Example_RTOS - Rtos API example

Users » marcozecchini » Code » Example_RTOS

Rtos API example

mbed-os/features/mbedtls/src/ecp.c@0:9fca2b23d0ba, 2019-02-23 (annotated)

Committer:: marcozecchini
Date:: Sat Feb 23 12:13:36 2019 +0000
Revision:: 0:9fca2b23d0ba

final commit

Who changed what in which revision?

User	Revision	Line number	New contents of line
marcozecchini	0:9fca2b23d0ba	1	/*
marcozecchini	0:9fca2b23d0ba	2	* Elliptic curves over GF(p): generic functions
marcozecchini	0:9fca2b23d0ba	3	*
marcozecchini	0:9fca2b23d0ba	4	* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
marcozecchini	0:9fca2b23d0ba	5	* SPDX-License-Identifier: Apache-2.0
marcozecchini	0:9fca2b23d0ba	6	*
marcozecchini	0:9fca2b23d0ba	7	* Licensed under the Apache License, Version 2.0 (the "License"); you may
marcozecchini	0:9fca2b23d0ba	8	* not use this file except in compliance with the License.
marcozecchini	0:9fca2b23d0ba	9	* You may obtain a copy of the License at
marcozecchini	0:9fca2b23d0ba	10	*
marcozecchini	0:9fca2b23d0ba	11	* http://www.apache.org/licenses/LICENSE-2.0
marcozecchini	0:9fca2b23d0ba	12	*
marcozecchini	0:9fca2b23d0ba	13	* Unless required by applicable law or agreed to in writing, software
marcozecchini	0:9fca2b23d0ba	14	* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
marcozecchini	0:9fca2b23d0ba	15	* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
marcozecchini	0:9fca2b23d0ba	16	* See the License for the specific language governing permissions and
marcozecchini	0:9fca2b23d0ba	17	* limitations under the License.
marcozecchini	0:9fca2b23d0ba	18	*
marcozecchini	0:9fca2b23d0ba	19	* This file is part of mbed TLS (https://tls.mbed.org)
marcozecchini	0:9fca2b23d0ba	20	*/
marcozecchini	0:9fca2b23d0ba	21
marcozecchini	0:9fca2b23d0ba	22	/*
marcozecchini	0:9fca2b23d0ba	23	* References:
marcozecchini	0:9fca2b23d0ba	24	*
marcozecchini	0:9fca2b23d0ba	25	* SEC1 http://www.secg.org/index.php?action=secg,docs_secg
marcozecchini	0:9fca2b23d0ba	26	* GECC = Guide to Elliptic Curve Cryptography - Hankerson, Menezes, Vanstone
marcozecchini	0:9fca2b23d0ba	27	* FIPS 186-3 http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf
marcozecchini	0:9fca2b23d0ba	28	* RFC 4492 for the related TLS structures and constants
marcozecchini	0:9fca2b23d0ba	29	*
marcozecchini	0:9fca2b23d0ba	30	* [Curve25519] http://cr.yp.to/ecdh/curve25519-20060209.pdf
marcozecchini	0:9fca2b23d0ba	31	*
marcozecchini	0:9fca2b23d0ba	32	* [2] CORON, Jean-S'ebastien. Resistance against differential power analysis
marcozecchini	0:9fca2b23d0ba	33	* for elliptic curve cryptosystems. In : Cryptographic Hardware and
marcozecchini	0:9fca2b23d0ba	34	* Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302.
marcozecchini	0:9fca2b23d0ba	35	* <http://link.springer.com/chapter/10.1007/3-540-48059-5_25>
marcozecchini	0:9fca2b23d0ba	36	*
marcozecchini	0:9fca2b23d0ba	37	* [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to
marcozecchini	0:9fca2b23d0ba	38	* render ECC resistant against Side Channel Attacks. IACR Cryptology
marcozecchini	0:9fca2b23d0ba	39	* ePrint Archive, 2004, vol. 2004, p. 342.
marcozecchini	0:9fca2b23d0ba	40	* <http://eprint.iacr.org/2004/342.pdf>
marcozecchini	0:9fca2b23d0ba	41	*/
marcozecchini	0:9fca2b23d0ba	42
marcozecchini	0:9fca2b23d0ba	43	#if !defined(MBEDTLS_CONFIG_FILE)
marcozecchini	0:9fca2b23d0ba	44	#include "mbedtls/config.h"
marcozecchini	0:9fca2b23d0ba	45	#else
marcozecchini	0:9fca2b23d0ba	46	#include MBEDTLS_CONFIG_FILE
marcozecchini	0:9fca2b23d0ba	47	#endif
marcozecchini	0:9fca2b23d0ba	48
marcozecchini	0:9fca2b23d0ba	49	#if defined(MBEDTLS_ECP_C)
marcozecchini	0:9fca2b23d0ba	50
marcozecchini	0:9fca2b23d0ba	51	#include "mbedtls/ecp.h"
marcozecchini	0:9fca2b23d0ba	52	#include "mbedtls/threading.h"
marcozecchini	0:9fca2b23d0ba	53
marcozecchini	0:9fca2b23d0ba	54	#include <string.h>
marcozecchini	0:9fca2b23d0ba	55
marcozecchini	0:9fca2b23d0ba	56	#if !defined(MBEDTLS_ECP_ALT)
marcozecchini	0:9fca2b23d0ba	57
marcozecchini	0:9fca2b23d0ba	58	#if defined(MBEDTLS_PLATFORM_C)
marcozecchini	0:9fca2b23d0ba	59	#include "mbedtls/platform.h"
marcozecchini	0:9fca2b23d0ba	60	#else
marcozecchini	0:9fca2b23d0ba	61	#include <stdlib.h>
marcozecchini	0:9fca2b23d0ba	62	#include <stdio.h>
marcozecchini	0:9fca2b23d0ba	63	#define mbedtls_printf printf
marcozecchini	0:9fca2b23d0ba	64	#define mbedtls_calloc calloc
marcozecchini	0:9fca2b23d0ba	65	#define mbedtls_free free
marcozecchini	0:9fca2b23d0ba	66	#endif
marcozecchini	0:9fca2b23d0ba	67
marcozecchini	0:9fca2b23d0ba	68	#include "mbedtls/ecp_internal.h"
marcozecchini	0:9fca2b23d0ba	69
marcozecchini	0:9fca2b23d0ba	70	#if ( defined(__ARMCC_VERSION) \|\| defined(_MSC_VER) ) && \
marcozecchini	0:9fca2b23d0ba	71	!defined(inline) && !defined(__cplusplus)
marcozecchini	0:9fca2b23d0ba	72	#define inline __inline
marcozecchini	0:9fca2b23d0ba	73	#endif
marcozecchini	0:9fca2b23d0ba	74
marcozecchini	0:9fca2b23d0ba	75	/* Implementation that should never be optimized out by the compiler */
marcozecchini	0:9fca2b23d0ba	76	static void mbedtls_zeroize( void *v, size_t n ) {
marcozecchini	0:9fca2b23d0ba	77	volatile unsigned char p = v; while( n-- ) p++ = 0;
marcozecchini	0:9fca2b23d0ba	78	}
marcozecchini	0:9fca2b23d0ba	79
marcozecchini	0:9fca2b23d0ba	80	#if defined(MBEDTLS_SELF_TEST)
marcozecchini	0:9fca2b23d0ba	81	/*
marcozecchini	0:9fca2b23d0ba	82	* Counts of point addition and doubling, and field multiplications.
marcozecchini	0:9fca2b23d0ba	83	* Used to test resistance of point multiplication to simple timing attacks.
marcozecchini	0:9fca2b23d0ba	84	*/
marcozecchini	0:9fca2b23d0ba	85	static unsigned long add_count, dbl_count, mul_count;
marcozecchini	0:9fca2b23d0ba	86	#endif
marcozecchini	0:9fca2b23d0ba	87
marcozecchini	0:9fca2b23d0ba	88	#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) \|\| \
marcozecchini	0:9fca2b23d0ba	89	defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) \|\| \
marcozecchini	0:9fca2b23d0ba	90	defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) \|\| \
marcozecchini	0:9fca2b23d0ba	91	defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) \|\| \
marcozecchini	0:9fca2b23d0ba	92	defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) \|\| \
marcozecchini	0:9fca2b23d0ba	93	defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) \|\| \
marcozecchini	0:9fca2b23d0ba	94	defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) \|\| \
marcozecchini	0:9fca2b23d0ba	95	defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) \|\| \
marcozecchini	0:9fca2b23d0ba	96	defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) \|\| \
marcozecchini	0:9fca2b23d0ba	97	defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) \|\| \
marcozecchini	0:9fca2b23d0ba	98	defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
marcozecchini	0:9fca2b23d0ba	99	#define ECP_SHORTWEIERSTRASS
marcozecchini	0:9fca2b23d0ba	100	#endif
marcozecchini	0:9fca2b23d0ba	101
marcozecchini	0:9fca2b23d0ba	102	#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
marcozecchini	0:9fca2b23d0ba	103	#define ECP_MONTGOMERY
marcozecchini	0:9fca2b23d0ba	104	#endif
marcozecchini	0:9fca2b23d0ba	105
marcozecchini	0:9fca2b23d0ba	106	/*
marcozecchini	0:9fca2b23d0ba	107	* Curve types: internal for now, might be exposed later
marcozecchini	0:9fca2b23d0ba	108	*/
marcozecchini	0:9fca2b23d0ba	109	typedef enum
marcozecchini	0:9fca2b23d0ba	110	{
marcozecchini	0:9fca2b23d0ba	111	ECP_TYPE_NONE = 0,
marcozecchini	0:9fca2b23d0ba	112	ECP_TYPE_SHORT_WEIERSTRASS, /* y^2 = x^3 + a x + b */
marcozecchini	0:9fca2b23d0ba	113	ECP_TYPE_MONTGOMERY, /* y^2 = x^3 + a x^2 + x */
marcozecchini	0:9fca2b23d0ba	114	} ecp_curve_type;
marcozecchini	0:9fca2b23d0ba	115
marcozecchini	0:9fca2b23d0ba	116	/*
marcozecchini	0:9fca2b23d0ba	117	* List of supported curves:
marcozecchini	0:9fca2b23d0ba	118	* - internal ID
marcozecchini	0:9fca2b23d0ba	119	* - TLS NamedCurve ID (RFC 4492 sec. 5.1.1, RFC 7071 sec. 2)
marcozecchini	0:9fca2b23d0ba	120	* - size in bits
marcozecchini	0:9fca2b23d0ba	121	* - readable name
marcozecchini	0:9fca2b23d0ba	122	*
marcozecchini	0:9fca2b23d0ba	123	* Curves are listed in order: largest curves first, and for a given size,
marcozecchini	0:9fca2b23d0ba	124	* fastest curves first. This provides the default order for the SSL module.
marcozecchini	0:9fca2b23d0ba	125	*
marcozecchini	0:9fca2b23d0ba	126	* Reminder: update profiles in x509_crt.c when adding a new curves!
marcozecchini	0:9fca2b23d0ba	127	*/
marcozecchini	0:9fca2b23d0ba	128	static const mbedtls_ecp_curve_info ecp_supported_curves[] =
marcozecchini	0:9fca2b23d0ba	129	{
marcozecchini	0:9fca2b23d0ba	130	#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
marcozecchini	0:9fca2b23d0ba	131	{ MBEDTLS_ECP_DP_SECP521R1, 25, 521, "secp521r1" },
marcozecchini	0:9fca2b23d0ba	132	#endif
marcozecchini	0:9fca2b23d0ba	133	#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
marcozecchini	0:9fca2b23d0ba	134	{ MBEDTLS_ECP_DP_BP512R1, 28, 512, "brainpoolP512r1" },
marcozecchini	0:9fca2b23d0ba	135	#endif
marcozecchini	0:9fca2b23d0ba	136	#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
marcozecchini	0:9fca2b23d0ba	137	{ MBEDTLS_ECP_DP_SECP384R1, 24, 384, "secp384r1" },
marcozecchini	0:9fca2b23d0ba	138	#endif
marcozecchini	0:9fca2b23d0ba	139	#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
marcozecchini	0:9fca2b23d0ba	140	{ MBEDTLS_ECP_DP_BP384R1, 27, 384, "brainpoolP384r1" },
marcozecchini	0:9fca2b23d0ba	141	#endif
marcozecchini	0:9fca2b23d0ba	142	#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
marcozecchini	0:9fca2b23d0ba	143	{ MBEDTLS_ECP_DP_SECP256R1, 23, 256, "secp256r1" },
marcozecchini	0:9fca2b23d0ba	144	#endif
marcozecchini	0:9fca2b23d0ba	145	#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
marcozecchini	0:9fca2b23d0ba	146	{ MBEDTLS_ECP_DP_SECP256K1, 22, 256, "secp256k1" },
marcozecchini	0:9fca2b23d0ba	147	#endif
marcozecchini	0:9fca2b23d0ba	148	#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
marcozecchini	0:9fca2b23d0ba	149	{ MBEDTLS_ECP_DP_BP256R1, 26, 256, "brainpoolP256r1" },
marcozecchini	0:9fca2b23d0ba	150	#endif
marcozecchini	0:9fca2b23d0ba	151	#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
marcozecchini	0:9fca2b23d0ba	152	{ MBEDTLS_ECP_DP_SECP224R1, 21, 224, "secp224r1" },
marcozecchini	0:9fca2b23d0ba	153	#endif
marcozecchini	0:9fca2b23d0ba	154	#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
marcozecchini	0:9fca2b23d0ba	155	{ MBEDTLS_ECP_DP_SECP224K1, 20, 224, "secp224k1" },
marcozecchini	0:9fca2b23d0ba	156	#endif
marcozecchini	0:9fca2b23d0ba	157	#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
marcozecchini	0:9fca2b23d0ba	158	{ MBEDTLS_ECP_DP_SECP192R1, 19, 192, "secp192r1" },
marcozecchini	0:9fca2b23d0ba	159	#endif
marcozecchini	0:9fca2b23d0ba	160	#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
marcozecchini	0:9fca2b23d0ba	161	{ MBEDTLS_ECP_DP_SECP192K1, 18, 192, "secp192k1" },
marcozecchini	0:9fca2b23d0ba	162	#endif
marcozecchini	0:9fca2b23d0ba	163	{ MBEDTLS_ECP_DP_NONE, 0, 0, NULL },
marcozecchini	0:9fca2b23d0ba	164	};
marcozecchini	0:9fca2b23d0ba	165
marcozecchini	0:9fca2b23d0ba	166	#define ECP_NB_CURVES sizeof( ecp_supported_curves ) / \
marcozecchini	0:9fca2b23d0ba	167	sizeof( ecp_supported_curves[0] )
marcozecchini	0:9fca2b23d0ba	168
marcozecchini	0:9fca2b23d0ba	169	static mbedtls_ecp_group_id ecp_supported_grp_id[ECP_NB_CURVES];
marcozecchini	0:9fca2b23d0ba	170
marcozecchini	0:9fca2b23d0ba	171	/*
marcozecchini	0:9fca2b23d0ba	172	* List of supported curves and associated info
marcozecchini	0:9fca2b23d0ba	173	*/
marcozecchini	0:9fca2b23d0ba	174	const mbedtls_ecp_curve_info *mbedtls_ecp_curve_list( void )
marcozecchini	0:9fca2b23d0ba	175	{
marcozecchini	0:9fca2b23d0ba	176	return( ecp_supported_curves );
marcozecchini	0:9fca2b23d0ba	177	}
marcozecchini	0:9fca2b23d0ba	178
marcozecchini	0:9fca2b23d0ba	179	/*
marcozecchini	0:9fca2b23d0ba	180	* List of supported curves, group ID only
marcozecchini	0:9fca2b23d0ba	181	*/
marcozecchini	0:9fca2b23d0ba	182	const mbedtls_ecp_group_id *mbedtls_ecp_grp_id_list( void )
marcozecchini	0:9fca2b23d0ba	183	{
marcozecchini	0:9fca2b23d0ba	184	static int init_done = 0;
marcozecchini	0:9fca2b23d0ba	185
marcozecchini	0:9fca2b23d0ba	186	if( ! init_done )
marcozecchini	0:9fca2b23d0ba	187	{
marcozecchini	0:9fca2b23d0ba	188	size_t i = 0;
marcozecchini	0:9fca2b23d0ba	189	const mbedtls_ecp_curve_info *curve_info;
marcozecchini	0:9fca2b23d0ba	190
marcozecchini	0:9fca2b23d0ba	191	for( curve_info = mbedtls_ecp_curve_list();
marcozecchini	0:9fca2b23d0ba	192	curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
marcozecchini	0:9fca2b23d0ba	193	curve_info++ )
marcozecchini	0:9fca2b23d0ba	194	{
marcozecchini	0:9fca2b23d0ba	195	ecp_supported_grp_id[i++] = curve_info->grp_id;
marcozecchini	0:9fca2b23d0ba	196	}
marcozecchini	0:9fca2b23d0ba	197	ecp_supported_grp_id[i] = MBEDTLS_ECP_DP_NONE;
marcozecchini	0:9fca2b23d0ba	198
marcozecchini	0:9fca2b23d0ba	199	init_done = 1;
marcozecchini	0:9fca2b23d0ba	200	}
marcozecchini	0:9fca2b23d0ba	201
marcozecchini	0:9fca2b23d0ba	202	return( ecp_supported_grp_id );
marcozecchini	0:9fca2b23d0ba	203	}
marcozecchini	0:9fca2b23d0ba	204
marcozecchini	0:9fca2b23d0ba	205	/*
marcozecchini	0:9fca2b23d0ba	206	* Get the curve info for the internal identifier
marcozecchini	0:9fca2b23d0ba	207	*/
marcozecchini	0:9fca2b23d0ba	208	const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_grp_id( mbedtls_ecp_group_id grp_id )
marcozecchini	0:9fca2b23d0ba	209	{
marcozecchini	0:9fca2b23d0ba	210	const mbedtls_ecp_curve_info *curve_info;
marcozecchini	0:9fca2b23d0ba	211
marcozecchini	0:9fca2b23d0ba	212	for( curve_info = mbedtls_ecp_curve_list();
marcozecchini	0:9fca2b23d0ba	213	curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
marcozecchini	0:9fca2b23d0ba	214	curve_info++ )
marcozecchini	0:9fca2b23d0ba	215	{
marcozecchini	0:9fca2b23d0ba	216	if( curve_info->grp_id == grp_id )
marcozecchini	0:9fca2b23d0ba	217	return( curve_info );
marcozecchini	0:9fca2b23d0ba	218	}
marcozecchini	0:9fca2b23d0ba	219
marcozecchini	0:9fca2b23d0ba	220	return( NULL );
marcozecchini	0:9fca2b23d0ba	221	}
marcozecchini	0:9fca2b23d0ba	222
marcozecchini	0:9fca2b23d0ba	223	/*
marcozecchini	0:9fca2b23d0ba	224	* Get the curve info from the TLS identifier
marcozecchini	0:9fca2b23d0ba	225	*/
marcozecchini	0:9fca2b23d0ba	226	const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_tls_id( uint16_t tls_id )
marcozecchini	0:9fca2b23d0ba	227	{
marcozecchini	0:9fca2b23d0ba	228	const mbedtls_ecp_curve_info *curve_info;
marcozecchini	0:9fca2b23d0ba	229
marcozecchini	0:9fca2b23d0ba	230	for( curve_info = mbedtls_ecp_curve_list();
marcozecchini	0:9fca2b23d0ba	231	curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
marcozecchini	0:9fca2b23d0ba	232	curve_info++ )
marcozecchini	0:9fca2b23d0ba	233	{
marcozecchini	0:9fca2b23d0ba	234	if( curve_info->tls_id == tls_id )
marcozecchini	0:9fca2b23d0ba	235	return( curve_info );
marcozecchini	0:9fca2b23d0ba	236	}
marcozecchini	0:9fca2b23d0ba	237
marcozecchini	0:9fca2b23d0ba	238	return( NULL );
marcozecchini	0:9fca2b23d0ba	239	}
marcozecchini	0:9fca2b23d0ba	240
marcozecchini	0:9fca2b23d0ba	241	/*
marcozecchini	0:9fca2b23d0ba	242	* Get the curve info from the name
marcozecchini	0:9fca2b23d0ba	243	*/
marcozecchini	0:9fca2b23d0ba	244	const mbedtls_ecp_curve_info mbedtls_ecp_curve_info_from_name( const char name )
marcozecchini	0:9fca2b23d0ba	245	{
marcozecchini	0:9fca2b23d0ba	246	const mbedtls_ecp_curve_info *curve_info;
marcozecchini	0:9fca2b23d0ba	247
marcozecchini	0:9fca2b23d0ba	248	for( curve_info = mbedtls_ecp_curve_list();
marcozecchini	0:9fca2b23d0ba	249	curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
marcozecchini	0:9fca2b23d0ba	250	curve_info++ )
marcozecchini	0:9fca2b23d0ba	251	{
marcozecchini	0:9fca2b23d0ba	252	if( strcmp( curve_info->name, name ) == 0 )
marcozecchini	0:9fca2b23d0ba	253	return( curve_info );
marcozecchini	0:9fca2b23d0ba	254	}
marcozecchini	0:9fca2b23d0ba	255
marcozecchini	0:9fca2b23d0ba	256	return( NULL );
marcozecchini	0:9fca2b23d0ba	257	}
marcozecchini	0:9fca2b23d0ba	258
marcozecchini	0:9fca2b23d0ba	259	/*
marcozecchini	0:9fca2b23d0ba	260	* Get the type of a curve
marcozecchini	0:9fca2b23d0ba	261	*/
marcozecchini	0:9fca2b23d0ba	262	static inline ecp_curve_type ecp_get_type( const mbedtls_ecp_group *grp )
marcozecchini	0:9fca2b23d0ba	263	{
marcozecchini	0:9fca2b23d0ba	264	if( grp->G.X.p == NULL )
marcozecchini	0:9fca2b23d0ba	265	return( ECP_TYPE_NONE );
marcozecchini	0:9fca2b23d0ba	266
marcozecchini	0:9fca2b23d0ba	267	if( grp->G.Y.p == NULL )
marcozecchini	0:9fca2b23d0ba	268	return( ECP_TYPE_MONTGOMERY );
marcozecchini	0:9fca2b23d0ba	269	else
marcozecchini	0:9fca2b23d0ba	270	return( ECP_TYPE_SHORT_WEIERSTRASS );
marcozecchini	0:9fca2b23d0ba	271	}
marcozecchini	0:9fca2b23d0ba	272
marcozecchini	0:9fca2b23d0ba	273	/*
marcozecchini	0:9fca2b23d0ba	274	* Initialize (the components of) a point
marcozecchini	0:9fca2b23d0ba	275	*/
marcozecchini	0:9fca2b23d0ba	276	void mbedtls_ecp_point_init( mbedtls_ecp_point *pt )
marcozecchini	0:9fca2b23d0ba	277	{
marcozecchini	0:9fca2b23d0ba	278	if( pt == NULL )
marcozecchini	0:9fca2b23d0ba	279	return;
marcozecchini	0:9fca2b23d0ba	280
marcozecchini	0:9fca2b23d0ba	281	mbedtls_mpi_init( &pt->X );
marcozecchini	0:9fca2b23d0ba	282	mbedtls_mpi_init( &pt->Y );
marcozecchini	0:9fca2b23d0ba	283	mbedtls_mpi_init( &pt->Z );
marcozecchini	0:9fca2b23d0ba	284	}
marcozecchini	0:9fca2b23d0ba	285
marcozecchini	0:9fca2b23d0ba	286	/*
marcozecchini	0:9fca2b23d0ba	287	* Initialize (the components of) a group
marcozecchini	0:9fca2b23d0ba	288	*/
marcozecchini	0:9fca2b23d0ba	289	void mbedtls_ecp_group_init( mbedtls_ecp_group *grp )
marcozecchini	0:9fca2b23d0ba	290	{
marcozecchini	0:9fca2b23d0ba	291	if( grp == NULL )
marcozecchini	0:9fca2b23d0ba	292	return;
marcozecchini	0:9fca2b23d0ba	293
marcozecchini	0:9fca2b23d0ba	294	memset( grp, 0, sizeof( mbedtls_ecp_group ) );
marcozecchini	0:9fca2b23d0ba	295	}
marcozecchini	0:9fca2b23d0ba	296
marcozecchini	0:9fca2b23d0ba	297	/*
marcozecchini	0:9fca2b23d0ba	298	* Initialize (the components of) a key pair
marcozecchini	0:9fca2b23d0ba	299	*/
marcozecchini	0:9fca2b23d0ba	300	void mbedtls_ecp_keypair_init( mbedtls_ecp_keypair *key )
marcozecchini	0:9fca2b23d0ba	301	{
marcozecchini	0:9fca2b23d0ba	302	if( key == NULL )
marcozecchini	0:9fca2b23d0ba	303	return;
marcozecchini	0:9fca2b23d0ba	304
marcozecchini	0:9fca2b23d0ba	305	mbedtls_ecp_group_init( &key->grp );
marcozecchini	0:9fca2b23d0ba	306	mbedtls_mpi_init( &key->d );
marcozecchini	0:9fca2b23d0ba	307	mbedtls_ecp_point_init( &key->Q );
marcozecchini	0:9fca2b23d0ba	308	}
marcozecchini	0:9fca2b23d0ba	309
marcozecchini	0:9fca2b23d0ba	310	/*
marcozecchini	0:9fca2b23d0ba	311	* Unallocate (the components of) a point
marcozecchini	0:9fca2b23d0ba	312	*/
marcozecchini	0:9fca2b23d0ba	313	void mbedtls_ecp_point_free( mbedtls_ecp_point *pt )
marcozecchini	0:9fca2b23d0ba	314	{
marcozecchini	0:9fca2b23d0ba	315	if( pt == NULL )
marcozecchini	0:9fca2b23d0ba	316	return;
marcozecchini	0:9fca2b23d0ba	317
marcozecchini	0:9fca2b23d0ba	318	mbedtls_mpi_free( &( pt->X ) );
marcozecchini	0:9fca2b23d0ba	319	mbedtls_mpi_free( &( pt->Y ) );
marcozecchini	0:9fca2b23d0ba	320	mbedtls_mpi_free( &( pt->Z ) );
marcozecchini	0:9fca2b23d0ba	321	}
marcozecchini	0:9fca2b23d0ba	322
marcozecchini	0:9fca2b23d0ba	323	/*
marcozecchini	0:9fca2b23d0ba	324	* Unallocate (the components of) a group
marcozecchini	0:9fca2b23d0ba	325	*/
marcozecchini	0:9fca2b23d0ba	326	void mbedtls_ecp_group_free( mbedtls_ecp_group *grp )
marcozecchini	0:9fca2b23d0ba	327	{
marcozecchini	0:9fca2b23d0ba	328	size_t i;
marcozecchini	0:9fca2b23d0ba	329
marcozecchini	0:9fca2b23d0ba	330	if( grp == NULL )
marcozecchini	0:9fca2b23d0ba	331	return;
marcozecchini	0:9fca2b23d0ba	332
marcozecchini	0:9fca2b23d0ba	333	if( grp->h != 1 )
marcozecchini	0:9fca2b23d0ba	334	{
marcozecchini	0:9fca2b23d0ba	335	mbedtls_mpi_free( &grp->P );
marcozecchini	0:9fca2b23d0ba	336	mbedtls_mpi_free( &grp->A );
marcozecchini	0:9fca2b23d0ba	337	mbedtls_mpi_free( &grp->B );
marcozecchini	0:9fca2b23d0ba	338	mbedtls_ecp_point_free( &grp->G );
marcozecchini	0:9fca2b23d0ba	339	mbedtls_mpi_free( &grp->N );
marcozecchini	0:9fca2b23d0ba	340	}
marcozecchini	0:9fca2b23d0ba	341
marcozecchini	0:9fca2b23d0ba	342	if( grp->T != NULL )
marcozecchini	0:9fca2b23d0ba	343	{
marcozecchini	0:9fca2b23d0ba	344	for( i = 0; i < grp->T_size; i++ )
marcozecchini	0:9fca2b23d0ba	345	mbedtls_ecp_point_free( &grp->T[i] );
marcozecchini	0:9fca2b23d0ba	346	mbedtls_free( grp->T );
marcozecchini	0:9fca2b23d0ba	347	}
marcozecchini	0:9fca2b23d0ba	348
marcozecchini	0:9fca2b23d0ba	349	mbedtls_zeroize( grp, sizeof( mbedtls_ecp_group ) );
marcozecchini	0:9fca2b23d0ba	350	}
marcozecchini	0:9fca2b23d0ba	351
marcozecchini	0:9fca2b23d0ba	352	/*
marcozecchini	0:9fca2b23d0ba	353	* Unallocate (the components of) a key pair
marcozecchini	0:9fca2b23d0ba	354	*/
marcozecchini	0:9fca2b23d0ba	355	void mbedtls_ecp_keypair_free( mbedtls_ecp_keypair *key )
marcozecchini	0:9fca2b23d0ba	356	{
marcozecchini	0:9fca2b23d0ba	357	if( key == NULL )
marcozecchini	0:9fca2b23d0ba	358	return;
marcozecchini	0:9fca2b23d0ba	359
marcozecchini	0:9fca2b23d0ba	360	mbedtls_ecp_group_free( &key->grp );
marcozecchini	0:9fca2b23d0ba	361	mbedtls_mpi_free( &key->d );
marcozecchini	0:9fca2b23d0ba	362	mbedtls_ecp_point_free( &key->Q );
marcozecchini	0:9fca2b23d0ba	363	}
marcozecchini	0:9fca2b23d0ba	364
marcozecchini	0:9fca2b23d0ba	365	/*
marcozecchini	0:9fca2b23d0ba	366	* Copy the contents of a point
marcozecchini	0:9fca2b23d0ba	367	*/
marcozecchini	0:9fca2b23d0ba	368	int mbedtls_ecp_copy( mbedtls_ecp_point P, const mbedtls_ecp_point Q )
marcozecchini	0:9fca2b23d0ba	369	{
marcozecchini	0:9fca2b23d0ba	370	int ret;
marcozecchini	0:9fca2b23d0ba	371
marcozecchini	0:9fca2b23d0ba	372	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->X, &Q->X ) );
marcozecchini	0:9fca2b23d0ba	373	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->Y, &Q->Y ) );
marcozecchini	0:9fca2b23d0ba	374	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->Z, &Q->Z ) );
marcozecchini	0:9fca2b23d0ba	375
marcozecchini	0:9fca2b23d0ba	376	cleanup:
marcozecchini	0:9fca2b23d0ba	377	return( ret );
marcozecchini	0:9fca2b23d0ba	378	}
marcozecchini	0:9fca2b23d0ba	379
marcozecchini	0:9fca2b23d0ba	380	/*
marcozecchini	0:9fca2b23d0ba	381	* Copy the contents of a group object
marcozecchini	0:9fca2b23d0ba	382	*/
marcozecchini	0:9fca2b23d0ba	383	int mbedtls_ecp_group_copy( mbedtls_ecp_group dst, const mbedtls_ecp_group src )
marcozecchini	0:9fca2b23d0ba	384	{
marcozecchini	0:9fca2b23d0ba	385	return mbedtls_ecp_group_load( dst, src->id );
marcozecchini	0:9fca2b23d0ba	386	}
marcozecchini	0:9fca2b23d0ba	387
marcozecchini	0:9fca2b23d0ba	388	/*
marcozecchini	0:9fca2b23d0ba	389	* Set point to zero
marcozecchini	0:9fca2b23d0ba	390	*/
marcozecchini	0:9fca2b23d0ba	391	int mbedtls_ecp_set_zero( mbedtls_ecp_point *pt )
marcozecchini	0:9fca2b23d0ba	392	{
marcozecchini	0:9fca2b23d0ba	393	int ret;
marcozecchini	0:9fca2b23d0ba	394
marcozecchini	0:9fca2b23d0ba	395	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->X , 1 ) );
marcozecchini	0:9fca2b23d0ba	396	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Y , 1 ) );
marcozecchini	0:9fca2b23d0ba	397	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z , 0 ) );
marcozecchini	0:9fca2b23d0ba	398
marcozecchini	0:9fca2b23d0ba	399	cleanup:
marcozecchini	0:9fca2b23d0ba	400	return( ret );
marcozecchini	0:9fca2b23d0ba	401	}
marcozecchini	0:9fca2b23d0ba	402
marcozecchini	0:9fca2b23d0ba	403	/*
marcozecchini	0:9fca2b23d0ba	404	* Tell if a point is zero
marcozecchini	0:9fca2b23d0ba	405	*/
marcozecchini	0:9fca2b23d0ba	406	int mbedtls_ecp_is_zero( mbedtls_ecp_point *pt )
marcozecchini	0:9fca2b23d0ba	407	{
marcozecchini	0:9fca2b23d0ba	408	return( mbedtls_mpi_cmp_int( &pt->Z, 0 ) == 0 );
marcozecchini	0:9fca2b23d0ba	409	}
marcozecchini	0:9fca2b23d0ba	410
marcozecchini	0:9fca2b23d0ba	411	/*
marcozecchini	0:9fca2b23d0ba	412	* Compare two points lazyly
marcozecchini	0:9fca2b23d0ba	413	*/
marcozecchini	0:9fca2b23d0ba	414	int mbedtls_ecp_point_cmp( const mbedtls_ecp_point *P,
marcozecchini	0:9fca2b23d0ba	415	const mbedtls_ecp_point *Q )
marcozecchini	0:9fca2b23d0ba	416	{
marcozecchini	0:9fca2b23d0ba	417	if( mbedtls_mpi_cmp_mpi( &P->X, &Q->X ) == 0 &&
marcozecchini	0:9fca2b23d0ba	418	mbedtls_mpi_cmp_mpi( &P->Y, &Q->Y ) == 0 &&
marcozecchini	0:9fca2b23d0ba	419	mbedtls_mpi_cmp_mpi( &P->Z, &Q->Z ) == 0 )
marcozecchini	0:9fca2b23d0ba	420	{
marcozecchini	0:9fca2b23d0ba	421	return( 0 );
marcozecchini	0:9fca2b23d0ba	422	}
marcozecchini	0:9fca2b23d0ba	423
marcozecchini	0:9fca2b23d0ba	424	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	425	}
marcozecchini	0:9fca2b23d0ba	426
marcozecchini	0:9fca2b23d0ba	427	/*
marcozecchini	0:9fca2b23d0ba	428	* Import a non-zero point from ASCII strings
marcozecchini	0:9fca2b23d0ba	429	*/
marcozecchini	0:9fca2b23d0ba	430	int mbedtls_ecp_point_read_string( mbedtls_ecp_point *P, int radix,
marcozecchini	0:9fca2b23d0ba	431	const char x, const char y )
marcozecchini	0:9fca2b23d0ba	432	{
marcozecchini	0:9fca2b23d0ba	433	int ret;
marcozecchini	0:9fca2b23d0ba	434
marcozecchini	0:9fca2b23d0ba	435	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &P->X, radix, x ) );
marcozecchini	0:9fca2b23d0ba	436	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &P->Y, radix, y ) );
marcozecchini	0:9fca2b23d0ba	437	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &P->Z, 1 ) );
marcozecchini	0:9fca2b23d0ba	438
marcozecchini	0:9fca2b23d0ba	439	cleanup:
marcozecchini	0:9fca2b23d0ba	440	return( ret );
marcozecchini	0:9fca2b23d0ba	441	}
marcozecchini	0:9fca2b23d0ba	442
marcozecchini	0:9fca2b23d0ba	443	/*
marcozecchini	0:9fca2b23d0ba	444	* Export a point into unsigned binary data (SEC1 2.3.3)
marcozecchini	0:9fca2b23d0ba	445	*/
marcozecchini	0:9fca2b23d0ba	446	int mbedtls_ecp_point_write_binary( const mbedtls_ecp_group grp, const mbedtls_ecp_point P,
marcozecchini	0:9fca2b23d0ba	447	int format, size_t *olen,
marcozecchini	0:9fca2b23d0ba	448	unsigned char *buf, size_t buflen )
marcozecchini	0:9fca2b23d0ba	449	{
marcozecchini	0:9fca2b23d0ba	450	int ret = 0;
marcozecchini	0:9fca2b23d0ba	451	size_t plen;
marcozecchini	0:9fca2b23d0ba	452
marcozecchini	0:9fca2b23d0ba	453	if( format != MBEDTLS_ECP_PF_UNCOMPRESSED &&
marcozecchini	0:9fca2b23d0ba	454	format != MBEDTLS_ECP_PF_COMPRESSED )
marcozecchini	0:9fca2b23d0ba	455	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	456
marcozecchini	0:9fca2b23d0ba	457	/*
marcozecchini	0:9fca2b23d0ba	458	* Common case: P == 0
marcozecchini	0:9fca2b23d0ba	459	*/
marcozecchini	0:9fca2b23d0ba	460	if( mbedtls_mpi_cmp_int( &P->Z, 0 ) == 0 )
marcozecchini	0:9fca2b23d0ba	461	{
marcozecchini	0:9fca2b23d0ba	462	if( buflen < 1 )
marcozecchini	0:9fca2b23d0ba	463	return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
marcozecchini	0:9fca2b23d0ba	464
marcozecchini	0:9fca2b23d0ba	465	buf[0] = 0x00;
marcozecchini	0:9fca2b23d0ba	466	*olen = 1;
marcozecchini	0:9fca2b23d0ba	467
marcozecchini	0:9fca2b23d0ba	468	return( 0 );
marcozecchini	0:9fca2b23d0ba	469	}
marcozecchini	0:9fca2b23d0ba	470
marcozecchini	0:9fca2b23d0ba	471	plen = mbedtls_mpi_size( &grp->P );
marcozecchini	0:9fca2b23d0ba	472
marcozecchini	0:9fca2b23d0ba	473	if( format == MBEDTLS_ECP_PF_UNCOMPRESSED )
marcozecchini	0:9fca2b23d0ba	474	{
marcozecchini	0:9fca2b23d0ba	475	olen = 2 plen + 1;
marcozecchini	0:9fca2b23d0ba	476
marcozecchini	0:9fca2b23d0ba	477	if( buflen < *olen )
marcozecchini	0:9fca2b23d0ba	478	return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
marcozecchini	0:9fca2b23d0ba	479
marcozecchini	0:9fca2b23d0ba	480	buf[0] = 0x04;
marcozecchini	0:9fca2b23d0ba	481	MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->X, buf + 1, plen ) );
marcozecchini	0:9fca2b23d0ba	482	MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->Y, buf + 1 + plen, plen ) );
marcozecchini	0:9fca2b23d0ba	483	}
marcozecchini	0:9fca2b23d0ba	484	else if( format == MBEDTLS_ECP_PF_COMPRESSED )
marcozecchini	0:9fca2b23d0ba	485	{
marcozecchini	0:9fca2b23d0ba	486	*olen = plen + 1;
marcozecchini	0:9fca2b23d0ba	487
marcozecchini	0:9fca2b23d0ba	488	if( buflen < *olen )
marcozecchini	0:9fca2b23d0ba	489	return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
marcozecchini	0:9fca2b23d0ba	490
marcozecchini	0:9fca2b23d0ba	491	buf[0] = 0x02 + mbedtls_mpi_get_bit( &P->Y, 0 );
marcozecchini	0:9fca2b23d0ba	492	MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->X, buf + 1, plen ) );
marcozecchini	0:9fca2b23d0ba	493	}
marcozecchini	0:9fca2b23d0ba	494
marcozecchini	0:9fca2b23d0ba	495	cleanup:
marcozecchini	0:9fca2b23d0ba	496	return( ret );
marcozecchini	0:9fca2b23d0ba	497	}
marcozecchini	0:9fca2b23d0ba	498
marcozecchini	0:9fca2b23d0ba	499	/*
marcozecchini	0:9fca2b23d0ba	500	* Import a point from unsigned binary data (SEC1 2.3.4)
marcozecchini	0:9fca2b23d0ba	501	*/
marcozecchini	0:9fca2b23d0ba	502	int mbedtls_ecp_point_read_binary( const mbedtls_ecp_group grp, mbedtls_ecp_point pt,
marcozecchini	0:9fca2b23d0ba	503	const unsigned char *buf, size_t ilen )
marcozecchini	0:9fca2b23d0ba	504	{
marcozecchini	0:9fca2b23d0ba	505	int ret;
marcozecchini	0:9fca2b23d0ba	506	size_t plen;
marcozecchini	0:9fca2b23d0ba	507
marcozecchini	0:9fca2b23d0ba	508	if( ilen < 1 )
marcozecchini	0:9fca2b23d0ba	509	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	510
marcozecchini	0:9fca2b23d0ba	511	if( buf[0] == 0x00 )
marcozecchini	0:9fca2b23d0ba	512	{
marcozecchini	0:9fca2b23d0ba	513	if( ilen == 1 )
marcozecchini	0:9fca2b23d0ba	514	return( mbedtls_ecp_set_zero( pt ) );
marcozecchini	0:9fca2b23d0ba	515	else
marcozecchini	0:9fca2b23d0ba	516	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	517	}
marcozecchini	0:9fca2b23d0ba	518
marcozecchini	0:9fca2b23d0ba	519	plen = mbedtls_mpi_size( &grp->P );
marcozecchini	0:9fca2b23d0ba	520
marcozecchini	0:9fca2b23d0ba	521	if( buf[0] != 0x04 )
marcozecchini	0:9fca2b23d0ba	522	return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
marcozecchini	0:9fca2b23d0ba	523
marcozecchini	0:9fca2b23d0ba	524	if( ilen != 2 * plen + 1 )
marcozecchini	0:9fca2b23d0ba	525	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	526
marcozecchini	0:9fca2b23d0ba	527	MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &pt->X, buf + 1, plen ) );
marcozecchini	0:9fca2b23d0ba	528	MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &pt->Y, buf + 1 + plen, plen ) );
marcozecchini	0:9fca2b23d0ba	529	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z, 1 ) );
marcozecchini	0:9fca2b23d0ba	530
marcozecchini	0:9fca2b23d0ba	531	cleanup:
marcozecchini	0:9fca2b23d0ba	532	return( ret );
marcozecchini	0:9fca2b23d0ba	533	}
marcozecchini	0:9fca2b23d0ba	534
marcozecchini	0:9fca2b23d0ba	535	/*
marcozecchini	0:9fca2b23d0ba	536	* Import a point from a TLS ECPoint record (RFC 4492)
marcozecchini	0:9fca2b23d0ba	537	* struct {
marcozecchini	0:9fca2b23d0ba	538	* opaque point <1..2^8-1>;
marcozecchini	0:9fca2b23d0ba	539	* } ECPoint;
marcozecchini	0:9fca2b23d0ba	540	*/
marcozecchini	0:9fca2b23d0ba	541	int mbedtls_ecp_tls_read_point( const mbedtls_ecp_group grp, mbedtls_ecp_point pt,
marcozecchini	0:9fca2b23d0ba	542	const unsigned char **buf, size_t buf_len )
marcozecchini	0:9fca2b23d0ba	543	{
marcozecchini	0:9fca2b23d0ba	544	unsigned char data_len;
marcozecchini	0:9fca2b23d0ba	545	const unsigned char *buf_start;
marcozecchini	0:9fca2b23d0ba	546
marcozecchini	0:9fca2b23d0ba	547	/*
marcozecchini	0:9fca2b23d0ba	548	* We must have at least two bytes (1 for length, at least one for data)
marcozecchini	0:9fca2b23d0ba	549	*/
marcozecchini	0:9fca2b23d0ba	550	if( buf_len < 2 )
marcozecchini	0:9fca2b23d0ba	551	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	552
marcozecchini	0:9fca2b23d0ba	553	data_len = (buf)++;
marcozecchini	0:9fca2b23d0ba	554	if( data_len < 1 \|\| data_len > buf_len - 1 )
marcozecchini	0:9fca2b23d0ba	555	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	556
marcozecchini	0:9fca2b23d0ba	557	/*
marcozecchini	0:9fca2b23d0ba	558	* Save buffer start for read_binary and update buf
marcozecchini	0:9fca2b23d0ba	559	*/
marcozecchini	0:9fca2b23d0ba	560	buf_start = *buf;
marcozecchini	0:9fca2b23d0ba	561	*buf += data_len;
marcozecchini	0:9fca2b23d0ba	562
marcozecchini	0:9fca2b23d0ba	563	return mbedtls_ecp_point_read_binary( grp, pt, buf_start, data_len );
marcozecchini	0:9fca2b23d0ba	564	}
marcozecchini	0:9fca2b23d0ba	565
marcozecchini	0:9fca2b23d0ba	566	/*
marcozecchini	0:9fca2b23d0ba	567	* Export a point as a TLS ECPoint record (RFC 4492)
marcozecchini	0:9fca2b23d0ba	568	* struct {
marcozecchini	0:9fca2b23d0ba	569	* opaque point <1..2^8-1>;
marcozecchini	0:9fca2b23d0ba	570	* } ECPoint;
marcozecchini	0:9fca2b23d0ba	571	*/
marcozecchini	0:9fca2b23d0ba	572	int mbedtls_ecp_tls_write_point( const mbedtls_ecp_group grp, const mbedtls_ecp_point pt,
marcozecchini	0:9fca2b23d0ba	573	int format, size_t *olen,
marcozecchini	0:9fca2b23d0ba	574	unsigned char *buf, size_t blen )
marcozecchini	0:9fca2b23d0ba	575	{
marcozecchini	0:9fca2b23d0ba	576	int ret;
marcozecchini	0:9fca2b23d0ba	577
marcozecchini	0:9fca2b23d0ba	578	/*
marcozecchini	0:9fca2b23d0ba	579	* buffer length must be at least one, for our length byte
marcozecchini	0:9fca2b23d0ba	580	*/
marcozecchini	0:9fca2b23d0ba	581	if( blen < 1 )
marcozecchini	0:9fca2b23d0ba	582	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	583
marcozecchini	0:9fca2b23d0ba	584	if( ( ret = mbedtls_ecp_point_write_binary( grp, pt, format,
marcozecchini	0:9fca2b23d0ba	585	olen, buf + 1, blen - 1) ) != 0 )
marcozecchini	0:9fca2b23d0ba	586	return( ret );
marcozecchini	0:9fca2b23d0ba	587
marcozecchini	0:9fca2b23d0ba	588	/*
marcozecchini	0:9fca2b23d0ba	589	* write length to the first byte and update total length
marcozecchini	0:9fca2b23d0ba	590	*/
marcozecchini	0:9fca2b23d0ba	591	buf[0] = (unsigned char) *olen;
marcozecchini	0:9fca2b23d0ba	592	++*olen;
marcozecchini	0:9fca2b23d0ba	593
marcozecchini	0:9fca2b23d0ba	594	return( 0 );
marcozecchini	0:9fca2b23d0ba	595	}
marcozecchini	0:9fca2b23d0ba	596
marcozecchini	0:9fca2b23d0ba	597	/*
marcozecchini	0:9fca2b23d0ba	598	* Set a group from an ECParameters record (RFC 4492)
marcozecchini	0:9fca2b23d0ba	599	*/
marcozecchini	0:9fca2b23d0ba	600	int mbedtls_ecp_tls_read_group( mbedtls_ecp_group grp, const unsigned char *buf, size_t len )
marcozecchini	0:9fca2b23d0ba	601	{
marcozecchini	0:9fca2b23d0ba	602	uint16_t tls_id;
marcozecchini	0:9fca2b23d0ba	603	const mbedtls_ecp_curve_info *curve_info;
marcozecchini	0:9fca2b23d0ba	604
marcozecchini	0:9fca2b23d0ba	605	/*
marcozecchini	0:9fca2b23d0ba	606	* We expect at least three bytes (see below)
marcozecchini	0:9fca2b23d0ba	607	*/
marcozecchini	0:9fca2b23d0ba	608	if( len < 3 )
marcozecchini	0:9fca2b23d0ba	609	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	610
marcozecchini	0:9fca2b23d0ba	611	/*
marcozecchini	0:9fca2b23d0ba	612	* First byte is curve_type; only named_curve is handled
marcozecchini	0:9fca2b23d0ba	613	*/
marcozecchini	0:9fca2b23d0ba	614	if( (buf)++ != MBEDTLS_ECP_TLS_NAMED_CURVE )
marcozecchini	0:9fca2b23d0ba	615	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	616
marcozecchini	0:9fca2b23d0ba	617	/*
marcozecchini	0:9fca2b23d0ba	618	* Next two bytes are the namedcurve value
marcozecchini	0:9fca2b23d0ba	619	*/
marcozecchini	0:9fca2b23d0ba	620	tls_id = (buf)++;
marcozecchini	0:9fca2b23d0ba	621	tls_id <<= 8;
marcozecchini	0:9fca2b23d0ba	622	tls_id \|= (buf)++;
marcozecchini	0:9fca2b23d0ba	623
marcozecchini	0:9fca2b23d0ba	624	if( ( curve_info = mbedtls_ecp_curve_info_from_tls_id( tls_id ) ) == NULL )
marcozecchini	0:9fca2b23d0ba	625	return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
marcozecchini	0:9fca2b23d0ba	626
marcozecchini	0:9fca2b23d0ba	627	return mbedtls_ecp_group_load( grp, curve_info->grp_id );
marcozecchini	0:9fca2b23d0ba	628	}
marcozecchini	0:9fca2b23d0ba	629
marcozecchini	0:9fca2b23d0ba	630	/*
marcozecchini	0:9fca2b23d0ba	631	* Write the ECParameters record corresponding to a group (RFC 4492)
marcozecchini	0:9fca2b23d0ba	632	*/
marcozecchini	0:9fca2b23d0ba	633	int mbedtls_ecp_tls_write_group( const mbedtls_ecp_group grp, size_t olen,
marcozecchini	0:9fca2b23d0ba	634	unsigned char *buf, size_t blen )
marcozecchini	0:9fca2b23d0ba	635	{
marcozecchini	0:9fca2b23d0ba	636	const mbedtls_ecp_curve_info *curve_info;
marcozecchini	0:9fca2b23d0ba	637
marcozecchini	0:9fca2b23d0ba	638	if( ( curve_info = mbedtls_ecp_curve_info_from_grp_id( grp->id ) ) == NULL )
marcozecchini	0:9fca2b23d0ba	639	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	640
marcozecchini	0:9fca2b23d0ba	641	/*
marcozecchini	0:9fca2b23d0ba	642	* We are going to write 3 bytes (see below)
marcozecchini	0:9fca2b23d0ba	643	*/
marcozecchini	0:9fca2b23d0ba	644	*olen = 3;
marcozecchini	0:9fca2b23d0ba	645	if( blen < *olen )
marcozecchini	0:9fca2b23d0ba	646	return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
marcozecchini	0:9fca2b23d0ba	647
marcozecchini	0:9fca2b23d0ba	648	/*
marcozecchini	0:9fca2b23d0ba	649	* First byte is curve_type, always named_curve
marcozecchini	0:9fca2b23d0ba	650	*/
marcozecchini	0:9fca2b23d0ba	651	*buf++ = MBEDTLS_ECP_TLS_NAMED_CURVE;
marcozecchini	0:9fca2b23d0ba	652
marcozecchini	0:9fca2b23d0ba	653	/*
marcozecchini	0:9fca2b23d0ba	654	* Next two bytes are the namedcurve value
marcozecchini	0:9fca2b23d0ba	655	*/
marcozecchini	0:9fca2b23d0ba	656	buf[0] = curve_info->tls_id >> 8;
marcozecchini	0:9fca2b23d0ba	657	buf[1] = curve_info->tls_id & 0xFF;
marcozecchini	0:9fca2b23d0ba	658
marcozecchini	0:9fca2b23d0ba	659	return( 0 );
marcozecchini	0:9fca2b23d0ba	660	}
marcozecchini	0:9fca2b23d0ba	661
marcozecchini	0:9fca2b23d0ba	662	/*
marcozecchini	0:9fca2b23d0ba	663	* Wrapper around fast quasi-modp functions, with fall-back to mbedtls_mpi_mod_mpi.
marcozecchini	0:9fca2b23d0ba	664	* See the documentation of struct mbedtls_ecp_group.
marcozecchini	0:9fca2b23d0ba	665	*
marcozecchini	0:9fca2b23d0ba	666	* This function is in the critial loop for mbedtls_ecp_mul, so pay attention to perf.
marcozecchini	0:9fca2b23d0ba	667	*/
marcozecchini	0:9fca2b23d0ba	668	static int ecp_modp( mbedtls_mpi N, const mbedtls_ecp_group grp )
marcozecchini	0:9fca2b23d0ba	669	{
marcozecchini	0:9fca2b23d0ba	670	int ret;
marcozecchini	0:9fca2b23d0ba	671
marcozecchini	0:9fca2b23d0ba	672	if( grp->modp == NULL )
marcozecchini	0:9fca2b23d0ba	673	return( mbedtls_mpi_mod_mpi( N, N, &grp->P ) );
marcozecchini	0:9fca2b23d0ba	674
marcozecchini	0:9fca2b23d0ba	675	/* N->s < 0 is a much faster test, which fails only if N is 0 */
marcozecchini	0:9fca2b23d0ba	676	if( ( N->s < 0 && mbedtls_mpi_cmp_int( N, 0 ) != 0 ) \|\|
marcozecchini	0:9fca2b23d0ba	677	mbedtls_mpi_bitlen( N ) > 2 * grp->pbits )
marcozecchini	0:9fca2b23d0ba	678	{
marcozecchini	0:9fca2b23d0ba	679	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	680	}
marcozecchini	0:9fca2b23d0ba	681
marcozecchini	0:9fca2b23d0ba	682	MBEDTLS_MPI_CHK( grp->modp( N ) );
marcozecchini	0:9fca2b23d0ba	683
marcozecchini	0:9fca2b23d0ba	684	/* N->s < 0 is a much faster test, which fails only if N is 0 */
marcozecchini	0:9fca2b23d0ba	685	while( N->s < 0 && mbedtls_mpi_cmp_int( N, 0 ) != 0 )
marcozecchini	0:9fca2b23d0ba	686	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &grp->P ) );
marcozecchini	0:9fca2b23d0ba	687
marcozecchini	0:9fca2b23d0ba	688	while( mbedtls_mpi_cmp_mpi( N, &grp->P ) >= 0 )
marcozecchini	0:9fca2b23d0ba	689	/* we known P, N and the result are positive */
marcozecchini	0:9fca2b23d0ba	690	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( N, N, &grp->P ) );
marcozecchini	0:9fca2b23d0ba	691
marcozecchini	0:9fca2b23d0ba	692	cleanup:
marcozecchini	0:9fca2b23d0ba	693	return( ret );
marcozecchini	0:9fca2b23d0ba	694	}
marcozecchini	0:9fca2b23d0ba	695
marcozecchini	0:9fca2b23d0ba	696	/*
marcozecchini	0:9fca2b23d0ba	697	* Fast mod-p functions expect their argument to be in the 0..p^2 range.
marcozecchini	0:9fca2b23d0ba	698	*
marcozecchini	0:9fca2b23d0ba	699	* In order to guarantee that, we need to ensure that operands of
marcozecchini	0:9fca2b23d0ba	700	* mbedtls_mpi_mul_mpi are in the 0..p range. So, after each operation we will
marcozecchini	0:9fca2b23d0ba	701	* bring the result back to this range.
marcozecchini	0:9fca2b23d0ba	702	*
marcozecchini	0:9fca2b23d0ba	703	* The following macros are shortcuts for doing that.
marcozecchini	0:9fca2b23d0ba	704	*/
marcozecchini	0:9fca2b23d0ba	705
marcozecchini	0:9fca2b23d0ba	706	/*
marcozecchini	0:9fca2b23d0ba	707	* Reduce a mbedtls_mpi mod p in-place, general case, to use after mbedtls_mpi_mul_mpi
marcozecchini	0:9fca2b23d0ba	708	*/
marcozecchini	0:9fca2b23d0ba	709	#if defined(MBEDTLS_SELF_TEST)
marcozecchini	0:9fca2b23d0ba	710	#define INC_MUL_COUNT mul_count++;
marcozecchini	0:9fca2b23d0ba	711	#else
marcozecchini	0:9fca2b23d0ba	712	#define INC_MUL_COUNT
marcozecchini	0:9fca2b23d0ba	713	#endif
marcozecchini	0:9fca2b23d0ba	714
marcozecchini	0:9fca2b23d0ba	715	#define MOD_MUL( N ) do { MBEDTLS_MPI_CHK( ecp_modp( &N, grp ) ); INC_MUL_COUNT } \
marcozecchini	0:9fca2b23d0ba	716	while( 0 )
marcozecchini	0:9fca2b23d0ba	717
marcozecchini	0:9fca2b23d0ba	718	/*
marcozecchini	0:9fca2b23d0ba	719	* Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_sub_mpi
marcozecchini	0:9fca2b23d0ba	720	* N->s < 0 is a very fast test, which fails only if N is 0
marcozecchini	0:9fca2b23d0ba	721	*/
marcozecchini	0:9fca2b23d0ba	722	#define MOD_SUB( N ) \
marcozecchini	0:9fca2b23d0ba	723	while( N.s < 0 && mbedtls_mpi_cmp_int( &N, 0 ) != 0 ) \
marcozecchini	0:9fca2b23d0ba	724	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &N, &N, &grp->P ) )
marcozecchini	0:9fca2b23d0ba	725
marcozecchini	0:9fca2b23d0ba	726	/*
marcozecchini	0:9fca2b23d0ba	727	* Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_add_mpi and mbedtls_mpi_mul_int.
marcozecchini	0:9fca2b23d0ba	728	* We known P, N and the result are positive, so sub_abs is correct, and
marcozecchini	0:9fca2b23d0ba	729	* a bit faster.
marcozecchini	0:9fca2b23d0ba	730	*/
marcozecchini	0:9fca2b23d0ba	731	#define MOD_ADD( N ) \
marcozecchini	0:9fca2b23d0ba	732	while( mbedtls_mpi_cmp_mpi( &N, &grp->P ) >= 0 ) \
marcozecchini	0:9fca2b23d0ba	733	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( &N, &N, &grp->P ) )
marcozecchini	0:9fca2b23d0ba	734
marcozecchini	0:9fca2b23d0ba	735	#if defined(ECP_SHORTWEIERSTRASS)
marcozecchini	0:9fca2b23d0ba	736	/*
marcozecchini	0:9fca2b23d0ba	737	* For curves in short Weierstrass form, we do all the internal operations in
marcozecchini	0:9fca2b23d0ba	738	* Jacobian coordinates.
marcozecchini	0:9fca2b23d0ba	739	*
marcozecchini	0:9fca2b23d0ba	740	* For multiplication, we'll use a comb method with coutermeasueres against
marcozecchini	0:9fca2b23d0ba	741	* SPA, hence timing attacks.
marcozecchini	0:9fca2b23d0ba	742	*/
marcozecchini	0:9fca2b23d0ba	743
marcozecchini	0:9fca2b23d0ba	744	/*
marcozecchini	0:9fca2b23d0ba	745	* Normalize jacobian coordinates so that Z == 0 \|\| Z == 1 (GECC 3.2.1)
marcozecchini	0:9fca2b23d0ba	746	* Cost: 1N := 1I + 3M + 1S
marcozecchini	0:9fca2b23d0ba	747	*/
marcozecchini	0:9fca2b23d0ba	748	static int ecp_normalize_jac( const mbedtls_ecp_group grp, mbedtls_ecp_point pt )
marcozecchini	0:9fca2b23d0ba	749	{
marcozecchini	0:9fca2b23d0ba	750	int ret;
marcozecchini	0:9fca2b23d0ba	751	mbedtls_mpi Zi, ZZi;
marcozecchini	0:9fca2b23d0ba	752
marcozecchini	0:9fca2b23d0ba	753	if( mbedtls_mpi_cmp_int( &pt->Z, 0 ) == 0 )
marcozecchini	0:9fca2b23d0ba	754	return( 0 );
marcozecchini	0:9fca2b23d0ba	755
marcozecchini	0:9fca2b23d0ba	756	#if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT)
marcozecchini	0:9fca2b23d0ba	757	if ( mbedtls_internal_ecp_grp_capable( grp ) )
marcozecchini	0:9fca2b23d0ba	758	{
marcozecchini	0:9fca2b23d0ba	759	return mbedtls_internal_ecp_normalize_jac( grp, pt );
marcozecchini	0:9fca2b23d0ba	760	}
marcozecchini	0:9fca2b23d0ba	761	#endif /* MBEDTLS_ECP_NORMALIZE_JAC_ALT */
marcozecchini	0:9fca2b23d0ba	762	mbedtls_mpi_init( &Zi ); mbedtls_mpi_init( &ZZi );
marcozecchini	0:9fca2b23d0ba	763
marcozecchini	0:9fca2b23d0ba	764	/*
marcozecchini	0:9fca2b23d0ba	765	* X = X / Z^2 mod p
marcozecchini	0:9fca2b23d0ba	766	*/
marcozecchini	0:9fca2b23d0ba	767	MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &Zi, &pt->Z, &grp->P ) );
marcozecchini	0:9fca2b23d0ba	768	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ZZi, &Zi, &Zi ) ); MOD_MUL( ZZi );
marcozecchini	0:9fca2b23d0ba	769	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &pt->X, &pt->X, &ZZi ) ); MOD_MUL( pt->X );
marcozecchini	0:9fca2b23d0ba	770
marcozecchini	0:9fca2b23d0ba	771	/*
marcozecchini	0:9fca2b23d0ba	772	* Y = Y / Z^3 mod p
marcozecchini	0:9fca2b23d0ba	773	*/
marcozecchini	0:9fca2b23d0ba	774	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &pt->Y, &pt->Y, &ZZi ) ); MOD_MUL( pt->Y );
marcozecchini	0:9fca2b23d0ba	775	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &pt->Y, &pt->Y, &Zi ) ); MOD_MUL( pt->Y );
marcozecchini	0:9fca2b23d0ba	776
marcozecchini	0:9fca2b23d0ba	777	/*
marcozecchini	0:9fca2b23d0ba	778	* Z = 1
marcozecchini	0:9fca2b23d0ba	779	*/
marcozecchini	0:9fca2b23d0ba	780	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z, 1 ) );
marcozecchini	0:9fca2b23d0ba	781
marcozecchini	0:9fca2b23d0ba	782	cleanup:
marcozecchini	0:9fca2b23d0ba	783
marcozecchini	0:9fca2b23d0ba	784	mbedtls_mpi_free( &Zi ); mbedtls_mpi_free( &ZZi );
marcozecchini	0:9fca2b23d0ba	785
marcozecchini	0:9fca2b23d0ba	786	return( ret );
marcozecchini	0:9fca2b23d0ba	787	}
marcozecchini	0:9fca2b23d0ba	788
marcozecchini	0:9fca2b23d0ba	789	/*
marcozecchini	0:9fca2b23d0ba	790	* Normalize jacobian coordinates of an array of (pointers to) points,
marcozecchini	0:9fca2b23d0ba	791	* using Montgomery's trick to perform only one inversion mod P.
marcozecchini	0:9fca2b23d0ba	792	* (See for example Cohen's "A Course in Computational Algebraic Number
marcozecchini	0:9fca2b23d0ba	793	* Theory", Algorithm 10.3.4.)
marcozecchini	0:9fca2b23d0ba	794	*
marcozecchini	0:9fca2b23d0ba	795	* Warning: fails (returning an error) if one of the points is zero!
marcozecchini	0:9fca2b23d0ba	796	* This should never happen, see choice of w in ecp_mul_comb().
marcozecchini	0:9fca2b23d0ba	797	*
marcozecchini	0:9fca2b23d0ba	798	* Cost: 1N(t) := 1I + (6t - 3)M + 1S
marcozecchini	0:9fca2b23d0ba	799	*/
marcozecchini	0:9fca2b23d0ba	800	static int ecp_normalize_jac_many( const mbedtls_ecp_group *grp,
marcozecchini	0:9fca2b23d0ba	801	mbedtls_ecp_point *T[], size_t t_len )
marcozecchini	0:9fca2b23d0ba	802	{
marcozecchini	0:9fca2b23d0ba	803	int ret;
marcozecchini	0:9fca2b23d0ba	804	size_t i;
marcozecchini	0:9fca2b23d0ba	805	mbedtls_mpi *c, u, Zi, ZZi;
marcozecchini	0:9fca2b23d0ba	806
marcozecchini	0:9fca2b23d0ba	807	if( t_len < 2 )
marcozecchini	0:9fca2b23d0ba	808	return( ecp_normalize_jac( grp, *T ) );
marcozecchini	0:9fca2b23d0ba	809
marcozecchini	0:9fca2b23d0ba	810	#if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT)
marcozecchini	0:9fca2b23d0ba	811	if ( mbedtls_internal_ecp_grp_capable( grp ) )
marcozecchini	0:9fca2b23d0ba	812	{
marcozecchini	0:9fca2b23d0ba	813	return mbedtls_internal_ecp_normalize_jac_many(grp, T, t_len);
marcozecchini	0:9fca2b23d0ba	814	}
marcozecchini	0:9fca2b23d0ba	815	#endif
marcozecchini	0:9fca2b23d0ba	816
marcozecchini	0:9fca2b23d0ba	817	if( ( c = mbedtls_calloc( t_len, sizeof( mbedtls_mpi ) ) ) == NULL )
marcozecchini	0:9fca2b23d0ba	818	return( MBEDTLS_ERR_ECP_ALLOC_FAILED );
marcozecchini	0:9fca2b23d0ba	819
marcozecchini	0:9fca2b23d0ba	820	mbedtls_mpi_init( &u ); mbedtls_mpi_init( &Zi ); mbedtls_mpi_init( &ZZi );
marcozecchini	0:9fca2b23d0ba	821
marcozecchini	0:9fca2b23d0ba	822	/*
marcozecchini	0:9fca2b23d0ba	823	* c[i] = Z_0 * ... * Z_i
marcozecchini	0:9fca2b23d0ba	824	*/
marcozecchini	0:9fca2b23d0ba	825	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &c[0], &T[0]->Z ) );
marcozecchini	0:9fca2b23d0ba	826	for( i = 1; i < t_len; i++ )
marcozecchini	0:9fca2b23d0ba	827	{
marcozecchini	0:9fca2b23d0ba	828	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &c[i], &c[i-1], &T[i]->Z ) );
marcozecchini	0:9fca2b23d0ba	829	MOD_MUL( c[i] );
marcozecchini	0:9fca2b23d0ba	830	}
marcozecchini	0:9fca2b23d0ba	831
marcozecchini	0:9fca2b23d0ba	832	/*
marcozecchini	0:9fca2b23d0ba	833	* u = 1 / (Z_0 * ... * Z_n) mod P
marcozecchini	0:9fca2b23d0ba	834	*/
marcozecchini	0:9fca2b23d0ba	835	MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &u, &c[t_len-1], &grp->P ) );
marcozecchini	0:9fca2b23d0ba	836
marcozecchini	0:9fca2b23d0ba	837	for( i = t_len - 1; ; i-- )
marcozecchini	0:9fca2b23d0ba	838	{
marcozecchini	0:9fca2b23d0ba	839	/*
marcozecchini	0:9fca2b23d0ba	840	* Zi = 1 / Z_i mod p
marcozecchini	0:9fca2b23d0ba	841	* u = 1 / (Z_0 * ... * Z_i) mod P
marcozecchini	0:9fca2b23d0ba	842	*/
marcozecchini	0:9fca2b23d0ba	843	if( i == 0 ) {
marcozecchini	0:9fca2b23d0ba	844	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &Zi, &u ) );
marcozecchini	0:9fca2b23d0ba	845	}
marcozecchini	0:9fca2b23d0ba	846	else
marcozecchini	0:9fca2b23d0ba	847	{
marcozecchini	0:9fca2b23d0ba	848	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &Zi, &u, &c[i-1] ) ); MOD_MUL( Zi );
marcozecchini	0:9fca2b23d0ba	849	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &u, &u, &T[i]->Z ) ); MOD_MUL( u );
marcozecchini	0:9fca2b23d0ba	850	}
marcozecchini	0:9fca2b23d0ba	851
marcozecchini	0:9fca2b23d0ba	852	/*
marcozecchini	0:9fca2b23d0ba	853	* proceed as in normalize()
marcozecchini	0:9fca2b23d0ba	854	*/
marcozecchini	0:9fca2b23d0ba	855	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ZZi, &Zi, &Zi ) ); MOD_MUL( ZZi );
marcozecchini	0:9fca2b23d0ba	856	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T[i]->X, &T[i]->X, &ZZi ) ); MOD_MUL( T[i]->X );
marcozecchini	0:9fca2b23d0ba	857	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T[i]->Y, &T[i]->Y, &ZZi ) ); MOD_MUL( T[i]->Y );
marcozecchini	0:9fca2b23d0ba	858	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T[i]->Y, &T[i]->Y, &Zi ) ); MOD_MUL( T[i]->Y );
marcozecchini	0:9fca2b23d0ba	859
marcozecchini	0:9fca2b23d0ba	860	/*
marcozecchini	0:9fca2b23d0ba	861	* Post-precessing: reclaim some memory by shrinking coordinates
marcozecchini	0:9fca2b23d0ba	862	* - not storing Z (always 1)
marcozecchini	0:9fca2b23d0ba	863	* - shrinking other coordinates, but still keeping the same number of
marcozecchini	0:9fca2b23d0ba	864	* limbs as P, as otherwise it will too likely be regrown too fast.
marcozecchini	0:9fca2b23d0ba	865	*/
marcozecchini	0:9fca2b23d0ba	866	MBEDTLS_MPI_CHK( mbedtls_mpi_shrink( &T[i]->X, grp->P.n ) );
marcozecchini	0:9fca2b23d0ba	867	MBEDTLS_MPI_CHK( mbedtls_mpi_shrink( &T[i]->Y, grp->P.n ) );
marcozecchini	0:9fca2b23d0ba	868	mbedtls_mpi_free( &T[i]->Z );
marcozecchini	0:9fca2b23d0ba	869
marcozecchini	0:9fca2b23d0ba	870	if( i == 0 )
marcozecchini	0:9fca2b23d0ba	871	break;
marcozecchini	0:9fca2b23d0ba	872	}
marcozecchini	0:9fca2b23d0ba	873
marcozecchini	0:9fca2b23d0ba	874	cleanup:
marcozecchini	0:9fca2b23d0ba	875
marcozecchini	0:9fca2b23d0ba	876	mbedtls_mpi_free( &u ); mbedtls_mpi_free( &Zi ); mbedtls_mpi_free( &ZZi );
marcozecchini	0:9fca2b23d0ba	877	for( i = 0; i < t_len; i++ )
marcozecchini	0:9fca2b23d0ba	878	mbedtls_mpi_free( &c[i] );
marcozecchini	0:9fca2b23d0ba	879	mbedtls_free( c );
marcozecchini	0:9fca2b23d0ba	880
marcozecchini	0:9fca2b23d0ba	881	return( ret );
marcozecchini	0:9fca2b23d0ba	882	}
marcozecchini	0:9fca2b23d0ba	883
marcozecchini	0:9fca2b23d0ba	884	/*
marcozecchini	0:9fca2b23d0ba	885	* Conditional point inversion: Q -> -Q = (Q.X, -Q.Y, Q.Z) without leak.
marcozecchini	0:9fca2b23d0ba	886	* "inv" must be 0 (don't invert) or 1 (invert) or the result will be invalid
marcozecchini	0:9fca2b23d0ba	887	*/
marcozecchini	0:9fca2b23d0ba	888	static int ecp_safe_invert_jac( const mbedtls_ecp_group *grp,
marcozecchini	0:9fca2b23d0ba	889	mbedtls_ecp_point *Q,
marcozecchini	0:9fca2b23d0ba	890	unsigned char inv )
marcozecchini	0:9fca2b23d0ba	891	{
marcozecchini	0:9fca2b23d0ba	892	int ret;
marcozecchini	0:9fca2b23d0ba	893	unsigned char nonzero;
marcozecchini	0:9fca2b23d0ba	894	mbedtls_mpi mQY;
marcozecchini	0:9fca2b23d0ba	895
marcozecchini	0:9fca2b23d0ba	896	mbedtls_mpi_init( &mQY );
marcozecchini	0:9fca2b23d0ba	897
marcozecchini	0:9fca2b23d0ba	898	/* Use the fact that -Q.Y mod P = P - Q.Y unless Q.Y == 0 */
marcozecchini	0:9fca2b23d0ba	899	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &mQY, &grp->P, &Q->Y ) );
marcozecchini	0:9fca2b23d0ba	900	nonzero = mbedtls_mpi_cmp_int( &Q->Y, 0 ) != 0;
marcozecchini	0:9fca2b23d0ba	901	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &Q->Y, &mQY, inv & nonzero ) );
marcozecchini	0:9fca2b23d0ba	902
marcozecchini	0:9fca2b23d0ba	903	cleanup:
marcozecchini	0:9fca2b23d0ba	904	mbedtls_mpi_free( &mQY );
marcozecchini	0:9fca2b23d0ba	905
marcozecchini	0:9fca2b23d0ba	906	return( ret );
marcozecchini	0:9fca2b23d0ba	907	}
marcozecchini	0:9fca2b23d0ba	908
marcozecchini	0:9fca2b23d0ba	909	/*
marcozecchini	0:9fca2b23d0ba	910	* Point doubling R = 2 P, Jacobian coordinates
marcozecchini	0:9fca2b23d0ba	911	*
marcozecchini	0:9fca2b23d0ba	912	* Based on http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#doubling-dbl-1998-cmo-2 .
marcozecchini	0:9fca2b23d0ba	913	*
marcozecchini	0:9fca2b23d0ba	914	* We follow the variable naming fairly closely. The formula variations that trade a MUL for a SQR
marcozecchini	0:9fca2b23d0ba	915	* (plus a few ADDs) aren't useful as our bignum implementation doesn't distinguish squaring.
marcozecchini	0:9fca2b23d0ba	916	*
marcozecchini	0:9fca2b23d0ba	917	* Standard optimizations are applied when curve parameter A is one of { 0, -3 }.
marcozecchini	0:9fca2b23d0ba	918	*
marcozecchini	0:9fca2b23d0ba	919	* Cost: 1D := 3M + 4S (A == 0)
marcozecchini	0:9fca2b23d0ba	920	* 4M + 4S (A == -3)
marcozecchini	0:9fca2b23d0ba	921	* 3M + 6S + 1a otherwise
marcozecchini	0:9fca2b23d0ba	922	*/
marcozecchini	0:9fca2b23d0ba	923	static int ecp_double_jac( const mbedtls_ecp_group grp, mbedtls_ecp_point R,
marcozecchini	0:9fca2b23d0ba	924	const mbedtls_ecp_point *P )
marcozecchini	0:9fca2b23d0ba	925	{
marcozecchini	0:9fca2b23d0ba	926	int ret;
marcozecchini	0:9fca2b23d0ba	927	mbedtls_mpi M, S, T, U;
marcozecchini	0:9fca2b23d0ba	928
marcozecchini	0:9fca2b23d0ba	929	#if defined(MBEDTLS_SELF_TEST)
marcozecchini	0:9fca2b23d0ba	930	dbl_count++;
marcozecchini	0:9fca2b23d0ba	931	#endif
marcozecchini	0:9fca2b23d0ba	932
marcozecchini	0:9fca2b23d0ba	933	#if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT)
marcozecchini	0:9fca2b23d0ba	934	if ( mbedtls_internal_ecp_grp_capable( grp ) )
marcozecchini	0:9fca2b23d0ba	935	{
marcozecchini	0:9fca2b23d0ba	936	return mbedtls_internal_ecp_double_jac( grp, R, P );
marcozecchini	0:9fca2b23d0ba	937	}
marcozecchini	0:9fca2b23d0ba	938	#endif /* MBEDTLS_ECP_DOUBLE_JAC_ALT */
marcozecchini	0:9fca2b23d0ba	939
marcozecchini	0:9fca2b23d0ba	940	mbedtls_mpi_init( &M ); mbedtls_mpi_init( &S ); mbedtls_mpi_init( &T ); mbedtls_mpi_init( &U );
marcozecchini	0:9fca2b23d0ba	941
marcozecchini	0:9fca2b23d0ba	942	/* Special case for A = -3 */
marcozecchini	0:9fca2b23d0ba	943	if( grp->A.p == NULL )
marcozecchini	0:9fca2b23d0ba	944	{
marcozecchini	0:9fca2b23d0ba	945	/* M = 3(X + Z^2)(X - Z^2) */
marcozecchini	0:9fca2b23d0ba	946	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &P->Z, &P->Z ) ); MOD_MUL( S );
marcozecchini	0:9fca2b23d0ba	947	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &T, &P->X, &S ) ); MOD_ADD( T );
marcozecchini	0:9fca2b23d0ba	948	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &U, &P->X, &S ) ); MOD_SUB( U );
marcozecchini	0:9fca2b23d0ba	949	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &T, &U ) ); MOD_MUL( S );
marcozecchini	0:9fca2b23d0ba	950	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &M, &S, 3 ) ); MOD_ADD( M );
marcozecchini	0:9fca2b23d0ba	951	}
marcozecchini	0:9fca2b23d0ba	952	else
marcozecchini	0:9fca2b23d0ba	953	{
marcozecchini	0:9fca2b23d0ba	954	/* M = 3.X^2 */
marcozecchini	0:9fca2b23d0ba	955	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &P->X, &P->X ) ); MOD_MUL( S );
marcozecchini	0:9fca2b23d0ba	956	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &M, &S, 3 ) ); MOD_ADD( M );
marcozecchini	0:9fca2b23d0ba	957
marcozecchini	0:9fca2b23d0ba	958	/* Optimize away for "koblitz" curves with A = 0 */
marcozecchini	0:9fca2b23d0ba	959	if( mbedtls_mpi_cmp_int( &grp->A, 0 ) != 0 )
marcozecchini	0:9fca2b23d0ba	960	{
marcozecchini	0:9fca2b23d0ba	961	/* M += A.Z^4 */
marcozecchini	0:9fca2b23d0ba	962	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &P->Z, &P->Z ) ); MOD_MUL( S );
marcozecchini	0:9fca2b23d0ba	963	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &S, &S ) ); MOD_MUL( T );
marcozecchini	0:9fca2b23d0ba	964	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &T, &grp->A ) ); MOD_MUL( S );
marcozecchini	0:9fca2b23d0ba	965	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &M, &M, &S ) ); MOD_ADD( M );
marcozecchini	0:9fca2b23d0ba	966	}
marcozecchini	0:9fca2b23d0ba	967	}
marcozecchini	0:9fca2b23d0ba	968
marcozecchini	0:9fca2b23d0ba	969	/* S = 4.X.Y^2 */
marcozecchini	0:9fca2b23d0ba	970	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &P->Y, &P->Y ) ); MOD_MUL( T );
marcozecchini	0:9fca2b23d0ba	971	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &T, 1 ) ); MOD_ADD( T );
marcozecchini	0:9fca2b23d0ba	972	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &P->X, &T ) ); MOD_MUL( S );
marcozecchini	0:9fca2b23d0ba	973	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &S, 1 ) ); MOD_ADD( S );
marcozecchini	0:9fca2b23d0ba	974
marcozecchini	0:9fca2b23d0ba	975	/* U = 8.Y^4 */
marcozecchini	0:9fca2b23d0ba	976	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &U, &T, &T ) ); MOD_MUL( U );
marcozecchini	0:9fca2b23d0ba	977	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &U, 1 ) ); MOD_ADD( U );
marcozecchini	0:9fca2b23d0ba	978
marcozecchini	0:9fca2b23d0ba	979	/* T = M^2 - 2.S */
marcozecchini	0:9fca2b23d0ba	980	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &M, &M ) ); MOD_MUL( T );
marcozecchini	0:9fca2b23d0ba	981	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T, &T, &S ) ); MOD_SUB( T );
marcozecchini	0:9fca2b23d0ba	982	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T, &T, &S ) ); MOD_SUB( T );
marcozecchini	0:9fca2b23d0ba	983
marcozecchini	0:9fca2b23d0ba	984	/* S = M(S - T) - U */
marcozecchini	0:9fca2b23d0ba	985	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &S, &S, &T ) ); MOD_SUB( S );
marcozecchini	0:9fca2b23d0ba	986	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &S, &M ) ); MOD_MUL( S );
marcozecchini	0:9fca2b23d0ba	987	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &S, &S, &U ) ); MOD_SUB( S );
marcozecchini	0:9fca2b23d0ba	988
marcozecchini	0:9fca2b23d0ba	989	/* U = 2.Y.Z */
marcozecchini	0:9fca2b23d0ba	990	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &U, &P->Y, &P->Z ) ); MOD_MUL( U );
marcozecchini	0:9fca2b23d0ba	991	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &U, 1 ) ); MOD_ADD( U );
marcozecchini	0:9fca2b23d0ba	992
marcozecchini	0:9fca2b23d0ba	993	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->X, &T ) );
marcozecchini	0:9fca2b23d0ba	994	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Y, &S ) );
marcozecchini	0:9fca2b23d0ba	995	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Z, &U ) );
marcozecchini	0:9fca2b23d0ba	996
marcozecchini	0:9fca2b23d0ba	997	cleanup:
marcozecchini	0:9fca2b23d0ba	998	mbedtls_mpi_free( &M ); mbedtls_mpi_free( &S ); mbedtls_mpi_free( &T ); mbedtls_mpi_free( &U );
marcozecchini	0:9fca2b23d0ba	999
marcozecchini	0:9fca2b23d0ba	1000	return( ret );
marcozecchini	0:9fca2b23d0ba	1001	}
marcozecchini	0:9fca2b23d0ba	1002
marcozecchini	0:9fca2b23d0ba	1003	/*
marcozecchini	0:9fca2b23d0ba	1004	* Addition: R = P + Q, mixed affine-Jacobian coordinates (GECC 3.22)
marcozecchini	0:9fca2b23d0ba	1005	*
marcozecchini	0:9fca2b23d0ba	1006	* The coordinates of Q must be normalized (= affine),
marcozecchini	0:9fca2b23d0ba	1007	* but those of P don't need to. R is not normalized.
marcozecchini	0:9fca2b23d0ba	1008	*
marcozecchini	0:9fca2b23d0ba	1009	* Special cases: (1) P or Q is zero, (2) R is zero, (3) P == Q.
marcozecchini	0:9fca2b23d0ba	1010	* None of these cases can happen as intermediate step in ecp_mul_comb():
marcozecchini	0:9fca2b23d0ba	1011	* - at each step, P, Q and R are multiples of the base point, the factor
marcozecchini	0:9fca2b23d0ba	1012	* being less than its order, so none of them is zero;
marcozecchini	0:9fca2b23d0ba	1013	* - Q is an odd multiple of the base point, P an even multiple,
marcozecchini	0:9fca2b23d0ba	1014	* due to the choice of precomputed points in the modified comb method.
marcozecchini	0:9fca2b23d0ba	1015	* So branches for these cases do not leak secret information.
marcozecchini	0:9fca2b23d0ba	1016	*
marcozecchini	0:9fca2b23d0ba	1017	* We accept Q->Z being unset (saving memory in tables) as meaning 1.
marcozecchini	0:9fca2b23d0ba	1018	*
marcozecchini	0:9fca2b23d0ba	1019	* Cost: 1A := 8M + 3S
marcozecchini	0:9fca2b23d0ba	1020	*/
marcozecchini	0:9fca2b23d0ba	1021	static int ecp_add_mixed( const mbedtls_ecp_group grp, mbedtls_ecp_point R,
marcozecchini	0:9fca2b23d0ba	1022	const mbedtls_ecp_point P, const mbedtls_ecp_point Q )
marcozecchini	0:9fca2b23d0ba	1023	{
marcozecchini	0:9fca2b23d0ba	1024	int ret;
marcozecchini	0:9fca2b23d0ba	1025	mbedtls_mpi T1, T2, T3, T4, X, Y, Z;
marcozecchini	0:9fca2b23d0ba	1026
marcozecchini	0:9fca2b23d0ba	1027	#if defined(MBEDTLS_SELF_TEST)
marcozecchini	0:9fca2b23d0ba	1028	add_count++;
marcozecchini	0:9fca2b23d0ba	1029	#endif
marcozecchini	0:9fca2b23d0ba	1030
marcozecchini	0:9fca2b23d0ba	1031	#if defined(MBEDTLS_ECP_ADD_MIXED_ALT)
marcozecchini	0:9fca2b23d0ba	1032	if ( mbedtls_internal_ecp_grp_capable( grp ) )
marcozecchini	0:9fca2b23d0ba	1033	{
marcozecchini	0:9fca2b23d0ba	1034	return mbedtls_internal_ecp_add_mixed( grp, R, P, Q );
marcozecchini	0:9fca2b23d0ba	1035	}
marcozecchini	0:9fca2b23d0ba	1036	#endif /* MBEDTLS_ECP_ADD_MIXED_ALT */
marcozecchini	0:9fca2b23d0ba	1037
marcozecchini	0:9fca2b23d0ba	1038	/*
marcozecchini	0:9fca2b23d0ba	1039	* Trivial cases: P == 0 or Q == 0 (case 1)
marcozecchini	0:9fca2b23d0ba	1040	*/
marcozecchini	0:9fca2b23d0ba	1041	if( mbedtls_mpi_cmp_int( &P->Z, 0 ) == 0 )
marcozecchini	0:9fca2b23d0ba	1042	return( mbedtls_ecp_copy( R, Q ) );
marcozecchini	0:9fca2b23d0ba	1043
marcozecchini	0:9fca2b23d0ba	1044	if( Q->Z.p != NULL && mbedtls_mpi_cmp_int( &Q->Z, 0 ) == 0 )
marcozecchini	0:9fca2b23d0ba	1045	return( mbedtls_ecp_copy( R, P ) );
marcozecchini	0:9fca2b23d0ba	1046
marcozecchini	0:9fca2b23d0ba	1047	/*
marcozecchini	0:9fca2b23d0ba	1048	* Make sure Q coordinates are normalized
marcozecchini	0:9fca2b23d0ba	1049	*/
marcozecchini	0:9fca2b23d0ba	1050	if( Q->Z.p != NULL && mbedtls_mpi_cmp_int( &Q->Z, 1 ) != 0 )
marcozecchini	0:9fca2b23d0ba	1051	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	1052
marcozecchini	0:9fca2b23d0ba	1053	mbedtls_mpi_init( &T1 ); mbedtls_mpi_init( &T2 ); mbedtls_mpi_init( &T3 ); mbedtls_mpi_init( &T4 );
marcozecchini	0:9fca2b23d0ba	1054	mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y ); mbedtls_mpi_init( &Z );
marcozecchini	0:9fca2b23d0ba	1055
marcozecchini	0:9fca2b23d0ba	1056	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &P->Z, &P->Z ) ); MOD_MUL( T1 );
marcozecchini	0:9fca2b23d0ba	1057	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T2, &T1, &P->Z ) ); MOD_MUL( T2 );
marcozecchini	0:9fca2b23d0ba	1058	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &T1, &Q->X ) ); MOD_MUL( T1 );
marcozecchini	0:9fca2b23d0ba	1059	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T2, &T2, &Q->Y ) ); MOD_MUL( T2 );
marcozecchini	0:9fca2b23d0ba	1060	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T1, &T1, &P->X ) ); MOD_SUB( T1 );
marcozecchini	0:9fca2b23d0ba	1061	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T2, &T2, &P->Y ) ); MOD_SUB( T2 );
marcozecchini	0:9fca2b23d0ba	1062
marcozecchini	0:9fca2b23d0ba	1063	/* Special cases (2) and (3) */
marcozecchini	0:9fca2b23d0ba	1064	if( mbedtls_mpi_cmp_int( &T1, 0 ) == 0 )
marcozecchini	0:9fca2b23d0ba	1065	{
marcozecchini	0:9fca2b23d0ba	1066	if( mbedtls_mpi_cmp_int( &T2, 0 ) == 0 )
marcozecchini	0:9fca2b23d0ba	1067	{
marcozecchini	0:9fca2b23d0ba	1068	ret = ecp_double_jac( grp, R, P );
marcozecchini	0:9fca2b23d0ba	1069	goto cleanup;
marcozecchini	0:9fca2b23d0ba	1070	}
marcozecchini	0:9fca2b23d0ba	1071	else
marcozecchini	0:9fca2b23d0ba	1072	{
marcozecchini	0:9fca2b23d0ba	1073	ret = mbedtls_ecp_set_zero( R );
marcozecchini	0:9fca2b23d0ba	1074	goto cleanup;
marcozecchini	0:9fca2b23d0ba	1075	}
marcozecchini	0:9fca2b23d0ba	1076	}
marcozecchini	0:9fca2b23d0ba	1077
marcozecchini	0:9fca2b23d0ba	1078	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &Z, &P->Z, &T1 ) ); MOD_MUL( Z );
marcozecchini	0:9fca2b23d0ba	1079	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T3, &T1, &T1 ) ); MOD_MUL( T3 );
marcozecchini	0:9fca2b23d0ba	1080	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T4, &T3, &T1 ) ); MOD_MUL( T4 );
marcozecchini	0:9fca2b23d0ba	1081	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T3, &T3, &P->X ) ); MOD_MUL( T3 );
marcozecchini	0:9fca2b23d0ba	1082	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &T1, &T3, 2 ) ); MOD_ADD( T1 );
marcozecchini	0:9fca2b23d0ba	1083	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &X, &T2, &T2 ) ); MOD_MUL( X );
marcozecchini	0:9fca2b23d0ba	1084	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &X, &X, &T1 ) ); MOD_SUB( X );
marcozecchini	0:9fca2b23d0ba	1085	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &X, &X, &T4 ) ); MOD_SUB( X );
marcozecchini	0:9fca2b23d0ba	1086	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T3, &T3, &X ) ); MOD_SUB( T3 );
marcozecchini	0:9fca2b23d0ba	1087	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T3, &T3, &T2 ) ); MOD_MUL( T3 );
marcozecchini	0:9fca2b23d0ba	1088	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T4, &T4, &P->Y ) ); MOD_MUL( T4 );
marcozecchini	0:9fca2b23d0ba	1089	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &Y, &T3, &T4 ) ); MOD_SUB( Y );
marcozecchini	0:9fca2b23d0ba	1090
marcozecchini	0:9fca2b23d0ba	1091	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->X, &X ) );
marcozecchini	0:9fca2b23d0ba	1092	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Y, &Y ) );
marcozecchini	0:9fca2b23d0ba	1093	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Z, &Z ) );
marcozecchini	0:9fca2b23d0ba	1094
marcozecchini	0:9fca2b23d0ba	1095	cleanup:
marcozecchini	0:9fca2b23d0ba	1096
marcozecchini	0:9fca2b23d0ba	1097	mbedtls_mpi_free( &T1 ); mbedtls_mpi_free( &T2 ); mbedtls_mpi_free( &T3 ); mbedtls_mpi_free( &T4 );
marcozecchini	0:9fca2b23d0ba	1098	mbedtls_mpi_free( &X ); mbedtls_mpi_free( &Y ); mbedtls_mpi_free( &Z );
marcozecchini	0:9fca2b23d0ba	1099
marcozecchini	0:9fca2b23d0ba	1100	return( ret );
marcozecchini	0:9fca2b23d0ba	1101	}
marcozecchini	0:9fca2b23d0ba	1102
marcozecchini	0:9fca2b23d0ba	1103	/*
marcozecchini	0:9fca2b23d0ba	1104	* Randomize jacobian coordinates:
marcozecchini	0:9fca2b23d0ba	1105	* (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l
marcozecchini	0:9fca2b23d0ba	1106	* This is sort of the reverse operation of ecp_normalize_jac().
marcozecchini	0:9fca2b23d0ba	1107	*
marcozecchini	0:9fca2b23d0ba	1108	* This countermeasure was first suggested in [2].
marcozecchini	0:9fca2b23d0ba	1109	*/
marcozecchini	0:9fca2b23d0ba	1110	static int ecp_randomize_jac( const mbedtls_ecp_group grp, mbedtls_ecp_point pt,
marcozecchini	0:9fca2b23d0ba	1111	int (f_rng)(void , unsigned char , size_t), void p_rng )
marcozecchini	0:9fca2b23d0ba	1112	{
marcozecchini	0:9fca2b23d0ba	1113	int ret;
marcozecchini	0:9fca2b23d0ba	1114	mbedtls_mpi l, ll;
marcozecchini	0:9fca2b23d0ba	1115	size_t p_size;
marcozecchini	0:9fca2b23d0ba	1116	int count = 0;
marcozecchini	0:9fca2b23d0ba	1117
marcozecchini	0:9fca2b23d0ba	1118	#if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT)
marcozecchini	0:9fca2b23d0ba	1119	if ( mbedtls_internal_ecp_grp_capable( grp ) )
marcozecchini	0:9fca2b23d0ba	1120	{
marcozecchini	0:9fca2b23d0ba	1121	return mbedtls_internal_ecp_randomize_jac( grp, pt, f_rng, p_rng );
marcozecchini	0:9fca2b23d0ba	1122	}
marcozecchini	0:9fca2b23d0ba	1123	#endif /* MBEDTLS_ECP_RANDOMIZE_JAC_ALT */
marcozecchini	0:9fca2b23d0ba	1124
marcozecchini	0:9fca2b23d0ba	1125	p_size = ( grp->pbits + 7 ) / 8;
marcozecchini	0:9fca2b23d0ba	1126	mbedtls_mpi_init( &l ); mbedtls_mpi_init( &ll );
marcozecchini	0:9fca2b23d0ba	1127
marcozecchini	0:9fca2b23d0ba	1128	/* Generate l such that 1 < l < p */
marcozecchini	0:9fca2b23d0ba	1129	do
marcozecchini	0:9fca2b23d0ba	1130	{
marcozecchini	0:9fca2b23d0ba	1131	MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &l, p_size, f_rng, p_rng ) );
marcozecchini	0:9fca2b23d0ba	1132
marcozecchini	0:9fca2b23d0ba	1133	while( mbedtls_mpi_cmp_mpi( &l, &grp->P ) >= 0 )
marcozecchini	0:9fca2b23d0ba	1134	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, 1 ) );
marcozecchini	0:9fca2b23d0ba	1135
marcozecchini	0:9fca2b23d0ba	1136	if( count++ > 10 )
marcozecchini	0:9fca2b23d0ba	1137	return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
marcozecchini	0:9fca2b23d0ba	1138	}
marcozecchini	0:9fca2b23d0ba	1139	while( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 );
marcozecchini	0:9fca2b23d0ba	1140
marcozecchini	0:9fca2b23d0ba	1141	/* Z = l * Z */
marcozecchini	0:9fca2b23d0ba	1142	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &pt->Z, &pt->Z, &l ) ); MOD_MUL( pt->Z );
marcozecchini	0:9fca2b23d0ba	1143
marcozecchini	0:9fca2b23d0ba	1144	/* X = l^2 * X */
marcozecchini	0:9fca2b23d0ba	1145	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ll, &l, &l ) ); MOD_MUL( ll );
marcozecchini	0:9fca2b23d0ba	1146	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &pt->X, &pt->X, &ll ) ); MOD_MUL( pt->X );
marcozecchini	0:9fca2b23d0ba	1147
marcozecchini	0:9fca2b23d0ba	1148	/* Y = l^3 * Y */
marcozecchini	0:9fca2b23d0ba	1149	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ll, &ll, &l ) ); MOD_MUL( ll );
marcozecchini	0:9fca2b23d0ba	1150	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &pt->Y, &pt->Y, &ll ) ); MOD_MUL( pt->Y );
marcozecchini	0:9fca2b23d0ba	1151
marcozecchini	0:9fca2b23d0ba	1152	cleanup:
marcozecchini	0:9fca2b23d0ba	1153	mbedtls_mpi_free( &l ); mbedtls_mpi_free( &ll );
marcozecchini	0:9fca2b23d0ba	1154
marcozecchini	0:9fca2b23d0ba	1155	return( ret );
marcozecchini	0:9fca2b23d0ba	1156	}
marcozecchini	0:9fca2b23d0ba	1157
marcozecchini	0:9fca2b23d0ba	1158	/*
marcozecchini	0:9fca2b23d0ba	1159	* Check and define parameters used by the comb method (see below for details)
marcozecchini	0:9fca2b23d0ba	1160	*/
marcozecchini	0:9fca2b23d0ba	1161	#if MBEDTLS_ECP_WINDOW_SIZE < 2 \|\| MBEDTLS_ECP_WINDOW_SIZE > 7
marcozecchini	0:9fca2b23d0ba	1162	#error "MBEDTLS_ECP_WINDOW_SIZE out of bounds"
marcozecchini	0:9fca2b23d0ba	1163	#endif
marcozecchini	0:9fca2b23d0ba	1164
marcozecchini	0:9fca2b23d0ba	1165	/* d = ceil( n / w ) */
marcozecchini	0:9fca2b23d0ba	1166	#define COMB_MAX_D ( MBEDTLS_ECP_MAX_BITS + 1 ) / 2
marcozecchini	0:9fca2b23d0ba	1167
marcozecchini	0:9fca2b23d0ba	1168	/* number of precomputed points */
marcozecchini	0:9fca2b23d0ba	1169	#define COMB_MAX_PRE ( 1 << ( MBEDTLS_ECP_WINDOW_SIZE - 1 ) )
marcozecchini	0:9fca2b23d0ba	1170
marcozecchini	0:9fca2b23d0ba	1171	/*
marcozecchini	0:9fca2b23d0ba	1172	* Compute the representation of m that will be used with our comb method.
marcozecchini	0:9fca2b23d0ba	1173	*
marcozecchini	0:9fca2b23d0ba	1174	* The basic comb method is described in GECC 3.44 for example. We use a
marcozecchini	0:9fca2b23d0ba	1175	* modified version that provides resistance to SPA by avoiding zero
marcozecchini	0:9fca2b23d0ba	1176	* digits in the representation as in [3]. We modify the method further by
marcozecchini	0:9fca2b23d0ba	1177	* requiring that all K_i be odd, which has the small cost that our
marcozecchini	0:9fca2b23d0ba	1178	* representation uses one more K_i, due to carries.
marcozecchini	0:9fca2b23d0ba	1179	*
marcozecchini	0:9fca2b23d0ba	1180	* Also, for the sake of compactness, only the seven low-order bits of x[i]
marcozecchini	0:9fca2b23d0ba	1181	* are used to represent K_i, and the msb of x[i] encodes the the sign (s_i in
marcozecchini	0:9fca2b23d0ba	1182	* the paper): it is set if and only if if s_i == -1;
marcozecchini	0:9fca2b23d0ba	1183	*
marcozecchini	0:9fca2b23d0ba	1184	* Calling conventions:
marcozecchini	0:9fca2b23d0ba	1185	* - x is an array of size d + 1
marcozecchini	0:9fca2b23d0ba	1186	* - w is the size, ie number of teeth, of the comb, and must be between
marcozecchini	0:9fca2b23d0ba	1187	* 2 and 7 (in practice, between 2 and MBEDTLS_ECP_WINDOW_SIZE)
marcozecchini	0:9fca2b23d0ba	1188	* - m is the MPI, expected to be odd and such that bitlength(m) <= w * d
marcozecchini	0:9fca2b23d0ba	1189	* (the result will be incorrect if these assumptions are not satisfied)
marcozecchini	0:9fca2b23d0ba	1190	*/
marcozecchini	0:9fca2b23d0ba	1191	static void ecp_comb_fixed( unsigned char x[], size_t d,
marcozecchini	0:9fca2b23d0ba	1192	unsigned char w, const mbedtls_mpi *m )
marcozecchini	0:9fca2b23d0ba	1193	{
marcozecchini	0:9fca2b23d0ba	1194	size_t i, j;
marcozecchini	0:9fca2b23d0ba	1195	unsigned char c, cc, adjust;
marcozecchini	0:9fca2b23d0ba	1196
marcozecchini	0:9fca2b23d0ba	1197	memset( x, 0, d+1 );
marcozecchini	0:9fca2b23d0ba	1198
marcozecchini	0:9fca2b23d0ba	1199	/* First get the classical comb values (except for x_d = 0) */
marcozecchini	0:9fca2b23d0ba	1200	for( i = 0; i < d; i++ )
marcozecchini	0:9fca2b23d0ba	1201	for( j = 0; j < w; j++ )
marcozecchini	0:9fca2b23d0ba	1202	x[i] \|= mbedtls_mpi_get_bit( m, i + d * j ) << j;
marcozecchini	0:9fca2b23d0ba	1203
marcozecchini	0:9fca2b23d0ba	1204	/* Now make sure x_1 .. x_d are odd */
marcozecchini	0:9fca2b23d0ba	1205	c = 0;
marcozecchini	0:9fca2b23d0ba	1206	for( i = 1; i <= d; i++ )
marcozecchini	0:9fca2b23d0ba	1207	{
marcozecchini	0:9fca2b23d0ba	1208	/* Add carry and update it */
marcozecchini	0:9fca2b23d0ba	1209	cc = x[i] & c;
marcozecchini	0:9fca2b23d0ba	1210	x[i] = x[i] ^ c;
marcozecchini	0:9fca2b23d0ba	1211	c = cc;
marcozecchini	0:9fca2b23d0ba	1212
marcozecchini	0:9fca2b23d0ba	1213	/* Adjust if needed, avoiding branches */
marcozecchini	0:9fca2b23d0ba	1214	adjust = 1 - ( x[i] & 0x01 );
marcozecchini	0:9fca2b23d0ba	1215	c \|= x[i] & ( x[i-1] * adjust );
marcozecchini	0:9fca2b23d0ba	1216	x[i] = x[i] ^ ( x[i-1] * adjust );
marcozecchini	0:9fca2b23d0ba	1217	x[i-1] \|= adjust << 7;
marcozecchini	0:9fca2b23d0ba	1218	}
marcozecchini	0:9fca2b23d0ba	1219	}
marcozecchini	0:9fca2b23d0ba	1220
marcozecchini	0:9fca2b23d0ba	1221	/*
marcozecchini	0:9fca2b23d0ba	1222	* Precompute points for the comb method
marcozecchini	0:9fca2b23d0ba	1223	*
marcozecchini	0:9fca2b23d0ba	1224	* If i = i_{w-1} ... i_1 is the binary representation of i, then
marcozecchini	0:9fca2b23d0ba	1225	* T[i] = i_{w-1} 2^{(w-1)d} P + ... + i_1 2^d P + P
marcozecchini	0:9fca2b23d0ba	1226	*
marcozecchini	0:9fca2b23d0ba	1227	* T must be able to hold 2^{w - 1} elements
marcozecchini	0:9fca2b23d0ba	1228	*
marcozecchini	0:9fca2b23d0ba	1229	* Cost: d(w-1) D + (2^{w-1} - 1) A + 1 N(w-1) + 1 N(2^{w-1} - 1)
marcozecchini	0:9fca2b23d0ba	1230	*/
marcozecchini	0:9fca2b23d0ba	1231	static int ecp_precompute_comb( const mbedtls_ecp_group *grp,
marcozecchini	0:9fca2b23d0ba	1232	mbedtls_ecp_point T[], const mbedtls_ecp_point *P,
marcozecchini	0:9fca2b23d0ba	1233	unsigned char w, size_t d )
marcozecchini	0:9fca2b23d0ba	1234	{
marcozecchini	0:9fca2b23d0ba	1235	int ret;
marcozecchini	0:9fca2b23d0ba	1236	unsigned char i, k;
marcozecchini	0:9fca2b23d0ba	1237	size_t j;
marcozecchini	0:9fca2b23d0ba	1238	mbedtls_ecp_point cur, TT[COMB_MAX_PRE - 1];
marcozecchini	0:9fca2b23d0ba	1239
marcozecchini	0:9fca2b23d0ba	1240	/*
marcozecchini	0:9fca2b23d0ba	1241	* Set T[0] = P and
marcozecchini	0:9fca2b23d0ba	1242	* T[2^{l-1}] = 2^{dl} P for l = 1 .. w-1 (this is not the final value)
marcozecchini	0:9fca2b23d0ba	1243	*/
marcozecchini	0:9fca2b23d0ba	1244	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &T[0], P ) );
marcozecchini	0:9fca2b23d0ba	1245
marcozecchini	0:9fca2b23d0ba	1246	k = 0;
marcozecchini	0:9fca2b23d0ba	1247	for( i = 1; i < ( 1U << ( w - 1 ) ); i <<= 1 )
marcozecchini	0:9fca2b23d0ba	1248	{
marcozecchini	0:9fca2b23d0ba	1249	cur = T + i;
marcozecchini	0:9fca2b23d0ba	1250	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( cur, T + ( i >> 1 ) ) );
marcozecchini	0:9fca2b23d0ba	1251	for( j = 0; j < d; j++ )
marcozecchini	0:9fca2b23d0ba	1252	MBEDTLS_MPI_CHK( ecp_double_jac( grp, cur, cur ) );
marcozecchini	0:9fca2b23d0ba	1253
marcozecchini	0:9fca2b23d0ba	1254	TT[k++] = cur;
marcozecchini	0:9fca2b23d0ba	1255	}
marcozecchini	0:9fca2b23d0ba	1256
marcozecchini	0:9fca2b23d0ba	1257	MBEDTLS_MPI_CHK( ecp_normalize_jac_many( grp, TT, k ) );
marcozecchini	0:9fca2b23d0ba	1258
marcozecchini	0:9fca2b23d0ba	1259	/*
marcozecchini	0:9fca2b23d0ba	1260	* Compute the remaining ones using the minimal number of additions
marcozecchini	0:9fca2b23d0ba	1261	* Be careful to update T[2^l] only after using it!
marcozecchini	0:9fca2b23d0ba	1262	*/
marcozecchini	0:9fca2b23d0ba	1263	k = 0;
marcozecchini	0:9fca2b23d0ba	1264	for( i = 1; i < ( 1U << ( w - 1 ) ); i <<= 1 )
marcozecchini	0:9fca2b23d0ba	1265	{
marcozecchini	0:9fca2b23d0ba	1266	j = i;
marcozecchini	0:9fca2b23d0ba	1267	while( j-- )
marcozecchini	0:9fca2b23d0ba	1268	{
marcozecchini	0:9fca2b23d0ba	1269	MBEDTLS_MPI_CHK( ecp_add_mixed( grp, &T[i + j], &T[j], &T[i] ) );
marcozecchini	0:9fca2b23d0ba	1270	TT[k++] = &T[i + j];
marcozecchini	0:9fca2b23d0ba	1271	}
marcozecchini	0:9fca2b23d0ba	1272	}
marcozecchini	0:9fca2b23d0ba	1273
marcozecchini	0:9fca2b23d0ba	1274	MBEDTLS_MPI_CHK( ecp_normalize_jac_many( grp, TT, k ) );
marcozecchini	0:9fca2b23d0ba	1275
marcozecchini	0:9fca2b23d0ba	1276	cleanup:
marcozecchini	0:9fca2b23d0ba	1277
marcozecchini	0:9fca2b23d0ba	1278	return( ret );
marcozecchini	0:9fca2b23d0ba	1279	}
marcozecchini	0:9fca2b23d0ba	1280
marcozecchini	0:9fca2b23d0ba	1281	/*
marcozecchini	0:9fca2b23d0ba	1282	* Select precomputed point: R = sign(i) * T[ abs(i) / 2 ]
marcozecchini	0:9fca2b23d0ba	1283	*/
marcozecchini	0:9fca2b23d0ba	1284	static int ecp_select_comb( const mbedtls_ecp_group grp, mbedtls_ecp_point R,
marcozecchini	0:9fca2b23d0ba	1285	const mbedtls_ecp_point T[], unsigned char t_len,
marcozecchini	0:9fca2b23d0ba	1286	unsigned char i )
marcozecchini	0:9fca2b23d0ba	1287	{
marcozecchini	0:9fca2b23d0ba	1288	int ret;
marcozecchini	0:9fca2b23d0ba	1289	unsigned char ii, j;
marcozecchini	0:9fca2b23d0ba	1290
marcozecchini	0:9fca2b23d0ba	1291	/* Ignore the "sign" bit and scale down */
marcozecchini	0:9fca2b23d0ba	1292	ii = ( i & 0x7Fu ) >> 1;
marcozecchini	0:9fca2b23d0ba	1293
marcozecchini	0:9fca2b23d0ba	1294	/* Read the whole table to thwart cache-based timing attacks */
marcozecchini	0:9fca2b23d0ba	1295	for( j = 0; j < t_len; j++ )
marcozecchini	0:9fca2b23d0ba	1296	{
marcozecchini	0:9fca2b23d0ba	1297	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &R->X, &T[j].X, j == ii ) );
marcozecchini	0:9fca2b23d0ba	1298	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &R->Y, &T[j].Y, j == ii ) );
marcozecchini	0:9fca2b23d0ba	1299	}
marcozecchini	0:9fca2b23d0ba	1300
marcozecchini	0:9fca2b23d0ba	1301	/* Safely invert result if i is "negative" */
marcozecchini	0:9fca2b23d0ba	1302	MBEDTLS_MPI_CHK( ecp_safe_invert_jac( grp, R, i >> 7 ) );
marcozecchini	0:9fca2b23d0ba	1303
marcozecchini	0:9fca2b23d0ba	1304	cleanup:
marcozecchini	0:9fca2b23d0ba	1305	return( ret );
marcozecchini	0:9fca2b23d0ba	1306	}
marcozecchini	0:9fca2b23d0ba	1307
marcozecchini	0:9fca2b23d0ba	1308	/*
marcozecchini	0:9fca2b23d0ba	1309	* Core multiplication algorithm for the (modified) comb method.
marcozecchini	0:9fca2b23d0ba	1310	* This part is actually common with the basic comb method (GECC 3.44)
marcozecchini	0:9fca2b23d0ba	1311	*
marcozecchini	0:9fca2b23d0ba	1312	* Cost: d A + d D + 1 R
marcozecchini	0:9fca2b23d0ba	1313	*/
marcozecchini	0:9fca2b23d0ba	1314	static int ecp_mul_comb_core( const mbedtls_ecp_group grp, mbedtls_ecp_point R,
marcozecchini	0:9fca2b23d0ba	1315	const mbedtls_ecp_point T[], unsigned char t_len,
marcozecchini	0:9fca2b23d0ba	1316	const unsigned char x[], size_t d,
marcozecchini	0:9fca2b23d0ba	1317	int (f_rng)(void , unsigned char *, size_t),
marcozecchini	0:9fca2b23d0ba	1318	void *p_rng )
marcozecchini	0:9fca2b23d0ba	1319	{
marcozecchini	0:9fca2b23d0ba	1320	int ret;
marcozecchini	0:9fca2b23d0ba	1321	mbedtls_ecp_point Txi;
marcozecchini	0:9fca2b23d0ba	1322	size_t i;
marcozecchini	0:9fca2b23d0ba	1323
marcozecchini	0:9fca2b23d0ba	1324	mbedtls_ecp_point_init( &Txi );
marcozecchini	0:9fca2b23d0ba	1325
marcozecchini	0:9fca2b23d0ba	1326	/* Start with a non-zero point and randomize its coordinates */
marcozecchini	0:9fca2b23d0ba	1327	i = d;
marcozecchini	0:9fca2b23d0ba	1328	MBEDTLS_MPI_CHK( ecp_select_comb( grp, R, T, t_len, x[i] ) );
marcozecchini	0:9fca2b23d0ba	1329	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->Z, 1 ) );
marcozecchini	0:9fca2b23d0ba	1330	if( f_rng != 0 )
marcozecchini	0:9fca2b23d0ba	1331	MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, R, f_rng, p_rng ) );
marcozecchini	0:9fca2b23d0ba	1332
marcozecchini	0:9fca2b23d0ba	1333	while( i-- != 0 )
marcozecchini	0:9fca2b23d0ba	1334	{
marcozecchini	0:9fca2b23d0ba	1335	MBEDTLS_MPI_CHK( ecp_double_jac( grp, R, R ) );
marcozecchini	0:9fca2b23d0ba	1336	MBEDTLS_MPI_CHK( ecp_select_comb( grp, &Txi, T, t_len, x[i] ) );
marcozecchini	0:9fca2b23d0ba	1337	MBEDTLS_MPI_CHK( ecp_add_mixed( grp, R, R, &Txi ) );
marcozecchini	0:9fca2b23d0ba	1338	}
marcozecchini	0:9fca2b23d0ba	1339
marcozecchini	0:9fca2b23d0ba	1340	cleanup:
marcozecchini	0:9fca2b23d0ba	1341
marcozecchini	0:9fca2b23d0ba	1342	mbedtls_ecp_point_free( &Txi );
marcozecchini	0:9fca2b23d0ba	1343
marcozecchini	0:9fca2b23d0ba	1344	return( ret );
marcozecchini	0:9fca2b23d0ba	1345	}
marcozecchini	0:9fca2b23d0ba	1346
marcozecchini	0:9fca2b23d0ba	1347	/*
marcozecchini	0:9fca2b23d0ba	1348	* Multiplication using the comb method,
marcozecchini	0:9fca2b23d0ba	1349	* for curves in short Weierstrass form
marcozecchini	0:9fca2b23d0ba	1350	*/
marcozecchini	0:9fca2b23d0ba	1351	static int ecp_mul_comb( mbedtls_ecp_group grp, mbedtls_ecp_point R,
marcozecchini	0:9fca2b23d0ba	1352	const mbedtls_mpi m, const mbedtls_ecp_point P,
marcozecchini	0:9fca2b23d0ba	1353	int (f_rng)(void , unsigned char *, size_t),
marcozecchini	0:9fca2b23d0ba	1354	void *p_rng )
marcozecchini	0:9fca2b23d0ba	1355	{
marcozecchini	0:9fca2b23d0ba	1356	int ret;
marcozecchini	0:9fca2b23d0ba	1357	unsigned char w, m_is_odd, p_eq_g, pre_len, i;
marcozecchini	0:9fca2b23d0ba	1358	size_t d;
marcozecchini	0:9fca2b23d0ba	1359	unsigned char k[COMB_MAX_D + 1];
marcozecchini	0:9fca2b23d0ba	1360	mbedtls_ecp_point *T;
marcozecchini	0:9fca2b23d0ba	1361	mbedtls_mpi M, mm;
marcozecchini	0:9fca2b23d0ba	1362
marcozecchini	0:9fca2b23d0ba	1363	mbedtls_mpi_init( &M );
marcozecchini	0:9fca2b23d0ba	1364	mbedtls_mpi_init( &mm );
marcozecchini	0:9fca2b23d0ba	1365
marcozecchini	0:9fca2b23d0ba	1366	/* we need N to be odd to trnaform m in an odd number, check now */
marcozecchini	0:9fca2b23d0ba	1367	if( mbedtls_mpi_get_bit( &grp->N, 0 ) != 1 )
marcozecchini	0:9fca2b23d0ba	1368	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	1369
marcozecchini	0:9fca2b23d0ba	1370	/*
marcozecchini	0:9fca2b23d0ba	1371	* Minimize the number of multiplications, that is minimize
marcozecchini	0:9fca2b23d0ba	1372	* 10 * d * w + 18 * 2^(w-1) + 11 * d + 7 * w, with d = ceil( nbits / w )
marcozecchini	0:9fca2b23d0ba	1373	* (see costs of the various parts, with 1S = 1M)
marcozecchini	0:9fca2b23d0ba	1374	*/
marcozecchini	0:9fca2b23d0ba	1375	w = grp->nbits >= 384 ? 5 : 4;
marcozecchini	0:9fca2b23d0ba	1376
marcozecchini	0:9fca2b23d0ba	1377	/*
marcozecchini	0:9fca2b23d0ba	1378	* If P == G, pre-compute a bit more, since this may be re-used later.
marcozecchini	0:9fca2b23d0ba	1379	* Just adding one avoids upping the cost of the first mul too much,
marcozecchini	0:9fca2b23d0ba	1380	* and the memory cost too.
marcozecchini	0:9fca2b23d0ba	1381	*/
marcozecchini	0:9fca2b23d0ba	1382	#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1
marcozecchini	0:9fca2b23d0ba	1383	p_eq_g = ( mbedtls_mpi_cmp_mpi( &P->Y, &grp->G.Y ) == 0 &&
marcozecchini	0:9fca2b23d0ba	1384	mbedtls_mpi_cmp_mpi( &P->X, &grp->G.X ) == 0 );
marcozecchini	0:9fca2b23d0ba	1385	if( p_eq_g )
marcozecchini	0:9fca2b23d0ba	1386	w++;
marcozecchini	0:9fca2b23d0ba	1387	#else
marcozecchini	0:9fca2b23d0ba	1388	p_eq_g = 0;
marcozecchini	0:9fca2b23d0ba	1389	#endif
marcozecchini	0:9fca2b23d0ba	1390
marcozecchini	0:9fca2b23d0ba	1391	/*
marcozecchini	0:9fca2b23d0ba	1392	* Make sure w is within bounds.
marcozecchini	0:9fca2b23d0ba	1393	* (The last test is useful only for very small curves in the test suite.)
marcozecchini	0:9fca2b23d0ba	1394	*/
marcozecchini	0:9fca2b23d0ba	1395	if( w > MBEDTLS_ECP_WINDOW_SIZE )
marcozecchini	0:9fca2b23d0ba	1396	w = MBEDTLS_ECP_WINDOW_SIZE;
marcozecchini	0:9fca2b23d0ba	1397	if( w >= grp->nbits )
marcozecchini	0:9fca2b23d0ba	1398	w = 2;
marcozecchini	0:9fca2b23d0ba	1399
marcozecchini	0:9fca2b23d0ba	1400	/* Other sizes that depend on w */
marcozecchini	0:9fca2b23d0ba	1401	pre_len = 1U << ( w - 1 );
marcozecchini	0:9fca2b23d0ba	1402	d = ( grp->nbits + w - 1 ) / w;
marcozecchini	0:9fca2b23d0ba	1403
marcozecchini	0:9fca2b23d0ba	1404	/*
marcozecchini	0:9fca2b23d0ba	1405	* Prepare precomputed points: if P == G we want to
marcozecchini	0:9fca2b23d0ba	1406	* use grp->T if already initialized, or initialize it.
marcozecchini	0:9fca2b23d0ba	1407	*/
marcozecchini	0:9fca2b23d0ba	1408	T = p_eq_g ? grp->T : NULL;
marcozecchini	0:9fca2b23d0ba	1409
marcozecchini	0:9fca2b23d0ba	1410	if( T == NULL )
marcozecchini	0:9fca2b23d0ba	1411	{
marcozecchini	0:9fca2b23d0ba	1412	T = mbedtls_calloc( pre_len, sizeof( mbedtls_ecp_point ) );
marcozecchini	0:9fca2b23d0ba	1413	if( T == NULL )
marcozecchini	0:9fca2b23d0ba	1414	{
marcozecchini	0:9fca2b23d0ba	1415	ret = MBEDTLS_ERR_ECP_ALLOC_FAILED;
marcozecchini	0:9fca2b23d0ba	1416	goto cleanup;
marcozecchini	0:9fca2b23d0ba	1417	}
marcozecchini	0:9fca2b23d0ba	1418
marcozecchini	0:9fca2b23d0ba	1419	MBEDTLS_MPI_CHK( ecp_precompute_comb( grp, T, P, w, d ) );
marcozecchini	0:9fca2b23d0ba	1420
marcozecchini	0:9fca2b23d0ba	1421	if( p_eq_g )
marcozecchini	0:9fca2b23d0ba	1422	{
marcozecchini	0:9fca2b23d0ba	1423	grp->T = T;
marcozecchini	0:9fca2b23d0ba	1424	grp->T_size = pre_len;
marcozecchini	0:9fca2b23d0ba	1425	}
marcozecchini	0:9fca2b23d0ba	1426	}
marcozecchini	0:9fca2b23d0ba	1427
marcozecchini	0:9fca2b23d0ba	1428	/*
marcozecchini	0:9fca2b23d0ba	1429	* Make sure M is odd (M = m or M = N - m, since N is odd)
marcozecchini	0:9fca2b23d0ba	1430	* using the fact that m * P = - (N - m) * P
marcozecchini	0:9fca2b23d0ba	1431	*/
marcozecchini	0:9fca2b23d0ba	1432	m_is_odd = ( mbedtls_mpi_get_bit( m, 0 ) == 1 );
marcozecchini	0:9fca2b23d0ba	1433	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &M, m ) );
marcozecchini	0:9fca2b23d0ba	1434	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &mm, &grp->N, m ) );
marcozecchini	0:9fca2b23d0ba	1435	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &M, &mm, ! m_is_odd ) );
marcozecchini	0:9fca2b23d0ba	1436
marcozecchini	0:9fca2b23d0ba	1437	/*
marcozecchini	0:9fca2b23d0ba	1438	* Go for comb multiplication, R = M * P
marcozecchini	0:9fca2b23d0ba	1439	*/
marcozecchini	0:9fca2b23d0ba	1440	ecp_comb_fixed( k, d, w, &M );
marcozecchini	0:9fca2b23d0ba	1441	MBEDTLS_MPI_CHK( ecp_mul_comb_core( grp, R, T, pre_len, k, d, f_rng, p_rng ) );
marcozecchini	0:9fca2b23d0ba	1442
marcozecchini	0:9fca2b23d0ba	1443	/*
marcozecchini	0:9fca2b23d0ba	1444	* Now get m * P from M * P and normalize it
marcozecchini	0:9fca2b23d0ba	1445	*/
marcozecchini	0:9fca2b23d0ba	1446	MBEDTLS_MPI_CHK( ecp_safe_invert_jac( grp, R, ! m_is_odd ) );
marcozecchini	0:9fca2b23d0ba	1447	MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, R ) );
marcozecchini	0:9fca2b23d0ba	1448
marcozecchini	0:9fca2b23d0ba	1449	cleanup:
marcozecchini	0:9fca2b23d0ba	1450
marcozecchini	0:9fca2b23d0ba	1451	if( T != NULL && ! p_eq_g )
marcozecchini	0:9fca2b23d0ba	1452	{
marcozecchini	0:9fca2b23d0ba	1453	for( i = 0; i < pre_len; i++ )
marcozecchini	0:9fca2b23d0ba	1454	mbedtls_ecp_point_free( &T[i] );
marcozecchini	0:9fca2b23d0ba	1455	mbedtls_free( T );
marcozecchini	0:9fca2b23d0ba	1456	}
marcozecchini	0:9fca2b23d0ba	1457
marcozecchini	0:9fca2b23d0ba	1458	mbedtls_mpi_free( &M );
marcozecchini	0:9fca2b23d0ba	1459	mbedtls_mpi_free( &mm );
marcozecchini	0:9fca2b23d0ba	1460
marcozecchini	0:9fca2b23d0ba	1461	if( ret != 0 )
marcozecchini	0:9fca2b23d0ba	1462	mbedtls_ecp_point_free( R );
marcozecchini	0:9fca2b23d0ba	1463
marcozecchini	0:9fca2b23d0ba	1464	return( ret );
marcozecchini	0:9fca2b23d0ba	1465	}
marcozecchini	0:9fca2b23d0ba	1466
marcozecchini	0:9fca2b23d0ba	1467	#endif /* ECP_SHORTWEIERSTRASS */
marcozecchini	0:9fca2b23d0ba	1468
marcozecchini	0:9fca2b23d0ba	1469	#if defined(ECP_MONTGOMERY)
marcozecchini	0:9fca2b23d0ba	1470	/*
marcozecchini	0:9fca2b23d0ba	1471	* For Montgomery curves, we do all the internal arithmetic in projective
marcozecchini	0:9fca2b23d0ba	1472	* coordinates. Import/export of points uses only the x coordinates, which is
marcozecchini	0:9fca2b23d0ba	1473	* internaly represented as X / Z.
marcozecchini	0:9fca2b23d0ba	1474	*
marcozecchini	0:9fca2b23d0ba	1475	* For scalar multiplication, we'll use a Montgomery ladder.
marcozecchini	0:9fca2b23d0ba	1476	*/
marcozecchini	0:9fca2b23d0ba	1477
marcozecchini	0:9fca2b23d0ba	1478	/*
marcozecchini	0:9fca2b23d0ba	1479	* Normalize Montgomery x/z coordinates: X = X/Z, Z = 1
marcozecchini	0:9fca2b23d0ba	1480	* Cost: 1M + 1I
marcozecchini	0:9fca2b23d0ba	1481	*/
marcozecchini	0:9fca2b23d0ba	1482	static int ecp_normalize_mxz( const mbedtls_ecp_group grp, mbedtls_ecp_point P )
marcozecchini	0:9fca2b23d0ba	1483	{
marcozecchini	0:9fca2b23d0ba	1484	int ret;
marcozecchini	0:9fca2b23d0ba	1485
marcozecchini	0:9fca2b23d0ba	1486	#if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT)
marcozecchini	0:9fca2b23d0ba	1487	if ( mbedtls_internal_ecp_grp_capable( grp ) )
marcozecchini	0:9fca2b23d0ba	1488	{
marcozecchini	0:9fca2b23d0ba	1489	return mbedtls_internal_ecp_normalize_mxz( grp, P );
marcozecchini	0:9fca2b23d0ba	1490	}
marcozecchini	0:9fca2b23d0ba	1491	#endif /* MBEDTLS_ECP_NORMALIZE_MXZ_ALT */
marcozecchini	0:9fca2b23d0ba	1492
marcozecchini	0:9fca2b23d0ba	1493	MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &P->Z, &P->Z, &grp->P ) );
marcozecchini	0:9fca2b23d0ba	1494	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &P->X, &P->X, &P->Z ) ); MOD_MUL( P->X );
marcozecchini	0:9fca2b23d0ba	1495	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &P->Z, 1 ) );
marcozecchini	0:9fca2b23d0ba	1496
marcozecchini	0:9fca2b23d0ba	1497	cleanup:
marcozecchini	0:9fca2b23d0ba	1498	return( ret );
marcozecchini	0:9fca2b23d0ba	1499	}
marcozecchini	0:9fca2b23d0ba	1500
marcozecchini	0:9fca2b23d0ba	1501	/*
marcozecchini	0:9fca2b23d0ba	1502	* Randomize projective x/z coordinates:
marcozecchini	0:9fca2b23d0ba	1503	* (X, Z) -> (l X, l Z) for random l
marcozecchini	0:9fca2b23d0ba	1504	* This is sort of the reverse operation of ecp_normalize_mxz().
marcozecchini	0:9fca2b23d0ba	1505	*
marcozecchini	0:9fca2b23d0ba	1506	* This countermeasure was first suggested in [2].
marcozecchini	0:9fca2b23d0ba	1507	* Cost: 2M
marcozecchini	0:9fca2b23d0ba	1508	*/
marcozecchini	0:9fca2b23d0ba	1509	static int ecp_randomize_mxz( const mbedtls_ecp_group grp, mbedtls_ecp_point P,
marcozecchini	0:9fca2b23d0ba	1510	int (f_rng)(void , unsigned char , size_t), void p_rng )
marcozecchini	0:9fca2b23d0ba	1511	{
marcozecchini	0:9fca2b23d0ba	1512	int ret;
marcozecchini	0:9fca2b23d0ba	1513	mbedtls_mpi l;
marcozecchini	0:9fca2b23d0ba	1514	size_t p_size;
marcozecchini	0:9fca2b23d0ba	1515	int count = 0;
marcozecchini	0:9fca2b23d0ba	1516
marcozecchini	0:9fca2b23d0ba	1517	#if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT)
marcozecchini	0:9fca2b23d0ba	1518	if ( mbedtls_internal_ecp_grp_capable( grp ) )
marcozecchini	0:9fca2b23d0ba	1519	{
marcozecchini	0:9fca2b23d0ba	1520	return mbedtls_internal_ecp_randomize_mxz( grp, P, f_rng, p_rng );
marcozecchini	0:9fca2b23d0ba	1521	}
marcozecchini	0:9fca2b23d0ba	1522	#endif /* MBEDTLS_ECP_RANDOMIZE_MXZ_ALT */
marcozecchini	0:9fca2b23d0ba	1523
marcozecchini	0:9fca2b23d0ba	1524	p_size = ( grp->pbits + 7 ) / 8;
marcozecchini	0:9fca2b23d0ba	1525	mbedtls_mpi_init( &l );
marcozecchini	0:9fca2b23d0ba	1526
marcozecchini	0:9fca2b23d0ba	1527	/* Generate l such that 1 < l < p */
marcozecchini	0:9fca2b23d0ba	1528	do
marcozecchini	0:9fca2b23d0ba	1529	{
marcozecchini	0:9fca2b23d0ba	1530	MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &l, p_size, f_rng, p_rng ) );
marcozecchini	0:9fca2b23d0ba	1531
marcozecchini	0:9fca2b23d0ba	1532	while( mbedtls_mpi_cmp_mpi( &l, &grp->P ) >= 0 )
marcozecchini	0:9fca2b23d0ba	1533	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, 1 ) );
marcozecchini	0:9fca2b23d0ba	1534
marcozecchini	0:9fca2b23d0ba	1535	if( count++ > 10 )
marcozecchini	0:9fca2b23d0ba	1536	return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
marcozecchini	0:9fca2b23d0ba	1537	}
marcozecchini	0:9fca2b23d0ba	1538	while( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 );
marcozecchini	0:9fca2b23d0ba	1539
marcozecchini	0:9fca2b23d0ba	1540	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &P->X, &P->X, &l ) ); MOD_MUL( P->X );
marcozecchini	0:9fca2b23d0ba	1541	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &P->Z, &P->Z, &l ) ); MOD_MUL( P->Z );
marcozecchini	0:9fca2b23d0ba	1542
marcozecchini	0:9fca2b23d0ba	1543	cleanup:
marcozecchini	0:9fca2b23d0ba	1544	mbedtls_mpi_free( &l );
marcozecchini	0:9fca2b23d0ba	1545
marcozecchini	0:9fca2b23d0ba	1546	return( ret );
marcozecchini	0:9fca2b23d0ba	1547	}
marcozecchini	0:9fca2b23d0ba	1548
marcozecchini	0:9fca2b23d0ba	1549	/*
marcozecchini	0:9fca2b23d0ba	1550	* Double-and-add: R = 2P, S = P + Q, with d = X(P - Q),
marcozecchini	0:9fca2b23d0ba	1551	* for Montgomery curves in x/z coordinates.
marcozecchini	0:9fca2b23d0ba	1552	*
marcozecchini	0:9fca2b23d0ba	1553	* http://www.hyperelliptic.org/EFD/g1p/auto-code/montgom/xz/ladder/mladd-1987-m.op3
marcozecchini	0:9fca2b23d0ba	1554	* with
marcozecchini	0:9fca2b23d0ba	1555	* d = X1
marcozecchini	0:9fca2b23d0ba	1556	* P = (X2, Z2)
marcozecchini	0:9fca2b23d0ba	1557	* Q = (X3, Z3)
marcozecchini	0:9fca2b23d0ba	1558	* R = (X4, Z4)
marcozecchini	0:9fca2b23d0ba	1559	* S = (X5, Z5)
marcozecchini	0:9fca2b23d0ba	1560	* and eliminating temporary variables tO, ..., t4.
marcozecchini	0:9fca2b23d0ba	1561	*
marcozecchini	0:9fca2b23d0ba	1562	* Cost: 5M + 4S
marcozecchini	0:9fca2b23d0ba	1563	*/
marcozecchini	0:9fca2b23d0ba	1564	static int ecp_double_add_mxz( const mbedtls_ecp_group *grp,
marcozecchini	0:9fca2b23d0ba	1565	mbedtls_ecp_point R, mbedtls_ecp_point S,
marcozecchini	0:9fca2b23d0ba	1566	const mbedtls_ecp_point P, const mbedtls_ecp_point Q,
marcozecchini	0:9fca2b23d0ba	1567	const mbedtls_mpi *d )
marcozecchini	0:9fca2b23d0ba	1568	{
marcozecchini	0:9fca2b23d0ba	1569	int ret;
marcozecchini	0:9fca2b23d0ba	1570	mbedtls_mpi A, AA, B, BB, E, C, D, DA, CB;
marcozecchini	0:9fca2b23d0ba	1571
marcozecchini	0:9fca2b23d0ba	1572	#if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT)
marcozecchini	0:9fca2b23d0ba	1573	if ( mbedtls_internal_ecp_grp_capable( grp ) )
marcozecchini	0:9fca2b23d0ba	1574	{
marcozecchini	0:9fca2b23d0ba	1575	return mbedtls_internal_ecp_double_add_mxz( grp, R, S, P, Q, d );
marcozecchini	0:9fca2b23d0ba	1576	}
marcozecchini	0:9fca2b23d0ba	1577	#endif /* MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT */
marcozecchini	0:9fca2b23d0ba	1578
marcozecchini	0:9fca2b23d0ba	1579	mbedtls_mpi_init( &A ); mbedtls_mpi_init( &AA ); mbedtls_mpi_init( &B );
marcozecchini	0:9fca2b23d0ba	1580	mbedtls_mpi_init( &BB ); mbedtls_mpi_init( &E ); mbedtls_mpi_init( &C );
marcozecchini	0:9fca2b23d0ba	1581	mbedtls_mpi_init( &D ); mbedtls_mpi_init( &DA ); mbedtls_mpi_init( &CB );
marcozecchini	0:9fca2b23d0ba	1582
marcozecchini	0:9fca2b23d0ba	1583	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &A, &P->X, &P->Z ) ); MOD_ADD( A );
marcozecchini	0:9fca2b23d0ba	1584	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &AA, &A, &A ) ); MOD_MUL( AA );
marcozecchini	0:9fca2b23d0ba	1585	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &B, &P->X, &P->Z ) ); MOD_SUB( B );
marcozecchini	0:9fca2b23d0ba	1586	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &BB, &B, &B ) ); MOD_MUL( BB );
marcozecchini	0:9fca2b23d0ba	1587	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &E, &AA, &BB ) ); MOD_SUB( E );
marcozecchini	0:9fca2b23d0ba	1588	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &C, &Q->X, &Q->Z ) ); MOD_ADD( C );
marcozecchini	0:9fca2b23d0ba	1589	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &D, &Q->X, &Q->Z ) ); MOD_SUB( D );
marcozecchini	0:9fca2b23d0ba	1590	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DA, &D, &A ) ); MOD_MUL( DA );
marcozecchini	0:9fca2b23d0ba	1591	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &CB, &C, &B ) ); MOD_MUL( CB );
marcozecchini	0:9fca2b23d0ba	1592	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &S->X, &DA, &CB ) ); MOD_MUL( S->X );
marcozecchini	0:9fca2b23d0ba	1593	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S->X, &S->X, &S->X ) ); MOD_MUL( S->X );
marcozecchini	0:9fca2b23d0ba	1594	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &S->Z, &DA, &CB ) ); MOD_SUB( S->Z );
marcozecchini	0:9fca2b23d0ba	1595	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S->Z, &S->Z, &S->Z ) ); MOD_MUL( S->Z );
marcozecchini	0:9fca2b23d0ba	1596	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S->Z, d, &S->Z ) ); MOD_MUL( S->Z );
marcozecchini	0:9fca2b23d0ba	1597	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &R->X, &AA, &BB ) ); MOD_MUL( R->X );
marcozecchini	0:9fca2b23d0ba	1598	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &R->Z, &grp->A, &E ) ); MOD_MUL( R->Z );
marcozecchini	0:9fca2b23d0ba	1599	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &R->Z, &BB, &R->Z ) ); MOD_ADD( R->Z );
marcozecchini	0:9fca2b23d0ba	1600	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &R->Z, &E, &R->Z ) ); MOD_MUL( R->Z );
marcozecchini	0:9fca2b23d0ba	1601
marcozecchini	0:9fca2b23d0ba	1602	cleanup:
marcozecchini	0:9fca2b23d0ba	1603	mbedtls_mpi_free( &A ); mbedtls_mpi_free( &AA ); mbedtls_mpi_free( &B );
marcozecchini	0:9fca2b23d0ba	1604	mbedtls_mpi_free( &BB ); mbedtls_mpi_free( &E ); mbedtls_mpi_free( &C );
marcozecchini	0:9fca2b23d0ba	1605	mbedtls_mpi_free( &D ); mbedtls_mpi_free( &DA ); mbedtls_mpi_free( &CB );
marcozecchini	0:9fca2b23d0ba	1606
marcozecchini	0:9fca2b23d0ba	1607	return( ret );
marcozecchini	0:9fca2b23d0ba	1608	}
marcozecchini	0:9fca2b23d0ba	1609
marcozecchini	0:9fca2b23d0ba	1610	/*
marcozecchini	0:9fca2b23d0ba	1611	* Multiplication with Montgomery ladder in x/z coordinates,
marcozecchini	0:9fca2b23d0ba	1612	* for curves in Montgomery form
marcozecchini	0:9fca2b23d0ba	1613	*/
marcozecchini	0:9fca2b23d0ba	1614	static int ecp_mul_mxz( mbedtls_ecp_group grp, mbedtls_ecp_point R,
marcozecchini	0:9fca2b23d0ba	1615	const mbedtls_mpi m, const mbedtls_ecp_point P,
marcozecchini	0:9fca2b23d0ba	1616	int (f_rng)(void , unsigned char *, size_t),
marcozecchini	0:9fca2b23d0ba	1617	void *p_rng )
marcozecchini	0:9fca2b23d0ba	1618	{
marcozecchini	0:9fca2b23d0ba	1619	int ret;
marcozecchini	0:9fca2b23d0ba	1620	size_t i;
marcozecchini	0:9fca2b23d0ba	1621	unsigned char b;
marcozecchini	0:9fca2b23d0ba	1622	mbedtls_ecp_point RP;
marcozecchini	0:9fca2b23d0ba	1623	mbedtls_mpi PX;
marcozecchini	0:9fca2b23d0ba	1624
marcozecchini	0:9fca2b23d0ba	1625	mbedtls_ecp_point_init( &RP ); mbedtls_mpi_init( &PX );
marcozecchini	0:9fca2b23d0ba	1626
marcozecchini	0:9fca2b23d0ba	1627	/* Save PX and read from P before writing to R, in case P == R */
marcozecchini	0:9fca2b23d0ba	1628	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &PX, &P->X ) );
marcozecchini	0:9fca2b23d0ba	1629	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &RP, P ) );
marcozecchini	0:9fca2b23d0ba	1630
marcozecchini	0:9fca2b23d0ba	1631	/* Set R to zero in modified x/z coordinates */
marcozecchini	0:9fca2b23d0ba	1632	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->X, 1 ) );
marcozecchini	0:9fca2b23d0ba	1633	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->Z, 0 ) );
marcozecchini	0:9fca2b23d0ba	1634	mbedtls_mpi_free( &R->Y );
marcozecchini	0:9fca2b23d0ba	1635
marcozecchini	0:9fca2b23d0ba	1636	/* RP.X might be sligtly larger than P, so reduce it */
marcozecchini	0:9fca2b23d0ba	1637	MOD_ADD( RP.X );
marcozecchini	0:9fca2b23d0ba	1638
marcozecchini	0:9fca2b23d0ba	1639	/* Randomize coordinates of the starting point */
marcozecchini	0:9fca2b23d0ba	1640	if( f_rng != NULL )
marcozecchini	0:9fca2b23d0ba	1641	MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, &RP, f_rng, p_rng ) );
marcozecchini	0:9fca2b23d0ba	1642
marcozecchini	0:9fca2b23d0ba	1643	/* Loop invariant: R = result so far, RP = R + P */
marcozecchini	0:9fca2b23d0ba	1644	i = mbedtls_mpi_bitlen( m ); /* one past the (zero-based) most significant bit */
marcozecchini	0:9fca2b23d0ba	1645	while( i-- > 0 )
marcozecchini	0:9fca2b23d0ba	1646	{
marcozecchini	0:9fca2b23d0ba	1647	b = mbedtls_mpi_get_bit( m, i );
marcozecchini	0:9fca2b23d0ba	1648	/*
marcozecchini	0:9fca2b23d0ba	1649	* if (b) R = 2R + P else R = 2R,
marcozecchini	0:9fca2b23d0ba	1650	* which is:
marcozecchini	0:9fca2b23d0ba	1651	* if (b) double_add( RP, R, RP, R )
marcozecchini	0:9fca2b23d0ba	1652	* else double_add( R, RP, R, RP )
marcozecchini	0:9fca2b23d0ba	1653	* but using safe conditional swaps to avoid leaks
marcozecchini	0:9fca2b23d0ba	1654	*/
marcozecchini	0:9fca2b23d0ba	1655	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->X, &RP.X, b ) );
marcozecchini	0:9fca2b23d0ba	1656	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->Z, &RP.Z, b ) );
marcozecchini	0:9fca2b23d0ba	1657	MBEDTLS_MPI_CHK( ecp_double_add_mxz( grp, R, &RP, R, &RP, &PX ) );
marcozecchini	0:9fca2b23d0ba	1658	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->X, &RP.X, b ) );
marcozecchini	0:9fca2b23d0ba	1659	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->Z, &RP.Z, b ) );
marcozecchini	0:9fca2b23d0ba	1660	}
marcozecchini	0:9fca2b23d0ba	1661
marcozecchini	0:9fca2b23d0ba	1662	MBEDTLS_MPI_CHK( ecp_normalize_mxz( grp, R ) );
marcozecchini	0:9fca2b23d0ba	1663
marcozecchini	0:9fca2b23d0ba	1664	cleanup:
marcozecchini	0:9fca2b23d0ba	1665	mbedtls_ecp_point_free( &RP ); mbedtls_mpi_free( &PX );
marcozecchini	0:9fca2b23d0ba	1666
marcozecchini	0:9fca2b23d0ba	1667	return( ret );
marcozecchini	0:9fca2b23d0ba	1668	}
marcozecchini	0:9fca2b23d0ba	1669
marcozecchini	0:9fca2b23d0ba	1670	#endif /* ECP_MONTGOMERY */
marcozecchini	0:9fca2b23d0ba	1671
marcozecchini	0:9fca2b23d0ba	1672	/*
marcozecchini	0:9fca2b23d0ba	1673	* Multiplication R = m * P
marcozecchini	0:9fca2b23d0ba	1674	*/
marcozecchini	0:9fca2b23d0ba	1675	int mbedtls_ecp_mul( mbedtls_ecp_group grp, mbedtls_ecp_point R,
marcozecchini	0:9fca2b23d0ba	1676	const mbedtls_mpi m, const mbedtls_ecp_point P,
marcozecchini	0:9fca2b23d0ba	1677	int (f_rng)(void , unsigned char , size_t), void p_rng )
marcozecchini	0:9fca2b23d0ba	1678	{
marcozecchini	0:9fca2b23d0ba	1679	int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
marcozecchini	0:9fca2b23d0ba	1680	#if defined(MBEDTLS_ECP_INTERNAL_ALT)
marcozecchini	0:9fca2b23d0ba	1681	char is_grp_capable = 0;
marcozecchini	0:9fca2b23d0ba	1682	#endif
marcozecchini	0:9fca2b23d0ba	1683
marcozecchini	0:9fca2b23d0ba	1684	/* Common sanity checks */
marcozecchini	0:9fca2b23d0ba	1685	if( mbedtls_mpi_cmp_int( &P->Z, 1 ) != 0 )
marcozecchini	0:9fca2b23d0ba	1686	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	1687
marcozecchini	0:9fca2b23d0ba	1688	if( ( ret = mbedtls_ecp_check_privkey( grp, m ) ) != 0 \|\|
marcozecchini	0:9fca2b23d0ba	1689	( ret = mbedtls_ecp_check_pubkey( grp, P ) ) != 0 )
marcozecchini	0:9fca2b23d0ba	1690	return( ret );
marcozecchini	0:9fca2b23d0ba	1691
marcozecchini	0:9fca2b23d0ba	1692	#if defined(MBEDTLS_ECP_INTERNAL_ALT)
marcozecchini	0:9fca2b23d0ba	1693	if ( is_grp_capable = mbedtls_internal_ecp_grp_capable( grp ) )
marcozecchini	0:9fca2b23d0ba	1694	{
marcozecchini	0:9fca2b23d0ba	1695	MBEDTLS_MPI_CHK( mbedtls_internal_ecp_init( grp ) );
marcozecchini	0:9fca2b23d0ba	1696	}
marcozecchini	0:9fca2b23d0ba	1697
marcozecchini	0:9fca2b23d0ba	1698	#endif /* MBEDTLS_ECP_INTERNAL_ALT */
marcozecchini	0:9fca2b23d0ba	1699	#if defined(ECP_MONTGOMERY)
marcozecchini	0:9fca2b23d0ba	1700	if( ecp_get_type( grp ) == ECP_TYPE_MONTGOMERY )
marcozecchini	0:9fca2b23d0ba	1701	ret = ecp_mul_mxz( grp, R, m, P, f_rng, p_rng );
marcozecchini	0:9fca2b23d0ba	1702
marcozecchini	0:9fca2b23d0ba	1703	#endif
marcozecchini	0:9fca2b23d0ba	1704	#if defined(ECP_SHORTWEIERSTRASS)
marcozecchini	0:9fca2b23d0ba	1705	if( ecp_get_type( grp ) == ECP_TYPE_SHORT_WEIERSTRASS )
marcozecchini	0:9fca2b23d0ba	1706	ret = ecp_mul_comb( grp, R, m, P, f_rng, p_rng );
marcozecchini	0:9fca2b23d0ba	1707
marcozecchini	0:9fca2b23d0ba	1708	#endif
marcozecchini	0:9fca2b23d0ba	1709	#if defined(MBEDTLS_ECP_INTERNAL_ALT)
marcozecchini	0:9fca2b23d0ba	1710	cleanup:
marcozecchini	0:9fca2b23d0ba	1711
marcozecchini	0:9fca2b23d0ba	1712	if ( is_grp_capable )
marcozecchini	0:9fca2b23d0ba	1713	{
marcozecchini	0:9fca2b23d0ba	1714	mbedtls_internal_ecp_free( grp );
marcozecchini	0:9fca2b23d0ba	1715	}
marcozecchini	0:9fca2b23d0ba	1716
marcozecchini	0:9fca2b23d0ba	1717	#endif /* MBEDTLS_ECP_INTERNAL_ALT */
marcozecchini	0:9fca2b23d0ba	1718	return( ret );
marcozecchini	0:9fca2b23d0ba	1719	}
marcozecchini	0:9fca2b23d0ba	1720
marcozecchini	0:9fca2b23d0ba	1721	#if defined(ECP_SHORTWEIERSTRASS)
marcozecchini	0:9fca2b23d0ba	1722	/*
marcozecchini	0:9fca2b23d0ba	1723	* Check that an affine point is valid as a public key,
marcozecchini	0:9fca2b23d0ba	1724	* short weierstrass curves (SEC1 3.2.3.1)
marcozecchini	0:9fca2b23d0ba	1725	*/
marcozecchini	0:9fca2b23d0ba	1726	static int ecp_check_pubkey_sw( const mbedtls_ecp_group grp, const mbedtls_ecp_point pt )
marcozecchini	0:9fca2b23d0ba	1727	{
marcozecchini	0:9fca2b23d0ba	1728	int ret;
marcozecchini	0:9fca2b23d0ba	1729	mbedtls_mpi YY, RHS;
marcozecchini	0:9fca2b23d0ba	1730
marcozecchini	0:9fca2b23d0ba	1731	/* pt coordinates must be normalized for our checks */
marcozecchini	0:9fca2b23d0ba	1732	if( mbedtls_mpi_cmp_int( &pt->X, 0 ) < 0 \|\|
marcozecchini	0:9fca2b23d0ba	1733	mbedtls_mpi_cmp_int( &pt->Y, 0 ) < 0 \|\|
marcozecchini	0:9fca2b23d0ba	1734	mbedtls_mpi_cmp_mpi( &pt->X, &grp->P ) >= 0 \|\|
marcozecchini	0:9fca2b23d0ba	1735	mbedtls_mpi_cmp_mpi( &pt->Y, &grp->P ) >= 0 )
marcozecchini	0:9fca2b23d0ba	1736	return( MBEDTLS_ERR_ECP_INVALID_KEY );
marcozecchini	0:9fca2b23d0ba	1737
marcozecchini	0:9fca2b23d0ba	1738	mbedtls_mpi_init( &YY ); mbedtls_mpi_init( &RHS );
marcozecchini	0:9fca2b23d0ba	1739
marcozecchini	0:9fca2b23d0ba	1740	/*
marcozecchini	0:9fca2b23d0ba	1741	* YY = Y^2
marcozecchini	0:9fca2b23d0ba	1742	* RHS = X (X^2 + A) + B = X^3 + A X + B
marcozecchini	0:9fca2b23d0ba	1743	*/
marcozecchini	0:9fca2b23d0ba	1744	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &YY, &pt->Y, &pt->Y ) ); MOD_MUL( YY );
marcozecchini	0:9fca2b23d0ba	1745	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &RHS, &pt->X, &pt->X ) ); MOD_MUL( RHS );
marcozecchini	0:9fca2b23d0ba	1746
marcozecchini	0:9fca2b23d0ba	1747	/* Special case for A = -3 */
marcozecchini	0:9fca2b23d0ba	1748	if( grp->A.p == NULL )
marcozecchini	0:9fca2b23d0ba	1749	{
marcozecchini	0:9fca2b23d0ba	1750	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &RHS, &RHS, 3 ) ); MOD_SUB( RHS );
marcozecchini	0:9fca2b23d0ba	1751	}
marcozecchini	0:9fca2b23d0ba	1752	else
marcozecchini	0:9fca2b23d0ba	1753	{
marcozecchini	0:9fca2b23d0ba	1754	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &RHS, &RHS, &grp->A ) ); MOD_ADD( RHS );
marcozecchini	0:9fca2b23d0ba	1755	}
marcozecchini	0:9fca2b23d0ba	1756
marcozecchini	0:9fca2b23d0ba	1757	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &RHS, &RHS, &pt->X ) ); MOD_MUL( RHS );
marcozecchini	0:9fca2b23d0ba	1758	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &RHS, &RHS, &grp->B ) ); MOD_ADD( RHS );
marcozecchini	0:9fca2b23d0ba	1759
marcozecchini	0:9fca2b23d0ba	1760	if( mbedtls_mpi_cmp_mpi( &YY, &RHS ) != 0 )
marcozecchini	0:9fca2b23d0ba	1761	ret = MBEDTLS_ERR_ECP_INVALID_KEY;
marcozecchini	0:9fca2b23d0ba	1762
marcozecchini	0:9fca2b23d0ba	1763	cleanup:
marcozecchini	0:9fca2b23d0ba	1764
marcozecchini	0:9fca2b23d0ba	1765	mbedtls_mpi_free( &YY ); mbedtls_mpi_free( &RHS );
marcozecchini	0:9fca2b23d0ba	1766
marcozecchini	0:9fca2b23d0ba	1767	return( ret );
marcozecchini	0:9fca2b23d0ba	1768	}
marcozecchini	0:9fca2b23d0ba	1769	#endif /* ECP_SHORTWEIERSTRASS */
marcozecchini	0:9fca2b23d0ba	1770
marcozecchini	0:9fca2b23d0ba	1771	/*
marcozecchini	0:9fca2b23d0ba	1772	* R = m * P with shortcuts for m == 1 and m == -1
marcozecchini	0:9fca2b23d0ba	1773	* NOT constant-time - ONLY for short Weierstrass!
marcozecchini	0:9fca2b23d0ba	1774	*/
marcozecchini	0:9fca2b23d0ba	1775	static int mbedtls_ecp_mul_shortcuts( mbedtls_ecp_group *grp,
marcozecchini	0:9fca2b23d0ba	1776	mbedtls_ecp_point *R,
marcozecchini	0:9fca2b23d0ba	1777	const mbedtls_mpi *m,
marcozecchini	0:9fca2b23d0ba	1778	const mbedtls_ecp_point *P )
marcozecchini	0:9fca2b23d0ba	1779	{
marcozecchini	0:9fca2b23d0ba	1780	int ret;
marcozecchini	0:9fca2b23d0ba	1781
marcozecchini	0:9fca2b23d0ba	1782	if( mbedtls_mpi_cmp_int( m, 1 ) == 0 )
marcozecchini	0:9fca2b23d0ba	1783	{
marcozecchini	0:9fca2b23d0ba	1784	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, P ) );
marcozecchini	0:9fca2b23d0ba	1785	}
marcozecchini	0:9fca2b23d0ba	1786	else if( mbedtls_mpi_cmp_int( m, -1 ) == 0 )
marcozecchini	0:9fca2b23d0ba	1787	{
marcozecchini	0:9fca2b23d0ba	1788	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, P ) );
marcozecchini	0:9fca2b23d0ba	1789	if( mbedtls_mpi_cmp_int( &R->Y, 0 ) != 0 )
marcozecchini	0:9fca2b23d0ba	1790	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &R->Y, &grp->P, &R->Y ) );
marcozecchini	0:9fca2b23d0ba	1791	}
marcozecchini	0:9fca2b23d0ba	1792	else
marcozecchini	0:9fca2b23d0ba	1793	{
marcozecchini	0:9fca2b23d0ba	1794	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, R, m, P, NULL, NULL ) );
marcozecchini	0:9fca2b23d0ba	1795	}
marcozecchini	0:9fca2b23d0ba	1796
marcozecchini	0:9fca2b23d0ba	1797	cleanup:
marcozecchini	0:9fca2b23d0ba	1798	return( ret );
marcozecchini	0:9fca2b23d0ba	1799	}
marcozecchini	0:9fca2b23d0ba	1800
marcozecchini	0:9fca2b23d0ba	1801	/*
marcozecchini	0:9fca2b23d0ba	1802	* Linear combination
marcozecchini	0:9fca2b23d0ba	1803	* NOT constant-time
marcozecchini	0:9fca2b23d0ba	1804	*/
marcozecchini	0:9fca2b23d0ba	1805	int mbedtls_ecp_muladd( mbedtls_ecp_group grp, mbedtls_ecp_point R,
marcozecchini	0:9fca2b23d0ba	1806	const mbedtls_mpi m, const mbedtls_ecp_point P,
marcozecchini	0:9fca2b23d0ba	1807	const mbedtls_mpi n, const mbedtls_ecp_point Q )
marcozecchini	0:9fca2b23d0ba	1808	{
marcozecchini	0:9fca2b23d0ba	1809	int ret;
marcozecchini	0:9fca2b23d0ba	1810	mbedtls_ecp_point mP;
marcozecchini	0:9fca2b23d0ba	1811	#if defined(MBEDTLS_ECP_INTERNAL_ALT)
marcozecchini	0:9fca2b23d0ba	1812	char is_grp_capable = 0;
marcozecchini	0:9fca2b23d0ba	1813	#endif
marcozecchini	0:9fca2b23d0ba	1814
marcozecchini	0:9fca2b23d0ba	1815	if( ecp_get_type( grp ) != ECP_TYPE_SHORT_WEIERSTRASS )
marcozecchini	0:9fca2b23d0ba	1816	return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
marcozecchini	0:9fca2b23d0ba	1817
marcozecchini	0:9fca2b23d0ba	1818	mbedtls_ecp_point_init( &mP );
marcozecchini	0:9fca2b23d0ba	1819
marcozecchini	0:9fca2b23d0ba	1820	MBEDTLS_MPI_CHK( mbedtls_ecp_mul_shortcuts( grp, &mP, m, P ) );
marcozecchini	0:9fca2b23d0ba	1821	MBEDTLS_MPI_CHK( mbedtls_ecp_mul_shortcuts( grp, R, n, Q ) );
marcozecchini	0:9fca2b23d0ba	1822
marcozecchini	0:9fca2b23d0ba	1823	#if defined(MBEDTLS_ECP_INTERNAL_ALT)
marcozecchini	0:9fca2b23d0ba	1824	if ( is_grp_capable = mbedtls_internal_ecp_grp_capable( grp ) )
marcozecchini	0:9fca2b23d0ba	1825	{
marcozecchini	0:9fca2b23d0ba	1826	MBEDTLS_MPI_CHK( mbedtls_internal_ecp_init( grp ) );
marcozecchini	0:9fca2b23d0ba	1827	}
marcozecchini	0:9fca2b23d0ba	1828
marcozecchini	0:9fca2b23d0ba	1829	#endif /* MBEDTLS_ECP_INTERNAL_ALT */
marcozecchini	0:9fca2b23d0ba	1830	MBEDTLS_MPI_CHK( ecp_add_mixed( grp, R, &mP, R ) );
marcozecchini	0:9fca2b23d0ba	1831	MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, R ) );
marcozecchini	0:9fca2b23d0ba	1832
marcozecchini	0:9fca2b23d0ba	1833	cleanup:
marcozecchini	0:9fca2b23d0ba	1834
marcozecchini	0:9fca2b23d0ba	1835	#if defined(MBEDTLS_ECP_INTERNAL_ALT)
marcozecchini	0:9fca2b23d0ba	1836	if ( is_grp_capable )
marcozecchini	0:9fca2b23d0ba	1837	{
marcozecchini	0:9fca2b23d0ba	1838	mbedtls_internal_ecp_free( grp );
marcozecchini	0:9fca2b23d0ba	1839	}
marcozecchini	0:9fca2b23d0ba	1840
marcozecchini	0:9fca2b23d0ba	1841	#endif /* MBEDTLS_ECP_INTERNAL_ALT */
marcozecchini	0:9fca2b23d0ba	1842	mbedtls_ecp_point_free( &mP );
marcozecchini	0:9fca2b23d0ba	1843
marcozecchini	0:9fca2b23d0ba	1844	return( ret );
marcozecchini	0:9fca2b23d0ba	1845	}
marcozecchini	0:9fca2b23d0ba	1846
marcozecchini	0:9fca2b23d0ba	1847
marcozecchini	0:9fca2b23d0ba	1848	#if defined(ECP_MONTGOMERY)
marcozecchini	0:9fca2b23d0ba	1849	/*
marcozecchini	0:9fca2b23d0ba	1850	* Check validity of a public key for Montgomery curves with x-only schemes
marcozecchini	0:9fca2b23d0ba	1851	*/
marcozecchini	0:9fca2b23d0ba	1852	static int ecp_check_pubkey_mx( const mbedtls_ecp_group grp, const mbedtls_ecp_point pt )
marcozecchini	0:9fca2b23d0ba	1853	{
marcozecchini	0:9fca2b23d0ba	1854	/* [Curve25519 p. 5] Just check X is the correct number of bytes */
marcozecchini	0:9fca2b23d0ba	1855	if( mbedtls_mpi_size( &pt->X ) > ( grp->nbits + 7 ) / 8 )
marcozecchini	0:9fca2b23d0ba	1856	return( MBEDTLS_ERR_ECP_INVALID_KEY );
marcozecchini	0:9fca2b23d0ba	1857
marcozecchini	0:9fca2b23d0ba	1858	return( 0 );
marcozecchini	0:9fca2b23d0ba	1859	}
marcozecchini	0:9fca2b23d0ba	1860	#endif /* ECP_MONTGOMERY */
marcozecchini	0:9fca2b23d0ba	1861
marcozecchini	0:9fca2b23d0ba	1862	/*
marcozecchini	0:9fca2b23d0ba	1863	* Check that a point is valid as a public key
marcozecchini	0:9fca2b23d0ba	1864	*/
marcozecchini	0:9fca2b23d0ba	1865	int mbedtls_ecp_check_pubkey( const mbedtls_ecp_group grp, const mbedtls_ecp_point pt )
marcozecchini	0:9fca2b23d0ba	1866	{
marcozecchini	0:9fca2b23d0ba	1867	/* Must use affine coordinates */
marcozecchini	0:9fca2b23d0ba	1868	if( mbedtls_mpi_cmp_int( &pt->Z, 1 ) != 0 )
marcozecchini	0:9fca2b23d0ba	1869	return( MBEDTLS_ERR_ECP_INVALID_KEY );
marcozecchini	0:9fca2b23d0ba	1870
marcozecchini	0:9fca2b23d0ba	1871	#if defined(ECP_MONTGOMERY)
marcozecchini	0:9fca2b23d0ba	1872	if( ecp_get_type( grp ) == ECP_TYPE_MONTGOMERY )
marcozecchini	0:9fca2b23d0ba	1873	return( ecp_check_pubkey_mx( grp, pt ) );
marcozecchini	0:9fca2b23d0ba	1874	#endif
marcozecchini	0:9fca2b23d0ba	1875	#if defined(ECP_SHORTWEIERSTRASS)
marcozecchini	0:9fca2b23d0ba	1876	if( ecp_get_type( grp ) == ECP_TYPE_SHORT_WEIERSTRASS )
marcozecchini	0:9fca2b23d0ba	1877	return( ecp_check_pubkey_sw( grp, pt ) );
marcozecchini	0:9fca2b23d0ba	1878	#endif
marcozecchini	0:9fca2b23d0ba	1879	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	1880	}
marcozecchini	0:9fca2b23d0ba	1881
marcozecchini	0:9fca2b23d0ba	1882	/*
marcozecchini	0:9fca2b23d0ba	1883	* Check that an mbedtls_mpi is valid as a private key
marcozecchini	0:9fca2b23d0ba	1884	*/
marcozecchini	0:9fca2b23d0ba	1885	int mbedtls_ecp_check_privkey( const mbedtls_ecp_group grp, const mbedtls_mpi d )
marcozecchini	0:9fca2b23d0ba	1886	{
marcozecchini	0:9fca2b23d0ba	1887	#if defined(ECP_MONTGOMERY)
marcozecchini	0:9fca2b23d0ba	1888	if( ecp_get_type( grp ) == ECP_TYPE_MONTGOMERY )
marcozecchini	0:9fca2b23d0ba	1889	{
marcozecchini	0:9fca2b23d0ba	1890	/* see [Curve25519] page 5 */
marcozecchini	0:9fca2b23d0ba	1891	if( mbedtls_mpi_get_bit( d, 0 ) != 0 \|\|
marcozecchini	0:9fca2b23d0ba	1892	mbedtls_mpi_get_bit( d, 1 ) != 0 \|\|
marcozecchini	0:9fca2b23d0ba	1893	mbedtls_mpi_get_bit( d, 2 ) != 0 \|\|
marcozecchini	0:9fca2b23d0ba	1894	mbedtls_mpi_bitlen( d ) - 1 != grp->nbits ) /* mbedtls_mpi_bitlen is one-based! */
marcozecchini	0:9fca2b23d0ba	1895	return( MBEDTLS_ERR_ECP_INVALID_KEY );
marcozecchini	0:9fca2b23d0ba	1896	else
marcozecchini	0:9fca2b23d0ba	1897	return( 0 );
marcozecchini	0:9fca2b23d0ba	1898	}
marcozecchini	0:9fca2b23d0ba	1899	#endif /* ECP_MONTGOMERY */
marcozecchini	0:9fca2b23d0ba	1900	#if defined(ECP_SHORTWEIERSTRASS)
marcozecchini	0:9fca2b23d0ba	1901	if( ecp_get_type( grp ) == ECP_TYPE_SHORT_WEIERSTRASS )
marcozecchini	0:9fca2b23d0ba	1902	{
marcozecchini	0:9fca2b23d0ba	1903	/* see SEC1 3.2 */
marcozecchini	0:9fca2b23d0ba	1904	if( mbedtls_mpi_cmp_int( d, 1 ) < 0 \|\|
marcozecchini	0:9fca2b23d0ba	1905	mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 )
marcozecchini	0:9fca2b23d0ba	1906	return( MBEDTLS_ERR_ECP_INVALID_KEY );
marcozecchini	0:9fca2b23d0ba	1907	else
marcozecchini	0:9fca2b23d0ba	1908	return( 0 );
marcozecchini	0:9fca2b23d0ba	1909	}
marcozecchini	0:9fca2b23d0ba	1910	#endif /* ECP_SHORTWEIERSTRASS */
marcozecchini	0:9fca2b23d0ba	1911
marcozecchini	0:9fca2b23d0ba	1912	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	1913	}
marcozecchini	0:9fca2b23d0ba	1914
marcozecchini	0:9fca2b23d0ba	1915	/*
marcozecchini	0:9fca2b23d0ba	1916	* Generate a keypair with configurable base point
marcozecchini	0:9fca2b23d0ba	1917	*/
marcozecchini	0:9fca2b23d0ba	1918	int mbedtls_ecp_gen_keypair_base( mbedtls_ecp_group *grp,
marcozecchini	0:9fca2b23d0ba	1919	const mbedtls_ecp_point *G,
marcozecchini	0:9fca2b23d0ba	1920	mbedtls_mpi d, mbedtls_ecp_point Q,
marcozecchini	0:9fca2b23d0ba	1921	int (f_rng)(void , unsigned char *, size_t),
marcozecchini	0:9fca2b23d0ba	1922	void *p_rng )
marcozecchini	0:9fca2b23d0ba	1923	{
marcozecchini	0:9fca2b23d0ba	1924	int ret;
marcozecchini	0:9fca2b23d0ba	1925	size_t n_size = ( grp->nbits + 7 ) / 8;
marcozecchini	0:9fca2b23d0ba	1926
marcozecchini	0:9fca2b23d0ba	1927	#if defined(ECP_MONTGOMERY)
marcozecchini	0:9fca2b23d0ba	1928	if( ecp_get_type( grp ) == ECP_TYPE_MONTGOMERY )
marcozecchini	0:9fca2b23d0ba	1929	{
marcozecchini	0:9fca2b23d0ba	1930	/* [M225] page 5 */
marcozecchini	0:9fca2b23d0ba	1931	size_t b;
marcozecchini	0:9fca2b23d0ba	1932
marcozecchini	0:9fca2b23d0ba	1933	do {
marcozecchini	0:9fca2b23d0ba	1934	MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( d, n_size, f_rng, p_rng ) );
marcozecchini	0:9fca2b23d0ba	1935	} while( mbedtls_mpi_bitlen( d ) == 0);
marcozecchini	0:9fca2b23d0ba	1936
marcozecchini	0:9fca2b23d0ba	1937	/* Make sure the most significant bit is nbits */
marcozecchini	0:9fca2b23d0ba	1938	b = mbedtls_mpi_bitlen( d ) - 1; /* mbedtls_mpi_bitlen is one-based */
marcozecchini	0:9fca2b23d0ba	1939	if( b > grp->nbits )
marcozecchini	0:9fca2b23d0ba	1940	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( d, b - grp->nbits ) );
marcozecchini	0:9fca2b23d0ba	1941	else
marcozecchini	0:9fca2b23d0ba	1942	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, grp->nbits, 1 ) );
marcozecchini	0:9fca2b23d0ba	1943
marcozecchini	0:9fca2b23d0ba	1944	/* Make sure the last three bits are unset */
marcozecchini	0:9fca2b23d0ba	1945	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 0, 0 ) );
marcozecchini	0:9fca2b23d0ba	1946	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 1, 0 ) );
marcozecchini	0:9fca2b23d0ba	1947	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 2, 0 ) );
marcozecchini	0:9fca2b23d0ba	1948	}
marcozecchini	0:9fca2b23d0ba	1949	else
marcozecchini	0:9fca2b23d0ba	1950	#endif /* ECP_MONTGOMERY */
marcozecchini	0:9fca2b23d0ba	1951	#if defined(ECP_SHORTWEIERSTRASS)
marcozecchini	0:9fca2b23d0ba	1952	if( ecp_get_type( grp ) == ECP_TYPE_SHORT_WEIERSTRASS )
marcozecchini	0:9fca2b23d0ba	1953	{
marcozecchini	0:9fca2b23d0ba	1954	/* SEC1 3.2.1: Generate d such that 1 <= n < N */
marcozecchini	0:9fca2b23d0ba	1955	int count = 0;
marcozecchini	0:9fca2b23d0ba	1956	unsigned char rnd[MBEDTLS_ECP_MAX_BYTES];
marcozecchini	0:9fca2b23d0ba	1957
marcozecchini	0:9fca2b23d0ba	1958	/*
marcozecchini	0:9fca2b23d0ba	1959	* Match the procedure given in RFC 6979 (deterministic ECDSA):
marcozecchini	0:9fca2b23d0ba	1960	* - use the same byte ordering;
marcozecchini	0:9fca2b23d0ba	1961	* - keep the leftmost nbits bits of the generated octet string;
marcozecchini	0:9fca2b23d0ba	1962	* - try until result is in the desired range.
marcozecchini	0:9fca2b23d0ba	1963	* This also avoids any biais, which is especially important for ECDSA.
marcozecchini	0:9fca2b23d0ba	1964	*/
marcozecchini	0:9fca2b23d0ba	1965	do
marcozecchini	0:9fca2b23d0ba	1966	{
marcozecchini	0:9fca2b23d0ba	1967	MBEDTLS_MPI_CHK( f_rng( p_rng, rnd, n_size ) );
marcozecchini	0:9fca2b23d0ba	1968	MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( d, rnd, n_size ) );
marcozecchini	0:9fca2b23d0ba	1969	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( d, 8 * n_size - grp->nbits ) );
marcozecchini	0:9fca2b23d0ba	1970
marcozecchini	0:9fca2b23d0ba	1971	/*
marcozecchini	0:9fca2b23d0ba	1972	* Each try has at worst a probability 1/2 of failing (the msb has
marcozecchini	0:9fca2b23d0ba	1973	* a probability 1/2 of being 0, and then the result will be < N),
marcozecchini	0:9fca2b23d0ba	1974	* so after 30 tries failure probability is a most 2**(-30).
marcozecchini	0:9fca2b23d0ba	1975	*
marcozecchini	0:9fca2b23d0ba	1976	* For most curves, 1 try is enough with overwhelming probability,
marcozecchini	0:9fca2b23d0ba	1977	* since N starts with a lot of 1s in binary, but some curves
marcozecchini	0:9fca2b23d0ba	1978	* such as secp224k1 are actually very close to the worst case.
marcozecchini	0:9fca2b23d0ba	1979	*/
marcozecchini	0:9fca2b23d0ba	1980	if( ++count > 30 )
marcozecchini	0:9fca2b23d0ba	1981	return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
marcozecchini	0:9fca2b23d0ba	1982	}
marcozecchini	0:9fca2b23d0ba	1983	while( mbedtls_mpi_cmp_int( d, 1 ) < 0 \|\|
marcozecchini	0:9fca2b23d0ba	1984	mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 );
marcozecchini	0:9fca2b23d0ba	1985	}
marcozecchini	0:9fca2b23d0ba	1986	else
marcozecchini	0:9fca2b23d0ba	1987	#endif /* ECP_SHORTWEIERSTRASS */
marcozecchini	0:9fca2b23d0ba	1988	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	1989
marcozecchini	0:9fca2b23d0ba	1990	cleanup:
marcozecchini	0:9fca2b23d0ba	1991	if( ret != 0 )
marcozecchini	0:9fca2b23d0ba	1992	return( ret );
marcozecchini	0:9fca2b23d0ba	1993
marcozecchini	0:9fca2b23d0ba	1994	return( mbedtls_ecp_mul( grp, Q, d, G, f_rng, p_rng ) );
marcozecchini	0:9fca2b23d0ba	1995	}
marcozecchini	0:9fca2b23d0ba	1996
marcozecchini	0:9fca2b23d0ba	1997	/*
marcozecchini	0:9fca2b23d0ba	1998	* Generate key pair, wrapper for conventional base point
marcozecchini	0:9fca2b23d0ba	1999	*/
marcozecchini	0:9fca2b23d0ba	2000	int mbedtls_ecp_gen_keypair( mbedtls_ecp_group *grp,
marcozecchini	0:9fca2b23d0ba	2001	mbedtls_mpi d, mbedtls_ecp_point Q,
marcozecchini	0:9fca2b23d0ba	2002	int (f_rng)(void , unsigned char *, size_t),
marcozecchini	0:9fca2b23d0ba	2003	void *p_rng )
marcozecchini	0:9fca2b23d0ba	2004	{
marcozecchini	0:9fca2b23d0ba	2005	return( mbedtls_ecp_gen_keypair_base( grp, &grp->G, d, Q, f_rng, p_rng ) );
marcozecchini	0:9fca2b23d0ba	2006	}
marcozecchini	0:9fca2b23d0ba	2007
marcozecchini	0:9fca2b23d0ba	2008	/*
marcozecchini	0:9fca2b23d0ba	2009	* Generate a keypair, prettier wrapper
marcozecchini	0:9fca2b23d0ba	2010	*/
marcozecchini	0:9fca2b23d0ba	2011	int mbedtls_ecp_gen_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
marcozecchini	0:9fca2b23d0ba	2012	int (f_rng)(void , unsigned char , size_t), void p_rng )
marcozecchini	0:9fca2b23d0ba	2013	{
marcozecchini	0:9fca2b23d0ba	2014	int ret;
marcozecchini	0:9fca2b23d0ba	2015
marcozecchini	0:9fca2b23d0ba	2016	if( ( ret = mbedtls_ecp_group_load( &key->grp, grp_id ) ) != 0 )
marcozecchini	0:9fca2b23d0ba	2017	return( ret );
marcozecchini	0:9fca2b23d0ba	2018
marcozecchini	0:9fca2b23d0ba	2019	return( mbedtls_ecp_gen_keypair( &key->grp, &key->d, &key->Q, f_rng, p_rng ) );
marcozecchini	0:9fca2b23d0ba	2020	}
marcozecchini	0:9fca2b23d0ba	2021
marcozecchini	0:9fca2b23d0ba	2022	/*
marcozecchini	0:9fca2b23d0ba	2023	* Check a public-private key pair
marcozecchini	0:9fca2b23d0ba	2024	*/
marcozecchini	0:9fca2b23d0ba	2025	int mbedtls_ecp_check_pub_priv( const mbedtls_ecp_keypair pub, const mbedtls_ecp_keypair prv )
marcozecchini	0:9fca2b23d0ba	2026	{
marcozecchini	0:9fca2b23d0ba	2027	int ret;
marcozecchini	0:9fca2b23d0ba	2028	mbedtls_ecp_point Q;
marcozecchini	0:9fca2b23d0ba	2029	mbedtls_ecp_group grp;
marcozecchini	0:9fca2b23d0ba	2030
marcozecchini	0:9fca2b23d0ba	2031	if( pub->grp.id == MBEDTLS_ECP_DP_NONE \|\|
marcozecchini	0:9fca2b23d0ba	2032	pub->grp.id != prv->grp.id \|\|
marcozecchini	0:9fca2b23d0ba	2033	mbedtls_mpi_cmp_mpi( &pub->Q.X, &prv->Q.X ) \|\|
marcozecchini	0:9fca2b23d0ba	2034	mbedtls_mpi_cmp_mpi( &pub->Q.Y, &prv->Q.Y ) \|\|
marcozecchini	0:9fca2b23d0ba	2035	mbedtls_mpi_cmp_mpi( &pub->Q.Z, &prv->Q.Z ) )
marcozecchini	0:9fca2b23d0ba	2036	{
marcozecchini	0:9fca2b23d0ba	2037	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
marcozecchini	0:9fca2b23d0ba	2038	}
marcozecchini	0:9fca2b23d0ba	2039
marcozecchini	0:9fca2b23d0ba	2040	mbedtls_ecp_point_init( &Q );
marcozecchini	0:9fca2b23d0ba	2041	mbedtls_ecp_group_init( &grp );
marcozecchini	0:9fca2b23d0ba	2042
marcozecchini	0:9fca2b23d0ba	2043	/* mbedtls_ecp_mul() needs a non-const group... */
marcozecchini	0:9fca2b23d0ba	2044	mbedtls_ecp_group_copy( &grp, &prv->grp );
marcozecchini	0:9fca2b23d0ba	2045
marcozecchini	0:9fca2b23d0ba	2046	/* Also checks d is valid */
marcozecchini	0:9fca2b23d0ba	2047	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &Q, &prv->d, &prv->grp.G, NULL, NULL ) );
marcozecchini	0:9fca2b23d0ba	2048
marcozecchini	0:9fca2b23d0ba	2049	if( mbedtls_mpi_cmp_mpi( &Q.X, &prv->Q.X ) \|\|
marcozecchini	0:9fca2b23d0ba	2050	mbedtls_mpi_cmp_mpi( &Q.Y, &prv->Q.Y ) \|\|
marcozecchini	0:9fca2b23d0ba	2051	mbedtls_mpi_cmp_mpi( &Q.Z, &prv->Q.Z ) )
marcozecchini	0:9fca2b23d0ba	2052	{
marcozecchini	0:9fca2b23d0ba	2053	ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
marcozecchini	0:9fca2b23d0ba	2054	goto cleanup;
marcozecchini	0:9fca2b23d0ba	2055	}
marcozecchini	0:9fca2b23d0ba	2056
marcozecchini	0:9fca2b23d0ba	2057	cleanup:
marcozecchini	0:9fca2b23d0ba	2058	mbedtls_ecp_point_free( &Q );
marcozecchini	0:9fca2b23d0ba	2059	mbedtls_ecp_group_free( &grp );
marcozecchini	0:9fca2b23d0ba	2060
marcozecchini	0:9fca2b23d0ba	2061	return( ret );
marcozecchini	0:9fca2b23d0ba	2062	}
marcozecchini	0:9fca2b23d0ba	2063
marcozecchini	0:9fca2b23d0ba	2064	#if defined(MBEDTLS_SELF_TEST)
marcozecchini	0:9fca2b23d0ba	2065
marcozecchini	0:9fca2b23d0ba	2066	/*
marcozecchini	0:9fca2b23d0ba	2067	* Checkup routine
marcozecchini	0:9fca2b23d0ba	2068	*/
marcozecchini	0:9fca2b23d0ba	2069	int mbedtls_ecp_self_test( int verbose )
marcozecchini	0:9fca2b23d0ba	2070	{
marcozecchini	0:9fca2b23d0ba	2071	int ret;
marcozecchini	0:9fca2b23d0ba	2072	size_t i;
marcozecchini	0:9fca2b23d0ba	2073	mbedtls_ecp_group grp;
marcozecchini	0:9fca2b23d0ba	2074	mbedtls_ecp_point R, P;
marcozecchini	0:9fca2b23d0ba	2075	mbedtls_mpi m;
marcozecchini	0:9fca2b23d0ba	2076	unsigned long add_c_prev, dbl_c_prev, mul_c_prev;
marcozecchini	0:9fca2b23d0ba	2077	/* exponents especially adapted for secp192r1 */
marcozecchini	0:9fca2b23d0ba	2078	const char *exponents[] =
marcozecchini	0:9fca2b23d0ba	2079	{
marcozecchini	0:9fca2b23d0ba	2080	"000000000000000000000000000000000000000000000001", /* one */
marcozecchini	0:9fca2b23d0ba	2081	"FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22830", /* N - 1 */
marcozecchini	0:9fca2b23d0ba	2082	"5EA6F389A38B8BC81E767753B15AA5569E1782E30ABE7D25", /* random */
marcozecchini	0:9fca2b23d0ba	2083	"400000000000000000000000000000000000000000000000", /* one and zeros */
marcozecchini	0:9fca2b23d0ba	2084	"7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", /* all ones */
marcozecchini	0:9fca2b23d0ba	2085	"555555555555555555555555555555555555555555555555", /* 101010... */
marcozecchini	0:9fca2b23d0ba	2086	};
marcozecchini	0:9fca2b23d0ba	2087
marcozecchini	0:9fca2b23d0ba	2088	mbedtls_ecp_group_init( &grp );
marcozecchini	0:9fca2b23d0ba	2089	mbedtls_ecp_point_init( &R );
marcozecchini	0:9fca2b23d0ba	2090	mbedtls_ecp_point_init( &P );
marcozecchini	0:9fca2b23d0ba	2091	mbedtls_mpi_init( &m );
marcozecchini	0:9fca2b23d0ba	2092
marcozecchini	0:9fca2b23d0ba	2093	/* Use secp192r1 if available, or any available curve */
marcozecchini	0:9fca2b23d0ba	2094	#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
marcozecchini	0:9fca2b23d0ba	2095	MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, MBEDTLS_ECP_DP_SECP192R1 ) );
marcozecchini	0:9fca2b23d0ba	2096	#else
marcozecchini	0:9fca2b23d0ba	2097	MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, mbedtls_ecp_curve_list()->grp_id ) );
marcozecchini	0:9fca2b23d0ba	2098	#endif
marcozecchini	0:9fca2b23d0ba	2099
marcozecchini	0:9fca2b23d0ba	2100	if( verbose != 0 )
marcozecchini	0:9fca2b23d0ba	2101	mbedtls_printf( " ECP test #1 (constant op_count, base point G): " );
marcozecchini	0:9fca2b23d0ba	2102
marcozecchini	0:9fca2b23d0ba	2103	/* Do a dummy multiplication first to trigger precomputation */
marcozecchini	0:9fca2b23d0ba	2104	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &m, 2 ) );
marcozecchini	0:9fca2b23d0ba	2105	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &P, &m, &grp.G, NULL, NULL ) );
marcozecchini	0:9fca2b23d0ba	2106
marcozecchini	0:9fca2b23d0ba	2107	add_count = 0;
marcozecchini	0:9fca2b23d0ba	2108	dbl_count = 0;
marcozecchini	0:9fca2b23d0ba	2109	mul_count = 0;
marcozecchini	0:9fca2b23d0ba	2110	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[0] ) );
marcozecchini	0:9fca2b23d0ba	2111	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &grp.G, NULL, NULL ) );
marcozecchini	0:9fca2b23d0ba	2112
marcozecchini	0:9fca2b23d0ba	2113	for( i = 1; i < sizeof( exponents ) / sizeof( exponents[0] ); i++ )
marcozecchini	0:9fca2b23d0ba	2114	{
marcozecchini	0:9fca2b23d0ba	2115	add_c_prev = add_count;
marcozecchini	0:9fca2b23d0ba	2116	dbl_c_prev = dbl_count;
marcozecchini	0:9fca2b23d0ba	2117	mul_c_prev = mul_count;
marcozecchini	0:9fca2b23d0ba	2118	add_count = 0;
marcozecchini	0:9fca2b23d0ba	2119	dbl_count = 0;
marcozecchini	0:9fca2b23d0ba	2120	mul_count = 0;
marcozecchini	0:9fca2b23d0ba	2121
marcozecchini	0:9fca2b23d0ba	2122	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[i] ) );
marcozecchini	0:9fca2b23d0ba	2123	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &grp.G, NULL, NULL ) );
marcozecchini	0:9fca2b23d0ba	2124
marcozecchini	0:9fca2b23d0ba	2125	if( add_count != add_c_prev \|\|
marcozecchini	0:9fca2b23d0ba	2126	dbl_count != dbl_c_prev \|\|
marcozecchini	0:9fca2b23d0ba	2127	mul_count != mul_c_prev )
marcozecchini	0:9fca2b23d0ba	2128	{
marcozecchini	0:9fca2b23d0ba	2129	if( verbose != 0 )
marcozecchini	0:9fca2b23d0ba	2130	mbedtls_printf( "failed (%u)\n", (unsigned int) i );
marcozecchini	0:9fca2b23d0ba	2131
marcozecchini	0:9fca2b23d0ba	2132	ret = 1;
marcozecchini	0:9fca2b23d0ba	2133	goto cleanup;
marcozecchini	0:9fca2b23d0ba	2134	}
marcozecchini	0:9fca2b23d0ba	2135	}
marcozecchini	0:9fca2b23d0ba	2136
marcozecchini	0:9fca2b23d0ba	2137	if( verbose != 0 )
marcozecchini	0:9fca2b23d0ba	2138	mbedtls_printf( "passed\n" );
marcozecchini	0:9fca2b23d0ba	2139
marcozecchini	0:9fca2b23d0ba	2140	if( verbose != 0 )
marcozecchini	0:9fca2b23d0ba	2141	mbedtls_printf( " ECP test #2 (constant op_count, other point): " );
marcozecchini	0:9fca2b23d0ba	2142	/* We computed P = 2G last time, use it */
marcozecchini	0:9fca2b23d0ba	2143
marcozecchini	0:9fca2b23d0ba	2144	add_count = 0;
marcozecchini	0:9fca2b23d0ba	2145	dbl_count = 0;
marcozecchini	0:9fca2b23d0ba	2146	mul_count = 0;
marcozecchini	0:9fca2b23d0ba	2147	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[0] ) );
marcozecchini	0:9fca2b23d0ba	2148	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &P, NULL, NULL ) );
marcozecchini	0:9fca2b23d0ba	2149
marcozecchini	0:9fca2b23d0ba	2150	for( i = 1; i < sizeof( exponents ) / sizeof( exponents[0] ); i++ )
marcozecchini	0:9fca2b23d0ba	2151	{
marcozecchini	0:9fca2b23d0ba	2152	add_c_prev = add_count;
marcozecchini	0:9fca2b23d0ba	2153	dbl_c_prev = dbl_count;
marcozecchini	0:9fca2b23d0ba	2154	mul_c_prev = mul_count;
marcozecchini	0:9fca2b23d0ba	2155	add_count = 0;
marcozecchini	0:9fca2b23d0ba	2156	dbl_count = 0;
marcozecchini	0:9fca2b23d0ba	2157	mul_count = 0;
marcozecchini	0:9fca2b23d0ba	2158
marcozecchini	0:9fca2b23d0ba	2159	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[i] ) );
marcozecchini	0:9fca2b23d0ba	2160	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &P, NULL, NULL ) );
marcozecchini	0:9fca2b23d0ba	2161
marcozecchini	0:9fca2b23d0ba	2162	if( add_count != add_c_prev \|\|
marcozecchini	0:9fca2b23d0ba	2163	dbl_count != dbl_c_prev \|\|
marcozecchini	0:9fca2b23d0ba	2164	mul_count != mul_c_prev )
marcozecchini	0:9fca2b23d0ba	2165	{
marcozecchini	0:9fca2b23d0ba	2166	if( verbose != 0 )
marcozecchini	0:9fca2b23d0ba	2167	mbedtls_printf( "failed (%u)\n", (unsigned int) i );
marcozecchini	0:9fca2b23d0ba	2168
marcozecchini	0:9fca2b23d0ba	2169	ret = 1;
marcozecchini	0:9fca2b23d0ba	2170	goto cleanup;
marcozecchini	0:9fca2b23d0ba	2171	}
marcozecchini	0:9fca2b23d0ba	2172	}
marcozecchini	0:9fca2b23d0ba	2173
marcozecchini	0:9fca2b23d0ba	2174	if( verbose != 0 )
marcozecchini	0:9fca2b23d0ba	2175	mbedtls_printf( "passed\n" );
marcozecchini	0:9fca2b23d0ba	2176
marcozecchini	0:9fca2b23d0ba	2177	cleanup:
marcozecchini	0:9fca2b23d0ba	2178
marcozecchini	0:9fca2b23d0ba	2179	if( ret < 0 && verbose != 0 )
marcozecchini	0:9fca2b23d0ba	2180	mbedtls_printf( "Unexpected error, return code = %08X\n", ret );
marcozecchini	0:9fca2b23d0ba	2181
marcozecchini	0:9fca2b23d0ba	2182	mbedtls_ecp_group_free( &grp );
marcozecchini	0:9fca2b23d0ba	2183	mbedtls_ecp_point_free( &R );
marcozecchini	0:9fca2b23d0ba	2184	mbedtls_ecp_point_free( &P );
marcozecchini	0:9fca2b23d0ba	2185	mbedtls_mpi_free( &m );
marcozecchini	0:9fca2b23d0ba	2186
marcozecchini	0:9fca2b23d0ba	2187	if( verbose != 0 )
marcozecchini	0:9fca2b23d0ba	2188	mbedtls_printf( "\n" );
marcozecchini	0:9fca2b23d0ba	2189
marcozecchini	0:9fca2b23d0ba	2190	return( ret );
marcozecchini	0:9fca2b23d0ba	2191	}
marcozecchini	0:9fca2b23d0ba	2192
marcozecchini	0:9fca2b23d0ba	2193	#endif /* MBEDTLS_SELF_TEST */
marcozecchini	0:9fca2b23d0ba	2194
marcozecchini	0:9fca2b23d0ba	2195	#endif /* !MBEDTLS_ECP_ALT */
marcozecchini	0:9fca2b23d0ba	2196
marcozecchini	0:9fca2b23d0ba	2197	#endif /* MBEDTLS_ECP_C */

Repository toolbox

Export to desktop IDE

Build repository

Repository details

Type:	Program
Mbed OS support:	Mbed OS
Created:	23 Feb 2019
Imports:	43
Forks:	0
Commits:	1
Dependents:	0
Dependencies:	0
Followers:	1

mbed-os/features/mbedtls/src/ecp.c@0:9fca2b23d0ba, 2019-02-23 (annotated)

Who changed what in which revision?

Repository toolbox

Repository details

Important Information for this Arm website

Access Warning