uECC.cpp

00001 /* Copyright 2014, Kenneth MacKay. Licensed under the BSD 2-clause license. */
00002 
00003 #include "uECC.h"
00004 #include "uECC_vli.h"
00005 
00006 #ifndef uECC_RNG_MAX_TRIES
00007     #define uECC_RNG_MAX_TRIES 64
00008 #endif
00009 
00010 #if uECC_ENABLE_VLI_API
00011     #define uECC_VLI_API
00012 #else
00013     #define uECC_VLI_API static
00014 #endif
00015 
00016 #define CONCATX(a, ...) a ## __VA_ARGS__
00017 #define CONCAT(a, ...) CONCATX(a, __VA_ARGS__)
00018 
00019 #define STRX(a) #a
00020 #define STR(a) STRX(a)
00021 
00022 #define EVAL(...)  EVAL1(EVAL1(EVAL1(EVAL1(__VA_ARGS__))))
00023 #define EVAL1(...) EVAL2(EVAL2(EVAL2(EVAL2(__VA_ARGS__))))
00024 #define EVAL2(...) EVAL3(EVAL3(EVAL3(EVAL3(__VA_ARGS__))))
00025 #define EVAL3(...) EVAL4(EVAL4(EVAL4(EVAL4(__VA_ARGS__))))
00026 #define EVAL4(...) __VA_ARGS__
00027 
00028 #define DEC_1  0
00029 #define DEC_2  1
00030 #define DEC_3  2
00031 #define DEC_4  3
00032 #define DEC_5  4
00033 #define DEC_6  5
00034 #define DEC_7  6
00035 #define DEC_8  7
00036 #define DEC_9  8
00037 #define DEC_10 9
00038 #define DEC_11 10
00039 #define DEC_12 11
00040 #define DEC_13 12
00041 #define DEC_14 13
00042 #define DEC_15 14
00043 #define DEC_16 15
00044 #define DEC_17 16
00045 #define DEC_18 17
00046 #define DEC_19 18
00047 #define DEC_20 19
00048 #define DEC_21 20
00049 #define DEC_22 21
00050 #define DEC_23 22
00051 #define DEC_24 23
00052 #define DEC_25 24
00053 #define DEC_26 25
00054 #define DEC_27 26
00055 #define DEC_28 27
00056 #define DEC_29 28
00057 #define DEC_30 29
00058 #define DEC_31 30
00059 #define DEC_32 31
00060 
00061 #define DEC(N) CONCAT(DEC_, N)
00062 
00063 #define SECOND_ARG(_, val, ...) val
00064 #define SOME_CHECK_0 ~, 0
00065 #define GET_SECOND_ARG(...) SECOND_ARG(__VA_ARGS__, SOME,)
00066 #define SOME_OR_0(N) GET_SECOND_ARG(CONCAT(SOME_CHECK_, N))
00067 
00068 #define EMPTY(...)
00069 #define DEFER(...) __VA_ARGS__ EMPTY()
00070 
00071 #define REPEAT_NAME_0() REPEAT_0
00072 #define REPEAT_NAME_SOME() REPEAT_SOME
00073 #define REPEAT_0(...)
00074 #define REPEAT_SOME(N, stuff) DEFER(CONCAT(REPEAT_NAME_, SOME_OR_0(DEC(N))))()(DEC(N), stuff) stuff
00075 #define REPEAT(N, stuff) EVAL(REPEAT_SOME(N, stuff))
00076 
00077 #define REPEATM_NAME_0() REPEATM_0
00078 #define REPEATM_NAME_SOME() REPEATM_SOME
00079 #define REPEATM_0(...)
00080 #define REPEATM_SOME(N, macro) macro(N) \
00081     DEFER(CONCAT(REPEATM_NAME_, SOME_OR_0(DEC(N))))()(DEC(N), macro)
00082 #define REPEATM(N, macro) EVAL(REPEATM_SOME(N, macro))
00083 
00084 //#include "platform-specific.inc"
00085 #include "platform-specific.h"
00086 
00087 #if (uECC_WORD_SIZE == 1)
00088     #if uECC_SUPPORTS_secp160r1
00089         #define uECC_MAX_WORDS 21 /* Due to the size of curve_n. */
00090     #endif
00091     #if uECC_SUPPORTS_secp192r1
00092         #undef uECC_MAX_WORDS
00093         #define uECC_MAX_WORDS 24
00094     #endif
00095     #if uECC_SUPPORTS_secp224r1
00096         #undef uECC_MAX_WORDS
00097         #define uECC_MAX_WORDS 28
00098     #endif
00099     #if (uECC_SUPPORTS_secp256r1 || uECC_SUPPORTS_secp256k1)
00100         #undef uECC_MAX_WORDS
00101         #define uECC_MAX_WORDS 32
00102     #endif
00103 #elif (uECC_WORD_SIZE == 4)
00104     #if uECC_SUPPORTS_secp160r1
00105         #define uECC_MAX_WORDS 6 /* Due to the size of curve_n. */
00106     #endif
00107     #if uECC_SUPPORTS_secp192r1
00108         #undef uECC_MAX_WORDS
00109         #define uECC_MAX_WORDS 6
00110     #endif
00111     #if uECC_SUPPORTS_secp224r1
00112         #undef uECC_MAX_WORDS
00113         #define uECC_MAX_WORDS 7
00114     #endif
00115     #if (uECC_SUPPORTS_secp256r1 || uECC_SUPPORTS_secp256k1)
00116         #undef uECC_MAX_WORDS
00117         #define uECC_MAX_WORDS 8
00118     #endif
00119 #elif (uECC_WORD_SIZE == 8)
00120     #if uECC_SUPPORTS_secp160r1
00121         #define uECC_MAX_WORDS 3
00122     #endif
00123     #if uECC_SUPPORTS_secp192r1
00124         #undef uECC_MAX_WORDS
00125         #define uECC_MAX_WORDS 3
00126     #endif
00127     #if uECC_SUPPORTS_secp224r1
00128         #undef uECC_MAX_WORDS
00129         #define uECC_MAX_WORDS 4
00130     #endif
00131     #if (uECC_SUPPORTS_secp256r1 || uECC_SUPPORTS_secp256k1)
00132         #undef uECC_MAX_WORDS
00133         #define uECC_MAX_WORDS 4
00134     #endif
00135 #endif /* uECC_WORD_SIZE */
00136 
00137 #define BITS_TO_WORDS(num_bits) ((num_bits + ((uECC_WORD_SIZE * 8) - 1)) / (uECC_WORD_SIZE * 8))
00138 #define BITS_TO_BYTES(num_bits) ((num_bits + 7) / 8)
00139 
00140 struct uECC_Curve_t {
00141     wordcount_t num_words;
00142     wordcount_t num_bytes;
00143     bitcount_t num_n_bits;
00144     uECC_word_t p[uECC_MAX_WORDS];
00145     uECC_word_t n[uECC_MAX_WORDS];
00146     uECC_word_t G[uECC_MAX_WORDS * 2];
00147     uECC_word_t b[uECC_MAX_WORDS];
00148     void (*double_jacobian)(uECC_word_t * X1,
00149                             uECC_word_t * Y1,
00150                             uECC_word_t * Z1,
00151                             uECC_Curve curve);
00152 #if uECC_SUPPORT_COMPRESSED_POINT
00153     void (*mod_sqrt)(uECC_word_t *a, uECC_Curve curve);
00154 #endif
00155     void (*x_side)(uECC_word_t *result, const uECC_word_t *x, uECC_Curve curve);
00156 #if (uECC_OPTIMIZATION_LEVEL > 0)
00157     void (*mmod_fast)(uECC_word_t *result, uECC_word_t *product);
00158 #endif
00159 };
00160 
00161 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
00162 static void bcopy(uint8_t *dst,
00163                   const uint8_t *src,
00164                   unsigned num_bytes) {
00165     while (0 != num_bytes) {
00166         num_bytes--;
00167         dst[num_bytes] = src[num_bytes];
00168     }
00169 }
00170 #endif
00171 
00172 static cmpresult_t uECC_vli_cmp_unsafe(const uECC_word_t *left,
00173                                        const uECC_word_t *right,
00174                                        wordcount_t num_words);
00175 
00176 #if (uECC_PLATFORM == uECC_arm || uECC_PLATFORM == uECC_arm_thumb || \
00177         uECC_PLATFORM == uECC_arm_thumb2)
00178     //#include "asm_arm.inc"
00179     #include "asm_arm.h"
00180 #if (uECC_PLATFORM == uECC_arm)    
00181     #warning uECC_arm
00182 #elif (uECC_PLATFORM == uECC_arm_thumb)
00183     #warning uECC_arm_thumb
00184 #elif (uECC_PLATFORM == uECC_arm_thumb2)
00185     #warning uECC_arm_thumb2
00186 #endif        
00187 #endif
00188 
00189 #if (uECC_PLATFORM == uECC_avr)
00190     #include "asm_avr.inc"
00191 #endif
00192 
00193 #if default_RNG_defined
00194 static uECC_RNG_Function g_rng_function = &default_RNG;
00195 #else
00196 static uECC_RNG_Function g_rng_function = 0;
00197 #endif
00198 
00199 void uECC_set_rng(uECC_RNG_Function rng_function) {
00200     g_rng_function = rng_function;
00201 }
00202 
00203 uECC_RNG_Function uECC_get_rng(void) {
00204     return g_rng_function;
00205 }
00206 
00207 int uECC_curve_private_key_size(uECC_Curve curve) {
00208     return BITS_TO_BYTES(curve->num_n_bits);
00209 }
00210 
00211 int uECC_curve_public_key_size(uECC_Curve curve) {
00212     return 2 * curve->num_bytes;
00213 }
00214 
00215 #if !asm_clear
00216 uECC_VLI_API void uECC_vli_clear(uECC_word_t *vli, wordcount_t num_words) {
00217     wordcount_t i;
00218     for (i = 0; i < num_words; ++i) {
00219         vli[i] = 0;
00220     }
00221 }
00222 #endif /* !asm_clear */
00223 
00224 /* Constant-time comparison to zero - secure way to compare long integers */
00225 /* Returns 1 if vli == 0, 0 otherwise. */
00226 uECC_VLI_API uECC_word_t uECC_vli_isZero(const uECC_word_t *vli, wordcount_t num_words) {
00227     uECC_word_t bits = 0;
00228     wordcount_t i;
00229     for (i = 0; i < num_words; ++i) {
00230         bits |= vli[i];
00231     }
00232     return (bits == 0);
00233 }
00234 
00235 /* Returns nonzero if bit 'bit' of vli is set. */
00236 uECC_VLI_API uECC_word_t uECC_vli_testBit(const uECC_word_t *vli, bitcount_t bit) {
00237     return (vli[bit >> uECC_WORD_BITS_SHIFT] & ((uECC_word_t)1 << (bit & uECC_WORD_BITS_MASK)));
00238 }
00239 
00240 /* Counts the number of words in vli. */
00241 static wordcount_t vli_numDigits(const uECC_word_t *vli, const wordcount_t max_words) {
00242     wordcount_t i;
00243     /* Search from the end until we find a non-zero digit.
00244        We do it in reverse because we expect that most digits will be nonzero. */
00245     for (i = max_words - 1; i >= 0 && vli[i] == 0; --i) {
00246     }
00247 
00248     return (i + 1);
00249 }
00250 
00251 /* Counts the number of bits required to represent vli. */
00252 uECC_VLI_API bitcount_t uECC_vli_numBits(const uECC_word_t *vli, const wordcount_t max_words) {
00253     uECC_word_t i;
00254     uECC_word_t digit;
00255 
00256     wordcount_t num_digits = vli_numDigits(vli, max_words);
00257     if (num_digits == 0) {
00258         return 0;
00259     }
00260 
00261     digit = vli[num_digits - 1];
00262     for (i = 0; digit; ++i) {
00263         digit >>= 1;
00264     }
00265 
00266     return (((bitcount_t)(num_digits - 1) << uECC_WORD_BITS_SHIFT) + i);
00267 }
00268 
00269 /* Sets dest = src. */
00270 #if !asm_set
00271 uECC_VLI_API void uECC_vli_set(uECC_word_t *dest, const uECC_word_t *src, wordcount_t num_words) {
00272     wordcount_t i;
00273     for (i = 0; i < num_words; ++i) {
00274         dest[i] = src[i];
00275     }
00276 }
00277 #endif /* !asm_set */
00278 
00279 /* Returns sign of left - right. */
00280 static cmpresult_t uECC_vli_cmp_unsafe(const uECC_word_t *left,
00281                                        const uECC_word_t *right,
00282                                        wordcount_t num_words) {
00283     wordcount_t i;
00284     for (i = num_words - 1; i >= 0; --i) {
00285         if (left[i] > right[i]) {
00286             return 1;
00287         } else if (left[i] < right[i]) {
00288             return -1;
00289         }
00290     }
00291     return 0;
00292 }
00293 
00294 /* Constant-time comparison function - secure way to compare long integers */
00295 /* Returns one if left == right, zero otherwise. */
00296 uECC_VLI_API uECC_word_t uECC_vli_equal(const uECC_word_t *left,
00297                                         const uECC_word_t *right,
00298                                         wordcount_t num_words) {
00299     uECC_word_t diff = 0;
00300     wordcount_t i;
00301     for (i = num_words - 1; i >= 0; --i) {
00302         diff |= (left[i] ^ right[i]);
00303     }
00304     return (diff == 0);
00305 }
00306 
00307 uECC_VLI_API uECC_word_t uECC_vli_sub(uECC_word_t *result,
00308                                       const uECC_word_t *left,
00309                                       const uECC_word_t *right,
00310                                       wordcount_t num_words);
00311 
00312 /* Returns sign of left - right, in constant time. */
00313 uECC_VLI_API cmpresult_t uECC_vli_cmp(const uECC_word_t *left,
00314                                       const uECC_word_t *right,
00315                                       wordcount_t num_words) {
00316     uECC_word_t tmp[uECC_MAX_WORDS];
00317     uECC_word_t neg = !!uECC_vli_sub(tmp, left, right, num_words);
00318     uECC_word_t equal = uECC_vli_isZero(tmp, num_words);
00319     return (!equal - 2 * neg);
00320 }
00321 
00322 /* Computes vli = vli >> 1. */
00323 #if !asm_rshift1
00324 uECC_VLI_API void uECC_vli_rshift1(uECC_word_t *vli, wordcount_t num_words) {
00325     uECC_word_t *end = vli;
00326     uECC_word_t carry = 0;
00327 
00328     vli += num_words;
00329     while (vli-- > end) {
00330         uECC_word_t temp = *vli;
00331         *vli = (temp >> 1) | carry;
00332         carry = temp << (uECC_WORD_BITS - 1);
00333     }
00334 }
00335 #endif /* !asm_rshift1 */
00336 
00337 /* Computes result = left + right, returning carry. Can modify in place. */
00338 #if !asm_add
00339 uECC_VLI_API uECC_word_t uECC_vli_add(uECC_word_t *result,
00340                                       const uECC_word_t *left,
00341                                       const uECC_word_t *right,
00342                                       wordcount_t num_words) {
00343     uECC_word_t carry = 0;
00344     wordcount_t i;
00345     for (i = 0; i < num_words; ++i) {
00346         uECC_word_t sum = left[i] + right[i] + carry;
00347         if (sum != left[i]) {
00348             carry = (sum < left[i]);
00349         }
00350         result[i] = sum;
00351     }
00352     return carry;
00353 }
00354 #endif /* !asm_add */
00355 
00356 /* Computes result = left - right, returning borrow. Can modify in place. */
00357 #if !asm_sub
00358 uECC_VLI_API uECC_word_t uECC_vli_sub(uECC_word_t *result,
00359                                       const uECC_word_t *left,
00360                                       const uECC_word_t *right,
00361                                       wordcount_t num_words) {
00362     uECC_word_t borrow = 0;
00363     wordcount_t i;
00364     for (i = 0; i < num_words; ++i) {
00365         uECC_word_t diff = left[i] - right[i] - borrow;
00366         if (diff != left[i]) {
00367             borrow = (diff > left[i]);
00368         }
00369         result[i] = diff;
00370     }
00371     return borrow;
00372 }
00373 #endif /* !asm_sub */
00374 
00375 #if !asm_mult || (uECC_SQUARE_FUNC && !asm_square) || \
00376     (uECC_SUPPORTS_secp256k1 && (uECC_OPTIMIZATION_LEVEL > 0) && \
00377         ((uECC_WORD_SIZE == 1) || (uECC_WORD_SIZE == 8)))
00378 static void muladd(uECC_word_t a,
00379                    uECC_word_t b,
00380                    uECC_word_t *r0,
00381                    uECC_word_t *r1,
00382                    uECC_word_t *r2) {
00383 #if uECC_WORD_SIZE == 8 && !SUPPORTS_INT128
00384     uint64_t a0 = a & 0xffffffffull;
00385     uint64_t a1 = a >> 32;
00386     uint64_t b0 = b & 0xffffffffull;
00387     uint64_t b1 = b >> 32;
00388 
00389     uint64_t i0 = a0 * b0;
00390     uint64_t i1 = a0 * b1;
00391     uint64_t i2 = a1 * b0;
00392     uint64_t i3 = a1 * b1;
00393 
00394     uint64_t p0, p1;
00395 
00396     i2 += (i0 >> 32);
00397     i2 += i1;
00398     if (i2 < i1) { /* overflow */
00399         i3 += 0x100000000ull;
00400     }
00401 
00402     p0 = (i0 & 0xffffffffull) | (i2 << 32);
00403     p1 = i3 + (i2 >> 32);
00404 
00405     *r0 += p0;
00406     *r1 += (p1 + (*r0 < p0));
00407     *r2 += ((*r1 < p1) || (*r1 == p1 && *r0 < p0));
00408 #else
00409     uECC_dword_t p = (uECC_dword_t)a * b;
00410     uECC_dword_t r01 = ((uECC_dword_t)(*r1) << uECC_WORD_BITS) | *r0;
00411     r01 += p;
00412     *r2 += (r01 < p);
00413     *r1 = r01 >> uECC_WORD_BITS;
00414     *r0 = (uECC_word_t)r01;
00415 #endif
00416 }
00417 #endif /* muladd needed */
00418 
00419 #if !asm_mult
00420 uECC_VLI_API void uECC_vli_mult(uECC_word_t *result,
00421                                 const uECC_word_t *left,
00422                                 const uECC_word_t *right,
00423                                 wordcount_t num_words) {
00424     uECC_word_t r0 = 0;
00425     uECC_word_t r1 = 0;
00426     uECC_word_t r2 = 0;
00427     wordcount_t i, k;
00428 
00429     /* Compute each digit of result in sequence, maintaining the carries. */
00430     for (k = 0; k < num_words; ++k) {
00431         for (i = 0; i <= k; ++i) {
00432             muladd(left[i], right[k - i], &r0, &r1, &r2);
00433         }
00434         result[k] = r0;
00435         r0 = r1;
00436         r1 = r2;
00437         r2 = 0;
00438     }
00439     for (k = num_words; k < num_words * 2 - 1; ++k) {
00440         for (i = (k + 1) - num_words; i < num_words; ++i) {
00441             muladd(left[i], right[k - i], &r0, &r1, &r2);
00442         }
00443         result[k] = r0;
00444         r0 = r1;
00445         r1 = r2;
00446         r2 = 0;
00447     }
00448     result[num_words * 2 - 1] = r0;
00449 }
00450 #endif /* !asm_mult */
00451 
00452 #if uECC_SQUARE_FUNC
00453 
00454 #if !asm_square
00455 static void mul2add(uECC_word_t a,
00456                     uECC_word_t b,
00457                     uECC_word_t *r0,
00458                     uECC_word_t *r1,
00459                     uECC_word_t *r2) {
00460 #if uECC_WORD_SIZE == 8 && !SUPPORTS_INT128
00461     uint64_t a0 = a & 0xffffffffull;
00462     uint64_t a1 = a >> 32;
00463     uint64_t b0 = b & 0xffffffffull;
00464     uint64_t b1 = b >> 32;
00465 
00466     uint64_t i0 = a0 * b0;
00467     uint64_t i1 = a0 * b1;
00468     uint64_t i2 = a1 * b0;
00469     uint64_t i3 = a1 * b1;
00470 
00471     uint64_t p0, p1;
00472 
00473     i2 += (i0 >> 32);
00474     i2 += i1;
00475     if (i2 < i1)
00476     { /* overflow */
00477         i3 += 0x100000000ull;
00478     }
00479 
00480     p0 = (i0 & 0xffffffffull) | (i2 << 32);
00481     p1 = i3 + (i2 >> 32);
00482 
00483     *r2 += (p1 >> 63);
00484     p1 = (p1 << 1) | (p0 >> 63);
00485     p0 <<= 1;
00486 
00487     *r0 += p0;
00488     *r1 += (p1 + (*r0 < p0));
00489     *r2 += ((*r1 < p1) || (*r1 == p1 && *r0 < p0));
00490 #else
00491     uECC_dword_t p = (uECC_dword_t)a * b;
00492     uECC_dword_t r01 = ((uECC_dword_t)(*r1) << uECC_WORD_BITS) | *r0;
00493     *r2 += (p >> (uECC_WORD_BITS * 2 - 1));
00494     p *= 2;
00495     r01 += p;
00496     *r2 += (r01 < p);
00497     *r1 = r01 >> uECC_WORD_BITS;
00498     *r0 = (uECC_word_t)r01;
00499 #endif
00500 }
00501 
00502 uECC_VLI_API void uECC_vli_square(uECC_word_t *result,
00503                                   const uECC_word_t *left,
00504                                   wordcount_t num_words) {
00505     uECC_word_t r0 = 0;
00506     uECC_word_t r1 = 0;
00507     uECC_word_t r2 = 0;
00508 
00509     wordcount_t i, k;
00510 
00511     for (k = 0; k < num_words * 2 - 1; ++k) {
00512         uECC_word_t min = (k < num_words ? 0 : (k + 1) - num_words);
00513         for (i = min; i <= k && i <= k - i; ++i) {
00514             if (i < k-i) {
00515                 mul2add(left[i], left[k - i], &r0, &r1, &r2);
00516             } else {
00517                 muladd(left[i], left[k - i], &r0, &r1, &r2);
00518             }
00519         }
00520         result[k] = r0;
00521         r0 = r1;
00522         r1 = r2;
00523         r2 = 0;
00524     }
00525 
00526     result[num_words * 2 - 1] = r0;
00527 }
00528 #endif /* !asm_square */
00529 
00530 #else /* uECC_SQUARE_FUNC */
00531 
00532 #if uECC_ENABLE_VLI_API
00533 uECC_VLI_API void uECC_vli_square(uECC_word_t *result,
00534                                   const uECC_word_t *left,
00535                                   wordcount_t num_words) {
00536     uECC_vli_mult(result, left, left, num_words);
00537 }
00538 #endif /* uECC_ENABLE_VLI_API */
00539 
00540 #endif /* uECC_SQUARE_FUNC */
00541 
00542 /* Computes result = (left + right) % mod.
00543    Assumes that left < mod and right < mod, and that result does not overlap mod. */
00544 uECC_VLI_API void uECC_vli_modAdd(uECC_word_t *result,
00545                                   const uECC_word_t *left,
00546                                   const uECC_word_t *right,
00547                                   const uECC_word_t *mod,
00548                                   wordcount_t num_words) {
00549     uECC_word_t carry = uECC_vli_add(result, left, right, num_words);
00550     if (carry || uECC_vli_cmp_unsafe(mod, result, num_words) != 1) {
00551         /* result > mod (result = mod + remainder), so subtract mod to get remainder. */
00552         uECC_vli_sub(result, result, mod, num_words);
00553     }
00554 }
00555 
00556 /* Computes result = (left - right) % mod.
00557    Assumes that left < mod and right < mod, and that result does not overlap mod. */
00558 uECC_VLI_API void uECC_vli_modSub(uECC_word_t *result,
00559                                   const uECC_word_t *left,
00560                                   const uECC_word_t *right,
00561                                   const uECC_word_t *mod,
00562                                   wordcount_t num_words) {
00563     uECC_word_t l_borrow = uECC_vli_sub(result, left, right, num_words);
00564     if (l_borrow) {
00565         /* In this case, result == -diff == (max int) - diff. Since -x % d == d - x,
00566            we can get the correct result from result + mod (with overflow). */
00567         uECC_vli_add(result, result, mod, num_words);
00568     }
00569 }
00570 
00571 /* Computes result = product % mod, where product is 2N words long. */
00572 /* Currently only designed to work for curve_p or curve_n. */
00573 uECC_VLI_API void uECC_vli_mmod(uECC_word_t *result,
00574                                 uECC_word_t *product,
00575                                 const uECC_word_t *mod,
00576                                 wordcount_t num_words) {
00577     uECC_word_t mod_multiple[2 * uECC_MAX_WORDS];
00578     uECC_word_t tmp[2 * uECC_MAX_WORDS];
00579     uECC_word_t *v[2] = {tmp, product};
00580     uECC_word_t index;
00581 
00582     /* Shift mod so its highest set bit is at the maximum position. */
00583     bitcount_t shift = (num_words * 2 * uECC_WORD_BITS) - uECC_vli_numBits(mod, num_words);
00584     wordcount_t word_shift = shift / uECC_WORD_BITS;
00585     wordcount_t bit_shift = shift % uECC_WORD_BITS;
00586     uECC_word_t carry = 0;
00587     uECC_vli_clear(mod_multiple, word_shift);
00588     if (bit_shift > 0) {
00589         for(index = 0; index < (uECC_word_t)num_words; ++index) {
00590             mod_multiple[word_shift + index] = (mod[index] << bit_shift) | carry;
00591             carry = mod[index] >> (uECC_WORD_BITS - bit_shift);
00592         }
00593     } else {
00594         uECC_vli_set(mod_multiple + word_shift, mod, num_words);
00595     }
00596 
00597     for (index = 1; shift >= 0; --shift) {
00598         uECC_word_t borrow = 0;
00599         wordcount_t i;
00600         for (i = 0; i < num_words * 2; ++i) {
00601             uECC_word_t diff = v[index][i] - mod_multiple[i] - borrow;
00602             if (diff != v[index][i]) {
00603                 borrow = (diff > v[index][i]);
00604             }
00605             v[1 - index][i] = diff;
00606         }
00607         index = !(index ^ borrow); /* Swap the index if there was no borrow */
00608         uECC_vli_rshift1(mod_multiple, num_words);
00609         mod_multiple[num_words - 1] |= mod_multiple[num_words] << (uECC_WORD_BITS - 1);
00610         uECC_vli_rshift1(mod_multiple + num_words, num_words);
00611     }
00612     uECC_vli_set(result, v[index], num_words);
00613 }
00614 
00615 /* Computes result = (left * right) % mod. */
00616 uECC_VLI_API void uECC_vli_modMult(uECC_word_t *result,
00617                                    const uECC_word_t *left,
00618                                    const uECC_word_t *right,
00619                                    const uECC_word_t *mod,
00620                                    wordcount_t num_words) {
00621     uECC_word_t product[2 * uECC_MAX_WORDS];
00622     uECC_vli_mult(product, left, right, num_words);
00623     uECC_vli_mmod(result, product, mod, num_words);
00624 }
00625 
00626 uECC_VLI_API void uECC_vli_modMult_fast(uECC_word_t *result,
00627                                         const uECC_word_t *left,
00628                                         const uECC_word_t *right,
00629                                         uECC_Curve curve) {
00630     uECC_word_t product[2 * uECC_MAX_WORDS];
00631     uECC_vli_mult(product, left, right, curve->num_words);
00632 #if (uECC_OPTIMIZATION_LEVEL > 0)
00633     curve->mmod_fast(result, product);
00634 #else
00635     uECC_vli_mmod(result, product, curve->p, curve->num_words);
00636 #endif
00637 }
00638 
00639 #if uECC_SQUARE_FUNC
00640 
00641 #if uECC_ENABLE_VLI_API
00642 /* Computes result = left^2 % mod. */
00643 uECC_VLI_API void uECC_vli_modSquare(uECC_word_t *result,
00644                                      const uECC_word_t *left,
00645                                      const uECC_word_t *mod,
00646                                      wordcount_t num_words) {
00647     uECC_word_t product[2 * uECC_MAX_WORDS];
00648     uECC_vli_square(product, left, num_words);
00649     uECC_vli_mmod(result, product, mod, num_words);
00650 }
00651 #endif /* uECC_ENABLE_VLI_API */
00652 
00653 uECC_VLI_API void uECC_vli_modSquare_fast(uECC_word_t *result,
00654                                           const uECC_word_t *left,
00655                                           uECC_Curve curve) {
00656     uECC_word_t product[2 * uECC_MAX_WORDS];
00657     uECC_vli_square(product, left, curve->num_words);
00658 #if (uECC_OPTIMIZATION_LEVEL > 0)
00659     curve->mmod_fast(result, product);
00660 #else
00661     uECC_vli_mmod(result, product, curve->p, curve->num_words);
00662 #endif
00663 }
00664 
00665 #else /* uECC_SQUARE_FUNC */
00666 
00667 #if uECC_ENABLE_VLI_API
00668 uECC_VLI_API void uECC_vli_modSquare(uECC_word_t *result,
00669                                      const uECC_word_t *left,
00670                                      const uECC_word_t *mod,
00671                                      wordcount_t num_words) {
00672     uECC_vli_modMult(result, left, left, mod, num_words);
00673 }
00674 #endif /* uECC_ENABLE_VLI_API */
00675 
00676 uECC_VLI_API void uECC_vli_modSquare_fast(uECC_word_t *result,
00677                                           const uECC_word_t *left,
00678                                           uECC_Curve curve) {
00679     uECC_vli_modMult_fast(result, left, left, curve);
00680 }
00681 
00682 #endif /* uECC_SQUARE_FUNC */
00683 
00684 #define EVEN(vli) (!(vli[0] & 1))
00685 static void vli_modInv_update(uECC_word_t *uv,
00686                               const uECC_word_t *mod,
00687                               wordcount_t num_words) {
00688     uECC_word_t carry = 0;
00689     if (!EVEN(uv)) {
00690         carry = uECC_vli_add(uv, uv, mod, num_words);
00691     }
00692     uECC_vli_rshift1(uv, num_words);
00693     if (carry) {
00694         uv[num_words - 1] |= HIGH_BIT_SET;
00695     }
00696 }
00697 
00698 /* Computes result = (1 / input) % mod. All VLIs are the same size.
00699    See "From Euclid's GCD to Montgomery Multiplication to the Great Divide" */
00700 uECC_VLI_API void uECC_vli_modInv(uECC_word_t *result,
00701                                   const uECC_word_t *input,
00702                                   const uECC_word_t *mod,
00703                                   wordcount_t num_words) {
00704     uECC_word_t a[uECC_MAX_WORDS], b[uECC_MAX_WORDS], u[uECC_MAX_WORDS], v[uECC_MAX_WORDS];
00705     cmpresult_t cmpResult;
00706 
00707     if (uECC_vli_isZero(input, num_words)) {
00708         uECC_vli_clear(result, num_words);
00709         return;
00710     }
00711 
00712     uECC_vli_set(a, input, num_words);
00713     uECC_vli_set(b, mod, num_words);
00714     uECC_vli_clear(u, num_words);
00715     u[0] = 1;
00716     uECC_vli_clear(v, num_words);
00717     while ((cmpResult = uECC_vli_cmp_unsafe(a, b, num_words)) != 0) {
00718         if (EVEN(a)) {
00719             uECC_vli_rshift1(a, num_words);
00720             vli_modInv_update(u, mod, num_words);
00721         } else if (EVEN(b)) {
00722             uECC_vli_rshift1(b, num_words);
00723             vli_modInv_update(v, mod, num_words);
00724         } else if (cmpResult > 0) {
00725             uECC_vli_sub(a, a, b, num_words);
00726             uECC_vli_rshift1(a, num_words);
00727             if (uECC_vli_cmp_unsafe(u, v, num_words) < 0) {
00728                 uECC_vli_add(u, u, mod, num_words);
00729             }
00730             uECC_vli_sub(u, u, v, num_words);
00731             vli_modInv_update(u, mod, num_words);
00732         } else {
00733             uECC_vli_sub(b, b, a, num_words);
00734             uECC_vli_rshift1(b, num_words);
00735             if (uECC_vli_cmp_unsafe(v, u, num_words) < 0) {
00736                 uECC_vli_add(v, v, mod, num_words);
00737             }
00738             uECC_vli_sub(v, v, u, num_words);
00739             vli_modInv_update(v, mod, num_words);
00740         }
00741     }
00742     uECC_vli_set(result, u, num_words);
00743 }
00744 
00745 /* ------ Point operations ------ */
00746 
00747 //#include "curve-specific.inc"
00748 #include "curve-specific.h"
00749 
00750 /* Returns 1 if 'point' is the point at infinity, 0 otherwise. */
00751 #define EccPoint_isZero(point, curve) uECC_vli_isZero((point), (curve)->num_words * 2)
00752 
00753 /* Point multiplication algorithm using Montgomery's ladder with co-Z coordinates.
00754 From http://eprint.iacr.org/2011/338.pdf
00755 */
00756 
00757 /* Modify (x1, y1) => (x1 * z^2, y1 * z^3) */
00758 static void apply_z(uECC_word_t * X1,
00759                     uECC_word_t * Y1,
00760                     const uECC_word_t * const Z,
00761                     uECC_Curve curve) {
00762     uECC_word_t t1[uECC_MAX_WORDS];
00763 
00764     uECC_vli_modSquare_fast(t1, Z, curve);    /* z^2 */
00765     uECC_vli_modMult_fast(X1, X1, t1, curve); /* x1 * z^2 */
00766     uECC_vli_modMult_fast(t1, t1, Z, curve);  /* z^3 */
00767     uECC_vli_modMult_fast(Y1, Y1, t1, curve); /* y1 * z^3 */
00768 }
00769 
00770 /* P = (x1, y1) => 2P, (x2, y2) => P' */
00771 static void XYcZ_initial_double(uECC_word_t * X1,
00772                                 uECC_word_t * Y1,
00773                                 uECC_word_t * X2,
00774                                 uECC_word_t * Y2,
00775                                 const uECC_word_t * const initial_Z,
00776                                 uECC_Curve curve) {
00777     uECC_word_t z[uECC_MAX_WORDS];
00778     wordcount_t num_words = curve->num_words;
00779     if (initial_Z) {
00780         uECC_vli_set(z, initial_Z, num_words);
00781     } else {
00782         uECC_vli_clear(z, num_words);
00783         z[0] = 1;
00784     }
00785 
00786     uECC_vli_set(X2, X1, num_words);
00787     uECC_vli_set(Y2, Y1, num_words);
00788 
00789     apply_z(X1, Y1, z, curve);
00790     curve->double_jacobian(X1, Y1, z, curve);
00791     apply_z(X2, Y2, z, curve);
00792 }
00793 
00794 /* Input P = (x1, y1, Z), Q = (x2, y2, Z)
00795    Output P' = (x1', y1', Z3), P + Q = (x3, y3, Z3)
00796    or P => P', Q => P + Q
00797 */
00798 static void XYcZ_add(uECC_word_t * X1,
00799                      uECC_word_t * Y1,
00800                      uECC_word_t * X2,
00801                      uECC_word_t * Y2,
00802                      uECC_Curve curve) {
00803     /* t1 = X1, t2 = Y1, t3 = X2, t4 = Y2 */
00804     uECC_word_t t5[uECC_MAX_WORDS];
00805     wordcount_t num_words = curve->num_words;
00806 
00807     uECC_vli_modSub(t5, X2, X1, curve->p, num_words); /* t5 = x2 - x1 */
00808     uECC_vli_modSquare_fast(t5, t5, curve);                  /* t5 = (x2 - x1)^2 = A */
00809     uECC_vli_modMult_fast(X1, X1, t5, curve);                /* t1 = x1*A = B */
00810     uECC_vli_modMult_fast(X2, X2, t5, curve);                /* t3 = x2*A = C */
00811     uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y2 - y1 */
00812     uECC_vli_modSquare_fast(t5, Y2, curve);                  /* t5 = (y2 - y1)^2 = D */
00813 
00814     uECC_vli_modSub(t5, t5, X1, curve->p, num_words); /* t5 = D - B */
00815     uECC_vli_modSub(t5, t5, X2, curve->p, num_words); /* t5 = D - B - C = x3 */
00816     uECC_vli_modSub(X2, X2, X1, curve->p, num_words); /* t3 = C - B */
00817     uECC_vli_modMult_fast(Y1, Y1, X2, curve);                /* t2 = y1*(C - B) */
00818     uECC_vli_modSub(X2, X1, t5, curve->p, num_words); /* t3 = B - x3 */
00819     uECC_vli_modMult_fast(Y2, Y2, X2, curve);                /* t4 = (y2 - y1)*(B - x3) */
00820     uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y3 */
00821 
00822     uECC_vli_set(X2, t5, num_words);
00823 }
00824 
00825 /* Input P = (x1, y1, Z), Q = (x2, y2, Z)
00826    Output P + Q = (x3, y3, Z3), P - Q = (x3', y3', Z3)
00827    or P => P - Q, Q => P + Q
00828 */
00829 static void XYcZ_addC(uECC_word_t * X1,
00830                       uECC_word_t * Y1,
00831                       uECC_word_t * X2,
00832                       uECC_word_t * Y2,
00833                       uECC_Curve curve) {
00834     /* t1 = X1, t2 = Y1, t3 = X2, t4 = Y2 */
00835     uECC_word_t t5[uECC_MAX_WORDS];
00836     uECC_word_t t6[uECC_MAX_WORDS];
00837     uECC_word_t t7[uECC_MAX_WORDS];
00838     wordcount_t num_words = curve->num_words;
00839 
00840     uECC_vli_modSub(t5, X2, X1, curve->p, num_words); /* t5 = x2 - x1 */
00841     uECC_vli_modSquare_fast(t5, t5, curve);                  /* t5 = (x2 - x1)^2 = A */
00842     uECC_vli_modMult_fast(X1, X1, t5, curve);                /* t1 = x1*A = B */
00843     uECC_vli_modMult_fast(X2, X2, t5, curve);                /* t3 = x2*A = C */
00844     uECC_vli_modAdd(t5, Y2, Y1, curve->p, num_words); /* t5 = y2 + y1 */
00845     uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = y2 - y1 */
00846 
00847     uECC_vli_modSub(t6, X2, X1, curve->p, num_words); /* t6 = C - B */
00848     uECC_vli_modMult_fast(Y1, Y1, t6, curve);                /* t2 = y1 * (C - B) = E */
00849     uECC_vli_modAdd(t6, X1, X2, curve->p, num_words); /* t6 = B + C */
00850     uECC_vli_modSquare_fast(X2, Y2, curve);                  /* t3 = (y2 - y1)^2 = D */
00851     uECC_vli_modSub(X2, X2, t6, curve->p, num_words); /* t3 = D - (B + C) = x3 */
00852 
00853     uECC_vli_modSub(t7, X1, X2, curve->p, num_words); /* t7 = B - x3 */
00854     uECC_vli_modMult_fast(Y2, Y2, t7, curve);                /* t4 = (y2 - y1)*(B - x3) */
00855     uECC_vli_modSub(Y2, Y2, Y1, curve->p, num_words); /* t4 = (y2 - y1)*(B - x3) - E = y3 */
00856 
00857     uECC_vli_modSquare_fast(t7, t5, curve);                  /* t7 = (y2 + y1)^2 = F */
00858     uECC_vli_modSub(t7, t7, t6, curve->p, num_words); /* t7 = F - (B + C) = x3' */
00859     uECC_vli_modSub(t6, t7, X1, curve->p, num_words); /* t6 = x3' - B */
00860     uECC_vli_modMult_fast(t6, t6, t5, curve);                /* t6 = (y2+y1)*(x3' - B) */
00861     uECC_vli_modSub(Y1, t6, Y1, curve->p, num_words); /* t2 = (y2+y1)*(x3' - B) - E = y3' */
00862 
00863     uECC_vli_set(X1, t7, num_words);
00864 }
00865 
00866 /* result may overlap point. */
00867 static void EccPoint_mult(uECC_word_t * result,
00868                           const uECC_word_t * point,
00869                           const uECC_word_t * scalar,
00870                           const uECC_word_t * initial_Z,
00871                           bitcount_t num_bits,
00872                           uECC_Curve curve) {
00873     /* R0 and R1 */
00874     uECC_word_t Rx[2][uECC_MAX_WORDS];
00875     uECC_word_t Ry[2][uECC_MAX_WORDS];
00876     uECC_word_t z[uECC_MAX_WORDS];
00877     bitcount_t i;
00878     uECC_word_t nb;
00879     wordcount_t num_words = curve->num_words;
00880 
00881     uECC_vli_set(Rx[1], point, num_words);
00882     uECC_vli_set(Ry[1], point + num_words, num_words);
00883 
00884     XYcZ_initial_double(Rx[1], Ry[1], Rx[0], Ry[0], initial_Z, curve);
00885 
00886     for (i = num_bits - 2; i > 0; --i) {
00887         nb = !uECC_vli_testBit(scalar, i);
00888         XYcZ_addC(Rx[1 - nb], Ry[1 - nb], Rx[nb], Ry[nb], curve);
00889         XYcZ_add(Rx[nb], Ry[nb], Rx[1 - nb], Ry[1 - nb], curve);
00890     }
00891 
00892     nb = !uECC_vli_testBit(scalar, 0);
00893     XYcZ_addC(Rx[1 - nb], Ry[1 - nb], Rx[nb], Ry[nb], curve);
00894 
00895     /* Find final 1/Z value. */
00896     uECC_vli_modSub(z, Rx[1], Rx[0], curve->p, num_words); /* X1 - X0 */
00897     uECC_vli_modMult_fast(z, z, Ry[1 - nb], curve);               /* Yb * (X1 - X0) */
00898     uECC_vli_modMult_fast(z, z, point, curve);                    /* xP * Yb * (X1 - X0) */
00899     uECC_vli_modInv(z, z, curve->p, num_words);            /* 1 / (xP * Yb * (X1 - X0)) */
00900     /* yP / (xP * Yb * (X1 - X0)) */
00901     uECC_vli_modMult_fast(z, z, point + num_words, curve);
00902     uECC_vli_modMult_fast(z, z, Rx[1 - nb], curve); /* Xb * yP / (xP * Yb * (X1 - X0)) */
00903     /* End 1/Z calculation */
00904 
00905     XYcZ_add(Rx[nb], Ry[nb], Rx[1 - nb], Ry[1 - nb], curve);
00906     apply_z(Rx[0], Ry[0], z, curve);
00907 
00908     uECC_vli_set(result, Rx[0], num_words);
00909     uECC_vli_set(result + num_words, Ry[0], num_words);
00910 }
00911 
00912 static uECC_word_t regularize_k(const uECC_word_t * const k,
00913                                 uECC_word_t *k0,
00914                                 uECC_word_t *k1,
00915                                 uECC_Curve curve) {
00916     wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
00917     bitcount_t num_n_bits = curve->num_n_bits;
00918     uECC_word_t carry = uECC_vli_add(k0, k, curve->n, num_n_words) ||
00919         (num_n_bits < ((bitcount_t)num_n_words * uECC_WORD_SIZE * 8) &&
00920          uECC_vli_testBit(k0, num_n_bits));
00921     uECC_vli_add(k1, k0, curve->n, num_n_words);
00922     return carry;
00923 }
00924 
00925 static uECC_word_t EccPoint_compute_public_key(uECC_word_t *result,
00926                                                uECC_word_t *private_key,
00927                                                uECC_Curve curve) {
00928     uECC_word_t tmp1[uECC_MAX_WORDS];
00929     uECC_word_t tmp2[uECC_MAX_WORDS];
00930     uECC_word_t *p2[2] = {tmp1, tmp2};
00931     uECC_word_t carry;
00932 
00933     /* Regularize the bitcount for the private key so that attackers cannot use a side channel
00934        attack to learn the number of leading zeros. */
00935     carry = regularize_k(private_key, tmp1, tmp2, curve);
00936 
00937     EccPoint_mult(result, curve->G, p2[!carry], 0, curve->num_n_bits + 1, curve);
00938 
00939     if (EccPoint_isZero(result, curve)) {
00940         return 0;
00941     }
00942     return 1;
00943 }
00944 
00945 #if uECC_WORD_SIZE == 1
00946 
00947 uECC_VLI_API void uECC_vli_nativeToBytes(uint8_t *bytes,
00948                                          int num_bytes,
00949                                          const uint8_t *native) {
00950     wordcount_t i;
00951     for (i = 0; i < num_bytes; ++i) {
00952         bytes[i] = native[(num_bytes - 1) - i];
00953     }
00954 }
00955 
00956 uECC_VLI_API void uECC_vli_bytesToNative(uint8_t *native,
00957                                          const uint8_t *bytes,
00958                                          int num_bytes) {
00959     uECC_vli_nativeToBytes(native, num_bytes, bytes);
00960 }
00961 
00962 #else
00963 
00964 uECC_VLI_API void uECC_vli_nativeToBytes(uint8_t *bytes,
00965                                          int num_bytes,
00966                                          const uECC_word_t *native) {
00967     wordcount_t i;
00968     for (i = 0; i < num_bytes; ++i) {
00969         unsigned b = num_bytes - 1 - i;
00970         bytes[i] = native[b / uECC_WORD_SIZE] >> (8 * (b % uECC_WORD_SIZE));
00971     }
00972 }
00973 
00974 uECC_VLI_API void uECC_vli_bytesToNative(uECC_word_t *native,
00975                                          const uint8_t *bytes,
00976                                          int num_bytes) {
00977     wordcount_t i;
00978     uECC_vli_clear(native, (num_bytes + (uECC_WORD_SIZE - 1)) / uECC_WORD_SIZE);
00979     for (i = 0; i < num_bytes; ++i) {
00980         unsigned b = num_bytes - 1 - i;
00981         native[b / uECC_WORD_SIZE] |=
00982             (uECC_word_t)bytes[i] << (8 * (b % uECC_WORD_SIZE));
00983     }
00984 }
00985 
00986 #endif /* uECC_WORD_SIZE */
00987 
00988 /* Generates a random integer in the range 0 < random < top.
00989    Both random and top have num_words words. */
00990 uECC_VLI_API int uECC_generate_random_int(uECC_word_t *random,
00991                                           const uECC_word_t *top,
00992                                           wordcount_t num_words) {
00993     uECC_word_t mask = (uECC_word_t)-1;
00994     uECC_word_t tries;
00995     bitcount_t num_bits = uECC_vli_numBits(top, num_words);
00996 
00997     if (!g_rng_function) {
00998         return 0;
00999     }
01000 
01001     for (tries = 0; tries < uECC_RNG_MAX_TRIES; ++tries) {
01002         if (!g_rng_function((uint8_t *)random, num_words * uECC_WORD_SIZE)) {
01003             return 0;
01004         }
01005         random[num_words - 1] &= mask >> ((bitcount_t)(num_words * uECC_WORD_SIZE * 8 - num_bits));
01006         if (!uECC_vli_isZero(random, num_words) &&
01007                 uECC_vli_cmp(top, random, num_words) == 1) {
01008             return 1;
01009         }
01010     }
01011     return 0;
01012 }
01013 
01014 int uECC_make_key(uint8_t *public_key,
01015                   uint8_t *private_key,
01016                   uECC_Curve curve) {
01017 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01018     uECC_word_t *_private = (uECC_word_t *)private_key;
01019     uECC_word_t *_public = (uECC_word_t *)public_key;
01020 #else
01021     uECC_word_t _private[uECC_MAX_WORDS];
01022     uECC_word_t _public[uECC_MAX_WORDS * 2];
01023 #endif
01024     uECC_word_t tries;
01025 
01026     for (tries = 0; tries < uECC_RNG_MAX_TRIES; ++tries) {
01027         if (!uECC_generate_random_int(_private, curve->n, BITS_TO_WORDS(curve->num_n_bits))) {
01028             return 0;
01029         }
01030 
01031         if (EccPoint_compute_public_key(_public, _private, curve)) {
01032 #if uECC_VLI_NATIVE_LITTLE_ENDIAN == 0
01033             uECC_vli_nativeToBytes(private_key, BITS_TO_BYTES(curve->num_n_bits), _private);
01034             uECC_vli_nativeToBytes(public_key, curve->num_bytes, _public);
01035             uECC_vli_nativeToBytes(
01036                 public_key + curve->num_bytes, curve->num_bytes, _public + curve->num_words);
01037 #endif
01038             return 1;
01039         }
01040     }
01041     return 0;
01042 }
01043 
01044 int uECC_shared_secret(const uint8_t *public_key,
01045                        const uint8_t *private_key,
01046                        uint8_t *secret,
01047                        uECC_Curve curve) {
01048     uECC_word_t _public[uECC_MAX_WORDS * 2];
01049     uECC_word_t _private[uECC_MAX_WORDS];
01050 
01051     uECC_word_t tmp[uECC_MAX_WORDS];
01052     uECC_word_t *p2[2] = {_private, tmp};
01053     uECC_word_t *initial_Z = 0;
01054     uECC_word_t carry;
01055     wordcount_t num_words = curve->num_words;
01056     wordcount_t num_bytes = curve->num_bytes;
01057 
01058 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01059     bcopy((uint8_t *) _private, private_key, num_bytes);
01060     bcopy((uint8_t *) _public, public_key, num_bytes*2);
01061 #else
01062     uECC_vli_bytesToNative(_private, private_key, BITS_TO_BYTES(curve->num_n_bits));
01063     uECC_vli_bytesToNative(_public, public_key, num_bytes);
01064     uECC_vli_bytesToNative(_public + num_words, public_key + num_bytes, num_bytes);
01065 #endif
01066 
01067     /* Regularize the bitcount for the private key so that attackers cannot use a side channel
01068        attack to learn the number of leading zeros. */
01069     carry = regularize_k(_private, _private, tmp, curve);
01070 
01071     /* If an RNG function was specified, try to get a random initial Z value to improve
01072        protection against side-channel attacks. */
01073     if (g_rng_function) {
01074         if (!uECC_generate_random_int(p2[carry], curve->p, num_words)) {
01075             return 0;
01076         }
01077         initial_Z = p2[carry];
01078     }
01079 
01080     EccPoint_mult(_public, _public, p2[!carry], initial_Z, curve->num_n_bits + 1, curve);
01081 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01082     bcopy((uint8_t *) secret, (uint8_t *) _public, num_bytes);
01083 #else
01084     uECC_vli_nativeToBytes(secret, num_bytes, _public);
01085 #endif
01086     return !EccPoint_isZero(_public, curve);
01087 }
01088 
01089 #if uECC_SUPPORT_COMPRESSED_POINT
01090 void uECC_compress(const uint8_t *public_key, uint8_t *compressed, uECC_Curve curve) {
01091     wordcount_t i;
01092     for (i = 0; i < curve->num_bytes; ++i) {
01093         compressed[i+1] = public_key[i];
01094     }
01095 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01096     compressed[0] = 2 + (public_key[curve->num_bytes] & 0x01);
01097 #else
01098     compressed[0] = 2 + (public_key[curve->num_bytes * 2 - 1] & 0x01);
01099 #endif
01100 }
01101 
01102 void uECC_decompress(const uint8_t *compressed, uint8_t *public_key, uECC_Curve curve) {
01103 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01104     uECC_word_t *point = (uECC_word_t *)public_key;
01105 #else
01106     uECC_word_t point[uECC_MAX_WORDS * 2];
01107 #endif
01108     uECC_word_t *y = point + curve->num_words;
01109 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01110     bcopy(public_key, compressed+1, curve->num_bytes);
01111 #else
01112     uECC_vli_bytesToNative(point, compressed + 1, curve->num_bytes);
01113 #endif
01114     curve->x_side(y, point, curve);
01115     curve->mod_sqrt(y, curve);
01116 
01117     if ((y[0] & 0x01) != (compressed[0] & 0x01)) {
01118         uECC_vli_sub(y, curve->p, y, curve->num_words);
01119     }
01120 
01121 #if uECC_VLI_NATIVE_LITTLE_ENDIAN == 0
01122     uECC_vli_nativeToBytes(public_key, curve->num_bytes, point);
01123     uECC_vli_nativeToBytes(public_key + curve->num_bytes, curve->num_bytes, y);
01124 #endif
01125 }
01126 #endif /* uECC_SUPPORT_COMPRESSED_POINT */
01127 
01128 int uECC_valid_point(const uECC_word_t *point, uECC_Curve curve) {
01129     uECC_word_t tmp1[uECC_MAX_WORDS];
01130     uECC_word_t tmp2[uECC_MAX_WORDS];
01131     wordcount_t num_words = curve->num_words;
01132 
01133     /* The point at infinity is invalid. */
01134     if (EccPoint_isZero(point, curve)) {
01135         return 0;
01136     }
01137 
01138     /* x and y must be smaller than p. */
01139     if (uECC_vli_cmp_unsafe(curve->p, point, num_words) != 1 ||
01140             uECC_vli_cmp_unsafe(curve->p, point + num_words, num_words) != 1) {
01141         return 0;
01142     }
01143 
01144     uECC_vli_modSquare_fast(tmp1, point + num_words, curve);
01145     curve->x_side(tmp2, point, curve); /* tmp2 = x^3 + ax + b */
01146 
01147     /* Make sure that y^2 == x^3 + ax + b */
01148     return (int)(uECC_vli_equal(tmp1, tmp2, num_words));
01149 }
01150 
01151 int uECC_valid_public_key(const uint8_t *public_key, uECC_Curve curve) {
01152 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01153     uECC_word_t *_public = (uECC_word_t *)public_key;
01154 #else
01155     uECC_word_t _public[uECC_MAX_WORDS * 2];
01156 #endif
01157 
01158 #if uECC_VLI_NATIVE_LITTLE_ENDIAN == 0
01159     uECC_vli_bytesToNative(_public, public_key, curve->num_bytes);
01160     uECC_vli_bytesToNative(
01161         _public + curve->num_words, public_key + curve->num_bytes, curve->num_bytes);
01162 #endif
01163     return uECC_valid_point(_public, curve);
01164 }
01165 
01166 int uECC_compute_public_key(const uint8_t *private_key, uint8_t *public_key, uECC_Curve curve) {
01167 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01168     uECC_word_t *_private = (uECC_word_t *)private_key;
01169     uECC_word_t *_public = (uECC_word_t *)public_key;
01170 #else
01171     uECC_word_t _private[uECC_MAX_WORDS];
01172     uECC_word_t _public[uECC_MAX_WORDS * 2];
01173 #endif
01174 
01175 #if uECC_VLI_NATIVE_LITTLE_ENDIAN == 0
01176     uECC_vli_bytesToNative(_private, private_key, BITS_TO_BYTES(curve->num_n_bits));
01177 #endif
01178 
01179     /* Make sure the private key is in the range [1, n-1]. */
01180     if (uECC_vli_isZero(_private, BITS_TO_WORDS(curve->num_n_bits))) {
01181         return 0;
01182     }
01183 
01184     if (uECC_vli_cmp(curve->n, _private, BITS_TO_WORDS(curve->num_n_bits)) != 1) {
01185         return 0;
01186     }
01187 
01188     /* Compute public key. */
01189     if (!EccPoint_compute_public_key(_public, _private, curve)) {
01190         return 0;
01191     }
01192 
01193 #if uECC_VLI_NATIVE_LITTLE_ENDIAN == 0
01194     uECC_vli_nativeToBytes(public_key, curve->num_bytes, _public);
01195     uECC_vli_nativeToBytes(
01196         public_key + curve->num_bytes, curve->num_bytes, _public + curve->num_words);
01197 #endif
01198     return 1;
01199 }
01200 
01201 
01202 /* -------- ECDSA code -------- */
01203 
01204 static void bits2int(uECC_word_t *native,
01205                      const uint8_t *bits,
01206                      unsigned bits_size,
01207                      uECC_Curve curve) {
01208     unsigned num_n_bytes = BITS_TO_BYTES(curve->num_n_bits);
01209     unsigned num_n_words = BITS_TO_WORDS(curve->num_n_bits);
01210     int shift;
01211     uECC_word_t carry;
01212     uECC_word_t *ptr;
01213 
01214     if (bits_size > num_n_bytes) {
01215         bits_size = num_n_bytes;
01216     }
01217 
01218     uECC_vli_clear(native, num_n_words);
01219 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01220     bcopy((uint8_t *) native, bits, bits_size);
01221 #else
01222     uECC_vli_bytesToNative(native, bits, bits_size);
01223 #endif    
01224     if (bits_size * 8 <= (unsigned)curve->num_n_bits) {
01225         return;
01226     }
01227     shift = bits_size * 8 - curve->num_n_bits;
01228     carry = 0;
01229     ptr = native + num_n_words;
01230     while (ptr-- > native) {
01231         uECC_word_t temp = *ptr;
01232         *ptr = (temp >> shift) | carry;
01233         carry = temp << (uECC_WORD_BITS - shift);
01234     }
01235 
01236     /* Reduce mod curve_n */
01237     if (uECC_vli_cmp_unsafe(curve->n, native, num_n_words) != 1) {
01238         uECC_vli_sub(native, native, curve->n, num_n_words);
01239     }
01240 }
01241 
01242 static int uECC_sign_with_k(const uint8_t *private_key,
01243                             const uint8_t *message_hash,
01244                             unsigned hash_size,
01245                             uECC_word_t *k,
01246                             uint8_t *signature,
01247                             uECC_Curve curve) {
01248 
01249     uECC_word_t tmp[uECC_MAX_WORDS];
01250     uECC_word_t s[uECC_MAX_WORDS];
01251     uECC_word_t *k2[2] = {tmp, s};
01252 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01253     uECC_word_t *p = (uECC_word_t *)signature;
01254 #else
01255     uECC_word_t p[uECC_MAX_WORDS * 2];
01256 #endif
01257     uECC_word_t carry;
01258     wordcount_t num_words = curve->num_words;
01259     wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
01260     bitcount_t num_n_bits = curve->num_n_bits;
01261 
01262     /* Make sure 0 < k < curve_n */
01263     if (uECC_vli_isZero(k, num_words) || uECC_vli_cmp(curve->n, k, num_n_words) != 1) {
01264         return 0;
01265     }
01266 
01267     carry = regularize_k(k, tmp, s, curve);
01268     EccPoint_mult(p, curve->G, k2[!carry], 0, num_n_bits + 1, curve);
01269     if (uECC_vli_isZero(p, num_words)) {
01270         return 0;
01271     }
01272 
01273     /* If an RNG function was specified, get a random number
01274        to prevent side channel analysis of k. */
01275     if (!g_rng_function) {
01276         uECC_vli_clear(tmp, num_n_words);
01277         tmp[0] = 1;
01278     } else if (!uECC_generate_random_int(tmp, curve->n, num_n_words)) {
01279         return 0;
01280     }
01281 
01282     /* Prevent side channel analysis of uECC_vli_modInv() to determine
01283        bits of k / the private key by premultiplying by a random number */
01284     uECC_vli_modMult(k, k, tmp, curve->n, num_n_words); /* k' = rand * k */
01285     uECC_vli_modInv(k, k, curve->n, num_n_words);       /* k = 1 / k' */
01286     uECC_vli_modMult(k, k, tmp, curve->n, num_n_words); /* k = 1 / k */
01287 
01288 #if uECC_VLI_NATIVE_LITTLE_ENDIAN == 0
01289     uECC_vli_nativeToBytes(signature, curve->num_bytes, p); /* store r */
01290 #endif
01291 
01292 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01293     bcopy((uint8_t *) tmp, private_key, BITS_TO_BYTES(curve->num_n_bits));
01294 #else
01295     uECC_vli_bytesToNative(tmp, private_key, BITS_TO_BYTES(curve->num_n_bits)); /* tmp = d */
01296 #endif
01297 
01298     s[num_n_words - 1] = 0;
01299     uECC_vli_set(s, p, num_words);
01300     uECC_vli_modMult(s, tmp, s, curve->n, num_n_words); /* s = r*d */
01301 
01302     bits2int(tmp, message_hash, hash_size, curve);
01303     uECC_vli_modAdd(s, tmp, s, curve->n, num_n_words); /* s = e + r*d */
01304     uECC_vli_modMult(s, s, k, curve->n, num_n_words);  /* s = (e + r*d) / k */
01305     if (uECC_vli_numBits(s, num_n_words) > (bitcount_t)curve->num_bytes * 8) {
01306         return 0;
01307     }
01308 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01309     bcopy((uint8_t *) signature + curve->num_bytes, (uint8_t *) s, curve->num_bytes);
01310 #else
01311     uECC_vli_nativeToBytes(signature + curve->num_bytes, curve->num_bytes, s);
01312 #endif    
01313     return 1;
01314 }
01315 
01316 int uECC_sign(const uint8_t *private_key,
01317               const uint8_t *message_hash,
01318               unsigned hash_size,
01319               uint8_t *signature,
01320               uECC_Curve curve) {
01321     uECC_word_t k[uECC_MAX_WORDS];
01322     uECC_word_t tries;
01323 
01324     for (tries = 0; tries < uECC_RNG_MAX_TRIES; ++tries) {
01325         if (!uECC_generate_random_int(k, curve->n, BITS_TO_WORDS(curve->num_n_bits))) {
01326             return 0;
01327         }
01328 
01329         if (uECC_sign_with_k(private_key, message_hash, hash_size, k, signature, curve)) {
01330             return 1;
01331         }
01332     }
01333     return 0;
01334 }
01335 
01336 /* Compute an HMAC using K as a key (as in RFC 6979). Note that K is always
01337    the same size as the hash result size. */
01338 static void HMAC_init(const uECC_HashContext *hash_context, const uint8_t *K) {
01339     uint8_t *pad = hash_context->tmp + 2 * hash_context->result_size;
01340     unsigned i;
01341     for (i = 0; i < hash_context->result_size; ++i)
01342         pad[i] = K[i] ^ 0x36;
01343     for (; i < hash_context->block_size; ++i)
01344         pad[i] = 0x36;
01345 
01346     hash_context->init_hash(hash_context);
01347     hash_context->update_hash(hash_context, pad, hash_context->block_size);
01348 }
01349 
01350 static void HMAC_update(const uECC_HashContext *hash_context,
01351                         const uint8_t *message,
01352                         unsigned message_size) {
01353     hash_context->update_hash(hash_context, message, message_size);
01354 }
01355 
01356 static void HMAC_finish(const uECC_HashContext *hash_context,
01357                         const uint8_t *K,
01358                         uint8_t *result) {
01359     uint8_t *pad = hash_context->tmp + 2 * hash_context->result_size;
01360     unsigned i;
01361     for (i = 0; i < hash_context->result_size; ++i)
01362         pad[i] = K[i] ^ 0x5c;
01363     for (; i < hash_context->block_size; ++i)
01364         pad[i] = 0x5c;
01365 
01366     hash_context->finish_hash(hash_context, result);
01367 
01368     hash_context->init_hash(hash_context);
01369     hash_context->update_hash(hash_context, pad, hash_context->block_size);
01370     hash_context->update_hash(hash_context, result, hash_context->result_size);
01371     hash_context->finish_hash(hash_context, result);
01372 }
01373 
01374 /* V = HMAC_K(V) */
01375 static void update_V(const uECC_HashContext *hash_context, uint8_t *K, uint8_t *V) {
01376     HMAC_init(hash_context, K);
01377     HMAC_update(hash_context, V, hash_context->result_size);
01378     HMAC_finish(hash_context, K, V);
01379 }
01380 
01381 /* Deterministic signing, similar to RFC 6979. Differences are:
01382     * We just use H(m) directly rather than bits2octets(H(m))
01383       (it is not reduced modulo curve_n).
01384     * We generate a value for k (aka T) directly rather than converting endianness.
01385 
01386    Layout of hash_context->tmp: <K> | <V> | (1 byte overlapped 0x00 or 0x01) / <HMAC pad> */
01387 int uECC_sign_deterministic(const uint8_t *private_key,
01388                             const uint8_t *message_hash,
01389                             unsigned hash_size,
01390                             const uECC_HashContext *hash_context,
01391                             uint8_t *signature,
01392                             uECC_Curve curve) {
01393     uint8_t *K = hash_context->tmp;
01394     uint8_t *V = K + hash_context->result_size;
01395     wordcount_t num_bytes = curve->num_bytes;
01396     wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
01397     bitcount_t num_n_bits = curve->num_n_bits;
01398     uECC_word_t tries;
01399     unsigned i;
01400     for (i = 0; i < hash_context->result_size; ++i) {
01401         V[i] = 0x01;
01402         K[i] = 0;
01403     }
01404 
01405     /* K = HMAC_K(V || 0x00 || int2octets(x) || h(m)) */
01406     HMAC_init(hash_context, K);
01407     V[hash_context->result_size] = 0x00;
01408     HMAC_update(hash_context, V, hash_context->result_size + 1);
01409     HMAC_update(hash_context, private_key, num_bytes);
01410     HMAC_update(hash_context, message_hash, hash_size);
01411     HMAC_finish(hash_context, K, K);
01412 
01413     update_V(hash_context, K, V);
01414 
01415     /* K = HMAC_K(V || 0x01 || int2octets(x) || h(m)) */
01416     HMAC_init(hash_context, K);
01417     V[hash_context->result_size] = 0x01;
01418     HMAC_update(hash_context, V, hash_context->result_size + 1);
01419     HMAC_update(hash_context, private_key, num_bytes);
01420     HMAC_update(hash_context, message_hash, hash_size);
01421     HMAC_finish(hash_context, K, K);
01422 
01423     update_V(hash_context, K, V);
01424 
01425     for (tries = 0; tries < uECC_RNG_MAX_TRIES; ++tries) {
01426         uECC_word_t T[uECC_MAX_WORDS];
01427         uint8_t *T_ptr = (uint8_t *)T;
01428         wordcount_t T_bytes = 0;
01429         for (;;) {
01430             update_V(hash_context, K, V);
01431             for (i = 0; i < hash_context->result_size; ++i) {
01432                 T_ptr[T_bytes++] = V[i];
01433                 if (T_bytes >= num_n_words * uECC_WORD_SIZE) {
01434                     goto filled;
01435                 }
01436             }
01437         }
01438     filled:
01439         if ((bitcount_t)num_n_words * uECC_WORD_SIZE * 8 > num_n_bits) {
01440             uECC_word_t mask = (uECC_word_t)-1;
01441             T[num_n_words - 1] &=
01442                 mask >> ((bitcount_t)(num_n_words * uECC_WORD_SIZE * 8 - num_n_bits));
01443         }
01444 
01445         if (uECC_sign_with_k(private_key, message_hash, hash_size, T, signature, curve)) {
01446             return 1;
01447         }
01448 
01449         /* K = HMAC_K(V || 0x00) */
01450         HMAC_init(hash_context, K);
01451         V[hash_context->result_size] = 0x00;
01452         HMAC_update(hash_context, V, hash_context->result_size + 1);
01453         HMAC_finish(hash_context, K, K);
01454 
01455         update_V(hash_context, K, V);
01456     }
01457     return 0;
01458 }
01459 
01460 static bitcount_t smax(bitcount_t a, bitcount_t b) {
01461     return (a > b ? a : b);
01462 }
01463 
01464 int uECC_verify(const uint8_t *public_key,
01465                 const uint8_t *message_hash,
01466                 unsigned hash_size,
01467                 const uint8_t *signature,
01468                 uECC_Curve curve) {
01469     uECC_word_t u1[uECC_MAX_WORDS], u2[uECC_MAX_WORDS];
01470     uECC_word_t z[uECC_MAX_WORDS];
01471     uECC_word_t sum[uECC_MAX_WORDS * 2];
01472     uECC_word_t rx[uECC_MAX_WORDS];
01473     uECC_word_t ry[uECC_MAX_WORDS];
01474     uECC_word_t tx[uECC_MAX_WORDS];
01475     uECC_word_t ty[uECC_MAX_WORDS];
01476     uECC_word_t tz[uECC_MAX_WORDS];
01477     const uECC_word_t *points[4];
01478     const uECC_word_t *point;
01479     bitcount_t num_bits;
01480     bitcount_t i;
01481 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01482     uECC_word_t *_public = (uECC_word_t *)public_key;
01483 #else
01484     uECC_word_t _public[uECC_MAX_WORDS * 2];
01485 #endif    
01486     uECC_word_t r[uECC_MAX_WORDS], s[uECC_MAX_WORDS];
01487     wordcount_t num_words = curve->num_words;
01488     wordcount_t num_n_words = BITS_TO_WORDS(curve->num_n_bits);
01489 
01490     rx[num_n_words - 1] = 0;
01491     r[num_n_words - 1] = 0;
01492     s[num_n_words - 1] = 0;
01493 
01494 #if uECC_VLI_NATIVE_LITTLE_ENDIAN
01495     bcopy((uint8_t *) r, signature, curve->num_bytes);
01496     bcopy((uint8_t *) s, signature + curve->num_bytes, curve->num_bytes);
01497 #else
01498     uECC_vli_bytesToNative(_public, public_key, curve->num_bytes);
01499     uECC_vli_bytesToNative(
01500         _public + num_words, public_key + curve->num_bytes, curve->num_bytes);
01501     uECC_vli_bytesToNative(r, signature, curve->num_bytes);
01502     uECC_vli_bytesToNative(s, signature + curve->num_bytes, curve->num_bytes);
01503 #endif
01504 
01505     /* r, s must not be 0. */
01506     if (uECC_vli_isZero(r, num_words) || uECC_vli_isZero(s, num_words)) {
01507         return 0;
01508     }
01509 
01510     /* r, s must be < n. */
01511     if (uECC_vli_cmp_unsafe(curve->n, r, num_n_words) != 1 ||
01512             uECC_vli_cmp_unsafe(curve->n, s, num_n_words) != 1) {
01513         return 0;
01514     }
01515 
01516     /* Calculate u1 and u2. */
01517     uECC_vli_modInv(z, s, curve->n, num_n_words); /* z = 1/s */
01518     u1[num_n_words - 1] = 0;
01519     bits2int(u1, message_hash, hash_size, curve);
01520     uECC_vli_modMult(u1, u1, z, curve->n, num_n_words); /* u1 = e/s */
01521     uECC_vli_modMult(u2, r, z, curve->n, num_n_words); /* u2 = r/s */
01522 
01523     /* Calculate sum = G + Q. */
01524     uECC_vli_set(sum, _public, num_words);
01525     uECC_vli_set(sum + num_words, _public + num_words, num_words);
01526     uECC_vli_set(tx, curve->G, num_words);
01527     uECC_vli_set(ty, curve->G + num_words, num_words);
01528     uECC_vli_modSub(z, sum, tx, curve->p, num_words); /* z = x2 - x1 */
01529     XYcZ_add(tx, ty, sum, sum + num_words, curve);
01530     uECC_vli_modInv(z, z, curve->p, num_words); /* z = 1/z */
01531     apply_z(sum, sum + num_words, z, curve);
01532 
01533     /* Use Shamir's trick to calculate u1*G + u2*Q */
01534     points[0] = 0;
01535     points[1] = curve->G;
01536     points[2] = _public;
01537     points[3] = sum;
01538     num_bits = smax(uECC_vli_numBits(u1, num_n_words),
01539                     uECC_vli_numBits(u2, num_n_words));
01540 
01541     point = points[(!!uECC_vli_testBit(u1, num_bits - 1)) |
01542                    ((!!uECC_vli_testBit(u2, num_bits - 1)) << 1)];
01543     uECC_vli_set(rx, point, num_words);
01544     uECC_vli_set(ry, point + num_words, num_words);
01545     uECC_vli_clear(z, num_words);
01546     z[0] = 1;
01547 
01548     for (i = num_bits - 2; i >= 0; --i) {
01549         uECC_word_t index;
01550         curve->double_jacobian(rx, ry, z, curve);
01551 
01552         index = (!!uECC_vli_testBit(u1, i)) | ((!!uECC_vli_testBit(u2, i)) << 1);
01553         point = points[index];
01554         if (point) {
01555             uECC_vli_set(tx, point, num_words);
01556             uECC_vli_set(ty, point + num_words, num_words);
01557             apply_z(tx, ty, z, curve);
01558             uECC_vli_modSub(tz, rx, tx, curve->p, num_words); /* Z = x2 - x1 */
01559             XYcZ_add(tx, ty, rx, ry, curve);
01560             uECC_vli_modMult_fast(z, z, tz, curve);
01561         }
01562     }
01563 
01564     uECC_vli_modInv(z, z, curve->p, num_words); /* Z = 1/Z */
01565     apply_z(rx, ry, z, curve);
01566 
01567     /* v = x1 (mod n) */
01568     if (uECC_vli_cmp_unsafe(curve->n, rx, num_n_words) != 1) {
01569         uECC_vli_sub(rx, rx, curve->n, num_n_words);
01570     }
01571 
01572     /* Accept only if v == r. */
01573     return (int)(uECC_vli_equal(rx, r, num_words));
01574 }
01575 
01576 #if uECC_ENABLE_VLI_API
01577 
01578 unsigned uECC_curve_num_words(uECC_Curve curve) {
01579     return curve->num_words;
01580 }
01581 
01582 unsigned uECC_curve_num_bytes(uECC_Curve curve) {
01583     return curve->num_bytes;
01584 }
01585 
01586 unsigned uECC_curve_num_bits(uECC_Curve curve) {
01587     return curve->num_bytes * 8;
01588 }
01589 
01590 unsigned uECC_curve_num_n_words(uECC_Curve curve) {
01591     return BITS_TO_WORDS(curve->num_n_bits);
01592 }
01593 
01594 unsigned uECC_curve_num_n_bytes(uECC_Curve curve) {
01595     return BITS_TO_BYTES(curve->num_n_bits);
01596 }
01597 
01598 unsigned uECC_curve_num_n_bits(uECC_Curve curve) {
01599     return curve->num_n_bits;
01600 }
01601 
01602 const uECC_word_t *uECC_curve_p(uECC_Curve curve) {
01603     return curve->p;
01604 }
01605 
01606 const uECC_word_t *uECC_curve_n(uECC_Curve curve) {
01607     return curve->n;
01608 }
01609 
01610 const uECC_word_t *uECC_curve_G(uECC_Curve curve) {
01611     return curve->G;
01612 }
01613 
01614 const uECC_word_t *uECC_curve_b(uECC_Curve curve) {
01615     return curve->b;
01616 }
01617 
01618 #if uECC_SUPPORT_COMPRESSED_POINT
01619 void uECC_vli_mod_sqrt(uECC_word_t *a, uECC_Curve curve) {
01620     curve->mod_sqrt(a, curve);
01621 }
01622 #endif
01623 
01624 void uECC_vli_mmod_fast(uECC_word_t *result, uECC_word_t *product, uECC_Curve curve) {
01625 #if (uECC_OPTIMIZATION_LEVEL > 0)
01626     curve->mmod_fast(result, product);
01627 #else
01628     uECC_vli_mmod(result, product, curve->p, curve->num_words);
01629 #endif
01630 }
01631 
01632 void uECC_point_mult(uECC_word_t *result,
01633                      const uECC_word_t *point,
01634                      const uECC_word_t *scalar,
01635                      uECC_Curve curve) {
01636     uECC_word_t tmp1[uECC_MAX_WORDS];
01637     uECC_word_t tmp2[uECC_MAX_WORDS];
01638     uECC_word_t *p2[2] = {tmp1, tmp2};
01639     uECC_word_t carry = regularize_k(scalar, tmp1, tmp2, curve);
01640 
01641     EccPoint_mult(result, point, p2[!carry], 0, curve->num_n_bits + 1, curve);
01642 }
01643 
01644 #endif /* uECC_ENABLE_VLI_API */