mbed-os_TYBLE16 - mbed-os5 only for TYBLE16

Users » kenjiArai » Code » mbed-os_TYBLE16

mbed-os5 only for TYBLE16

Dependents: TYBLE16_simple_data_logger TYBLE16_MP3_Air

features/mbedtls/mbed-crypto/src/ecp.c@1:9db0e321a9f4, 2019-12-31 (annotated)

Committer:: kenjiArai
Date:: Tue Dec 31 06:02:27 2019 +0000
Revision:: 1:9db0e321a9f4
Parent:: 0:5b88d5760320

updated based on mbed-os5.15.0

Who changed what in which revision?

User	Revision	Line number	New contents of line
kenjiArai	0:5b88d5760320	1	/*
kenjiArai	0:5b88d5760320	2	* Elliptic curves over GF(p): generic functions
kenjiArai	0:5b88d5760320	3	*
kenjiArai	0:5b88d5760320	4	* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
kenjiArai	0:5b88d5760320	5	* SPDX-License-Identifier: Apache-2.0
kenjiArai	0:5b88d5760320	6	*
kenjiArai	0:5b88d5760320	7	* Licensed under the Apache License, Version 2.0 (the "License"); you may
kenjiArai	0:5b88d5760320	8	* not use this file except in compliance with the License.
kenjiArai	0:5b88d5760320	9	* You may obtain a copy of the License at
kenjiArai	0:5b88d5760320	10	*
kenjiArai	0:5b88d5760320	11	* http://www.apache.org/licenses/LICENSE-2.0
kenjiArai	0:5b88d5760320	12	*
kenjiArai	0:5b88d5760320	13	* Unless required by applicable law or agreed to in writing, software
kenjiArai	0:5b88d5760320	14	* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
kenjiArai	0:5b88d5760320	15	* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
kenjiArai	0:5b88d5760320	16	* See the License for the specific language governing permissions and
kenjiArai	0:5b88d5760320	17	* limitations under the License.
kenjiArai	0:5b88d5760320	18	*
kenjiArai	0:5b88d5760320	19	* This file is part of mbed TLS (https://tls.mbed.org)
kenjiArai	0:5b88d5760320	20	*/
kenjiArai	0:5b88d5760320	21
kenjiArai	0:5b88d5760320	22	/*
kenjiArai	0:5b88d5760320	23	* References:
kenjiArai	0:5b88d5760320	24	*
kenjiArai	0:5b88d5760320	25	* SEC1 http://www.secg.org/index.php?action=secg,docs_secg
kenjiArai	0:5b88d5760320	26	* GECC = Guide to Elliptic Curve Cryptography - Hankerson, Menezes, Vanstone
kenjiArai	0:5b88d5760320	27	* FIPS 186-3 http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf
kenjiArai	0:5b88d5760320	28	* RFC 4492 for the related TLS structures and constants
kenjiArai	0:5b88d5760320	29	* RFC 7748 for the Curve448 and Curve25519 curve definitions
kenjiArai	0:5b88d5760320	30	*
kenjiArai	0:5b88d5760320	31	* [Curve25519] http://cr.yp.to/ecdh/curve25519-20060209.pdf
kenjiArai	0:5b88d5760320	32	*
kenjiArai	0:5b88d5760320	33	* [2] CORON, Jean-S'ebastien. Resistance against differential power analysis
kenjiArai	0:5b88d5760320	34	* for elliptic curve cryptosystems. In : Cryptographic Hardware and
kenjiArai	0:5b88d5760320	35	* Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302.
kenjiArai	0:5b88d5760320	36	* <http://link.springer.com/chapter/10.1007/3-540-48059-5_25>
kenjiArai	0:5b88d5760320	37	*
kenjiArai	0:5b88d5760320	38	* [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to
kenjiArai	0:5b88d5760320	39	* render ECC resistant against Side Channel Attacks. IACR Cryptology
kenjiArai	0:5b88d5760320	40	* ePrint Archive, 2004, vol. 2004, p. 342.
kenjiArai	0:5b88d5760320	41	* <http://eprint.iacr.org/2004/342.pdf>
kenjiArai	0:5b88d5760320	42	*/
kenjiArai	0:5b88d5760320	43
kenjiArai	0:5b88d5760320	44	#if !defined(MBEDTLS_CONFIG_FILE)
kenjiArai	0:5b88d5760320	45	#include "mbedtls/config.h"
kenjiArai	0:5b88d5760320	46	#else
kenjiArai	0:5b88d5760320	47	#include MBEDTLS_CONFIG_FILE
kenjiArai	0:5b88d5760320	48	#endif
kenjiArai	0:5b88d5760320	49
kenjiArai	0:5b88d5760320	50	/**
kenjiArai	0:5b88d5760320	51	* \brief Function level alternative implementation.
kenjiArai	0:5b88d5760320	52	*
kenjiArai	0:5b88d5760320	53	* The MBEDTLS_ECP_INTERNAL_ALT macro enables alternative implementations to
kenjiArai	0:5b88d5760320	54	* replace certain functions in this module. The alternative implementations are
kenjiArai	0:5b88d5760320	55	* typically hardware accelerators and need to activate the hardware before the
kenjiArai	0:5b88d5760320	56	* computation starts and deactivate it after it finishes. The
kenjiArai	0:5b88d5760320	57	* mbedtls_internal_ecp_init() and mbedtls_internal_ecp_free() functions serve
kenjiArai	0:5b88d5760320	58	* this purpose.
kenjiArai	0:5b88d5760320	59	*
kenjiArai	0:5b88d5760320	60	* To preserve the correct functionality the following conditions must hold:
kenjiArai	0:5b88d5760320	61	*
kenjiArai	0:5b88d5760320	62	* - The alternative implementation must be activated by
kenjiArai	0:5b88d5760320	63	* mbedtls_internal_ecp_init() before any of the replaceable functions is
kenjiArai	0:5b88d5760320	64	* called.
kenjiArai	0:5b88d5760320	65	* - mbedtls_internal_ecp_free() must \b only be called when the alternative
kenjiArai	0:5b88d5760320	66	* implementation is activated.
kenjiArai	0:5b88d5760320	67	* - mbedtls_internal_ecp_init() must \b not be called when the alternative
kenjiArai	0:5b88d5760320	68	* implementation is activated.
kenjiArai	0:5b88d5760320	69	* - Public functions must not return while the alternative implementation is
kenjiArai	0:5b88d5760320	70	* activated.
kenjiArai	0:5b88d5760320	71	* - Replaceable functions are guarded by \c MBEDTLS_ECP_XXX_ALT macros and
kenjiArai	0:5b88d5760320	72	* before calling them an \code if( mbedtls_internal_ecp_grp_capable( grp ) )
kenjiArai	0:5b88d5760320	73	* \endcode ensures that the alternative implementation supports the current
kenjiArai	0:5b88d5760320	74	* group.
kenjiArai	0:5b88d5760320	75	*/
kenjiArai	0:5b88d5760320	76	#if defined(MBEDTLS_ECP_INTERNAL_ALT)
kenjiArai	0:5b88d5760320	77	#endif
kenjiArai	0:5b88d5760320	78
kenjiArai	0:5b88d5760320	79	#if defined(MBEDTLS_ECP_C)
kenjiArai	0:5b88d5760320	80
kenjiArai	0:5b88d5760320	81	#include "mbedtls/ecp.h"
kenjiArai	0:5b88d5760320	82	#include "mbedtls/threading.h"
kenjiArai	0:5b88d5760320	83	#include "mbedtls/platform_util.h"
kenjiArai	0:5b88d5760320	84
kenjiArai	0:5b88d5760320	85	#include <string.h>
kenjiArai	0:5b88d5760320	86
kenjiArai	0:5b88d5760320	87	#if !defined(MBEDTLS_ECP_ALT)
kenjiArai	0:5b88d5760320	88
kenjiArai	0:5b88d5760320	89	/* Parameter validation macros based on platform_util.h */
kenjiArai	0:5b88d5760320	90	#define ECP_VALIDATE_RET( cond ) \
kenjiArai	0:5b88d5760320	91	MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_ECP_BAD_INPUT_DATA )
kenjiArai	0:5b88d5760320	92	#define ECP_VALIDATE( cond ) \
kenjiArai	0:5b88d5760320	93	MBEDTLS_INTERNAL_VALIDATE( cond )
kenjiArai	0:5b88d5760320	94
kenjiArai	0:5b88d5760320	95	#if defined(MBEDTLS_PLATFORM_C)
kenjiArai	0:5b88d5760320	96	#include "mbedtls/platform.h"
kenjiArai	0:5b88d5760320	97	#else
kenjiArai	0:5b88d5760320	98	#include <stdlib.h>
kenjiArai	0:5b88d5760320	99	#include <stdio.h>
kenjiArai	0:5b88d5760320	100	#define mbedtls_printf printf
kenjiArai	0:5b88d5760320	101	#define mbedtls_calloc calloc
kenjiArai	0:5b88d5760320	102	#define mbedtls_free free
kenjiArai	0:5b88d5760320	103	#endif
kenjiArai	0:5b88d5760320	104
kenjiArai	0:5b88d5760320	105	#include "mbedtls/ecp_internal.h"
kenjiArai	0:5b88d5760320	106
kenjiArai	0:5b88d5760320	107	#if ( defined(__ARMCC_VERSION) \|\| defined(_MSC_VER) ) && \
kenjiArai	0:5b88d5760320	108	!defined(inline) && !defined(__cplusplus)
kenjiArai	0:5b88d5760320	109	#define inline __inline
kenjiArai	0:5b88d5760320	110	#endif
kenjiArai	0:5b88d5760320	111
kenjiArai	0:5b88d5760320	112	#if defined(MBEDTLS_SELF_TEST)
kenjiArai	0:5b88d5760320	113	/*
kenjiArai	0:5b88d5760320	114	* Counts of point addition and doubling, and field multiplications.
kenjiArai	0:5b88d5760320	115	* Used to test resistance of point multiplication to simple timing attacks.
kenjiArai	0:5b88d5760320	116	*/
kenjiArai	0:5b88d5760320	117	static unsigned long add_count, dbl_count, mul_count;
kenjiArai	0:5b88d5760320	118	#endif
kenjiArai	0:5b88d5760320	119
kenjiArai	0:5b88d5760320	120	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	121	/*
kenjiArai	0:5b88d5760320	122	* Maximum number of "basic operations" to be done in a row.
kenjiArai	0:5b88d5760320	123	*
kenjiArai	0:5b88d5760320	124	* Default value 0 means that ECC operations will not yield.
kenjiArai	0:5b88d5760320	125	* Note that regardless of the value of ecp_max_ops, always at
kenjiArai	0:5b88d5760320	126	* least one step is performed before yielding.
kenjiArai	0:5b88d5760320	127	*
kenjiArai	0:5b88d5760320	128	* Setting ecp_max_ops=1 can be suitable for testing purposes
kenjiArai	0:5b88d5760320	129	* as it will interrupt computation at all possible points.
kenjiArai	0:5b88d5760320	130	*/
kenjiArai	0:5b88d5760320	131	static unsigned ecp_max_ops = 0;
kenjiArai	0:5b88d5760320	132
kenjiArai	0:5b88d5760320	133	/*
kenjiArai	0:5b88d5760320	134	* Set ecp_max_ops
kenjiArai	0:5b88d5760320	135	*/
kenjiArai	0:5b88d5760320	136	void mbedtls_ecp_set_max_ops( unsigned max_ops )
kenjiArai	0:5b88d5760320	137	{
kenjiArai	0:5b88d5760320	138	ecp_max_ops = max_ops;
kenjiArai	0:5b88d5760320	139	}
kenjiArai	0:5b88d5760320	140
kenjiArai	0:5b88d5760320	141	/*
kenjiArai	0:5b88d5760320	142	* Check if restart is enabled
kenjiArai	0:5b88d5760320	143	*/
kenjiArai	0:5b88d5760320	144	int mbedtls_ecp_restart_is_enabled( void )
kenjiArai	0:5b88d5760320	145	{
kenjiArai	0:5b88d5760320	146	return( ecp_max_ops != 0 );
kenjiArai	0:5b88d5760320	147	}
kenjiArai	0:5b88d5760320	148
kenjiArai	0:5b88d5760320	149	/*
kenjiArai	0:5b88d5760320	150	* Restart sub-context for ecp_mul_comb()
kenjiArai	0:5b88d5760320	151	*/
kenjiArai	0:5b88d5760320	152	struct mbedtls_ecp_restart_mul
kenjiArai	0:5b88d5760320	153	{
kenjiArai	0:5b88d5760320	154	mbedtls_ecp_point R; /* current intermediate result */
kenjiArai	0:5b88d5760320	155	size_t i; /* current index in various loops, 0 outside */
kenjiArai	0:5b88d5760320	156	mbedtls_ecp_point T; / table for precomputed points */
kenjiArai	0:5b88d5760320	157	unsigned char T_size; /* number of points in table T */
kenjiArai	0:5b88d5760320	158	enum { /* what were we doing last time we returned? */
kenjiArai	0:5b88d5760320	159	ecp_rsm_init = 0, /* nothing so far, dummy initial state */
kenjiArai	0:5b88d5760320	160	ecp_rsm_pre_dbl, /* precompute 2^n multiples */
kenjiArai	0:5b88d5760320	161	ecp_rsm_pre_norm_dbl, /* normalize precomputed 2^n multiples */
kenjiArai	0:5b88d5760320	162	ecp_rsm_pre_add, /* precompute remaining points by adding */
kenjiArai	0:5b88d5760320	163	ecp_rsm_pre_norm_add, /* normalize all precomputed points */
kenjiArai	0:5b88d5760320	164	ecp_rsm_comb_core, /* ecp_mul_comb_core() */
kenjiArai	0:5b88d5760320	165	ecp_rsm_final_norm, /* do the final normalization */
kenjiArai	0:5b88d5760320	166	} state;
kenjiArai	0:5b88d5760320	167	};
kenjiArai	0:5b88d5760320	168
kenjiArai	0:5b88d5760320	169	/*
kenjiArai	0:5b88d5760320	170	* Init restart_mul sub-context
kenjiArai	0:5b88d5760320	171	*/
kenjiArai	0:5b88d5760320	172	static void ecp_restart_rsm_init( mbedtls_ecp_restart_mul_ctx *ctx )
kenjiArai	0:5b88d5760320	173	{
kenjiArai	0:5b88d5760320	174	mbedtls_ecp_point_init( &ctx->R );
kenjiArai	0:5b88d5760320	175	ctx->i = 0;
kenjiArai	0:5b88d5760320	176	ctx->T = NULL;
kenjiArai	0:5b88d5760320	177	ctx->T_size = 0;
kenjiArai	0:5b88d5760320	178	ctx->state = ecp_rsm_init;
kenjiArai	0:5b88d5760320	179	}
kenjiArai	0:5b88d5760320	180
kenjiArai	0:5b88d5760320	181	/*
kenjiArai	0:5b88d5760320	182	* Free the components of a restart_mul sub-context
kenjiArai	0:5b88d5760320	183	*/
kenjiArai	0:5b88d5760320	184	static void ecp_restart_rsm_free( mbedtls_ecp_restart_mul_ctx *ctx )
kenjiArai	0:5b88d5760320	185	{
kenjiArai	0:5b88d5760320	186	unsigned char i;
kenjiArai	0:5b88d5760320	187
kenjiArai	0:5b88d5760320	188	if( ctx == NULL )
kenjiArai	0:5b88d5760320	189	return;
kenjiArai	0:5b88d5760320	190
kenjiArai	0:5b88d5760320	191	mbedtls_ecp_point_free( &ctx->R );
kenjiArai	0:5b88d5760320	192
kenjiArai	0:5b88d5760320	193	if( ctx->T != NULL )
kenjiArai	0:5b88d5760320	194	{
kenjiArai	0:5b88d5760320	195	for( i = 0; i < ctx->T_size; i++ )
kenjiArai	0:5b88d5760320	196	mbedtls_ecp_point_free( ctx->T + i );
kenjiArai	0:5b88d5760320	197	mbedtls_free( ctx->T );
kenjiArai	0:5b88d5760320	198	}
kenjiArai	0:5b88d5760320	199
kenjiArai	0:5b88d5760320	200	ecp_restart_rsm_init( ctx );
kenjiArai	0:5b88d5760320	201	}
kenjiArai	0:5b88d5760320	202
kenjiArai	0:5b88d5760320	203	/*
kenjiArai	0:5b88d5760320	204	* Restart context for ecp_muladd()
kenjiArai	0:5b88d5760320	205	*/
kenjiArai	0:5b88d5760320	206	struct mbedtls_ecp_restart_muladd
kenjiArai	0:5b88d5760320	207	{
kenjiArai	0:5b88d5760320	208	mbedtls_ecp_point mP; /* mP value */
kenjiArai	0:5b88d5760320	209	mbedtls_ecp_point R; /* R intermediate result */
kenjiArai	0:5b88d5760320	210	enum { /* what should we do next? */
kenjiArai	0:5b88d5760320	211	ecp_rsma_mul1 = 0, /* first multiplication */
kenjiArai	0:5b88d5760320	212	ecp_rsma_mul2, /* second multiplication */
kenjiArai	0:5b88d5760320	213	ecp_rsma_add, /* addition */
kenjiArai	0:5b88d5760320	214	ecp_rsma_norm, /* normalization */
kenjiArai	0:5b88d5760320	215	} state;
kenjiArai	0:5b88d5760320	216	};
kenjiArai	0:5b88d5760320	217
kenjiArai	0:5b88d5760320	218	/*
kenjiArai	0:5b88d5760320	219	* Init restart_muladd sub-context
kenjiArai	0:5b88d5760320	220	*/
kenjiArai	0:5b88d5760320	221	static void ecp_restart_ma_init( mbedtls_ecp_restart_muladd_ctx *ctx )
kenjiArai	0:5b88d5760320	222	{
kenjiArai	0:5b88d5760320	223	mbedtls_ecp_point_init( &ctx->mP );
kenjiArai	0:5b88d5760320	224	mbedtls_ecp_point_init( &ctx->R );
kenjiArai	0:5b88d5760320	225	ctx->state = ecp_rsma_mul1;
kenjiArai	0:5b88d5760320	226	}
kenjiArai	0:5b88d5760320	227
kenjiArai	0:5b88d5760320	228	/*
kenjiArai	0:5b88d5760320	229	* Free the components of a restart_muladd sub-context
kenjiArai	0:5b88d5760320	230	*/
kenjiArai	0:5b88d5760320	231	static void ecp_restart_ma_free( mbedtls_ecp_restart_muladd_ctx *ctx )
kenjiArai	0:5b88d5760320	232	{
kenjiArai	0:5b88d5760320	233	if( ctx == NULL )
kenjiArai	0:5b88d5760320	234	return;
kenjiArai	0:5b88d5760320	235
kenjiArai	0:5b88d5760320	236	mbedtls_ecp_point_free( &ctx->mP );
kenjiArai	0:5b88d5760320	237	mbedtls_ecp_point_free( &ctx->R );
kenjiArai	0:5b88d5760320	238
kenjiArai	0:5b88d5760320	239	ecp_restart_ma_init( ctx );
kenjiArai	0:5b88d5760320	240	}
kenjiArai	0:5b88d5760320	241
kenjiArai	0:5b88d5760320	242	/*
kenjiArai	0:5b88d5760320	243	* Initialize a restart context
kenjiArai	0:5b88d5760320	244	*/
kenjiArai	0:5b88d5760320	245	void mbedtls_ecp_restart_init( mbedtls_ecp_restart_ctx *ctx )
kenjiArai	0:5b88d5760320	246	{
kenjiArai	0:5b88d5760320	247	ECP_VALIDATE( ctx != NULL );
kenjiArai	0:5b88d5760320	248	ctx->ops_done = 0;
kenjiArai	0:5b88d5760320	249	ctx->depth = 0;
kenjiArai	0:5b88d5760320	250	ctx->rsm = NULL;
kenjiArai	0:5b88d5760320	251	ctx->ma = NULL;
kenjiArai	0:5b88d5760320	252	}
kenjiArai	0:5b88d5760320	253
kenjiArai	0:5b88d5760320	254	/*
kenjiArai	0:5b88d5760320	255	* Free the components of a restart context
kenjiArai	0:5b88d5760320	256	*/
kenjiArai	0:5b88d5760320	257	void mbedtls_ecp_restart_free( mbedtls_ecp_restart_ctx *ctx )
kenjiArai	0:5b88d5760320	258	{
kenjiArai	0:5b88d5760320	259	if( ctx == NULL )
kenjiArai	0:5b88d5760320	260	return;
kenjiArai	0:5b88d5760320	261
kenjiArai	0:5b88d5760320	262	ecp_restart_rsm_free( ctx->rsm );
kenjiArai	0:5b88d5760320	263	mbedtls_free( ctx->rsm );
kenjiArai	0:5b88d5760320	264
kenjiArai	0:5b88d5760320	265	ecp_restart_ma_free( ctx->ma );
kenjiArai	0:5b88d5760320	266	mbedtls_free( ctx->ma );
kenjiArai	0:5b88d5760320	267
kenjiArai	0:5b88d5760320	268	mbedtls_ecp_restart_init( ctx );
kenjiArai	0:5b88d5760320	269	}
kenjiArai	0:5b88d5760320	270
kenjiArai	0:5b88d5760320	271	/*
kenjiArai	0:5b88d5760320	272	* Check if we can do the next step
kenjiArai	0:5b88d5760320	273	*/
kenjiArai	0:5b88d5760320	274	int mbedtls_ecp_check_budget( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	275	mbedtls_ecp_restart_ctx *rs_ctx,
kenjiArai	0:5b88d5760320	276	unsigned ops )
kenjiArai	0:5b88d5760320	277	{
kenjiArai	0:5b88d5760320	278	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	279
kenjiArai	0:5b88d5760320	280	if( rs_ctx != NULL && ecp_max_ops != 0 )
kenjiArai	0:5b88d5760320	281	{
kenjiArai	0:5b88d5760320	282	/* scale depending on curve size: the chosen reference is 256-bit,
kenjiArai	0:5b88d5760320	283	* and multiplication is quadratic. Round to the closest integer. */
kenjiArai	0:5b88d5760320	284	if( grp->pbits >= 512 )
kenjiArai	0:5b88d5760320	285	ops *= 4;
kenjiArai	0:5b88d5760320	286	else if( grp->pbits >= 384 )
kenjiArai	0:5b88d5760320	287	ops *= 2;
kenjiArai	0:5b88d5760320	288
kenjiArai	0:5b88d5760320	289	/* Avoid infinite loops: always allow first step.
kenjiArai	0:5b88d5760320	290	* Because of that, however, it's not generally true
kenjiArai	0:5b88d5760320	291	* that ops_done <= ecp_max_ops, so the check
kenjiArai	0:5b88d5760320	292	* ops_done > ecp_max_ops below is mandatory. */
kenjiArai	0:5b88d5760320	293	if( ( rs_ctx->ops_done != 0 ) &&
kenjiArai	0:5b88d5760320	294	( rs_ctx->ops_done > ecp_max_ops \|\|
kenjiArai	0:5b88d5760320	295	ops > ecp_max_ops - rs_ctx->ops_done ) )
kenjiArai	0:5b88d5760320	296	{
kenjiArai	0:5b88d5760320	297	return( MBEDTLS_ERR_ECP_IN_PROGRESS );
kenjiArai	0:5b88d5760320	298	}
kenjiArai	0:5b88d5760320	299
kenjiArai	0:5b88d5760320	300	/* update running count */
kenjiArai	0:5b88d5760320	301	rs_ctx->ops_done += ops;
kenjiArai	0:5b88d5760320	302	}
kenjiArai	0:5b88d5760320	303
kenjiArai	0:5b88d5760320	304	return( 0 );
kenjiArai	0:5b88d5760320	305	}
kenjiArai	0:5b88d5760320	306
kenjiArai	0:5b88d5760320	307	/* Call this when entering a function that needs its own sub-context */
kenjiArai	0:5b88d5760320	308	#define ECP_RS_ENTER( SUB ) do { \
kenjiArai	0:5b88d5760320	309	/* reset ops count for this call if top-level */ \
kenjiArai	0:5b88d5760320	310	if( rs_ctx != NULL && rs_ctx->depth++ == 0 ) \
kenjiArai	0:5b88d5760320	311	rs_ctx->ops_done = 0; \
kenjiArai	0:5b88d5760320	312	\
kenjiArai	0:5b88d5760320	313	/* set up our own sub-context if needed */ \
kenjiArai	0:5b88d5760320	314	if( mbedtls_ecp_restart_is_enabled() && \
kenjiArai	0:5b88d5760320	315	rs_ctx != NULL && rs_ctx->SUB == NULL ) \
kenjiArai	0:5b88d5760320	316	{ \
kenjiArai	0:5b88d5760320	317	rs_ctx->SUB = mbedtls_calloc( 1, sizeof( *rs_ctx->SUB ) ); \
kenjiArai	0:5b88d5760320	318	if( rs_ctx->SUB == NULL ) \
kenjiArai	0:5b88d5760320	319	return( MBEDTLS_ERR_ECP_ALLOC_FAILED ); \
kenjiArai	0:5b88d5760320	320	\
kenjiArai	0:5b88d5760320	321	ecp_restart_## SUB ##_init( rs_ctx->SUB ); \
kenjiArai	0:5b88d5760320	322	} \
kenjiArai	0:5b88d5760320	323	} while( 0 )
kenjiArai	0:5b88d5760320	324
kenjiArai	0:5b88d5760320	325	/* Call this when leaving a function that needs its own sub-context */
kenjiArai	0:5b88d5760320	326	#define ECP_RS_LEAVE( SUB ) do { \
kenjiArai	0:5b88d5760320	327	/* clear our sub-context when not in progress (done or error) */ \
kenjiArai	0:5b88d5760320	328	if( rs_ctx != NULL && rs_ctx->SUB != NULL && \
kenjiArai	0:5b88d5760320	329	ret != MBEDTLS_ERR_ECP_IN_PROGRESS ) \
kenjiArai	0:5b88d5760320	330	{ \
kenjiArai	0:5b88d5760320	331	ecp_restart_## SUB ##_free( rs_ctx->SUB ); \
kenjiArai	0:5b88d5760320	332	mbedtls_free( rs_ctx->SUB ); \
kenjiArai	0:5b88d5760320	333	rs_ctx->SUB = NULL; \
kenjiArai	0:5b88d5760320	334	} \
kenjiArai	0:5b88d5760320	335	\
kenjiArai	0:5b88d5760320	336	if( rs_ctx != NULL ) \
kenjiArai	0:5b88d5760320	337	rs_ctx->depth--; \
kenjiArai	0:5b88d5760320	338	} while( 0 )
kenjiArai	0:5b88d5760320	339
kenjiArai	0:5b88d5760320	340	#else /* MBEDTLS_ECP_RESTARTABLE */
kenjiArai	0:5b88d5760320	341
kenjiArai	0:5b88d5760320	342	#define ECP_RS_ENTER( sub ) (void) rs_ctx;
kenjiArai	0:5b88d5760320	343	#define ECP_RS_LEAVE( sub ) (void) rs_ctx;
kenjiArai	0:5b88d5760320	344
kenjiArai	0:5b88d5760320	345	#endif /* MBEDTLS_ECP_RESTARTABLE */
kenjiArai	0:5b88d5760320	346
kenjiArai	0:5b88d5760320	347	#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) \|\| \
kenjiArai	0:5b88d5760320	348	defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) \|\| \
kenjiArai	0:5b88d5760320	349	defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) \|\| \
kenjiArai	0:5b88d5760320	350	defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) \|\| \
kenjiArai	0:5b88d5760320	351	defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) \|\| \
kenjiArai	0:5b88d5760320	352	defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) \|\| \
kenjiArai	0:5b88d5760320	353	defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) \|\| \
kenjiArai	0:5b88d5760320	354	defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) \|\| \
kenjiArai	0:5b88d5760320	355	defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) \|\| \
kenjiArai	0:5b88d5760320	356	defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) \|\| \
kenjiArai	0:5b88d5760320	357	defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
kenjiArai	0:5b88d5760320	358	#define ECP_SHORTWEIERSTRASS
kenjiArai	0:5b88d5760320	359	#endif
kenjiArai	0:5b88d5760320	360
kenjiArai	0:5b88d5760320	361	#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) \|\| \
kenjiArai	0:5b88d5760320	362	defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
kenjiArai	0:5b88d5760320	363	#define ECP_MONTGOMERY
kenjiArai	0:5b88d5760320	364	#endif
kenjiArai	0:5b88d5760320	365
kenjiArai	0:5b88d5760320	366	/*
kenjiArai	0:5b88d5760320	367	* List of supported curves:
kenjiArai	0:5b88d5760320	368	* - internal ID
kenjiArai	1:9db0e321a9f4	369	* - TLS NamedCurve ID (RFC 4492 sec. 5.1.1, RFC 7071 sec. 2, RFC 8446 sec. 4.2.7)
kenjiArai	0:5b88d5760320	370	* - size in bits
kenjiArai	0:5b88d5760320	371	* - readable name
kenjiArai	0:5b88d5760320	372	*
kenjiArai	0:5b88d5760320	373	* Curves are listed in order: largest curves first, and for a given size,
kenjiArai	0:5b88d5760320	374	* fastest curves first. This provides the default order for the SSL module.
kenjiArai	0:5b88d5760320	375	*
kenjiArai	0:5b88d5760320	376	* Reminder: update profiles in Mbed TLS's x509_crt.c when adding new curves!
kenjiArai	0:5b88d5760320	377	*/
kenjiArai	0:5b88d5760320	378	static const mbedtls_ecp_curve_info ecp_supported_curves[] =
kenjiArai	0:5b88d5760320	379	{
kenjiArai	0:5b88d5760320	380	#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
kenjiArai	0:5b88d5760320	381	{ MBEDTLS_ECP_DP_SECP521R1, 25, 521, "secp521r1" },
kenjiArai	0:5b88d5760320	382	#endif
kenjiArai	0:5b88d5760320	383	#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
kenjiArai	0:5b88d5760320	384	{ MBEDTLS_ECP_DP_BP512R1, 28, 512, "brainpoolP512r1" },
kenjiArai	0:5b88d5760320	385	#endif
kenjiArai	0:5b88d5760320	386	#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
kenjiArai	0:5b88d5760320	387	{ MBEDTLS_ECP_DP_SECP384R1, 24, 384, "secp384r1" },
kenjiArai	0:5b88d5760320	388	#endif
kenjiArai	0:5b88d5760320	389	#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
kenjiArai	0:5b88d5760320	390	{ MBEDTLS_ECP_DP_BP384R1, 27, 384, "brainpoolP384r1" },
kenjiArai	0:5b88d5760320	391	#endif
kenjiArai	0:5b88d5760320	392	#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
kenjiArai	0:5b88d5760320	393	{ MBEDTLS_ECP_DP_SECP256R1, 23, 256, "secp256r1" },
kenjiArai	0:5b88d5760320	394	#endif
kenjiArai	0:5b88d5760320	395	#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
kenjiArai	0:5b88d5760320	396	{ MBEDTLS_ECP_DP_SECP256K1, 22, 256, "secp256k1" },
kenjiArai	0:5b88d5760320	397	#endif
kenjiArai	0:5b88d5760320	398	#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
kenjiArai	0:5b88d5760320	399	{ MBEDTLS_ECP_DP_BP256R1, 26, 256, "brainpoolP256r1" },
kenjiArai	0:5b88d5760320	400	#endif
kenjiArai	0:5b88d5760320	401	#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
kenjiArai	0:5b88d5760320	402	{ MBEDTLS_ECP_DP_SECP224R1, 21, 224, "secp224r1" },
kenjiArai	0:5b88d5760320	403	#endif
kenjiArai	0:5b88d5760320	404	#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
kenjiArai	0:5b88d5760320	405	{ MBEDTLS_ECP_DP_SECP224K1, 20, 224, "secp224k1" },
kenjiArai	0:5b88d5760320	406	#endif
kenjiArai	0:5b88d5760320	407	#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
kenjiArai	0:5b88d5760320	408	{ MBEDTLS_ECP_DP_SECP192R1, 19, 192, "secp192r1" },
kenjiArai	0:5b88d5760320	409	#endif
kenjiArai	0:5b88d5760320	410	#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
kenjiArai	0:5b88d5760320	411	{ MBEDTLS_ECP_DP_SECP192K1, 18, 192, "secp192k1" },
kenjiArai	0:5b88d5760320	412	#endif
kenjiArai	1:9db0e321a9f4	413	#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) && defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED)
kenjiArai	1:9db0e321a9f4	414	{ MBEDTLS_ECP_DP_CURVE25519, 29, 256, "x25519" },
kenjiArai	1:9db0e321a9f4	415	#endif
kenjiArai	0:5b88d5760320	416	{ MBEDTLS_ECP_DP_NONE, 0, 0, NULL },
kenjiArai	0:5b88d5760320	417	};
kenjiArai	0:5b88d5760320	418
kenjiArai	0:5b88d5760320	419	#define ECP_NB_CURVES sizeof( ecp_supported_curves ) / \
kenjiArai	0:5b88d5760320	420	sizeof( ecp_supported_curves[0] )
kenjiArai	0:5b88d5760320	421
kenjiArai	0:5b88d5760320	422	static mbedtls_ecp_group_id ecp_supported_grp_id[ECP_NB_CURVES];
kenjiArai	0:5b88d5760320	423
kenjiArai	0:5b88d5760320	424	/*
kenjiArai	0:5b88d5760320	425	* List of supported curves and associated info
kenjiArai	0:5b88d5760320	426	*/
kenjiArai	0:5b88d5760320	427	const mbedtls_ecp_curve_info *mbedtls_ecp_curve_list( void )
kenjiArai	0:5b88d5760320	428	{
kenjiArai	0:5b88d5760320	429	return( ecp_supported_curves );
kenjiArai	0:5b88d5760320	430	}
kenjiArai	0:5b88d5760320	431
kenjiArai	0:5b88d5760320	432	/*
kenjiArai	0:5b88d5760320	433	* List of supported curves, group ID only
kenjiArai	0:5b88d5760320	434	*/
kenjiArai	0:5b88d5760320	435	const mbedtls_ecp_group_id *mbedtls_ecp_grp_id_list( void )
kenjiArai	0:5b88d5760320	436	{
kenjiArai	0:5b88d5760320	437	static int init_done = 0;
kenjiArai	0:5b88d5760320	438
kenjiArai	0:5b88d5760320	439	if( ! init_done )
kenjiArai	0:5b88d5760320	440	{
kenjiArai	0:5b88d5760320	441	size_t i = 0;
kenjiArai	0:5b88d5760320	442	const mbedtls_ecp_curve_info *curve_info;
kenjiArai	0:5b88d5760320	443
kenjiArai	0:5b88d5760320	444	for( curve_info = mbedtls_ecp_curve_list();
kenjiArai	0:5b88d5760320	445	curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
kenjiArai	0:5b88d5760320	446	curve_info++ )
kenjiArai	0:5b88d5760320	447	{
kenjiArai	0:5b88d5760320	448	ecp_supported_grp_id[i++] = curve_info->grp_id;
kenjiArai	0:5b88d5760320	449	}
kenjiArai	0:5b88d5760320	450	ecp_supported_grp_id[i] = MBEDTLS_ECP_DP_NONE;
kenjiArai	0:5b88d5760320	451
kenjiArai	0:5b88d5760320	452	init_done = 1;
kenjiArai	0:5b88d5760320	453	}
kenjiArai	0:5b88d5760320	454
kenjiArai	0:5b88d5760320	455	return( ecp_supported_grp_id );
kenjiArai	0:5b88d5760320	456	}
kenjiArai	0:5b88d5760320	457
kenjiArai	0:5b88d5760320	458	/*
kenjiArai	0:5b88d5760320	459	* Get the curve info for the internal identifier
kenjiArai	0:5b88d5760320	460	*/
kenjiArai	0:5b88d5760320	461	const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_grp_id( mbedtls_ecp_group_id grp_id )
kenjiArai	0:5b88d5760320	462	{
kenjiArai	0:5b88d5760320	463	const mbedtls_ecp_curve_info *curve_info;
kenjiArai	0:5b88d5760320	464
kenjiArai	0:5b88d5760320	465	for( curve_info = mbedtls_ecp_curve_list();
kenjiArai	0:5b88d5760320	466	curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
kenjiArai	0:5b88d5760320	467	curve_info++ )
kenjiArai	0:5b88d5760320	468	{
kenjiArai	0:5b88d5760320	469	if( curve_info->grp_id == grp_id )
kenjiArai	0:5b88d5760320	470	return( curve_info );
kenjiArai	0:5b88d5760320	471	}
kenjiArai	0:5b88d5760320	472
kenjiArai	0:5b88d5760320	473	return( NULL );
kenjiArai	0:5b88d5760320	474	}
kenjiArai	0:5b88d5760320	475
kenjiArai	0:5b88d5760320	476	/*
kenjiArai	0:5b88d5760320	477	* Get the curve info from the TLS identifier
kenjiArai	0:5b88d5760320	478	*/
kenjiArai	0:5b88d5760320	479	const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_tls_id( uint16_t tls_id )
kenjiArai	0:5b88d5760320	480	{
kenjiArai	0:5b88d5760320	481	const mbedtls_ecp_curve_info *curve_info;
kenjiArai	0:5b88d5760320	482
kenjiArai	0:5b88d5760320	483	for( curve_info = mbedtls_ecp_curve_list();
kenjiArai	0:5b88d5760320	484	curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
kenjiArai	0:5b88d5760320	485	curve_info++ )
kenjiArai	0:5b88d5760320	486	{
kenjiArai	0:5b88d5760320	487	if( curve_info->tls_id == tls_id )
kenjiArai	0:5b88d5760320	488	return( curve_info );
kenjiArai	0:5b88d5760320	489	}
kenjiArai	0:5b88d5760320	490
kenjiArai	0:5b88d5760320	491	return( NULL );
kenjiArai	0:5b88d5760320	492	}
kenjiArai	0:5b88d5760320	493
kenjiArai	0:5b88d5760320	494	/*
kenjiArai	0:5b88d5760320	495	* Get the curve info from the name
kenjiArai	0:5b88d5760320	496	*/
kenjiArai	0:5b88d5760320	497	const mbedtls_ecp_curve_info mbedtls_ecp_curve_info_from_name( const char name )
kenjiArai	0:5b88d5760320	498	{
kenjiArai	0:5b88d5760320	499	const mbedtls_ecp_curve_info *curve_info;
kenjiArai	0:5b88d5760320	500
kenjiArai	0:5b88d5760320	501	if( name == NULL )
kenjiArai	0:5b88d5760320	502	return( NULL );
kenjiArai	0:5b88d5760320	503
kenjiArai	0:5b88d5760320	504	for( curve_info = mbedtls_ecp_curve_list();
kenjiArai	0:5b88d5760320	505	curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
kenjiArai	0:5b88d5760320	506	curve_info++ )
kenjiArai	0:5b88d5760320	507	{
kenjiArai	0:5b88d5760320	508	if( strcmp( curve_info->name, name ) == 0 )
kenjiArai	0:5b88d5760320	509	return( curve_info );
kenjiArai	0:5b88d5760320	510	}
kenjiArai	0:5b88d5760320	511
kenjiArai	0:5b88d5760320	512	return( NULL );
kenjiArai	0:5b88d5760320	513	}
kenjiArai	0:5b88d5760320	514
kenjiArai	0:5b88d5760320	515	/*
kenjiArai	0:5b88d5760320	516	* Get the type of a curve
kenjiArai	0:5b88d5760320	517	*/
kenjiArai	0:5b88d5760320	518	mbedtls_ecp_curve_type mbedtls_ecp_get_type( const mbedtls_ecp_group *grp )
kenjiArai	0:5b88d5760320	519	{
kenjiArai	0:5b88d5760320	520	if( grp->G.X.p == NULL )
kenjiArai	0:5b88d5760320	521	return( MBEDTLS_ECP_TYPE_NONE );
kenjiArai	0:5b88d5760320	522
kenjiArai	0:5b88d5760320	523	if( grp->G.Y.p == NULL )
kenjiArai	0:5b88d5760320	524	return( MBEDTLS_ECP_TYPE_MONTGOMERY );
kenjiArai	0:5b88d5760320	525	else
kenjiArai	0:5b88d5760320	526	return( MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS );
kenjiArai	0:5b88d5760320	527	}
kenjiArai	0:5b88d5760320	528
kenjiArai	0:5b88d5760320	529	/*
kenjiArai	0:5b88d5760320	530	* Initialize (the components of) a point
kenjiArai	0:5b88d5760320	531	*/
kenjiArai	0:5b88d5760320	532	void mbedtls_ecp_point_init( mbedtls_ecp_point *pt )
kenjiArai	0:5b88d5760320	533	{
kenjiArai	0:5b88d5760320	534	ECP_VALIDATE( pt != NULL );
kenjiArai	0:5b88d5760320	535
kenjiArai	0:5b88d5760320	536	mbedtls_mpi_init( &pt->X );
kenjiArai	0:5b88d5760320	537	mbedtls_mpi_init( &pt->Y );
kenjiArai	0:5b88d5760320	538	mbedtls_mpi_init( &pt->Z );
kenjiArai	0:5b88d5760320	539	}
kenjiArai	0:5b88d5760320	540
kenjiArai	0:5b88d5760320	541	/*
kenjiArai	0:5b88d5760320	542	* Initialize (the components of) a group
kenjiArai	0:5b88d5760320	543	*/
kenjiArai	0:5b88d5760320	544	void mbedtls_ecp_group_init( mbedtls_ecp_group *grp )
kenjiArai	0:5b88d5760320	545	{
kenjiArai	0:5b88d5760320	546	ECP_VALIDATE( grp != NULL );
kenjiArai	0:5b88d5760320	547
kenjiArai	0:5b88d5760320	548	grp->id = MBEDTLS_ECP_DP_NONE;
kenjiArai	0:5b88d5760320	549	mbedtls_mpi_init( &grp->P );
kenjiArai	0:5b88d5760320	550	mbedtls_mpi_init( &grp->A );
kenjiArai	0:5b88d5760320	551	mbedtls_mpi_init( &grp->B );
kenjiArai	0:5b88d5760320	552	mbedtls_ecp_point_init( &grp->G );
kenjiArai	0:5b88d5760320	553	mbedtls_mpi_init( &grp->N );
kenjiArai	0:5b88d5760320	554	grp->pbits = 0;
kenjiArai	0:5b88d5760320	555	grp->nbits = 0;
kenjiArai	0:5b88d5760320	556	grp->h = 0;
kenjiArai	0:5b88d5760320	557	grp->modp = NULL;
kenjiArai	0:5b88d5760320	558	grp->t_pre = NULL;
kenjiArai	0:5b88d5760320	559	grp->t_post = NULL;
kenjiArai	0:5b88d5760320	560	grp->t_data = NULL;
kenjiArai	0:5b88d5760320	561	grp->T = NULL;
kenjiArai	0:5b88d5760320	562	grp->T_size = 0;
kenjiArai	0:5b88d5760320	563	}
kenjiArai	0:5b88d5760320	564
kenjiArai	0:5b88d5760320	565	/*
kenjiArai	0:5b88d5760320	566	* Initialize (the components of) a key pair
kenjiArai	0:5b88d5760320	567	*/
kenjiArai	0:5b88d5760320	568	void mbedtls_ecp_keypair_init( mbedtls_ecp_keypair *key )
kenjiArai	0:5b88d5760320	569	{
kenjiArai	0:5b88d5760320	570	ECP_VALIDATE( key != NULL );
kenjiArai	0:5b88d5760320	571
kenjiArai	0:5b88d5760320	572	mbedtls_ecp_group_init( &key->grp );
kenjiArai	0:5b88d5760320	573	mbedtls_mpi_init( &key->d );
kenjiArai	0:5b88d5760320	574	mbedtls_ecp_point_init( &key->Q );
kenjiArai	0:5b88d5760320	575	}
kenjiArai	0:5b88d5760320	576
kenjiArai	0:5b88d5760320	577	/*
kenjiArai	0:5b88d5760320	578	* Unallocate (the components of) a point
kenjiArai	0:5b88d5760320	579	*/
kenjiArai	0:5b88d5760320	580	void mbedtls_ecp_point_free( mbedtls_ecp_point *pt )
kenjiArai	0:5b88d5760320	581	{
kenjiArai	0:5b88d5760320	582	if( pt == NULL )
kenjiArai	0:5b88d5760320	583	return;
kenjiArai	0:5b88d5760320	584
kenjiArai	0:5b88d5760320	585	mbedtls_mpi_free( &( pt->X ) );
kenjiArai	0:5b88d5760320	586	mbedtls_mpi_free( &( pt->Y ) );
kenjiArai	0:5b88d5760320	587	mbedtls_mpi_free( &( pt->Z ) );
kenjiArai	0:5b88d5760320	588	}
kenjiArai	0:5b88d5760320	589
kenjiArai	0:5b88d5760320	590	/*
kenjiArai	0:5b88d5760320	591	* Unallocate (the components of) a group
kenjiArai	0:5b88d5760320	592	*/
kenjiArai	0:5b88d5760320	593	void mbedtls_ecp_group_free( mbedtls_ecp_group *grp )
kenjiArai	0:5b88d5760320	594	{
kenjiArai	0:5b88d5760320	595	size_t i;
kenjiArai	0:5b88d5760320	596
kenjiArai	0:5b88d5760320	597	if( grp == NULL )
kenjiArai	0:5b88d5760320	598	return;
kenjiArai	0:5b88d5760320	599
kenjiArai	0:5b88d5760320	600	if( grp->h != 1 )
kenjiArai	0:5b88d5760320	601	{
kenjiArai	0:5b88d5760320	602	mbedtls_mpi_free( &grp->P );
kenjiArai	0:5b88d5760320	603	mbedtls_mpi_free( &grp->A );
kenjiArai	0:5b88d5760320	604	mbedtls_mpi_free( &grp->B );
kenjiArai	0:5b88d5760320	605	mbedtls_ecp_point_free( &grp->G );
kenjiArai	0:5b88d5760320	606	mbedtls_mpi_free( &grp->N );
kenjiArai	0:5b88d5760320	607	}
kenjiArai	0:5b88d5760320	608
kenjiArai	0:5b88d5760320	609	if( grp->T != NULL )
kenjiArai	0:5b88d5760320	610	{
kenjiArai	0:5b88d5760320	611	for( i = 0; i < grp->T_size; i++ )
kenjiArai	0:5b88d5760320	612	mbedtls_ecp_point_free( &grp->T[i] );
kenjiArai	0:5b88d5760320	613	mbedtls_free( grp->T );
kenjiArai	0:5b88d5760320	614	}
kenjiArai	0:5b88d5760320	615
kenjiArai	0:5b88d5760320	616	mbedtls_platform_zeroize( grp, sizeof( mbedtls_ecp_group ) );
kenjiArai	0:5b88d5760320	617	}
kenjiArai	0:5b88d5760320	618
kenjiArai	0:5b88d5760320	619	/*
kenjiArai	0:5b88d5760320	620	* Unallocate (the components of) a key pair
kenjiArai	0:5b88d5760320	621	*/
kenjiArai	0:5b88d5760320	622	void mbedtls_ecp_keypair_free( mbedtls_ecp_keypair *key )
kenjiArai	0:5b88d5760320	623	{
kenjiArai	0:5b88d5760320	624	if( key == NULL )
kenjiArai	0:5b88d5760320	625	return;
kenjiArai	0:5b88d5760320	626
kenjiArai	0:5b88d5760320	627	mbedtls_ecp_group_free( &key->grp );
kenjiArai	0:5b88d5760320	628	mbedtls_mpi_free( &key->d );
kenjiArai	0:5b88d5760320	629	mbedtls_ecp_point_free( &key->Q );
kenjiArai	0:5b88d5760320	630	}
kenjiArai	0:5b88d5760320	631
kenjiArai	0:5b88d5760320	632	/*
kenjiArai	0:5b88d5760320	633	* Copy the contents of a point
kenjiArai	0:5b88d5760320	634	*/
kenjiArai	0:5b88d5760320	635	int mbedtls_ecp_copy( mbedtls_ecp_point P, const mbedtls_ecp_point Q )
kenjiArai	0:5b88d5760320	636	{
kenjiArai	0:5b88d5760320	637	int ret;
kenjiArai	0:5b88d5760320	638	ECP_VALIDATE_RET( P != NULL );
kenjiArai	0:5b88d5760320	639	ECP_VALIDATE_RET( Q != NULL );
kenjiArai	0:5b88d5760320	640
kenjiArai	0:5b88d5760320	641	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->X, &Q->X ) );
kenjiArai	0:5b88d5760320	642	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->Y, &Q->Y ) );
kenjiArai	0:5b88d5760320	643	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->Z, &Q->Z ) );
kenjiArai	0:5b88d5760320	644
kenjiArai	0:5b88d5760320	645	cleanup:
kenjiArai	0:5b88d5760320	646	return( ret );
kenjiArai	0:5b88d5760320	647	}
kenjiArai	0:5b88d5760320	648
kenjiArai	0:5b88d5760320	649	/*
kenjiArai	0:5b88d5760320	650	* Copy the contents of a group object
kenjiArai	0:5b88d5760320	651	*/
kenjiArai	0:5b88d5760320	652	int mbedtls_ecp_group_copy( mbedtls_ecp_group dst, const mbedtls_ecp_group src )
kenjiArai	0:5b88d5760320	653	{
kenjiArai	0:5b88d5760320	654	ECP_VALIDATE_RET( dst != NULL );
kenjiArai	0:5b88d5760320	655	ECP_VALIDATE_RET( src != NULL );
kenjiArai	0:5b88d5760320	656
kenjiArai	0:5b88d5760320	657	return( mbedtls_ecp_group_load( dst, src->id ) );
kenjiArai	0:5b88d5760320	658	}
kenjiArai	0:5b88d5760320	659
kenjiArai	0:5b88d5760320	660	/*
kenjiArai	0:5b88d5760320	661	* Set point to zero
kenjiArai	0:5b88d5760320	662	*/
kenjiArai	0:5b88d5760320	663	int mbedtls_ecp_set_zero( mbedtls_ecp_point *pt )
kenjiArai	0:5b88d5760320	664	{
kenjiArai	0:5b88d5760320	665	int ret;
kenjiArai	0:5b88d5760320	666	ECP_VALIDATE_RET( pt != NULL );
kenjiArai	0:5b88d5760320	667
kenjiArai	0:5b88d5760320	668	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->X , 1 ) );
kenjiArai	0:5b88d5760320	669	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Y , 1 ) );
kenjiArai	0:5b88d5760320	670	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z , 0 ) );
kenjiArai	0:5b88d5760320	671
kenjiArai	0:5b88d5760320	672	cleanup:
kenjiArai	0:5b88d5760320	673	return( ret );
kenjiArai	0:5b88d5760320	674	}
kenjiArai	0:5b88d5760320	675
kenjiArai	0:5b88d5760320	676	/*
kenjiArai	0:5b88d5760320	677	* Tell if a point is zero
kenjiArai	0:5b88d5760320	678	*/
kenjiArai	0:5b88d5760320	679	int mbedtls_ecp_is_zero( mbedtls_ecp_point *pt )
kenjiArai	0:5b88d5760320	680	{
kenjiArai	0:5b88d5760320	681	ECP_VALIDATE_RET( pt != NULL );
kenjiArai	0:5b88d5760320	682
kenjiArai	0:5b88d5760320	683	return( mbedtls_mpi_cmp_int( &pt->Z, 0 ) == 0 );
kenjiArai	0:5b88d5760320	684	}
kenjiArai	0:5b88d5760320	685
kenjiArai	0:5b88d5760320	686	/*
kenjiArai	0:5b88d5760320	687	* Compare two points lazily
kenjiArai	0:5b88d5760320	688	*/
kenjiArai	0:5b88d5760320	689	int mbedtls_ecp_point_cmp( const mbedtls_ecp_point *P,
kenjiArai	0:5b88d5760320	690	const mbedtls_ecp_point *Q )
kenjiArai	0:5b88d5760320	691	{
kenjiArai	0:5b88d5760320	692	ECP_VALIDATE_RET( P != NULL );
kenjiArai	0:5b88d5760320	693	ECP_VALIDATE_RET( Q != NULL );
kenjiArai	0:5b88d5760320	694
kenjiArai	0:5b88d5760320	695	if( mbedtls_mpi_cmp_mpi( &P->X, &Q->X ) == 0 &&
kenjiArai	0:5b88d5760320	696	mbedtls_mpi_cmp_mpi( &P->Y, &Q->Y ) == 0 &&
kenjiArai	0:5b88d5760320	697	mbedtls_mpi_cmp_mpi( &P->Z, &Q->Z ) == 0 )
kenjiArai	0:5b88d5760320	698	{
kenjiArai	0:5b88d5760320	699	return( 0 );
kenjiArai	0:5b88d5760320	700	}
kenjiArai	0:5b88d5760320	701
kenjiArai	0:5b88d5760320	702	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	703	}
kenjiArai	0:5b88d5760320	704
kenjiArai	0:5b88d5760320	705	/*
kenjiArai	0:5b88d5760320	706	* Import a non-zero point from ASCII strings
kenjiArai	0:5b88d5760320	707	*/
kenjiArai	0:5b88d5760320	708	int mbedtls_ecp_point_read_string( mbedtls_ecp_point *P, int radix,
kenjiArai	0:5b88d5760320	709	const char x, const char y )
kenjiArai	0:5b88d5760320	710	{
kenjiArai	0:5b88d5760320	711	int ret;
kenjiArai	0:5b88d5760320	712	ECP_VALIDATE_RET( P != NULL );
kenjiArai	0:5b88d5760320	713	ECP_VALIDATE_RET( x != NULL );
kenjiArai	0:5b88d5760320	714	ECP_VALIDATE_RET( y != NULL );
kenjiArai	0:5b88d5760320	715
kenjiArai	0:5b88d5760320	716	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &P->X, radix, x ) );
kenjiArai	0:5b88d5760320	717	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &P->Y, radix, y ) );
kenjiArai	0:5b88d5760320	718	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &P->Z, 1 ) );
kenjiArai	0:5b88d5760320	719
kenjiArai	0:5b88d5760320	720	cleanup:
kenjiArai	0:5b88d5760320	721	return( ret );
kenjiArai	0:5b88d5760320	722	}
kenjiArai	0:5b88d5760320	723
kenjiArai	0:5b88d5760320	724	/*
kenjiArai	0:5b88d5760320	725	* Export a point into unsigned binary data (SEC1 2.3.3 and RFC7748)
kenjiArai	0:5b88d5760320	726	*/
kenjiArai	0:5b88d5760320	727	int mbedtls_ecp_point_write_binary( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	728	const mbedtls_ecp_point *P,
kenjiArai	0:5b88d5760320	729	int format, size_t *olen,
kenjiArai	0:5b88d5760320	730	unsigned char *buf, size_t buflen )
kenjiArai	0:5b88d5760320	731	{
kenjiArai	0:5b88d5760320	732	int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
kenjiArai	0:5b88d5760320	733	size_t plen;
kenjiArai	0:5b88d5760320	734	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	735	ECP_VALIDATE_RET( P != NULL );
kenjiArai	0:5b88d5760320	736	ECP_VALIDATE_RET( olen != NULL );
kenjiArai	0:5b88d5760320	737	ECP_VALIDATE_RET( buf != NULL );
kenjiArai	0:5b88d5760320	738	ECP_VALIDATE_RET( format == MBEDTLS_ECP_PF_UNCOMPRESSED \|\|
kenjiArai	0:5b88d5760320	739	format == MBEDTLS_ECP_PF_COMPRESSED );
kenjiArai	0:5b88d5760320	740
kenjiArai	0:5b88d5760320	741	plen = mbedtls_mpi_size( &grp->P );
kenjiArai	0:5b88d5760320	742
kenjiArai	0:5b88d5760320	743	#if defined(ECP_MONTGOMERY)
kenjiArai	0:5b88d5760320	744	if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
kenjiArai	0:5b88d5760320	745	{
kenjiArai	0:5b88d5760320	746	*olen = plen;
kenjiArai	0:5b88d5760320	747	if( buflen < *olen )
kenjiArai	0:5b88d5760320	748	return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
kenjiArai	0:5b88d5760320	749
kenjiArai	0:5b88d5760320	750	MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary_le( &P->X, buf, plen ) );
kenjiArai	0:5b88d5760320	751	}
kenjiArai	0:5b88d5760320	752	#endif
kenjiArai	0:5b88d5760320	753	#if defined(ECP_SHORTWEIERSTRASS)
kenjiArai	0:5b88d5760320	754	if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
kenjiArai	0:5b88d5760320	755	{
kenjiArai	0:5b88d5760320	756	/*
kenjiArai	0:5b88d5760320	757	* Common case: P == 0
kenjiArai	0:5b88d5760320	758	*/
kenjiArai	0:5b88d5760320	759	if( mbedtls_mpi_cmp_int( &P->Z, 0 ) == 0 )
kenjiArai	0:5b88d5760320	760	{
kenjiArai	0:5b88d5760320	761	if( buflen < 1 )
kenjiArai	0:5b88d5760320	762	return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
kenjiArai	0:5b88d5760320	763
kenjiArai	0:5b88d5760320	764	buf[0] = 0x00;
kenjiArai	0:5b88d5760320	765	*olen = 1;
kenjiArai	0:5b88d5760320	766
kenjiArai	0:5b88d5760320	767	return( 0 );
kenjiArai	0:5b88d5760320	768	}
kenjiArai	0:5b88d5760320	769
kenjiArai	0:5b88d5760320	770	if( format == MBEDTLS_ECP_PF_UNCOMPRESSED )
kenjiArai	0:5b88d5760320	771	{
kenjiArai	0:5b88d5760320	772	olen = 2 plen + 1;
kenjiArai	0:5b88d5760320	773
kenjiArai	0:5b88d5760320	774	if( buflen < *olen )
kenjiArai	0:5b88d5760320	775	return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
kenjiArai	0:5b88d5760320	776
kenjiArai	0:5b88d5760320	777	buf[0] = 0x04;
kenjiArai	0:5b88d5760320	778	MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->X, buf + 1, plen ) );
kenjiArai	0:5b88d5760320	779	MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->Y, buf + 1 + plen, plen ) );
kenjiArai	0:5b88d5760320	780	}
kenjiArai	0:5b88d5760320	781	else if( format == MBEDTLS_ECP_PF_COMPRESSED )
kenjiArai	0:5b88d5760320	782	{
kenjiArai	0:5b88d5760320	783	*olen = plen + 1;
kenjiArai	0:5b88d5760320	784
kenjiArai	0:5b88d5760320	785	if( buflen < *olen )
kenjiArai	0:5b88d5760320	786	return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
kenjiArai	0:5b88d5760320	787
kenjiArai	0:5b88d5760320	788	buf[0] = 0x02 + mbedtls_mpi_get_bit( &P->Y, 0 );
kenjiArai	0:5b88d5760320	789	MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->X, buf + 1, plen ) );
kenjiArai	0:5b88d5760320	790	}
kenjiArai	0:5b88d5760320	791	}
kenjiArai	0:5b88d5760320	792	#endif
kenjiArai	0:5b88d5760320	793
kenjiArai	0:5b88d5760320	794	cleanup:
kenjiArai	0:5b88d5760320	795	return( ret );
kenjiArai	0:5b88d5760320	796	}
kenjiArai	0:5b88d5760320	797
kenjiArai	0:5b88d5760320	798	/*
kenjiArai	0:5b88d5760320	799	* Import a point from unsigned binary data (SEC1 2.3.4 and RFC7748)
kenjiArai	0:5b88d5760320	800	*/
kenjiArai	0:5b88d5760320	801	int mbedtls_ecp_point_read_binary( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	802	mbedtls_ecp_point *pt,
kenjiArai	0:5b88d5760320	803	const unsigned char *buf, size_t ilen )
kenjiArai	0:5b88d5760320	804	{
kenjiArai	0:5b88d5760320	805	int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
kenjiArai	0:5b88d5760320	806	size_t plen;
kenjiArai	0:5b88d5760320	807	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	808	ECP_VALIDATE_RET( pt != NULL );
kenjiArai	0:5b88d5760320	809	ECP_VALIDATE_RET( buf != NULL );
kenjiArai	0:5b88d5760320	810
kenjiArai	0:5b88d5760320	811	if( ilen < 1 )
kenjiArai	0:5b88d5760320	812	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	813
kenjiArai	0:5b88d5760320	814	plen = mbedtls_mpi_size( &grp->P );
kenjiArai	0:5b88d5760320	815
kenjiArai	0:5b88d5760320	816	#if defined(ECP_MONTGOMERY)
kenjiArai	0:5b88d5760320	817	if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
kenjiArai	0:5b88d5760320	818	{
kenjiArai	0:5b88d5760320	819	if( plen != ilen )
kenjiArai	0:5b88d5760320	820	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	821
kenjiArai	0:5b88d5760320	822	MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary_le( &pt->X, buf, plen ) );
kenjiArai	0:5b88d5760320	823	mbedtls_mpi_free( &pt->Y );
kenjiArai	0:5b88d5760320	824
kenjiArai	0:5b88d5760320	825	if( grp->id == MBEDTLS_ECP_DP_CURVE25519 )
kenjiArai	0:5b88d5760320	826	/* Set most significant bit to 0 as prescribed in RFC7748 §5 */
kenjiArai	0:5b88d5760320	827	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &pt->X, plen * 8 - 1, 0 ) );
kenjiArai	0:5b88d5760320	828
kenjiArai	0:5b88d5760320	829	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z, 1 ) );
kenjiArai	0:5b88d5760320	830	}
kenjiArai	0:5b88d5760320	831	#endif
kenjiArai	0:5b88d5760320	832	#if defined(ECP_SHORTWEIERSTRASS)
kenjiArai	0:5b88d5760320	833	if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
kenjiArai	0:5b88d5760320	834	{
kenjiArai	0:5b88d5760320	835	if( buf[0] == 0x00 )
kenjiArai	0:5b88d5760320	836	{
kenjiArai	0:5b88d5760320	837	if( ilen == 1 )
kenjiArai	0:5b88d5760320	838	return( mbedtls_ecp_set_zero( pt ) );
kenjiArai	0:5b88d5760320	839	else
kenjiArai	0:5b88d5760320	840	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	841	}
kenjiArai	0:5b88d5760320	842
kenjiArai	0:5b88d5760320	843	if( buf[0] != 0x04 )
kenjiArai	0:5b88d5760320	844	return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
kenjiArai	0:5b88d5760320	845
kenjiArai	0:5b88d5760320	846	if( ilen != 2 * plen + 1 )
kenjiArai	0:5b88d5760320	847	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	848
kenjiArai	0:5b88d5760320	849	MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &pt->X, buf + 1, plen ) );
kenjiArai	0:5b88d5760320	850	MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &pt->Y,
kenjiArai	0:5b88d5760320	851	buf + 1 + plen, plen ) );
kenjiArai	0:5b88d5760320	852	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z, 1 ) );
kenjiArai	0:5b88d5760320	853	}
kenjiArai	0:5b88d5760320	854	#endif
kenjiArai	0:5b88d5760320	855
kenjiArai	0:5b88d5760320	856	cleanup:
kenjiArai	0:5b88d5760320	857	return( ret );
kenjiArai	0:5b88d5760320	858	}
kenjiArai	0:5b88d5760320	859
kenjiArai	0:5b88d5760320	860	/*
kenjiArai	0:5b88d5760320	861	* Import a point from a TLS ECPoint record (RFC 4492)
kenjiArai	0:5b88d5760320	862	* struct {
kenjiArai	0:5b88d5760320	863	* opaque point <1..2^8-1>;
kenjiArai	0:5b88d5760320	864	* } ECPoint;
kenjiArai	0:5b88d5760320	865	*/
kenjiArai	0:5b88d5760320	866	int mbedtls_ecp_tls_read_point( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	867	mbedtls_ecp_point *pt,
kenjiArai	0:5b88d5760320	868	const unsigned char **buf, size_t buf_len )
kenjiArai	0:5b88d5760320	869	{
kenjiArai	0:5b88d5760320	870	unsigned char data_len;
kenjiArai	0:5b88d5760320	871	const unsigned char *buf_start;
kenjiArai	0:5b88d5760320	872	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	873	ECP_VALIDATE_RET( pt != NULL );
kenjiArai	0:5b88d5760320	874	ECP_VALIDATE_RET( buf != NULL );
kenjiArai	0:5b88d5760320	875	ECP_VALIDATE_RET( *buf != NULL );
kenjiArai	0:5b88d5760320	876
kenjiArai	0:5b88d5760320	877	/*
kenjiArai	0:5b88d5760320	878	* We must have at least two bytes (1 for length, at least one for data)
kenjiArai	0:5b88d5760320	879	*/
kenjiArai	0:5b88d5760320	880	if( buf_len < 2 )
kenjiArai	0:5b88d5760320	881	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	882
kenjiArai	0:5b88d5760320	883	data_len = (buf)++;
kenjiArai	0:5b88d5760320	884	if( data_len < 1 \|\| data_len > buf_len - 1 )
kenjiArai	0:5b88d5760320	885	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	886
kenjiArai	0:5b88d5760320	887	/*
kenjiArai	0:5b88d5760320	888	* Save buffer start for read_binary and update buf
kenjiArai	0:5b88d5760320	889	*/
kenjiArai	0:5b88d5760320	890	buf_start = *buf;
kenjiArai	0:5b88d5760320	891	*buf += data_len;
kenjiArai	0:5b88d5760320	892
kenjiArai	0:5b88d5760320	893	return( mbedtls_ecp_point_read_binary( grp, pt, buf_start, data_len ) );
kenjiArai	0:5b88d5760320	894	}
kenjiArai	0:5b88d5760320	895
kenjiArai	0:5b88d5760320	896	/*
kenjiArai	0:5b88d5760320	897	* Export a point as a TLS ECPoint record (RFC 4492)
kenjiArai	0:5b88d5760320	898	* struct {
kenjiArai	0:5b88d5760320	899	* opaque point <1..2^8-1>;
kenjiArai	0:5b88d5760320	900	* } ECPoint;
kenjiArai	0:5b88d5760320	901	*/
kenjiArai	0:5b88d5760320	902	int mbedtls_ecp_tls_write_point( const mbedtls_ecp_group grp, const mbedtls_ecp_point pt,
kenjiArai	0:5b88d5760320	903	int format, size_t *olen,
kenjiArai	0:5b88d5760320	904	unsigned char *buf, size_t blen )
kenjiArai	0:5b88d5760320	905	{
kenjiArai	0:5b88d5760320	906	int ret;
kenjiArai	0:5b88d5760320	907	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	908	ECP_VALIDATE_RET( pt != NULL );
kenjiArai	0:5b88d5760320	909	ECP_VALIDATE_RET( olen != NULL );
kenjiArai	0:5b88d5760320	910	ECP_VALIDATE_RET( buf != NULL );
kenjiArai	0:5b88d5760320	911	ECP_VALIDATE_RET( format == MBEDTLS_ECP_PF_UNCOMPRESSED \|\|
kenjiArai	0:5b88d5760320	912	format == MBEDTLS_ECP_PF_COMPRESSED );
kenjiArai	0:5b88d5760320	913
kenjiArai	0:5b88d5760320	914	/*
kenjiArai	0:5b88d5760320	915	* buffer length must be at least one, for our length byte
kenjiArai	0:5b88d5760320	916	*/
kenjiArai	0:5b88d5760320	917	if( blen < 1 )
kenjiArai	0:5b88d5760320	918	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	919
kenjiArai	0:5b88d5760320	920	if( ( ret = mbedtls_ecp_point_write_binary( grp, pt, format,
kenjiArai	0:5b88d5760320	921	olen, buf + 1, blen - 1) ) != 0 )
kenjiArai	0:5b88d5760320	922	return( ret );
kenjiArai	0:5b88d5760320	923
kenjiArai	0:5b88d5760320	924	/*
kenjiArai	0:5b88d5760320	925	* write length to the first byte and update total length
kenjiArai	0:5b88d5760320	926	*/
kenjiArai	0:5b88d5760320	927	buf[0] = (unsigned char) *olen;
kenjiArai	0:5b88d5760320	928	++*olen;
kenjiArai	0:5b88d5760320	929
kenjiArai	0:5b88d5760320	930	return( 0 );
kenjiArai	0:5b88d5760320	931	}
kenjiArai	0:5b88d5760320	932
kenjiArai	0:5b88d5760320	933	/*
kenjiArai	0:5b88d5760320	934	* Set a group from an ECParameters record (RFC 4492)
kenjiArai	0:5b88d5760320	935	*/
kenjiArai	0:5b88d5760320	936	int mbedtls_ecp_tls_read_group( mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	937	const unsigned char **buf, size_t len )
kenjiArai	0:5b88d5760320	938	{
kenjiArai	0:5b88d5760320	939	int ret;
kenjiArai	0:5b88d5760320	940	mbedtls_ecp_group_id grp_id;
kenjiArai	0:5b88d5760320	941	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	942	ECP_VALIDATE_RET( buf != NULL );
kenjiArai	0:5b88d5760320	943	ECP_VALIDATE_RET( *buf != NULL );
kenjiArai	0:5b88d5760320	944
kenjiArai	0:5b88d5760320	945	if( ( ret = mbedtls_ecp_tls_read_group_id( &grp_id, buf, len ) ) != 0 )
kenjiArai	0:5b88d5760320	946	return( ret );
kenjiArai	0:5b88d5760320	947
kenjiArai	0:5b88d5760320	948	return( mbedtls_ecp_group_load( grp, grp_id ) );
kenjiArai	0:5b88d5760320	949	}
kenjiArai	0:5b88d5760320	950
kenjiArai	0:5b88d5760320	951	/*
kenjiArai	0:5b88d5760320	952	* Read a group id from an ECParameters record (RFC 4492) and convert it to
kenjiArai	0:5b88d5760320	953	* mbedtls_ecp_group_id.
kenjiArai	0:5b88d5760320	954	*/
kenjiArai	0:5b88d5760320	955	int mbedtls_ecp_tls_read_group_id( mbedtls_ecp_group_id *grp,
kenjiArai	0:5b88d5760320	956	const unsigned char **buf, size_t len )
kenjiArai	0:5b88d5760320	957	{
kenjiArai	0:5b88d5760320	958	uint16_t tls_id;
kenjiArai	0:5b88d5760320	959	const mbedtls_ecp_curve_info *curve_info;
kenjiArai	0:5b88d5760320	960	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	961	ECP_VALIDATE_RET( buf != NULL );
kenjiArai	0:5b88d5760320	962	ECP_VALIDATE_RET( *buf != NULL );
kenjiArai	0:5b88d5760320	963
kenjiArai	0:5b88d5760320	964	/*
kenjiArai	0:5b88d5760320	965	* We expect at least three bytes (see below)
kenjiArai	0:5b88d5760320	966	*/
kenjiArai	0:5b88d5760320	967	if( len < 3 )
kenjiArai	0:5b88d5760320	968	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	969
kenjiArai	0:5b88d5760320	970	/*
kenjiArai	0:5b88d5760320	971	* First byte is curve_type; only named_curve is handled
kenjiArai	0:5b88d5760320	972	*/
kenjiArai	0:5b88d5760320	973	if( (buf)++ != MBEDTLS_ECP_TLS_NAMED_CURVE )
kenjiArai	0:5b88d5760320	974	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	975
kenjiArai	0:5b88d5760320	976	/*
kenjiArai	0:5b88d5760320	977	* Next two bytes are the namedcurve value
kenjiArai	0:5b88d5760320	978	*/
kenjiArai	0:5b88d5760320	979	tls_id = (buf)++;
kenjiArai	0:5b88d5760320	980	tls_id <<= 8;
kenjiArai	0:5b88d5760320	981	tls_id \|= (buf)++;
kenjiArai	0:5b88d5760320	982
kenjiArai	0:5b88d5760320	983	if( ( curve_info = mbedtls_ecp_curve_info_from_tls_id( tls_id ) ) == NULL )
kenjiArai	0:5b88d5760320	984	return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
kenjiArai	0:5b88d5760320	985
kenjiArai	0:5b88d5760320	986	*grp = curve_info->grp_id;
kenjiArai	0:5b88d5760320	987
kenjiArai	0:5b88d5760320	988	return( 0 );
kenjiArai	0:5b88d5760320	989	}
kenjiArai	0:5b88d5760320	990
kenjiArai	0:5b88d5760320	991	/*
kenjiArai	0:5b88d5760320	992	* Write the ECParameters record corresponding to a group (RFC 4492)
kenjiArai	0:5b88d5760320	993	*/
kenjiArai	0:5b88d5760320	994	int mbedtls_ecp_tls_write_group( const mbedtls_ecp_group grp, size_t olen,
kenjiArai	0:5b88d5760320	995	unsigned char *buf, size_t blen )
kenjiArai	0:5b88d5760320	996	{
kenjiArai	0:5b88d5760320	997	const mbedtls_ecp_curve_info *curve_info;
kenjiArai	0:5b88d5760320	998	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	999	ECP_VALIDATE_RET( buf != NULL );
kenjiArai	0:5b88d5760320	1000	ECP_VALIDATE_RET( olen != NULL );
kenjiArai	0:5b88d5760320	1001
kenjiArai	0:5b88d5760320	1002	if( ( curve_info = mbedtls_ecp_curve_info_from_grp_id( grp->id ) ) == NULL )
kenjiArai	0:5b88d5760320	1003	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	1004
kenjiArai	0:5b88d5760320	1005	/*
kenjiArai	0:5b88d5760320	1006	* We are going to write 3 bytes (see below)
kenjiArai	0:5b88d5760320	1007	*/
kenjiArai	0:5b88d5760320	1008	*olen = 3;
kenjiArai	0:5b88d5760320	1009	if( blen < *olen )
kenjiArai	0:5b88d5760320	1010	return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
kenjiArai	0:5b88d5760320	1011
kenjiArai	0:5b88d5760320	1012	/*
kenjiArai	0:5b88d5760320	1013	* First byte is curve_type, always named_curve
kenjiArai	0:5b88d5760320	1014	*/
kenjiArai	0:5b88d5760320	1015	*buf++ = MBEDTLS_ECP_TLS_NAMED_CURVE;
kenjiArai	0:5b88d5760320	1016
kenjiArai	0:5b88d5760320	1017	/*
kenjiArai	0:5b88d5760320	1018	* Next two bytes are the namedcurve value
kenjiArai	0:5b88d5760320	1019	*/
kenjiArai	0:5b88d5760320	1020	buf[0] = curve_info->tls_id >> 8;
kenjiArai	0:5b88d5760320	1021	buf[1] = curve_info->tls_id & 0xFF;
kenjiArai	0:5b88d5760320	1022
kenjiArai	0:5b88d5760320	1023	return( 0 );
kenjiArai	0:5b88d5760320	1024	}
kenjiArai	0:5b88d5760320	1025
kenjiArai	0:5b88d5760320	1026	/*
kenjiArai	0:5b88d5760320	1027	* Wrapper around fast quasi-modp functions, with fall-back to mbedtls_mpi_mod_mpi.
kenjiArai	0:5b88d5760320	1028	* See the documentation of struct mbedtls_ecp_group.
kenjiArai	0:5b88d5760320	1029	*
kenjiArai	0:5b88d5760320	1030	* This function is in the critial loop for mbedtls_ecp_mul, so pay attention to perf.
kenjiArai	0:5b88d5760320	1031	*/
kenjiArai	0:5b88d5760320	1032	static int ecp_modp( mbedtls_mpi N, const mbedtls_ecp_group grp )
kenjiArai	0:5b88d5760320	1033	{
kenjiArai	0:5b88d5760320	1034	int ret;
kenjiArai	0:5b88d5760320	1035
kenjiArai	0:5b88d5760320	1036	if( grp->modp == NULL )
kenjiArai	0:5b88d5760320	1037	return( mbedtls_mpi_mod_mpi( N, N, &grp->P ) );
kenjiArai	0:5b88d5760320	1038
kenjiArai	0:5b88d5760320	1039	/* N->s < 0 is a much faster test, which fails only if N is 0 */
kenjiArai	0:5b88d5760320	1040	if( ( N->s < 0 && mbedtls_mpi_cmp_int( N, 0 ) != 0 ) \|\|
kenjiArai	0:5b88d5760320	1041	mbedtls_mpi_bitlen( N ) > 2 * grp->pbits )
kenjiArai	0:5b88d5760320	1042	{
kenjiArai	0:5b88d5760320	1043	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	1044	}
kenjiArai	0:5b88d5760320	1045
kenjiArai	0:5b88d5760320	1046	MBEDTLS_MPI_CHK( grp->modp( N ) );
kenjiArai	0:5b88d5760320	1047
kenjiArai	0:5b88d5760320	1048	/* N->s < 0 is a much faster test, which fails only if N is 0 */
kenjiArai	0:5b88d5760320	1049	while( N->s < 0 && mbedtls_mpi_cmp_int( N, 0 ) != 0 )
kenjiArai	0:5b88d5760320	1050	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &grp->P ) );
kenjiArai	0:5b88d5760320	1051
kenjiArai	0:5b88d5760320	1052	while( mbedtls_mpi_cmp_mpi( N, &grp->P ) >= 0 )
kenjiArai	0:5b88d5760320	1053	/* we known P, N and the result are positive */
kenjiArai	0:5b88d5760320	1054	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( N, N, &grp->P ) );
kenjiArai	0:5b88d5760320	1055
kenjiArai	0:5b88d5760320	1056	cleanup:
kenjiArai	0:5b88d5760320	1057	return( ret );
kenjiArai	0:5b88d5760320	1058	}
kenjiArai	0:5b88d5760320	1059
kenjiArai	0:5b88d5760320	1060	/*
kenjiArai	0:5b88d5760320	1061	* Fast mod-p functions expect their argument to be in the 0..p^2 range.
kenjiArai	0:5b88d5760320	1062	*
kenjiArai	0:5b88d5760320	1063	* In order to guarantee that, we need to ensure that operands of
kenjiArai	0:5b88d5760320	1064	* mbedtls_mpi_mul_mpi are in the 0..p range. So, after each operation we will
kenjiArai	0:5b88d5760320	1065	* bring the result back to this range.
kenjiArai	0:5b88d5760320	1066	*
kenjiArai	0:5b88d5760320	1067	* The following macros are shortcuts for doing that.
kenjiArai	0:5b88d5760320	1068	*/
kenjiArai	0:5b88d5760320	1069
kenjiArai	0:5b88d5760320	1070	/*
kenjiArai	0:5b88d5760320	1071	* Reduce a mbedtls_mpi mod p in-place, general case, to use after mbedtls_mpi_mul_mpi
kenjiArai	0:5b88d5760320	1072	*/
kenjiArai	0:5b88d5760320	1073	#if defined(MBEDTLS_SELF_TEST)
kenjiArai	0:5b88d5760320	1074	#define INC_MUL_COUNT mul_count++;
kenjiArai	0:5b88d5760320	1075	#else
kenjiArai	0:5b88d5760320	1076	#define INC_MUL_COUNT
kenjiArai	0:5b88d5760320	1077	#endif
kenjiArai	0:5b88d5760320	1078
kenjiArai	0:5b88d5760320	1079	#define MOD_MUL( N ) \
kenjiArai	0:5b88d5760320	1080	do \
kenjiArai	0:5b88d5760320	1081	{ \
kenjiArai	0:5b88d5760320	1082	MBEDTLS_MPI_CHK( ecp_modp( &(N), grp ) ); \
kenjiArai	0:5b88d5760320	1083	INC_MUL_COUNT \
kenjiArai	0:5b88d5760320	1084	} while( 0 )
kenjiArai	0:5b88d5760320	1085
kenjiArai	1:9db0e321a9f4	1086	static inline int mbedtls_mpi_mul_mod( const mbedtls_ecp_group *grp,
kenjiArai	1:9db0e321a9f4	1087	mbedtls_mpi *X,
kenjiArai	1:9db0e321a9f4	1088	const mbedtls_mpi *A,
kenjiArai	1:9db0e321a9f4	1089	const mbedtls_mpi *B )
kenjiArai	1:9db0e321a9f4	1090	{
kenjiArai	1:9db0e321a9f4	1091	int ret;
kenjiArai	1:9db0e321a9f4	1092	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( X, A, B ) );
kenjiArai	1:9db0e321a9f4	1093	MOD_MUL( *X );
kenjiArai	1:9db0e321a9f4	1094	cleanup:
kenjiArai	1:9db0e321a9f4	1095	return( ret );
kenjiArai	1:9db0e321a9f4	1096	}
kenjiArai	1:9db0e321a9f4	1097
kenjiArai	0:5b88d5760320	1098	/*
kenjiArai	0:5b88d5760320	1099	* Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_sub_mpi
kenjiArai	0:5b88d5760320	1100	* N->s < 0 is a very fast test, which fails only if N is 0
kenjiArai	0:5b88d5760320	1101	*/
kenjiArai	0:5b88d5760320	1102	#define MOD_SUB( N ) \
kenjiArai	0:5b88d5760320	1103	while( (N).s < 0 && mbedtls_mpi_cmp_int( &(N), 0 ) != 0 ) \
kenjiArai	0:5b88d5760320	1104	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &(N), &(N), &grp->P ) )
kenjiArai	0:5b88d5760320	1105
kenjiArai	1:9db0e321a9f4	1106	static inline int mbedtls_mpi_sub_mod( const mbedtls_ecp_group *grp,
kenjiArai	1:9db0e321a9f4	1107	mbedtls_mpi *X,
kenjiArai	1:9db0e321a9f4	1108	const mbedtls_mpi *A,
kenjiArai	1:9db0e321a9f4	1109	const mbedtls_mpi *B )
kenjiArai	1:9db0e321a9f4	1110	{
kenjiArai	1:9db0e321a9f4	1111	int ret;
kenjiArai	1:9db0e321a9f4	1112	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( X, A, B ) );
kenjiArai	1:9db0e321a9f4	1113	MOD_SUB( *X );
kenjiArai	1:9db0e321a9f4	1114	cleanup:
kenjiArai	1:9db0e321a9f4	1115	return( ret );
kenjiArai	1:9db0e321a9f4	1116	}
kenjiArai	1:9db0e321a9f4	1117
kenjiArai	0:5b88d5760320	1118	/*
kenjiArai	0:5b88d5760320	1119	* Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_add_mpi and mbedtls_mpi_mul_int.
kenjiArai	0:5b88d5760320	1120	* We known P, N and the result are positive, so sub_abs is correct, and
kenjiArai	0:5b88d5760320	1121	* a bit faster.
kenjiArai	0:5b88d5760320	1122	*/
kenjiArai	0:5b88d5760320	1123	#define MOD_ADD( N ) \
kenjiArai	0:5b88d5760320	1124	while( mbedtls_mpi_cmp_mpi( &(N), &grp->P ) >= 0 ) \
kenjiArai	0:5b88d5760320	1125	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( &(N), &(N), &grp->P ) )
kenjiArai	0:5b88d5760320	1126
kenjiArai	1:9db0e321a9f4	1127	static inline int mbedtls_mpi_add_mod( const mbedtls_ecp_group *grp,
kenjiArai	1:9db0e321a9f4	1128	mbedtls_mpi *X,
kenjiArai	1:9db0e321a9f4	1129	const mbedtls_mpi *A,
kenjiArai	1:9db0e321a9f4	1130	const mbedtls_mpi *B )
kenjiArai	1:9db0e321a9f4	1131	{
kenjiArai	1:9db0e321a9f4	1132	int ret;
kenjiArai	1:9db0e321a9f4	1133	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( X, A, B ) );
kenjiArai	1:9db0e321a9f4	1134	MOD_ADD( *X );
kenjiArai	1:9db0e321a9f4	1135	cleanup:
kenjiArai	1:9db0e321a9f4	1136	return( ret );
kenjiArai	1:9db0e321a9f4	1137	}
kenjiArai	1:9db0e321a9f4	1138
kenjiArai	1:9db0e321a9f4	1139	static inline int mbedtls_mpi_shift_l_mod( const mbedtls_ecp_group *grp,
kenjiArai	1:9db0e321a9f4	1140	mbedtls_mpi *X,
kenjiArai	1:9db0e321a9f4	1141	size_t count )
kenjiArai	1:9db0e321a9f4	1142	{
kenjiArai	1:9db0e321a9f4	1143	int ret;
kenjiArai	1:9db0e321a9f4	1144	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( X, count ) );
kenjiArai	1:9db0e321a9f4	1145	MOD_ADD( *X );
kenjiArai	1:9db0e321a9f4	1146	cleanup:
kenjiArai	1:9db0e321a9f4	1147	return( ret );
kenjiArai	1:9db0e321a9f4	1148	}
kenjiArai	1:9db0e321a9f4	1149
kenjiArai	0:5b88d5760320	1150	#if defined(ECP_SHORTWEIERSTRASS)
kenjiArai	0:5b88d5760320	1151	/*
kenjiArai	0:5b88d5760320	1152	* For curves in short Weierstrass form, we do all the internal operations in
kenjiArai	0:5b88d5760320	1153	* Jacobian coordinates.
kenjiArai	0:5b88d5760320	1154	*
kenjiArai	0:5b88d5760320	1155	* For multiplication, we'll use a comb method with coutermeasueres against
kenjiArai	0:5b88d5760320	1156	* SPA, hence timing attacks.
kenjiArai	0:5b88d5760320	1157	*/
kenjiArai	0:5b88d5760320	1158
kenjiArai	0:5b88d5760320	1159	/*
kenjiArai	0:5b88d5760320	1160	* Normalize jacobian coordinates so that Z == 0 \|\| Z == 1 (GECC 3.2.1)
kenjiArai	0:5b88d5760320	1161	* Cost: 1N := 1I + 3M + 1S
kenjiArai	0:5b88d5760320	1162	*/
kenjiArai	0:5b88d5760320	1163	static int ecp_normalize_jac( const mbedtls_ecp_group grp, mbedtls_ecp_point pt )
kenjiArai	0:5b88d5760320	1164	{
kenjiArai	0:5b88d5760320	1165	int ret;
kenjiArai	0:5b88d5760320	1166	mbedtls_mpi Zi, ZZi;
kenjiArai	0:5b88d5760320	1167
kenjiArai	0:5b88d5760320	1168	if( mbedtls_mpi_cmp_int( &pt->Z, 0 ) == 0 )
kenjiArai	0:5b88d5760320	1169	return( 0 );
kenjiArai	0:5b88d5760320	1170
kenjiArai	0:5b88d5760320	1171	#if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT)
kenjiArai	0:5b88d5760320	1172	if( mbedtls_internal_ecp_grp_capable( grp ) )
kenjiArai	0:5b88d5760320	1173	return( mbedtls_internal_ecp_normalize_jac( grp, pt ) );
kenjiArai	0:5b88d5760320	1174	#endif /* MBEDTLS_ECP_NORMALIZE_JAC_ALT */
kenjiArai	0:5b88d5760320	1175
kenjiArai	0:5b88d5760320	1176	mbedtls_mpi_init( &Zi ); mbedtls_mpi_init( &ZZi );
kenjiArai	0:5b88d5760320	1177
kenjiArai	0:5b88d5760320	1178	/*
kenjiArai	0:5b88d5760320	1179	* X = X / Z^2 mod p
kenjiArai	0:5b88d5760320	1180	*/
kenjiArai	0:5b88d5760320	1181	MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &Zi, &pt->Z, &grp->P ) );
kenjiArai	1:9db0e321a9f4	1182	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &ZZi, &Zi, &Zi ) );
kenjiArai	1:9db0e321a9f4	1183	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &pt->X, &pt->X, &ZZi ) );
kenjiArai	0:5b88d5760320	1184
kenjiArai	0:5b88d5760320	1185	/*
kenjiArai	0:5b88d5760320	1186	* Y = Y / Z^3 mod p
kenjiArai	0:5b88d5760320	1187	*/
kenjiArai	1:9db0e321a9f4	1188	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &pt->Y, &pt->Y, &ZZi ) );
kenjiArai	1:9db0e321a9f4	1189	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &pt->Y, &pt->Y, &Zi ) );
kenjiArai	0:5b88d5760320	1190
kenjiArai	0:5b88d5760320	1191	/*
kenjiArai	0:5b88d5760320	1192	* Z = 1
kenjiArai	0:5b88d5760320	1193	*/
kenjiArai	0:5b88d5760320	1194	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z, 1 ) );
kenjiArai	0:5b88d5760320	1195
kenjiArai	0:5b88d5760320	1196	cleanup:
kenjiArai	0:5b88d5760320	1197
kenjiArai	0:5b88d5760320	1198	mbedtls_mpi_free( &Zi ); mbedtls_mpi_free( &ZZi );
kenjiArai	0:5b88d5760320	1199
kenjiArai	0:5b88d5760320	1200	return( ret );
kenjiArai	0:5b88d5760320	1201	}
kenjiArai	0:5b88d5760320	1202
kenjiArai	0:5b88d5760320	1203	/*
kenjiArai	0:5b88d5760320	1204	* Normalize jacobian coordinates of an array of (pointers to) points,
kenjiArai	0:5b88d5760320	1205	* using Montgomery's trick to perform only one inversion mod P.
kenjiArai	0:5b88d5760320	1206	* (See for example Cohen's "A Course in Computational Algebraic Number
kenjiArai	0:5b88d5760320	1207	* Theory", Algorithm 10.3.4.)
kenjiArai	0:5b88d5760320	1208	*
kenjiArai	0:5b88d5760320	1209	* Warning: fails (returning an error) if one of the points is zero!
kenjiArai	0:5b88d5760320	1210	* This should never happen, see choice of w in ecp_mul_comb().
kenjiArai	0:5b88d5760320	1211	*
kenjiArai	0:5b88d5760320	1212	* Cost: 1N(t) := 1I + (6t - 3)M + 1S
kenjiArai	0:5b88d5760320	1213	*/
kenjiArai	0:5b88d5760320	1214	static int ecp_normalize_jac_many( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	1215	mbedtls_ecp_point *T[], size_t T_size )
kenjiArai	0:5b88d5760320	1216	{
kenjiArai	0:5b88d5760320	1217	int ret;
kenjiArai	0:5b88d5760320	1218	size_t i;
kenjiArai	0:5b88d5760320	1219	mbedtls_mpi *c, u, Zi, ZZi;
kenjiArai	0:5b88d5760320	1220
kenjiArai	0:5b88d5760320	1221	if( T_size < 2 )
kenjiArai	0:5b88d5760320	1222	return( ecp_normalize_jac( grp, *T ) );
kenjiArai	0:5b88d5760320	1223
kenjiArai	0:5b88d5760320	1224	#if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT)
kenjiArai	0:5b88d5760320	1225	if( mbedtls_internal_ecp_grp_capable( grp ) )
kenjiArai	0:5b88d5760320	1226	return( mbedtls_internal_ecp_normalize_jac_many( grp, T, T_size ) );
kenjiArai	0:5b88d5760320	1227	#endif
kenjiArai	0:5b88d5760320	1228
kenjiArai	0:5b88d5760320	1229	if( ( c = mbedtls_calloc( T_size, sizeof( mbedtls_mpi ) ) ) == NULL )
kenjiArai	0:5b88d5760320	1230	return( MBEDTLS_ERR_ECP_ALLOC_FAILED );
kenjiArai	0:5b88d5760320	1231
kenjiArai	0:5b88d5760320	1232	for( i = 0; i < T_size; i++ )
kenjiArai	0:5b88d5760320	1233	mbedtls_mpi_init( &c[i] );
kenjiArai	0:5b88d5760320	1234
kenjiArai	0:5b88d5760320	1235	mbedtls_mpi_init( &u ); mbedtls_mpi_init( &Zi ); mbedtls_mpi_init( &ZZi );
kenjiArai	0:5b88d5760320	1236
kenjiArai	0:5b88d5760320	1237	/*
kenjiArai	0:5b88d5760320	1238	* c[i] = Z_0 * ... * Z_i
kenjiArai	0:5b88d5760320	1239	*/
kenjiArai	0:5b88d5760320	1240	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &c[0], &T[0]->Z ) );
kenjiArai	0:5b88d5760320	1241	for( i = 1; i < T_size; i++ )
kenjiArai	0:5b88d5760320	1242	{
kenjiArai	1:9db0e321a9f4	1243	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &c[i], &c[i-1], &T[i]->Z ) );
kenjiArai	0:5b88d5760320	1244	}
kenjiArai	0:5b88d5760320	1245
kenjiArai	0:5b88d5760320	1246	/*
kenjiArai	0:5b88d5760320	1247	* u = 1 / (Z_0 * ... * Z_n) mod P
kenjiArai	0:5b88d5760320	1248	*/
kenjiArai	0:5b88d5760320	1249	MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &u, &c[T_size-1], &grp->P ) );
kenjiArai	0:5b88d5760320	1250
kenjiArai	0:5b88d5760320	1251	for( i = T_size - 1; ; i-- )
kenjiArai	0:5b88d5760320	1252	{
kenjiArai	0:5b88d5760320	1253	/*
kenjiArai	0:5b88d5760320	1254	* Zi = 1 / Z_i mod p
kenjiArai	0:5b88d5760320	1255	* u = 1 / (Z_0 * ... * Z_i) mod P
kenjiArai	0:5b88d5760320	1256	*/
kenjiArai	0:5b88d5760320	1257	if( i == 0 ) {
kenjiArai	0:5b88d5760320	1258	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &Zi, &u ) );
kenjiArai	0:5b88d5760320	1259	}
kenjiArai	0:5b88d5760320	1260	else
kenjiArai	0:5b88d5760320	1261	{
kenjiArai	1:9db0e321a9f4	1262	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &Zi, &u, &c[i-1] ) );
kenjiArai	1:9db0e321a9f4	1263	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &u, &u, &T[i]->Z ) );
kenjiArai	0:5b88d5760320	1264	}
kenjiArai	0:5b88d5760320	1265
kenjiArai	0:5b88d5760320	1266	/*
kenjiArai	0:5b88d5760320	1267	* proceed as in normalize()
kenjiArai	0:5b88d5760320	1268	*/
kenjiArai	1:9db0e321a9f4	1269	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &ZZi, &Zi, &Zi ) );
kenjiArai	1:9db0e321a9f4	1270	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T[i]->X, &T[i]->X, &ZZi ) );
kenjiArai	1:9db0e321a9f4	1271	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T[i]->Y, &T[i]->Y, &ZZi ) );
kenjiArai	1:9db0e321a9f4	1272	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T[i]->Y, &T[i]->Y, &Zi ) );
kenjiArai	0:5b88d5760320	1273
kenjiArai	0:5b88d5760320	1274	/*
kenjiArai	0:5b88d5760320	1275	* Post-precessing: reclaim some memory by shrinking coordinates
kenjiArai	0:5b88d5760320	1276	* - not storing Z (always 1)
kenjiArai	0:5b88d5760320	1277	* - shrinking other coordinates, but still keeping the same number of
kenjiArai	0:5b88d5760320	1278	* limbs as P, as otherwise it will too likely be regrown too fast.
kenjiArai	0:5b88d5760320	1279	*/
kenjiArai	0:5b88d5760320	1280	MBEDTLS_MPI_CHK( mbedtls_mpi_shrink( &T[i]->X, grp->P.n ) );
kenjiArai	0:5b88d5760320	1281	MBEDTLS_MPI_CHK( mbedtls_mpi_shrink( &T[i]->Y, grp->P.n ) );
kenjiArai	0:5b88d5760320	1282	mbedtls_mpi_free( &T[i]->Z );
kenjiArai	0:5b88d5760320	1283
kenjiArai	0:5b88d5760320	1284	if( i == 0 )
kenjiArai	0:5b88d5760320	1285	break;
kenjiArai	0:5b88d5760320	1286	}
kenjiArai	0:5b88d5760320	1287
kenjiArai	0:5b88d5760320	1288	cleanup:
kenjiArai	0:5b88d5760320	1289
kenjiArai	0:5b88d5760320	1290	mbedtls_mpi_free( &u ); mbedtls_mpi_free( &Zi ); mbedtls_mpi_free( &ZZi );
kenjiArai	0:5b88d5760320	1291	for( i = 0; i < T_size; i++ )
kenjiArai	0:5b88d5760320	1292	mbedtls_mpi_free( &c[i] );
kenjiArai	0:5b88d5760320	1293	mbedtls_free( c );
kenjiArai	0:5b88d5760320	1294
kenjiArai	0:5b88d5760320	1295	return( ret );
kenjiArai	0:5b88d5760320	1296	}
kenjiArai	0:5b88d5760320	1297
kenjiArai	0:5b88d5760320	1298	/*
kenjiArai	0:5b88d5760320	1299	* Conditional point inversion: Q -> -Q = (Q.X, -Q.Y, Q.Z) without leak.
kenjiArai	0:5b88d5760320	1300	* "inv" must be 0 (don't invert) or 1 (invert) or the result will be invalid
kenjiArai	0:5b88d5760320	1301	*/
kenjiArai	0:5b88d5760320	1302	static int ecp_safe_invert_jac( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	1303	mbedtls_ecp_point *Q,
kenjiArai	0:5b88d5760320	1304	unsigned char inv )
kenjiArai	0:5b88d5760320	1305	{
kenjiArai	0:5b88d5760320	1306	int ret;
kenjiArai	0:5b88d5760320	1307	unsigned char nonzero;
kenjiArai	0:5b88d5760320	1308	mbedtls_mpi mQY;
kenjiArai	0:5b88d5760320	1309
kenjiArai	0:5b88d5760320	1310	mbedtls_mpi_init( &mQY );
kenjiArai	0:5b88d5760320	1311
kenjiArai	0:5b88d5760320	1312	/* Use the fact that -Q.Y mod P = P - Q.Y unless Q.Y == 0 */
kenjiArai	0:5b88d5760320	1313	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &mQY, &grp->P, &Q->Y ) );
kenjiArai	0:5b88d5760320	1314	nonzero = mbedtls_mpi_cmp_int( &Q->Y, 0 ) != 0;
kenjiArai	0:5b88d5760320	1315	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &Q->Y, &mQY, inv & nonzero ) );
kenjiArai	0:5b88d5760320	1316
kenjiArai	0:5b88d5760320	1317	cleanup:
kenjiArai	0:5b88d5760320	1318	mbedtls_mpi_free( &mQY );
kenjiArai	0:5b88d5760320	1319
kenjiArai	0:5b88d5760320	1320	return( ret );
kenjiArai	0:5b88d5760320	1321	}
kenjiArai	0:5b88d5760320	1322
kenjiArai	0:5b88d5760320	1323	/*
kenjiArai	0:5b88d5760320	1324	* Point doubling R = 2 P, Jacobian coordinates
kenjiArai	0:5b88d5760320	1325	*
kenjiArai	0:5b88d5760320	1326	* Based on http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#doubling-dbl-1998-cmo-2 .
kenjiArai	0:5b88d5760320	1327	*
kenjiArai	0:5b88d5760320	1328	* We follow the variable naming fairly closely. The formula variations that trade a MUL for a SQR
kenjiArai	0:5b88d5760320	1329	* (plus a few ADDs) aren't useful as our bignum implementation doesn't distinguish squaring.
kenjiArai	0:5b88d5760320	1330	*
kenjiArai	0:5b88d5760320	1331	* Standard optimizations are applied when curve parameter A is one of { 0, -3 }.
kenjiArai	0:5b88d5760320	1332	*
kenjiArai	0:5b88d5760320	1333	* Cost: 1D := 3M + 4S (A == 0)
kenjiArai	0:5b88d5760320	1334	* 4M + 4S (A == -3)
kenjiArai	0:5b88d5760320	1335	* 3M + 6S + 1a otherwise
kenjiArai	0:5b88d5760320	1336	*/
kenjiArai	0:5b88d5760320	1337	static int ecp_double_jac( const mbedtls_ecp_group grp, mbedtls_ecp_point R,
kenjiArai	0:5b88d5760320	1338	const mbedtls_ecp_point *P )
kenjiArai	0:5b88d5760320	1339	{
kenjiArai	0:5b88d5760320	1340	int ret;
kenjiArai	0:5b88d5760320	1341	mbedtls_mpi M, S, T, U;
kenjiArai	0:5b88d5760320	1342
kenjiArai	0:5b88d5760320	1343	#if defined(MBEDTLS_SELF_TEST)
kenjiArai	0:5b88d5760320	1344	dbl_count++;
kenjiArai	0:5b88d5760320	1345	#endif
kenjiArai	0:5b88d5760320	1346
kenjiArai	0:5b88d5760320	1347	#if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT)
kenjiArai	0:5b88d5760320	1348	if( mbedtls_internal_ecp_grp_capable( grp ) )
kenjiArai	0:5b88d5760320	1349	return( mbedtls_internal_ecp_double_jac( grp, R, P ) );
kenjiArai	0:5b88d5760320	1350	#endif /* MBEDTLS_ECP_DOUBLE_JAC_ALT */
kenjiArai	0:5b88d5760320	1351
kenjiArai	0:5b88d5760320	1352	mbedtls_mpi_init( &M ); mbedtls_mpi_init( &S ); mbedtls_mpi_init( &T ); mbedtls_mpi_init( &U );
kenjiArai	0:5b88d5760320	1353
kenjiArai	0:5b88d5760320	1354	/* Special case for A = -3 */
kenjiArai	0:5b88d5760320	1355	if( grp->A.p == NULL )
kenjiArai	0:5b88d5760320	1356	{
kenjiArai	0:5b88d5760320	1357	/* M = 3(X + Z^2)(X - Z^2) */
kenjiArai	1:9db0e321a9f4	1358	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &P->Z, &P->Z ) );
kenjiArai	1:9db0e321a9f4	1359	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &T, &P->X, &S ) );
kenjiArai	1:9db0e321a9f4	1360	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &U, &P->X, &S ) );
kenjiArai	1:9db0e321a9f4	1361	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &T, &U ) );
kenjiArai	0:5b88d5760320	1362	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &M, &S, 3 ) ); MOD_ADD( M );
kenjiArai	0:5b88d5760320	1363	}
kenjiArai	0:5b88d5760320	1364	else
kenjiArai	0:5b88d5760320	1365	{
kenjiArai	0:5b88d5760320	1366	/* M = 3.X^2 */
kenjiArai	1:9db0e321a9f4	1367	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &P->X, &P->X ) );
kenjiArai	0:5b88d5760320	1368	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &M, &S, 3 ) ); MOD_ADD( M );
kenjiArai	0:5b88d5760320	1369
kenjiArai	0:5b88d5760320	1370	/* Optimize away for "koblitz" curves with A = 0 */
kenjiArai	0:5b88d5760320	1371	if( mbedtls_mpi_cmp_int( &grp->A, 0 ) != 0 )
kenjiArai	0:5b88d5760320	1372	{
kenjiArai	0:5b88d5760320	1373	/* M += A.Z^4 */
kenjiArai	1:9db0e321a9f4	1374	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &P->Z, &P->Z ) );
kenjiArai	1:9db0e321a9f4	1375	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T, &S, &S ) );
kenjiArai	1:9db0e321a9f4	1376	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &T, &grp->A ) );
kenjiArai	1:9db0e321a9f4	1377	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &M, &M, &S ) );
kenjiArai	0:5b88d5760320	1378	}
kenjiArai	0:5b88d5760320	1379	}
kenjiArai	0:5b88d5760320	1380
kenjiArai	0:5b88d5760320	1381	/* S = 4.X.Y^2 */
kenjiArai	1:9db0e321a9f4	1382	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T, &P->Y, &P->Y ) );
kenjiArai	1:9db0e321a9f4	1383	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l_mod( grp, &T, 1 ) );
kenjiArai	1:9db0e321a9f4	1384	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &P->X, &T ) );
kenjiArai	1:9db0e321a9f4	1385	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l_mod( grp, &S, 1 ) );
kenjiArai	0:5b88d5760320	1386
kenjiArai	0:5b88d5760320	1387	/* U = 8.Y^4 */
kenjiArai	1:9db0e321a9f4	1388	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &U, &T, &T ) );
kenjiArai	1:9db0e321a9f4	1389	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l_mod( grp, &U, 1 ) );
kenjiArai	0:5b88d5760320	1390
kenjiArai	0:5b88d5760320	1391	/* T = M^2 - 2.S */
kenjiArai	1:9db0e321a9f4	1392	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T, &M, &M ) );
kenjiArai	1:9db0e321a9f4	1393	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &T, &T, &S ) );
kenjiArai	1:9db0e321a9f4	1394	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &T, &T, &S ) );
kenjiArai	0:5b88d5760320	1395
kenjiArai	0:5b88d5760320	1396	/* S = M(S - T) - U */
kenjiArai	1:9db0e321a9f4	1397	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &S, &S, &T ) );
kenjiArai	1:9db0e321a9f4	1398	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &S, &M ) );
kenjiArai	1:9db0e321a9f4	1399	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &S, &S, &U ) );
kenjiArai	0:5b88d5760320	1400
kenjiArai	0:5b88d5760320	1401	/* U = 2.Y.Z */
kenjiArai	1:9db0e321a9f4	1402	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &U, &P->Y, &P->Z ) );
kenjiArai	1:9db0e321a9f4	1403	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l_mod( grp, &U, 1 ) );
kenjiArai	0:5b88d5760320	1404
kenjiArai	0:5b88d5760320	1405	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->X, &T ) );
kenjiArai	0:5b88d5760320	1406	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Y, &S ) );
kenjiArai	0:5b88d5760320	1407	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Z, &U ) );
kenjiArai	0:5b88d5760320	1408
kenjiArai	0:5b88d5760320	1409	cleanup:
kenjiArai	0:5b88d5760320	1410	mbedtls_mpi_free( &M ); mbedtls_mpi_free( &S ); mbedtls_mpi_free( &T ); mbedtls_mpi_free( &U );
kenjiArai	0:5b88d5760320	1411
kenjiArai	0:5b88d5760320	1412	return( ret );
kenjiArai	0:5b88d5760320	1413	}
kenjiArai	0:5b88d5760320	1414
kenjiArai	0:5b88d5760320	1415	/*
kenjiArai	0:5b88d5760320	1416	* Addition: R = P + Q, mixed affine-Jacobian coordinates (GECC 3.22)
kenjiArai	0:5b88d5760320	1417	*
kenjiArai	0:5b88d5760320	1418	* The coordinates of Q must be normalized (= affine),
kenjiArai	0:5b88d5760320	1419	* but those of P don't need to. R is not normalized.
kenjiArai	0:5b88d5760320	1420	*
kenjiArai	0:5b88d5760320	1421	* Special cases: (1) P or Q is zero, (2) R is zero, (3) P == Q.
kenjiArai	0:5b88d5760320	1422	* None of these cases can happen as intermediate step in ecp_mul_comb():
kenjiArai	0:5b88d5760320	1423	* - at each step, P, Q and R are multiples of the base point, the factor
kenjiArai	0:5b88d5760320	1424	* being less than its order, so none of them is zero;
kenjiArai	0:5b88d5760320	1425	* - Q is an odd multiple of the base point, P an even multiple,
kenjiArai	0:5b88d5760320	1426	* due to the choice of precomputed points in the modified comb method.
kenjiArai	0:5b88d5760320	1427	* So branches for these cases do not leak secret information.
kenjiArai	0:5b88d5760320	1428	*
kenjiArai	0:5b88d5760320	1429	* We accept Q->Z being unset (saving memory in tables) as meaning 1.
kenjiArai	0:5b88d5760320	1430	*
kenjiArai	0:5b88d5760320	1431	* Cost: 1A := 8M + 3S
kenjiArai	0:5b88d5760320	1432	*/
kenjiArai	0:5b88d5760320	1433	static int ecp_add_mixed( const mbedtls_ecp_group grp, mbedtls_ecp_point R,
kenjiArai	0:5b88d5760320	1434	const mbedtls_ecp_point P, const mbedtls_ecp_point Q )
kenjiArai	0:5b88d5760320	1435	{
kenjiArai	0:5b88d5760320	1436	int ret;
kenjiArai	0:5b88d5760320	1437	mbedtls_mpi T1, T2, T3, T4, X, Y, Z;
kenjiArai	0:5b88d5760320	1438
kenjiArai	0:5b88d5760320	1439	#if defined(MBEDTLS_SELF_TEST)
kenjiArai	0:5b88d5760320	1440	add_count++;
kenjiArai	0:5b88d5760320	1441	#endif
kenjiArai	0:5b88d5760320	1442
kenjiArai	0:5b88d5760320	1443	#if defined(MBEDTLS_ECP_ADD_MIXED_ALT)
kenjiArai	0:5b88d5760320	1444	if( mbedtls_internal_ecp_grp_capable( grp ) )
kenjiArai	0:5b88d5760320	1445	return( mbedtls_internal_ecp_add_mixed( grp, R, P, Q ) );
kenjiArai	0:5b88d5760320	1446	#endif /* MBEDTLS_ECP_ADD_MIXED_ALT */
kenjiArai	0:5b88d5760320	1447
kenjiArai	0:5b88d5760320	1448	/*
kenjiArai	0:5b88d5760320	1449	* Trivial cases: P == 0 or Q == 0 (case 1)
kenjiArai	0:5b88d5760320	1450	*/
kenjiArai	0:5b88d5760320	1451	if( mbedtls_mpi_cmp_int( &P->Z, 0 ) == 0 )
kenjiArai	0:5b88d5760320	1452	return( mbedtls_ecp_copy( R, Q ) );
kenjiArai	0:5b88d5760320	1453
kenjiArai	0:5b88d5760320	1454	if( Q->Z.p != NULL && mbedtls_mpi_cmp_int( &Q->Z, 0 ) == 0 )
kenjiArai	0:5b88d5760320	1455	return( mbedtls_ecp_copy( R, P ) );
kenjiArai	0:5b88d5760320	1456
kenjiArai	0:5b88d5760320	1457	/*
kenjiArai	0:5b88d5760320	1458	* Make sure Q coordinates are normalized
kenjiArai	0:5b88d5760320	1459	*/
kenjiArai	0:5b88d5760320	1460	if( Q->Z.p != NULL && mbedtls_mpi_cmp_int( &Q->Z, 1 ) != 0 )
kenjiArai	0:5b88d5760320	1461	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	1462
kenjiArai	0:5b88d5760320	1463	mbedtls_mpi_init( &T1 ); mbedtls_mpi_init( &T2 ); mbedtls_mpi_init( &T3 ); mbedtls_mpi_init( &T4 );
kenjiArai	0:5b88d5760320	1464	mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y ); mbedtls_mpi_init( &Z );
kenjiArai	0:5b88d5760320	1465
kenjiArai	1:9db0e321a9f4	1466	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T1, &P->Z, &P->Z ) );
kenjiArai	1:9db0e321a9f4	1467	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T2, &T1, &P->Z ) );
kenjiArai	1:9db0e321a9f4	1468	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T1, &T1, &Q->X ) );
kenjiArai	1:9db0e321a9f4	1469	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T2, &T2, &Q->Y ) );
kenjiArai	1:9db0e321a9f4	1470	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &T1, &T1, &P->X ) );
kenjiArai	1:9db0e321a9f4	1471	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &T2, &T2, &P->Y ) );
kenjiArai	0:5b88d5760320	1472
kenjiArai	0:5b88d5760320	1473	/* Special cases (2) and (3) */
kenjiArai	0:5b88d5760320	1474	if( mbedtls_mpi_cmp_int( &T1, 0 ) == 0 )
kenjiArai	0:5b88d5760320	1475	{
kenjiArai	0:5b88d5760320	1476	if( mbedtls_mpi_cmp_int( &T2, 0 ) == 0 )
kenjiArai	0:5b88d5760320	1477	{
kenjiArai	0:5b88d5760320	1478	ret = ecp_double_jac( grp, R, P );
kenjiArai	0:5b88d5760320	1479	goto cleanup;
kenjiArai	0:5b88d5760320	1480	}
kenjiArai	0:5b88d5760320	1481	else
kenjiArai	0:5b88d5760320	1482	{
kenjiArai	0:5b88d5760320	1483	ret = mbedtls_ecp_set_zero( R );
kenjiArai	0:5b88d5760320	1484	goto cleanup;
kenjiArai	0:5b88d5760320	1485	}
kenjiArai	0:5b88d5760320	1486	}
kenjiArai	0:5b88d5760320	1487
kenjiArai	1:9db0e321a9f4	1488	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &Z, &P->Z, &T1 ) );
kenjiArai	1:9db0e321a9f4	1489	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T3, &T1, &T1 ) );
kenjiArai	1:9db0e321a9f4	1490	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T4, &T3, &T1 ) );
kenjiArai	1:9db0e321a9f4	1491	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T3, &T3, &P->X ) );
kenjiArai	1:9db0e321a9f4	1492	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &T1, &T3 ) );
kenjiArai	1:9db0e321a9f4	1493	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l_mod( grp, &T1, 1 ) );
kenjiArai	1:9db0e321a9f4	1494	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &X, &T2, &T2 ) );
kenjiArai	1:9db0e321a9f4	1495	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &X, &X, &T1 ) );
kenjiArai	1:9db0e321a9f4	1496	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &X, &X, &T4 ) );
kenjiArai	1:9db0e321a9f4	1497	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &T3, &T3, &X ) );
kenjiArai	1:9db0e321a9f4	1498	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T3, &T3, &T2 ) );
kenjiArai	1:9db0e321a9f4	1499	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T4, &T4, &P->Y ) );
kenjiArai	1:9db0e321a9f4	1500	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &Y, &T3, &T4 ) );
kenjiArai	0:5b88d5760320	1501
kenjiArai	0:5b88d5760320	1502	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->X, &X ) );
kenjiArai	0:5b88d5760320	1503	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Y, &Y ) );
kenjiArai	0:5b88d5760320	1504	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Z, &Z ) );
kenjiArai	0:5b88d5760320	1505
kenjiArai	0:5b88d5760320	1506	cleanup:
kenjiArai	0:5b88d5760320	1507
kenjiArai	0:5b88d5760320	1508	mbedtls_mpi_free( &T1 ); mbedtls_mpi_free( &T2 ); mbedtls_mpi_free( &T3 ); mbedtls_mpi_free( &T4 );
kenjiArai	0:5b88d5760320	1509	mbedtls_mpi_free( &X ); mbedtls_mpi_free( &Y ); mbedtls_mpi_free( &Z );
kenjiArai	0:5b88d5760320	1510
kenjiArai	0:5b88d5760320	1511	return( ret );
kenjiArai	0:5b88d5760320	1512	}
kenjiArai	0:5b88d5760320	1513
kenjiArai	0:5b88d5760320	1514	/*
kenjiArai	0:5b88d5760320	1515	* Randomize jacobian coordinates:
kenjiArai	0:5b88d5760320	1516	* (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l
kenjiArai	0:5b88d5760320	1517	* This is sort of the reverse operation of ecp_normalize_jac().
kenjiArai	0:5b88d5760320	1518	*
kenjiArai	0:5b88d5760320	1519	* This countermeasure was first suggested in [2].
kenjiArai	0:5b88d5760320	1520	*/
kenjiArai	0:5b88d5760320	1521	static int ecp_randomize_jac( const mbedtls_ecp_group grp, mbedtls_ecp_point pt,
kenjiArai	0:5b88d5760320	1522	int (f_rng)(void , unsigned char , size_t), void p_rng )
kenjiArai	0:5b88d5760320	1523	{
kenjiArai	0:5b88d5760320	1524	int ret;
kenjiArai	0:5b88d5760320	1525	mbedtls_mpi l, ll;
kenjiArai	0:5b88d5760320	1526	size_t p_size;
kenjiArai	0:5b88d5760320	1527	int count = 0;
kenjiArai	0:5b88d5760320	1528
kenjiArai	0:5b88d5760320	1529	#if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT)
kenjiArai	0:5b88d5760320	1530	if( mbedtls_internal_ecp_grp_capable( grp ) )
kenjiArai	0:5b88d5760320	1531	return( mbedtls_internal_ecp_randomize_jac( grp, pt, f_rng, p_rng ) );
kenjiArai	0:5b88d5760320	1532	#endif /* MBEDTLS_ECP_RANDOMIZE_JAC_ALT */
kenjiArai	0:5b88d5760320	1533
kenjiArai	0:5b88d5760320	1534	p_size = ( grp->pbits + 7 ) / 8;
kenjiArai	0:5b88d5760320	1535	mbedtls_mpi_init( &l ); mbedtls_mpi_init( &ll );
kenjiArai	0:5b88d5760320	1536
kenjiArai	0:5b88d5760320	1537	/* Generate l such that 1 < l < p */
kenjiArai	0:5b88d5760320	1538	do
kenjiArai	0:5b88d5760320	1539	{
kenjiArai	0:5b88d5760320	1540	MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &l, p_size, f_rng, p_rng ) );
kenjiArai	0:5b88d5760320	1541
kenjiArai	0:5b88d5760320	1542	while( mbedtls_mpi_cmp_mpi( &l, &grp->P ) >= 0 )
kenjiArai	0:5b88d5760320	1543	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, 1 ) );
kenjiArai	0:5b88d5760320	1544
kenjiArai	0:5b88d5760320	1545	if( count++ > 10 )
kenjiArai	0:5b88d5760320	1546	return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
kenjiArai	0:5b88d5760320	1547	}
kenjiArai	0:5b88d5760320	1548	while( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 );
kenjiArai	0:5b88d5760320	1549
kenjiArai	0:5b88d5760320	1550	/* Z = l * Z */
kenjiArai	1:9db0e321a9f4	1551	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &pt->Z, &pt->Z, &l ) );
kenjiArai	0:5b88d5760320	1552
kenjiArai	0:5b88d5760320	1553	/* X = l^2 * X */
kenjiArai	1:9db0e321a9f4	1554	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &ll, &l, &l ) );
kenjiArai	1:9db0e321a9f4	1555	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &pt->X, &pt->X, &ll ) );
kenjiArai	0:5b88d5760320	1556
kenjiArai	0:5b88d5760320	1557	/* Y = l^3 * Y */
kenjiArai	1:9db0e321a9f4	1558	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &ll, &ll, &l ) );
kenjiArai	1:9db0e321a9f4	1559	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &pt->Y, &pt->Y, &ll ) );
kenjiArai	0:5b88d5760320	1560
kenjiArai	0:5b88d5760320	1561	cleanup:
kenjiArai	0:5b88d5760320	1562	mbedtls_mpi_free( &l ); mbedtls_mpi_free( &ll );
kenjiArai	0:5b88d5760320	1563
kenjiArai	0:5b88d5760320	1564	return( ret );
kenjiArai	0:5b88d5760320	1565	}
kenjiArai	0:5b88d5760320	1566
kenjiArai	0:5b88d5760320	1567	/*
kenjiArai	0:5b88d5760320	1568	* Check and define parameters used by the comb method (see below for details)
kenjiArai	0:5b88d5760320	1569	*/
kenjiArai	0:5b88d5760320	1570	#if MBEDTLS_ECP_WINDOW_SIZE < 2 \|\| MBEDTLS_ECP_WINDOW_SIZE > 7
kenjiArai	0:5b88d5760320	1571	#error "MBEDTLS_ECP_WINDOW_SIZE out of bounds"
kenjiArai	0:5b88d5760320	1572	#endif
kenjiArai	0:5b88d5760320	1573
kenjiArai	0:5b88d5760320	1574	/* d = ceil( n / w ) */
kenjiArai	0:5b88d5760320	1575	#define COMB_MAX_D ( MBEDTLS_ECP_MAX_BITS + 1 ) / 2
kenjiArai	0:5b88d5760320	1576
kenjiArai	0:5b88d5760320	1577	/* number of precomputed points */
kenjiArai	0:5b88d5760320	1578	#define COMB_MAX_PRE ( 1 << ( MBEDTLS_ECP_WINDOW_SIZE - 1 ) )
kenjiArai	0:5b88d5760320	1579
kenjiArai	0:5b88d5760320	1580	/*
kenjiArai	0:5b88d5760320	1581	* Compute the representation of m that will be used with our comb method.
kenjiArai	0:5b88d5760320	1582	*
kenjiArai	0:5b88d5760320	1583	* The basic comb method is described in GECC 3.44 for example. We use a
kenjiArai	0:5b88d5760320	1584	* modified version that provides resistance to SPA by avoiding zero
kenjiArai	0:5b88d5760320	1585	* digits in the representation as in [3]. We modify the method further by
kenjiArai	0:5b88d5760320	1586	* requiring that all K_i be odd, which has the small cost that our
kenjiArai	0:5b88d5760320	1587	* representation uses one more K_i, due to carries, but saves on the size of
kenjiArai	0:5b88d5760320	1588	* the precomputed table.
kenjiArai	0:5b88d5760320	1589	*
kenjiArai	0:5b88d5760320	1590	* Summary of the comb method and its modifications:
kenjiArai	0:5b88d5760320	1591	*
kenjiArai	0:5b88d5760320	1592	* - The goal is to compute mP for some wd-bit integer m.
kenjiArai	0:5b88d5760320	1593	*
kenjiArai	0:5b88d5760320	1594	* - The basic comb method splits m into the w-bit integers
kenjiArai	0:5b88d5760320	1595	* x[0] .. x[d-1] where x[i] consists of the bits in m whose
kenjiArai	0:5b88d5760320	1596	* index has residue i modulo d, and computes m * P as
kenjiArai	0:5b88d5760320	1597	* S[x[0]] + 2 * S[x[1]] + .. + 2^(d-1) S[x[d-1]], where
kenjiArai	0:5b88d5760320	1598	* S[i_{w-1} .. i_0] := i_{w-1} 2^{(w-1)d} P + ... + i_1 2^d P + i_0 P.
kenjiArai	0:5b88d5760320	1599	*
kenjiArai	0:5b88d5760320	1600	* - If it happens that, say, x[i+1]=0 (=> S[x[i+1]]=0), one can replace the sum by
kenjiArai	0:5b88d5760320	1601	* .. + 2^{i-1} S[x[i-1]] - 2^i S[x[i]] + 2^{i+1} S[x[i]] + 2^{i+2} S[x[i+2]] ..,
kenjiArai	0:5b88d5760320	1602	* thereby successively converting it into a form where all summands
kenjiArai	0:5b88d5760320	1603	* are nonzero, at the cost of negative summands. This is the basic idea of [3].
kenjiArai	0:5b88d5760320	1604	*
kenjiArai	0:5b88d5760320	1605	* - More generally, even if x[i+1] != 0, we can first transform the sum as
kenjiArai	0:5b88d5760320	1606	* .. - 2^i S[x[i]] + 2^{i+1} ( S[x[i]] + S[x[i+1]] ) + 2^{i+2} S[x[i+2]] ..,
kenjiArai	0:5b88d5760320	1607	* and then replace S[x[i]] + S[x[i+1]] = S[x[i] ^ x[i+1]] + 2 S[x[i] & x[i+1]].
kenjiArai	0:5b88d5760320	1608	* Performing and iterating this procedure for those x[i] that are even
kenjiArai	0:5b88d5760320	1609	* (keeping track of carry), we can transform the original sum into one of the form
kenjiArai	0:5b88d5760320	1610	* S[x'[0]] +- 2 S[x'[1]] +- .. +- 2^{d-1} S[x'[d-1]] + 2^d S[x'[d]]
kenjiArai	0:5b88d5760320	1611	* with all x'[i] odd. It is therefore only necessary to know S at odd indices,
kenjiArai	0:5b88d5760320	1612	* which is why we are only computing half of it in the first place in
kenjiArai	0:5b88d5760320	1613	* ecp_precompute_comb and accessing it with index abs(i) / 2 in ecp_select_comb.
kenjiArai	0:5b88d5760320	1614	*
kenjiArai	0:5b88d5760320	1615	* - For the sake of compactness, only the seven low-order bits of x[i]
kenjiArai	0:5b88d5760320	1616	* are used to represent its absolute value (K_i in the paper), and the msb
kenjiArai	0:5b88d5760320	1617	* of x[i] encodes the sign (s_i in the paper): it is set if and only if
kenjiArai	0:5b88d5760320	1618	* if s_i == -1;
kenjiArai	0:5b88d5760320	1619	*
kenjiArai	0:5b88d5760320	1620	* Calling conventions:
kenjiArai	0:5b88d5760320	1621	* - x is an array of size d + 1
kenjiArai	0:5b88d5760320	1622	* - w is the size, ie number of teeth, of the comb, and must be between
kenjiArai	0:5b88d5760320	1623	* 2 and 7 (in practice, between 2 and MBEDTLS_ECP_WINDOW_SIZE)
kenjiArai	0:5b88d5760320	1624	* - m is the MPI, expected to be odd and such that bitlength(m) <= w * d
kenjiArai	0:5b88d5760320	1625	* (the result will be incorrect if these assumptions are not satisfied)
kenjiArai	0:5b88d5760320	1626	*/
kenjiArai	0:5b88d5760320	1627	static void ecp_comb_recode_core( unsigned char x[], size_t d,
kenjiArai	0:5b88d5760320	1628	unsigned char w, const mbedtls_mpi *m )
kenjiArai	0:5b88d5760320	1629	{
kenjiArai	0:5b88d5760320	1630	size_t i, j;
kenjiArai	0:5b88d5760320	1631	unsigned char c, cc, adjust;
kenjiArai	0:5b88d5760320	1632
kenjiArai	0:5b88d5760320	1633	memset( x, 0, d+1 );
kenjiArai	0:5b88d5760320	1634
kenjiArai	0:5b88d5760320	1635	/* First get the classical comb values (except for x_d = 0) */
kenjiArai	0:5b88d5760320	1636	for( i = 0; i < d; i++ )
kenjiArai	0:5b88d5760320	1637	for( j = 0; j < w; j++ )
kenjiArai	0:5b88d5760320	1638	x[i] \|= mbedtls_mpi_get_bit( m, i + d * j ) << j;
kenjiArai	0:5b88d5760320	1639
kenjiArai	0:5b88d5760320	1640	/* Now make sure x_1 .. x_d are odd */
kenjiArai	0:5b88d5760320	1641	c = 0;
kenjiArai	0:5b88d5760320	1642	for( i = 1; i <= d; i++ )
kenjiArai	0:5b88d5760320	1643	{
kenjiArai	0:5b88d5760320	1644	/* Add carry and update it */
kenjiArai	0:5b88d5760320	1645	cc = x[i] & c;
kenjiArai	0:5b88d5760320	1646	x[i] = x[i] ^ c;
kenjiArai	0:5b88d5760320	1647	c = cc;
kenjiArai	0:5b88d5760320	1648
kenjiArai	0:5b88d5760320	1649	/* Adjust if needed, avoiding branches */
kenjiArai	0:5b88d5760320	1650	adjust = 1 - ( x[i] & 0x01 );
kenjiArai	0:5b88d5760320	1651	c \|= x[i] & ( x[i-1] * adjust );
kenjiArai	0:5b88d5760320	1652	x[i] = x[i] ^ ( x[i-1] * adjust );
kenjiArai	0:5b88d5760320	1653	x[i-1] \|= adjust << 7;
kenjiArai	0:5b88d5760320	1654	}
kenjiArai	0:5b88d5760320	1655	}
kenjiArai	0:5b88d5760320	1656
kenjiArai	0:5b88d5760320	1657	/*
kenjiArai	0:5b88d5760320	1658	* Precompute points for the adapted comb method
kenjiArai	0:5b88d5760320	1659	*
kenjiArai	0:5b88d5760320	1660	* Assumption: T must be able to hold 2^{w - 1} elements.
kenjiArai	0:5b88d5760320	1661	*
kenjiArai	0:5b88d5760320	1662	* Operation: If i = i_{w-1} ... i_1 is the binary representation of i,
kenjiArai	0:5b88d5760320	1663	* sets T[i] = i_{w-1} 2^{(w-1)d} P + ... + i_1 2^d P + P.
kenjiArai	0:5b88d5760320	1664	*
kenjiArai	0:5b88d5760320	1665	* Cost: d(w-1) D + (2^{w-1} - 1) A + 1 N(w-1) + 1 N(2^{w-1} - 1)
kenjiArai	0:5b88d5760320	1666	*
kenjiArai	0:5b88d5760320	1667	* Note: Even comb values (those where P would be omitted from the
kenjiArai	0:5b88d5760320	1668	* sum defining T[i] above) are not needed in our adaption
kenjiArai	0:5b88d5760320	1669	* the comb method. See ecp_comb_recode_core().
kenjiArai	0:5b88d5760320	1670	*
kenjiArai	0:5b88d5760320	1671	* This function currently works in four steps:
kenjiArai	0:5b88d5760320	1672	* (1) [dbl] Computation of intermediate T[i] for 2-power values of i
kenjiArai	0:5b88d5760320	1673	* (2) [norm_dbl] Normalization of coordinates of these T[i]
kenjiArai	0:5b88d5760320	1674	* (3) [add] Computation of all T[i]
kenjiArai	0:5b88d5760320	1675	* (4) [norm_add] Normalization of all T[i]
kenjiArai	0:5b88d5760320	1676	*
kenjiArai	0:5b88d5760320	1677	* Step 1 can be interrupted but not the others; together with the final
kenjiArai	0:5b88d5760320	1678	* coordinate normalization they are the largest steps done at once, depending
kenjiArai	0:5b88d5760320	1679	* on the window size. Here are operation counts for P-256:
kenjiArai	0:5b88d5760320	1680	*
kenjiArai	0:5b88d5760320	1681	* step (2) (3) (4)
kenjiArai	0:5b88d5760320	1682	* w = 5 142 165 208
kenjiArai	0:5b88d5760320	1683	* w = 4 136 77 160
kenjiArai	0:5b88d5760320	1684	* w = 3 130 33 136
kenjiArai	0:5b88d5760320	1685	* w = 2 124 11 124
kenjiArai	0:5b88d5760320	1686	*
kenjiArai	0:5b88d5760320	1687	* So if ECC operations are blocking for too long even with a low max_ops
kenjiArai	0:5b88d5760320	1688	* value, it's useful to set MBEDTLS_ECP_WINDOW_SIZE to a lower value in order
kenjiArai	0:5b88d5760320	1689	* to minimize maximum blocking time.
kenjiArai	0:5b88d5760320	1690	*/
kenjiArai	0:5b88d5760320	1691	static int ecp_precompute_comb( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	1692	mbedtls_ecp_point T[], const mbedtls_ecp_point *P,
kenjiArai	0:5b88d5760320	1693	unsigned char w, size_t d,
kenjiArai	0:5b88d5760320	1694	mbedtls_ecp_restart_ctx *rs_ctx )
kenjiArai	0:5b88d5760320	1695	{
kenjiArai	0:5b88d5760320	1696	int ret;
kenjiArai	0:5b88d5760320	1697	unsigned char i;
kenjiArai	0:5b88d5760320	1698	size_t j = 0;
kenjiArai	0:5b88d5760320	1699	const unsigned char T_size = 1U << ( w - 1 );
kenjiArai	0:5b88d5760320	1700	mbedtls_ecp_point cur, TT[COMB_MAX_PRE - 1];
kenjiArai	0:5b88d5760320	1701
kenjiArai	0:5b88d5760320	1702	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	1703	if( rs_ctx != NULL && rs_ctx->rsm != NULL )
kenjiArai	0:5b88d5760320	1704	{
kenjiArai	0:5b88d5760320	1705	if( rs_ctx->rsm->state == ecp_rsm_pre_dbl )
kenjiArai	0:5b88d5760320	1706	goto dbl;
kenjiArai	0:5b88d5760320	1707	if( rs_ctx->rsm->state == ecp_rsm_pre_norm_dbl )
kenjiArai	0:5b88d5760320	1708	goto norm_dbl;
kenjiArai	0:5b88d5760320	1709	if( rs_ctx->rsm->state == ecp_rsm_pre_add )
kenjiArai	0:5b88d5760320	1710	goto add;
kenjiArai	0:5b88d5760320	1711	if( rs_ctx->rsm->state == ecp_rsm_pre_norm_add )
kenjiArai	0:5b88d5760320	1712	goto norm_add;
kenjiArai	0:5b88d5760320	1713	}
kenjiArai	0:5b88d5760320	1714	#else
kenjiArai	0:5b88d5760320	1715	(void) rs_ctx;
kenjiArai	0:5b88d5760320	1716	#endif
kenjiArai	0:5b88d5760320	1717
kenjiArai	0:5b88d5760320	1718	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	1719	if( rs_ctx != NULL && rs_ctx->rsm != NULL )
kenjiArai	0:5b88d5760320	1720	{
kenjiArai	0:5b88d5760320	1721	rs_ctx->rsm->state = ecp_rsm_pre_dbl;
kenjiArai	0:5b88d5760320	1722
kenjiArai	0:5b88d5760320	1723	/* initial state for the loop */
kenjiArai	0:5b88d5760320	1724	rs_ctx->rsm->i = 0;
kenjiArai	0:5b88d5760320	1725	}
kenjiArai	0:5b88d5760320	1726
kenjiArai	0:5b88d5760320	1727	dbl:
kenjiArai	0:5b88d5760320	1728	#endif
kenjiArai	0:5b88d5760320	1729	/*
kenjiArai	0:5b88d5760320	1730	* Set T[0] = P and
kenjiArai	0:5b88d5760320	1731	* T[2^{l-1}] = 2^{dl} P for l = 1 .. w-1 (this is not the final value)
kenjiArai	0:5b88d5760320	1732	*/
kenjiArai	0:5b88d5760320	1733	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &T[0], P ) );
kenjiArai	0:5b88d5760320	1734
kenjiArai	0:5b88d5760320	1735	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	1736	if( rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->i != 0 )
kenjiArai	0:5b88d5760320	1737	j = rs_ctx->rsm->i;
kenjiArai	0:5b88d5760320	1738	else
kenjiArai	0:5b88d5760320	1739	#endif
kenjiArai	0:5b88d5760320	1740	j = 0;
kenjiArai	0:5b88d5760320	1741
kenjiArai	0:5b88d5760320	1742	for( ; j < d * ( w - 1 ); j++ )
kenjiArai	0:5b88d5760320	1743	{
kenjiArai	0:5b88d5760320	1744	MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_DBL );
kenjiArai	0:5b88d5760320	1745
kenjiArai	0:5b88d5760320	1746	i = 1U << ( j / d );
kenjiArai	0:5b88d5760320	1747	cur = T + i;
kenjiArai	0:5b88d5760320	1748
kenjiArai	0:5b88d5760320	1749	if( j % d == 0 )
kenjiArai	0:5b88d5760320	1750	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( cur, T + ( i >> 1 ) ) );
kenjiArai	0:5b88d5760320	1751
kenjiArai	0:5b88d5760320	1752	MBEDTLS_MPI_CHK( ecp_double_jac( grp, cur, cur ) );
kenjiArai	0:5b88d5760320	1753	}
kenjiArai	0:5b88d5760320	1754
kenjiArai	0:5b88d5760320	1755	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	1756	if( rs_ctx != NULL && rs_ctx->rsm != NULL )
kenjiArai	0:5b88d5760320	1757	rs_ctx->rsm->state = ecp_rsm_pre_norm_dbl;
kenjiArai	0:5b88d5760320	1758
kenjiArai	0:5b88d5760320	1759	norm_dbl:
kenjiArai	0:5b88d5760320	1760	#endif
kenjiArai	0:5b88d5760320	1761	/*
kenjiArai	0:5b88d5760320	1762	* Normalize current elements in T. As T has holes,
kenjiArai	0:5b88d5760320	1763	* use an auxiliary array of pointers to elements in T.
kenjiArai	0:5b88d5760320	1764	*/
kenjiArai	0:5b88d5760320	1765	j = 0;
kenjiArai	0:5b88d5760320	1766	for( i = 1; i < T_size; i <<= 1 )
kenjiArai	0:5b88d5760320	1767	TT[j++] = T + i;
kenjiArai	0:5b88d5760320	1768
kenjiArai	0:5b88d5760320	1769	MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV + 6 * j - 2 );
kenjiArai	0:5b88d5760320	1770
kenjiArai	0:5b88d5760320	1771	MBEDTLS_MPI_CHK( ecp_normalize_jac_many( grp, TT, j ) );
kenjiArai	0:5b88d5760320	1772
kenjiArai	0:5b88d5760320	1773	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	1774	if( rs_ctx != NULL && rs_ctx->rsm != NULL )
kenjiArai	0:5b88d5760320	1775	rs_ctx->rsm->state = ecp_rsm_pre_add;
kenjiArai	0:5b88d5760320	1776
kenjiArai	0:5b88d5760320	1777	add:
kenjiArai	0:5b88d5760320	1778	#endif
kenjiArai	0:5b88d5760320	1779	/*
kenjiArai	0:5b88d5760320	1780	* Compute the remaining ones using the minimal number of additions
kenjiArai	0:5b88d5760320	1781	* Be careful to update T[2^l] only after using it!
kenjiArai	0:5b88d5760320	1782	*/
kenjiArai	0:5b88d5760320	1783	MBEDTLS_ECP_BUDGET( ( T_size - 1 ) * MBEDTLS_ECP_OPS_ADD );
kenjiArai	0:5b88d5760320	1784
kenjiArai	0:5b88d5760320	1785	for( i = 1; i < T_size; i <<= 1 )
kenjiArai	0:5b88d5760320	1786	{
kenjiArai	0:5b88d5760320	1787	j = i;
kenjiArai	0:5b88d5760320	1788	while( j-- )
kenjiArai	0:5b88d5760320	1789	MBEDTLS_MPI_CHK( ecp_add_mixed( grp, &T[i + j], &T[j], &T[i] ) );
kenjiArai	0:5b88d5760320	1790	}
kenjiArai	0:5b88d5760320	1791
kenjiArai	0:5b88d5760320	1792	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	1793	if( rs_ctx != NULL && rs_ctx->rsm != NULL )
kenjiArai	0:5b88d5760320	1794	rs_ctx->rsm->state = ecp_rsm_pre_norm_add;
kenjiArai	0:5b88d5760320	1795
kenjiArai	0:5b88d5760320	1796	norm_add:
kenjiArai	0:5b88d5760320	1797	#endif
kenjiArai	0:5b88d5760320	1798	/*
kenjiArai	0:5b88d5760320	1799	* Normalize final elements in T. Even though there are no holes now, we
kenjiArai	0:5b88d5760320	1800	* still need the auxiliary array for homogeneity with the previous
kenjiArai	0:5b88d5760320	1801	* call. Also, skip T[0] which is already normalised, being a copy of P.
kenjiArai	0:5b88d5760320	1802	*/
kenjiArai	0:5b88d5760320	1803	for( j = 0; j + 1 < T_size; j++ )
kenjiArai	0:5b88d5760320	1804	TT[j] = T + j + 1;
kenjiArai	0:5b88d5760320	1805
kenjiArai	0:5b88d5760320	1806	MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV + 6 * j - 2 );
kenjiArai	0:5b88d5760320	1807
kenjiArai	0:5b88d5760320	1808	MBEDTLS_MPI_CHK( ecp_normalize_jac_many( grp, TT, j ) );
kenjiArai	0:5b88d5760320	1809
kenjiArai	0:5b88d5760320	1810	cleanup:
kenjiArai	0:5b88d5760320	1811	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	1812	if( rs_ctx != NULL && rs_ctx->rsm != NULL &&
kenjiArai	0:5b88d5760320	1813	ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
kenjiArai	0:5b88d5760320	1814	{
kenjiArai	0:5b88d5760320	1815	if( rs_ctx->rsm->state == ecp_rsm_pre_dbl )
kenjiArai	0:5b88d5760320	1816	rs_ctx->rsm->i = j;
kenjiArai	0:5b88d5760320	1817	}
kenjiArai	0:5b88d5760320	1818	#endif
kenjiArai	0:5b88d5760320	1819
kenjiArai	0:5b88d5760320	1820	return( ret );
kenjiArai	0:5b88d5760320	1821	}
kenjiArai	0:5b88d5760320	1822
kenjiArai	0:5b88d5760320	1823	/*
kenjiArai	0:5b88d5760320	1824	* Select precomputed point: R = sign(i) * T[ abs(i) / 2 ]
kenjiArai	0:5b88d5760320	1825	*
kenjiArai	0:5b88d5760320	1826	* See ecp_comb_recode_core() for background
kenjiArai	0:5b88d5760320	1827	*/
kenjiArai	0:5b88d5760320	1828	static int ecp_select_comb( const mbedtls_ecp_group grp, mbedtls_ecp_point R,
kenjiArai	0:5b88d5760320	1829	const mbedtls_ecp_point T[], unsigned char T_size,
kenjiArai	0:5b88d5760320	1830	unsigned char i )
kenjiArai	0:5b88d5760320	1831	{
kenjiArai	0:5b88d5760320	1832	int ret;
kenjiArai	0:5b88d5760320	1833	unsigned char ii, j;
kenjiArai	0:5b88d5760320	1834
kenjiArai	0:5b88d5760320	1835	/* Ignore the "sign" bit and scale down */
kenjiArai	0:5b88d5760320	1836	ii = ( i & 0x7Fu ) >> 1;
kenjiArai	0:5b88d5760320	1837
kenjiArai	0:5b88d5760320	1838	/* Read the whole table to thwart cache-based timing attacks */
kenjiArai	0:5b88d5760320	1839	for( j = 0; j < T_size; j++ )
kenjiArai	0:5b88d5760320	1840	{
kenjiArai	0:5b88d5760320	1841	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &R->X, &T[j].X, j == ii ) );
kenjiArai	0:5b88d5760320	1842	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &R->Y, &T[j].Y, j == ii ) );
kenjiArai	0:5b88d5760320	1843	}
kenjiArai	0:5b88d5760320	1844
kenjiArai	0:5b88d5760320	1845	/* Safely invert result if i is "negative" */
kenjiArai	0:5b88d5760320	1846	MBEDTLS_MPI_CHK( ecp_safe_invert_jac( grp, R, i >> 7 ) );
kenjiArai	0:5b88d5760320	1847
kenjiArai	0:5b88d5760320	1848	cleanup:
kenjiArai	0:5b88d5760320	1849	return( ret );
kenjiArai	0:5b88d5760320	1850	}
kenjiArai	0:5b88d5760320	1851
kenjiArai	0:5b88d5760320	1852	/*
kenjiArai	0:5b88d5760320	1853	* Core multiplication algorithm for the (modified) comb method.
kenjiArai	0:5b88d5760320	1854	* This part is actually common with the basic comb method (GECC 3.44)
kenjiArai	0:5b88d5760320	1855	*
kenjiArai	0:5b88d5760320	1856	* Cost: d A + d D + 1 R
kenjiArai	0:5b88d5760320	1857	*/
kenjiArai	0:5b88d5760320	1858	static int ecp_mul_comb_core( const mbedtls_ecp_group grp, mbedtls_ecp_point R,
kenjiArai	0:5b88d5760320	1859	const mbedtls_ecp_point T[], unsigned char T_size,
kenjiArai	0:5b88d5760320	1860	const unsigned char x[], size_t d,
kenjiArai	0:5b88d5760320	1861	int (f_rng)(void , unsigned char *, size_t),
kenjiArai	0:5b88d5760320	1862	void *p_rng,
kenjiArai	0:5b88d5760320	1863	mbedtls_ecp_restart_ctx *rs_ctx )
kenjiArai	0:5b88d5760320	1864	{
kenjiArai	0:5b88d5760320	1865	int ret;
kenjiArai	0:5b88d5760320	1866	mbedtls_ecp_point Txi;
kenjiArai	0:5b88d5760320	1867	size_t i;
kenjiArai	0:5b88d5760320	1868
kenjiArai	0:5b88d5760320	1869	mbedtls_ecp_point_init( &Txi );
kenjiArai	0:5b88d5760320	1870
kenjiArai	0:5b88d5760320	1871	#if !defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	1872	(void) rs_ctx;
kenjiArai	0:5b88d5760320	1873	#endif
kenjiArai	0:5b88d5760320	1874
kenjiArai	0:5b88d5760320	1875	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	1876	if( rs_ctx != NULL && rs_ctx->rsm != NULL &&
kenjiArai	0:5b88d5760320	1877	rs_ctx->rsm->state != ecp_rsm_comb_core )
kenjiArai	0:5b88d5760320	1878	{
kenjiArai	0:5b88d5760320	1879	rs_ctx->rsm->i = 0;
kenjiArai	0:5b88d5760320	1880	rs_ctx->rsm->state = ecp_rsm_comb_core;
kenjiArai	0:5b88d5760320	1881	}
kenjiArai	0:5b88d5760320	1882
kenjiArai	0:5b88d5760320	1883	/* new 'if' instead of nested for the sake of the 'else' branch */
kenjiArai	0:5b88d5760320	1884	if( rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->i != 0 )
kenjiArai	0:5b88d5760320	1885	{
kenjiArai	0:5b88d5760320	1886	/* restore current index (R already pointing to rs_ctx->rsm->R) */
kenjiArai	0:5b88d5760320	1887	i = rs_ctx->rsm->i;
kenjiArai	0:5b88d5760320	1888	}
kenjiArai	0:5b88d5760320	1889	else
kenjiArai	0:5b88d5760320	1890	#endif
kenjiArai	0:5b88d5760320	1891	{
kenjiArai	0:5b88d5760320	1892	/* Start with a non-zero point and randomize its coordinates */
kenjiArai	0:5b88d5760320	1893	i = d;
kenjiArai	0:5b88d5760320	1894	MBEDTLS_MPI_CHK( ecp_select_comb( grp, R, T, T_size, x[i] ) );
kenjiArai	0:5b88d5760320	1895	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->Z, 1 ) );
kenjiArai	0:5b88d5760320	1896	if( f_rng != 0 )
kenjiArai	0:5b88d5760320	1897	MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, R, f_rng, p_rng ) );
kenjiArai	0:5b88d5760320	1898	}
kenjiArai	0:5b88d5760320	1899
kenjiArai	0:5b88d5760320	1900	while( i != 0 )
kenjiArai	0:5b88d5760320	1901	{
kenjiArai	0:5b88d5760320	1902	MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_DBL + MBEDTLS_ECP_OPS_ADD );
kenjiArai	0:5b88d5760320	1903	--i;
kenjiArai	0:5b88d5760320	1904
kenjiArai	0:5b88d5760320	1905	MBEDTLS_MPI_CHK( ecp_double_jac( grp, R, R ) );
kenjiArai	0:5b88d5760320	1906	MBEDTLS_MPI_CHK( ecp_select_comb( grp, &Txi, T, T_size, x[i] ) );
kenjiArai	0:5b88d5760320	1907	MBEDTLS_MPI_CHK( ecp_add_mixed( grp, R, R, &Txi ) );
kenjiArai	0:5b88d5760320	1908	}
kenjiArai	0:5b88d5760320	1909
kenjiArai	0:5b88d5760320	1910	cleanup:
kenjiArai	0:5b88d5760320	1911
kenjiArai	0:5b88d5760320	1912	mbedtls_ecp_point_free( &Txi );
kenjiArai	0:5b88d5760320	1913
kenjiArai	0:5b88d5760320	1914	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	1915	if( rs_ctx != NULL && rs_ctx->rsm != NULL &&
kenjiArai	0:5b88d5760320	1916	ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
kenjiArai	0:5b88d5760320	1917	{
kenjiArai	0:5b88d5760320	1918	rs_ctx->rsm->i = i;
kenjiArai	0:5b88d5760320	1919	/* no need to save R, already pointing to rs_ctx->rsm->R */
kenjiArai	0:5b88d5760320	1920	}
kenjiArai	0:5b88d5760320	1921	#endif
kenjiArai	0:5b88d5760320	1922
kenjiArai	0:5b88d5760320	1923	return( ret );
kenjiArai	0:5b88d5760320	1924	}
kenjiArai	0:5b88d5760320	1925
kenjiArai	0:5b88d5760320	1926	/*
kenjiArai	0:5b88d5760320	1927	* Recode the scalar to get constant-time comb multiplication
kenjiArai	0:5b88d5760320	1928	*
kenjiArai	0:5b88d5760320	1929	* As the actual scalar recoding needs an odd scalar as a starting point,
kenjiArai	0:5b88d5760320	1930	* this wrapper ensures that by replacing m by N - m if necessary, and
kenjiArai	0:5b88d5760320	1931	* informs the caller that the result of multiplication will be negated.
kenjiArai	0:5b88d5760320	1932	*
kenjiArai	0:5b88d5760320	1933	* This works because we only support large prime order for Short Weierstrass
kenjiArai	0:5b88d5760320	1934	* curves, so N is always odd hence either m or N - m is.
kenjiArai	0:5b88d5760320	1935	*
kenjiArai	0:5b88d5760320	1936	* See ecp_comb_recode_core() for background.
kenjiArai	0:5b88d5760320	1937	*/
kenjiArai	0:5b88d5760320	1938	static int ecp_comb_recode_scalar( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	1939	const mbedtls_mpi *m,
kenjiArai	0:5b88d5760320	1940	unsigned char k[COMB_MAX_D + 1],
kenjiArai	0:5b88d5760320	1941	size_t d,
kenjiArai	0:5b88d5760320	1942	unsigned char w,
kenjiArai	0:5b88d5760320	1943	unsigned char *parity_trick )
kenjiArai	0:5b88d5760320	1944	{
kenjiArai	0:5b88d5760320	1945	int ret;
kenjiArai	0:5b88d5760320	1946	mbedtls_mpi M, mm;
kenjiArai	0:5b88d5760320	1947
kenjiArai	0:5b88d5760320	1948	mbedtls_mpi_init( &M );
kenjiArai	0:5b88d5760320	1949	mbedtls_mpi_init( &mm );
kenjiArai	0:5b88d5760320	1950
kenjiArai	0:5b88d5760320	1951	/* N is always odd (see above), just make extra sure */
kenjiArai	0:5b88d5760320	1952	if( mbedtls_mpi_get_bit( &grp->N, 0 ) != 1 )
kenjiArai	0:5b88d5760320	1953	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	1954
kenjiArai	0:5b88d5760320	1955	/* do we need the parity trick? */
kenjiArai	0:5b88d5760320	1956	*parity_trick = ( mbedtls_mpi_get_bit( m, 0 ) == 0 );
kenjiArai	0:5b88d5760320	1957
kenjiArai	0:5b88d5760320	1958	/* execute parity fix in constant time */
kenjiArai	0:5b88d5760320	1959	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &M, m ) );
kenjiArai	0:5b88d5760320	1960	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &mm, &grp->N, m ) );
kenjiArai	0:5b88d5760320	1961	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &M, &mm, *parity_trick ) );
kenjiArai	0:5b88d5760320	1962
kenjiArai	0:5b88d5760320	1963	/* actual scalar recoding */
kenjiArai	0:5b88d5760320	1964	ecp_comb_recode_core( k, d, w, &M );
kenjiArai	0:5b88d5760320	1965
kenjiArai	0:5b88d5760320	1966	cleanup:
kenjiArai	0:5b88d5760320	1967	mbedtls_mpi_free( &mm );
kenjiArai	0:5b88d5760320	1968	mbedtls_mpi_free( &M );
kenjiArai	0:5b88d5760320	1969
kenjiArai	0:5b88d5760320	1970	return( ret );
kenjiArai	0:5b88d5760320	1971	}
kenjiArai	0:5b88d5760320	1972
kenjiArai	0:5b88d5760320	1973	/*
kenjiArai	0:5b88d5760320	1974	* Perform comb multiplication (for short Weierstrass curves)
kenjiArai	0:5b88d5760320	1975	* once the auxiliary table has been pre-computed.
kenjiArai	0:5b88d5760320	1976	*
kenjiArai	0:5b88d5760320	1977	* Scalar recoding may use a parity trick that makes us compute -m * P,
kenjiArai	0:5b88d5760320	1978	* if that is the case we'll need to recover m * P at the end.
kenjiArai	0:5b88d5760320	1979	*/
kenjiArai	0:5b88d5760320	1980	static int ecp_mul_comb_after_precomp( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	1981	mbedtls_ecp_point *R,
kenjiArai	0:5b88d5760320	1982	const mbedtls_mpi *m,
kenjiArai	0:5b88d5760320	1983	const mbedtls_ecp_point *T,
kenjiArai	0:5b88d5760320	1984	unsigned char T_size,
kenjiArai	0:5b88d5760320	1985	unsigned char w,
kenjiArai	0:5b88d5760320	1986	size_t d,
kenjiArai	0:5b88d5760320	1987	int (f_rng)(void , unsigned char *, size_t),
kenjiArai	0:5b88d5760320	1988	void *p_rng,
kenjiArai	0:5b88d5760320	1989	mbedtls_ecp_restart_ctx *rs_ctx )
kenjiArai	0:5b88d5760320	1990	{
kenjiArai	0:5b88d5760320	1991	int ret;
kenjiArai	0:5b88d5760320	1992	unsigned char parity_trick;
kenjiArai	0:5b88d5760320	1993	unsigned char k[COMB_MAX_D + 1];
kenjiArai	0:5b88d5760320	1994	mbedtls_ecp_point *RR = R;
kenjiArai	0:5b88d5760320	1995
kenjiArai	0:5b88d5760320	1996	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	1997	if( rs_ctx != NULL && rs_ctx->rsm != NULL )
kenjiArai	0:5b88d5760320	1998	{
kenjiArai	0:5b88d5760320	1999	RR = &rs_ctx->rsm->R;
kenjiArai	0:5b88d5760320	2000
kenjiArai	0:5b88d5760320	2001	if( rs_ctx->rsm->state == ecp_rsm_final_norm )
kenjiArai	0:5b88d5760320	2002	goto final_norm;
kenjiArai	0:5b88d5760320	2003	}
kenjiArai	0:5b88d5760320	2004	#endif
kenjiArai	0:5b88d5760320	2005
kenjiArai	0:5b88d5760320	2006	MBEDTLS_MPI_CHK( ecp_comb_recode_scalar( grp, m, k, d, w,
kenjiArai	0:5b88d5760320	2007	&parity_trick ) );
kenjiArai	0:5b88d5760320	2008	MBEDTLS_MPI_CHK( ecp_mul_comb_core( grp, RR, T, T_size, k, d,
kenjiArai	0:5b88d5760320	2009	f_rng, p_rng, rs_ctx ) );
kenjiArai	0:5b88d5760320	2010	MBEDTLS_MPI_CHK( ecp_safe_invert_jac( grp, RR, parity_trick ) );
kenjiArai	0:5b88d5760320	2011
kenjiArai	0:5b88d5760320	2012	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	2013	if( rs_ctx != NULL && rs_ctx->rsm != NULL )
kenjiArai	0:5b88d5760320	2014	rs_ctx->rsm->state = ecp_rsm_final_norm;
kenjiArai	0:5b88d5760320	2015
kenjiArai	0:5b88d5760320	2016	final_norm:
kenjiArai	0:5b88d5760320	2017	#endif
kenjiArai	0:5b88d5760320	2018	MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV );
kenjiArai	0:5b88d5760320	2019	MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, RR ) );
kenjiArai	0:5b88d5760320	2020
kenjiArai	0:5b88d5760320	2021	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	2022	if( rs_ctx != NULL && rs_ctx->rsm != NULL )
kenjiArai	0:5b88d5760320	2023	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, RR ) );
kenjiArai	0:5b88d5760320	2024	#endif
kenjiArai	0:5b88d5760320	2025
kenjiArai	0:5b88d5760320	2026	cleanup:
kenjiArai	0:5b88d5760320	2027	return( ret );
kenjiArai	0:5b88d5760320	2028	}
kenjiArai	0:5b88d5760320	2029
kenjiArai	0:5b88d5760320	2030	/*
kenjiArai	0:5b88d5760320	2031	* Pick window size based on curve size and whether we optimize for base point
kenjiArai	0:5b88d5760320	2032	*/
kenjiArai	0:5b88d5760320	2033	static unsigned char ecp_pick_window_size( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	2034	unsigned char p_eq_g )
kenjiArai	0:5b88d5760320	2035	{
kenjiArai	0:5b88d5760320	2036	unsigned char w;
kenjiArai	0:5b88d5760320	2037
kenjiArai	0:5b88d5760320	2038	/*
kenjiArai	0:5b88d5760320	2039	* Minimize the number of multiplications, that is minimize
kenjiArai	0:5b88d5760320	2040	* 10 * d * w + 18 * 2^(w-1) + 11 * d + 7 * w, with d = ceil( nbits / w )
kenjiArai	0:5b88d5760320	2041	* (see costs of the various parts, with 1S = 1M)
kenjiArai	0:5b88d5760320	2042	*/
kenjiArai	0:5b88d5760320	2043	w = grp->nbits >= 384 ? 5 : 4;
kenjiArai	0:5b88d5760320	2044
kenjiArai	0:5b88d5760320	2045	/*
kenjiArai	0:5b88d5760320	2046	* If P == G, pre-compute a bit more, since this may be re-used later.
kenjiArai	0:5b88d5760320	2047	* Just adding one avoids upping the cost of the first mul too much,
kenjiArai	0:5b88d5760320	2048	* and the memory cost too.
kenjiArai	0:5b88d5760320	2049	*/
kenjiArai	0:5b88d5760320	2050	if( p_eq_g )
kenjiArai	0:5b88d5760320	2051	w++;
kenjiArai	0:5b88d5760320	2052
kenjiArai	0:5b88d5760320	2053	/*
kenjiArai	0:5b88d5760320	2054	* Make sure w is within bounds.
kenjiArai	0:5b88d5760320	2055	* (The last test is useful only for very small curves in the test suite.)
kenjiArai	0:5b88d5760320	2056	*/
kenjiArai	1:9db0e321a9f4	2057	#if( MBEDTLS_ECP_WINDOW_SIZE < 6 )
kenjiArai	0:5b88d5760320	2058	if( w > MBEDTLS_ECP_WINDOW_SIZE )
kenjiArai	0:5b88d5760320	2059	w = MBEDTLS_ECP_WINDOW_SIZE;
kenjiArai	1:9db0e321a9f4	2060	#endif
kenjiArai	0:5b88d5760320	2061	if( w >= grp->nbits )
kenjiArai	0:5b88d5760320	2062	w = 2;
kenjiArai	0:5b88d5760320	2063
kenjiArai	0:5b88d5760320	2064	return( w );
kenjiArai	0:5b88d5760320	2065	}
kenjiArai	0:5b88d5760320	2066
kenjiArai	0:5b88d5760320	2067	/*
kenjiArai	0:5b88d5760320	2068	* Multiplication using the comb method - for curves in short Weierstrass form
kenjiArai	0:5b88d5760320	2069	*
kenjiArai	0:5b88d5760320	2070	* This function is mainly responsible for administrative work:
kenjiArai	0:5b88d5760320	2071	* - managing the restart context if enabled
kenjiArai	0:5b88d5760320	2072	* - managing the table of precomputed points (passed between the below two
kenjiArai	0:5b88d5760320	2073	* functions): allocation, computation, ownership tranfer, freeing.
kenjiArai	0:5b88d5760320	2074	*
kenjiArai	0:5b88d5760320	2075	* It delegates the actual arithmetic work to:
kenjiArai	0:5b88d5760320	2076	* ecp_precompute_comb() and ecp_mul_comb_with_precomp()
kenjiArai	0:5b88d5760320	2077	*
kenjiArai	0:5b88d5760320	2078	* See comments on ecp_comb_recode_core() regarding the computation strategy.
kenjiArai	0:5b88d5760320	2079	*/
kenjiArai	0:5b88d5760320	2080	static int ecp_mul_comb( mbedtls_ecp_group grp, mbedtls_ecp_point R,
kenjiArai	0:5b88d5760320	2081	const mbedtls_mpi m, const mbedtls_ecp_point P,
kenjiArai	0:5b88d5760320	2082	int (f_rng)(void , unsigned char *, size_t),
kenjiArai	0:5b88d5760320	2083	void *p_rng,
kenjiArai	0:5b88d5760320	2084	mbedtls_ecp_restart_ctx *rs_ctx )
kenjiArai	0:5b88d5760320	2085	{
kenjiArai	0:5b88d5760320	2086	int ret;
kenjiArai	0:5b88d5760320	2087	unsigned char w, p_eq_g, i;
kenjiArai	0:5b88d5760320	2088	size_t d;
kenjiArai	0:5b88d5760320	2089	unsigned char T_size, T_ok;
kenjiArai	0:5b88d5760320	2090	mbedtls_ecp_point *T;
kenjiArai	0:5b88d5760320	2091
kenjiArai	0:5b88d5760320	2092	ECP_RS_ENTER( rsm );
kenjiArai	0:5b88d5760320	2093
kenjiArai	0:5b88d5760320	2094	/* Is P the base point ? */
kenjiArai	0:5b88d5760320	2095	#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1
kenjiArai	0:5b88d5760320	2096	p_eq_g = ( mbedtls_mpi_cmp_mpi( &P->Y, &grp->G.Y ) == 0 &&
kenjiArai	0:5b88d5760320	2097	mbedtls_mpi_cmp_mpi( &P->X, &grp->G.X ) == 0 );
kenjiArai	0:5b88d5760320	2098	#else
kenjiArai	0:5b88d5760320	2099	p_eq_g = 0;
kenjiArai	0:5b88d5760320	2100	#endif
kenjiArai	0:5b88d5760320	2101
kenjiArai	0:5b88d5760320	2102	/* Pick window size and deduce related sizes */
kenjiArai	0:5b88d5760320	2103	w = ecp_pick_window_size( grp, p_eq_g );
kenjiArai	0:5b88d5760320	2104	T_size = 1U << ( w - 1 );
kenjiArai	0:5b88d5760320	2105	d = ( grp->nbits + w - 1 ) / w;
kenjiArai	0:5b88d5760320	2106
kenjiArai	0:5b88d5760320	2107	/* Pre-computed table: do we have it already for the base point? */
kenjiArai	0:5b88d5760320	2108	if( p_eq_g && grp->T != NULL )
kenjiArai	0:5b88d5760320	2109	{
kenjiArai	0:5b88d5760320	2110	/* second pointer to the same table, will be deleted on exit */
kenjiArai	0:5b88d5760320	2111	T = grp->T;
kenjiArai	0:5b88d5760320	2112	T_ok = 1;
kenjiArai	0:5b88d5760320	2113	}
kenjiArai	0:5b88d5760320	2114	else
kenjiArai	0:5b88d5760320	2115	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	2116	/* Pre-computed table: do we have one in progress? complete? */
kenjiArai	0:5b88d5760320	2117	if( rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->T != NULL )
kenjiArai	0:5b88d5760320	2118	{
kenjiArai	0:5b88d5760320	2119	/* transfer ownership of T from rsm to local function */
kenjiArai	0:5b88d5760320	2120	T = rs_ctx->rsm->T;
kenjiArai	0:5b88d5760320	2121	rs_ctx->rsm->T = NULL;
kenjiArai	0:5b88d5760320	2122	rs_ctx->rsm->T_size = 0;
kenjiArai	0:5b88d5760320	2123
kenjiArai	0:5b88d5760320	2124	/* This effectively jumps to the call to mul_comb_after_precomp() */
kenjiArai	0:5b88d5760320	2125	T_ok = rs_ctx->rsm->state >= ecp_rsm_comb_core;
kenjiArai	0:5b88d5760320	2126	}
kenjiArai	0:5b88d5760320	2127	else
kenjiArai	0:5b88d5760320	2128	#endif
kenjiArai	0:5b88d5760320	2129	/* Allocate table if we didn't have any */
kenjiArai	0:5b88d5760320	2130	{
kenjiArai	0:5b88d5760320	2131	T = mbedtls_calloc( T_size, sizeof( mbedtls_ecp_point ) );
kenjiArai	0:5b88d5760320	2132	if( T == NULL )
kenjiArai	0:5b88d5760320	2133	{
kenjiArai	0:5b88d5760320	2134	ret = MBEDTLS_ERR_ECP_ALLOC_FAILED;
kenjiArai	0:5b88d5760320	2135	goto cleanup;
kenjiArai	0:5b88d5760320	2136	}
kenjiArai	0:5b88d5760320	2137
kenjiArai	0:5b88d5760320	2138	for( i = 0; i < T_size; i++ )
kenjiArai	0:5b88d5760320	2139	mbedtls_ecp_point_init( &T[i] );
kenjiArai	0:5b88d5760320	2140
kenjiArai	0:5b88d5760320	2141	T_ok = 0;
kenjiArai	0:5b88d5760320	2142	}
kenjiArai	0:5b88d5760320	2143
kenjiArai	0:5b88d5760320	2144	/* Compute table (or finish computing it) if not done already */
kenjiArai	0:5b88d5760320	2145	if( !T_ok )
kenjiArai	0:5b88d5760320	2146	{
kenjiArai	0:5b88d5760320	2147	MBEDTLS_MPI_CHK( ecp_precompute_comb( grp, T, P, w, d, rs_ctx ) );
kenjiArai	0:5b88d5760320	2148
kenjiArai	0:5b88d5760320	2149	if( p_eq_g )
kenjiArai	0:5b88d5760320	2150	{
kenjiArai	0:5b88d5760320	2151	/* almost transfer ownership of T to the group, but keep a copy of
kenjiArai	0:5b88d5760320	2152	* the pointer to use for calling the next function more easily */
kenjiArai	0:5b88d5760320	2153	grp->T = T;
kenjiArai	0:5b88d5760320	2154	grp->T_size = T_size;
kenjiArai	0:5b88d5760320	2155	}
kenjiArai	0:5b88d5760320	2156	}
kenjiArai	0:5b88d5760320	2157
kenjiArai	0:5b88d5760320	2158	/* Actual comb multiplication using precomputed points */
kenjiArai	0:5b88d5760320	2159	MBEDTLS_MPI_CHK( ecp_mul_comb_after_precomp( grp, R, m,
kenjiArai	0:5b88d5760320	2160	T, T_size, w, d,
kenjiArai	0:5b88d5760320	2161	f_rng, p_rng, rs_ctx ) );
kenjiArai	0:5b88d5760320	2162
kenjiArai	0:5b88d5760320	2163	cleanup:
kenjiArai	0:5b88d5760320	2164
kenjiArai	0:5b88d5760320	2165	/* does T belong to the group? */
kenjiArai	0:5b88d5760320	2166	if( T == grp->T )
kenjiArai	0:5b88d5760320	2167	T = NULL;
kenjiArai	0:5b88d5760320	2168
kenjiArai	0:5b88d5760320	2169	/* does T belong to the restart context? */
kenjiArai	0:5b88d5760320	2170	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	2171	if( rs_ctx != NULL && rs_ctx->rsm != NULL && ret == MBEDTLS_ERR_ECP_IN_PROGRESS && T != NULL )
kenjiArai	0:5b88d5760320	2172	{
kenjiArai	0:5b88d5760320	2173	/* transfer ownership of T from local function to rsm */
kenjiArai	0:5b88d5760320	2174	rs_ctx->rsm->T_size = T_size;
kenjiArai	0:5b88d5760320	2175	rs_ctx->rsm->T = T;
kenjiArai	0:5b88d5760320	2176	T = NULL;
kenjiArai	0:5b88d5760320	2177	}
kenjiArai	0:5b88d5760320	2178	#endif
kenjiArai	0:5b88d5760320	2179
kenjiArai	0:5b88d5760320	2180	/* did T belong to us? then let's destroy it! */
kenjiArai	0:5b88d5760320	2181	if( T != NULL )
kenjiArai	0:5b88d5760320	2182	{
kenjiArai	0:5b88d5760320	2183	for( i = 0; i < T_size; i++ )
kenjiArai	0:5b88d5760320	2184	mbedtls_ecp_point_free( &T[i] );
kenjiArai	0:5b88d5760320	2185	mbedtls_free( T );
kenjiArai	0:5b88d5760320	2186	}
kenjiArai	0:5b88d5760320	2187
kenjiArai	0:5b88d5760320	2188	/* don't free R while in progress in case R == P */
kenjiArai	0:5b88d5760320	2189	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	2190	if( ret != MBEDTLS_ERR_ECP_IN_PROGRESS )
kenjiArai	0:5b88d5760320	2191	#endif
kenjiArai	0:5b88d5760320	2192	/* prevent caller from using invalid value */
kenjiArai	0:5b88d5760320	2193	if( ret != 0 )
kenjiArai	0:5b88d5760320	2194	mbedtls_ecp_point_free( R );
kenjiArai	0:5b88d5760320	2195
kenjiArai	0:5b88d5760320	2196	ECP_RS_LEAVE( rsm );
kenjiArai	0:5b88d5760320	2197
kenjiArai	0:5b88d5760320	2198	return( ret );
kenjiArai	0:5b88d5760320	2199	}
kenjiArai	0:5b88d5760320	2200
kenjiArai	0:5b88d5760320	2201	#endif /* ECP_SHORTWEIERSTRASS */
kenjiArai	0:5b88d5760320	2202
kenjiArai	0:5b88d5760320	2203	#if defined(ECP_MONTGOMERY)
kenjiArai	0:5b88d5760320	2204	/*
kenjiArai	0:5b88d5760320	2205	* For Montgomery curves, we do all the internal arithmetic in projective
kenjiArai	0:5b88d5760320	2206	* coordinates. Import/export of points uses only the x coordinates, which is
kenjiArai	0:5b88d5760320	2207	* internaly represented as X / Z.
kenjiArai	0:5b88d5760320	2208	*
kenjiArai	0:5b88d5760320	2209	* For scalar multiplication, we'll use a Montgomery ladder.
kenjiArai	0:5b88d5760320	2210	*/
kenjiArai	0:5b88d5760320	2211
kenjiArai	0:5b88d5760320	2212	/*
kenjiArai	0:5b88d5760320	2213	* Normalize Montgomery x/z coordinates: X = X/Z, Z = 1
kenjiArai	0:5b88d5760320	2214	* Cost: 1M + 1I
kenjiArai	0:5b88d5760320	2215	*/
kenjiArai	0:5b88d5760320	2216	static int ecp_normalize_mxz( const mbedtls_ecp_group grp, mbedtls_ecp_point P )
kenjiArai	0:5b88d5760320	2217	{
kenjiArai	0:5b88d5760320	2218	int ret;
kenjiArai	0:5b88d5760320	2219
kenjiArai	0:5b88d5760320	2220	#if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT)
kenjiArai	0:5b88d5760320	2221	if( mbedtls_internal_ecp_grp_capable( grp ) )
kenjiArai	0:5b88d5760320	2222	return( mbedtls_internal_ecp_normalize_mxz( grp, P ) );
kenjiArai	0:5b88d5760320	2223	#endif /* MBEDTLS_ECP_NORMALIZE_MXZ_ALT */
kenjiArai	0:5b88d5760320	2224
kenjiArai	0:5b88d5760320	2225	MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &P->Z, &P->Z, &grp->P ) );
kenjiArai	1:9db0e321a9f4	2226	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &P->X, &P->X, &P->Z ) );
kenjiArai	0:5b88d5760320	2227	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &P->Z, 1 ) );
kenjiArai	0:5b88d5760320	2228
kenjiArai	0:5b88d5760320	2229	cleanup:
kenjiArai	0:5b88d5760320	2230	return( ret );
kenjiArai	0:5b88d5760320	2231	}
kenjiArai	0:5b88d5760320	2232
kenjiArai	0:5b88d5760320	2233	/*
kenjiArai	0:5b88d5760320	2234	* Randomize projective x/z coordinates:
kenjiArai	0:5b88d5760320	2235	* (X, Z) -> (l X, l Z) for random l
kenjiArai	0:5b88d5760320	2236	* This is sort of the reverse operation of ecp_normalize_mxz().
kenjiArai	0:5b88d5760320	2237	*
kenjiArai	0:5b88d5760320	2238	* This countermeasure was first suggested in [2].
kenjiArai	0:5b88d5760320	2239	* Cost: 2M
kenjiArai	0:5b88d5760320	2240	*/
kenjiArai	0:5b88d5760320	2241	static int ecp_randomize_mxz( const mbedtls_ecp_group grp, mbedtls_ecp_point P,
kenjiArai	0:5b88d5760320	2242	int (f_rng)(void , unsigned char , size_t), void p_rng )
kenjiArai	0:5b88d5760320	2243	{
kenjiArai	0:5b88d5760320	2244	int ret;
kenjiArai	0:5b88d5760320	2245	mbedtls_mpi l;
kenjiArai	0:5b88d5760320	2246	size_t p_size;
kenjiArai	0:5b88d5760320	2247	int count = 0;
kenjiArai	0:5b88d5760320	2248
kenjiArai	0:5b88d5760320	2249	#if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT)
kenjiArai	0:5b88d5760320	2250	if( mbedtls_internal_ecp_grp_capable( grp ) )
kenjiArai	0:5b88d5760320	2251	return( mbedtls_internal_ecp_randomize_mxz( grp, P, f_rng, p_rng );
kenjiArai	0:5b88d5760320	2252	#endif /* MBEDTLS_ECP_RANDOMIZE_MXZ_ALT */
kenjiArai	0:5b88d5760320	2253
kenjiArai	0:5b88d5760320	2254	p_size = ( grp->pbits + 7 ) / 8;
kenjiArai	0:5b88d5760320	2255	mbedtls_mpi_init( &l );
kenjiArai	0:5b88d5760320	2256
kenjiArai	0:5b88d5760320	2257	/* Generate l such that 1 < l < p */
kenjiArai	0:5b88d5760320	2258	do
kenjiArai	0:5b88d5760320	2259	{
kenjiArai	0:5b88d5760320	2260	MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &l, p_size, f_rng, p_rng ) );
kenjiArai	0:5b88d5760320	2261
kenjiArai	0:5b88d5760320	2262	while( mbedtls_mpi_cmp_mpi( &l, &grp->P ) >= 0 )
kenjiArai	0:5b88d5760320	2263	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, 1 ) );
kenjiArai	0:5b88d5760320	2264
kenjiArai	0:5b88d5760320	2265	if( count++ > 10 )
kenjiArai	0:5b88d5760320	2266	return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
kenjiArai	0:5b88d5760320	2267	}
kenjiArai	0:5b88d5760320	2268	while( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 );
kenjiArai	0:5b88d5760320	2269
kenjiArai	1:9db0e321a9f4	2270	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &P->X, &P->X, &l ) );
kenjiArai	1:9db0e321a9f4	2271	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &P->Z, &P->Z, &l ) );
kenjiArai	0:5b88d5760320	2272
kenjiArai	0:5b88d5760320	2273	cleanup:
kenjiArai	0:5b88d5760320	2274	mbedtls_mpi_free( &l );
kenjiArai	0:5b88d5760320	2275
kenjiArai	0:5b88d5760320	2276	return( ret );
kenjiArai	0:5b88d5760320	2277	}
kenjiArai	0:5b88d5760320	2278
kenjiArai	0:5b88d5760320	2279	/*
kenjiArai	0:5b88d5760320	2280	* Double-and-add: R = 2P, S = P + Q, with d = X(P - Q),
kenjiArai	0:5b88d5760320	2281	* for Montgomery curves in x/z coordinates.
kenjiArai	0:5b88d5760320	2282	*
kenjiArai	0:5b88d5760320	2283	* http://www.hyperelliptic.org/EFD/g1p/auto-code/montgom/xz/ladder/mladd-1987-m.op3
kenjiArai	0:5b88d5760320	2284	* with
kenjiArai	0:5b88d5760320	2285	* d = X1
kenjiArai	0:5b88d5760320	2286	* P = (X2, Z2)
kenjiArai	0:5b88d5760320	2287	* Q = (X3, Z3)
kenjiArai	0:5b88d5760320	2288	* R = (X4, Z4)
kenjiArai	0:5b88d5760320	2289	* S = (X5, Z5)
kenjiArai	0:5b88d5760320	2290	* and eliminating temporary variables tO, ..., t4.
kenjiArai	0:5b88d5760320	2291	*
kenjiArai	0:5b88d5760320	2292	* Cost: 5M + 4S
kenjiArai	0:5b88d5760320	2293	*/
kenjiArai	0:5b88d5760320	2294	static int ecp_double_add_mxz( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	2295	mbedtls_ecp_point R, mbedtls_ecp_point S,
kenjiArai	0:5b88d5760320	2296	const mbedtls_ecp_point P, const mbedtls_ecp_point Q,
kenjiArai	0:5b88d5760320	2297	const mbedtls_mpi *d )
kenjiArai	0:5b88d5760320	2298	{
kenjiArai	0:5b88d5760320	2299	int ret;
kenjiArai	0:5b88d5760320	2300	mbedtls_mpi A, AA, B, BB, E, C, D, DA, CB;
kenjiArai	0:5b88d5760320	2301
kenjiArai	0:5b88d5760320	2302	#if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT)
kenjiArai	0:5b88d5760320	2303	if( mbedtls_internal_ecp_grp_capable( grp ) )
kenjiArai	0:5b88d5760320	2304	return( mbedtls_internal_ecp_double_add_mxz( grp, R, S, P, Q, d ) );
kenjiArai	0:5b88d5760320	2305	#endif /* MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT */
kenjiArai	0:5b88d5760320	2306
kenjiArai	0:5b88d5760320	2307	mbedtls_mpi_init( &A ); mbedtls_mpi_init( &AA ); mbedtls_mpi_init( &B );
kenjiArai	0:5b88d5760320	2308	mbedtls_mpi_init( &BB ); mbedtls_mpi_init( &E ); mbedtls_mpi_init( &C );
kenjiArai	0:5b88d5760320	2309	mbedtls_mpi_init( &D ); mbedtls_mpi_init( &DA ); mbedtls_mpi_init( &CB );
kenjiArai	0:5b88d5760320	2310
kenjiArai	1:9db0e321a9f4	2311	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &A, &P->X, &P->Z ) );
kenjiArai	1:9db0e321a9f4	2312	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &AA, &A, &A ) );
kenjiArai	1:9db0e321a9f4	2313	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &B, &P->X, &P->Z ) );
kenjiArai	1:9db0e321a9f4	2314	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &BB, &B, &B ) );
kenjiArai	1:9db0e321a9f4	2315	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &E, &AA, &BB ) );
kenjiArai	1:9db0e321a9f4	2316	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &C, &Q->X, &Q->Z ) );
kenjiArai	1:9db0e321a9f4	2317	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &D, &Q->X, &Q->Z ) );
kenjiArai	1:9db0e321a9f4	2318	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &DA, &D, &A ) );
kenjiArai	1:9db0e321a9f4	2319	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &CB, &C, &B ) );
kenjiArai	0:5b88d5760320	2320	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &S->X, &DA, &CB ) ); MOD_MUL( S->X );
kenjiArai	1:9db0e321a9f4	2321	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S->X, &S->X, &S->X ) );
kenjiArai	1:9db0e321a9f4	2322	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &S->Z, &DA, &CB ) );
kenjiArai	1:9db0e321a9f4	2323	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S->Z, &S->Z, &S->Z ) );
kenjiArai	1:9db0e321a9f4	2324	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S->Z, d, &S->Z ) );
kenjiArai	1:9db0e321a9f4	2325	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &R->X, &AA, &BB ) );
kenjiArai	1:9db0e321a9f4	2326	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &R->Z, &grp->A, &E ) );
kenjiArai	1:9db0e321a9f4	2327	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &R->Z, &BB, &R->Z ) );
kenjiArai	1:9db0e321a9f4	2328	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &R->Z, &E, &R->Z ) );
kenjiArai	0:5b88d5760320	2329
kenjiArai	0:5b88d5760320	2330	cleanup:
kenjiArai	0:5b88d5760320	2331	mbedtls_mpi_free( &A ); mbedtls_mpi_free( &AA ); mbedtls_mpi_free( &B );
kenjiArai	0:5b88d5760320	2332	mbedtls_mpi_free( &BB ); mbedtls_mpi_free( &E ); mbedtls_mpi_free( &C );
kenjiArai	0:5b88d5760320	2333	mbedtls_mpi_free( &D ); mbedtls_mpi_free( &DA ); mbedtls_mpi_free( &CB );
kenjiArai	0:5b88d5760320	2334
kenjiArai	0:5b88d5760320	2335	return( ret );
kenjiArai	0:5b88d5760320	2336	}
kenjiArai	0:5b88d5760320	2337
kenjiArai	0:5b88d5760320	2338	/*
kenjiArai	0:5b88d5760320	2339	* Multiplication with Montgomery ladder in x/z coordinates,
kenjiArai	0:5b88d5760320	2340	* for curves in Montgomery form
kenjiArai	0:5b88d5760320	2341	*/
kenjiArai	0:5b88d5760320	2342	static int ecp_mul_mxz( mbedtls_ecp_group grp, mbedtls_ecp_point R,
kenjiArai	0:5b88d5760320	2343	const mbedtls_mpi m, const mbedtls_ecp_point P,
kenjiArai	0:5b88d5760320	2344	int (f_rng)(void , unsigned char *, size_t),
kenjiArai	0:5b88d5760320	2345	void *p_rng )
kenjiArai	0:5b88d5760320	2346	{
kenjiArai	0:5b88d5760320	2347	int ret;
kenjiArai	0:5b88d5760320	2348	size_t i;
kenjiArai	0:5b88d5760320	2349	unsigned char b;
kenjiArai	0:5b88d5760320	2350	mbedtls_ecp_point RP;
kenjiArai	0:5b88d5760320	2351	mbedtls_mpi PX;
kenjiArai	0:5b88d5760320	2352
kenjiArai	0:5b88d5760320	2353	mbedtls_ecp_point_init( &RP ); mbedtls_mpi_init( &PX );
kenjiArai	0:5b88d5760320	2354
kenjiArai	0:5b88d5760320	2355	/* Save PX and read from P before writing to R, in case P == R */
kenjiArai	0:5b88d5760320	2356	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &PX, &P->X ) );
kenjiArai	0:5b88d5760320	2357	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &RP, P ) );
kenjiArai	0:5b88d5760320	2358
kenjiArai	0:5b88d5760320	2359	/* Set R to zero in modified x/z coordinates */
kenjiArai	0:5b88d5760320	2360	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->X, 1 ) );
kenjiArai	0:5b88d5760320	2361	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->Z, 0 ) );
kenjiArai	0:5b88d5760320	2362	mbedtls_mpi_free( &R->Y );
kenjiArai	0:5b88d5760320	2363
kenjiArai	0:5b88d5760320	2364	/* RP.X might be sligtly larger than P, so reduce it */
kenjiArai	0:5b88d5760320	2365	MOD_ADD( RP.X );
kenjiArai	0:5b88d5760320	2366
kenjiArai	0:5b88d5760320	2367	/* Randomize coordinates of the starting point */
kenjiArai	0:5b88d5760320	2368	if( f_rng != NULL )
kenjiArai	0:5b88d5760320	2369	MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, &RP, f_rng, p_rng ) );
kenjiArai	0:5b88d5760320	2370
kenjiArai	0:5b88d5760320	2371	/* Loop invariant: R = result so far, RP = R + P */
kenjiArai	0:5b88d5760320	2372	i = mbedtls_mpi_bitlen( m ); /* one past the (zero-based) most significant bit */
kenjiArai	0:5b88d5760320	2373	while( i-- > 0 )
kenjiArai	0:5b88d5760320	2374	{
kenjiArai	0:5b88d5760320	2375	b = mbedtls_mpi_get_bit( m, i );
kenjiArai	0:5b88d5760320	2376	/*
kenjiArai	0:5b88d5760320	2377	* if (b) R = 2R + P else R = 2R,
kenjiArai	0:5b88d5760320	2378	* which is:
kenjiArai	0:5b88d5760320	2379	* if (b) double_add( RP, R, RP, R )
kenjiArai	0:5b88d5760320	2380	* else double_add( R, RP, R, RP )
kenjiArai	0:5b88d5760320	2381	* but using safe conditional swaps to avoid leaks
kenjiArai	0:5b88d5760320	2382	*/
kenjiArai	0:5b88d5760320	2383	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->X, &RP.X, b ) );
kenjiArai	0:5b88d5760320	2384	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->Z, &RP.Z, b ) );
kenjiArai	0:5b88d5760320	2385	MBEDTLS_MPI_CHK( ecp_double_add_mxz( grp, R, &RP, R, &RP, &PX ) );
kenjiArai	0:5b88d5760320	2386	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->X, &RP.X, b ) );
kenjiArai	0:5b88d5760320	2387	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->Z, &RP.Z, b ) );
kenjiArai	0:5b88d5760320	2388	}
kenjiArai	0:5b88d5760320	2389
kenjiArai	0:5b88d5760320	2390	MBEDTLS_MPI_CHK( ecp_normalize_mxz( grp, R ) );
kenjiArai	0:5b88d5760320	2391
kenjiArai	0:5b88d5760320	2392	cleanup:
kenjiArai	0:5b88d5760320	2393	mbedtls_ecp_point_free( &RP ); mbedtls_mpi_free( &PX );
kenjiArai	0:5b88d5760320	2394
kenjiArai	0:5b88d5760320	2395	return( ret );
kenjiArai	0:5b88d5760320	2396	}
kenjiArai	0:5b88d5760320	2397
kenjiArai	0:5b88d5760320	2398	#endif /* ECP_MONTGOMERY */
kenjiArai	0:5b88d5760320	2399
kenjiArai	0:5b88d5760320	2400	/*
kenjiArai	0:5b88d5760320	2401	* Restartable multiplication R = m * P
kenjiArai	0:5b88d5760320	2402	*/
kenjiArai	0:5b88d5760320	2403	int mbedtls_ecp_mul_restartable( mbedtls_ecp_group grp, mbedtls_ecp_point R,
kenjiArai	0:5b88d5760320	2404	const mbedtls_mpi m, const mbedtls_ecp_point P,
kenjiArai	0:5b88d5760320	2405	int (f_rng)(void , unsigned char , size_t), void p_rng,
kenjiArai	0:5b88d5760320	2406	mbedtls_ecp_restart_ctx *rs_ctx )
kenjiArai	0:5b88d5760320	2407	{
kenjiArai	0:5b88d5760320	2408	int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
kenjiArai	0:5b88d5760320	2409	#if defined(MBEDTLS_ECP_INTERNAL_ALT)
kenjiArai	0:5b88d5760320	2410	char is_grp_capable = 0;
kenjiArai	0:5b88d5760320	2411	#endif
kenjiArai	0:5b88d5760320	2412	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	2413	ECP_VALIDATE_RET( R != NULL );
kenjiArai	0:5b88d5760320	2414	ECP_VALIDATE_RET( m != NULL );
kenjiArai	0:5b88d5760320	2415	ECP_VALIDATE_RET( P != NULL );
kenjiArai	0:5b88d5760320	2416
kenjiArai	0:5b88d5760320	2417	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	2418	/* reset ops count for this call if top-level */
kenjiArai	0:5b88d5760320	2419	if( rs_ctx != NULL && rs_ctx->depth++ == 0 )
kenjiArai	0:5b88d5760320	2420	rs_ctx->ops_done = 0;
kenjiArai	0:5b88d5760320	2421	#endif
kenjiArai	0:5b88d5760320	2422
kenjiArai	0:5b88d5760320	2423	#if defined(MBEDTLS_ECP_INTERNAL_ALT)
kenjiArai	0:5b88d5760320	2424	if( ( is_grp_capable = mbedtls_internal_ecp_grp_capable( grp ) ) )
kenjiArai	0:5b88d5760320	2425	MBEDTLS_MPI_CHK( mbedtls_internal_ecp_init( grp ) );
kenjiArai	0:5b88d5760320	2426	#endif /* MBEDTLS_ECP_INTERNAL_ALT */
kenjiArai	0:5b88d5760320	2427
kenjiArai	0:5b88d5760320	2428	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	2429	/* skip argument check when restarting */
kenjiArai	0:5b88d5760320	2430	if( rs_ctx == NULL \|\| rs_ctx->rsm == NULL )
kenjiArai	0:5b88d5760320	2431	#endif
kenjiArai	0:5b88d5760320	2432	{
kenjiArai	0:5b88d5760320	2433	/* check_privkey is free */
kenjiArai	0:5b88d5760320	2434	MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_CHK );
kenjiArai	0:5b88d5760320	2435
kenjiArai	0:5b88d5760320	2436	/* Common sanity checks */
kenjiArai	0:5b88d5760320	2437	MBEDTLS_MPI_CHK( mbedtls_ecp_check_privkey( grp, m ) );
kenjiArai	0:5b88d5760320	2438	MBEDTLS_MPI_CHK( mbedtls_ecp_check_pubkey( grp, P ) );
kenjiArai	0:5b88d5760320	2439	}
kenjiArai	0:5b88d5760320	2440
kenjiArai	0:5b88d5760320	2441	ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
kenjiArai	0:5b88d5760320	2442	#if defined(ECP_MONTGOMERY)
kenjiArai	0:5b88d5760320	2443	if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
kenjiArai	0:5b88d5760320	2444	MBEDTLS_MPI_CHK( ecp_mul_mxz( grp, R, m, P, f_rng, p_rng ) );
kenjiArai	0:5b88d5760320	2445	#endif
kenjiArai	0:5b88d5760320	2446	#if defined(ECP_SHORTWEIERSTRASS)
kenjiArai	0:5b88d5760320	2447	if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
kenjiArai	0:5b88d5760320	2448	MBEDTLS_MPI_CHK( ecp_mul_comb( grp, R, m, P, f_rng, p_rng, rs_ctx ) );
kenjiArai	0:5b88d5760320	2449	#endif
kenjiArai	0:5b88d5760320	2450
kenjiArai	0:5b88d5760320	2451	cleanup:
kenjiArai	0:5b88d5760320	2452
kenjiArai	0:5b88d5760320	2453	#if defined(MBEDTLS_ECP_INTERNAL_ALT)
kenjiArai	0:5b88d5760320	2454	if( is_grp_capable )
kenjiArai	0:5b88d5760320	2455	mbedtls_internal_ecp_free( grp );
kenjiArai	0:5b88d5760320	2456	#endif /* MBEDTLS_ECP_INTERNAL_ALT */
kenjiArai	0:5b88d5760320	2457
kenjiArai	0:5b88d5760320	2458	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	2459	if( rs_ctx != NULL )
kenjiArai	0:5b88d5760320	2460	rs_ctx->depth--;
kenjiArai	0:5b88d5760320	2461	#endif
kenjiArai	0:5b88d5760320	2462
kenjiArai	0:5b88d5760320	2463	return( ret );
kenjiArai	0:5b88d5760320	2464	}
kenjiArai	0:5b88d5760320	2465
kenjiArai	0:5b88d5760320	2466	/*
kenjiArai	0:5b88d5760320	2467	* Multiplication R = m * P
kenjiArai	0:5b88d5760320	2468	*/
kenjiArai	0:5b88d5760320	2469	int mbedtls_ecp_mul( mbedtls_ecp_group grp, mbedtls_ecp_point R,
kenjiArai	0:5b88d5760320	2470	const mbedtls_mpi m, const mbedtls_ecp_point P,
kenjiArai	0:5b88d5760320	2471	int (f_rng)(void , unsigned char , size_t), void p_rng )
kenjiArai	0:5b88d5760320	2472	{
kenjiArai	0:5b88d5760320	2473	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	2474	ECP_VALIDATE_RET( R != NULL );
kenjiArai	0:5b88d5760320	2475	ECP_VALIDATE_RET( m != NULL );
kenjiArai	0:5b88d5760320	2476	ECP_VALIDATE_RET( P != NULL );
kenjiArai	0:5b88d5760320	2477	return( mbedtls_ecp_mul_restartable( grp, R, m, P, f_rng, p_rng, NULL ) );
kenjiArai	0:5b88d5760320	2478	}
kenjiArai	0:5b88d5760320	2479
kenjiArai	0:5b88d5760320	2480	#if defined(ECP_SHORTWEIERSTRASS)
kenjiArai	0:5b88d5760320	2481	/*
kenjiArai	0:5b88d5760320	2482	* Check that an affine point is valid as a public key,
kenjiArai	0:5b88d5760320	2483	* short weierstrass curves (SEC1 3.2.3.1)
kenjiArai	0:5b88d5760320	2484	*/
kenjiArai	0:5b88d5760320	2485	static int ecp_check_pubkey_sw( const mbedtls_ecp_group grp, const mbedtls_ecp_point pt )
kenjiArai	0:5b88d5760320	2486	{
kenjiArai	0:5b88d5760320	2487	int ret;
kenjiArai	0:5b88d5760320	2488	mbedtls_mpi YY, RHS;
kenjiArai	0:5b88d5760320	2489
kenjiArai	0:5b88d5760320	2490	/* pt coordinates must be normalized for our checks */
kenjiArai	0:5b88d5760320	2491	if( mbedtls_mpi_cmp_int( &pt->X, 0 ) < 0 \|\|
kenjiArai	0:5b88d5760320	2492	mbedtls_mpi_cmp_int( &pt->Y, 0 ) < 0 \|\|
kenjiArai	0:5b88d5760320	2493	mbedtls_mpi_cmp_mpi( &pt->X, &grp->P ) >= 0 \|\|
kenjiArai	0:5b88d5760320	2494	mbedtls_mpi_cmp_mpi( &pt->Y, &grp->P ) >= 0 )
kenjiArai	0:5b88d5760320	2495	return( MBEDTLS_ERR_ECP_INVALID_KEY );
kenjiArai	0:5b88d5760320	2496
kenjiArai	0:5b88d5760320	2497	mbedtls_mpi_init( &YY ); mbedtls_mpi_init( &RHS );
kenjiArai	0:5b88d5760320	2498
kenjiArai	0:5b88d5760320	2499	/*
kenjiArai	0:5b88d5760320	2500	* YY = Y^2
kenjiArai	0:5b88d5760320	2501	* RHS = X (X^2 + A) + B = X^3 + A X + B
kenjiArai	0:5b88d5760320	2502	*/
kenjiArai	1:9db0e321a9f4	2503	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &YY, &pt->Y, &pt->Y ) );
kenjiArai	1:9db0e321a9f4	2504	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &RHS, &pt->X, &pt->X ) );
kenjiArai	0:5b88d5760320	2505
kenjiArai	0:5b88d5760320	2506	/* Special case for A = -3 */
kenjiArai	0:5b88d5760320	2507	if( grp->A.p == NULL )
kenjiArai	0:5b88d5760320	2508	{
kenjiArai	0:5b88d5760320	2509	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &RHS, &RHS, 3 ) ); MOD_SUB( RHS );
kenjiArai	0:5b88d5760320	2510	}
kenjiArai	0:5b88d5760320	2511	else
kenjiArai	0:5b88d5760320	2512	{
kenjiArai	1:9db0e321a9f4	2513	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &RHS, &RHS, &grp->A ) );
kenjiArai	0:5b88d5760320	2514	}
kenjiArai	0:5b88d5760320	2515
kenjiArai	1:9db0e321a9f4	2516	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &RHS, &RHS, &pt->X ) );
kenjiArai	1:9db0e321a9f4	2517	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &RHS, &RHS, &grp->B ) );
kenjiArai	0:5b88d5760320	2518
kenjiArai	0:5b88d5760320	2519	if( mbedtls_mpi_cmp_mpi( &YY, &RHS ) != 0 )
kenjiArai	0:5b88d5760320	2520	ret = MBEDTLS_ERR_ECP_INVALID_KEY;
kenjiArai	0:5b88d5760320	2521
kenjiArai	0:5b88d5760320	2522	cleanup:
kenjiArai	0:5b88d5760320	2523
kenjiArai	0:5b88d5760320	2524	mbedtls_mpi_free( &YY ); mbedtls_mpi_free( &RHS );
kenjiArai	0:5b88d5760320	2525
kenjiArai	0:5b88d5760320	2526	return( ret );
kenjiArai	0:5b88d5760320	2527	}
kenjiArai	0:5b88d5760320	2528	#endif /* ECP_SHORTWEIERSTRASS */
kenjiArai	0:5b88d5760320	2529
kenjiArai	0:5b88d5760320	2530	/*
kenjiArai	0:5b88d5760320	2531	* R = m * P with shortcuts for m == 1 and m == -1
kenjiArai	0:5b88d5760320	2532	* NOT constant-time - ONLY for short Weierstrass!
kenjiArai	0:5b88d5760320	2533	*/
kenjiArai	0:5b88d5760320	2534	static int mbedtls_ecp_mul_shortcuts( mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	2535	mbedtls_ecp_point *R,
kenjiArai	0:5b88d5760320	2536	const mbedtls_mpi *m,
kenjiArai	0:5b88d5760320	2537	const mbedtls_ecp_point *P,
kenjiArai	0:5b88d5760320	2538	mbedtls_ecp_restart_ctx *rs_ctx )
kenjiArai	0:5b88d5760320	2539	{
kenjiArai	0:5b88d5760320	2540	int ret;
kenjiArai	0:5b88d5760320	2541
kenjiArai	0:5b88d5760320	2542	if( mbedtls_mpi_cmp_int( m, 1 ) == 0 )
kenjiArai	0:5b88d5760320	2543	{
kenjiArai	0:5b88d5760320	2544	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, P ) );
kenjiArai	0:5b88d5760320	2545	}
kenjiArai	0:5b88d5760320	2546	else if( mbedtls_mpi_cmp_int( m, -1 ) == 0 )
kenjiArai	0:5b88d5760320	2547	{
kenjiArai	0:5b88d5760320	2548	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, P ) );
kenjiArai	0:5b88d5760320	2549	if( mbedtls_mpi_cmp_int( &R->Y, 0 ) != 0 )
kenjiArai	0:5b88d5760320	2550	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &R->Y, &grp->P, &R->Y ) );
kenjiArai	0:5b88d5760320	2551	}
kenjiArai	0:5b88d5760320	2552	else
kenjiArai	0:5b88d5760320	2553	{
kenjiArai	0:5b88d5760320	2554	MBEDTLS_MPI_CHK( mbedtls_ecp_mul_restartable( grp, R, m, P,
kenjiArai	0:5b88d5760320	2555	NULL, NULL, rs_ctx ) );
kenjiArai	0:5b88d5760320	2556	}
kenjiArai	0:5b88d5760320	2557
kenjiArai	0:5b88d5760320	2558	cleanup:
kenjiArai	0:5b88d5760320	2559	return( ret );
kenjiArai	0:5b88d5760320	2560	}
kenjiArai	0:5b88d5760320	2561
kenjiArai	0:5b88d5760320	2562	/*
kenjiArai	0:5b88d5760320	2563	* Restartable linear combination
kenjiArai	0:5b88d5760320	2564	* NOT constant-time
kenjiArai	0:5b88d5760320	2565	*/
kenjiArai	0:5b88d5760320	2566	int mbedtls_ecp_muladd_restartable(
kenjiArai	0:5b88d5760320	2567	mbedtls_ecp_group grp, mbedtls_ecp_point R,
kenjiArai	0:5b88d5760320	2568	const mbedtls_mpi m, const mbedtls_ecp_point P,
kenjiArai	0:5b88d5760320	2569	const mbedtls_mpi n, const mbedtls_ecp_point Q,
kenjiArai	0:5b88d5760320	2570	mbedtls_ecp_restart_ctx *rs_ctx )
kenjiArai	0:5b88d5760320	2571	{
kenjiArai	0:5b88d5760320	2572	int ret;
kenjiArai	0:5b88d5760320	2573	mbedtls_ecp_point mP;
kenjiArai	0:5b88d5760320	2574	mbedtls_ecp_point *pmP = &mP;
kenjiArai	0:5b88d5760320	2575	mbedtls_ecp_point *pR = R;
kenjiArai	0:5b88d5760320	2576	#if defined(MBEDTLS_ECP_INTERNAL_ALT)
kenjiArai	0:5b88d5760320	2577	char is_grp_capable = 0;
kenjiArai	0:5b88d5760320	2578	#endif
kenjiArai	0:5b88d5760320	2579	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	2580	ECP_VALIDATE_RET( R != NULL );
kenjiArai	0:5b88d5760320	2581	ECP_VALIDATE_RET( m != NULL );
kenjiArai	0:5b88d5760320	2582	ECP_VALIDATE_RET( P != NULL );
kenjiArai	0:5b88d5760320	2583	ECP_VALIDATE_RET( n != NULL );
kenjiArai	0:5b88d5760320	2584	ECP_VALIDATE_RET( Q != NULL );
kenjiArai	0:5b88d5760320	2585
kenjiArai	0:5b88d5760320	2586	if( mbedtls_ecp_get_type( grp ) != MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
kenjiArai	0:5b88d5760320	2587	return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
kenjiArai	0:5b88d5760320	2588
kenjiArai	0:5b88d5760320	2589	mbedtls_ecp_point_init( &mP );
kenjiArai	0:5b88d5760320	2590
kenjiArai	0:5b88d5760320	2591	ECP_RS_ENTER( ma );
kenjiArai	0:5b88d5760320	2592
kenjiArai	0:5b88d5760320	2593	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	2594	if( rs_ctx != NULL && rs_ctx->ma != NULL )
kenjiArai	0:5b88d5760320	2595	{
kenjiArai	0:5b88d5760320	2596	/* redirect intermediate results to restart context */
kenjiArai	0:5b88d5760320	2597	pmP = &rs_ctx->ma->mP;
kenjiArai	0:5b88d5760320	2598	pR = &rs_ctx->ma->R;
kenjiArai	0:5b88d5760320	2599
kenjiArai	0:5b88d5760320	2600	/* jump to next operation */
kenjiArai	0:5b88d5760320	2601	if( rs_ctx->ma->state == ecp_rsma_mul2 )
kenjiArai	0:5b88d5760320	2602	goto mul2;
kenjiArai	0:5b88d5760320	2603	if( rs_ctx->ma->state == ecp_rsma_add )
kenjiArai	0:5b88d5760320	2604	goto add;
kenjiArai	0:5b88d5760320	2605	if( rs_ctx->ma->state == ecp_rsma_norm )
kenjiArai	0:5b88d5760320	2606	goto norm;
kenjiArai	0:5b88d5760320	2607	}
kenjiArai	0:5b88d5760320	2608	#endif /* MBEDTLS_ECP_RESTARTABLE */
kenjiArai	0:5b88d5760320	2609
kenjiArai	0:5b88d5760320	2610	MBEDTLS_MPI_CHK( mbedtls_ecp_mul_shortcuts( grp, pmP, m, P, rs_ctx ) );
kenjiArai	0:5b88d5760320	2611	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	2612	if( rs_ctx != NULL && rs_ctx->ma != NULL )
kenjiArai	0:5b88d5760320	2613	rs_ctx->ma->state = ecp_rsma_mul2;
kenjiArai	0:5b88d5760320	2614
kenjiArai	0:5b88d5760320	2615	mul2:
kenjiArai	0:5b88d5760320	2616	#endif
kenjiArai	0:5b88d5760320	2617	MBEDTLS_MPI_CHK( mbedtls_ecp_mul_shortcuts( grp, pR, n, Q, rs_ctx ) );
kenjiArai	0:5b88d5760320	2618
kenjiArai	0:5b88d5760320	2619	#if defined(MBEDTLS_ECP_INTERNAL_ALT)
kenjiArai	0:5b88d5760320	2620	if( ( is_grp_capable = mbedtls_internal_ecp_grp_capable( grp ) ) )
kenjiArai	0:5b88d5760320	2621	MBEDTLS_MPI_CHK( mbedtls_internal_ecp_init( grp ) );
kenjiArai	0:5b88d5760320	2622	#endif /* MBEDTLS_ECP_INTERNAL_ALT */
kenjiArai	0:5b88d5760320	2623
kenjiArai	0:5b88d5760320	2624	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	2625	if( rs_ctx != NULL && rs_ctx->ma != NULL )
kenjiArai	0:5b88d5760320	2626	rs_ctx->ma->state = ecp_rsma_add;
kenjiArai	0:5b88d5760320	2627
kenjiArai	0:5b88d5760320	2628	add:
kenjiArai	0:5b88d5760320	2629	#endif
kenjiArai	0:5b88d5760320	2630	MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_ADD );
kenjiArai	0:5b88d5760320	2631	MBEDTLS_MPI_CHK( ecp_add_mixed( grp, pR, pmP, pR ) );
kenjiArai	0:5b88d5760320	2632	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	2633	if( rs_ctx != NULL && rs_ctx->ma != NULL )
kenjiArai	0:5b88d5760320	2634	rs_ctx->ma->state = ecp_rsma_norm;
kenjiArai	0:5b88d5760320	2635
kenjiArai	0:5b88d5760320	2636	norm:
kenjiArai	0:5b88d5760320	2637	#endif
kenjiArai	0:5b88d5760320	2638	MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV );
kenjiArai	0:5b88d5760320	2639	MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, pR ) );
kenjiArai	0:5b88d5760320	2640
kenjiArai	0:5b88d5760320	2641	#if defined(MBEDTLS_ECP_RESTARTABLE)
kenjiArai	0:5b88d5760320	2642	if( rs_ctx != NULL && rs_ctx->ma != NULL )
kenjiArai	0:5b88d5760320	2643	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, pR ) );
kenjiArai	0:5b88d5760320	2644	#endif
kenjiArai	0:5b88d5760320	2645
kenjiArai	0:5b88d5760320	2646	cleanup:
kenjiArai	0:5b88d5760320	2647	#if defined(MBEDTLS_ECP_INTERNAL_ALT)
kenjiArai	0:5b88d5760320	2648	if( is_grp_capable )
kenjiArai	0:5b88d5760320	2649	mbedtls_internal_ecp_free( grp );
kenjiArai	0:5b88d5760320	2650	#endif /* MBEDTLS_ECP_INTERNAL_ALT */
kenjiArai	0:5b88d5760320	2651
kenjiArai	0:5b88d5760320	2652	mbedtls_ecp_point_free( &mP );
kenjiArai	0:5b88d5760320	2653
kenjiArai	0:5b88d5760320	2654	ECP_RS_LEAVE( ma );
kenjiArai	0:5b88d5760320	2655
kenjiArai	0:5b88d5760320	2656	return( ret );
kenjiArai	0:5b88d5760320	2657	}
kenjiArai	0:5b88d5760320	2658
kenjiArai	0:5b88d5760320	2659	/*
kenjiArai	0:5b88d5760320	2660	* Linear combination
kenjiArai	0:5b88d5760320	2661	* NOT constant-time
kenjiArai	0:5b88d5760320	2662	*/
kenjiArai	0:5b88d5760320	2663	int mbedtls_ecp_muladd( mbedtls_ecp_group grp, mbedtls_ecp_point R,
kenjiArai	0:5b88d5760320	2664	const mbedtls_mpi m, const mbedtls_ecp_point P,
kenjiArai	0:5b88d5760320	2665	const mbedtls_mpi n, const mbedtls_ecp_point Q )
kenjiArai	0:5b88d5760320	2666	{
kenjiArai	0:5b88d5760320	2667	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	2668	ECP_VALIDATE_RET( R != NULL );
kenjiArai	0:5b88d5760320	2669	ECP_VALIDATE_RET( m != NULL );
kenjiArai	0:5b88d5760320	2670	ECP_VALIDATE_RET( P != NULL );
kenjiArai	0:5b88d5760320	2671	ECP_VALIDATE_RET( n != NULL );
kenjiArai	0:5b88d5760320	2672	ECP_VALIDATE_RET( Q != NULL );
kenjiArai	0:5b88d5760320	2673	return( mbedtls_ecp_muladd_restartable( grp, R, m, P, n, Q, NULL ) );
kenjiArai	0:5b88d5760320	2674	}
kenjiArai	0:5b88d5760320	2675
kenjiArai	0:5b88d5760320	2676	#if defined(ECP_MONTGOMERY)
kenjiArai	0:5b88d5760320	2677	/*
kenjiArai	0:5b88d5760320	2678	* Check validity of a public key for Montgomery curves with x-only schemes
kenjiArai	0:5b88d5760320	2679	*/
kenjiArai	0:5b88d5760320	2680	static int ecp_check_pubkey_mx( const mbedtls_ecp_group grp, const mbedtls_ecp_point pt )
kenjiArai	0:5b88d5760320	2681	{
kenjiArai	0:5b88d5760320	2682	/* [Curve25519 p. 5] Just check X is the correct number of bytes */
kenjiArai	0:5b88d5760320	2683	/* Allow any public value, if it's too big then we'll just reduce it mod p
kenjiArai	0:5b88d5760320	2684	* (RFC 7748 sec. 5 para. 3). */
kenjiArai	0:5b88d5760320	2685	if( mbedtls_mpi_size( &pt->X ) > ( grp->nbits + 7 ) / 8 )
kenjiArai	0:5b88d5760320	2686	return( MBEDTLS_ERR_ECP_INVALID_KEY );
kenjiArai	0:5b88d5760320	2687
kenjiArai	0:5b88d5760320	2688	return( 0 );
kenjiArai	0:5b88d5760320	2689	}
kenjiArai	0:5b88d5760320	2690	#endif /* ECP_MONTGOMERY */
kenjiArai	0:5b88d5760320	2691
kenjiArai	0:5b88d5760320	2692	/*
kenjiArai	0:5b88d5760320	2693	* Check that a point is valid as a public key
kenjiArai	0:5b88d5760320	2694	*/
kenjiArai	0:5b88d5760320	2695	int mbedtls_ecp_check_pubkey( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	2696	const mbedtls_ecp_point *pt )
kenjiArai	0:5b88d5760320	2697	{
kenjiArai	0:5b88d5760320	2698	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	2699	ECP_VALIDATE_RET( pt != NULL );
kenjiArai	0:5b88d5760320	2700
kenjiArai	0:5b88d5760320	2701	/* Must use affine coordinates */
kenjiArai	0:5b88d5760320	2702	if( mbedtls_mpi_cmp_int( &pt->Z, 1 ) != 0 )
kenjiArai	0:5b88d5760320	2703	return( MBEDTLS_ERR_ECP_INVALID_KEY );
kenjiArai	0:5b88d5760320	2704
kenjiArai	0:5b88d5760320	2705	#if defined(ECP_MONTGOMERY)
kenjiArai	0:5b88d5760320	2706	if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
kenjiArai	0:5b88d5760320	2707	return( ecp_check_pubkey_mx( grp, pt ) );
kenjiArai	0:5b88d5760320	2708	#endif
kenjiArai	0:5b88d5760320	2709	#if defined(ECP_SHORTWEIERSTRASS)
kenjiArai	0:5b88d5760320	2710	if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
kenjiArai	0:5b88d5760320	2711	return( ecp_check_pubkey_sw( grp, pt ) );
kenjiArai	0:5b88d5760320	2712	#endif
kenjiArai	0:5b88d5760320	2713	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	2714	}
kenjiArai	0:5b88d5760320	2715
kenjiArai	0:5b88d5760320	2716	/*
kenjiArai	0:5b88d5760320	2717	* Check that an mbedtls_mpi is valid as a private key
kenjiArai	0:5b88d5760320	2718	*/
kenjiArai	0:5b88d5760320	2719	int mbedtls_ecp_check_privkey( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	2720	const mbedtls_mpi *d )
kenjiArai	0:5b88d5760320	2721	{
kenjiArai	0:5b88d5760320	2722	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	2723	ECP_VALIDATE_RET( d != NULL );
kenjiArai	0:5b88d5760320	2724
kenjiArai	0:5b88d5760320	2725	#if defined(ECP_MONTGOMERY)
kenjiArai	0:5b88d5760320	2726	if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
kenjiArai	0:5b88d5760320	2727	{
kenjiArai	0:5b88d5760320	2728	/* see RFC 7748 sec. 5 para. 5 */
kenjiArai	0:5b88d5760320	2729	if( mbedtls_mpi_get_bit( d, 0 ) != 0 \|\|
kenjiArai	0:5b88d5760320	2730	mbedtls_mpi_get_bit( d, 1 ) != 0 \|\|
kenjiArai	0:5b88d5760320	2731	mbedtls_mpi_bitlen( d ) - 1 != grp->nbits ) /* mbedtls_mpi_bitlen is one-based! */
kenjiArai	0:5b88d5760320	2732	return( MBEDTLS_ERR_ECP_INVALID_KEY );
kenjiArai	0:5b88d5760320	2733
kenjiArai	0:5b88d5760320	2734	/* see [Curve25519] page 5 */
kenjiArai	0:5b88d5760320	2735	if( grp->nbits == 254 && mbedtls_mpi_get_bit( d, 2 ) != 0 )
kenjiArai	0:5b88d5760320	2736	return( MBEDTLS_ERR_ECP_INVALID_KEY );
kenjiArai	0:5b88d5760320	2737
kenjiArai	0:5b88d5760320	2738	return( 0 );
kenjiArai	0:5b88d5760320	2739	}
kenjiArai	0:5b88d5760320	2740	#endif /* ECP_MONTGOMERY */
kenjiArai	0:5b88d5760320	2741	#if defined(ECP_SHORTWEIERSTRASS)
kenjiArai	0:5b88d5760320	2742	if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
kenjiArai	0:5b88d5760320	2743	{
kenjiArai	0:5b88d5760320	2744	/* see SEC1 3.2 */
kenjiArai	0:5b88d5760320	2745	if( mbedtls_mpi_cmp_int( d, 1 ) < 0 \|\|
kenjiArai	0:5b88d5760320	2746	mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 )
kenjiArai	0:5b88d5760320	2747	return( MBEDTLS_ERR_ECP_INVALID_KEY );
kenjiArai	0:5b88d5760320	2748	else
kenjiArai	0:5b88d5760320	2749	return( 0 );
kenjiArai	0:5b88d5760320	2750	}
kenjiArai	0:5b88d5760320	2751	#endif /* ECP_SHORTWEIERSTRASS */
kenjiArai	0:5b88d5760320	2752
kenjiArai	0:5b88d5760320	2753	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	2754	}
kenjiArai	0:5b88d5760320	2755
kenjiArai	0:5b88d5760320	2756	/*
kenjiArai	0:5b88d5760320	2757	* Generate a private key
kenjiArai	0:5b88d5760320	2758	*/
kenjiArai	0:5b88d5760320	2759	int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	2760	mbedtls_mpi *d,
kenjiArai	0:5b88d5760320	2761	int (f_rng)(void , unsigned char *, size_t),
kenjiArai	0:5b88d5760320	2762	void *p_rng )
kenjiArai	0:5b88d5760320	2763	{
kenjiArai	0:5b88d5760320	2764	int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
kenjiArai	0:5b88d5760320	2765	size_t n_size;
kenjiArai	0:5b88d5760320	2766
kenjiArai	0:5b88d5760320	2767	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	2768	ECP_VALIDATE_RET( d != NULL );
kenjiArai	0:5b88d5760320	2769	ECP_VALIDATE_RET( f_rng != NULL );
kenjiArai	0:5b88d5760320	2770
kenjiArai	0:5b88d5760320	2771	n_size = ( grp->nbits + 7 ) / 8;
kenjiArai	0:5b88d5760320	2772
kenjiArai	0:5b88d5760320	2773	#if defined(ECP_MONTGOMERY)
kenjiArai	0:5b88d5760320	2774	if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
kenjiArai	0:5b88d5760320	2775	{
kenjiArai	0:5b88d5760320	2776	/* [M225] page 5 */
kenjiArai	0:5b88d5760320	2777	size_t b;
kenjiArai	0:5b88d5760320	2778
kenjiArai	0:5b88d5760320	2779	do {
kenjiArai	0:5b88d5760320	2780	MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( d, n_size, f_rng, p_rng ) );
kenjiArai	0:5b88d5760320	2781	} while( mbedtls_mpi_bitlen( d ) == 0);
kenjiArai	0:5b88d5760320	2782
kenjiArai	0:5b88d5760320	2783	/* Make sure the most significant bit is nbits */
kenjiArai	0:5b88d5760320	2784	b = mbedtls_mpi_bitlen( d ) - 1; /* mbedtls_mpi_bitlen is one-based */
kenjiArai	0:5b88d5760320	2785	if( b > grp->nbits )
kenjiArai	0:5b88d5760320	2786	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( d, b - grp->nbits ) );
kenjiArai	0:5b88d5760320	2787	else
kenjiArai	0:5b88d5760320	2788	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, grp->nbits, 1 ) );
kenjiArai	0:5b88d5760320	2789
kenjiArai	0:5b88d5760320	2790	/* Make sure the last two bits are unset for Curve448, three bits for
kenjiArai	0:5b88d5760320	2791	Curve25519 */
kenjiArai	0:5b88d5760320	2792	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 0, 0 ) );
kenjiArai	0:5b88d5760320	2793	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 1, 0 ) );
kenjiArai	0:5b88d5760320	2794	if( grp->nbits == 254 )
kenjiArai	0:5b88d5760320	2795	{
kenjiArai	0:5b88d5760320	2796	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 2, 0 ) );
kenjiArai	0:5b88d5760320	2797	}
kenjiArai	0:5b88d5760320	2798	}
kenjiArai	0:5b88d5760320	2799	#endif /* ECP_MONTGOMERY */
kenjiArai	0:5b88d5760320	2800
kenjiArai	0:5b88d5760320	2801	#if defined(ECP_SHORTWEIERSTRASS)
kenjiArai	0:5b88d5760320	2802	if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
kenjiArai	0:5b88d5760320	2803	{
kenjiArai	0:5b88d5760320	2804	/* SEC1 3.2.1: Generate d such that 1 <= n < N */
kenjiArai	0:5b88d5760320	2805	int count = 0;
kenjiArai	0:5b88d5760320	2806
kenjiArai	0:5b88d5760320	2807	/*
kenjiArai	0:5b88d5760320	2808	* Match the procedure given in RFC 6979 (deterministic ECDSA):
kenjiArai	0:5b88d5760320	2809	* - use the same byte ordering;
kenjiArai	0:5b88d5760320	2810	* - keep the leftmost nbits bits of the generated octet string;
kenjiArai	0:5b88d5760320	2811	* - try until result is in the desired range.
kenjiArai	0:5b88d5760320	2812	* This also avoids any biais, which is especially important for ECDSA.
kenjiArai	0:5b88d5760320	2813	*/
kenjiArai	0:5b88d5760320	2814	do
kenjiArai	0:5b88d5760320	2815	{
kenjiArai	0:5b88d5760320	2816	MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( d, n_size, f_rng, p_rng ) );
kenjiArai	0:5b88d5760320	2817	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( d, 8 * n_size - grp->nbits ) );
kenjiArai	0:5b88d5760320	2818
kenjiArai	0:5b88d5760320	2819	/*
kenjiArai	0:5b88d5760320	2820	* Each try has at worst a probability 1/2 of failing (the msb has
kenjiArai	0:5b88d5760320	2821	* a probability 1/2 of being 0, and then the result will be < N),
kenjiArai	0:5b88d5760320	2822	* so after 30 tries failure probability is a most 2**(-30).
kenjiArai	0:5b88d5760320	2823	*
kenjiArai	0:5b88d5760320	2824	* For most curves, 1 try is enough with overwhelming probability,
kenjiArai	0:5b88d5760320	2825	* since N starts with a lot of 1s in binary, but some curves
kenjiArai	0:5b88d5760320	2826	* such as secp224k1 are actually very close to the worst case.
kenjiArai	0:5b88d5760320	2827	*/
kenjiArai	0:5b88d5760320	2828	if( ++count > 30 )
kenjiArai	0:5b88d5760320	2829	return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
kenjiArai	0:5b88d5760320	2830	}
kenjiArai	0:5b88d5760320	2831	while( mbedtls_mpi_cmp_int( d, 1 ) < 0 \|\|
kenjiArai	0:5b88d5760320	2832	mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 );
kenjiArai	0:5b88d5760320	2833	}
kenjiArai	0:5b88d5760320	2834	#endif /* ECP_SHORTWEIERSTRASS */
kenjiArai	0:5b88d5760320	2835
kenjiArai	0:5b88d5760320	2836	cleanup:
kenjiArai	0:5b88d5760320	2837	return( ret );
kenjiArai	0:5b88d5760320	2838	}
kenjiArai	0:5b88d5760320	2839
kenjiArai	0:5b88d5760320	2840	/*
kenjiArai	0:5b88d5760320	2841	* Generate a keypair with configurable base point
kenjiArai	0:5b88d5760320	2842	*/
kenjiArai	0:5b88d5760320	2843	int mbedtls_ecp_gen_keypair_base( mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	2844	const mbedtls_ecp_point *G,
kenjiArai	0:5b88d5760320	2845	mbedtls_mpi d, mbedtls_ecp_point Q,
kenjiArai	0:5b88d5760320	2846	int (f_rng)(void , unsigned char *, size_t),
kenjiArai	0:5b88d5760320	2847	void *p_rng )
kenjiArai	0:5b88d5760320	2848	{
kenjiArai	0:5b88d5760320	2849	int ret;
kenjiArai	0:5b88d5760320	2850	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	2851	ECP_VALIDATE_RET( d != NULL );
kenjiArai	0:5b88d5760320	2852	ECP_VALIDATE_RET( G != NULL );
kenjiArai	0:5b88d5760320	2853	ECP_VALIDATE_RET( Q != NULL );
kenjiArai	0:5b88d5760320	2854	ECP_VALIDATE_RET( f_rng != NULL );
kenjiArai	0:5b88d5760320	2855
kenjiArai	0:5b88d5760320	2856	MBEDTLS_MPI_CHK( mbedtls_ecp_gen_privkey( grp, d, f_rng, p_rng ) );
kenjiArai	0:5b88d5760320	2857	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, Q, d, G, f_rng, p_rng ) );
kenjiArai	0:5b88d5760320	2858
kenjiArai	0:5b88d5760320	2859	cleanup:
kenjiArai	0:5b88d5760320	2860	return( ret );
kenjiArai	0:5b88d5760320	2861	}
kenjiArai	0:5b88d5760320	2862
kenjiArai	0:5b88d5760320	2863	/*
kenjiArai	0:5b88d5760320	2864	* Generate key pair, wrapper for conventional base point
kenjiArai	0:5b88d5760320	2865	*/
kenjiArai	0:5b88d5760320	2866	int mbedtls_ecp_gen_keypair( mbedtls_ecp_group *grp,
kenjiArai	0:5b88d5760320	2867	mbedtls_mpi d, mbedtls_ecp_point Q,
kenjiArai	0:5b88d5760320	2868	int (f_rng)(void , unsigned char *, size_t),
kenjiArai	0:5b88d5760320	2869	void *p_rng )
kenjiArai	0:5b88d5760320	2870	{
kenjiArai	0:5b88d5760320	2871	ECP_VALIDATE_RET( grp != NULL );
kenjiArai	0:5b88d5760320	2872	ECP_VALIDATE_RET( d != NULL );
kenjiArai	0:5b88d5760320	2873	ECP_VALIDATE_RET( Q != NULL );
kenjiArai	0:5b88d5760320	2874	ECP_VALIDATE_RET( f_rng != NULL );
kenjiArai	0:5b88d5760320	2875
kenjiArai	0:5b88d5760320	2876	return( mbedtls_ecp_gen_keypair_base( grp, &grp->G, d, Q, f_rng, p_rng ) );
kenjiArai	0:5b88d5760320	2877	}
kenjiArai	0:5b88d5760320	2878
kenjiArai	0:5b88d5760320	2879	/*
kenjiArai	0:5b88d5760320	2880	* Generate a keypair, prettier wrapper
kenjiArai	0:5b88d5760320	2881	*/
kenjiArai	0:5b88d5760320	2882	int mbedtls_ecp_gen_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
kenjiArai	0:5b88d5760320	2883	int (f_rng)(void , unsigned char , size_t), void p_rng )
kenjiArai	0:5b88d5760320	2884	{
kenjiArai	0:5b88d5760320	2885	int ret;
kenjiArai	0:5b88d5760320	2886	ECP_VALIDATE_RET( key != NULL );
kenjiArai	0:5b88d5760320	2887	ECP_VALIDATE_RET( f_rng != NULL );
kenjiArai	0:5b88d5760320	2888
kenjiArai	0:5b88d5760320	2889	if( ( ret = mbedtls_ecp_group_load( &key->grp, grp_id ) ) != 0 )
kenjiArai	0:5b88d5760320	2890	return( ret );
kenjiArai	0:5b88d5760320	2891
kenjiArai	0:5b88d5760320	2892	return( mbedtls_ecp_gen_keypair( &key->grp, &key->d, &key->Q, f_rng, p_rng ) );
kenjiArai	0:5b88d5760320	2893	}
kenjiArai	0:5b88d5760320	2894
kenjiArai	0:5b88d5760320	2895	#define ECP_CURVE25519_KEY_SIZE 32
kenjiArai	0:5b88d5760320	2896	/*
kenjiArai	0:5b88d5760320	2897	* Read a private key.
kenjiArai	0:5b88d5760320	2898	*/
kenjiArai	0:5b88d5760320	2899	int mbedtls_ecp_read_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
kenjiArai	0:5b88d5760320	2900	const unsigned char *buf, size_t buflen )
kenjiArai	0:5b88d5760320	2901	{
kenjiArai	0:5b88d5760320	2902	int ret = 0;
kenjiArai	0:5b88d5760320	2903
kenjiArai	0:5b88d5760320	2904	ECP_VALIDATE_RET( key != NULL );
kenjiArai	0:5b88d5760320	2905	ECP_VALIDATE_RET( buf != NULL );
kenjiArai	0:5b88d5760320	2906
kenjiArai	0:5b88d5760320	2907	if( ( ret = mbedtls_ecp_group_load( &key->grp, grp_id ) ) != 0 )
kenjiArai	0:5b88d5760320	2908	return( ret );
kenjiArai	0:5b88d5760320	2909
kenjiArai	0:5b88d5760320	2910	ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
kenjiArai	0:5b88d5760320	2911
kenjiArai	0:5b88d5760320	2912	#if defined(ECP_MONTGOMERY)
kenjiArai	0:5b88d5760320	2913	if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
kenjiArai	0:5b88d5760320	2914	{
kenjiArai	0:5b88d5760320	2915	/*
kenjiArai	0:5b88d5760320	2916	* If it is Curve25519 curve then mask the key as mandated by RFC7748
kenjiArai	0:5b88d5760320	2917	*/
kenjiArai	0:5b88d5760320	2918	if( grp_id == MBEDTLS_ECP_DP_CURVE25519 )
kenjiArai	0:5b88d5760320	2919	{
kenjiArai	0:5b88d5760320	2920	if( buflen != ECP_CURVE25519_KEY_SIZE )
kenjiArai	0:5b88d5760320	2921	return MBEDTLS_ERR_ECP_INVALID_KEY;
kenjiArai	0:5b88d5760320	2922
kenjiArai	0:5b88d5760320	2923	MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary_le( &key->d, buf, buflen ) );
kenjiArai	0:5b88d5760320	2924
kenjiArai	0:5b88d5760320	2925	/* Set the three least significant bits to 0 */
kenjiArai	0:5b88d5760320	2926	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &key->d, 0, 0 ) );
kenjiArai	0:5b88d5760320	2927	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &key->d, 1, 0 ) );
kenjiArai	0:5b88d5760320	2928	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &key->d, 2, 0 ) );
kenjiArai	0:5b88d5760320	2929
kenjiArai	0:5b88d5760320	2930	/* Set the most significant bit to 0 */
kenjiArai	0:5b88d5760320	2931	MBEDTLS_MPI_CHK(
kenjiArai	0:5b88d5760320	2932	mbedtls_mpi_set_bit( &key->d,
kenjiArai	0:5b88d5760320	2933	ECP_CURVE25519_KEY_SIZE * 8 - 1, 0 )
kenjiArai	0:5b88d5760320	2934	);
kenjiArai	0:5b88d5760320	2935
kenjiArai	0:5b88d5760320	2936	/* Set the second most significant bit to 1 */
kenjiArai	0:5b88d5760320	2937	MBEDTLS_MPI_CHK(
kenjiArai	0:5b88d5760320	2938	mbedtls_mpi_set_bit( &key->d,
kenjiArai	0:5b88d5760320	2939	ECP_CURVE25519_KEY_SIZE * 8 - 2, 1 )
kenjiArai	0:5b88d5760320	2940	);
kenjiArai	0:5b88d5760320	2941	}
kenjiArai	0:5b88d5760320	2942	else
kenjiArai	0:5b88d5760320	2943	ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
kenjiArai	0:5b88d5760320	2944	}
kenjiArai	0:5b88d5760320	2945
kenjiArai	0:5b88d5760320	2946	#endif
kenjiArai	0:5b88d5760320	2947	#if defined(ECP_SHORTWEIERSTRASS)
kenjiArai	0:5b88d5760320	2948	if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
kenjiArai	0:5b88d5760320	2949	{
kenjiArai	0:5b88d5760320	2950	MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &key->d, buf, buflen ) );
kenjiArai	0:5b88d5760320	2951
kenjiArai	0:5b88d5760320	2952	MBEDTLS_MPI_CHK( mbedtls_ecp_check_privkey( &key->grp, &key->d ) );
kenjiArai	0:5b88d5760320	2953	}
kenjiArai	0:5b88d5760320	2954
kenjiArai	0:5b88d5760320	2955	#endif
kenjiArai	0:5b88d5760320	2956	cleanup:
kenjiArai	0:5b88d5760320	2957
kenjiArai	0:5b88d5760320	2958	if( ret != 0 )
kenjiArai	0:5b88d5760320	2959	mbedtls_mpi_free( &key->d );
kenjiArai	0:5b88d5760320	2960
kenjiArai	0:5b88d5760320	2961	return( ret );
kenjiArai	0:5b88d5760320	2962	}
kenjiArai	0:5b88d5760320	2963
kenjiArai	0:5b88d5760320	2964	/*
kenjiArai	0:5b88d5760320	2965	* Check a public-private key pair
kenjiArai	0:5b88d5760320	2966	*/
kenjiArai	0:5b88d5760320	2967	int mbedtls_ecp_check_pub_priv( const mbedtls_ecp_keypair pub, const mbedtls_ecp_keypair prv )
kenjiArai	0:5b88d5760320	2968	{
kenjiArai	0:5b88d5760320	2969	int ret;
kenjiArai	0:5b88d5760320	2970	mbedtls_ecp_point Q;
kenjiArai	0:5b88d5760320	2971	mbedtls_ecp_group grp;
kenjiArai	0:5b88d5760320	2972	ECP_VALIDATE_RET( pub != NULL );
kenjiArai	0:5b88d5760320	2973	ECP_VALIDATE_RET( prv != NULL );
kenjiArai	0:5b88d5760320	2974
kenjiArai	0:5b88d5760320	2975	if( pub->grp.id == MBEDTLS_ECP_DP_NONE \|\|
kenjiArai	0:5b88d5760320	2976	pub->grp.id != prv->grp.id \|\|
kenjiArai	0:5b88d5760320	2977	mbedtls_mpi_cmp_mpi( &pub->Q.X, &prv->Q.X ) \|\|
kenjiArai	0:5b88d5760320	2978	mbedtls_mpi_cmp_mpi( &pub->Q.Y, &prv->Q.Y ) \|\|
kenjiArai	0:5b88d5760320	2979	mbedtls_mpi_cmp_mpi( &pub->Q.Z, &prv->Q.Z ) )
kenjiArai	0:5b88d5760320	2980	{
kenjiArai	0:5b88d5760320	2981	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
kenjiArai	0:5b88d5760320	2982	}
kenjiArai	0:5b88d5760320	2983
kenjiArai	0:5b88d5760320	2984	mbedtls_ecp_point_init( &Q );
kenjiArai	0:5b88d5760320	2985	mbedtls_ecp_group_init( &grp );
kenjiArai	0:5b88d5760320	2986
kenjiArai	0:5b88d5760320	2987	/* mbedtls_ecp_mul() needs a non-const group... */
kenjiArai	0:5b88d5760320	2988	mbedtls_ecp_group_copy( &grp, &prv->grp );
kenjiArai	0:5b88d5760320	2989
kenjiArai	0:5b88d5760320	2990	/* Also checks d is valid */
kenjiArai	0:5b88d5760320	2991	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &Q, &prv->d, &prv->grp.G, NULL, NULL ) );
kenjiArai	0:5b88d5760320	2992
kenjiArai	0:5b88d5760320	2993	if( mbedtls_mpi_cmp_mpi( &Q.X, &prv->Q.X ) \|\|
kenjiArai	0:5b88d5760320	2994	mbedtls_mpi_cmp_mpi( &Q.Y, &prv->Q.Y ) \|\|
kenjiArai	0:5b88d5760320	2995	mbedtls_mpi_cmp_mpi( &Q.Z, &prv->Q.Z ) )
kenjiArai	0:5b88d5760320	2996	{
kenjiArai	0:5b88d5760320	2997	ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
kenjiArai	0:5b88d5760320	2998	goto cleanup;
kenjiArai	0:5b88d5760320	2999	}
kenjiArai	0:5b88d5760320	3000
kenjiArai	0:5b88d5760320	3001	cleanup:
kenjiArai	0:5b88d5760320	3002	mbedtls_ecp_point_free( &Q );
kenjiArai	0:5b88d5760320	3003	mbedtls_ecp_group_free( &grp );
kenjiArai	0:5b88d5760320	3004
kenjiArai	0:5b88d5760320	3005	return( ret );
kenjiArai	0:5b88d5760320	3006	}
kenjiArai	0:5b88d5760320	3007
kenjiArai	0:5b88d5760320	3008	#if defined(MBEDTLS_SELF_TEST)
kenjiArai	0:5b88d5760320	3009
kenjiArai	0:5b88d5760320	3010	/*
kenjiArai	0:5b88d5760320	3011	* Checkup routine
kenjiArai	0:5b88d5760320	3012	*/
kenjiArai	0:5b88d5760320	3013	int mbedtls_ecp_self_test( int verbose )
kenjiArai	0:5b88d5760320	3014	{
kenjiArai	0:5b88d5760320	3015	int ret;
kenjiArai	0:5b88d5760320	3016	size_t i;
kenjiArai	0:5b88d5760320	3017	mbedtls_ecp_group grp;
kenjiArai	0:5b88d5760320	3018	mbedtls_ecp_point R, P;
kenjiArai	0:5b88d5760320	3019	mbedtls_mpi m;
kenjiArai	0:5b88d5760320	3020	unsigned long add_c_prev, dbl_c_prev, mul_c_prev;
kenjiArai	0:5b88d5760320	3021	/* exponents especially adapted for secp192r1 */
kenjiArai	0:5b88d5760320	3022	const char *exponents[] =
kenjiArai	0:5b88d5760320	3023	{
kenjiArai	0:5b88d5760320	3024	"000000000000000000000000000000000000000000000001", /* one */
kenjiArai	0:5b88d5760320	3025	"FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22830", /* N - 1 */
kenjiArai	0:5b88d5760320	3026	"5EA6F389A38B8BC81E767753B15AA5569E1782E30ABE7D25", /* random */
kenjiArai	0:5b88d5760320	3027	"400000000000000000000000000000000000000000000000", /* one and zeros */
kenjiArai	0:5b88d5760320	3028	"7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", /* all ones */
kenjiArai	0:5b88d5760320	3029	"555555555555555555555555555555555555555555555555", /* 101010... */
kenjiArai	0:5b88d5760320	3030	};
kenjiArai	0:5b88d5760320	3031
kenjiArai	0:5b88d5760320	3032	mbedtls_ecp_group_init( &grp );
kenjiArai	0:5b88d5760320	3033	mbedtls_ecp_point_init( &R );
kenjiArai	0:5b88d5760320	3034	mbedtls_ecp_point_init( &P );
kenjiArai	0:5b88d5760320	3035	mbedtls_mpi_init( &m );
kenjiArai	0:5b88d5760320	3036
kenjiArai	0:5b88d5760320	3037	/* Use secp192r1 if available, or any available curve */
kenjiArai	0:5b88d5760320	3038	#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
kenjiArai	0:5b88d5760320	3039	MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, MBEDTLS_ECP_DP_SECP192R1 ) );
kenjiArai	0:5b88d5760320	3040	#else
kenjiArai	0:5b88d5760320	3041	MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, mbedtls_ecp_curve_list()->grp_id ) );
kenjiArai	0:5b88d5760320	3042	#endif
kenjiArai	0:5b88d5760320	3043
kenjiArai	0:5b88d5760320	3044	if( verbose != 0 )
kenjiArai	0:5b88d5760320	3045	mbedtls_printf( " ECP test #1 (constant op_count, base point G): " );
kenjiArai	0:5b88d5760320	3046
kenjiArai	0:5b88d5760320	3047	/* Do a dummy multiplication first to trigger precomputation */
kenjiArai	0:5b88d5760320	3048	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &m, 2 ) );
kenjiArai	0:5b88d5760320	3049	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &P, &m, &grp.G, NULL, NULL ) );
kenjiArai	0:5b88d5760320	3050
kenjiArai	0:5b88d5760320	3051	add_count = 0;
kenjiArai	0:5b88d5760320	3052	dbl_count = 0;
kenjiArai	0:5b88d5760320	3053	mul_count = 0;
kenjiArai	0:5b88d5760320	3054	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[0] ) );
kenjiArai	0:5b88d5760320	3055	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &grp.G, NULL, NULL ) );
kenjiArai	0:5b88d5760320	3056
kenjiArai	0:5b88d5760320	3057	for( i = 1; i < sizeof( exponents ) / sizeof( exponents[0] ); i++ )
kenjiArai	0:5b88d5760320	3058	{
kenjiArai	0:5b88d5760320	3059	add_c_prev = add_count;
kenjiArai	0:5b88d5760320	3060	dbl_c_prev = dbl_count;
kenjiArai	0:5b88d5760320	3061	mul_c_prev = mul_count;
kenjiArai	0:5b88d5760320	3062	add_count = 0;
kenjiArai	0:5b88d5760320	3063	dbl_count = 0;
kenjiArai	0:5b88d5760320	3064	mul_count = 0;
kenjiArai	0:5b88d5760320	3065
kenjiArai	0:5b88d5760320	3066	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[i] ) );
kenjiArai	0:5b88d5760320	3067	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &grp.G, NULL, NULL ) );
kenjiArai	0:5b88d5760320	3068
kenjiArai	0:5b88d5760320	3069	if( add_count != add_c_prev \|\|
kenjiArai	0:5b88d5760320	3070	dbl_count != dbl_c_prev \|\|
kenjiArai	0:5b88d5760320	3071	mul_count != mul_c_prev )
kenjiArai	0:5b88d5760320	3072	{
kenjiArai	0:5b88d5760320	3073	if( verbose != 0 )
kenjiArai	0:5b88d5760320	3074	mbedtls_printf( "failed (%u)\n", (unsigned int) i );
kenjiArai	0:5b88d5760320	3075
kenjiArai	0:5b88d5760320	3076	ret = 1;
kenjiArai	0:5b88d5760320	3077	goto cleanup;
kenjiArai	0:5b88d5760320	3078	}
kenjiArai	0:5b88d5760320	3079	}
kenjiArai	0:5b88d5760320	3080
kenjiArai	0:5b88d5760320	3081	if( verbose != 0 )
kenjiArai	0:5b88d5760320	3082	mbedtls_printf( "passed\n" );
kenjiArai	0:5b88d5760320	3083
kenjiArai	0:5b88d5760320	3084	if( verbose != 0 )
kenjiArai	0:5b88d5760320	3085	mbedtls_printf( " ECP test #2 (constant op_count, other point): " );
kenjiArai	0:5b88d5760320	3086	/* We computed P = 2G last time, use it */
kenjiArai	0:5b88d5760320	3087
kenjiArai	0:5b88d5760320	3088	add_count = 0;
kenjiArai	0:5b88d5760320	3089	dbl_count = 0;
kenjiArai	0:5b88d5760320	3090	mul_count = 0;
kenjiArai	0:5b88d5760320	3091	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[0] ) );
kenjiArai	0:5b88d5760320	3092	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &P, NULL, NULL ) );
kenjiArai	0:5b88d5760320	3093
kenjiArai	0:5b88d5760320	3094	for( i = 1; i < sizeof( exponents ) / sizeof( exponents[0] ); i++ )
kenjiArai	0:5b88d5760320	3095	{
kenjiArai	0:5b88d5760320	3096	add_c_prev = add_count;
kenjiArai	0:5b88d5760320	3097	dbl_c_prev = dbl_count;
kenjiArai	0:5b88d5760320	3098	mul_c_prev = mul_count;
kenjiArai	0:5b88d5760320	3099	add_count = 0;
kenjiArai	0:5b88d5760320	3100	dbl_count = 0;
kenjiArai	0:5b88d5760320	3101	mul_count = 0;
kenjiArai	0:5b88d5760320	3102
kenjiArai	0:5b88d5760320	3103	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[i] ) );
kenjiArai	0:5b88d5760320	3104	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &P, NULL, NULL ) );
kenjiArai	0:5b88d5760320	3105
kenjiArai	0:5b88d5760320	3106	if( add_count != add_c_prev \|\|
kenjiArai	0:5b88d5760320	3107	dbl_count != dbl_c_prev \|\|
kenjiArai	0:5b88d5760320	3108	mul_count != mul_c_prev )
kenjiArai	0:5b88d5760320	3109	{
kenjiArai	0:5b88d5760320	3110	if( verbose != 0 )
kenjiArai	0:5b88d5760320	3111	mbedtls_printf( "failed (%u)\n", (unsigned int) i );
kenjiArai	0:5b88d5760320	3112
kenjiArai	0:5b88d5760320	3113	ret = 1;
kenjiArai	0:5b88d5760320	3114	goto cleanup;
kenjiArai	0:5b88d5760320	3115	}
kenjiArai	0:5b88d5760320	3116	}
kenjiArai	0:5b88d5760320	3117
kenjiArai	0:5b88d5760320	3118	if( verbose != 0 )
kenjiArai	0:5b88d5760320	3119	mbedtls_printf( "passed\n" );
kenjiArai	0:5b88d5760320	3120
kenjiArai	0:5b88d5760320	3121	cleanup:
kenjiArai	0:5b88d5760320	3122
kenjiArai	0:5b88d5760320	3123	if( ret < 0 && verbose != 0 )
kenjiArai	0:5b88d5760320	3124	mbedtls_printf( "Unexpected error, return code = %08X\n", ret );
kenjiArai	0:5b88d5760320	3125
kenjiArai	0:5b88d5760320	3126	mbedtls_ecp_group_free( &grp );
kenjiArai	0:5b88d5760320	3127	mbedtls_ecp_point_free( &R );
kenjiArai	0:5b88d5760320	3128	mbedtls_ecp_point_free( &P );
kenjiArai	0:5b88d5760320	3129	mbedtls_mpi_free( &m );
kenjiArai	0:5b88d5760320	3130
kenjiArai	0:5b88d5760320	3131	if( verbose != 0 )
kenjiArai	0:5b88d5760320	3132	mbedtls_printf( "\n" );
kenjiArai	0:5b88d5760320	3133
kenjiArai	0:5b88d5760320	3134	return( ret );
kenjiArai	0:5b88d5760320	3135	}
kenjiArai	0:5b88d5760320	3136
kenjiArai	0:5b88d5760320	3137	#endif /* MBEDTLS_SELF_TEST */
kenjiArai	0:5b88d5760320	3138
kenjiArai	0:5b88d5760320	3139	#endif /* !MBEDTLS_ECP_ALT */
kenjiArai	0:5b88d5760320	3140
kenjiArai	0:5b88d5760320	3141	#endif /* MBEDTLS_ECP_C */

Repository toolbox

Export to desktop IDE

Repository details

Type:	Library
Created:	17 Dec 2019
Imports:	79
Forks:	0
Commits:	2
Dependents:	2
Dependencies:	0
Followers:	1

The code in this repository is Apache licensed.

features/mbedtls/mbed-crypto/src/ecp.c@1:9db0e321a9f4, 2019-12-31 (annotated)

Who changed what in which revision?

Repository toolbox

Repository details

Important Information for this Arm website

Access Warning