32:11 +00001358 * c[n] = 1 / (Z_0 * ... * Z_n) mod P
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001359 */
Hanno Beckerb8442cd2022-01-04 06:32:11 +00001360 MPI_ECP_INV( &c[T_size-1], &c[T_size-1] );
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001361
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001362 for( i = T_size - 1; ; i-- )
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001363 {
Hanno Beckerb8442cd2022-01-04 06:32:11 +00001364 /* At the start of iteration i (note that i decrements), we have
1365 * - c[j] = Z_0 * .... * Z_j for j < i,
1366 * - c[j] = 1 / (Z_0 * .... * Z_j) for j == i,
1367 *
1368 * This is maintained via
1369 * - c[i-1] <- c[i] * Z_i
1370 *
1371 * We also derive 1/Z_i = c[i] * c[i-1] for i>0 and use that
1372 * to do the actual normalization. For i==0, we already have
1373 * c[0] = 1 / Z_0.
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001374 */
Hanno Beckerb8442cd2022-01-04 06:32:11 +00001375
1376 if( i > 0 )
Hanno Beckerce29ae82022-01-04 04:55:11 +00001377 {
Hanno Beckerb8442cd2022-01-04 06:32:11 +00001378 /* Compute 1/Z_i and establish invariant for the next iteration. */
1379 MPI_ECP_MUL( &t, &c[i], &c[i-1] );
1380 MPI_ECP_MUL( &c[i-1], &c[i], &T[i]->Z );
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001381 }
1382 else
1383 {
Hanno Beckerb8442cd2022-01-04 06:32:11 +00001384 MPI_ECP_MOV( &t, &c[0] );
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001385 }
1386
Hanno Beckerb8442cd2022-01-04 06:32:11 +00001387 /* Now t holds 1 / Z_i; normalize as in ecp_normalize_jac() */
1388 MPI_ECP_MUL( &T[i]->Y, &T[i]->Y, &t );
Hanno Becker885ed402022-01-04 06:43:50 +00001389 MPI_ECP_SQR( &t, &t );
Hanno Beckerb8442cd2022-01-04 06:32:11 +00001390 MPI_ECP_MUL( &T[i]->X, &T[i]->X, &t );
1391 MPI_ECP_MUL( &T[i]->Y, &T[i]->Y, &t );
Manuel Pégourié-Gonnard1f789b82013-12-30 17:31:56 +01001392
1393 /*
1394 * Post-precessing: reclaim some memory by shrinking coordinates
1395 * - not storing Z (always 1)
1396 * - shrinking other coordinates, but still keeping the same number of
1397 * limbs as P, as otherwise it will too likely be regrown too fast.
1398 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001399 MBEDTLS_MPI_CHK( mbedtls_mpi_shrink( &T[i]->X, grp->P.n ) );
1400 MBEDTLS_MPI_CHK( mbedtls_mpi_shrink( &T[i]->Y, grp->P.n ) );
Hanno Beckeree95f6c2022-01-09 05:46:18 +00001401
1402 MPI_ECP_LSET( &T[i]->Z, 1 );
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001403
1404 if( i == 0 )
1405 break;
1406 }
1407
1408cleanup:
1409
Hanno Beckerb8442cd2022-01-04 06:32:11 +00001410 mbedtls_mpi_free( &t );
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001411 for( i = 0; i < T_size; i++ )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001412 mbedtls_mpi_free( &c[i] );
1413 mbedtls_free( c );
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001414
1415 return( ret );
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01001416#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT) */
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001417}
1418
Manuel Pégourié-Gonnardcdd44322012-11-21 16:00:55 +01001419/*
Manuel Pégourié-Gonnard01fca5e2013-11-21 17:47:12 +01001420 * Conditional point inversion: Q -> -Q = (Q.X, -Q.Y, Q.Z) without leak.
1421 * "inv" must be 0 (don't invert) or 1 (invert) or the result will be invalid
1422 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001423static int ecp_safe_invert_jac( const mbedtls_ecp_group *grp,
1424 mbedtls_ecp_point *Q,
Manuel Pégourié-Gonnard01fca5e2013-11-21 17:47:12 +01001425 unsigned char inv )
1426{
Janos Follath24eed8d2019-11-22 13:21:35 +00001427 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker595616e2022-01-05 08:28:24 +00001428 mbedtls_mpi tmp;
1429 mbedtls_mpi_init( &tmp );
Manuel Pégourié-Gonnard01fca5e2013-11-21 17:47:12 +01001430
Hanno Becker595616e2022-01-05 08:28:24 +00001431 MPI_ECP_COND_NEG( &Q->Y, inv );
Manuel Pégourié-Gonnard01fca5e2013-11-21 17:47:12 +01001432
1433cleanup:
Hanno Becker595616e2022-01-05 08:28:24 +00001434 mbedtls_mpi_free( &tmp );
Manuel Pégourié-Gonnard01fca5e2013-11-21 17:47:12 +01001435 return( ret );
1436}
1437
1438/*
Manuel Pégourié-Gonnard0cd6f982013-10-10 15:55:39 +02001439 * Point doubling R = 2 P, Jacobian coordinates
Manuel Pégourié-Gonnard0ace4b32013-10-10 12:44:27 +02001440 *
Peter Dettmance661b22015-02-07 14:43:51 +07001441 * Based on http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#doubling-dbl-1998-cmo-2 .
Manuel Pégourié-Gonnard04a02252013-11-20 22:57:38 +01001442 *
Peter Dettmance661b22015-02-07 14:43:51 +07001443 * We follow the variable naming fairly closely. The formula variations that trade a MUL for a SQR
1444 * (plus a few ADDs) aren't useful as our bignum implementation doesn't distinguish squaring.
1445 *
1446 * Standard optimizations are applied when curve parameter A is one of { 0, -3 }.
1447 *
1448 * Cost: 1D := 3M + 4S (A == 0)
1449 * 4M + 4S (A == -3)
1450 * 3M + 6S + 1a otherwise
Manuel Pégourié-Gonnard1c4aa242013-10-09 16:09:46 +02001451 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001452static int ecp_double_jac( const mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001453 const mbedtls_ecp_point *P,
1454 mbedtls_mpi tmp[4] )
Manuel Pégourié-Gonnard1c4aa242013-10-09 16:09:46 +02001455{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001456#if defined(MBEDTLS_SELF_TEST)
Manuel Pégourié-Gonnard0cd6f982013-10-10 15:55:39 +02001457 dbl_count++;
1458#endif
1459
Janos Follathb0697532016-08-18 12:38:46 +01001460#if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT)
Manuel Pégourié-Gonnardebac5d32017-08-23 16:23:36 +02001461 if( mbedtls_internal_ecp_grp_capable( grp ) )
1462 return( mbedtls_internal_ecp_double_jac( grp, R, P ) );
Janos Follath372697b2016-10-28 16:53:11 +01001463#endif /* MBEDTLS_ECP_DOUBLE_JAC_ALT */
Janos Follathb0697532016-08-18 12:38:46 +01001464
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01001465#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_DOUBLE_JAC_ALT)
1466 return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
1467#else
1468 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard73cc01d2013-12-06 12:41:30 +01001469
1470 /* Special case for A = -3 */
1471 if( grp->A.p == NULL )
1472 {
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001473 /* tmp[0] <- M = 3(X + Z^2)(X - Z^2) */
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001474 MPI_ECP_SQR( &tmp[1], &P->Z );
1475 MPI_ECP_ADD( &tmp[2], &P->X, &tmp[1] );
1476 MPI_ECP_SUB( &tmp[3], &P->X, &tmp[1] );
1477 MPI_ECP_MUL( &tmp[1], &tmp[2], &tmp[3] );
1478 MPI_ECP_MUL_INT( &tmp[0], &tmp[1], 3 );
Manuel Pégourié-Gonnard73cc01d2013-12-06 12:41:30 +01001479 }
1480 else
Peter Vaskovica676acf2014-08-06 00:48:39 +02001481 {
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001482 /* tmp[0] <- M = 3.X^2 + A.Z^4 */
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001483 MPI_ECP_SQR( &tmp[1], &P->X );
1484 MPI_ECP_MUL_INT( &tmp[0], &tmp[1], 3 );
Peter Dettmance661b22015-02-07 14:43:51 +07001485
1486 /* Optimize away for "koblitz" curves with A = 0 */
Hanno Becker595616e2022-01-05 08:28:24 +00001487 if( MPI_ECP_CMP_INT( &grp->A, 0 ) != 0 )
Peter Dettmance661b22015-02-07 14:43:51 +07001488 {
1489 /* M += A.Z^4 */
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001490 MPI_ECP_SQR( &tmp[1], &P->Z );
1491 MPI_ECP_SQR( &tmp[2], &tmp[1] );
1492 MPI_ECP_MUL( &tmp[1], &tmp[2], &grp->A );
1493 MPI_ECP_ADD( &tmp[0], &tmp[0], &tmp[1] );
Peter Dettmance661b22015-02-07 14:43:51 +07001494 }
Peter Vaskovica676acf2014-08-06 00:48:39 +02001495 }
Manuel Pégourié-Gonnard73cc01d2013-12-06 12:41:30 +01001496
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001497 /* tmp[1] <- S = 4.X.Y^2 */
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001498 MPI_ECP_SQR( &tmp[2], &P->Y );
1499 MPI_ECP_SHIFT_L( &tmp[2], 1 );
1500 MPI_ECP_MUL( &tmp[1], &P->X, &tmp[2] );
1501 MPI_ECP_SHIFT_L( &tmp[1], 1 );
Manuel Pégourié-Gonnard1c4aa242013-10-09 16:09:46 +02001502
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001503 /* tmp[3] <- U = 8.Y^4 */
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001504 MPI_ECP_SQR( &tmp[3], &tmp[2] );
1505 MPI_ECP_SHIFT_L( &tmp[3], 1 );
Peter Dettmance661b22015-02-07 14:43:51 +07001506
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001507 /* tmp[2] <- T = M^2 - 2.S */
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001508 MPI_ECP_SQR( &tmp[2], &tmp[0] );
1509 MPI_ECP_SUB( &tmp[2], &tmp[2], &tmp[1] );
1510 MPI_ECP_SUB( &tmp[2], &tmp[2], &tmp[1] );
Peter Dettmance661b22015-02-07 14:43:51 +07001511
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001512 /* tmp[1] <- S = M(S - T) - U */
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001513 MPI_ECP_SUB( &tmp[1], &tmp[1], &tmp[2] );
1514 MPI_ECP_MUL( &tmp[1], &tmp[1], &tmp[0] );
1515 MPI_ECP_SUB( &tmp[1], &tmp[1], &tmp[3] );
Peter Dettmance661b22015-02-07 14:43:51 +07001516
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001517 /* tmp[3] <- U = 2.Y.Z */
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001518 MPI_ECP_MUL( &tmp[3], &P->Y, &P->Z );
1519 MPI_ECP_SHIFT_L( &tmp[3], 1 );
Peter Dettmance661b22015-02-07 14:43:51 +07001520
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001521 /* Store results */
Hanno Becker595616e2022-01-05 08:28:24 +00001522 MPI_ECP_MOV( &R->X, &tmp[2] );
1523 MPI_ECP_MOV( &R->Y, &tmp[1] );
1524 MPI_ECP_MOV( &R->Z, &tmp[3] );
Manuel Pégourié-Gonnard1c4aa242013-10-09 16:09:46 +02001525
1526cleanup:
Manuel Pégourié-Gonnard1c4aa242013-10-09 16:09:46 +02001527
1528 return( ret );
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01001529#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) */
Manuel Pégourié-Gonnard1c4aa242013-10-09 16:09:46 +02001530}
1531
1532/*
Manuel Pégourié-Gonnard469a2092013-11-21 18:20:43 +01001533 * Addition: R = P + Q, mixed affine-Jacobian coordinates (GECC 3.22)
Manuel Pégourié-Gonnard9674fd02012-11-19 21:23:27 +01001534 *
1535 * The coordinates of Q must be normalized (= affine),
1536 * but those of P don't need to. R is not normalized.
1537 *
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001538 * P,Q,R may alias, but only at the level of EC points: they must be either
1539 * equal as pointers, or disjoint (including the coordinate data buffers).
1540 * Fine-grained aliasing at the level of coordinates is not supported.
1541 *
Manuel Pégourié-Gonnardaade42f2013-11-21 19:19:54 +01001542 * Special cases: (1) P or Q is zero, (2) R is zero, (3) P == Q.
Manuel Pégourié-Gonnard7a949d32013-12-05 10:26:01 +01001543 * None of these cases can happen as intermediate step in ecp_mul_comb():
Manuel Pégourié-Gonnardaade42f2013-11-21 19:19:54 +01001544 * - at each step, P, Q and R are multiples of the base point, the factor
1545 * being less than its order, so none of them is zero;
1546 * - Q is an odd multiple of the base point, P an even multiple,
1547 * due to the choice of precomputed points in the modified comb method.
1548 * So branches for these cases do not leak secret information.
1549 *
Manuel Pégourié-Gonnard04a02252013-11-20 22:57:38 +01001550 * Cost: 1A := 8M + 3S
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +01001551 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001552static int ecp_add_mixed( const mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
Hanno Becker3b29f212022-01-04 07:34:14 +00001553 const mbedtls_ecp_point *P, const mbedtls_ecp_point *Q,
1554 mbedtls_mpi tmp[4] )
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +01001555{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001556#if defined(MBEDTLS_SELF_TEST)
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +01001557 add_count++;
1558#endif
1559
Janos Follathb0697532016-08-18 12:38:46 +01001560#if defined(MBEDTLS_ECP_ADD_MIXED_ALT)
Manuel Pégourié-Gonnardebac5d32017-08-23 16:23:36 +02001561 if( mbedtls_internal_ecp_grp_capable( grp ) )
1562 return( mbedtls_internal_ecp_add_mixed( grp, R, P, Q ) );
Janos Follath372697b2016-10-28 16:53:11 +01001563#endif /* MBEDTLS_ECP_ADD_MIXED_ALT */
Janos Follathb0697532016-08-18 12:38:46 +01001564
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01001565#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_ADD_MIXED_ALT)
1566 return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
1567#else
1568 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker838b7152022-01-04 05:01:53 +00001569
1570 /* NOTE: Aliasing between input and output is allowed, so one has to make
1571 * sure that at the point X,Y,Z are written, {P,Q}->{X,Y,Z} are no
1572 * longer read from. */
Hanno Becker5c8ea302022-01-01 06:01:45 +00001573 mbedtls_mpi * const X = &R->X;
1574 mbedtls_mpi * const Y = &R->Y;
1575 mbedtls_mpi * const Z = &R->Z;
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01001576
Hanno Beckeree95f6c2022-01-09 05:46:18 +00001577 if( !MPI_ECP_VALID( &Q->Z ) )
1578 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
1579
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +01001580 /*
Manuel Pégourié-Gonnardaade42f2013-11-21 19:19:54 +01001581 * Trivial cases: P == 0 or Q == 0 (case 1)
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +01001582 */
Hanno Beckerc27a0e02022-01-06 05:56:34 +00001583 if( MPI_ECP_CMP_INT( &P->Z, 0 ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001584 return( mbedtls_ecp_copy( R, Q ) );
Manuel Pégourié-Gonnard469a2092013-11-21 18:20:43 +01001585
Hanno Beckeree95f6c2022-01-09 05:46:18 +00001586 if( MPI_ECP_CMP_INT( &Q->Z, 0 ) == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001587 return( mbedtls_ecp_copy( R, P ) );
Manuel Pégourié-Gonnard1c2782c2012-11-19 20:16:28 +01001588
1589 /*
1590 * Make sure Q coordinates are normalized
1591 */
Hanno Beckeree95f6c2022-01-09 05:46:18 +00001592 if( MPI_ECP_CMP_INT( &Q->Z, 1 ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001593 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +01001594
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001595 MPI_ECP_SQR( &tmp[0], &P->Z );
1596 MPI_ECP_MUL( &tmp[1], &tmp[0], &P->Z );
1597 MPI_ECP_MUL( &tmp[0], &tmp[0], &Q->X );
1598 MPI_ECP_MUL( &tmp[1], &tmp[1], &Q->Y );
1599 MPI_ECP_SUB( &tmp[0], &tmp[0], &P->X );
1600 MPI_ECP_SUB( &tmp[1], &tmp[1], &P->Y );
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +01001601
Manuel Pégourié-Gonnardaade42f2013-11-21 19:19:54 +01001602 /* Special cases (2) and (3) */
Hanno Becker595616e2022-01-05 08:28:24 +00001603 if( MPI_ECP_CMP_INT( &tmp[0], 0 ) == 0 )
Manuel Pégourié-Gonnard7e0adfb2012-11-08 23:21:46 +01001604 {
Hanno Becker595616e2022-01-05 08:28:24 +00001605 if( MPI_ECP_CMP_INT( &tmp[1], 0 ) == 0 )
Manuel Pégourié-Gonnard7e0adfb2012-11-08 23:21:46 +01001606 {
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001607 ret = ecp_double_jac( grp, R, P, tmp );
Manuel Pégourié-Gonnard7e0adfb2012-11-08 23:21:46 +01001608 goto cleanup;
1609 }
1610 else
1611 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001612 ret = mbedtls_ecp_set_zero( R );
Manuel Pégourié-Gonnard7e0adfb2012-11-08 23:21:46 +01001613 goto cleanup;
1614 }
1615 }
1616
Hanno Becker838b7152022-01-04 05:01:53 +00001617 /* {P,Q}->Z no longer used, so OK to write to Z even if there's aliasing. */
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001618 MPI_ECP_MUL( Z, &P->Z, &tmp[0] );
1619 MPI_ECP_SQR( &tmp[2], &tmp[0] );
1620 MPI_ECP_MUL( &tmp[3], &tmp[2], &tmp[0] );
1621 MPI_ECP_MUL( &tmp[2], &tmp[2], &P->X );
Hanno Beckerce29ae82022-01-04 04:55:11 +00001622
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001623 MPI_ECP_MOV( &tmp[0], &tmp[2] );
1624 MPI_ECP_SHIFT_L( &tmp[0], 1 );
Hanno Beckerce29ae82022-01-04 04:55:11 +00001625
Hanno Becker838b7152022-01-04 05:01:53 +00001626 /* {P,Q}->X no longer used, so OK to write to X even if there's aliasing. */
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001627 MPI_ECP_SQR( X, &tmp[1] );
1628 MPI_ECP_SUB( X, X, &tmp[0] );
1629 MPI_ECP_SUB( X, X, &tmp[3] );
1630 MPI_ECP_SUB( &tmp[2], &tmp[2], X );
1631 MPI_ECP_MUL( &tmp[2], &tmp[2], &tmp[1] );
1632 MPI_ECP_MUL( &tmp[3], &tmp[3], &P->Y );
Hanno Becker838b7152022-01-04 05:01:53 +00001633 /* {P,Q}->Y no longer used, so OK to write to Y even if there's aliasing. */
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001634 MPI_ECP_SUB( Y, &tmp[2], &tmp[3] );
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +01001635
1636cleanup:
1637
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +01001638 return( ret );
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01001639#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_ADD_MIXED_ALT) */
Manuel Pégourié-Gonnardae180d02012-11-02 18:14:40 +01001640}
1641
1642/*
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +02001643 * Randomize jacobian coordinates:
1644 * (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l
Manuel Pégourié-Gonnard3c0b4ea2013-12-02 19:44:41 +01001645 * This is sort of the reverse operation of ecp_normalize_jac().
Manuel Pégourié-Gonnard44aab792013-11-21 10:53:59 +01001646 *
1647 * This countermeasure was first suggested in [2].
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +02001648 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001649static int ecp_randomize_jac( const mbedtls_ecp_group *grp, mbedtls_ecp_point *pt,
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +02001650 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
1651{
Janos Follathb0697532016-08-18 12:38:46 +01001652#if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT)
Manuel Pégourié-Gonnardebac5d32017-08-23 16:23:36 +02001653 if( mbedtls_internal_ecp_grp_capable( grp ) )
1654 return( mbedtls_internal_ecp_randomize_jac( grp, pt, f_rng, p_rng ) );
Janos Follath372697b2016-10-28 16:53:11 +01001655#endif /* MBEDTLS_ECP_RANDOMIZE_JAC_ALT */
Janos Follathb0697532016-08-18 12:38:46 +01001656
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01001657#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT)
1658 return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
1659#else
1660 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker0d629792022-01-04 06:45:49 +00001661 mbedtls_mpi l;
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01001662
Hanno Becker0d629792022-01-04 06:45:49 +00001663 mbedtls_mpi_init( &l );
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +02001664
1665 /* Generate l such that 1 < l < p */
Hanno Becker595616e2022-01-05 08:28:24 +00001666 MPI_ECP_RAND( &l );
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +02001667
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001668 /* Z' = l * Z */
Hanno Becker0d629792022-01-04 06:45:49 +00001669 MPI_ECP_MUL( &pt->Z, &pt->Z, &l );
1670
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001671 /* Y' = l * Y */
Hanno Becker0d629792022-01-04 06:45:49 +00001672 MPI_ECP_MUL( &pt->Y, &pt->Y, &l );
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +02001673
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001674 /* X' = l^2 * X */
Hanno Becker0d629792022-01-04 06:45:49 +00001675 MPI_ECP_SQR( &l, &l );
1676 MPI_ECP_MUL( &pt->X, &pt->X, &l );
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +02001677
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001678 /* Y'' = l^2 * Y' = l^3 * Y */
Hanno Becker0d629792022-01-04 06:45:49 +00001679 MPI_ECP_MUL( &pt->Y, &pt->Y, &l );
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +02001680
1681cleanup:
Hanno Becker0d629792022-01-04 06:45:49 +00001682 mbedtls_mpi_free( &l );
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +02001683
Gilles Peskine59215172021-03-29 22:28:50 +02001684 if( ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE )
1685 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +02001686 return( ret );
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01001687#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT) */
Manuel Pégourié-Gonnard07de4b12013-09-02 16:26:04 +02001688}
1689
1690/*
Manuel Pégourié-Gonnardc30200e2013-11-20 18:39:55 +01001691 * Check and define parameters used by the comb method (see below for details)
1692 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001693#if MBEDTLS_ECP_WINDOW_SIZE < 2 || MBEDTLS_ECP_WINDOW_SIZE > 7
1694#error "MBEDTLS_ECP_WINDOW_SIZE out of bounds"
Manuel Pégourié-Gonnardc30200e2013-11-20 18:39:55 +01001695#endif
1696
1697/* d = ceil( n / w ) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001698#define COMB_MAX_D ( MBEDTLS_ECP_MAX_BITS + 1 ) / 2
Manuel Pégourié-Gonnardc30200e2013-11-20 18:39:55 +01001699
1700/* number of precomputed points */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001701#define COMB_MAX_PRE ( 1 << ( MBEDTLS_ECP_WINDOW_SIZE - 1 ) )
Manuel Pégourié-Gonnardc30200e2013-11-20 18:39:55 +01001702
1703/*
1704 * Compute the representation of m that will be used with our comb method.
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001705 *
1706 * The basic comb method is described in GECC 3.44 for example. We use a
Manuel Pégourié-Gonnard101a39f2013-11-20 14:47:19 +01001707 * modified version that provides resistance to SPA by avoiding zero
1708 * digits in the representation as in [3]. We modify the method further by
1709 * requiring that all K_i be odd, which has the small cost that our
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02001710 * representation uses one more K_i, due to carries, but saves on the size of
1711 * the precomputed table.
Manuel Pégourié-Gonnard101a39f2013-11-20 14:47:19 +01001712 *
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02001713 * Summary of the comb method and its modifications:
1714 *
1715 * - The goal is to compute m*P for some w*d-bit integer m.
1716 *
1717 * - The basic comb method splits m into the w-bit integers
1718 * x[0] .. x[d-1] where x[i] consists of the bits in m whose
1719 * index has residue i modulo d, and computes m * P as
1720 * S[x[0]] + 2 * S[x[1]] + .. + 2^(d-1) S[x[d-1]], where
1721 * S[i_{w-1} .. i_0] := i_{w-1} 2^{(w-1)d} P + ... + i_1 2^d P + i_0 P.
1722 *
1723 * - If it happens that, say, x[i+1]=0 (=> S[x[i+1]]=0), one can replace the sum by
1724 * .. + 2^{i-1} S[x[i-1]] - 2^i S[x[i]] + 2^{i+1} S[x[i]] + 2^{i+2} S[x[i+2]] ..,
1725 * thereby successively converting it into a form where all summands
1726 * are nonzero, at the cost of negative summands. This is the basic idea of [3].
1727 *
1728 * - More generally, even if x[i+1] != 0, we can first transform the sum as
1729 * .. - 2^i S[x[i]] + 2^{i+1} ( S[x[i]] + S[x[i+1]] ) + 2^{i+2} S[x[i+2]] ..,
1730 * and then replace S[x[i]] + S[x[i+1]] = S[x[i] ^ x[i+1]] + 2 S[x[i] & x[i+1]].
1731 * Performing and iterating this procedure for those x[i] that are even
1732 * (keeping track of carry), we can transform the original sum into one of the form
1733 * S[x'[0]] +- 2 S[x'[1]] +- .. +- 2^{d-1} S[x'[d-1]] + 2^d S[x'[d]]
1734 * with all x'[i] odd. It is therefore only necessary to know S at odd indices,
1735 * which is why we are only computing half of it in the first place in
1736 * ecp_precompute_comb and accessing it with index abs(i) / 2 in ecp_select_comb.
1737 *
1738 * - For the sake of compactness, only the seven low-order bits of x[i]
1739 * are used to represent its absolute value (K_i in the paper), and the msb
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +02001740 * of x[i] encodes the sign (s_i in the paper): it is set if and only if
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02001741 * if s_i == -1;
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001742 *
1743 * Calling conventions:
Manuel Pégourié-Gonnard101a39f2013-11-20 14:47:19 +01001744 * - x is an array of size d + 1
Manuel Pégourié-Gonnardc30200e2013-11-20 18:39:55 +01001745 * - w is the size, ie number of teeth, of the comb, and must be between
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001746 * 2 and 7 (in practice, between 2 and MBEDTLS_ECP_WINDOW_SIZE)
Manuel Pégourié-Gonnard101a39f2013-11-20 14:47:19 +01001747 * - m is the MPI, expected to be odd and such that bitlength(m) <= w * d
1748 * (the result will be incorrect if these assumptions are not satisfied)
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001749 */
Manuel Pégourié-Gonnard62738e92017-03-14 10:00:21 +01001750static void ecp_comb_recode_core( unsigned char x[], size_t d,
1751 unsigned char w, const mbedtls_mpi *m )
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001752{
1753 size_t i, j;
Manuel Pégourié-Gonnard101a39f2013-11-20 14:47:19 +01001754 unsigned char c, cc, adjust;
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001755
Manuel Pégourié-Gonnard101a39f2013-11-20 14:47:19 +01001756 memset( x, 0, d+1 );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001757
Manuel Pégourié-Gonnardedc1a1f2013-11-21 09:50:00 +01001758 /* First get the classical comb values (except for x_d = 0) */
1759 for( i = 0; i < d; i++ )
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001760 for( j = 0; j < w; j++ )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001761 x[i] |= mbedtls_mpi_get_bit( m, i + d * j ) << j;
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001762
Manuel Pégourié-Gonnardedc1a1f2013-11-21 09:50:00 +01001763 /* Now make sure x_1 .. x_d are odd */
1764 c = 0;
1765 for( i = 1; i <= d; i++ )
1766 {
Manuel Pégourié-Gonnard101a39f2013-11-20 14:47:19 +01001767 /* Add carry and update it */
1768 cc = x[i] & c;
1769 x[i] = x[i] ^ c;
1770 c = cc;
1771
Manuel Pégourié-Gonnardedc1a1f2013-11-21 09:50:00 +01001772 /* Adjust if needed, avoiding branches */
Manuel Pégourié-Gonnard101a39f2013-11-20 14:47:19 +01001773 adjust = 1 - ( x[i] & 0x01 );
1774 c |= x[i] & ( x[i-1] * adjust );
1775 x[i] = x[i] ^ ( x[i-1] * adjust );
1776 x[i-1] |= adjust << 7;
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001777 }
1778}
1779
1780/*
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02001781 * Precompute points for the adapted comb method
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001782 *
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02001783 * Assumption: T must be able to hold 2^{w - 1} elements.
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001784 *
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02001785 * Operation: If i = i_{w-1} ... i_1 is the binary representation of i,
1786 * sets T[i] = i_{w-1} 2^{(w-1)d} P + ... + i_1 2^d P + P.
Manuel Pégourié-Gonnard04a02252013-11-20 22:57:38 +01001787 *
1788 * Cost: d(w-1) D + (2^{w-1} - 1) A + 1 N(w-1) + 1 N(2^{w-1} - 1)
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02001789 *
1790 * Note: Even comb values (those where P would be omitted from the
1791 * sum defining T[i] above) are not needed in our adaption
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +02001792 * the comb method. See ecp_comb_recode_core().
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02001793 *
1794 * This function currently works in four steps:
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +02001795 * (1) [dbl] Computation of intermediate T[i] for 2-power values of i
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02001796 * (2) [norm_dbl] Normalization of coordinates of these T[i]
1797 * (3) [add] Computation of all T[i]
1798 * (4) [norm_add] Normalization of all T[i]
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02001799 *
1800 * Step 1 can be interrupted but not the others; together with the final
1801 * coordinate normalization they are the largest steps done at once, depending
1802 * on the window size. Here are operation counts for P-256:
1803 *
1804 * step (2) (3) (4)
1805 * w = 5 142 165 208
1806 * w = 4 136 77 160
1807 * w = 3 130 33 136
1808 * w = 2 124 11 124
1809 *
1810 * So if ECC operations are blocking for too long even with a low max_ops
1811 * value, it's useful to set MBEDTLS_ECP_WINDOW_SIZE to a lower value in order
1812 * to minimize maximum blocking time.
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001813 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001814static int ecp_precompute_comb( const mbedtls_ecp_group *grp,
1815 mbedtls_ecp_point T[], const mbedtls_ecp_point *P,
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02001816 unsigned char w, size_t d,
1817 mbedtls_ecp_restart_ctx *rs_ctx )
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001818{
Janos Follath24eed8d2019-11-22 13:21:35 +00001819 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardfc3e0be2017-03-20 09:29:31 +01001820 unsigned char i;
Manuel Pégourié-Gonnard213541a2017-03-20 12:50:41 +01001821 size_t j = 0;
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001822 const unsigned char T_size = 1U << ( w - 1 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001823 mbedtls_ecp_point *cur, *TT[COMB_MAX_PRE - 1];
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001824
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001825 mbedtls_mpi tmp[4];
1826
Hanno Becker466df6e2022-01-10 11:16:51 +00001827 mpi_init_many( tmp, sizeof( tmp ) / sizeof( mbedtls_mpi ) );
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001828
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02001829#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02001830 if( rs_ctx != NULL && rs_ctx->rsm != NULL )
Manuel Pégourié-Gonnard085b1df2017-03-16 16:56:04 +01001831 {
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02001832 if( rs_ctx->rsm->state == ecp_rsm_pre_dbl )
1833 goto dbl;
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02001834 if( rs_ctx->rsm->state == ecp_rsm_pre_norm_dbl )
Manuel Pégourié-Gonnarde2d7cb32017-03-20 10:24:17 +01001835 goto norm_dbl;
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02001836 if( rs_ctx->rsm->state == ecp_rsm_pre_add )
1837 goto add;
1838 if( rs_ctx->rsm->state == ecp_rsm_pre_norm_add )
1839 goto norm_add;
Manuel Pégourié-Gonnard085b1df2017-03-16 16:56:04 +01001840 }
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +02001841#else
1842 (void) rs_ctx;
Manuel Pégourié-Gonnard085b1df2017-03-16 16:56:04 +01001843#endif
1844
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02001845#if defined(MBEDTLS_ECP_RESTARTABLE)
1846 if( rs_ctx != NULL && rs_ctx->rsm != NULL )
1847 {
1848 rs_ctx->rsm->state = ecp_rsm_pre_dbl;
1849
1850 /* initial state for the loop */
1851 rs_ctx->rsm->i = 0;
1852 }
1853
1854dbl:
1855#endif
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +02001856 /*
1857 * Set T[0] = P and
1858 * T[2^{l-1}] = 2^{dl} P for l = 1 .. w-1 (this is not the final value)
1859 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001860 MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &T[0], P ) );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001861
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02001862#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02001863 if( rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->i != 0 )
1864 j = rs_ctx->rsm->i;
Manuel Pégourié-Gonnard213541a2017-03-20 12:50:41 +01001865 else
1866#endif
1867 j = 0;
1868
1869 for( ; j < d * ( w - 1 ); j++ )
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001870 {
Manuel Pégourié-Gonnardc7511482017-04-20 16:31:00 +02001871 MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_DBL );
Manuel Pégourié-Gonnard213541a2017-03-20 12:50:41 +01001872
Manuel Pégourié-Gonnardae557072017-03-20 12:21:24 +01001873 i = 1U << ( j / d );
Manuel Pégourié-Gonnard101a39f2013-11-20 14:47:19 +01001874 cur = T + i;
Manuel Pégourié-Gonnardae557072017-03-20 12:21:24 +01001875
1876 if( j % d == 0 )
1877 MBEDTLS_MPI_CHK( mbedtls_ecp_copy( cur, T + ( i >> 1 ) ) );
1878
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001879 MBEDTLS_MPI_CHK( ecp_double_jac( grp, cur, cur, tmp ) );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001880 }
1881
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02001882#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02001883 if( rs_ctx != NULL && rs_ctx->rsm != NULL )
1884 rs_ctx->rsm->state = ecp_rsm_pre_norm_dbl;
1885
Manuel Pégourié-Gonnarde2d7cb32017-03-20 10:24:17 +01001886norm_dbl:
1887#endif
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +02001888 /*
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00001889 * Normalize current elements in T to allow them to be used in
1890 * ecp_add_mixed() below, which requires one normalized input.
1891 *
1892 * As T has holes, use an auxiliary array of pointers to elements in T.
1893 *
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +02001894 */
Manuel Pégourié-Gonnardfc3e0be2017-03-20 09:29:31 +01001895 j = 0;
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001896 for( i = 1; i < T_size; i <<= 1 )
Manuel Pégourié-Gonnardfc3e0be2017-03-20 09:29:31 +01001897 TT[j++] = T + i;
1898
Manuel Pégourié-Gonnardc7511482017-04-20 16:31:00 +02001899 MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV + 6 * j - 2 );
Manuel Pégourié-Gonnarde2d7cb32017-03-20 10:24:17 +01001900
Manuel Pégourié-Gonnardfc3e0be2017-03-20 09:29:31 +01001901 MBEDTLS_MPI_CHK( ecp_normalize_jac_many( grp, TT, j ) );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001902
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02001903#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02001904 if( rs_ctx != NULL && rs_ctx->rsm != NULL )
1905 rs_ctx->rsm->state = ecp_rsm_pre_add;
1906
Manuel Pégourié-Gonnarde2d7cb32017-03-20 10:24:17 +01001907add:
1908#endif
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +02001909 /*
1910 * Compute the remaining ones using the minimal number of additions
1911 * Be careful to update T[2^l] only after using it!
1912 */
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001913 MBEDTLS_ECP_BUDGET( ( T_size - 1 ) * MBEDTLS_ECP_OPS_ADD );
Manuel Pégourié-Gonnarde2d7cb32017-03-20 10:24:17 +01001914
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001915 for( i = 1; i < T_size; i <<= 1 )
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001916 {
Manuel Pégourié-Gonnard101a39f2013-11-20 14:47:19 +01001917 j = i;
1918 while( j-- )
Hanno Becker3b29f212022-01-04 07:34:14 +00001919 MBEDTLS_MPI_CHK( ecp_add_mixed( grp, &T[i + j], &T[j], &T[i], tmp ) );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001920 }
1921
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02001922#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02001923 if( rs_ctx != NULL && rs_ctx->rsm != NULL )
1924 rs_ctx->rsm->state = ecp_rsm_pre_norm_add;
1925
Manuel Pégourié-Gonnarde2d7cb32017-03-20 10:24:17 +01001926norm_add:
1927#endif
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +02001928 /*
Manuel Pégourié-Gonnarda966fde2018-10-23 10:41:11 +02001929 * Normalize final elements in T. Even though there are no holes now, we
1930 * still need the auxiliary array for homogeneity with the previous
1931 * call. Also, skip T[0] which is already normalised, being a copy of P.
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +02001932 */
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001933 for( j = 0; j + 1 < T_size; j++ )
Manuel Pégourié-Gonnardfc3e0be2017-03-20 09:29:31 +01001934 TT[j] = T + j + 1;
1935
Manuel Pégourié-Gonnardc7511482017-04-20 16:31:00 +02001936 MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV + 6 * j - 2 );
Manuel Pégourié-Gonnarde2d7cb32017-03-20 10:24:17 +01001937
Manuel Pégourié-Gonnardfc3e0be2017-03-20 09:29:31 +01001938 MBEDTLS_MPI_CHK( ecp_normalize_jac_many( grp, TT, j ) );
Manuel Pégourié-Gonnarde2820122013-11-21 10:08:50 +01001939
Hanno Beckeree95f6c2022-01-09 05:46:18 +00001940 /* Free Z coordinate (=1 after normalization) to save RAM.
1941 * This makes T[i] invalid as mbedtls_ecp_points, but this is OK
1942 * since from this point onwards, they are only accessed indirectly
1943 * via the getter function ecp_select_comb() which does set the
1944 * target's Z coordinate to 1. */
1945 for( i = 0; i < T_size; i++ )
1946 mbedtls_mpi_free( &T[i].Z );
1947
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001948cleanup:
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001949
Hanno Becker466df6e2022-01-10 11:16:51 +00001950 mpi_free_many( tmp, sizeof( tmp ) / sizeof( mbedtls_mpi ) );
Hanno Beckera7f8edd2022-01-04 07:29:46 +00001951
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02001952#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02001953 if( rs_ctx != NULL && rs_ctx->rsm != NULL &&
1954 ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
Manuel Pégourié-Gonnard213541a2017-03-20 12:50:41 +01001955 {
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02001956 if( rs_ctx->rsm->state == ecp_rsm_pre_dbl )
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02001957 rs_ctx->rsm->i = j;
Manuel Pégourié-Gonnard213541a2017-03-20 12:50:41 +01001958 }
1959#endif
Janos Follathb0697532016-08-18 12:38:46 +01001960
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001961 return( ret );
1962}
1963
1964/*
Manuel Pégourié-Gonnard101a39f2013-11-20 14:47:19 +01001965 * Select precomputed point: R = sign(i) * T[ abs(i) / 2 ]
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02001966 *
1967 * See ecp_comb_recode_core() for background
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001968 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001969static int ecp_select_comb( const mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001970 const mbedtls_ecp_point T[], unsigned char T_size,
Manuel Pégourié-Gonnardd7283502013-11-21 20:00:38 +01001971 unsigned char i )
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001972{
Janos Follath24eed8d2019-11-22 13:21:35 +00001973 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardd7283502013-11-21 20:00:38 +01001974 unsigned char ii, j;
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001975
Manuel Pégourié-Gonnardd7283502013-11-21 20:00:38 +01001976 /* Ignore the "sign" bit and scale down */
1977 ii = ( i & 0x7Fu ) >> 1;
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001978
Manuel Pégourié-Gonnardd7283502013-11-21 20:00:38 +01001979 /* Read the whole table to thwart cache-based timing attacks */
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02001980 for( j = 0; j < T_size; j++ )
Manuel Pégourié-Gonnardd7283502013-11-21 20:00:38 +01001981 {
Hanno Beckerc27a0e02022-01-06 05:56:34 +00001982 MPI_ECP_COND_ASSIGN( &R->X, &T[j].X, j == ii );
1983 MPI_ECP_COND_ASSIGN( &R->Y, &T[j].Y, j == ii );
Manuel Pégourié-Gonnardd7283502013-11-21 20:00:38 +01001984 }
1985
Manuel Pégourié-Gonnard01fca5e2013-11-21 17:47:12 +01001986 /* Safely invert result if i is "negative" */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001987 MBEDTLS_MPI_CHK( ecp_safe_invert_jac( grp, R, i >> 7 ) );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001988
Hanno Becker595616e2022-01-05 08:28:24 +00001989 MPI_ECP_LSET( &R->Z, 1 );
Hanno Becker6a288702022-01-05 05:19:48 +00001990
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01001991cleanup:
1992 return( ret );
1993}
1994
1995/*
1996 * Core multiplication algorithm for the (modified) comb method.
1997 * This part is actually common with the basic comb method (GECC 3.44)
Manuel Pégourié-Gonnard04a02252013-11-20 22:57:38 +01001998 *
1999 * Cost: d A + d D + 1 R
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002000 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002001static int ecp_mul_comb_core( const mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02002002 const mbedtls_ecp_point T[], unsigned char T_size,
Manuel Pégourié-Gonnard70c14372013-11-20 20:07:26 +01002003 const unsigned char x[], size_t d,
2004 int (*f_rng)(void *, unsigned char *, size_t),
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02002005 void *p_rng,
2006 mbedtls_ecp_restart_ctx *rs_ctx )
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002007{
Janos Follath24eed8d2019-11-22 13:21:35 +00002008 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002009 mbedtls_ecp_point Txi;
Hanno Beckera7f8edd2022-01-04 07:29:46 +00002010 mbedtls_mpi tmp[4];
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002011 size_t i;
2012
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002013 mbedtls_ecp_point_init( &Txi );
Hanno Becker466df6e2022-01-10 11:16:51 +00002014 mpi_init_many( tmp, sizeof( tmp ) / sizeof( mbedtls_mpi ) );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002015
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002016#if !defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02002017 (void) rs_ctx;
2018#endif
2019
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002020#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02002021 if( rs_ctx != NULL && rs_ctx->rsm != NULL &&
2022 rs_ctx->rsm->state != ecp_rsm_comb_core )
2023 {
2024 rs_ctx->rsm->i = 0;
2025 rs_ctx->rsm->state = ecp_rsm_comb_core;
2026 }
2027
2028 /* new 'if' instead of nested for the sake of the 'else' branch */
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02002029 if( rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->i != 0 )
Manuel Pégourié-Gonnardc5d844b2017-03-15 13:06:28 +01002030 {
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02002031 /* restore current index (R already pointing to rs_ctx->rsm->R) */
2032 i = rs_ctx->rsm->i;
Manuel Pégourié-Gonnardc5d844b2017-03-15 13:06:28 +01002033 }
2034 else
2035#endif
2036 {
2037 /* Start with a non-zero point and randomize its coordinates */
2038 i = d;
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02002039 MBEDTLS_MPI_CHK( ecp_select_comb( grp, R, T, T_size, x[i] ) );
Manuel Pégourié-Gonnardc5d844b2017-03-15 13:06:28 +01002040 if( f_rng != 0 )
2041 MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, R, f_rng, p_rng ) );
2042 }
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002043
Manuel Pégourié-Gonnard90f31b72018-10-16 10:45:24 +02002044 while( i != 0 )
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002045 {
Manuel Pégourié-Gonnardc7511482017-04-20 16:31:00 +02002046 MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_DBL + MBEDTLS_ECP_OPS_ADD );
Manuel Pégourié-Gonnard90f31b72018-10-16 10:45:24 +02002047 --i;
2048
Hanno Beckera7f8edd2022-01-04 07:29:46 +00002049 MBEDTLS_MPI_CHK( ecp_double_jac( grp, R, R, tmp ) );
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02002050 MBEDTLS_MPI_CHK( ecp_select_comb( grp, &Txi, T, T_size, x[i] ) );
Hanno Becker3b29f212022-01-04 07:34:14 +00002051 MBEDTLS_MPI_CHK( ecp_add_mixed( grp, R, R, &Txi, tmp ) );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002052 }
2053
2054cleanup:
Janos Follathb0697532016-08-18 12:38:46 +01002055
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002056 mbedtls_ecp_point_free( &Txi );
Hanno Becker466df6e2022-01-10 11:16:51 +00002057 mpi_free_many( tmp, sizeof( tmp ) / sizeof( mbedtls_mpi ) );
Hanno Beckera7f8edd2022-01-04 07:29:46 +00002058
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002059#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02002060 if( rs_ctx != NULL && rs_ctx->rsm != NULL &&
2061 ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
Manuel Pégourié-Gonnardc5d844b2017-03-15 13:06:28 +01002062 {
Manuel Pégourié-Gonnard90f31b72018-10-16 10:45:24 +02002063 rs_ctx->rsm->i = i;
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02002064 /* no need to save R, already pointing to rs_ctx->rsm->R */
Manuel Pégourié-Gonnardc5d844b2017-03-15 13:06:28 +01002065 }
2066#endif
2067
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002068 return( ret );
2069}
2070
2071/*
Manuel Pégourié-Gonnard62738e92017-03-14 10:00:21 +01002072 * Recode the scalar to get constant-time comb multiplication
2073 *
2074 * As the actual scalar recoding needs an odd scalar as a starting point,
2075 * this wrapper ensures that by replacing m by N - m if necessary, and
2076 * informs the caller that the result of multiplication will be negated.
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02002077 *
Manuel Pégourié-Gonnardfd87e352017-08-24 14:21:05 +02002078 * This works because we only support large prime order for Short Weierstrass
2079 * curves, so N is always odd hence either m or N - m is.
2080 *
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02002081 * See ecp_comb_recode_core() for background.
Manuel Pégourié-Gonnardec5606a2017-03-09 12:46:45 +01002082 */
Manuel Pégourié-Gonnard62738e92017-03-14 10:00:21 +01002083static int ecp_comb_recode_scalar( const mbedtls_ecp_group *grp,
2084 const mbedtls_mpi *m,
2085 unsigned char k[COMB_MAX_D + 1],
2086 size_t d,
2087 unsigned char w,
2088 unsigned char *parity_trick )
Manuel Pégourié-Gonnardec5606a2017-03-09 12:46:45 +01002089{
Janos Follath24eed8d2019-11-22 13:21:35 +00002090 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard62738e92017-03-14 10:00:21 +01002091 mbedtls_mpi M, mm;
Manuel Pégourié-Gonnardec5606a2017-03-09 12:46:45 +01002092
Manuel Pégourié-Gonnard62738e92017-03-14 10:00:21 +01002093 mbedtls_mpi_init( &M );
Manuel Pégourié-Gonnardec5606a2017-03-09 12:46:45 +01002094 mbedtls_mpi_init( &mm );
2095
Manuel Pégourié-Gonnardfd87e352017-08-24 14:21:05 +02002096 /* N is always odd (see above), just make extra sure */
Manuel Pégourié-Gonnardec5606a2017-03-09 12:46:45 +01002097 if( mbedtls_mpi_get_bit( &grp->N, 0 ) != 1 )
2098 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
2099
Manuel Pégourié-Gonnard62738e92017-03-14 10:00:21 +01002100 /* do we need the parity trick? */
2101 *parity_trick = ( mbedtls_mpi_get_bit( m, 0 ) == 0 );
2102
2103 /* execute parity fix in constant time */
2104 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &M, m ) );
Manuel Pégourié-Gonnardec5606a2017-03-09 12:46:45 +01002105 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &mm, &grp->N, m ) );
Manuel Pégourié-Gonnard62738e92017-03-14 10:00:21 +01002106 MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &M, &mm, *parity_trick ) );
2107
2108 /* actual scalar recoding */
2109 ecp_comb_recode_core( k, d, w, &M );
Manuel Pégourié-Gonnardec5606a2017-03-09 12:46:45 +01002110
2111cleanup:
2112 mbedtls_mpi_free( &mm );
Manuel Pégourié-Gonnard62738e92017-03-14 10:00:21 +01002113 mbedtls_mpi_free( &M );
Manuel Pégourié-Gonnardec5606a2017-03-09 12:46:45 +01002114
2115 return( ret );
2116}
2117
2118/*
Manuel Pégourié-Gonnard391f4412017-03-13 12:26:21 +01002119 * Perform comb multiplication (for short Weierstrass curves)
2120 * once the auxiliary table has been pre-computed.
Manuel Pégourié-Gonnard62738e92017-03-14 10:00:21 +01002121 *
2122 * Scalar recoding may use a parity trick that makes us compute -m * P,
2123 * if that is the case we'll need to recover m * P at the end.
Manuel Pégourié-Gonnard391f4412017-03-13 12:26:21 +01002124 */
2125static int ecp_mul_comb_after_precomp( const mbedtls_ecp_group *grp,
2126 mbedtls_ecp_point *R,
2127 const mbedtls_mpi *m,
2128 const mbedtls_ecp_point *T,
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02002129 unsigned char T_size,
Manuel Pégourié-Gonnard391f4412017-03-13 12:26:21 +01002130 unsigned char w,
2131 size_t d,
2132 int (*f_rng)(void *, unsigned char *, size_t),
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02002133 void *p_rng,
2134 mbedtls_ecp_restart_ctx *rs_ctx )
Manuel Pégourié-Gonnard391f4412017-03-13 12:26:21 +01002135{
Janos Follath24eed8d2019-11-22 13:21:35 +00002136 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard62738e92017-03-14 10:00:21 +01002137 unsigned char parity_trick;
Manuel Pégourié-Gonnard391f4412017-03-13 12:26:21 +01002138 unsigned char k[COMB_MAX_D + 1];
Manuel Pégourié-Gonnard8962ddb2017-03-14 12:11:21 +01002139 mbedtls_ecp_point *RR = R;
2140
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02002141#if defined(MBEDTLS_ECP_RESTARTABLE)
2142 if( rs_ctx != NULL && rs_ctx->rsm != NULL )
2143 {
2144 RR = &rs_ctx->rsm->R;
2145
2146 if( rs_ctx->rsm->state == ecp_rsm_final_norm )
2147 goto final_norm;
2148 }
Manuel Pégourié-Gonnard8962ddb2017-03-14 12:11:21 +01002149#endif
Manuel Pégourié-Gonnard391f4412017-03-13 12:26:21 +01002150
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02002151 MBEDTLS_MPI_CHK( ecp_comb_recode_scalar( grp, m, k, d, w,
2152 &parity_trick ) );
2153 MBEDTLS_MPI_CHK( ecp_mul_comb_core( grp, RR, T, T_size, k, d,
2154 f_rng, p_rng, rs_ctx ) );
2155 MBEDTLS_MPI_CHK( ecp_safe_invert_jac( grp, RR, parity_trick ) );
2156
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002157#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02002158 if( rs_ctx != NULL && rs_ctx->rsm != NULL )
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02002159 rs_ctx->rsm->state = ecp_rsm_final_norm;
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02002160
Manuel Pégourié-Gonnard4ed1dab2017-08-24 11:02:04 +02002161final_norm:
Manuel Pégourié-Gonnard9b8d34e2020-06-08 09:53:20 +02002162 MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV );
Manuel Pégourié-Gonnard2fad7ae2017-03-14 13:13:13 +01002163#endif
Manuel Pégourié-Gonnarda4aa89b2020-03-25 12:41:29 +01002164 /*
2165 * Knowledge of the jacobian coordinates may leak the last few bits of the
2166 * scalar [1], and since our MPI implementation isn't constant-flow,
2167 * inversion (used for coordinate normalization) may leak the full value
2168 * of its input via side-channels [2].
2169 *
2170 * [1] https://eprint.iacr.org/2003/191
2171 * [2] https://eprint.iacr.org/2020/055
2172 *
2173 * Avoid the leak by randomizing coordinates before we normalize them.
2174 */
2175 if( f_rng != 0 )
2176 MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, RR, f_rng, p_rng ) );
2177
Manuel Pégourié-Gonnard8962ddb2017-03-14 12:11:21 +01002178 MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, RR ) );
2179
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002180#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard28d16282017-08-23 17:33:27 +02002181 if( rs_ctx != NULL && rs_ctx->rsm != NULL )
2182 MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, RR ) );
Manuel Pégourié-Gonnard8962ddb2017-03-14 12:11:21 +01002183#endif
Manuel Pégourié-Gonnard391f4412017-03-13 12:26:21 +01002184
2185cleanup:
Manuel Pégourié-Gonnard391f4412017-03-13 12:26:21 +01002186 return( ret );
2187}
2188
Manuel Pégourié-Gonnard391f4412017-03-13 12:26:21 +01002189/*
Manuel Pégourié-Gonnard4b2336d2017-03-09 13:23:50 +01002190 * Pick window size based on curve size and whether we optimize for base point
2191 */
2192static unsigned char ecp_pick_window_size( const mbedtls_ecp_group *grp,
2193 unsigned char p_eq_g )
2194{
2195 unsigned char w;
2196
2197 /*
2198 * Minimize the number of multiplications, that is minimize
2199 * 10 * d * w + 18 * 2^(w-1) + 11 * d + 7 * w, with d = ceil( nbits / w )
2200 * (see costs of the various parts, with 1S = 1M)
2201 */
2202 w = grp->nbits >= 384 ? 5 : 4;
2203
2204 /*
2205 * If P == G, pre-compute a bit more, since this may be re-used later.
2206 * Just adding one avoids upping the cost of the first mul too much,
2207 * and the memory cost too.
2208 */
2209 if( p_eq_g )
2210 w++;
2211
2212 /*
kXuanba9cb762021-04-08 14:32:06 +08002213 * If static comb table may not be used (!p_eq_g) or static comb table does
2214 * not exists, make sure w is within bounds.
Manuel Pégourié-Gonnard4b2336d2017-03-09 13:23:50 +01002215 * (The last test is useful only for very small curves in the test suite.)
kXuanba9cb762021-04-08 14:32:06 +08002216 *
2217 * The user reduces MBEDTLS_ECP_WINDOW_SIZE does not changes the size of
2218 * static comb table, because the size of static comb table is fixed when
2219 * it is generated.
Manuel Pégourié-Gonnard4b2336d2017-03-09 13:23:50 +01002220 */
k-stachowiak653a4a22019-07-03 14:31:09 +02002221#if( MBEDTLS_ECP_WINDOW_SIZE < 6 )
kXuanba9cb762021-04-08 14:32:06 +08002222 if( (!p_eq_g || !ecp_group_is_static_comb_table(grp)) && w > MBEDTLS_ECP_WINDOW_SIZE )
Manuel Pégourié-Gonnard4b2336d2017-03-09 13:23:50 +01002223 w = MBEDTLS_ECP_WINDOW_SIZE;
k-stachowiak653a4a22019-07-03 14:31:09 +02002224#endif
Manuel Pégourié-Gonnard4b2336d2017-03-09 13:23:50 +01002225 if( w >= grp->nbits )
2226 w = 2;
2227
2228 return( w );
2229}
2230
2231/*
Manuel Pégourié-Gonnard07bf6f52017-03-16 17:21:38 +01002232 * Multiplication using the comb method - for curves in short Weierstrass form
2233 *
2234 * This function is mainly responsible for administrative work:
2235 * - managing the restart context if enabled
Manuel Pégourié-Gonnard11556e22017-08-24 13:41:19 +02002236 * - managing the table of precomputed points (passed between the below two
Manuel Pégourié-Gonnard07bf6f52017-03-16 17:21:38 +01002237 * functions): allocation, computation, ownership tranfer, freeing.
2238 *
2239 * It delegates the actual arithmetic work to:
2240 * ecp_precompute_comb() and ecp_mul_comb_with_precomp()
2241 *
2242 * See comments on ecp_comb_recode_core() regarding the computation strategy.
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002243 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002244static int ecp_mul_comb( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
2245 const mbedtls_mpi *m, const mbedtls_ecp_point *P,
Manuel Pégourié-Gonnarda0179b82013-12-04 11:49:20 +01002246 int (*f_rng)(void *, unsigned char *, size_t),
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02002247 void *p_rng,
2248 mbedtls_ecp_restart_ctx *rs_ctx )
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002249{
Janos Follath24eed8d2019-11-22 13:21:35 +00002250 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard11556e22017-08-24 13:41:19 +02002251 unsigned char w, p_eq_g, i;
Manuel Pégourié-Gonnardd7283502013-11-21 20:00:38 +01002252 size_t d;
Manuel Pégourié-Gonnardf2a9fcf2020-06-03 12:11:56 +02002253 unsigned char T_size = 0, T_ok = 0;
2254 mbedtls_ecp_point *T = NULL;
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002255
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +02002256 ECP_RS_ENTER( rsm );
Manuel Pégourié-Gonnard510d5ca2017-03-08 11:41:47 +01002257
Manuel Pégourié-Gonnard22be6352017-03-09 13:02:35 +01002258 /* Is P the base point ? */
2259#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1
Hanno Beckerc27a0e02022-01-06 05:56:34 +00002260 p_eq_g = ( MPI_ECP_CMP( &P->Y, &grp->G.Y ) == 0 &&
2261 MPI_ECP_CMP( &P->X, &grp->G.X ) == 0 );
Manuel Pégourié-Gonnard196d1332017-08-28 13:14:27 +02002262#else
2263 p_eq_g = 0;
Manuel Pégourié-Gonnard22be6352017-03-09 13:02:35 +01002264#endif
2265
Manuel Pégourié-Gonnard391f4412017-03-13 12:26:21 +01002266 /* Pick window size and deduce related sizes */
Manuel Pégourié-Gonnard4b2336d2017-03-09 13:23:50 +01002267 w = ecp_pick_window_size( grp, p_eq_g );
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02002268 T_size = 1U << ( w - 1 );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002269 d = ( grp->nbits + w - 1 ) / w;
2270
Manuel Pégourié-Gonnard085b1df2017-03-16 16:56:04 +01002271 /* Pre-computed table: do we have it already for the base point? */
2272 if( p_eq_g && grp->T != NULL )
2273 {
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02002274 /* second pointer to the same table, will be deleted on exit */
Manuel Pégourié-Gonnard085b1df2017-03-16 16:56:04 +01002275 T = grp->T;
2276 T_ok = 1;
2277 }
Manuel Pégourié-Gonnard11556e22017-08-24 13:41:19 +02002278 else
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002279#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard085b1df2017-03-16 16:56:04 +01002280 /* Pre-computed table: do we have one in progress? complete? */
Manuel Pégourié-Gonnard11556e22017-08-24 13:41:19 +02002281 if( rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->T != NULL )
Manuel Pégourié-Gonnardc9c0aa62017-03-16 14:53:26 +01002282 {
Manuel Pégourié-Gonnard45fd0162017-03-22 08:24:42 +01002283 /* transfer ownership of T from rsm to local function */
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02002284 T = rs_ctx->rsm->T;
2285 rs_ctx->rsm->T = NULL;
2286 rs_ctx->rsm->T_size = 0;
Manuel Pégourié-Gonnard085b1df2017-03-16 16:56:04 +01002287
Manuel Pégourié-Gonnardb25cb602018-10-16 11:48:09 +02002288 /* This effectively jumps to the call to mul_comb_after_precomp() */
Manuel Pégourié-Gonnard11556e22017-08-24 13:41:19 +02002289 T_ok = rs_ctx->rsm->state >= ecp_rsm_comb_core;
Manuel Pégourié-Gonnardc9c0aa62017-03-16 14:53:26 +01002290 }
Manuel Pégourié-Gonnard11556e22017-08-24 13:41:19 +02002291 else
Manuel Pégourié-Gonnardc9c0aa62017-03-16 14:53:26 +01002292#endif
Manuel Pégourié-Gonnard085b1df2017-03-16 16:56:04 +01002293 /* Allocate table if we didn't have any */
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002294 {
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02002295 T = mbedtls_calloc( T_size, sizeof( mbedtls_ecp_point ) );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002296 if( T == NULL )
2297 {
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02002298 ret = MBEDTLS_ERR_ECP_ALLOC_FAILED;
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002299 goto cleanup;
2300 }
Manuel Pégourié-Gonnard5bd38b12017-08-23 16:55:59 +02002301
2302 for( i = 0; i < T_size; i++ )
2303 mbedtls_ecp_point_init( &T[i] );
Manuel Pégourié-Gonnard11556e22017-08-24 13:41:19 +02002304
2305 T_ok = 0;
Manuel Pégourié-Gonnard085b1df2017-03-16 16:56:04 +01002306 }
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002307
Manuel Pégourié-Gonnard085b1df2017-03-16 16:56:04 +01002308 /* Compute table (or finish computing it) if not done already */
2309 if( !T_ok )
2310 {
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02002311 MBEDTLS_MPI_CHK( ecp_precompute_comb( grp, T, P, w, d, rs_ctx ) );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002312
2313 if( p_eq_g )
2314 {
Manuel Pégourié-Gonnard7037e222017-08-23 14:30:36 +02002315 /* almost transfer ownership of T to the group, but keep a copy of
Manuel Pégourié-Gonnardee68cff2018-10-15 15:27:49 +02002316 * the pointer to use for calling the next function more easily */
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002317 grp->T = T;
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02002318 grp->T_size = T_size;
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002319 }
2320 }
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002321
Manuel Pégourié-Gonnard391f4412017-03-13 12:26:21 +01002322 /* Actual comb multiplication using precomputed points */
2323 MBEDTLS_MPI_CHK( ecp_mul_comb_after_precomp( grp, R, m,
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02002324 T, T_size, w, d,
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02002325 f_rng, p_rng, rs_ctx ) );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002326
2327cleanup:
2328
Manuel Pégourié-Gonnard07bf6f52017-03-16 17:21:38 +01002329 /* does T belong to the group? */
2330 if( T == grp->T )
2331 T = NULL;
2332
2333 /* does T belong to the restart context? */
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002334#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02002335 if( rs_ctx != NULL && rs_ctx->rsm != NULL && ret == MBEDTLS_ERR_ECP_IN_PROGRESS && T != NULL )
Manuel Pégourié-Gonnardc9c0aa62017-03-16 14:53:26 +01002336 {
Manuel Pégourié-Gonnard45fd0162017-03-22 08:24:42 +01002337 /* transfer ownership of T from local function to rsm */
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02002338 rs_ctx->rsm->T_size = T_size;
Manuel Pégourié-Gonnard3cade222017-04-20 09:31:00 +02002339 rs_ctx->rsm->T = T;
Manuel Pégourié-Gonnardc9c0aa62017-03-16 14:53:26 +01002340 T = NULL;
2341 }
2342#endif
2343
Manuel Pégourié-Gonnard07bf6f52017-03-16 17:21:38 +01002344 /* did T belong to us? then let's destroy it! */
2345 if( T != NULL )
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002346 {
Manuel Pégourié-Gonnard92cceb22017-08-23 16:27:29 +02002347 for( i = 0; i < T_size; i++ )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002348 mbedtls_ecp_point_free( &T[i] );
2349 mbedtls_free( T );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002350 }
2351
Manuel Pégourié-Gonnard2fad7ae2017-03-14 13:13:13 +01002352 /* don't free R while in progress in case R == P */
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002353#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard2fad7ae2017-03-14 13:13:13 +01002354 if( ret != MBEDTLS_ERR_ECP_IN_PROGRESS )
2355#endif
Manuel Pégourié-Gonnard07bf6f52017-03-16 17:21:38 +01002356 /* prevent caller from using invalid value */
Manuel Pégourié-Gonnardaade42f2013-11-21 19:19:54 +01002357 if( ret != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002358 mbedtls_ecp_point_free( R );
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002359
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +02002360 ECP_RS_LEAVE( rsm );
Manuel Pégourié-Gonnard77af79a2017-03-14 10:58:00 +01002361
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002362 return( ret );
2363}
2364
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02002365#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
Manuel Pégourié-Gonnard7c94d8b2013-12-04 23:15:46 +01002366
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02002367#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
Manuel Pégourié-Gonnard7c94d8b2013-12-04 23:15:46 +01002368/*
2369 * For Montgomery curves, we do all the internal arithmetic in projective
2370 * coordinates. Import/export of points uses only the x coordinates, which is
2371 * internaly represented as X / Z.
2372 *
2373 * For scalar multiplication, we'll use a Montgomery ladder.
2374 */
2375
Manuel Pégourié-Gonnardd1c1ba92013-11-16 15:50:12 +01002376/*
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002377 * Normalize Montgomery x/z coordinates: X = X/Z, Z = 1
2378 * Cost: 1M + 1I
2379 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002380static int ecp_normalize_mxz( const mbedtls_ecp_group *grp, mbedtls_ecp_point *P )
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002381{
Janos Follathb0697532016-08-18 12:38:46 +01002382#if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT)
Manuel Pégourié-Gonnardebac5d32017-08-23 16:23:36 +02002383 if( mbedtls_internal_ecp_grp_capable( grp ) )
2384 return( mbedtls_internal_ecp_normalize_mxz( grp, P ) );
Janos Follath372697b2016-10-28 16:53:11 +01002385#endif /* MBEDTLS_ECP_NORMALIZE_MXZ_ALT */
Janos Follathb0697532016-08-18 12:38:46 +01002386
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01002387#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT)
2388 return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
2389#else
2390 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckerce29ae82022-01-04 04:55:11 +00002391 MPI_ECP_INV( &P->Z, &P->Z );
2392 MPI_ECP_MUL( &P->X, &P->X, &P->Z );
Hanno Becker595616e2022-01-05 08:28:24 +00002393 MPI_ECP_LSET( &P->Z, 1 );
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002394
2395cleanup:
2396 return( ret );
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01002397#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT) */
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002398}
2399
2400/*
Manuel Pégourié-Gonnard3afa07f2013-12-03 13:28:21 +01002401 * Randomize projective x/z coordinates:
2402 * (X, Z) -> (l X, l Z) for random l
2403 * This is sort of the reverse operation of ecp_normalize_mxz().
2404 *
2405 * This countermeasure was first suggested in [2].
2406 * Cost: 2M
2407 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002408static int ecp_randomize_mxz( const mbedtls_ecp_group *grp, mbedtls_ecp_point *P,
Manuel Pégourié-Gonnard3afa07f2013-12-03 13:28:21 +01002409 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
2410{
Janos Follathb0697532016-08-18 12:38:46 +01002411#if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT)
Manuel Pégourié-Gonnardebac5d32017-08-23 16:23:36 +02002412 if( mbedtls_internal_ecp_grp_capable( grp ) )
Steven Cooremand4bfb3e2021-03-11 13:18:29 +01002413 return( mbedtls_internal_ecp_randomize_mxz( grp, P, f_rng, p_rng ) );
Janos Follath372697b2016-10-28 16:53:11 +01002414#endif /* MBEDTLS_ECP_RANDOMIZE_MXZ_ALT */
Janos Follathb0697532016-08-18 12:38:46 +01002415
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01002416#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT)
2417 return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
2418#else
2419 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2420 mbedtls_mpi l;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002421 mbedtls_mpi_init( &l );
Manuel Pégourié-Gonnard3afa07f2013-12-03 13:28:21 +01002422
2423 /* Generate l such that 1 < l < p */
Hanno Becker595616e2022-01-05 08:28:24 +00002424 MPI_ECP_RAND( &l );
Manuel Pégourié-Gonnard3afa07f2013-12-03 13:28:21 +01002425
Hanno Beckerce29ae82022-01-04 04:55:11 +00002426 MPI_ECP_MUL( &P->X, &P->X, &l );
2427 MPI_ECP_MUL( &P->Z, &P->Z, &l );
Manuel Pégourié-Gonnard3afa07f2013-12-03 13:28:21 +01002428
2429cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002430 mbedtls_mpi_free( &l );
Manuel Pégourié-Gonnard3afa07f2013-12-03 13:28:21 +01002431
Gilles Peskine59215172021-03-29 22:28:50 +02002432 if( ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE )
2433 ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
Manuel Pégourié-Gonnard3afa07f2013-12-03 13:28:21 +01002434 return( ret );
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01002435#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT) */
Manuel Pégourié-Gonnard3afa07f2013-12-03 13:28:21 +01002436}
2437
2438/*
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002439 * Double-and-add: R = 2P, S = P + Q, with d = X(P - Q),
2440 * for Montgomery curves in x/z coordinates.
2441 *
2442 * http://www.hyperelliptic.org/EFD/g1p/auto-code/montgom/xz/ladder/mladd-1987-m.op3
2443 * with
2444 * d = X1
2445 * P = (X2, Z2)
2446 * Q = (X3, Z3)
2447 * R = (X4, Z4)
2448 * S = (X5, Z5)
2449 * and eliminating temporary variables tO, ..., t4.
2450 *
2451 * Cost: 5M + 4S
2452 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002453static int ecp_double_add_mxz( const mbedtls_ecp_group *grp,
2454 mbedtls_ecp_point *R, mbedtls_ecp_point *S,
2455 const mbedtls_ecp_point *P, const mbedtls_ecp_point *Q,
Hanno Becker30838862022-01-04 13:25:59 +00002456 const mbedtls_mpi *d,
2457 mbedtls_mpi T[4] )
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002458{
Janos Follathb0697532016-08-18 12:38:46 +01002459#if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT)
Manuel Pégourié-Gonnardebac5d32017-08-23 16:23:36 +02002460 if( mbedtls_internal_ecp_grp_capable( grp ) )
2461 return( mbedtls_internal_ecp_double_add_mxz( grp, R, S, P, Q, d ) );
Janos Follath372697b2016-10-28 16:53:11 +01002462#endif /* MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT */
Janos Follathb0697532016-08-18 12:38:46 +01002463
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01002464#if defined(MBEDTLS_ECP_NO_FALLBACK) && defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT)
2465 return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
2466#else
2467 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01002468
Hanno Beckerac4d4bc2022-01-09 05:58:49 +00002469 MPI_ECP_ADD( &T[0], &P->X, &P->Z ); /* Pp := PX + PZ */
2470 MPI_ECP_SUB( &T[1], &P->X, &P->Z ); /* Pm := PX - PZ */
2471 MPI_ECP_ADD( &T[2], &Q->X, &Q->Z ); /* Qp := QX + XZ */
2472 MPI_ECP_SUB( &T[3], &Q->X, &Q->Z ); /* Qm := QX - QZ */
2473 MPI_ECP_MUL( &T[3], &T[3], &T[0] ); /* Qm * Pp */
2474 MPI_ECP_MUL( &T[2], &T[2], &T[1] ); /* Qp * Pm */
2475 MPI_ECP_SQR( &T[0], &T[0] ); /* Pp^2 */
2476 MPI_ECP_SQR( &T[1], &T[1] ); /* Pm^2 */
2477 MPI_ECP_MUL( &R->X, &T[0], &T[1] ); /* Pp^2 * Pm^2 */
2478 MPI_ECP_SUB( &T[0], &T[0], &T[1] ); /* Pp^2 - Pm^2 */
2479 MPI_ECP_MUL( &R->Z, &grp->A, &T[0] ); /* A * (Pp^2 - Pm^2) */
2480 MPI_ECP_ADD( &R->Z, &T[1], &R->Z ); /* [ A * (Pp^2-Pm^2) ] + Pm^2 */
2481 MPI_ECP_ADD( &S->X, &T[3], &T[2] ); /* Qm*Pp + Qp*Pm */
2482 MPI_ECP_SQR( &S->X, &S->X ); /* (Qm*Pp + Qp*Pm)^2 */
2483 MPI_ECP_SUB( &S->Z, &T[3], &T[2] ); /* Qm*Pp - Qp*Pm */
2484 MPI_ECP_SQR( &S->Z, &S->Z ); /* (Qm*Pp - Qp*Pm)^2 */
2485 MPI_ECP_MUL( &S->Z, d, &S->Z ); /* d * ( Qm*Pp - Qp*Pm )^2 */
2486 MPI_ECP_MUL( &R->Z, &T[0], &R->Z ); /* [A*(Pp^2-Pm^2)+Pm^2]*(Pp^2-Pm^2) */
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002487
2488cleanup:
Hanno Becker28ccb1c2022-01-04 07:15:04 +00002489
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002490 return( ret );
Steven Cooreman7eb2aa02021-01-22 09:43:59 +01002491#endif /* !defined(MBEDTLS_ECP_NO_FALLBACK) || !defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) */
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002492}
2493
2494/*
Manuel Pégourié-Gonnarda0179b82013-12-04 11:49:20 +01002495 * Multiplication with Montgomery ladder in x/z coordinates,
2496 * for curves in Montgomery form
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002497 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002498static int ecp_mul_mxz( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
2499 const mbedtls_mpi *m, const mbedtls_ecp_point *P,
Manuel Pégourié-Gonnarda0179b82013-12-04 11:49:20 +01002500 int (*f_rng)(void *, unsigned char *, size_t),
2501 void *p_rng )
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002502{
Janos Follath24eed8d2019-11-22 13:21:35 +00002503 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002504 size_t i;
Manuel Pégourié-Gonnardb6f45a62013-12-04 21:54:36 +01002505 unsigned char b;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002506 mbedtls_ecp_point RP;
2507 mbedtls_mpi PX;
Hanno Becker30838862022-01-04 13:25:59 +00002508 mbedtls_mpi tmp[4];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002509 mbedtls_ecp_point_init( &RP ); mbedtls_mpi_init( &PX );
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002510
Hanno Becker466df6e2022-01-10 11:16:51 +00002511 mpi_init_many( tmp, sizeof( tmp ) / sizeof( mbedtls_mpi ) );
Hanno Becker30838862022-01-04 13:25:59 +00002512
Manuel Pégourié-Gonnard02b57052021-06-15 11:29:26 +02002513 if( f_rng == NULL )
2514 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
2515
Manuel Pégourié-Gonnard3afa07f2013-12-03 13:28:21 +01002516 /* Save PX and read from P before writing to R, in case P == R */
Hanno Becker595616e2022-01-05 08:28:24 +00002517 MPI_ECP_MOV( &PX, &P->X );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002518 MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &RP, P ) );
Manuel Pégourié-Gonnard357ff652013-12-04 18:39:17 +01002519
2520 /* Set R to zero in modified x/z coordinates */
Hanno Becker595616e2022-01-05 08:28:24 +00002521 MPI_ECP_LSET( &R->X, 1 );
2522 MPI_ECP_LSET( &R->Z, 0 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002523 mbedtls_mpi_free( &R->Y );
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002524
Manuel Pégourié-Gonnard93f41db2013-12-05 10:48:42 +01002525 /* RP.X might be sligtly larger than P, so reduce it */
Hanno Beckerce29ae82022-01-04 04:55:11 +00002526 MOD_ADD( &RP.X );
Manuel Pégourié-Gonnard93f41db2013-12-05 10:48:42 +01002527
Manuel Pégourié-Gonnard3afa07f2013-12-03 13:28:21 +01002528 /* Randomize coordinates of the starting point */
Manuel Pégourié-Gonnard02b57052021-06-15 11:29:26 +02002529 MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, &RP, f_rng, p_rng ) );
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002530
Manuel Pégourié-Gonnardb6f45a62013-12-04 21:54:36 +01002531 /* Loop invariant: R = result so far, RP = R + P */
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +02002532 i = mbedtls_mpi_bitlen( m ); /* one past the (zero-based) most significant bit */
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002533 while( i-- > 0 )
2534 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002535 b = mbedtls_mpi_get_bit( m, i );
Manuel Pégourié-Gonnardb6f45a62013-12-04 21:54:36 +01002536 /*
2537 * if (b) R = 2R + P else R = 2R,
2538 * which is:
2539 * if (b) double_add( RP, R, RP, R )
2540 * else double_add( R, RP, R, RP )
2541 * but using safe conditional swaps to avoid leaks
2542 */
Hanno Beckerc27a0e02022-01-06 05:56:34 +00002543 MPI_ECP_COND_SWAP( &R->X, &RP.X, b );
2544 MPI_ECP_COND_SWAP( &R->Z, &RP.Z, b );
Hanno Becker30838862022-01-04 13:25:59 +00002545 MBEDTLS_MPI_CHK( ecp_double_add_mxz( grp, R, &RP, R, &RP, &PX, tmp ) );
Hanno Beckerc27a0e02022-01-06 05:56:34 +00002546 MPI_ECP_COND_SWAP( &R->X, &RP.X, b );
2547 MPI_ECP_COND_SWAP( &R->Z, &RP.Z, b );
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002548 }
2549
Manuel Pégourié-Gonnarda4aa89b2020-03-25 12:41:29 +01002550 /*
2551 * Knowledge of the projective coordinates may leak the last few bits of the
2552 * scalar [1], and since our MPI implementation isn't constant-flow,
2553 * inversion (used for coordinate normalization) may leak the full value
2554 * of its input via side-channels [2].
2555 *
2556 * [1] https://eprint.iacr.org/2003/191
2557 * [2] https://eprint.iacr.org/2020/055
2558 *
2559 * Avoid the leak by randomizing coordinates before we normalize them.
2560 */
Manuel Pégourié-Gonnard02b57052021-06-15 11:29:26 +02002561 MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, R, f_rng, p_rng ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002562 MBEDTLS_MPI_CHK( ecp_normalize_mxz( grp, R ) );
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002563
2564cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002565 mbedtls_ecp_point_free( &RP ); mbedtls_mpi_free( &PX );
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002566
Hanno Becker466df6e2022-01-10 11:16:51 +00002567 mpi_free_many( tmp, sizeof( tmp ) / sizeof( mbedtls_mpi ) );
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002568 return( ret );
2569}
2570
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02002571#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
Manuel Pégourié-Gonnard7c94d8b2013-12-04 23:15:46 +01002572
Manuel Pégourié-Gonnardd9ea82e72013-12-03 12:02:28 +01002573/*
Manuel Pégourié-Gonnard884569c2017-04-20 10:10:59 +02002574 * Restartable multiplication R = m * P
Manuel Pégourié-Gonnard75525ae2021-06-15 11:29:26 +02002575 *
2576 * This internal function can be called without an RNG in case where we know
2577 * the inputs are not sensitive.
Manuel Pégourié-Gonnarda0179b82013-12-04 11:49:20 +01002578 */
Manuel Pégourié-Gonnard75525ae2021-06-15 11:29:26 +02002579static int ecp_mul_restartable_internal( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002580 const mbedtls_mpi *m, const mbedtls_ecp_point *P,
Manuel Pégourié-Gonnard884569c2017-04-20 10:10:59 +02002581 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
2582 mbedtls_ecp_restart_ctx *rs_ctx )
Manuel Pégourié-Gonnarda0179b82013-12-04 11:49:20 +01002583{
Janos Follathb0697532016-08-18 12:38:46 +01002584 int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
Janos Follathc44ab972016-11-18 16:38:23 +00002585#if defined(MBEDTLS_ECP_INTERNAL_ALT)
2586 char is_grp_capable = 0;
2587#endif
Manuel Pégourié-Gonnardaa3ed6f2021-06-15 11:29:26 +02002588
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002589#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard3a256122017-04-20 11:20:26 +02002590 /* reset ops count for this call if top-level */
2591 if( rs_ctx != NULL && rs_ctx->depth++ == 0 )
2592 rs_ctx->ops_done = 0;
Gilles Peskine59970052019-02-28 13:12:06 +01002593#else
2594 (void) rs_ctx;
Manuel Pégourié-Gonnard3a256122017-04-20 11:20:26 +02002595#endif
Manuel Pégourié-Gonnarda0179b82013-12-04 11:49:20 +01002596
Janos Follathc44ab972016-11-18 16:38:23 +00002597#if defined(MBEDTLS_ECP_INTERNAL_ALT)
Manuel Pégourié-Gonnardebac5d32017-08-23 16:23:36 +02002598 if( ( is_grp_capable = mbedtls_internal_ecp_grp_capable( grp ) ) )
Janos Follathc44ab972016-11-18 16:38:23 +00002599 MBEDTLS_MPI_CHK( mbedtls_internal_ecp_init( grp ) );
Janos Follathc44ab972016-11-18 16:38:23 +00002600#endif /* MBEDTLS_ECP_INTERNAL_ALT */
Manuel Pégourié-Gonnard3a256122017-04-20 11:20:26 +02002601
Manuel Pégourié-Gonnard95aedfe2017-08-24 13:47:04 +02002602#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnarda08cd1a2017-04-20 11:29:43 +02002603 /* skip argument check when restarting */
Manuel Pégourié-Gonnard95aedfe2017-08-24 13:47:04 +02002604 if( rs_ctx == NULL || rs_ctx->rsm == NULL )
Manuel Pégourié-Gonnarda08cd1a2017-04-20 11:29:43 +02002605#endif
2606 {
Manuel Pégourié-Gonnard5314f232017-04-21 12:36:59 +02002607 /* check_privkey is free */
2608 MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_CHK );
2609
Manuel Pégourié-Gonnarda08cd1a2017-04-20 11:29:43 +02002610 /* Common sanity checks */
2611 MBEDTLS_MPI_CHK( mbedtls_ecp_check_privkey( grp, m ) );
2612 MBEDTLS_MPI_CHK( mbedtls_ecp_check_pubkey( grp, P ) );
Manuel Pégourié-Gonnarda08cd1a2017-04-20 11:29:43 +02002613 }
Manuel Pégourié-Gonnard3a256122017-04-20 11:20:26 +02002614
2615 ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02002616#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
Janos Follathdf9295b2019-02-26 12:36:52 +00002617 if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
Manuel Pégourié-Gonnard3a256122017-04-20 11:20:26 +02002618 MBEDTLS_MPI_CHK( ecp_mul_mxz( grp, R, m, P, f_rng, p_rng ) );
Janos Follath430d3372016-11-03 14:25:37 +00002619#endif
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02002620#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
Janos Follathdf9295b2019-02-26 12:36:52 +00002621 if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
Manuel Pégourié-Gonnard3a256122017-04-20 11:20:26 +02002622 MBEDTLS_MPI_CHK( ecp_mul_comb( grp, R, m, P, f_rng, p_rng, rs_ctx ) );
Janos Follath430d3372016-11-03 14:25:37 +00002623#endif
Manuel Pégourié-Gonnard3a256122017-04-20 11:20:26 +02002624
Janos Follath6c8ccd52016-11-29 15:37:09 +00002625cleanup:
Janos Follathb0697532016-08-18 12:38:46 +01002626
Manuel Pégourié-Gonnard3a256122017-04-20 11:20:26 +02002627#if defined(MBEDTLS_ECP_INTERNAL_ALT)
Manuel Pégourié-Gonnardebac5d32017-08-23 16:23:36 +02002628 if( is_grp_capable )
Janos Follathc44ab972016-11-18 16:38:23 +00002629 mbedtls_internal_ecp_free( grp );
Janos Follathc44ab972016-11-18 16:38:23 +00002630#endif /* MBEDTLS_ECP_INTERNAL_ALT */
Manuel Pégourié-Gonnard3a256122017-04-20 11:20:26 +02002631
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002632#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard3a256122017-04-20 11:20:26 +02002633 if( rs_ctx != NULL )
2634 rs_ctx->depth--;
2635#endif
2636
Janos Follathb0697532016-08-18 12:38:46 +01002637 return( ret );
Manuel Pégourié-Gonnarda0179b82013-12-04 11:49:20 +01002638}
2639
Manuel Pégourié-Gonnardb739a712017-04-19 10:11:56 +02002640/*
Manuel Pégourié-Gonnard75525ae2021-06-15 11:29:26 +02002641 * Restartable multiplication R = m * P
2642 */
2643int mbedtls_ecp_mul_restartable( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
2644 const mbedtls_mpi *m, const mbedtls_ecp_point *P,
2645 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
2646 mbedtls_ecp_restart_ctx *rs_ctx )
2647{
2648 ECP_VALIDATE_RET( grp != NULL );
2649 ECP_VALIDATE_RET( R != NULL );
2650 ECP_VALIDATE_RET( m != NULL );
2651 ECP_VALIDATE_RET( P != NULL );
2652
2653 if( f_rng == NULL )
2654 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
2655
2656 return( ecp_mul_restartable_internal( grp, R, m, P, f_rng, p_rng, rs_ctx ) );
2657}
2658
2659/*
Manuel Pégourié-Gonnard884569c2017-04-20 10:10:59 +02002660 * Multiplication R = m * P
Manuel Pégourié-Gonnardb739a712017-04-19 10:11:56 +02002661 */
Manuel Pégourié-Gonnard884569c2017-04-20 10:10:59 +02002662int mbedtls_ecp_mul( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
Manuel Pégourié-Gonnardb739a712017-04-19 10:11:56 +02002663 const mbedtls_mpi *m, const mbedtls_ecp_point *P,
Manuel Pégourié-Gonnard884569c2017-04-20 10:10:59 +02002664 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
Manuel Pégourié-Gonnardb739a712017-04-19 10:11:56 +02002665{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002666 ECP_VALIDATE_RET( grp != NULL );
2667 ECP_VALIDATE_RET( R != NULL );
2668 ECP_VALIDATE_RET( m != NULL );
2669 ECP_VALIDATE_RET( P != NULL );
Manuel Pégourié-Gonnard884569c2017-04-20 10:10:59 +02002670 return( mbedtls_ecp_mul_restartable( grp, R, m, P, f_rng, p_rng, NULL ) );
Manuel Pégourié-Gonnardb739a712017-04-19 10:11:56 +02002671}
Manuel Pégourié-Gonnardb739a712017-04-19 10:11:56 +02002672
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02002673#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
Manuel Pégourié-Gonnarda0179b82013-12-04 11:49:20 +01002674/*
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01002675 * Check that an affine point is valid as a public key,
2676 * short weierstrass curves (SEC1 3.2.3.1)
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02002677 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002678static int ecp_check_pubkey_sw( const mbedtls_ecp_group *grp, const mbedtls_ecp_point *pt )
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02002679{
Janos Follath24eed8d2019-11-22 13:21:35 +00002680 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002681 mbedtls_mpi YY, RHS;
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02002682
Manuel Pégourié-Gonnard312d2e82013-12-04 11:08:01 +01002683 /* pt coordinates must be normalized for our checks */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002684 if( mbedtls_mpi_cmp_int( &pt->X, 0 ) < 0 ||
2685 mbedtls_mpi_cmp_int( &pt->Y, 0 ) < 0 ||
2686 mbedtls_mpi_cmp_mpi( &pt->X, &grp->P ) >= 0 ||
2687 mbedtls_mpi_cmp_mpi( &pt->Y, &grp->P ) >= 0 )
2688 return( MBEDTLS_ERR_ECP_INVALID_KEY );
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02002689
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002690 mbedtls_mpi_init( &YY ); mbedtls_mpi_init( &RHS );
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02002691
2692 /*
2693 * YY = Y^2
Manuel Pégourié-Gonnardcd7458a2013-10-08 13:11:30 +02002694 * RHS = X (X^2 + A) + B = X^3 + A X + B
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02002695 */
Hanno Becker885ed402022-01-04 06:43:50 +00002696 MPI_ECP_SQR( &YY, &pt->Y );
2697 MPI_ECP_SQR( &RHS, &pt->X );
Manuel Pégourié-Gonnard73cc01d2013-12-06 12:41:30 +01002698
2699 /* Special case for A = -3 */
2700 if( grp->A.p == NULL )
2701 {
Hanno Beckerce29ae82022-01-04 04:55:11 +00002702 MPI_ECP_SUB_INT( &RHS, &RHS, 3 );
Manuel Pégourié-Gonnard73cc01d2013-12-06 12:41:30 +01002703 }
2704 else
2705 {
Hanno Beckerce29ae82022-01-04 04:55:11 +00002706 MPI_ECP_ADD( &RHS, &RHS, &grp->A );
Manuel Pégourié-Gonnard73cc01d2013-12-06 12:41:30 +01002707 }
2708
Hanno Beckerce29ae82022-01-04 04:55:11 +00002709 MPI_ECP_MUL( &RHS, &RHS, &pt->X );
2710 MPI_ECP_ADD( &RHS, &RHS, &grp->B );
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02002711
Hanno Becker595616e2022-01-05 08:28:24 +00002712 if( MPI_ECP_CMP( &YY, &RHS ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002713 ret = MBEDTLS_ERR_ECP_INVALID_KEY;
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02002714
2715cleanup:
2716
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002717 mbedtls_mpi_free( &YY ); mbedtls_mpi_free( &RHS );
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02002718
2719 return( ret );
2720}
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02002721#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01002722
Gilles Peskine9b99a892018-09-14 18:32:19 +02002723#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +02002724/*
TRodziewicz9edff742021-03-04 17:59:39 +01002725 * R = m * P with shortcuts for m == 0, m == 1 and m == -1
Manuel Pégourié-Gonnardde9f9532015-10-23 15:50:37 +02002726 * NOT constant-time - ONLY for short Weierstrass!
2727 */
2728static int mbedtls_ecp_mul_shortcuts( mbedtls_ecp_group *grp,
2729 mbedtls_ecp_point *R,
2730 const mbedtls_mpi *m,
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002731 const mbedtls_ecp_point *P,
2732 mbedtls_ecp_restart_ctx *rs_ctx )
Manuel Pégourié-Gonnardde9f9532015-10-23 15:50:37 +02002733{
Janos Follath24eed8d2019-11-22 13:21:35 +00002734 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckerc27a0e02022-01-06 05:56:34 +00002735 mbedtls_mpi tmp;
2736 mbedtls_mpi_init( &tmp );
Manuel Pégourié-Gonnardde9f9532015-10-23 15:50:37 +02002737
TRodziewicz782a7ea2021-03-17 11:35:16 +01002738 if( mbedtls_mpi_cmp_int( m, 0 ) == 0 )
TRodziewicz9edff742021-03-04 17:59:39 +01002739 {
2740 MBEDTLS_MPI_CHK( mbedtls_ecp_set_zero( R ) );
2741 }
2742 else if( mbedtls_mpi_cmp_int( m, 1 ) == 0 )
Manuel Pégourié-Gonnardde9f9532015-10-23 15:50:37 +02002743 {
2744 MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, P ) );
2745 }
2746 else if( mbedtls_mpi_cmp_int( m, -1 ) == 0 )
2747 {
2748 MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, P ) );
Hanno Beckerc27a0e02022-01-06 05:56:34 +00002749 MPI_ECP_NEG( &R->Y );
Manuel Pégourié-Gonnardde9f9532015-10-23 15:50:37 +02002750 }
2751 else
2752 {
Manuel Pégourié-Gonnard75525ae2021-06-15 11:29:26 +02002753 MBEDTLS_MPI_CHK( ecp_mul_restartable_internal( grp, R, m, P,
2754 NULL, NULL, rs_ctx ) );
Manuel Pégourié-Gonnardde9f9532015-10-23 15:50:37 +02002755 }
2756
2757cleanup:
Hanno Beckerc27a0e02022-01-06 05:56:34 +00002758 mbedtls_mpi_free( &tmp );
2759
Manuel Pégourié-Gonnardde9f9532015-10-23 15:50:37 +02002760 return( ret );
2761}
2762
2763/*
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +02002764 * Restartable linear combination
Manuel Pégourié-Gonnardde9f9532015-10-23 15:50:37 +02002765 * NOT constant-time
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +02002766 */
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +02002767int mbedtls_ecp_muladd_restartable(
2768 mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +02002769 const mbedtls_mpi *m, const mbedtls_ecp_point *P,
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +02002770 const mbedtls_mpi *n, const mbedtls_ecp_point *Q,
2771 mbedtls_ecp_restart_ctx *rs_ctx )
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +02002772{
Janos Follath24eed8d2019-11-22 13:21:35 +00002773 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +02002774 mbedtls_ecp_point mP;
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002775 mbedtls_ecp_point *pmP = &mP;
2776 mbedtls_ecp_point *pR = R;
Hanno Becker3b29f212022-01-04 07:34:14 +00002777 mbedtls_mpi tmp[4];
Janos Follathc44ab972016-11-18 16:38:23 +00002778#if defined(MBEDTLS_ECP_INTERNAL_ALT)
2779 char is_grp_capable = 0;
2780#endif
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002781 ECP_VALIDATE_RET( grp != NULL );
2782 ECP_VALIDATE_RET( R != NULL );
2783 ECP_VALIDATE_RET( m != NULL );
2784 ECP_VALIDATE_RET( P != NULL );
2785 ECP_VALIDATE_RET( n != NULL );
2786 ECP_VALIDATE_RET( Q != NULL );
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +02002787
Janos Follathdf9295b2019-02-26 12:36:52 +00002788 if( mbedtls_ecp_get_type( grp ) != MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +02002789 return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
2790
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002791 mbedtls_ecp_point_init( &mP );
Hanno Becker466df6e2022-01-10 11:16:51 +00002792 mpi_init_many( tmp, sizeof( tmp ) / sizeof( mbedtls_mpi ) );
Hanno Becker3b29f212022-01-04 07:34:14 +00002793
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +02002794 ECP_RS_ENTER( ma );
2795
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002796#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002797 if( rs_ctx != NULL && rs_ctx->ma != NULL )
2798 {
2799 /* redirect intermediate results to restart context */
2800 pmP = &rs_ctx->ma->mP;
2801 pR = &rs_ctx->ma->R;
2802
2803 /* jump to next operation */
2804 if( rs_ctx->ma->state == ecp_rsma_mul2 )
2805 goto mul2;
2806 if( rs_ctx->ma->state == ecp_rsma_add )
2807 goto add;
2808 if( rs_ctx->ma->state == ecp_rsma_norm )
2809 goto norm;
2810 }
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002811#endif /* MBEDTLS_ECP_RESTARTABLE */
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +02002812
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002813 MBEDTLS_MPI_CHK( mbedtls_ecp_mul_shortcuts( grp, pmP, m, P, rs_ctx ) );
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002814#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002815 if( rs_ctx != NULL && rs_ctx->ma != NULL )
Manuel Pégourié-Gonnardc9efa002017-08-24 10:25:06 +02002816 rs_ctx->ma->state = ecp_rsma_mul2;
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +02002817
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002818mul2:
2819#endif
2820 MBEDTLS_MPI_CHK( mbedtls_ecp_mul_shortcuts( grp, pR, n, Q, rs_ctx ) );
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002821
2822#if defined(MBEDTLS_ECP_INTERNAL_ALT)
2823 if( ( is_grp_capable = mbedtls_internal_ecp_grp_capable( grp ) ) )
2824 MBEDTLS_MPI_CHK( mbedtls_internal_ecp_init( grp ) );
2825#endif /* MBEDTLS_ECP_INTERNAL_ALT */
2826
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002827#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002828 if( rs_ctx != NULL && rs_ctx->ma != NULL )
Manuel Pégourié-Gonnardc9efa002017-08-24 10:25:06 +02002829 rs_ctx->ma->state = ecp_rsma_add;
Manuel Pégourié-Gonnard1a7c5ef2015-08-13 10:19:09 +02002830
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002831add:
2832#endif
Manuel Pégourié-Gonnardc7511482017-04-20 16:31:00 +02002833 MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_ADD );
Hanno Becker3b29f212022-01-04 07:34:14 +00002834 MBEDTLS_MPI_CHK( ecp_add_mixed( grp, pR, pmP, pR, tmp ) );
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002835#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002836 if( rs_ctx != NULL && rs_ctx->ma != NULL )
Manuel Pégourié-Gonnardc9efa002017-08-24 10:25:06 +02002837 rs_ctx->ma->state = ecp_rsma_norm;
Janos Follath430d3372016-11-03 14:25:37 +00002838
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002839norm:
2840#endif
Manuel Pégourié-Gonnardc7511482017-04-20 16:31:00 +02002841 MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV );
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002842 MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, pR ) );
2843
Manuel Pégourié-Gonnard4b9c51e2017-04-20 15:50:26 +02002844#if defined(MBEDTLS_ECP_RESTARTABLE)
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002845 if( rs_ctx != NULL && rs_ctx->ma != NULL )
2846 MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, pR ) );
2847#endif
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +02002848
2849cleanup:
Hanno Becker3b29f212022-01-04 07:34:14 +00002850
Hanno Becker466df6e2022-01-10 11:16:51 +00002851 mpi_free_many( tmp, sizeof( tmp ) / sizeof( mbedtls_mpi ) );
Hanno Becker3b29f212022-01-04 07:34:14 +00002852
Janos Follathc44ab972016-11-18 16:38:23 +00002853#if defined(MBEDTLS_ECP_INTERNAL_ALT)
Manuel Pégourié-Gonnardebac5d32017-08-23 16:23:36 +02002854 if( is_grp_capable )
Janos Follathc44ab972016-11-18 16:38:23 +00002855 mbedtls_internal_ecp_free( grp );
Janos Follathc44ab972016-11-18 16:38:23 +00002856#endif /* MBEDTLS_ECP_INTERNAL_ALT */
Manuel Pégourié-Gonnard1631d632017-04-20 14:48:56 +02002857
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +02002858 mbedtls_ecp_point_free( &mP );
2859
Manuel Pégourié-Gonnarddb4a8eb2017-08-23 18:18:22 +02002860 ECP_RS_LEAVE( ma );
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +02002861
Manuel Pégourié-Gonnard56cc88a2015-05-11 18:40:45 +02002862 return( ret );
2863}
2864
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +02002865/*
2866 * Linear combination
2867 * NOT constant-time
2868 */
2869int mbedtls_ecp_muladd( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
2870 const mbedtls_mpi *m, const mbedtls_ecp_point *P,
2871 const mbedtls_mpi *n, const mbedtls_ecp_point *Q )
2872{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002873 ECP_VALIDATE_RET( grp != NULL );
2874 ECP_VALIDATE_RET( R != NULL );
2875 ECP_VALIDATE_RET( m != NULL );
2876 ECP_VALIDATE_RET( P != NULL );
2877 ECP_VALIDATE_RET( n != NULL );
2878 ECP_VALIDATE_RET( Q != NULL );
Manuel Pégourié-Gonnard54dd6522017-04-20 13:36:18 +02002879 return( mbedtls_ecp_muladd_restartable( grp, R, m, P, n, Q, NULL ) );
2880}
Gilles Peskine9b99a892018-09-14 18:32:19 +02002881#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01002882
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02002883#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
Manuel Pégourié-Gonnardf29857c2021-06-23 10:14:58 +02002884#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
Manuel Pégourié-Gonnard06215ea2021-06-23 12:53:18 +02002885#define ECP_MPI_INIT(s, n, p) {s, (n), (mbedtls_mpi_uint *)(p)}
2886#define ECP_MPI_INIT_ARRAY(x) \
2887 ECP_MPI_INIT(1, sizeof(x) / sizeof(mbedtls_mpi_uint), x)
2888/*
2889 * Constants for the two points other than 0, 1, -1 (mod p) in
2890 * https://cr.yp.to/ecdh.html#validate
2891 * See ecp_check_pubkey_x25519().
2892 */
2893static const mbedtls_mpi_uint x25519_bad_point_1[] = {
Janos Follath1107ee42021-06-25 12:43:26 +01002894 MBEDTLS_BYTES_TO_T_UINT_8( 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae ),
2895 MBEDTLS_BYTES_TO_T_UINT_8( 0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a ),
2896 MBEDTLS_BYTES_TO_T_UINT_8( 0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd ),
2897 MBEDTLS_BYTES_TO_T_UINT_8( 0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00 ),
Manuel Pégourié-Gonnard06215ea2021-06-23 12:53:18 +02002898};
2899static const mbedtls_mpi_uint x25519_bad_point_2[] = {
Janos Follath1107ee42021-06-25 12:43:26 +01002900 MBEDTLS_BYTES_TO_T_UINT_8( 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24 ),
2901 MBEDTLS_BYTES_TO_T_UINT_8( 0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b ),
2902 MBEDTLS_BYTES_TO_T_UINT_8( 0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86 ),
2903 MBEDTLS_BYTES_TO_T_UINT_8( 0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57 ),
Manuel Pégourié-Gonnard06215ea2021-06-23 12:53:18 +02002904};
2905static const mbedtls_mpi ecp_x25519_bad_point_1 = ECP_MPI_INIT_ARRAY(
2906 x25519_bad_point_1 );
2907static const mbedtls_mpi ecp_x25519_bad_point_2 = ECP_MPI_INIT_ARRAY(
2908 x25519_bad_point_2 );
Janos Follath865a75e2021-06-24 15:34:59 +01002909#endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
Manuel Pégourié-Gonnard2389a602021-06-23 12:25:48 +02002910
Manuel Pégourié-Gonnardf29857c2021-06-23 10:14:58 +02002911/*
2912 * Check that the input point is not one of the low-order points.
2913 * This is recommended by the "May the Fourth" paper:
2914 * https://eprint.iacr.org/2017/806.pdf
2915 * Those points are never sent by an honest peer.
2916 */
Janos Follath865a75e2021-06-24 15:34:59 +01002917static int ecp_check_bad_points_mx( const mbedtls_mpi *X, const mbedtls_mpi *P,
2918 const mbedtls_ecp_group_id grp_id )
Manuel Pégourié-Gonnardf29857c2021-06-23 10:14:58 +02002919{
2920 int ret;
Manuel Pégourié-Gonnard2389a602021-06-23 12:25:48 +02002921 mbedtls_mpi XmP;
Manuel Pégourié-Gonnardf29857c2021-06-23 10:14:58 +02002922
2923 mbedtls_mpi_init( &XmP );
Manuel Pégourié-Gonnardf29857c2021-06-23 10:14:58 +02002924
2925 /* Reduce X mod P so that we only need to check values less than P.
2926 * We know X < 2^256 so we can proceed by subtraction. */
2927 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &XmP, X ) );
2928 while( mbedtls_mpi_cmp_mpi( &XmP, P ) >= 0 )
2929 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &XmP, &XmP, P ) );
2930
Janos Follath865a75e2021-06-24 15:34:59 +01002931 /* Check against the known bad values that are less than P. For Curve448
2932 * these are 0, 1 and -1. For Curve25519 we check the values less than P
2933 * from the following list: https://cr.yp.to/ecdh.html#validate */
Manuel Pégourié-Gonnardf29857c2021-06-23 10:14:58 +02002934 if( mbedtls_mpi_cmp_int( &XmP, 1 ) <= 0 ) /* takes care of 0 and 1 */
Janos Follath8081ced2021-06-24 14:24:13 +01002935 {
2936 ret = MBEDTLS_ERR_ECP_INVALID_KEY;
2937 goto cleanup;
2938 }
Manuel Pégourié-Gonnardf29857c2021-06-23 10:14:58 +02002939
Janos Follath865a75e2021-06-24 15:34:59 +01002940#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
2941 if( grp_id == MBEDTLS_ECP_DP_CURVE25519 )
Janos Follath8081ced2021-06-24 14:24:13 +01002942 {
Janos Follath865a75e2021-06-24 15:34:59 +01002943 if( mbedtls_mpi_cmp_mpi( &XmP, &ecp_x25519_bad_point_1 ) == 0 )
2944 {
2945 ret = MBEDTLS_ERR_ECP_INVALID_KEY;
2946 goto cleanup;
2947 }
Manuel Pégourié-Gonnardf29857c2021-06-23 10:14:58 +02002948
Janos Follath865a75e2021-06-24 15:34:59 +01002949 if( mbedtls_mpi_cmp_mpi( &XmP, &ecp_x25519_bad_point_2 ) == 0 )
2950 {
2951 ret = MBEDTLS_ERR_ECP_INVALID_KEY;
2952 goto cleanup;
2953 }
Janos Follath8081ced2021-06-24 14:24:13 +01002954 }
Janos Follath83e384d2021-06-25 15:29:56 +01002955#else
2956 (void) grp_id;
Janos Follath865a75e2021-06-24 15:34:59 +01002957#endif
Manuel Pégourié-Gonnardf29857c2021-06-23 10:14:58 +02002958
Manuel Pégourié-Gonnard2389a602021-06-23 12:25:48 +02002959 /* Final check: check if XmP + 1 is P (final because it changes XmP!) */
2960 MBEDTLS_MPI_CHK( mbedtls_mpi_add_int( &XmP, &XmP, 1 ) );
2961 if( mbedtls_mpi_cmp_mpi( &XmP, P ) == 0 )
Janos Follath8081ced2021-06-24 14:24:13 +01002962 {
2963 ret = MBEDTLS_ERR_ECP_INVALID_KEY;
2964 goto cleanup;
2965 }
Manuel Pégourié-Gonnardf29857c2021-06-23 10:14:58 +02002966
2967 ret = 0;
2968
2969cleanup:
2970 mbedtls_mpi_free( &XmP );
Manuel Pégourié-Gonnardf29857c2021-06-23 10:14:58 +02002971
2972 return( ret );
2973}
Manuel Pégourié-Gonnardf29857c2021-06-23 10:14:58 +02002974
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01002975/*
2976 * Check validity of a public key for Montgomery curves with x-only schemes
2977 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002978static int ecp_check_pubkey_mx( const mbedtls_ecp_group *grp, const mbedtls_ecp_point *pt )
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01002979{
Manuel Pégourié-Gonnard07894332015-06-23 00:18:41 +02002980 /* [Curve25519 p. 5] Just check X is the correct number of bytes */
Nicholas Wilson08f3ef12015-11-10 13:10:01 +00002981 /* Allow any public value, if it's too big then we'll just reduce it mod p
2982 * (RFC 7748 sec. 5 para. 3). */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002983 if( mbedtls_mpi_size( &pt->X ) > ( grp->nbits + 7 ) / 8 )
2984 return( MBEDTLS_ERR_ECP_INVALID_KEY );
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01002985
Manuel Pégourié-Gonnardf29857c2021-06-23 10:14:58 +02002986 /* Implicit in all standards (as they don't consider negative numbers):
2987 * X must be non-negative. This is normally ensured by the way it's
2988 * encoded for transmission, but let's be extra sure. */
2989 if( mbedtls_mpi_cmp_int( &pt->X, 0 ) < 0 )
2990 return( MBEDTLS_ERR_ECP_INVALID_KEY );
2991
Janos Follath865a75e2021-06-24 15:34:59 +01002992 return( ecp_check_bad_points_mx( &pt->X, &grp->P, grp->id ) );
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01002993}
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02002994#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01002995
2996/*
2997 * Check that a point is valid as a public key
2998 */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002999int mbedtls_ecp_check_pubkey( const mbedtls_ecp_group *grp,
3000 const mbedtls_ecp_point *pt )
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01003001{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003002 ECP_VALIDATE_RET( grp != NULL );
3003 ECP_VALIDATE_RET( pt != NULL );
3004
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01003005 /* Must use affine coordinates */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003006 if( mbedtls_mpi_cmp_int( &pt->Z, 1 ) != 0 )
3007 return( MBEDTLS_ERR_ECP_INVALID_KEY );
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01003008
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02003009#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
Janos Follathdf9295b2019-02-26 12:36:52 +00003010 if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01003011 return( ecp_check_pubkey_mx( grp, pt ) );
3012#endif
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02003013#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
Janos Follathdf9295b2019-02-26 12:36:52 +00003014 if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01003015 return( ecp_check_pubkey_sw( grp, pt ) );
3016#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003017 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01003018}
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02003019
3020/*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003021 * Check that an mbedtls_mpi is valid as a private key
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02003022 */
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003023int mbedtls_ecp_check_privkey( const mbedtls_ecp_group *grp,
3024 const mbedtls_mpi *d )
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02003025{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003026 ECP_VALIDATE_RET( grp != NULL );
3027 ECP_VALIDATE_RET( d != NULL );
3028
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02003029#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
Janos Follathdf9295b2019-02-26 12:36:52 +00003030 if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
Manuel Pégourié-Gonnard312d2e82013-12-04 11:08:01 +01003031 {
Nicholas Wilson08f3ef12015-11-10 13:10:01 +00003032 /* see RFC 7748 sec. 5 para. 5 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003033 if( mbedtls_mpi_get_bit( d, 0 ) != 0 ||
3034 mbedtls_mpi_get_bit( d, 1 ) != 0 ||
Manuel Pégourié-Gonnardc0696c22015-06-18 16:47:17 +02003035 mbedtls_mpi_bitlen( d ) - 1 != grp->nbits ) /* mbedtls_mpi_bitlen is one-based! */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003036 return( MBEDTLS_ERR_ECP_INVALID_KEY );
Nicholas Wilson08f3ef12015-11-10 13:10:01 +00003037
3038 /* see [Curve25519] page 5 */
3039 if( grp->nbits == 254 && mbedtls_mpi_get_bit( d, 2 ) != 0 )
3040 return( MBEDTLS_ERR_ECP_INVALID_KEY );
3041
3042 return( 0 );
Manuel Pégourié-Gonnard312d2e82013-12-04 11:08:01 +01003043 }
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02003044#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
3045#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
Janos Follathdf9295b2019-02-26 12:36:52 +00003046 if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
Manuel Pégourié-Gonnard312d2e82013-12-04 11:08:01 +01003047 {
3048 /* see SEC1 3.2 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003049 if( mbedtls_mpi_cmp_int( d, 1 ) < 0 ||
3050 mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 )
3051 return( MBEDTLS_ERR_ECP_INVALID_KEY );
Manuel Pégourié-Gonnardd9622732013-12-05 10:06:06 +01003052 else
3053 return( 0 );
Manuel Pégourié-Gonnard312d2e82013-12-04 11:08:01 +01003054 }
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02003055#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02003056
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003057 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02003058}
3059
Gilles Peskine72fcc982021-03-23 22:31:31 +01003060#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
3061MBEDTLS_STATIC_TESTABLE
Gilles Peskine55c46042021-03-24 12:34:40 +01003062int mbedtls_ecp_gen_privkey_mx( size_t high_bit,
Gilles Peskine72fcc982021-03-23 22:31:31 +01003063 mbedtls_mpi *d,
3064 int (*f_rng)(void *, unsigned char *, size_t),
3065 void *p_rng )
3066{
3067 int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
Gilles Peskine61f1f5f2021-03-24 12:46:46 +01003068 size_t n_random_bytes = high_bit / 8 + 1;
Gilles Peskine72fcc982021-03-23 22:31:31 +01003069
3070 /* [Curve25519] page 5 */
Gilles Peskine61f1f5f2021-03-24 12:46:46 +01003071 /* Generate a (high_bit+1)-bit random number by generating just enough
3072 * random bytes, then shifting out extra bits from the top (necessary
3073 * when (high_bit+1) is not a multiple of 8). */
3074 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( d, n_random_bytes,
3075 f_rng, p_rng ) );
3076 MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( d, 8 * n_random_bytes - high_bit - 1 ) );
Gilles Peskine72fcc982021-03-23 22:31:31 +01003077
Gilles Peskine67986d02021-03-24 12:25:59 +01003078 MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, high_bit, 1 ) );
Gilles Peskine72fcc982021-03-23 22:31:31 +01003079
3080 /* Make sure the last two bits are unset for Curve448, three bits for
3081 Curve25519 */
3082 MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 0, 0 ) );
3083 MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 1, 0 ) );
Gilles Peskine55c46042021-03-24 12:34:40 +01003084 if( high_bit == 254 )
Gilles Peskine72fcc982021-03-23 22:31:31 +01003085 {
3086 MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 2, 0 ) );
3087 }
3088
3089cleanup:
3090 return( ret );
3091}
3092#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
3093
Gilles Peskine60d8b982021-03-29 22:28:21 +02003094#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
3095static int mbedtls_ecp_gen_privkey_sw(
3096 const mbedtls_mpi *N, mbedtls_mpi *d,
3097 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
3098{
3099 int ret = mbedtls_mpi_random( d, 1, N, f_rng, p_rng );
3100 switch( ret )
3101 {
3102 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
3103 return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
3104 default:
3105 return( ret );
3106 }
3107}
3108#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
3109
Manuel Pégourié-Gonnardc8dc2952013-07-01 14:06:13 +02003110/*
Manuel Pégourié-Gonnarda7937f92017-04-20 15:37:46 +02003111 * Generate a private key
Manuel Pégourié-Gonnard45a035a2013-01-26 14:42:45 +01003112 */
Manuel Pégourié-Gonnarda7937f92017-04-20 15:37:46 +02003113int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp,
3114 mbedtls_mpi *d,
Manuel Pégourié-Gonnard45a035a2013-01-26 14:42:45 +01003115 int (*f_rng)(void *, unsigned char *, size_t),
3116 void *p_rng )
3117{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003118 ECP_VALIDATE_RET( grp != NULL );
3119 ECP_VALIDATE_RET( d != NULL );
3120 ECP_VALIDATE_RET( f_rng != NULL );
3121
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02003122#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
Janos Follathdf9295b2019-02-26 12:36:52 +00003123 if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
Gilles Peskine72fcc982021-03-23 22:31:31 +01003124 return( mbedtls_ecp_gen_privkey_mx( grp->nbits, d, f_rng, p_rng ) );
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02003125#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
Manuel Pégourié-Gonnarda7937f92017-04-20 15:37:46 +02003126
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02003127#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
Janos Follathdf9295b2019-02-26 12:36:52 +00003128 if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
Gilles Peskine60d8b982021-03-29 22:28:21 +02003129 return( mbedtls_ecp_gen_privkey_sw( &grp->N, d, f_rng, p_rng ) );
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02003130#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
Manuel Pégourié-Gonnard45a035a2013-01-26 14:42:45 +01003131
Gilles Peskine72fcc982021-03-23 22:31:31 +01003132 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnarda7937f92017-04-20 15:37:46 +02003133}
Manuel Pégourié-Gonnardc9573992014-01-03 12:54:00 +01003134
Manuel Pégourié-Gonnarda7937f92017-04-20 15:37:46 +02003135/*
3136 * Generate a keypair with configurable base point
3137 */
3138int mbedtls_ecp_gen_keypair_base( mbedtls_ecp_group *grp,
3139 const mbedtls_ecp_point *G,
3140 mbedtls_mpi *d, mbedtls_ecp_point *Q,
3141 int (*f_rng)(void *, unsigned char *, size_t),
3142 void *p_rng )
3143{
Janos Follath24eed8d2019-11-22 13:21:35 +00003144 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003145 ECP_VALIDATE_RET( grp != NULL );
3146 ECP_VALIDATE_RET( d != NULL );
3147 ECP_VALIDATE_RET( G != NULL );
3148 ECP_VALIDATE_RET( Q != NULL );
3149 ECP_VALIDATE_RET( f_rng != NULL );
Manuel Pégourié-Gonnarda7937f92017-04-20 15:37:46 +02003150
3151 MBEDTLS_MPI_CHK( mbedtls_ecp_gen_privkey( grp, d, f_rng, p_rng ) );
3152 MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, Q, d, G, f_rng, p_rng ) );
3153
3154cleanup:
3155 return( ret );
Manuel Pégourié-Gonnardd9a3f472015-08-11 14:31:03 +02003156}
3157
3158/*
3159 * Generate key pair, wrapper for conventional base point
3160 */
3161int mbedtls_ecp_gen_keypair( mbedtls_ecp_group *grp,
3162 mbedtls_mpi *d, mbedtls_ecp_point *Q,
3163 int (*f_rng)(void *, unsigned char *, size_t),
3164 void *p_rng )
3165{
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003166 ECP_VALIDATE_RET( grp != NULL );
3167 ECP_VALIDATE_RET( d != NULL );
3168 ECP_VALIDATE_RET( Q != NULL );
3169 ECP_VALIDATE_RET( f_rng != NULL );
3170
Manuel Pégourié-Gonnardd9a3f472015-08-11 14:31:03 +02003171 return( mbedtls_ecp_gen_keypair_base( grp, &grp->G, d, Q, f_rng, p_rng ) );
Manuel Pégourié-Gonnard45a035a2013-01-26 14:42:45 +01003172}
Manuel Pégourié-Gonnardefaa31e2012-11-06 21:34:35 +01003173
Manuel Pégourié-Gonnard104ee1d2013-11-30 14:13:16 +01003174/*
3175 * Generate a keypair, prettier wrapper
3176 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003177int mbedtls_ecp_gen_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
Manuel Pégourié-Gonnard104ee1d2013-11-30 14:13:16 +01003178 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
3179{
Janos Follath24eed8d2019-11-22 13:21:35 +00003180 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003181 ECP_VALIDATE_RET( key != NULL );
3182 ECP_VALIDATE_RET( f_rng != NULL );
Manuel Pégourié-Gonnard104ee1d2013-11-30 14:13:16 +01003183
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +02003184 if( ( ret = mbedtls_ecp_group_load( &key->grp, grp_id ) ) != 0 )
Manuel Pégourié-Gonnard104ee1d2013-11-30 14:13:16 +01003185 return( ret );
3186
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003187 return( mbedtls_ecp_gen_keypair( &key->grp, &key->d, &key->Q, f_rng, p_rng ) );
Manuel Pégourié-Gonnard104ee1d2013-11-30 14:13:16 +01003188}
3189
Janos Follath77800962019-02-25 16:32:08 +00003190#define ECP_CURVE25519_KEY_SIZE 32
Archana1d2e2bb2021-06-07 06:13:16 +05303191#define ECP_CURVE448_KEY_SIZE 56
Janos Follath171a7ef2019-02-15 16:17:45 +00003192/*
3193 * Read a private key.
3194 */
3195int mbedtls_ecp_read_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
3196 const unsigned char *buf, size_t buflen )
3197{
3198 int ret = 0;
3199
Janos Follath28eb06d2019-02-26 10:53:34 +00003200 ECP_VALIDATE_RET( key != NULL );
3201 ECP_VALIDATE_RET( buf != NULL );
3202
Janos Follath171a7ef2019-02-15 16:17:45 +00003203 if( ( ret = mbedtls_ecp_group_load( &key->grp, grp_id ) ) != 0 )
3204 return( ret );
3205
Janos Follath28eb06d2019-02-26 10:53:34 +00003206 ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
3207
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02003208#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
Janos Follathdf9295b2019-02-26 12:36:52 +00003209 if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
Janos Follath171a7ef2019-02-15 16:17:45 +00003210 {
Janos Follath28eb06d2019-02-26 10:53:34 +00003211 /*
Archana1d2e2bb2021-06-07 06:13:16 +05303212 * Mask the key as mandated by RFC7748 for Curve25519 and Curve448.
Janos Follath28eb06d2019-02-26 10:53:34 +00003213 */
3214 if( grp_id == MBEDTLS_ECP_DP_CURVE25519 )
3215 {
3216 if( buflen != ECP_CURVE25519_KEY_SIZE )
Archana277572f2021-07-12 09:00:57 +05303217 return( MBEDTLS_ERR_ECP_INVALID_KEY );
Janos Follath171a7ef2019-02-15 16:17:45 +00003218
Janos Follath28eb06d2019-02-26 10:53:34 +00003219 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary_le( &key->d, buf, buflen ) );
Janos Follath171a7ef2019-02-15 16:17:45 +00003220
Janos Follath28eb06d2019-02-26 10:53:34 +00003221 /* Set the three least significant bits to 0 */
3222 MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &key->d, 0, 0 ) );
3223 MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &key->d, 1, 0 ) );
3224 MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &key->d, 2, 0 ) );
Janos Follath171a7ef2019-02-15 16:17:45 +00003225
Janos Follath28eb06d2019-02-26 10:53:34 +00003226 /* Set the most significant bit to 0 */
3227 MBEDTLS_MPI_CHK(
3228 mbedtls_mpi_set_bit( &key->d,
3229 ECP_CURVE25519_KEY_SIZE * 8 - 1, 0 )
3230 );
Janos Follath171a7ef2019-02-15 16:17:45 +00003231
Janos Follath28eb06d2019-02-26 10:53:34 +00003232 /* Set the second most significant bit to 1 */
3233 MBEDTLS_MPI_CHK(
3234 mbedtls_mpi_set_bit( &key->d,
3235 ECP_CURVE25519_KEY_SIZE * 8 - 2, 1 )
3236 );
3237 }
Archana1d2e2bb2021-06-07 06:13:16 +05303238 else if( grp_id == MBEDTLS_ECP_DP_CURVE448 )
3239 {
3240 if( buflen != ECP_CURVE448_KEY_SIZE )
Archana277572f2021-07-12 09:00:57 +05303241 return( MBEDTLS_ERR_ECP_INVALID_KEY );
Archana1d2e2bb2021-06-07 06:13:16 +05303242
3243 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary_le( &key->d, buf, buflen ) );
3244
3245 /* Set the two least significant bits to 0 */
3246 MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &key->d, 0, 0 ) );
3247 MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &key->d, 1, 0 ) );
3248
3249 /* Set the most significant bit to 1 */
3250 MBEDTLS_MPI_CHK(
3251 mbedtls_mpi_set_bit( &key->d,
3252 ECP_CURVE448_KEY_SIZE * 8 - 1, 1 )
3253 );
3254 }
Janos Follath171a7ef2019-02-15 16:17:45 +00003255 }
3256
3257#endif
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02003258#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
Janos Follathdf9295b2019-02-26 12:36:52 +00003259 if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
Janos Follath171a7ef2019-02-15 16:17:45 +00003260 {
3261 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &key->d, buf, buflen ) );
3262
3263 MBEDTLS_MPI_CHK( mbedtls_ecp_check_privkey( &key->grp, &key->d ) );
3264 }
3265
3266#endif
3267cleanup:
3268
3269 if( ret != 0 )
3270 mbedtls_mpi_free( &key->d );
3271
3272 return( ret );
3273}
3274
Manuel Pégourié-Gonnard30668d62014-11-06 15:25:32 +01003275/*
Steven Cooremande8593f2020-06-09 19:55:26 +02003276 * Write a private key.
3277 */
Steven Cooreman0024df62020-07-13 10:59:40 +02003278int mbedtls_ecp_write_key( mbedtls_ecp_keypair *key,
Steven Cooremanc9b7f782020-06-11 17:00:36 +02003279 unsigned char *buf, size_t buflen )
Steven Cooremande8593f2020-06-09 19:55:26 +02003280{
Steven Cooreman0024df62020-07-13 10:59:40 +02003281 int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
Steven Cooremande8593f2020-06-09 19:55:26 +02003282
Steven Cooreman0024df62020-07-13 10:59:40 +02003283 ECP_VALIDATE_RET( key != NULL );
3284 ECP_VALIDATE_RET( buf != NULL );
Steven Cooremande8593f2020-06-09 19:55:26 +02003285
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02003286#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
Steven Cooremande8593f2020-06-09 19:55:26 +02003287 if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
3288 {
Steven Cooreman0024df62020-07-13 10:59:40 +02003289 if( key->grp.id == MBEDTLS_ECP_DP_CURVE25519 )
Steven Cooremande8593f2020-06-09 19:55:26 +02003290 {
3291 if( buflen < ECP_CURVE25519_KEY_SIZE )
Archana277572f2021-07-12 09:00:57 +05303292 return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
Steven Cooremande8593f2020-06-09 19:55:26 +02003293
Steven Cooremande8593f2020-06-09 19:55:26 +02003294 }
Archana277572f2021-07-12 09:00:57 +05303295 else if( key->grp.id == MBEDTLS_ECP_DP_CURVE448 )
Archana1d2e2bb2021-06-07 06:13:16 +05303296 {
3297 if( buflen < ECP_CURVE448_KEY_SIZE )
Archana277572f2021-07-12 09:00:57 +05303298 return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
Archana1d2e2bb2021-06-07 06:13:16 +05303299 }
3300 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary_le( &key->d, buf, buflen ) );
Steven Cooremande8593f2020-06-09 19:55:26 +02003301 }
Steven Cooremande8593f2020-06-09 19:55:26 +02003302#endif
Gilles Peskinee8c04fe2018-09-14 17:44:21 +02003303#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
Steven Cooremande8593f2020-06-09 19:55:26 +02003304 if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
3305 {
3306 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &key->d, buf, buflen ) );
Steven Cooremande8593f2020-06-09 19:55:26 +02003307 }
3308
3309#endif
3310cleanup:
3311
3312 return( ret );
3313}
3314
3315
3316/*
Manuel Pégourié-Gonnard30668d62014-11-06 15:25:32 +01003317 * Check a public-private key pair
3318 */
Manuel Pégourié-Gonnardf8c24bf2021-06-15 11:29:26 +02003319int mbedtls_ecp_check_pub_priv(
3320 const mbedtls_ecp_keypair *pub, const mbedtls_ecp_keypair *prv,
3321 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
Manuel Pégourié-Gonnard30668d62014-11-06 15:25:32 +01003322{
Janos Follath24eed8d2019-11-22 13:21:35 +00003323 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003324 mbedtls_ecp_point Q;
3325 mbedtls_ecp_group grp;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003326 ECP_VALIDATE_RET( pub != NULL );
3327 ECP_VALIDATE_RET( prv != NULL );
Manuel Pégourié-Gonnard30668d62014-11-06 15:25:32 +01003328
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003329 if( pub->grp.id == MBEDTLS_ECP_DP_NONE ||
Manuel Pégourié-Gonnard30668d62014-11-06 15:25:32 +01003330 pub->grp.id != prv->grp.id ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003331 mbedtls_mpi_cmp_mpi( &pub->Q.X, &prv->Q.X ) ||
3332 mbedtls_mpi_cmp_mpi( &pub->Q.Y, &prv->Q.Y ) ||
3333 mbedtls_mpi_cmp_mpi( &pub->Q.Z, &prv->Q.Z ) )
Manuel Pégourié-Gonnard30668d62014-11-06 15:25:32 +01003334 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003335 return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard30668d62014-11-06 15:25:32 +01003336 }
3337
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003338 mbedtls_ecp_point_init( &Q );
3339 mbedtls_ecp_group_init( &grp );
Manuel Pégourié-Gonnard30668d62014-11-06 15:25:32 +01003340
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003341 /* mbedtls_ecp_mul() needs a non-const group... */
3342 mbedtls_ecp_group_copy( &grp, &prv->grp );
Manuel Pégourié-Gonnard30668d62014-11-06 15:25:32 +01003343
3344 /* Also checks d is valid */
Manuel Pégourié-Gonnardf8c24bf2021-06-15 11:29:26 +02003345 MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &Q, &prv->d, &prv->grp.G, f_rng, p_rng ) );
Manuel Pégourié-Gonnard30668d62014-11-06 15:25:32 +01003346
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003347 if( mbedtls_mpi_cmp_mpi( &Q.X, &prv->Q.X ) ||
3348 mbedtls_mpi_cmp_mpi( &Q.Y, &prv->Q.Y ) ||
3349 mbedtls_mpi_cmp_mpi( &Q.Z, &prv->Q.Z ) )
Manuel Pégourié-Gonnard30668d62014-11-06 15:25:32 +01003350 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003351 ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
Manuel Pégourié-Gonnard30668d62014-11-06 15:25:32 +01003352 goto cleanup;
3353 }
3354
3355cleanup:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003356 mbedtls_ecp_point_free( &Q );
3357 mbedtls_ecp_group_free( &grp );
Manuel Pégourié-Gonnard30668d62014-11-06 15:25:32 +01003358
3359 return( ret );
3360}
3361
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003362#if defined(MBEDTLS_SELF_TEST)
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +01003363
Manuel Pégourié-Gonnardaa3ed6f2021-06-15 11:29:26 +02003364/*
3365 * PRNG for test - !!!INSECURE NEVER USE IN PRODUCTION!!!
3366 *
3367 * This is the linear congruential generator from numerical recipes,
3368 * except we only use the low byte as the output. See
3369 * https://en.wikipedia.org/wiki/Linear_congruential_generator#Parameters_in_common_use
3370 */
3371static int self_test_rng( void *ctx, unsigned char *out, size_t len )
3372{
3373 static uint32_t state = 42;
3374
3375 (void) ctx;
3376
3377 for( size_t i = 0; i < len; i++ )
3378 {
3379 state = state * 1664525u + 1013904223u;
3380 out[i] = (unsigned char) state;
3381 }
3382
3383 return( 0 );
3384}
3385
Gilles Peskine6d9c8d72020-07-22 01:26:25 +02003386/* Adjust the exponent to be a valid private point for the specified curve.
3387 * This is sometimes necessary because we use a single set of exponents
3388 * for all curves but the validity of values depends on the curve. */
Gilles Peskinea088c812018-09-17 18:31:15 +02003389static int self_test_adjust_exponent( const mbedtls_ecp_group *grp,
3390 mbedtls_mpi *m )
3391{
3392 int ret = 0;
3393 switch( grp->id )
3394 {
3395 /* If Curve25519 is available, then that's what we use for the
3396 * Montgomery test, so we don't need the adjustment code. */
3397#if ! defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
3398#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
3399 case MBEDTLS_ECP_DP_CURVE448:
3400 /* Move highest bit from 254 to N-1. Setting bit N-1 is
3401 * necessary to enforce the highest-bit-set constraint. */
3402 MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( m, 254, 0 ) );
3403 MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( m, grp->nbits, 1 ) );
3404 /* Copy second-highest bit from 253 to N-2. This is not
3405 * necessary but improves the test variety a bit. */
3406 MBEDTLS_MPI_CHK(
3407 mbedtls_mpi_set_bit( m, grp->nbits - 1,
3408 mbedtls_mpi_get_bit( m, 253 ) ) );
3409 break;
3410#endif
3411#endif /* ! defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) */
3412 default:
3413 /* Non-Montgomery curves and Curve25519 need no adjustment. */
3414 (void) grp;
3415 (void) m;
3416 goto cleanup;
3417 }
3418cleanup:
3419 return( ret );
3420}
3421
Gilles Peskine6d9c8d72020-07-22 01:26:25 +02003422/* Calculate R = m.P for each m in exponents. Check that the number of
3423 * basic operations doesn't depend on the value of m. */
Gilles Peskinec95696f2018-09-17 15:59:01 +02003424static int self_test_point( int verbose,
3425 mbedtls_ecp_group *grp,
3426 mbedtls_ecp_point *R,
3427 mbedtls_mpi *m,
Gilles Peskine6d9c8d72020-07-22 01:26:25 +02003428 const mbedtls_ecp_point *P,
Gilles Peskinec95696f2018-09-17 15:59:01 +02003429 const char *const *exponents,
3430 size_t n_exponents )
3431{
3432 int ret = 0;
Gilles Peskine24666792018-09-17 18:29:49 +02003433 size_t i = 0;
Gilles Peskinec95696f2018-09-17 15:59:01 +02003434 unsigned long add_c_prev, dbl_c_prev, mul_c_prev;
3435 add_count = 0;
3436 dbl_count = 0;
3437 mul_count = 0;
Gilles Peskinea088c812018-09-17 18:31:15 +02003438
Gilles Peskinec95696f2018-09-17 15:59:01 +02003439 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( m, 16, exponents[0] ) );
Gilles Peskinea088c812018-09-17 18:31:15 +02003440 MBEDTLS_MPI_CHK( self_test_adjust_exponent( grp, m ) );
Manuel Pégourié-Gonnardaa3ed6f2021-06-15 11:29:26 +02003441 MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, R, m, P, self_test_rng, NULL ) );
Gilles Peskinec95696f2018-09-17 15:59:01 +02003442
3443 for( i = 1; i < n_exponents; i++ )
3444 {
3445 add_c_prev = add_count;
3446 dbl_c_prev = dbl_count;
3447 mul_c_prev = mul_count;
3448 add_count = 0;
3449 dbl_count = 0;
3450 mul_count = 0;
3451
3452 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( m, 16, exponents[i] ) );
Gilles Peskinea088c812018-09-17 18:31:15 +02003453 MBEDTLS_MPI_CHK( self_test_adjust_exponent( grp, m ) );
Manuel Pégourié-Gonnardaa3ed6f2021-06-15 11:29:26 +02003454 MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, R, m, P, self_test_rng, NULL ) );
Gilles Peskinec95696f2018-09-17 15:59:01 +02003455
3456 if( add_count != add_c_prev ||
3457 dbl_count != dbl_c_prev ||
3458 mul_count != mul_c_prev )
3459 {
3460 ret = 1;
3461 break;
3462 }
3463 }
3464
3465cleanup:
3466 if( verbose != 0 )
3467 {
3468 if( ret != 0 )
3469 mbedtls_printf( "failed (%u)\n", (unsigned int) i );
3470 else
3471 mbedtls_printf( "passed\n" );
3472 }
3473 return( ret );
3474}
3475
Manuel Pégourié-Gonnardb505c272012-11-05 17:27:54 +01003476/*
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +01003477 * Checkup routine
3478 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003479int mbedtls_ecp_self_test( int verbose )
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +01003480{
Janos Follath24eed8d2019-11-22 13:21:35 +00003481 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003482 mbedtls_ecp_group grp;
3483 mbedtls_ecp_point R, P;
3484 mbedtls_mpi m;
Gilles Peskine24666792018-09-17 18:29:49 +02003485
3486#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
Gilles Peskined9767a52018-09-14 19:29:47 +02003487 /* Exponents especially adapted for secp192k1, which has the lowest
3488 * order n of all supported curves (secp192r1 is in a slightly larger
3489 * field but the order of its base point is slightly smaller). */
Gilles Peskine24666792018-09-17 18:29:49 +02003490 const char *sw_exponents[] =
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +01003491 {
Manuel Pégourié-Gonnardb63f9e92012-11-21 13:00:58 +01003492 "000000000000000000000000000000000000000000000001", /* one */
Gilles Peskined9767a52018-09-14 19:29:47 +02003493 "FFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8C", /* n - 1 */
Manuel Pégourié-Gonnardb63f9e92012-11-21 13:00:58 +01003494 "5EA6F389A38B8BC81E767753B15AA5569E1782E30ABE7D25", /* random */
Manuel Pégourié-Gonnardff27b7c2013-11-21 09:28:03 +01003495 "400000000000000000000000000000000000000000000000", /* one and zeros */
3496 "7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", /* all ones */
3497 "555555555555555555555555555555555555555555555555", /* 101010... */
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +01003498 };
Gilles Peskine24666792018-09-17 18:29:49 +02003499#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
3500#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
3501 const char *m_exponents[] =
3502 {
Gilles Peskine6d9c8d72020-07-22 01:26:25 +02003503 /* Valid private values for Curve25519. In a build with Curve448
3504 * but not Curve25519, they will be adjusted in
3505 * self_test_adjust_exponent(). */
Gilles Peskine24666792018-09-17 18:29:49 +02003506 "4000000000000000000000000000000000000000000000000000000000000000",
3507 "5C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C30",
3508 "5715ECCE24583F7A7023C24164390586842E816D7280A49EF6DF4EAE6B280BF8",
3509 "41A2B017516F6D254E1F002BCCBADD54BE30F8CEC737A0E912B4963B6BA74460",
3510 "5555555555555555555555555555555555555555555555555555555555555550",
3511 "7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8",
3512 };
3513#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +01003514
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003515 mbedtls_ecp_group_init( &grp );
3516 mbedtls_ecp_point_init( &R );
3517 mbedtls_ecp_point_init( &P );
3518 mbedtls_mpi_init( &m );
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +01003519
Gilles Peskine24666792018-09-17 18:29:49 +02003520#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
Manuel Pégourié-Gonnardb8012fc2013-10-10 15:40:49 +02003521 /* Use secp192r1 if available, or any available curve */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003522#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +02003523 MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, MBEDTLS_ECP_DP_SECP192R1 ) );
Paul Bakker5dc6b5f2013-06-29 23:26:34 +02003524#else
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +02003525 MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, mbedtls_ecp_curve_list()->grp_id ) );
Manuel Pégourié-Gonnardb8012fc2013-10-10 15:40:49 +02003526#endif
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +01003527
3528 if( verbose != 0 )
Gilles Peskine24666792018-09-17 18:29:49 +02003529 mbedtls_printf( " ECP SW test #1 (constant op_count, base point G): " );
Manuel Pégourié-Gonnard161ef962013-09-17 19:13:10 +02003530 /* Do a dummy multiplication first to trigger precomputation */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003531 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &m, 2 ) );
Manuel Pégourié-Gonnardaa3ed6f2021-06-15 11:29:26 +02003532 MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &P, &m, &grp.G, self_test_rng, NULL ) );
Gilles Peskinec95696f2018-09-17 15:59:01 +02003533 ret = self_test_point( verbose,
3534 &grp, &R, &m, &grp.G,
Gilles Peskine24666792018-09-17 18:29:49 +02003535 sw_exponents,
3536 sizeof( sw_exponents ) / sizeof( sw_exponents[0] ));
Gilles Peskinec95696f2018-09-17 15:59:01 +02003537 if( ret != 0 )
3538 goto cleanup;
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +01003539
Manuel Pégourié-Gonnard161ef962013-09-17 19:13:10 +02003540 if( verbose != 0 )
Gilles Peskine24666792018-09-17 18:29:49 +02003541 mbedtls_printf( " ECP SW test #2 (constant op_count, other point): " );
Manuel Pégourié-Gonnard161ef962013-09-17 19:13:10 +02003542 /* We computed P = 2G last time, use it */
Gilles Peskinec95696f2018-09-17 15:59:01 +02003543 ret = self_test_point( verbose,
3544 &grp, &R, &m, &P,
Gilles Peskine24666792018-09-17 18:29:49 +02003545 sw_exponents,
3546 sizeof( sw_exponents ) / sizeof( sw_exponents[0] ));
3547 if( ret != 0 )
3548 goto cleanup;
3549
3550 mbedtls_ecp_group_free( &grp );
3551 mbedtls_ecp_point_free( &R );
3552#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
3553
3554#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
3555 if( verbose != 0 )
3556 mbedtls_printf( " ECP Montgomery test (constant op_count): " );
3557#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
3558 MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, MBEDTLS_ECP_DP_CURVE25519 ) );
3559#elif defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
3560 MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, MBEDTLS_ECP_DP_CURVE448 ) );
3561#else
3562#error "MBEDTLS_ECP_MONTGOMERY_ENABLED is defined, but no curve is supported for self-test"
3563#endif
3564 ret = self_test_point( verbose,
3565 &grp, &R, &m, &grp.G,
3566 m_exponents,
3567 sizeof( m_exponents ) / sizeof( m_exponents[0] ));
3568 if( ret != 0 )
3569 goto cleanup;
3570#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
Manuel Pégourié-Gonnard161ef962013-09-17 19:13:10 +02003571
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +01003572cleanup:
3573
3574 if( ret < 0 && verbose != 0 )
Kenneth Soerensen518d4352020-04-01 17:22:45 +02003575 mbedtls_printf( "Unexpected error, return code = %08X\n", (unsigned int) ret );
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +01003576
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003577 mbedtls_ecp_group_free( &grp );
3578 mbedtls_ecp_point_free( &R );
3579 mbedtls_ecp_point_free( &P );
3580 mbedtls_mpi_free( &m );
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +01003581
3582 if( verbose != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003583 mbedtls_printf( "\n" );
Manuel Pégourié-Gonnardb4a310b2012-11-13 20:57:00 +01003584
3585 return( ret );
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +01003586}
3587
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003588#endif /* MBEDTLS_SELF_TEST */
Manuel Pégourié-Gonnard39d2adb2012-10-31 09:26:55 +01003589
Janos Follathb0697532016-08-18 12:38:46 +01003590#endif /* !MBEDTLS_ECP_ALT */
3591
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003592#endif /* MBEDTLS_ECP_C */