6_songs-from-the-cloud - This is a fork due to permission issues

Users » timbeight » Code » 6_songs-from-the-cloud

Timothy Beight / Mbed 2 deprecated 6_songs-from-the-cloud

This is a fork due to permission issues

Dependencies: mbed Socket lwip-eth lwip-sys lwip

Fork of 6_songs-from-the-cloud by MakingMusicWorkshop

mbed-client/mbedtls/source/ecp.c@1:0ddbe2d3319c, 2016-05-19 (annotated)

Committer:: timbeight
Date:: Thu May 19 16:02:10 2016 +0000
Revision:: 1:0ddbe2d3319c
Parent:: 0:f7c60d3e7b8a

This is my first commit while in the class.

Who changed what in which revision?

User	Revision	Line number	New contents of line
maclobdell	0:f7c60d3e7b8a	1	/*
maclobdell	0:f7c60d3e7b8a	2	* Elliptic curves over GF(p): generic functions
maclobdell	0:f7c60d3e7b8a	3	*
maclobdell	0:f7c60d3e7b8a	4	* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
maclobdell	0:f7c60d3e7b8a	5	* SPDX-License-Identifier: Apache-2.0
maclobdell	0:f7c60d3e7b8a	6	*
maclobdell	0:f7c60d3e7b8a	7	* Licensed under the Apache License, Version 2.0 (the "License"); you may
maclobdell	0:f7c60d3e7b8a	8	* not use this file except in compliance with the License.
maclobdell	0:f7c60d3e7b8a	9	* You may obtain a copy of the License at
maclobdell	0:f7c60d3e7b8a	10	*
maclobdell	0:f7c60d3e7b8a	11	* http://www.apache.org/licenses/LICENSE-2.0
maclobdell	0:f7c60d3e7b8a	12	*
maclobdell	0:f7c60d3e7b8a	13	* Unless required by applicable law or agreed to in writing, software
maclobdell	0:f7c60d3e7b8a	14	* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
maclobdell	0:f7c60d3e7b8a	15	* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
maclobdell	0:f7c60d3e7b8a	16	* See the License for the specific language governing permissions and
maclobdell	0:f7c60d3e7b8a	17	* limitations under the License.
maclobdell	0:f7c60d3e7b8a	18	*
maclobdell	0:f7c60d3e7b8a	19	* This file is part of mbed TLS (https://tls.mbed.org)
maclobdell	0:f7c60d3e7b8a	20	*/
maclobdell	0:f7c60d3e7b8a	21
maclobdell	0:f7c60d3e7b8a	22	/*
maclobdell	0:f7c60d3e7b8a	23	* References:
maclobdell	0:f7c60d3e7b8a	24	*
maclobdell	0:f7c60d3e7b8a	25	* SEC1 http://www.secg.org/index.php?action=secg,docs_secg
maclobdell	0:f7c60d3e7b8a	26	* GECC = Guide to Elliptic Curve Cryptography - Hankerson, Menezes, Vanstone
maclobdell	0:f7c60d3e7b8a	27	* FIPS 186-3 http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf
maclobdell	0:f7c60d3e7b8a	28	* RFC 4492 for the related TLS structures and constants
maclobdell	0:f7c60d3e7b8a	29	*
maclobdell	0:f7c60d3e7b8a	30	* [Curve25519] http://cr.yp.to/ecdh/curve25519-20060209.pdf
maclobdell	0:f7c60d3e7b8a	31	*
maclobdell	0:f7c60d3e7b8a	32	* [2] CORON, Jean-S'ebastien. Resistance against differential power analysis
maclobdell	0:f7c60d3e7b8a	33	* for elliptic curve cryptosystems. In : Cryptographic Hardware and
maclobdell	0:f7c60d3e7b8a	34	* Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302.
maclobdell	0:f7c60d3e7b8a	35	* <http://link.springer.com/chapter/10.1007/3-540-48059-5_25>
maclobdell	0:f7c60d3e7b8a	36	*
maclobdell	0:f7c60d3e7b8a	37	* [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to
maclobdell	0:f7c60d3e7b8a	38	* render ECC resistant against Side Channel Attacks. IACR Cryptology
maclobdell	0:f7c60d3e7b8a	39	* ePrint Archive, 2004, vol. 2004, p. 342.
maclobdell	0:f7c60d3e7b8a	40	* <http://eprint.iacr.org/2004/342.pdf>
maclobdell	0:f7c60d3e7b8a	41	*/
maclobdell	0:f7c60d3e7b8a	42
maclobdell	0:f7c60d3e7b8a	43	#if !defined(MBEDTLS_CONFIG_FILE)
maclobdell	0:f7c60d3e7b8a	44	#include "mbedtls/config.h"
maclobdell	0:f7c60d3e7b8a	45	#else
maclobdell	0:f7c60d3e7b8a	46	#include MBEDTLS_CONFIG_FILE
maclobdell	0:f7c60d3e7b8a	47	#endif
maclobdell	0:f7c60d3e7b8a	48
maclobdell	0:f7c60d3e7b8a	49	#if defined(MBEDTLS_ECP_C)
maclobdell	0:f7c60d3e7b8a	50
maclobdell	0:f7c60d3e7b8a	51	#include "mbedtls/ecp.h"
maclobdell	0:f7c60d3e7b8a	52
maclobdell	0:f7c60d3e7b8a	53	#include <string.h>
maclobdell	0:f7c60d3e7b8a	54
maclobdell	0:f7c60d3e7b8a	55	#if defined(MBEDTLS_PLATFORM_C)
maclobdell	0:f7c60d3e7b8a	56	#include "mbedtls/platform.h"
maclobdell	0:f7c60d3e7b8a	57	#else
maclobdell	0:f7c60d3e7b8a	58	#include <stdlib.h>
maclobdell	0:f7c60d3e7b8a	59	#include <stdio.h>
maclobdell	0:f7c60d3e7b8a	60	#define mbedtls_printf printf
maclobdell	0:f7c60d3e7b8a	61	#define mbedtls_calloc calloc
maclobdell	0:f7c60d3e7b8a	62	#define mbedtls_free free
maclobdell	0:f7c60d3e7b8a	63	#endif
maclobdell	0:f7c60d3e7b8a	64
maclobdell	0:f7c60d3e7b8a	65	#if ( defined(__ARMCC_VERSION) \|\| defined(_MSC_VER) ) && \
maclobdell	0:f7c60d3e7b8a	66	!defined(inline) && !defined(__cplusplus)
maclobdell	0:f7c60d3e7b8a	67	#define inline __inline
maclobdell	0:f7c60d3e7b8a	68	#endif
maclobdell	0:f7c60d3e7b8a	69
maclobdell	0:f7c60d3e7b8a	70	/* Implementation that should never be optimized out by the compiler */
maclobdell	0:f7c60d3e7b8a	71	static void mbedtls_zeroize( void *v, size_t n ) {
maclobdell	0:f7c60d3e7b8a	72	volatile unsigned char p = v; while( n-- ) p++ = 0;
maclobdell	0:f7c60d3e7b8a	73	}
maclobdell	0:f7c60d3e7b8a	74
maclobdell	0:f7c60d3e7b8a	75	#if defined(MBEDTLS_SELF_TEST)
maclobdell	0:f7c60d3e7b8a	76	/*
maclobdell	0:f7c60d3e7b8a	77	* Counts of point addition and doubling, and field multiplications.
maclobdell	0:f7c60d3e7b8a	78	* Used to test resistance of point multiplication to simple timing attacks.
maclobdell	0:f7c60d3e7b8a	79	*/
maclobdell	0:f7c60d3e7b8a	80	static unsigned long add_count, dbl_count, mul_count;
maclobdell	0:f7c60d3e7b8a	81	#endif
maclobdell	0:f7c60d3e7b8a	82
maclobdell	0:f7c60d3e7b8a	83	#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) \|\| \
maclobdell	0:f7c60d3e7b8a	84	defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) \|\| \
maclobdell	0:f7c60d3e7b8a	85	defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) \|\| \
maclobdell	0:f7c60d3e7b8a	86	defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) \|\| \
maclobdell	0:f7c60d3e7b8a	87	defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) \|\| \
maclobdell	0:f7c60d3e7b8a	88	defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) \|\| \
maclobdell	0:f7c60d3e7b8a	89	defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) \|\| \
maclobdell	0:f7c60d3e7b8a	90	defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) \|\| \
maclobdell	0:f7c60d3e7b8a	91	defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) \|\| \
maclobdell	0:f7c60d3e7b8a	92	defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) \|\| \
maclobdell	0:f7c60d3e7b8a	93	defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
maclobdell	0:f7c60d3e7b8a	94	#define ECP_SHORTWEIERSTRASS
maclobdell	0:f7c60d3e7b8a	95	#endif
maclobdell	0:f7c60d3e7b8a	96
maclobdell	0:f7c60d3e7b8a	97	#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
maclobdell	0:f7c60d3e7b8a	98	#define ECP_MONTGOMERY
maclobdell	0:f7c60d3e7b8a	99	#endif
maclobdell	0:f7c60d3e7b8a	100
maclobdell	0:f7c60d3e7b8a	101	/*
maclobdell	0:f7c60d3e7b8a	102	* Curve types: internal for now, might be exposed later
maclobdell	0:f7c60d3e7b8a	103	*/
maclobdell	0:f7c60d3e7b8a	104	typedef enum
maclobdell	0:f7c60d3e7b8a	105	{
maclobdell	0:f7c60d3e7b8a	106	ECP_TYPE_NONE = 0,
maclobdell	0:f7c60d3e7b8a	107	ECP_TYPE_SHORT_WEIERSTRASS, /* y^2 = x^3 + a x + b */
maclobdell	0:f7c60d3e7b8a	108	ECP_TYPE_MONTGOMERY, /* y^2 = x^3 + a x^2 + x */
maclobdell	0:f7c60d3e7b8a	109	} ecp_curve_type;
maclobdell	0:f7c60d3e7b8a	110
maclobdell	0:f7c60d3e7b8a	111	/*
maclobdell	0:f7c60d3e7b8a	112	* List of supported curves:
maclobdell	0:f7c60d3e7b8a	113	* - internal ID
maclobdell	0:f7c60d3e7b8a	114	* - TLS NamedCurve ID (RFC 4492 sec. 5.1.1, RFC 7071 sec. 2)
maclobdell	0:f7c60d3e7b8a	115	* - size in bits
maclobdell	0:f7c60d3e7b8a	116	* - readable name
maclobdell	0:f7c60d3e7b8a	117	*
maclobdell	0:f7c60d3e7b8a	118	* Curves are listed in order: largest curves first, and for a given size,
maclobdell	0:f7c60d3e7b8a	119	* fastest curves first. This provides the default order for the SSL module.
maclobdell	0:f7c60d3e7b8a	120	*
maclobdell	0:f7c60d3e7b8a	121	* Reminder: update profiles in x509_crt.c when adding a new curves!
maclobdell	0:f7c60d3e7b8a	122	*/
maclobdell	0:f7c60d3e7b8a	123	static const mbedtls_ecp_curve_info ecp_supported_curves[] =
maclobdell	0:f7c60d3e7b8a	124	{
maclobdell	0:f7c60d3e7b8a	125	#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
maclobdell	0:f7c60d3e7b8a	126	{ MBEDTLS_ECP_DP_SECP521R1, 25, 521, "secp521r1" },
maclobdell	0:f7c60d3e7b8a	127	#endif
maclobdell	0:f7c60d3e7b8a	128	#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
maclobdell	0:f7c60d3e7b8a	129	{ MBEDTLS_ECP_DP_BP512R1, 28, 512, "brainpoolP512r1" },
maclobdell	0:f7c60d3e7b8a	130	#endif
maclobdell	0:f7c60d3e7b8a	131	#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
maclobdell	0:f7c60d3e7b8a	132	{ MBEDTLS_ECP_DP_SECP384R1, 24, 384, "secp384r1" },
maclobdell	0:f7c60d3e7b8a	133	#endif
maclobdell	0:f7c60d3e7b8a	134	#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
maclobdell	0:f7c60d3e7b8a	135	{ MBEDTLS_ECP_DP_BP384R1, 27, 384, "brainpoolP384r1" },
maclobdell	0:f7c60d3e7b8a	136	#endif
maclobdell	0:f7c60d3e7b8a	137	#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
maclobdell	0:f7c60d3e7b8a	138	{ MBEDTLS_ECP_DP_SECP256R1, 23, 256, "secp256r1" },
maclobdell	0:f7c60d3e7b8a	139	#endif
maclobdell	0:f7c60d3e7b8a	140	#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
maclobdell	0:f7c60d3e7b8a	141	{ MBEDTLS_ECP_DP_SECP256K1, 22, 256, "secp256k1" },
maclobdell	0:f7c60d3e7b8a	142	#endif
maclobdell	0:f7c60d3e7b8a	143	#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
maclobdell	0:f7c60d3e7b8a	144	{ MBEDTLS_ECP_DP_BP256R1, 26, 256, "brainpoolP256r1" },
maclobdell	0:f7c60d3e7b8a	145	#endif
maclobdell	0:f7c60d3e7b8a	146	#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
maclobdell	0:f7c60d3e7b8a	147	{ MBEDTLS_ECP_DP_SECP224R1, 21, 224, "secp224r1" },
maclobdell	0:f7c60d3e7b8a	148	#endif
maclobdell	0:f7c60d3e7b8a	149	#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
maclobdell	0:f7c60d3e7b8a	150	{ MBEDTLS_ECP_DP_SECP224K1, 20, 224, "secp224k1" },
maclobdell	0:f7c60d3e7b8a	151	#endif
maclobdell	0:f7c60d3e7b8a	152	#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
maclobdell	0:f7c60d3e7b8a	153	{ MBEDTLS_ECP_DP_SECP192R1, 19, 192, "secp192r1" },
maclobdell	0:f7c60d3e7b8a	154	#endif
maclobdell	0:f7c60d3e7b8a	155	#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
maclobdell	0:f7c60d3e7b8a	156	{ MBEDTLS_ECP_DP_SECP192K1, 18, 192, "secp192k1" },
maclobdell	0:f7c60d3e7b8a	157	#endif
maclobdell	0:f7c60d3e7b8a	158	{ MBEDTLS_ECP_DP_NONE, 0, 0, NULL },
maclobdell	0:f7c60d3e7b8a	159	};
maclobdell	0:f7c60d3e7b8a	160
maclobdell	0:f7c60d3e7b8a	161	#define ECP_NB_CURVES sizeof( ecp_supported_curves ) / \
maclobdell	0:f7c60d3e7b8a	162	sizeof( ecp_supported_curves[0] )
maclobdell	0:f7c60d3e7b8a	163
maclobdell	0:f7c60d3e7b8a	164	static mbedtls_ecp_group_id ecp_supported_grp_id[ECP_NB_CURVES];
maclobdell	0:f7c60d3e7b8a	165
maclobdell	0:f7c60d3e7b8a	166	/*
maclobdell	0:f7c60d3e7b8a	167	* List of supported curves and associated info
maclobdell	0:f7c60d3e7b8a	168	*/
maclobdell	0:f7c60d3e7b8a	169	const mbedtls_ecp_curve_info *mbedtls_ecp_curve_list( void )
maclobdell	0:f7c60d3e7b8a	170	{
maclobdell	0:f7c60d3e7b8a	171	return( ecp_supported_curves );
maclobdell	0:f7c60d3e7b8a	172	}
maclobdell	0:f7c60d3e7b8a	173
maclobdell	0:f7c60d3e7b8a	174	/*
maclobdell	0:f7c60d3e7b8a	175	* List of supported curves, group ID only
maclobdell	0:f7c60d3e7b8a	176	*/
maclobdell	0:f7c60d3e7b8a	177	const mbedtls_ecp_group_id *mbedtls_ecp_grp_id_list( void )
maclobdell	0:f7c60d3e7b8a	178	{
maclobdell	0:f7c60d3e7b8a	179	static int init_done = 0;
maclobdell	0:f7c60d3e7b8a	180
maclobdell	0:f7c60d3e7b8a	181	if( ! init_done )
maclobdell	0:f7c60d3e7b8a	182	{
maclobdell	0:f7c60d3e7b8a	183	size_t i = 0;
maclobdell	0:f7c60d3e7b8a	184	const mbedtls_ecp_curve_info *curve_info;
maclobdell	0:f7c60d3e7b8a	185
maclobdell	0:f7c60d3e7b8a	186	for( curve_info = mbedtls_ecp_curve_list();
maclobdell	0:f7c60d3e7b8a	187	curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
maclobdell	0:f7c60d3e7b8a	188	curve_info++ )
maclobdell	0:f7c60d3e7b8a	189	{
maclobdell	0:f7c60d3e7b8a	190	ecp_supported_grp_id[i++] = curve_info->grp_id;
maclobdell	0:f7c60d3e7b8a	191	}
maclobdell	0:f7c60d3e7b8a	192	ecp_supported_grp_id[i] = MBEDTLS_ECP_DP_NONE;
maclobdell	0:f7c60d3e7b8a	193
maclobdell	0:f7c60d3e7b8a	194	init_done = 1;
maclobdell	0:f7c60d3e7b8a	195	}
maclobdell	0:f7c60d3e7b8a	196
maclobdell	0:f7c60d3e7b8a	197	return( ecp_supported_grp_id );
maclobdell	0:f7c60d3e7b8a	198	}
maclobdell	0:f7c60d3e7b8a	199
maclobdell	0:f7c60d3e7b8a	200	/*
maclobdell	0:f7c60d3e7b8a	201	* Get the curve info for the internal identifier
maclobdell	0:f7c60d3e7b8a	202	*/
maclobdell	0:f7c60d3e7b8a	203	const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_grp_id( mbedtls_ecp_group_id grp_id )
maclobdell	0:f7c60d3e7b8a	204	{
maclobdell	0:f7c60d3e7b8a	205	const mbedtls_ecp_curve_info *curve_info;
maclobdell	0:f7c60d3e7b8a	206
maclobdell	0:f7c60d3e7b8a	207	for( curve_info = mbedtls_ecp_curve_list();
maclobdell	0:f7c60d3e7b8a	208	curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
maclobdell	0:f7c60d3e7b8a	209	curve_info++ )
maclobdell	0:f7c60d3e7b8a	210	{
maclobdell	0:f7c60d3e7b8a	211	if( curve_info->grp_id == grp_id )
maclobdell	0:f7c60d3e7b8a	212	return( curve_info );
maclobdell	0:f7c60d3e7b8a	213	}
maclobdell	0:f7c60d3e7b8a	214
maclobdell	0:f7c60d3e7b8a	215	return( NULL );
maclobdell	0:f7c60d3e7b8a	216	}
maclobdell	0:f7c60d3e7b8a	217
maclobdell	0:f7c60d3e7b8a	218	/*
maclobdell	0:f7c60d3e7b8a	219	* Get the curve info from the TLS identifier
maclobdell	0:f7c60d3e7b8a	220	*/
maclobdell	0:f7c60d3e7b8a	221	const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_tls_id( uint16_t tls_id )
maclobdell	0:f7c60d3e7b8a	222	{
maclobdell	0:f7c60d3e7b8a	223	const mbedtls_ecp_curve_info *curve_info;
maclobdell	0:f7c60d3e7b8a	224
maclobdell	0:f7c60d3e7b8a	225	for( curve_info = mbedtls_ecp_curve_list();
maclobdell	0:f7c60d3e7b8a	226	curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
maclobdell	0:f7c60d3e7b8a	227	curve_info++ )
maclobdell	0:f7c60d3e7b8a	228	{
maclobdell	0:f7c60d3e7b8a	229	if( curve_info->tls_id == tls_id )
maclobdell	0:f7c60d3e7b8a	230	return( curve_info );
maclobdell	0:f7c60d3e7b8a	231	}
maclobdell	0:f7c60d3e7b8a	232
maclobdell	0:f7c60d3e7b8a	233	return( NULL );
maclobdell	0:f7c60d3e7b8a	234	}
maclobdell	0:f7c60d3e7b8a	235
maclobdell	0:f7c60d3e7b8a	236	/*
maclobdell	0:f7c60d3e7b8a	237	* Get the curve info from the name
maclobdell	0:f7c60d3e7b8a	238	*/
maclobdell	0:f7c60d3e7b8a	239	const mbedtls_ecp_curve_info mbedtls_ecp_curve_info_from_name( const char name )
maclobdell	0:f7c60d3e7b8a	240	{
maclobdell	0:f7c60d3e7b8a	241	const mbedtls_ecp_curve_info *curve_info;
maclobdell	0:f7c60d3e7b8a	242
maclobdell	0:f7c60d3e7b8a	243	for( curve_info = mbedtls_ecp_curve_list();
maclobdell	0:f7c60d3e7b8a	244	curve_info->grp_id != MBEDTLS_ECP_DP_NONE;
maclobdell	0:f7c60d3e7b8a	245	curve_info++ )
maclobdell	0:f7c60d3e7b8a	246	{
maclobdell	0:f7c60d3e7b8a	247	if( strcmp( curve_info->name, name ) == 0 )
maclobdell	0:f7c60d3e7b8a	248	return( curve_info );
maclobdell	0:f7c60d3e7b8a	249	}
maclobdell	0:f7c60d3e7b8a	250
maclobdell	0:f7c60d3e7b8a	251	return( NULL );
maclobdell	0:f7c60d3e7b8a	252	}
maclobdell	0:f7c60d3e7b8a	253
maclobdell	0:f7c60d3e7b8a	254	/*
maclobdell	0:f7c60d3e7b8a	255	* Get the type of a curve
maclobdell	0:f7c60d3e7b8a	256	*/
maclobdell	0:f7c60d3e7b8a	257	static inline ecp_curve_type ecp_get_type( const mbedtls_ecp_group *grp )
maclobdell	0:f7c60d3e7b8a	258	{
maclobdell	0:f7c60d3e7b8a	259	if( grp->G.X.p == NULL )
maclobdell	0:f7c60d3e7b8a	260	return( ECP_TYPE_NONE );
maclobdell	0:f7c60d3e7b8a	261
maclobdell	0:f7c60d3e7b8a	262	if( grp->G.Y.p == NULL )
maclobdell	0:f7c60d3e7b8a	263	return( ECP_TYPE_MONTGOMERY );
maclobdell	0:f7c60d3e7b8a	264	else
maclobdell	0:f7c60d3e7b8a	265	return( ECP_TYPE_SHORT_WEIERSTRASS );
maclobdell	0:f7c60d3e7b8a	266	}
maclobdell	0:f7c60d3e7b8a	267
maclobdell	0:f7c60d3e7b8a	268	/*
maclobdell	0:f7c60d3e7b8a	269	* Initialize (the components of) a point
maclobdell	0:f7c60d3e7b8a	270	*/
maclobdell	0:f7c60d3e7b8a	271	void mbedtls_ecp_point_init( mbedtls_ecp_point *pt )
maclobdell	0:f7c60d3e7b8a	272	{
maclobdell	0:f7c60d3e7b8a	273	if( pt == NULL )
maclobdell	0:f7c60d3e7b8a	274	return;
maclobdell	0:f7c60d3e7b8a	275
maclobdell	0:f7c60d3e7b8a	276	mbedtls_mpi_init( &pt->X );
maclobdell	0:f7c60d3e7b8a	277	mbedtls_mpi_init( &pt->Y );
maclobdell	0:f7c60d3e7b8a	278	mbedtls_mpi_init( &pt->Z );
maclobdell	0:f7c60d3e7b8a	279	}
maclobdell	0:f7c60d3e7b8a	280
maclobdell	0:f7c60d3e7b8a	281	/*
maclobdell	0:f7c60d3e7b8a	282	* Initialize (the components of) a group
maclobdell	0:f7c60d3e7b8a	283	*/
maclobdell	0:f7c60d3e7b8a	284	void mbedtls_ecp_group_init( mbedtls_ecp_group *grp )
maclobdell	0:f7c60d3e7b8a	285	{
maclobdell	0:f7c60d3e7b8a	286	if( grp == NULL )
maclobdell	0:f7c60d3e7b8a	287	return;
maclobdell	0:f7c60d3e7b8a	288
maclobdell	0:f7c60d3e7b8a	289	memset( grp, 0, sizeof( mbedtls_ecp_group ) );
maclobdell	0:f7c60d3e7b8a	290	}
maclobdell	0:f7c60d3e7b8a	291
maclobdell	0:f7c60d3e7b8a	292	/*
maclobdell	0:f7c60d3e7b8a	293	* Initialize (the components of) a key pair
maclobdell	0:f7c60d3e7b8a	294	*/
maclobdell	0:f7c60d3e7b8a	295	void mbedtls_ecp_keypair_init( mbedtls_ecp_keypair *key )
maclobdell	0:f7c60d3e7b8a	296	{
maclobdell	0:f7c60d3e7b8a	297	if( key == NULL )
maclobdell	0:f7c60d3e7b8a	298	return;
maclobdell	0:f7c60d3e7b8a	299
maclobdell	0:f7c60d3e7b8a	300	mbedtls_ecp_group_init( &key->grp );
maclobdell	0:f7c60d3e7b8a	301	mbedtls_mpi_init( &key->d );
maclobdell	0:f7c60d3e7b8a	302	mbedtls_ecp_point_init( &key->Q );
maclobdell	0:f7c60d3e7b8a	303	}
maclobdell	0:f7c60d3e7b8a	304
maclobdell	0:f7c60d3e7b8a	305	/*
maclobdell	0:f7c60d3e7b8a	306	* Unallocate (the components of) a point
maclobdell	0:f7c60d3e7b8a	307	*/
maclobdell	0:f7c60d3e7b8a	308	void mbedtls_ecp_point_free( mbedtls_ecp_point *pt )
maclobdell	0:f7c60d3e7b8a	309	{
maclobdell	0:f7c60d3e7b8a	310	if( pt == NULL )
maclobdell	0:f7c60d3e7b8a	311	return;
maclobdell	0:f7c60d3e7b8a	312
maclobdell	0:f7c60d3e7b8a	313	mbedtls_mpi_free( &( pt->X ) );
maclobdell	0:f7c60d3e7b8a	314	mbedtls_mpi_free( &( pt->Y ) );
maclobdell	0:f7c60d3e7b8a	315	mbedtls_mpi_free( &( pt->Z ) );
maclobdell	0:f7c60d3e7b8a	316	}
maclobdell	0:f7c60d3e7b8a	317
maclobdell	0:f7c60d3e7b8a	318	/*
maclobdell	0:f7c60d3e7b8a	319	* Unallocate (the components of) a group
maclobdell	0:f7c60d3e7b8a	320	*/
maclobdell	0:f7c60d3e7b8a	321	void mbedtls_ecp_group_free( mbedtls_ecp_group *grp )
maclobdell	0:f7c60d3e7b8a	322	{
maclobdell	0:f7c60d3e7b8a	323	size_t i;
maclobdell	0:f7c60d3e7b8a	324
maclobdell	0:f7c60d3e7b8a	325	if( grp == NULL )
maclobdell	0:f7c60d3e7b8a	326	return;
maclobdell	0:f7c60d3e7b8a	327
maclobdell	0:f7c60d3e7b8a	328	if( grp->h != 1 )
maclobdell	0:f7c60d3e7b8a	329	{
maclobdell	0:f7c60d3e7b8a	330	mbedtls_mpi_free( &grp->P );
maclobdell	0:f7c60d3e7b8a	331	mbedtls_mpi_free( &grp->A );
maclobdell	0:f7c60d3e7b8a	332	mbedtls_mpi_free( &grp->B );
maclobdell	0:f7c60d3e7b8a	333	mbedtls_ecp_point_free( &grp->G );
maclobdell	0:f7c60d3e7b8a	334	mbedtls_mpi_free( &grp->N );
maclobdell	0:f7c60d3e7b8a	335	}
maclobdell	0:f7c60d3e7b8a	336
maclobdell	0:f7c60d3e7b8a	337	if( grp->T != NULL )
maclobdell	0:f7c60d3e7b8a	338	{
maclobdell	0:f7c60d3e7b8a	339	for( i = 0; i < grp->T_size; i++ )
maclobdell	0:f7c60d3e7b8a	340	mbedtls_ecp_point_free( &grp->T[i] );
maclobdell	0:f7c60d3e7b8a	341	mbedtls_free( grp->T );
maclobdell	0:f7c60d3e7b8a	342	}
maclobdell	0:f7c60d3e7b8a	343
maclobdell	0:f7c60d3e7b8a	344	mbedtls_zeroize( grp, sizeof( mbedtls_ecp_group ) );
maclobdell	0:f7c60d3e7b8a	345	}
maclobdell	0:f7c60d3e7b8a	346
maclobdell	0:f7c60d3e7b8a	347	/*
maclobdell	0:f7c60d3e7b8a	348	* Unallocate (the components of) a key pair
maclobdell	0:f7c60d3e7b8a	349	*/
maclobdell	0:f7c60d3e7b8a	350	void mbedtls_ecp_keypair_free( mbedtls_ecp_keypair *key )
maclobdell	0:f7c60d3e7b8a	351	{
maclobdell	0:f7c60d3e7b8a	352	if( key == NULL )
maclobdell	0:f7c60d3e7b8a	353	return;
maclobdell	0:f7c60d3e7b8a	354
maclobdell	0:f7c60d3e7b8a	355	mbedtls_ecp_group_free( &key->grp );
maclobdell	0:f7c60d3e7b8a	356	mbedtls_mpi_free( &key->d );
maclobdell	0:f7c60d3e7b8a	357	mbedtls_ecp_point_free( &key->Q );
maclobdell	0:f7c60d3e7b8a	358	}
maclobdell	0:f7c60d3e7b8a	359
maclobdell	0:f7c60d3e7b8a	360	/*
maclobdell	0:f7c60d3e7b8a	361	* Copy the contents of a point
maclobdell	0:f7c60d3e7b8a	362	*/
maclobdell	0:f7c60d3e7b8a	363	int mbedtls_ecp_copy( mbedtls_ecp_point P, const mbedtls_ecp_point Q )
maclobdell	0:f7c60d3e7b8a	364	{
maclobdell	0:f7c60d3e7b8a	365	int ret;
maclobdell	0:f7c60d3e7b8a	366
maclobdell	0:f7c60d3e7b8a	367	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->X, &Q->X ) );
maclobdell	0:f7c60d3e7b8a	368	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->Y, &Q->Y ) );
maclobdell	0:f7c60d3e7b8a	369	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->Z, &Q->Z ) );
maclobdell	0:f7c60d3e7b8a	370
maclobdell	0:f7c60d3e7b8a	371	cleanup:
maclobdell	0:f7c60d3e7b8a	372	return( ret );
maclobdell	0:f7c60d3e7b8a	373	}
maclobdell	0:f7c60d3e7b8a	374
maclobdell	0:f7c60d3e7b8a	375	/*
maclobdell	0:f7c60d3e7b8a	376	* Copy the contents of a group object
maclobdell	0:f7c60d3e7b8a	377	*/
maclobdell	0:f7c60d3e7b8a	378	int mbedtls_ecp_group_copy( mbedtls_ecp_group dst, const mbedtls_ecp_group src )
maclobdell	0:f7c60d3e7b8a	379	{
maclobdell	0:f7c60d3e7b8a	380	return mbedtls_ecp_group_load( dst, src->id );
maclobdell	0:f7c60d3e7b8a	381	}
maclobdell	0:f7c60d3e7b8a	382
maclobdell	0:f7c60d3e7b8a	383	/*
maclobdell	0:f7c60d3e7b8a	384	* Set point to zero
maclobdell	0:f7c60d3e7b8a	385	*/
maclobdell	0:f7c60d3e7b8a	386	int mbedtls_ecp_set_zero( mbedtls_ecp_point *pt )
maclobdell	0:f7c60d3e7b8a	387	{
maclobdell	0:f7c60d3e7b8a	388	int ret;
maclobdell	0:f7c60d3e7b8a	389
maclobdell	0:f7c60d3e7b8a	390	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->X , 1 ) );
maclobdell	0:f7c60d3e7b8a	391	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Y , 1 ) );
maclobdell	0:f7c60d3e7b8a	392	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z , 0 ) );
maclobdell	0:f7c60d3e7b8a	393
maclobdell	0:f7c60d3e7b8a	394	cleanup:
maclobdell	0:f7c60d3e7b8a	395	return( ret );
maclobdell	0:f7c60d3e7b8a	396	}
maclobdell	0:f7c60d3e7b8a	397
maclobdell	0:f7c60d3e7b8a	398	/*
maclobdell	0:f7c60d3e7b8a	399	* Tell if a point is zero
maclobdell	0:f7c60d3e7b8a	400	*/
maclobdell	0:f7c60d3e7b8a	401	int mbedtls_ecp_is_zero( mbedtls_ecp_point *pt )
maclobdell	0:f7c60d3e7b8a	402	{
maclobdell	0:f7c60d3e7b8a	403	return( mbedtls_mpi_cmp_int( &pt->Z, 0 ) == 0 );
maclobdell	0:f7c60d3e7b8a	404	}
maclobdell	0:f7c60d3e7b8a	405
maclobdell	0:f7c60d3e7b8a	406	/*
maclobdell	0:f7c60d3e7b8a	407	* Compare two points lazyly
maclobdell	0:f7c60d3e7b8a	408	*/
maclobdell	0:f7c60d3e7b8a	409	int mbedtls_ecp_point_cmp( const mbedtls_ecp_point *P,
maclobdell	0:f7c60d3e7b8a	410	const mbedtls_ecp_point *Q )
maclobdell	0:f7c60d3e7b8a	411	{
maclobdell	0:f7c60d3e7b8a	412	if( mbedtls_mpi_cmp_mpi( &P->X, &Q->X ) == 0 &&
maclobdell	0:f7c60d3e7b8a	413	mbedtls_mpi_cmp_mpi( &P->Y, &Q->Y ) == 0 &&
maclobdell	0:f7c60d3e7b8a	414	mbedtls_mpi_cmp_mpi( &P->Z, &Q->Z ) == 0 )
maclobdell	0:f7c60d3e7b8a	415	{
maclobdell	0:f7c60d3e7b8a	416	return( 0 );
maclobdell	0:f7c60d3e7b8a	417	}
maclobdell	0:f7c60d3e7b8a	418
maclobdell	0:f7c60d3e7b8a	419	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	420	}
maclobdell	0:f7c60d3e7b8a	421
maclobdell	0:f7c60d3e7b8a	422	/*
maclobdell	0:f7c60d3e7b8a	423	* Import a non-zero point from ASCII strings
maclobdell	0:f7c60d3e7b8a	424	*/
maclobdell	0:f7c60d3e7b8a	425	int mbedtls_ecp_point_read_string( mbedtls_ecp_point *P, int radix,
maclobdell	0:f7c60d3e7b8a	426	const char x, const char y )
maclobdell	0:f7c60d3e7b8a	427	{
maclobdell	0:f7c60d3e7b8a	428	int ret;
maclobdell	0:f7c60d3e7b8a	429
maclobdell	0:f7c60d3e7b8a	430	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &P->X, radix, x ) );
maclobdell	0:f7c60d3e7b8a	431	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &P->Y, radix, y ) );
maclobdell	0:f7c60d3e7b8a	432	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &P->Z, 1 ) );
maclobdell	0:f7c60d3e7b8a	433
maclobdell	0:f7c60d3e7b8a	434	cleanup:
maclobdell	0:f7c60d3e7b8a	435	return( ret );
maclobdell	0:f7c60d3e7b8a	436	}
maclobdell	0:f7c60d3e7b8a	437
maclobdell	0:f7c60d3e7b8a	438	/*
maclobdell	0:f7c60d3e7b8a	439	* Export a point into unsigned binary data (SEC1 2.3.3)
maclobdell	0:f7c60d3e7b8a	440	*/
maclobdell	0:f7c60d3e7b8a	441	int mbedtls_ecp_point_write_binary( const mbedtls_ecp_group grp, const mbedtls_ecp_point P,
maclobdell	0:f7c60d3e7b8a	442	int format, size_t *olen,
maclobdell	0:f7c60d3e7b8a	443	unsigned char *buf, size_t buflen )
maclobdell	0:f7c60d3e7b8a	444	{
maclobdell	0:f7c60d3e7b8a	445	int ret = 0;
maclobdell	0:f7c60d3e7b8a	446	size_t plen;
maclobdell	0:f7c60d3e7b8a	447
maclobdell	0:f7c60d3e7b8a	448	if( format != MBEDTLS_ECP_PF_UNCOMPRESSED &&
maclobdell	0:f7c60d3e7b8a	449	format != MBEDTLS_ECP_PF_COMPRESSED )
maclobdell	0:f7c60d3e7b8a	450	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	451
maclobdell	0:f7c60d3e7b8a	452	/*
maclobdell	0:f7c60d3e7b8a	453	* Common case: P == 0
maclobdell	0:f7c60d3e7b8a	454	*/
maclobdell	0:f7c60d3e7b8a	455	if( mbedtls_mpi_cmp_int( &P->Z, 0 ) == 0 )
maclobdell	0:f7c60d3e7b8a	456	{
maclobdell	0:f7c60d3e7b8a	457	if( buflen < 1 )
maclobdell	0:f7c60d3e7b8a	458	return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
maclobdell	0:f7c60d3e7b8a	459
maclobdell	0:f7c60d3e7b8a	460	buf[0] = 0x00;
maclobdell	0:f7c60d3e7b8a	461	*olen = 1;
maclobdell	0:f7c60d3e7b8a	462
maclobdell	0:f7c60d3e7b8a	463	return( 0 );
maclobdell	0:f7c60d3e7b8a	464	}
maclobdell	0:f7c60d3e7b8a	465
maclobdell	0:f7c60d3e7b8a	466	plen = mbedtls_mpi_size( &grp->P );
maclobdell	0:f7c60d3e7b8a	467
maclobdell	0:f7c60d3e7b8a	468	if( format == MBEDTLS_ECP_PF_UNCOMPRESSED )
maclobdell	0:f7c60d3e7b8a	469	{
maclobdell	0:f7c60d3e7b8a	470	olen = 2 plen + 1;
maclobdell	0:f7c60d3e7b8a	471
maclobdell	0:f7c60d3e7b8a	472	if( buflen < *olen )
maclobdell	0:f7c60d3e7b8a	473	return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
maclobdell	0:f7c60d3e7b8a	474
maclobdell	0:f7c60d3e7b8a	475	buf[0] = 0x04;
maclobdell	0:f7c60d3e7b8a	476	MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->X, buf + 1, plen ) );
maclobdell	0:f7c60d3e7b8a	477	MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->Y, buf + 1 + plen, plen ) );
maclobdell	0:f7c60d3e7b8a	478	}
maclobdell	0:f7c60d3e7b8a	479	else if( format == MBEDTLS_ECP_PF_COMPRESSED )
maclobdell	0:f7c60d3e7b8a	480	{
maclobdell	0:f7c60d3e7b8a	481	*olen = plen + 1;
maclobdell	0:f7c60d3e7b8a	482
maclobdell	0:f7c60d3e7b8a	483	if( buflen < *olen )
maclobdell	0:f7c60d3e7b8a	484	return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
maclobdell	0:f7c60d3e7b8a	485
maclobdell	0:f7c60d3e7b8a	486	buf[0] = 0x02 + mbedtls_mpi_get_bit( &P->Y, 0 );
maclobdell	0:f7c60d3e7b8a	487	MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->X, buf + 1, plen ) );
maclobdell	0:f7c60d3e7b8a	488	}
maclobdell	0:f7c60d3e7b8a	489
maclobdell	0:f7c60d3e7b8a	490	cleanup:
maclobdell	0:f7c60d3e7b8a	491	return( ret );
maclobdell	0:f7c60d3e7b8a	492	}
maclobdell	0:f7c60d3e7b8a	493
maclobdell	0:f7c60d3e7b8a	494	/*
maclobdell	0:f7c60d3e7b8a	495	* Import a point from unsigned binary data (SEC1 2.3.4)
maclobdell	0:f7c60d3e7b8a	496	*/
maclobdell	0:f7c60d3e7b8a	497	int mbedtls_ecp_point_read_binary( const mbedtls_ecp_group grp, mbedtls_ecp_point pt,
maclobdell	0:f7c60d3e7b8a	498	const unsigned char *buf, size_t ilen )
maclobdell	0:f7c60d3e7b8a	499	{
maclobdell	0:f7c60d3e7b8a	500	int ret;
maclobdell	0:f7c60d3e7b8a	501	size_t plen;
maclobdell	0:f7c60d3e7b8a	502
maclobdell	0:f7c60d3e7b8a	503	if( ilen < 1 )
maclobdell	0:f7c60d3e7b8a	504	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	505
maclobdell	0:f7c60d3e7b8a	506	if( buf[0] == 0x00 )
maclobdell	0:f7c60d3e7b8a	507	{
maclobdell	0:f7c60d3e7b8a	508	if( ilen == 1 )
maclobdell	0:f7c60d3e7b8a	509	return( mbedtls_ecp_set_zero( pt ) );
maclobdell	0:f7c60d3e7b8a	510	else
maclobdell	0:f7c60d3e7b8a	511	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	512	}
maclobdell	0:f7c60d3e7b8a	513
maclobdell	0:f7c60d3e7b8a	514	plen = mbedtls_mpi_size( &grp->P );
maclobdell	0:f7c60d3e7b8a	515
maclobdell	0:f7c60d3e7b8a	516	if( buf[0] != 0x04 )
maclobdell	0:f7c60d3e7b8a	517	return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
maclobdell	0:f7c60d3e7b8a	518
maclobdell	0:f7c60d3e7b8a	519	if( ilen != 2 * plen + 1 )
maclobdell	0:f7c60d3e7b8a	520	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	521
maclobdell	0:f7c60d3e7b8a	522	MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &pt->X, buf + 1, plen ) );
maclobdell	0:f7c60d3e7b8a	523	MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &pt->Y, buf + 1 + plen, plen ) );
maclobdell	0:f7c60d3e7b8a	524	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z, 1 ) );
maclobdell	0:f7c60d3e7b8a	525
maclobdell	0:f7c60d3e7b8a	526	cleanup:
maclobdell	0:f7c60d3e7b8a	527	return( ret );
maclobdell	0:f7c60d3e7b8a	528	}
maclobdell	0:f7c60d3e7b8a	529
maclobdell	0:f7c60d3e7b8a	530	/*
maclobdell	0:f7c60d3e7b8a	531	* Import a point from a TLS ECPoint record (RFC 4492)
maclobdell	0:f7c60d3e7b8a	532	* struct {
maclobdell	0:f7c60d3e7b8a	533	* opaque point <1..2^8-1>;
maclobdell	0:f7c60d3e7b8a	534	* } ECPoint;
maclobdell	0:f7c60d3e7b8a	535	*/
maclobdell	0:f7c60d3e7b8a	536	int mbedtls_ecp_tls_read_point( const mbedtls_ecp_group grp, mbedtls_ecp_point pt,
maclobdell	0:f7c60d3e7b8a	537	const unsigned char **buf, size_t buf_len )
maclobdell	0:f7c60d3e7b8a	538	{
maclobdell	0:f7c60d3e7b8a	539	unsigned char data_len;
maclobdell	0:f7c60d3e7b8a	540	const unsigned char *buf_start;
maclobdell	0:f7c60d3e7b8a	541
maclobdell	0:f7c60d3e7b8a	542	/*
maclobdell	0:f7c60d3e7b8a	543	* We must have at least two bytes (1 for length, at least one for data)
maclobdell	0:f7c60d3e7b8a	544	*/
maclobdell	0:f7c60d3e7b8a	545	if( buf_len < 2 )
maclobdell	0:f7c60d3e7b8a	546	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	547
maclobdell	0:f7c60d3e7b8a	548	data_len = (buf)++;
maclobdell	0:f7c60d3e7b8a	549	if( data_len < 1 \|\| data_len > buf_len - 1 )
maclobdell	0:f7c60d3e7b8a	550	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	551
maclobdell	0:f7c60d3e7b8a	552	/*
maclobdell	0:f7c60d3e7b8a	553	* Save buffer start for read_binary and update buf
maclobdell	0:f7c60d3e7b8a	554	*/
maclobdell	0:f7c60d3e7b8a	555	buf_start = *buf;
maclobdell	0:f7c60d3e7b8a	556	*buf += data_len;
maclobdell	0:f7c60d3e7b8a	557
maclobdell	0:f7c60d3e7b8a	558	return mbedtls_ecp_point_read_binary( grp, pt, buf_start, data_len );
maclobdell	0:f7c60d3e7b8a	559	}
maclobdell	0:f7c60d3e7b8a	560
maclobdell	0:f7c60d3e7b8a	561	/*
maclobdell	0:f7c60d3e7b8a	562	* Export a point as a TLS ECPoint record (RFC 4492)
maclobdell	0:f7c60d3e7b8a	563	* struct {
maclobdell	0:f7c60d3e7b8a	564	* opaque point <1..2^8-1>;
maclobdell	0:f7c60d3e7b8a	565	* } ECPoint;
maclobdell	0:f7c60d3e7b8a	566	*/
maclobdell	0:f7c60d3e7b8a	567	int mbedtls_ecp_tls_write_point( const mbedtls_ecp_group grp, const mbedtls_ecp_point pt,
maclobdell	0:f7c60d3e7b8a	568	int format, size_t *olen,
maclobdell	0:f7c60d3e7b8a	569	unsigned char *buf, size_t blen )
maclobdell	0:f7c60d3e7b8a	570	{
maclobdell	0:f7c60d3e7b8a	571	int ret;
maclobdell	0:f7c60d3e7b8a	572
maclobdell	0:f7c60d3e7b8a	573	/*
maclobdell	0:f7c60d3e7b8a	574	* buffer length must be at least one, for our length byte
maclobdell	0:f7c60d3e7b8a	575	*/
maclobdell	0:f7c60d3e7b8a	576	if( blen < 1 )
maclobdell	0:f7c60d3e7b8a	577	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	578
maclobdell	0:f7c60d3e7b8a	579	if( ( ret = mbedtls_ecp_point_write_binary( grp, pt, format,
maclobdell	0:f7c60d3e7b8a	580	olen, buf + 1, blen - 1) ) != 0 )
maclobdell	0:f7c60d3e7b8a	581	return( ret );
maclobdell	0:f7c60d3e7b8a	582
maclobdell	0:f7c60d3e7b8a	583	/*
maclobdell	0:f7c60d3e7b8a	584	* write length to the first byte and update total length
maclobdell	0:f7c60d3e7b8a	585	*/
maclobdell	0:f7c60d3e7b8a	586	buf[0] = (unsigned char) *olen;
maclobdell	0:f7c60d3e7b8a	587	++*olen;
maclobdell	0:f7c60d3e7b8a	588
maclobdell	0:f7c60d3e7b8a	589	return( 0 );
maclobdell	0:f7c60d3e7b8a	590	}
maclobdell	0:f7c60d3e7b8a	591
maclobdell	0:f7c60d3e7b8a	592	/*
maclobdell	0:f7c60d3e7b8a	593	* Set a group from an ECParameters record (RFC 4492)
maclobdell	0:f7c60d3e7b8a	594	*/
maclobdell	0:f7c60d3e7b8a	595	int mbedtls_ecp_tls_read_group( mbedtls_ecp_group grp, const unsigned char *buf, size_t len )
maclobdell	0:f7c60d3e7b8a	596	{
maclobdell	0:f7c60d3e7b8a	597	uint16_t tls_id;
maclobdell	0:f7c60d3e7b8a	598	const mbedtls_ecp_curve_info *curve_info;
maclobdell	0:f7c60d3e7b8a	599
maclobdell	0:f7c60d3e7b8a	600	/*
maclobdell	0:f7c60d3e7b8a	601	* We expect at least three bytes (see below)
maclobdell	0:f7c60d3e7b8a	602	*/
maclobdell	0:f7c60d3e7b8a	603	if( len < 3 )
maclobdell	0:f7c60d3e7b8a	604	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	605
maclobdell	0:f7c60d3e7b8a	606	/*
maclobdell	0:f7c60d3e7b8a	607	* First byte is curve_type; only named_curve is handled
maclobdell	0:f7c60d3e7b8a	608	*/
maclobdell	0:f7c60d3e7b8a	609	if( (buf)++ != MBEDTLS_ECP_TLS_NAMED_CURVE )
maclobdell	0:f7c60d3e7b8a	610	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	611
maclobdell	0:f7c60d3e7b8a	612	/*
maclobdell	0:f7c60d3e7b8a	613	* Next two bytes are the namedcurve value
maclobdell	0:f7c60d3e7b8a	614	*/
maclobdell	0:f7c60d3e7b8a	615	tls_id = (buf)++;
maclobdell	0:f7c60d3e7b8a	616	tls_id <<= 8;
maclobdell	0:f7c60d3e7b8a	617	tls_id \|= (buf)++;
maclobdell	0:f7c60d3e7b8a	618
maclobdell	0:f7c60d3e7b8a	619	if( ( curve_info = mbedtls_ecp_curve_info_from_tls_id( tls_id ) ) == NULL )
maclobdell	0:f7c60d3e7b8a	620	return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
maclobdell	0:f7c60d3e7b8a	621
maclobdell	0:f7c60d3e7b8a	622	return mbedtls_ecp_group_load( grp, curve_info->grp_id );
maclobdell	0:f7c60d3e7b8a	623	}
maclobdell	0:f7c60d3e7b8a	624
maclobdell	0:f7c60d3e7b8a	625	/*
maclobdell	0:f7c60d3e7b8a	626	* Write the ECParameters record corresponding to a group (RFC 4492)
maclobdell	0:f7c60d3e7b8a	627	*/
maclobdell	0:f7c60d3e7b8a	628	int mbedtls_ecp_tls_write_group( const mbedtls_ecp_group grp, size_t olen,
maclobdell	0:f7c60d3e7b8a	629	unsigned char *buf, size_t blen )
maclobdell	0:f7c60d3e7b8a	630	{
maclobdell	0:f7c60d3e7b8a	631	const mbedtls_ecp_curve_info *curve_info;
maclobdell	0:f7c60d3e7b8a	632
maclobdell	0:f7c60d3e7b8a	633	if( ( curve_info = mbedtls_ecp_curve_info_from_grp_id( grp->id ) ) == NULL )
maclobdell	0:f7c60d3e7b8a	634	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	635
maclobdell	0:f7c60d3e7b8a	636	/*
maclobdell	0:f7c60d3e7b8a	637	* We are going to write 3 bytes (see below)
maclobdell	0:f7c60d3e7b8a	638	*/
maclobdell	0:f7c60d3e7b8a	639	*olen = 3;
maclobdell	0:f7c60d3e7b8a	640	if( blen < *olen )
maclobdell	0:f7c60d3e7b8a	641	return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
maclobdell	0:f7c60d3e7b8a	642
maclobdell	0:f7c60d3e7b8a	643	/*
maclobdell	0:f7c60d3e7b8a	644	* First byte is curve_type, always named_curve
maclobdell	0:f7c60d3e7b8a	645	*/
maclobdell	0:f7c60d3e7b8a	646	*buf++ = MBEDTLS_ECP_TLS_NAMED_CURVE;
maclobdell	0:f7c60d3e7b8a	647
maclobdell	0:f7c60d3e7b8a	648	/*
maclobdell	0:f7c60d3e7b8a	649	* Next two bytes are the namedcurve value
maclobdell	0:f7c60d3e7b8a	650	*/
maclobdell	0:f7c60d3e7b8a	651	buf[0] = curve_info->tls_id >> 8;
maclobdell	0:f7c60d3e7b8a	652	buf[1] = curve_info->tls_id & 0xFF;
maclobdell	0:f7c60d3e7b8a	653
maclobdell	0:f7c60d3e7b8a	654	return( 0 );
maclobdell	0:f7c60d3e7b8a	655	}
maclobdell	0:f7c60d3e7b8a	656
maclobdell	0:f7c60d3e7b8a	657	/*
maclobdell	0:f7c60d3e7b8a	658	* Wrapper around fast quasi-modp functions, with fall-back to mbedtls_mpi_mod_mpi.
maclobdell	0:f7c60d3e7b8a	659	* See the documentation of struct mbedtls_ecp_group.
maclobdell	0:f7c60d3e7b8a	660	*
maclobdell	0:f7c60d3e7b8a	661	* This function is in the critial loop for mbedtls_ecp_mul, so pay attention to perf.
maclobdell	0:f7c60d3e7b8a	662	*/
maclobdell	0:f7c60d3e7b8a	663	static int ecp_modp( mbedtls_mpi N, const mbedtls_ecp_group grp )
maclobdell	0:f7c60d3e7b8a	664	{
maclobdell	0:f7c60d3e7b8a	665	int ret;
maclobdell	0:f7c60d3e7b8a	666
maclobdell	0:f7c60d3e7b8a	667	if( grp->modp == NULL )
maclobdell	0:f7c60d3e7b8a	668	return( mbedtls_mpi_mod_mpi( N, N, &grp->P ) );
maclobdell	0:f7c60d3e7b8a	669
maclobdell	0:f7c60d3e7b8a	670	/* N->s < 0 is a much faster test, which fails only if N is 0 */
maclobdell	0:f7c60d3e7b8a	671	if( ( N->s < 0 && mbedtls_mpi_cmp_int( N, 0 ) != 0 ) \|\|
maclobdell	0:f7c60d3e7b8a	672	mbedtls_mpi_bitlen( N ) > 2 * grp->pbits )
maclobdell	0:f7c60d3e7b8a	673	{
maclobdell	0:f7c60d3e7b8a	674	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	675	}
maclobdell	0:f7c60d3e7b8a	676
maclobdell	0:f7c60d3e7b8a	677	MBEDTLS_MPI_CHK( grp->modp( N ) );
maclobdell	0:f7c60d3e7b8a	678
maclobdell	0:f7c60d3e7b8a	679	/* N->s < 0 is a much faster test, which fails only if N is 0 */
maclobdell	0:f7c60d3e7b8a	680	while( N->s < 0 && mbedtls_mpi_cmp_int( N, 0 ) != 0 )
maclobdell	0:f7c60d3e7b8a	681	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &grp->P ) );
maclobdell	0:f7c60d3e7b8a	682
maclobdell	0:f7c60d3e7b8a	683	while( mbedtls_mpi_cmp_mpi( N, &grp->P ) >= 0 )
maclobdell	0:f7c60d3e7b8a	684	/* we known P, N and the result are positive */
maclobdell	0:f7c60d3e7b8a	685	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( N, N, &grp->P ) );
maclobdell	0:f7c60d3e7b8a	686
maclobdell	0:f7c60d3e7b8a	687	cleanup:
maclobdell	0:f7c60d3e7b8a	688	return( ret );
maclobdell	0:f7c60d3e7b8a	689	}
maclobdell	0:f7c60d3e7b8a	690
maclobdell	0:f7c60d3e7b8a	691	/*
maclobdell	0:f7c60d3e7b8a	692	* Fast mod-p functions expect their argument to be in the 0..p^2 range.
maclobdell	0:f7c60d3e7b8a	693	*
maclobdell	0:f7c60d3e7b8a	694	* In order to guarantee that, we need to ensure that operands of
maclobdell	0:f7c60d3e7b8a	695	* mbedtls_mpi_mul_mpi are in the 0..p range. So, after each operation we will
maclobdell	0:f7c60d3e7b8a	696	* bring the result back to this range.
maclobdell	0:f7c60d3e7b8a	697	*
maclobdell	0:f7c60d3e7b8a	698	* The following macros are shortcuts for doing that.
maclobdell	0:f7c60d3e7b8a	699	*/
maclobdell	0:f7c60d3e7b8a	700
maclobdell	0:f7c60d3e7b8a	701	/*
maclobdell	0:f7c60d3e7b8a	702	* Reduce a mbedtls_mpi mod p in-place, general case, to use after mbedtls_mpi_mul_mpi
maclobdell	0:f7c60d3e7b8a	703	*/
maclobdell	0:f7c60d3e7b8a	704	#if defined(MBEDTLS_SELF_TEST)
maclobdell	0:f7c60d3e7b8a	705	#define INC_MUL_COUNT mul_count++;
maclobdell	0:f7c60d3e7b8a	706	#else
maclobdell	0:f7c60d3e7b8a	707	#define INC_MUL_COUNT
maclobdell	0:f7c60d3e7b8a	708	#endif
maclobdell	0:f7c60d3e7b8a	709
maclobdell	0:f7c60d3e7b8a	710	#define MOD_MUL( N ) do { MBEDTLS_MPI_CHK( ecp_modp( &N, grp ) ); INC_MUL_COUNT } \
maclobdell	0:f7c60d3e7b8a	711	while( 0 )
maclobdell	0:f7c60d3e7b8a	712
maclobdell	0:f7c60d3e7b8a	713	/*
maclobdell	0:f7c60d3e7b8a	714	* Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_sub_mpi
maclobdell	0:f7c60d3e7b8a	715	* N->s < 0 is a very fast test, which fails only if N is 0
maclobdell	0:f7c60d3e7b8a	716	*/
maclobdell	0:f7c60d3e7b8a	717	#define MOD_SUB( N ) \
maclobdell	0:f7c60d3e7b8a	718	while( N.s < 0 && mbedtls_mpi_cmp_int( &N, 0 ) != 0 ) \
maclobdell	0:f7c60d3e7b8a	719	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &N, &N, &grp->P ) )
maclobdell	0:f7c60d3e7b8a	720
maclobdell	0:f7c60d3e7b8a	721	/*
maclobdell	0:f7c60d3e7b8a	722	* Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_add_mpi and mbedtls_mpi_mul_int.
maclobdell	0:f7c60d3e7b8a	723	* We known P, N and the result are positive, so sub_abs is correct, and
maclobdell	0:f7c60d3e7b8a	724	* a bit faster.
maclobdell	0:f7c60d3e7b8a	725	*/
maclobdell	0:f7c60d3e7b8a	726	#define MOD_ADD( N ) \
maclobdell	0:f7c60d3e7b8a	727	while( mbedtls_mpi_cmp_mpi( &N, &grp->P ) >= 0 ) \
maclobdell	0:f7c60d3e7b8a	728	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( &N, &N, &grp->P ) )
maclobdell	0:f7c60d3e7b8a	729
maclobdell	0:f7c60d3e7b8a	730	#if defined(ECP_SHORTWEIERSTRASS)
maclobdell	0:f7c60d3e7b8a	731	/*
maclobdell	0:f7c60d3e7b8a	732	* For curves in short Weierstrass form, we do all the internal operations in
maclobdell	0:f7c60d3e7b8a	733	* Jacobian coordinates.
maclobdell	0:f7c60d3e7b8a	734	*
maclobdell	0:f7c60d3e7b8a	735	* For multiplication, we'll use a comb method with coutermeasueres against
maclobdell	0:f7c60d3e7b8a	736	* SPA, hence timing attacks.
maclobdell	0:f7c60d3e7b8a	737	*/
maclobdell	0:f7c60d3e7b8a	738
maclobdell	0:f7c60d3e7b8a	739	/*
maclobdell	0:f7c60d3e7b8a	740	* Normalize jacobian coordinates so that Z == 0 \|\| Z == 1 (GECC 3.2.1)
maclobdell	0:f7c60d3e7b8a	741	* Cost: 1N := 1I + 3M + 1S
maclobdell	0:f7c60d3e7b8a	742	*/
maclobdell	0:f7c60d3e7b8a	743	static int ecp_normalize_jac( const mbedtls_ecp_group grp, mbedtls_ecp_point pt )
maclobdell	0:f7c60d3e7b8a	744	{
maclobdell	0:f7c60d3e7b8a	745	int ret;
maclobdell	0:f7c60d3e7b8a	746	mbedtls_mpi Zi, ZZi;
maclobdell	0:f7c60d3e7b8a	747
maclobdell	0:f7c60d3e7b8a	748	if( mbedtls_mpi_cmp_int( &pt->Z, 0 ) == 0 )
maclobdell	0:f7c60d3e7b8a	749	return( 0 );
maclobdell	0:f7c60d3e7b8a	750
maclobdell	0:f7c60d3e7b8a	751	mbedtls_mpi_init( &Zi ); mbedtls_mpi_init( &ZZi );
maclobdell	0:f7c60d3e7b8a	752
maclobdell	0:f7c60d3e7b8a	753	/*
maclobdell	0:f7c60d3e7b8a	754	* X = X / Z^2 mod p
maclobdell	0:f7c60d3e7b8a	755	*/
maclobdell	0:f7c60d3e7b8a	756	MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &Zi, &pt->Z, &grp->P ) );
maclobdell	0:f7c60d3e7b8a	757	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ZZi, &Zi, &Zi ) ); MOD_MUL( ZZi );
maclobdell	0:f7c60d3e7b8a	758	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &pt->X, &pt->X, &ZZi ) ); MOD_MUL( pt->X );
maclobdell	0:f7c60d3e7b8a	759
maclobdell	0:f7c60d3e7b8a	760	/*
maclobdell	0:f7c60d3e7b8a	761	* Y = Y / Z^3 mod p
maclobdell	0:f7c60d3e7b8a	762	*/
maclobdell	0:f7c60d3e7b8a	763	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &pt->Y, &pt->Y, &ZZi ) ); MOD_MUL( pt->Y );
maclobdell	0:f7c60d3e7b8a	764	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &pt->Y, &pt->Y, &Zi ) ); MOD_MUL( pt->Y );
maclobdell	0:f7c60d3e7b8a	765
maclobdell	0:f7c60d3e7b8a	766	/*
maclobdell	0:f7c60d3e7b8a	767	* Z = 1
maclobdell	0:f7c60d3e7b8a	768	*/
maclobdell	0:f7c60d3e7b8a	769	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z, 1 ) );
maclobdell	0:f7c60d3e7b8a	770
maclobdell	0:f7c60d3e7b8a	771	cleanup:
maclobdell	0:f7c60d3e7b8a	772
maclobdell	0:f7c60d3e7b8a	773	mbedtls_mpi_free( &Zi ); mbedtls_mpi_free( &ZZi );
maclobdell	0:f7c60d3e7b8a	774
maclobdell	0:f7c60d3e7b8a	775	return( ret );
maclobdell	0:f7c60d3e7b8a	776	}
maclobdell	0:f7c60d3e7b8a	777
maclobdell	0:f7c60d3e7b8a	778	/*
maclobdell	0:f7c60d3e7b8a	779	* Normalize jacobian coordinates of an array of (pointers to) points,
maclobdell	0:f7c60d3e7b8a	780	* using Montgomery's trick to perform only one inversion mod P.
maclobdell	0:f7c60d3e7b8a	781	* (See for example Cohen's "A Course in Computational Algebraic Number
maclobdell	0:f7c60d3e7b8a	782	* Theory", Algorithm 10.3.4.)
maclobdell	0:f7c60d3e7b8a	783	*
maclobdell	0:f7c60d3e7b8a	784	* Warning: fails (returning an error) if one of the points is zero!
maclobdell	0:f7c60d3e7b8a	785	* This should never happen, see choice of w in ecp_mul_comb().
maclobdell	0:f7c60d3e7b8a	786	*
maclobdell	0:f7c60d3e7b8a	787	* Cost: 1N(t) := 1I + (6t - 3)M + 1S
maclobdell	0:f7c60d3e7b8a	788	*/
maclobdell	0:f7c60d3e7b8a	789	static int ecp_normalize_jac_many( const mbedtls_ecp_group *grp,
maclobdell	0:f7c60d3e7b8a	790	mbedtls_ecp_point *T[], size_t t_len )
maclobdell	0:f7c60d3e7b8a	791	{
maclobdell	0:f7c60d3e7b8a	792	int ret;
maclobdell	0:f7c60d3e7b8a	793	size_t i;
maclobdell	0:f7c60d3e7b8a	794	mbedtls_mpi *c, u, Zi, ZZi;
maclobdell	0:f7c60d3e7b8a	795
maclobdell	0:f7c60d3e7b8a	796	if( t_len < 2 )
maclobdell	0:f7c60d3e7b8a	797	return( ecp_normalize_jac( grp, *T ) );
maclobdell	0:f7c60d3e7b8a	798
maclobdell	0:f7c60d3e7b8a	799	if( ( c = mbedtls_calloc( t_len, sizeof( mbedtls_mpi ) ) ) == NULL )
maclobdell	0:f7c60d3e7b8a	800	return( MBEDTLS_ERR_ECP_ALLOC_FAILED );
maclobdell	0:f7c60d3e7b8a	801
maclobdell	0:f7c60d3e7b8a	802	mbedtls_mpi_init( &u ); mbedtls_mpi_init( &Zi ); mbedtls_mpi_init( &ZZi );
maclobdell	0:f7c60d3e7b8a	803
maclobdell	0:f7c60d3e7b8a	804	/*
maclobdell	0:f7c60d3e7b8a	805	* c[i] = Z_0 * ... * Z_i
maclobdell	0:f7c60d3e7b8a	806	*/
maclobdell	0:f7c60d3e7b8a	807	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &c[0], &T[0]->Z ) );
maclobdell	0:f7c60d3e7b8a	808	for( i = 1; i < t_len; i++ )
maclobdell	0:f7c60d3e7b8a	809	{
maclobdell	0:f7c60d3e7b8a	810	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &c[i], &c[i-1], &T[i]->Z ) );
maclobdell	0:f7c60d3e7b8a	811	MOD_MUL( c[i] );
maclobdell	0:f7c60d3e7b8a	812	}
maclobdell	0:f7c60d3e7b8a	813
maclobdell	0:f7c60d3e7b8a	814	/*
maclobdell	0:f7c60d3e7b8a	815	* u = 1 / (Z_0 * ... * Z_n) mod P
maclobdell	0:f7c60d3e7b8a	816	*/
maclobdell	0:f7c60d3e7b8a	817	MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &u, &c[t_len-1], &grp->P ) );
maclobdell	0:f7c60d3e7b8a	818
maclobdell	0:f7c60d3e7b8a	819	for( i = t_len - 1; ; i-- )
maclobdell	0:f7c60d3e7b8a	820	{
maclobdell	0:f7c60d3e7b8a	821	/*
maclobdell	0:f7c60d3e7b8a	822	* Zi = 1 / Z_i mod p
maclobdell	0:f7c60d3e7b8a	823	* u = 1 / (Z_0 * ... * Z_i) mod P
maclobdell	0:f7c60d3e7b8a	824	*/
maclobdell	0:f7c60d3e7b8a	825	if( i == 0 ) {
maclobdell	0:f7c60d3e7b8a	826	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &Zi, &u ) );
maclobdell	0:f7c60d3e7b8a	827	}
maclobdell	0:f7c60d3e7b8a	828	else
maclobdell	0:f7c60d3e7b8a	829	{
maclobdell	0:f7c60d3e7b8a	830	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &Zi, &u, &c[i-1] ) ); MOD_MUL( Zi );
maclobdell	0:f7c60d3e7b8a	831	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &u, &u, &T[i]->Z ) ); MOD_MUL( u );
maclobdell	0:f7c60d3e7b8a	832	}
maclobdell	0:f7c60d3e7b8a	833
maclobdell	0:f7c60d3e7b8a	834	/*
maclobdell	0:f7c60d3e7b8a	835	* proceed as in normalize()
maclobdell	0:f7c60d3e7b8a	836	*/
maclobdell	0:f7c60d3e7b8a	837	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ZZi, &Zi, &Zi ) ); MOD_MUL( ZZi );
maclobdell	0:f7c60d3e7b8a	838	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T[i]->X, &T[i]->X, &ZZi ) ); MOD_MUL( T[i]->X );
maclobdell	0:f7c60d3e7b8a	839	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T[i]->Y, &T[i]->Y, &ZZi ) ); MOD_MUL( T[i]->Y );
maclobdell	0:f7c60d3e7b8a	840	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T[i]->Y, &T[i]->Y, &Zi ) ); MOD_MUL( T[i]->Y );
maclobdell	0:f7c60d3e7b8a	841
maclobdell	0:f7c60d3e7b8a	842	/*
maclobdell	0:f7c60d3e7b8a	843	* Post-precessing: reclaim some memory by shrinking coordinates
maclobdell	0:f7c60d3e7b8a	844	* - not storing Z (always 1)
maclobdell	0:f7c60d3e7b8a	845	* - shrinking other coordinates, but still keeping the same number of
maclobdell	0:f7c60d3e7b8a	846	* limbs as P, as otherwise it will too likely be regrown too fast.
maclobdell	0:f7c60d3e7b8a	847	*/
maclobdell	0:f7c60d3e7b8a	848	MBEDTLS_MPI_CHK( mbedtls_mpi_shrink( &T[i]->X, grp->P.n ) );
maclobdell	0:f7c60d3e7b8a	849	MBEDTLS_MPI_CHK( mbedtls_mpi_shrink( &T[i]->Y, grp->P.n ) );
maclobdell	0:f7c60d3e7b8a	850	mbedtls_mpi_free( &T[i]->Z );
maclobdell	0:f7c60d3e7b8a	851
maclobdell	0:f7c60d3e7b8a	852	if( i == 0 )
maclobdell	0:f7c60d3e7b8a	853	break;
maclobdell	0:f7c60d3e7b8a	854	}
maclobdell	0:f7c60d3e7b8a	855
maclobdell	0:f7c60d3e7b8a	856	cleanup:
maclobdell	0:f7c60d3e7b8a	857
maclobdell	0:f7c60d3e7b8a	858	mbedtls_mpi_free( &u ); mbedtls_mpi_free( &Zi ); mbedtls_mpi_free( &ZZi );
maclobdell	0:f7c60d3e7b8a	859	for( i = 0; i < t_len; i++ )
maclobdell	0:f7c60d3e7b8a	860	mbedtls_mpi_free( &c[i] );
maclobdell	0:f7c60d3e7b8a	861	mbedtls_free( c );
maclobdell	0:f7c60d3e7b8a	862
maclobdell	0:f7c60d3e7b8a	863	return( ret );
maclobdell	0:f7c60d3e7b8a	864	}
maclobdell	0:f7c60d3e7b8a	865
maclobdell	0:f7c60d3e7b8a	866	/*
maclobdell	0:f7c60d3e7b8a	867	* Conditional point inversion: Q -> -Q = (Q.X, -Q.Y, Q.Z) without leak.
maclobdell	0:f7c60d3e7b8a	868	* "inv" must be 0 (don't invert) or 1 (invert) or the result will be invalid
maclobdell	0:f7c60d3e7b8a	869	*/
maclobdell	0:f7c60d3e7b8a	870	static int ecp_safe_invert_jac( const mbedtls_ecp_group *grp,
maclobdell	0:f7c60d3e7b8a	871	mbedtls_ecp_point *Q,
maclobdell	0:f7c60d3e7b8a	872	unsigned char inv )
maclobdell	0:f7c60d3e7b8a	873	{
maclobdell	0:f7c60d3e7b8a	874	int ret;
maclobdell	0:f7c60d3e7b8a	875	unsigned char nonzero;
maclobdell	0:f7c60d3e7b8a	876	mbedtls_mpi mQY;
maclobdell	0:f7c60d3e7b8a	877
maclobdell	0:f7c60d3e7b8a	878	mbedtls_mpi_init( &mQY );
maclobdell	0:f7c60d3e7b8a	879
maclobdell	0:f7c60d3e7b8a	880	/* Use the fact that -Q.Y mod P = P - Q.Y unless Q.Y == 0 */
maclobdell	0:f7c60d3e7b8a	881	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &mQY, &grp->P, &Q->Y ) );
maclobdell	0:f7c60d3e7b8a	882	nonzero = mbedtls_mpi_cmp_int( &Q->Y, 0 ) != 0;
maclobdell	0:f7c60d3e7b8a	883	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &Q->Y, &mQY, inv & nonzero ) );
maclobdell	0:f7c60d3e7b8a	884
maclobdell	0:f7c60d3e7b8a	885	cleanup:
maclobdell	0:f7c60d3e7b8a	886	mbedtls_mpi_free( &mQY );
maclobdell	0:f7c60d3e7b8a	887
maclobdell	0:f7c60d3e7b8a	888	return( ret );
maclobdell	0:f7c60d3e7b8a	889	}
maclobdell	0:f7c60d3e7b8a	890
maclobdell	0:f7c60d3e7b8a	891	/*
maclobdell	0:f7c60d3e7b8a	892	* Point doubling R = 2 P, Jacobian coordinates
maclobdell	0:f7c60d3e7b8a	893	*
maclobdell	0:f7c60d3e7b8a	894	* Based on http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#doubling-dbl-1998-cmo-2 .
maclobdell	0:f7c60d3e7b8a	895	*
maclobdell	0:f7c60d3e7b8a	896	* We follow the variable naming fairly closely. The formula variations that trade a MUL for a SQR
maclobdell	0:f7c60d3e7b8a	897	* (plus a few ADDs) aren't useful as our bignum implementation doesn't distinguish squaring.
maclobdell	0:f7c60d3e7b8a	898	*
maclobdell	0:f7c60d3e7b8a	899	* Standard optimizations are applied when curve parameter A is one of { 0, -3 }.
maclobdell	0:f7c60d3e7b8a	900	*
maclobdell	0:f7c60d3e7b8a	901	* Cost: 1D := 3M + 4S (A == 0)
maclobdell	0:f7c60d3e7b8a	902	* 4M + 4S (A == -3)
maclobdell	0:f7c60d3e7b8a	903	* 3M + 6S + 1a otherwise
maclobdell	0:f7c60d3e7b8a	904	*/
maclobdell	0:f7c60d3e7b8a	905	static int ecp_double_jac( const mbedtls_ecp_group grp, mbedtls_ecp_point R,
maclobdell	0:f7c60d3e7b8a	906	const mbedtls_ecp_point *P )
maclobdell	0:f7c60d3e7b8a	907	{
maclobdell	0:f7c60d3e7b8a	908	int ret;
maclobdell	0:f7c60d3e7b8a	909	mbedtls_mpi M, S, T, U;
maclobdell	0:f7c60d3e7b8a	910
maclobdell	0:f7c60d3e7b8a	911	#if defined(MBEDTLS_SELF_TEST)
maclobdell	0:f7c60d3e7b8a	912	dbl_count++;
maclobdell	0:f7c60d3e7b8a	913	#endif
maclobdell	0:f7c60d3e7b8a	914
maclobdell	0:f7c60d3e7b8a	915	mbedtls_mpi_init( &M ); mbedtls_mpi_init( &S ); mbedtls_mpi_init( &T ); mbedtls_mpi_init( &U );
maclobdell	0:f7c60d3e7b8a	916
maclobdell	0:f7c60d3e7b8a	917	/* Special case for A = -3 */
maclobdell	0:f7c60d3e7b8a	918	if( grp->A.p == NULL )
maclobdell	0:f7c60d3e7b8a	919	{
maclobdell	0:f7c60d3e7b8a	920	/* M = 3(X + Z^2)(X - Z^2) */
maclobdell	0:f7c60d3e7b8a	921	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &P->Z, &P->Z ) ); MOD_MUL( S );
maclobdell	0:f7c60d3e7b8a	922	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &T, &P->X, &S ) ); MOD_ADD( T );
maclobdell	0:f7c60d3e7b8a	923	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &U, &P->X, &S ) ); MOD_SUB( U );
maclobdell	0:f7c60d3e7b8a	924	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &T, &U ) ); MOD_MUL( S );
maclobdell	0:f7c60d3e7b8a	925	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &M, &S, 3 ) ); MOD_ADD( M );
maclobdell	0:f7c60d3e7b8a	926	}
maclobdell	0:f7c60d3e7b8a	927	else
maclobdell	0:f7c60d3e7b8a	928	{
maclobdell	0:f7c60d3e7b8a	929	/* M = 3.X^2 */
maclobdell	0:f7c60d3e7b8a	930	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &P->X, &P->X ) ); MOD_MUL( S );
maclobdell	0:f7c60d3e7b8a	931	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &M, &S, 3 ) ); MOD_ADD( M );
maclobdell	0:f7c60d3e7b8a	932
maclobdell	0:f7c60d3e7b8a	933	/* Optimize away for "koblitz" curves with A = 0 */
maclobdell	0:f7c60d3e7b8a	934	if( mbedtls_mpi_cmp_int( &grp->A, 0 ) != 0 )
maclobdell	0:f7c60d3e7b8a	935	{
maclobdell	0:f7c60d3e7b8a	936	/* M += A.Z^4 */
maclobdell	0:f7c60d3e7b8a	937	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &P->Z, &P->Z ) ); MOD_MUL( S );
maclobdell	0:f7c60d3e7b8a	938	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &S, &S ) ); MOD_MUL( T );
maclobdell	0:f7c60d3e7b8a	939	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &T, &grp->A ) ); MOD_MUL( S );
maclobdell	0:f7c60d3e7b8a	940	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &M, &M, &S ) ); MOD_ADD( M );
maclobdell	0:f7c60d3e7b8a	941	}
maclobdell	0:f7c60d3e7b8a	942	}
maclobdell	0:f7c60d3e7b8a	943
maclobdell	0:f7c60d3e7b8a	944	/* S = 4.X.Y^2 */
maclobdell	0:f7c60d3e7b8a	945	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &P->Y, &P->Y ) ); MOD_MUL( T );
maclobdell	0:f7c60d3e7b8a	946	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &T, 1 ) ); MOD_ADD( T );
maclobdell	0:f7c60d3e7b8a	947	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &P->X, &T ) ); MOD_MUL( S );
maclobdell	0:f7c60d3e7b8a	948	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &S, 1 ) ); MOD_ADD( S );
maclobdell	0:f7c60d3e7b8a	949
maclobdell	0:f7c60d3e7b8a	950	/* U = 8.Y^4 */
maclobdell	0:f7c60d3e7b8a	951	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &U, &T, &T ) ); MOD_MUL( U );
maclobdell	0:f7c60d3e7b8a	952	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &U, 1 ) ); MOD_ADD( U );
maclobdell	0:f7c60d3e7b8a	953
maclobdell	0:f7c60d3e7b8a	954	/* T = M^2 - 2.S */
maclobdell	0:f7c60d3e7b8a	955	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &M, &M ) ); MOD_MUL( T );
maclobdell	0:f7c60d3e7b8a	956	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T, &T, &S ) ); MOD_SUB( T );
maclobdell	0:f7c60d3e7b8a	957	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T, &T, &S ) ); MOD_SUB( T );
maclobdell	0:f7c60d3e7b8a	958
maclobdell	0:f7c60d3e7b8a	959	/* S = M(S - T) - U */
maclobdell	0:f7c60d3e7b8a	960	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &S, &S, &T ) ); MOD_SUB( S );
maclobdell	0:f7c60d3e7b8a	961	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S, &S, &M ) ); MOD_MUL( S );
maclobdell	0:f7c60d3e7b8a	962	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &S, &S, &U ) ); MOD_SUB( S );
maclobdell	0:f7c60d3e7b8a	963
maclobdell	0:f7c60d3e7b8a	964	/* U = 2.Y.Z */
maclobdell	0:f7c60d3e7b8a	965	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &U, &P->Y, &P->Z ) ); MOD_MUL( U );
maclobdell	0:f7c60d3e7b8a	966	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &U, 1 ) ); MOD_ADD( U );
maclobdell	0:f7c60d3e7b8a	967
maclobdell	0:f7c60d3e7b8a	968	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->X, &T ) );
maclobdell	0:f7c60d3e7b8a	969	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Y, &S ) );
maclobdell	0:f7c60d3e7b8a	970	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Z, &U ) );
maclobdell	0:f7c60d3e7b8a	971
maclobdell	0:f7c60d3e7b8a	972	cleanup:
maclobdell	0:f7c60d3e7b8a	973	mbedtls_mpi_free( &M ); mbedtls_mpi_free( &S ); mbedtls_mpi_free( &T ); mbedtls_mpi_free( &U );
maclobdell	0:f7c60d3e7b8a	974
maclobdell	0:f7c60d3e7b8a	975	return( ret );
maclobdell	0:f7c60d3e7b8a	976	}
maclobdell	0:f7c60d3e7b8a	977
maclobdell	0:f7c60d3e7b8a	978	/*
maclobdell	0:f7c60d3e7b8a	979	* Addition: R = P + Q, mixed affine-Jacobian coordinates (GECC 3.22)
maclobdell	0:f7c60d3e7b8a	980	*
maclobdell	0:f7c60d3e7b8a	981	* The coordinates of Q must be normalized (= affine),
maclobdell	0:f7c60d3e7b8a	982	* but those of P don't need to. R is not normalized.
maclobdell	0:f7c60d3e7b8a	983	*
maclobdell	0:f7c60d3e7b8a	984	* Special cases: (1) P or Q is zero, (2) R is zero, (3) P == Q.
maclobdell	0:f7c60d3e7b8a	985	* None of these cases can happen as intermediate step in ecp_mul_comb():
maclobdell	0:f7c60d3e7b8a	986	* - at each step, P, Q and R are multiples of the base point, the factor
maclobdell	0:f7c60d3e7b8a	987	* being less than its order, so none of them is zero;
maclobdell	0:f7c60d3e7b8a	988	* - Q is an odd multiple of the base point, P an even multiple,
maclobdell	0:f7c60d3e7b8a	989	* due to the choice of precomputed points in the modified comb method.
maclobdell	0:f7c60d3e7b8a	990	* So branches for these cases do not leak secret information.
maclobdell	0:f7c60d3e7b8a	991	*
maclobdell	0:f7c60d3e7b8a	992	* We accept Q->Z being unset (saving memory in tables) as meaning 1.
maclobdell	0:f7c60d3e7b8a	993	*
maclobdell	0:f7c60d3e7b8a	994	* Cost: 1A := 8M + 3S
maclobdell	0:f7c60d3e7b8a	995	*/
maclobdell	0:f7c60d3e7b8a	996	static int ecp_add_mixed( const mbedtls_ecp_group grp, mbedtls_ecp_point R,
maclobdell	0:f7c60d3e7b8a	997	const mbedtls_ecp_point P, const mbedtls_ecp_point Q )
maclobdell	0:f7c60d3e7b8a	998	{
maclobdell	0:f7c60d3e7b8a	999	int ret;
maclobdell	0:f7c60d3e7b8a	1000	mbedtls_mpi T1, T2, T3, T4, X, Y, Z;
maclobdell	0:f7c60d3e7b8a	1001
maclobdell	0:f7c60d3e7b8a	1002	#if defined(MBEDTLS_SELF_TEST)
maclobdell	0:f7c60d3e7b8a	1003	add_count++;
maclobdell	0:f7c60d3e7b8a	1004	#endif
maclobdell	0:f7c60d3e7b8a	1005
maclobdell	0:f7c60d3e7b8a	1006	/*
maclobdell	0:f7c60d3e7b8a	1007	* Trivial cases: P == 0 or Q == 0 (case 1)
maclobdell	0:f7c60d3e7b8a	1008	*/
maclobdell	0:f7c60d3e7b8a	1009	if( mbedtls_mpi_cmp_int( &P->Z, 0 ) == 0 )
maclobdell	0:f7c60d3e7b8a	1010	return( mbedtls_ecp_copy( R, Q ) );
maclobdell	0:f7c60d3e7b8a	1011
maclobdell	0:f7c60d3e7b8a	1012	if( Q->Z.p != NULL && mbedtls_mpi_cmp_int( &Q->Z, 0 ) == 0 )
maclobdell	0:f7c60d3e7b8a	1013	return( mbedtls_ecp_copy( R, P ) );
maclobdell	0:f7c60d3e7b8a	1014
maclobdell	0:f7c60d3e7b8a	1015	/*
maclobdell	0:f7c60d3e7b8a	1016	* Make sure Q coordinates are normalized
maclobdell	0:f7c60d3e7b8a	1017	*/
maclobdell	0:f7c60d3e7b8a	1018	if( Q->Z.p != NULL && mbedtls_mpi_cmp_int( &Q->Z, 1 ) != 0 )
maclobdell	0:f7c60d3e7b8a	1019	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	1020
maclobdell	0:f7c60d3e7b8a	1021	mbedtls_mpi_init( &T1 ); mbedtls_mpi_init( &T2 ); mbedtls_mpi_init( &T3 ); mbedtls_mpi_init( &T4 );
maclobdell	0:f7c60d3e7b8a	1022	mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y ); mbedtls_mpi_init( &Z );
maclobdell	0:f7c60d3e7b8a	1023
maclobdell	0:f7c60d3e7b8a	1024	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &P->Z, &P->Z ) ); MOD_MUL( T1 );
maclobdell	0:f7c60d3e7b8a	1025	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T2, &T1, &P->Z ) ); MOD_MUL( T2 );
maclobdell	0:f7c60d3e7b8a	1026	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &T1, &Q->X ) ); MOD_MUL( T1 );
maclobdell	0:f7c60d3e7b8a	1027	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T2, &T2, &Q->Y ) ); MOD_MUL( T2 );
maclobdell	0:f7c60d3e7b8a	1028	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T1, &T1, &P->X ) ); MOD_SUB( T1 );
maclobdell	0:f7c60d3e7b8a	1029	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T2, &T2, &P->Y ) ); MOD_SUB( T2 );
maclobdell	0:f7c60d3e7b8a	1030
maclobdell	0:f7c60d3e7b8a	1031	/* Special cases (2) and (3) */
maclobdell	0:f7c60d3e7b8a	1032	if( mbedtls_mpi_cmp_int( &T1, 0 ) == 0 )
maclobdell	0:f7c60d3e7b8a	1033	{
maclobdell	0:f7c60d3e7b8a	1034	if( mbedtls_mpi_cmp_int( &T2, 0 ) == 0 )
maclobdell	0:f7c60d3e7b8a	1035	{
maclobdell	0:f7c60d3e7b8a	1036	ret = ecp_double_jac( grp, R, P );
maclobdell	0:f7c60d3e7b8a	1037	goto cleanup;
maclobdell	0:f7c60d3e7b8a	1038	}
maclobdell	0:f7c60d3e7b8a	1039	else
maclobdell	0:f7c60d3e7b8a	1040	{
maclobdell	0:f7c60d3e7b8a	1041	ret = mbedtls_ecp_set_zero( R );
maclobdell	0:f7c60d3e7b8a	1042	goto cleanup;
maclobdell	0:f7c60d3e7b8a	1043	}
maclobdell	0:f7c60d3e7b8a	1044	}
maclobdell	0:f7c60d3e7b8a	1045
maclobdell	0:f7c60d3e7b8a	1046	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &Z, &P->Z, &T1 ) ); MOD_MUL( Z );
maclobdell	0:f7c60d3e7b8a	1047	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T3, &T1, &T1 ) ); MOD_MUL( T3 );
maclobdell	0:f7c60d3e7b8a	1048	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T4, &T3, &T1 ) ); MOD_MUL( T4 );
maclobdell	0:f7c60d3e7b8a	1049	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T3, &T3, &P->X ) ); MOD_MUL( T3 );
maclobdell	0:f7c60d3e7b8a	1050	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &T1, &T3, 2 ) ); MOD_ADD( T1 );
maclobdell	0:f7c60d3e7b8a	1051	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &X, &T2, &T2 ) ); MOD_MUL( X );
maclobdell	0:f7c60d3e7b8a	1052	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &X, &X, &T1 ) ); MOD_SUB( X );
maclobdell	0:f7c60d3e7b8a	1053	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &X, &X, &T4 ) ); MOD_SUB( X );
maclobdell	0:f7c60d3e7b8a	1054	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T3, &T3, &X ) ); MOD_SUB( T3 );
maclobdell	0:f7c60d3e7b8a	1055	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T3, &T3, &T2 ) ); MOD_MUL( T3 );
maclobdell	0:f7c60d3e7b8a	1056	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T4, &T4, &P->Y ) ); MOD_MUL( T4 );
maclobdell	0:f7c60d3e7b8a	1057	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &Y, &T3, &T4 ) ); MOD_SUB( Y );
maclobdell	0:f7c60d3e7b8a	1058
maclobdell	0:f7c60d3e7b8a	1059	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->X, &X ) );
maclobdell	0:f7c60d3e7b8a	1060	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Y, &Y ) );
maclobdell	0:f7c60d3e7b8a	1061	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Z, &Z ) );
maclobdell	0:f7c60d3e7b8a	1062
maclobdell	0:f7c60d3e7b8a	1063	cleanup:
maclobdell	0:f7c60d3e7b8a	1064
maclobdell	0:f7c60d3e7b8a	1065	mbedtls_mpi_free( &T1 ); mbedtls_mpi_free( &T2 ); mbedtls_mpi_free( &T3 ); mbedtls_mpi_free( &T4 );
maclobdell	0:f7c60d3e7b8a	1066	mbedtls_mpi_free( &X ); mbedtls_mpi_free( &Y ); mbedtls_mpi_free( &Z );
maclobdell	0:f7c60d3e7b8a	1067
maclobdell	0:f7c60d3e7b8a	1068	return( ret );
maclobdell	0:f7c60d3e7b8a	1069	}
maclobdell	0:f7c60d3e7b8a	1070
maclobdell	0:f7c60d3e7b8a	1071	/*
maclobdell	0:f7c60d3e7b8a	1072	* Randomize jacobian coordinates:
maclobdell	0:f7c60d3e7b8a	1073	* (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l
maclobdell	0:f7c60d3e7b8a	1074	* This is sort of the reverse operation of ecp_normalize_jac().
maclobdell	0:f7c60d3e7b8a	1075	*
maclobdell	0:f7c60d3e7b8a	1076	* This countermeasure was first suggested in [2].
maclobdell	0:f7c60d3e7b8a	1077	*/
maclobdell	0:f7c60d3e7b8a	1078	static int ecp_randomize_jac( const mbedtls_ecp_group grp, mbedtls_ecp_point pt,
maclobdell	0:f7c60d3e7b8a	1079	int (f_rng)(void , unsigned char , size_t), void p_rng )
maclobdell	0:f7c60d3e7b8a	1080	{
maclobdell	0:f7c60d3e7b8a	1081	int ret;
maclobdell	0:f7c60d3e7b8a	1082	mbedtls_mpi l, ll;
maclobdell	0:f7c60d3e7b8a	1083	size_t p_size = ( grp->pbits + 7 ) / 8;
maclobdell	0:f7c60d3e7b8a	1084	int count = 0;
maclobdell	0:f7c60d3e7b8a	1085
maclobdell	0:f7c60d3e7b8a	1086	mbedtls_mpi_init( &l ); mbedtls_mpi_init( &ll );
maclobdell	0:f7c60d3e7b8a	1087
maclobdell	0:f7c60d3e7b8a	1088	/* Generate l such that 1 < l < p */
maclobdell	0:f7c60d3e7b8a	1089	do
maclobdell	0:f7c60d3e7b8a	1090	{
maclobdell	0:f7c60d3e7b8a	1091	mbedtls_mpi_fill_random( &l, p_size, f_rng, p_rng );
maclobdell	0:f7c60d3e7b8a	1092
maclobdell	0:f7c60d3e7b8a	1093	while( mbedtls_mpi_cmp_mpi( &l, &grp->P ) >= 0 )
maclobdell	0:f7c60d3e7b8a	1094	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, 1 ) );
maclobdell	0:f7c60d3e7b8a	1095
maclobdell	0:f7c60d3e7b8a	1096	if( count++ > 10 )
maclobdell	0:f7c60d3e7b8a	1097	return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
maclobdell	0:f7c60d3e7b8a	1098	}
maclobdell	0:f7c60d3e7b8a	1099	while( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 );
maclobdell	0:f7c60d3e7b8a	1100
maclobdell	0:f7c60d3e7b8a	1101	/* Z = l * Z */
maclobdell	0:f7c60d3e7b8a	1102	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &pt->Z, &pt->Z, &l ) ); MOD_MUL( pt->Z );
maclobdell	0:f7c60d3e7b8a	1103
maclobdell	0:f7c60d3e7b8a	1104	/* X = l^2 * X */
maclobdell	0:f7c60d3e7b8a	1105	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ll, &l, &l ) ); MOD_MUL( ll );
maclobdell	0:f7c60d3e7b8a	1106	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &pt->X, &pt->X, &ll ) ); MOD_MUL( pt->X );
maclobdell	0:f7c60d3e7b8a	1107
maclobdell	0:f7c60d3e7b8a	1108	/* Y = l^3 * Y */
maclobdell	0:f7c60d3e7b8a	1109	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ll, &ll, &l ) ); MOD_MUL( ll );
maclobdell	0:f7c60d3e7b8a	1110	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &pt->Y, &pt->Y, &ll ) ); MOD_MUL( pt->Y );
maclobdell	0:f7c60d3e7b8a	1111
maclobdell	0:f7c60d3e7b8a	1112	cleanup:
maclobdell	0:f7c60d3e7b8a	1113	mbedtls_mpi_free( &l ); mbedtls_mpi_free( &ll );
maclobdell	0:f7c60d3e7b8a	1114
maclobdell	0:f7c60d3e7b8a	1115	return( ret );
maclobdell	0:f7c60d3e7b8a	1116	}
maclobdell	0:f7c60d3e7b8a	1117
maclobdell	0:f7c60d3e7b8a	1118	/*
maclobdell	0:f7c60d3e7b8a	1119	* Check and define parameters used by the comb method (see below for details)
maclobdell	0:f7c60d3e7b8a	1120	*/
maclobdell	0:f7c60d3e7b8a	1121	#if MBEDTLS_ECP_WINDOW_SIZE < 2 \|\| MBEDTLS_ECP_WINDOW_SIZE > 7
maclobdell	0:f7c60d3e7b8a	1122	#error "MBEDTLS_ECP_WINDOW_SIZE out of bounds"
maclobdell	0:f7c60d3e7b8a	1123	#endif
maclobdell	0:f7c60d3e7b8a	1124
maclobdell	0:f7c60d3e7b8a	1125	/* d = ceil( n / w ) */
maclobdell	0:f7c60d3e7b8a	1126	#define COMB_MAX_D ( MBEDTLS_ECP_MAX_BITS + 1 ) / 2
maclobdell	0:f7c60d3e7b8a	1127
maclobdell	0:f7c60d3e7b8a	1128	/* number of precomputed points */
maclobdell	0:f7c60d3e7b8a	1129	#define COMB_MAX_PRE ( 1 << ( MBEDTLS_ECP_WINDOW_SIZE - 1 ) )
maclobdell	0:f7c60d3e7b8a	1130
maclobdell	0:f7c60d3e7b8a	1131	/*
maclobdell	0:f7c60d3e7b8a	1132	* Compute the representation of m that will be used with our comb method.
maclobdell	0:f7c60d3e7b8a	1133	*
maclobdell	0:f7c60d3e7b8a	1134	* The basic comb method is described in GECC 3.44 for example. We use a
maclobdell	0:f7c60d3e7b8a	1135	* modified version that provides resistance to SPA by avoiding zero
maclobdell	0:f7c60d3e7b8a	1136	* digits in the representation as in [3]. We modify the method further by
maclobdell	0:f7c60d3e7b8a	1137	* requiring that all K_i be odd, which has the small cost that our
maclobdell	0:f7c60d3e7b8a	1138	* representation uses one more K_i, due to carries.
maclobdell	0:f7c60d3e7b8a	1139	*
maclobdell	0:f7c60d3e7b8a	1140	* Also, for the sake of compactness, only the seven low-order bits of x[i]
maclobdell	0:f7c60d3e7b8a	1141	* are used to represent K_i, and the msb of x[i] encodes the the sign (s_i in
maclobdell	0:f7c60d3e7b8a	1142	* the paper): it is set if and only if if s_i == -1;
maclobdell	0:f7c60d3e7b8a	1143	*
maclobdell	0:f7c60d3e7b8a	1144	* Calling conventions:
maclobdell	0:f7c60d3e7b8a	1145	* - x is an array of size d + 1
maclobdell	0:f7c60d3e7b8a	1146	* - w is the size, ie number of teeth, of the comb, and must be between
maclobdell	0:f7c60d3e7b8a	1147	* 2 and 7 (in practice, between 2 and MBEDTLS_ECP_WINDOW_SIZE)
maclobdell	0:f7c60d3e7b8a	1148	* - m is the MPI, expected to be odd and such that bitlength(m) <= w * d
maclobdell	0:f7c60d3e7b8a	1149	* (the result will be incorrect if these assumptions are not satisfied)
maclobdell	0:f7c60d3e7b8a	1150	*/
maclobdell	0:f7c60d3e7b8a	1151	static void ecp_comb_fixed( unsigned char x[], size_t d,
maclobdell	0:f7c60d3e7b8a	1152	unsigned char w, const mbedtls_mpi *m )
maclobdell	0:f7c60d3e7b8a	1153	{
maclobdell	0:f7c60d3e7b8a	1154	size_t i, j;
maclobdell	0:f7c60d3e7b8a	1155	unsigned char c, cc, adjust;
maclobdell	0:f7c60d3e7b8a	1156
maclobdell	0:f7c60d3e7b8a	1157	memset( x, 0, d+1 );
maclobdell	0:f7c60d3e7b8a	1158
maclobdell	0:f7c60d3e7b8a	1159	/* First get the classical comb values (except for x_d = 0) */
maclobdell	0:f7c60d3e7b8a	1160	for( i = 0; i < d; i++ )
maclobdell	0:f7c60d3e7b8a	1161	for( j = 0; j < w; j++ )
maclobdell	0:f7c60d3e7b8a	1162	x[i] \|= mbedtls_mpi_get_bit( m, i + d * j ) << j;
maclobdell	0:f7c60d3e7b8a	1163
maclobdell	0:f7c60d3e7b8a	1164	/* Now make sure x_1 .. x_d are odd */
maclobdell	0:f7c60d3e7b8a	1165	c = 0;
maclobdell	0:f7c60d3e7b8a	1166	for( i = 1; i <= d; i++ )
maclobdell	0:f7c60d3e7b8a	1167	{
maclobdell	0:f7c60d3e7b8a	1168	/* Add carry and update it */
maclobdell	0:f7c60d3e7b8a	1169	cc = x[i] & c;
maclobdell	0:f7c60d3e7b8a	1170	x[i] = x[i] ^ c;
maclobdell	0:f7c60d3e7b8a	1171	c = cc;
maclobdell	0:f7c60d3e7b8a	1172
maclobdell	0:f7c60d3e7b8a	1173	/* Adjust if needed, avoiding branches */
maclobdell	0:f7c60d3e7b8a	1174	adjust = 1 - ( x[i] & 0x01 );
maclobdell	0:f7c60d3e7b8a	1175	c \|= x[i] & ( x[i-1] * adjust );
maclobdell	0:f7c60d3e7b8a	1176	x[i] = x[i] ^ ( x[i-1] * adjust );
maclobdell	0:f7c60d3e7b8a	1177	x[i-1] \|= adjust << 7;
maclobdell	0:f7c60d3e7b8a	1178	}
maclobdell	0:f7c60d3e7b8a	1179	}
maclobdell	0:f7c60d3e7b8a	1180
maclobdell	0:f7c60d3e7b8a	1181	/*
maclobdell	0:f7c60d3e7b8a	1182	* Precompute points for the comb method
maclobdell	0:f7c60d3e7b8a	1183	*
maclobdell	0:f7c60d3e7b8a	1184	* If i = i_{w-1} ... i_1 is the binary representation of i, then
maclobdell	0:f7c60d3e7b8a	1185	* T[i] = i_{w-1} 2^{(w-1)d} P + ... + i_1 2^d P + P
maclobdell	0:f7c60d3e7b8a	1186	*
maclobdell	0:f7c60d3e7b8a	1187	* T must be able to hold 2^{w - 1} elements
maclobdell	0:f7c60d3e7b8a	1188	*
maclobdell	0:f7c60d3e7b8a	1189	* Cost: d(w-1) D + (2^{w-1} - 1) A + 1 N(w-1) + 1 N(2^{w-1} - 1)
maclobdell	0:f7c60d3e7b8a	1190	*/
maclobdell	0:f7c60d3e7b8a	1191	static int ecp_precompute_comb( const mbedtls_ecp_group *grp,
maclobdell	0:f7c60d3e7b8a	1192	mbedtls_ecp_point T[], const mbedtls_ecp_point *P,
maclobdell	0:f7c60d3e7b8a	1193	unsigned char w, size_t d )
maclobdell	0:f7c60d3e7b8a	1194	{
maclobdell	0:f7c60d3e7b8a	1195	int ret;
maclobdell	0:f7c60d3e7b8a	1196	unsigned char i, k;
maclobdell	0:f7c60d3e7b8a	1197	size_t j;
maclobdell	0:f7c60d3e7b8a	1198	mbedtls_ecp_point cur, TT[COMB_MAX_PRE - 1];
maclobdell	0:f7c60d3e7b8a	1199
maclobdell	0:f7c60d3e7b8a	1200	/*
maclobdell	0:f7c60d3e7b8a	1201	* Set T[0] = P and
maclobdell	0:f7c60d3e7b8a	1202	* T[2^{l-1}] = 2^{dl} P for l = 1 .. w-1 (this is not the final value)
maclobdell	0:f7c60d3e7b8a	1203	*/
maclobdell	0:f7c60d3e7b8a	1204	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &T[0], P ) );
maclobdell	0:f7c60d3e7b8a	1205
maclobdell	0:f7c60d3e7b8a	1206	k = 0;
maclobdell	0:f7c60d3e7b8a	1207	for( i = 1; i < ( 1U << ( w - 1 ) ); i <<= 1 )
maclobdell	0:f7c60d3e7b8a	1208	{
maclobdell	0:f7c60d3e7b8a	1209	cur = T + i;
maclobdell	0:f7c60d3e7b8a	1210	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( cur, T + ( i >> 1 ) ) );
maclobdell	0:f7c60d3e7b8a	1211	for( j = 0; j < d; j++ )
maclobdell	0:f7c60d3e7b8a	1212	MBEDTLS_MPI_CHK( ecp_double_jac( grp, cur, cur ) );
maclobdell	0:f7c60d3e7b8a	1213
maclobdell	0:f7c60d3e7b8a	1214	TT[k++] = cur;
maclobdell	0:f7c60d3e7b8a	1215	}
maclobdell	0:f7c60d3e7b8a	1216
maclobdell	0:f7c60d3e7b8a	1217	MBEDTLS_MPI_CHK( ecp_normalize_jac_many( grp, TT, k ) );
maclobdell	0:f7c60d3e7b8a	1218
maclobdell	0:f7c60d3e7b8a	1219	/*
maclobdell	0:f7c60d3e7b8a	1220	* Compute the remaining ones using the minimal number of additions
maclobdell	0:f7c60d3e7b8a	1221	* Be careful to update T[2^l] only after using it!
maclobdell	0:f7c60d3e7b8a	1222	*/
maclobdell	0:f7c60d3e7b8a	1223	k = 0;
maclobdell	0:f7c60d3e7b8a	1224	for( i = 1; i < ( 1U << ( w - 1 ) ); i <<= 1 )
maclobdell	0:f7c60d3e7b8a	1225	{
maclobdell	0:f7c60d3e7b8a	1226	j = i;
maclobdell	0:f7c60d3e7b8a	1227	while( j-- )
maclobdell	0:f7c60d3e7b8a	1228	{
maclobdell	0:f7c60d3e7b8a	1229	MBEDTLS_MPI_CHK( ecp_add_mixed( grp, &T[i + j], &T[j], &T[i] ) );
maclobdell	0:f7c60d3e7b8a	1230	TT[k++] = &T[i + j];
maclobdell	0:f7c60d3e7b8a	1231	}
maclobdell	0:f7c60d3e7b8a	1232	}
maclobdell	0:f7c60d3e7b8a	1233
maclobdell	0:f7c60d3e7b8a	1234	MBEDTLS_MPI_CHK( ecp_normalize_jac_many( grp, TT, k ) );
maclobdell	0:f7c60d3e7b8a	1235
maclobdell	0:f7c60d3e7b8a	1236	cleanup:
maclobdell	0:f7c60d3e7b8a	1237	return( ret );
maclobdell	0:f7c60d3e7b8a	1238	}
maclobdell	0:f7c60d3e7b8a	1239
maclobdell	0:f7c60d3e7b8a	1240	/*
maclobdell	0:f7c60d3e7b8a	1241	* Select precomputed point: R = sign(i) * T[ abs(i) / 2 ]
maclobdell	0:f7c60d3e7b8a	1242	*/
maclobdell	0:f7c60d3e7b8a	1243	static int ecp_select_comb( const mbedtls_ecp_group grp, mbedtls_ecp_point R,
maclobdell	0:f7c60d3e7b8a	1244	const mbedtls_ecp_point T[], unsigned char t_len,
maclobdell	0:f7c60d3e7b8a	1245	unsigned char i )
maclobdell	0:f7c60d3e7b8a	1246	{
maclobdell	0:f7c60d3e7b8a	1247	int ret;
maclobdell	0:f7c60d3e7b8a	1248	unsigned char ii, j;
maclobdell	0:f7c60d3e7b8a	1249
maclobdell	0:f7c60d3e7b8a	1250	/* Ignore the "sign" bit and scale down */
maclobdell	0:f7c60d3e7b8a	1251	ii = ( i & 0x7Fu ) >> 1;
maclobdell	0:f7c60d3e7b8a	1252
maclobdell	0:f7c60d3e7b8a	1253	/* Read the whole table to thwart cache-based timing attacks */
maclobdell	0:f7c60d3e7b8a	1254	for( j = 0; j < t_len; j++ )
maclobdell	0:f7c60d3e7b8a	1255	{
maclobdell	0:f7c60d3e7b8a	1256	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &R->X, &T[j].X, j == ii ) );
maclobdell	0:f7c60d3e7b8a	1257	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &R->Y, &T[j].Y, j == ii ) );
maclobdell	0:f7c60d3e7b8a	1258	}
maclobdell	0:f7c60d3e7b8a	1259
maclobdell	0:f7c60d3e7b8a	1260	/* Safely invert result if i is "negative" */
maclobdell	0:f7c60d3e7b8a	1261	MBEDTLS_MPI_CHK( ecp_safe_invert_jac( grp, R, i >> 7 ) );
maclobdell	0:f7c60d3e7b8a	1262
maclobdell	0:f7c60d3e7b8a	1263	cleanup:
maclobdell	0:f7c60d3e7b8a	1264	return( ret );
maclobdell	0:f7c60d3e7b8a	1265	}
maclobdell	0:f7c60d3e7b8a	1266
maclobdell	0:f7c60d3e7b8a	1267	/*
maclobdell	0:f7c60d3e7b8a	1268	* Core multiplication algorithm for the (modified) comb method.
maclobdell	0:f7c60d3e7b8a	1269	* This part is actually common with the basic comb method (GECC 3.44)
maclobdell	0:f7c60d3e7b8a	1270	*
maclobdell	0:f7c60d3e7b8a	1271	* Cost: d A + d D + 1 R
maclobdell	0:f7c60d3e7b8a	1272	*/
maclobdell	0:f7c60d3e7b8a	1273	static int ecp_mul_comb_core( const mbedtls_ecp_group grp, mbedtls_ecp_point R,
maclobdell	0:f7c60d3e7b8a	1274	const mbedtls_ecp_point T[], unsigned char t_len,
maclobdell	0:f7c60d3e7b8a	1275	const unsigned char x[], size_t d,
maclobdell	0:f7c60d3e7b8a	1276	int (f_rng)(void , unsigned char *, size_t),
maclobdell	0:f7c60d3e7b8a	1277	void *p_rng )
maclobdell	0:f7c60d3e7b8a	1278	{
maclobdell	0:f7c60d3e7b8a	1279	int ret;
maclobdell	0:f7c60d3e7b8a	1280	mbedtls_ecp_point Txi;
maclobdell	0:f7c60d3e7b8a	1281	size_t i;
maclobdell	0:f7c60d3e7b8a	1282
maclobdell	0:f7c60d3e7b8a	1283	mbedtls_ecp_point_init( &Txi );
maclobdell	0:f7c60d3e7b8a	1284
maclobdell	0:f7c60d3e7b8a	1285	/* Start with a non-zero point and randomize its coordinates */
maclobdell	0:f7c60d3e7b8a	1286	i = d;
maclobdell	0:f7c60d3e7b8a	1287	MBEDTLS_MPI_CHK( ecp_select_comb( grp, R, T, t_len, x[i] ) );
maclobdell	0:f7c60d3e7b8a	1288	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->Z, 1 ) );
maclobdell	0:f7c60d3e7b8a	1289	if( f_rng != 0 )
maclobdell	0:f7c60d3e7b8a	1290	MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, R, f_rng, p_rng ) );
maclobdell	0:f7c60d3e7b8a	1291
maclobdell	0:f7c60d3e7b8a	1292	while( i-- != 0 )
maclobdell	0:f7c60d3e7b8a	1293	{
maclobdell	0:f7c60d3e7b8a	1294	MBEDTLS_MPI_CHK( ecp_double_jac( grp, R, R ) );
maclobdell	0:f7c60d3e7b8a	1295	MBEDTLS_MPI_CHK( ecp_select_comb( grp, &Txi, T, t_len, x[i] ) );
maclobdell	0:f7c60d3e7b8a	1296	MBEDTLS_MPI_CHK( ecp_add_mixed( grp, R, R, &Txi ) );
maclobdell	0:f7c60d3e7b8a	1297	}
maclobdell	0:f7c60d3e7b8a	1298
maclobdell	0:f7c60d3e7b8a	1299	cleanup:
maclobdell	0:f7c60d3e7b8a	1300	mbedtls_ecp_point_free( &Txi );
maclobdell	0:f7c60d3e7b8a	1301
maclobdell	0:f7c60d3e7b8a	1302	return( ret );
maclobdell	0:f7c60d3e7b8a	1303	}
maclobdell	0:f7c60d3e7b8a	1304
maclobdell	0:f7c60d3e7b8a	1305	/*
maclobdell	0:f7c60d3e7b8a	1306	* Multiplication using the comb method,
maclobdell	0:f7c60d3e7b8a	1307	* for curves in short Weierstrass form
maclobdell	0:f7c60d3e7b8a	1308	*/
maclobdell	0:f7c60d3e7b8a	1309	static int ecp_mul_comb( mbedtls_ecp_group grp, mbedtls_ecp_point R,
maclobdell	0:f7c60d3e7b8a	1310	const mbedtls_mpi m, const mbedtls_ecp_point P,
maclobdell	0:f7c60d3e7b8a	1311	int (f_rng)(void , unsigned char *, size_t),
maclobdell	0:f7c60d3e7b8a	1312	void *p_rng )
maclobdell	0:f7c60d3e7b8a	1313	{
maclobdell	0:f7c60d3e7b8a	1314	int ret;
maclobdell	0:f7c60d3e7b8a	1315	unsigned char w, m_is_odd, p_eq_g, pre_len, i;
maclobdell	0:f7c60d3e7b8a	1316	size_t d;
maclobdell	0:f7c60d3e7b8a	1317	unsigned char k[COMB_MAX_D + 1];
maclobdell	0:f7c60d3e7b8a	1318	mbedtls_ecp_point *T;
maclobdell	0:f7c60d3e7b8a	1319	mbedtls_mpi M, mm;
maclobdell	0:f7c60d3e7b8a	1320
maclobdell	0:f7c60d3e7b8a	1321	mbedtls_mpi_init( &M );
maclobdell	0:f7c60d3e7b8a	1322	mbedtls_mpi_init( &mm );
maclobdell	0:f7c60d3e7b8a	1323
maclobdell	0:f7c60d3e7b8a	1324	/* we need N to be odd to trnaform m in an odd number, check now */
maclobdell	0:f7c60d3e7b8a	1325	if( mbedtls_mpi_get_bit( &grp->N, 0 ) != 1 )
maclobdell	0:f7c60d3e7b8a	1326	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	1327
maclobdell	0:f7c60d3e7b8a	1328	/*
maclobdell	0:f7c60d3e7b8a	1329	* Minimize the number of multiplications, that is minimize
maclobdell	0:f7c60d3e7b8a	1330	* 10 * d * w + 18 * 2^(w-1) + 11 * d + 7 * w, with d = ceil( nbits / w )
maclobdell	0:f7c60d3e7b8a	1331	* (see costs of the various parts, with 1S = 1M)
maclobdell	0:f7c60d3e7b8a	1332	*/
maclobdell	0:f7c60d3e7b8a	1333	w = grp->nbits >= 384 ? 5 : 4;
maclobdell	0:f7c60d3e7b8a	1334
maclobdell	0:f7c60d3e7b8a	1335	/*
maclobdell	0:f7c60d3e7b8a	1336	* If P == G, pre-compute a bit more, since this may be re-used later.
maclobdell	0:f7c60d3e7b8a	1337	* Just adding one avoids upping the cost of the first mul too much,
maclobdell	0:f7c60d3e7b8a	1338	* and the memory cost too.
maclobdell	0:f7c60d3e7b8a	1339	*/
maclobdell	0:f7c60d3e7b8a	1340	#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1
maclobdell	0:f7c60d3e7b8a	1341	p_eq_g = ( mbedtls_mpi_cmp_mpi( &P->Y, &grp->G.Y ) == 0 &&
maclobdell	0:f7c60d3e7b8a	1342	mbedtls_mpi_cmp_mpi( &P->X, &grp->G.X ) == 0 );
maclobdell	0:f7c60d3e7b8a	1343	if( p_eq_g )
maclobdell	0:f7c60d3e7b8a	1344	w++;
maclobdell	0:f7c60d3e7b8a	1345	#else
maclobdell	0:f7c60d3e7b8a	1346	p_eq_g = 0;
maclobdell	0:f7c60d3e7b8a	1347	#endif
maclobdell	0:f7c60d3e7b8a	1348
maclobdell	0:f7c60d3e7b8a	1349	/*
maclobdell	0:f7c60d3e7b8a	1350	* Make sure w is within bounds.
maclobdell	0:f7c60d3e7b8a	1351	* (The last test is useful only for very small curves in the test suite.)
maclobdell	0:f7c60d3e7b8a	1352	*/
maclobdell	0:f7c60d3e7b8a	1353	if( w > MBEDTLS_ECP_WINDOW_SIZE )
maclobdell	0:f7c60d3e7b8a	1354	w = MBEDTLS_ECP_WINDOW_SIZE;
maclobdell	0:f7c60d3e7b8a	1355	if( w >= grp->nbits )
maclobdell	0:f7c60d3e7b8a	1356	w = 2;
maclobdell	0:f7c60d3e7b8a	1357
maclobdell	0:f7c60d3e7b8a	1358	/* Other sizes that depend on w */
maclobdell	0:f7c60d3e7b8a	1359	pre_len = 1U << ( w - 1 );
maclobdell	0:f7c60d3e7b8a	1360	d = ( grp->nbits + w - 1 ) / w;
maclobdell	0:f7c60d3e7b8a	1361
maclobdell	0:f7c60d3e7b8a	1362	/*
maclobdell	0:f7c60d3e7b8a	1363	* Prepare precomputed points: if P == G we want to
maclobdell	0:f7c60d3e7b8a	1364	* use grp->T if already initialized, or initialize it.
maclobdell	0:f7c60d3e7b8a	1365	*/
maclobdell	0:f7c60d3e7b8a	1366	T = p_eq_g ? grp->T : NULL;
maclobdell	0:f7c60d3e7b8a	1367
maclobdell	0:f7c60d3e7b8a	1368	if( T == NULL )
maclobdell	0:f7c60d3e7b8a	1369	{
maclobdell	0:f7c60d3e7b8a	1370	T = mbedtls_calloc( pre_len, sizeof( mbedtls_ecp_point ) );
maclobdell	0:f7c60d3e7b8a	1371	if( T == NULL )
maclobdell	0:f7c60d3e7b8a	1372	{
maclobdell	0:f7c60d3e7b8a	1373	ret = MBEDTLS_ERR_ECP_ALLOC_FAILED;
maclobdell	0:f7c60d3e7b8a	1374	goto cleanup;
maclobdell	0:f7c60d3e7b8a	1375	}
maclobdell	0:f7c60d3e7b8a	1376
maclobdell	0:f7c60d3e7b8a	1377	MBEDTLS_MPI_CHK( ecp_precompute_comb( grp, T, P, w, d ) );
maclobdell	0:f7c60d3e7b8a	1378
maclobdell	0:f7c60d3e7b8a	1379	if( p_eq_g )
maclobdell	0:f7c60d3e7b8a	1380	{
maclobdell	0:f7c60d3e7b8a	1381	grp->T = T;
maclobdell	0:f7c60d3e7b8a	1382	grp->T_size = pre_len;
maclobdell	0:f7c60d3e7b8a	1383	}
maclobdell	0:f7c60d3e7b8a	1384	}
maclobdell	0:f7c60d3e7b8a	1385
maclobdell	0:f7c60d3e7b8a	1386	/*
maclobdell	0:f7c60d3e7b8a	1387	* Make sure M is odd (M = m or M = N - m, since N is odd)
maclobdell	0:f7c60d3e7b8a	1388	* using the fact that m * P = - (N - m) * P
maclobdell	0:f7c60d3e7b8a	1389	*/
maclobdell	0:f7c60d3e7b8a	1390	m_is_odd = ( mbedtls_mpi_get_bit( m, 0 ) == 1 );
maclobdell	0:f7c60d3e7b8a	1391	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &M, m ) );
maclobdell	0:f7c60d3e7b8a	1392	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &mm, &grp->N, m ) );
maclobdell	0:f7c60d3e7b8a	1393	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &M, &mm, ! m_is_odd ) );
maclobdell	0:f7c60d3e7b8a	1394
maclobdell	0:f7c60d3e7b8a	1395	/*
maclobdell	0:f7c60d3e7b8a	1396	* Go for comb multiplication, R = M * P
maclobdell	0:f7c60d3e7b8a	1397	*/
maclobdell	0:f7c60d3e7b8a	1398	ecp_comb_fixed( k, d, w, &M );
maclobdell	0:f7c60d3e7b8a	1399	MBEDTLS_MPI_CHK( ecp_mul_comb_core( grp, R, T, pre_len, k, d, f_rng, p_rng ) );
maclobdell	0:f7c60d3e7b8a	1400
maclobdell	0:f7c60d3e7b8a	1401	/*
maclobdell	0:f7c60d3e7b8a	1402	* Now get m * P from M * P and normalize it
maclobdell	0:f7c60d3e7b8a	1403	*/
maclobdell	0:f7c60d3e7b8a	1404	MBEDTLS_MPI_CHK( ecp_safe_invert_jac( grp, R, ! m_is_odd ) );
maclobdell	0:f7c60d3e7b8a	1405	MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, R ) );
maclobdell	0:f7c60d3e7b8a	1406
maclobdell	0:f7c60d3e7b8a	1407	cleanup:
maclobdell	0:f7c60d3e7b8a	1408
maclobdell	0:f7c60d3e7b8a	1409	if( T != NULL && ! p_eq_g )
maclobdell	0:f7c60d3e7b8a	1410	{
maclobdell	0:f7c60d3e7b8a	1411	for( i = 0; i < pre_len; i++ )
maclobdell	0:f7c60d3e7b8a	1412	mbedtls_ecp_point_free( &T[i] );
maclobdell	0:f7c60d3e7b8a	1413	mbedtls_free( T );
maclobdell	0:f7c60d3e7b8a	1414	}
maclobdell	0:f7c60d3e7b8a	1415
maclobdell	0:f7c60d3e7b8a	1416	mbedtls_mpi_free( &M );
maclobdell	0:f7c60d3e7b8a	1417	mbedtls_mpi_free( &mm );
maclobdell	0:f7c60d3e7b8a	1418
maclobdell	0:f7c60d3e7b8a	1419	if( ret != 0 )
maclobdell	0:f7c60d3e7b8a	1420	mbedtls_ecp_point_free( R );
maclobdell	0:f7c60d3e7b8a	1421
maclobdell	0:f7c60d3e7b8a	1422	return( ret );
maclobdell	0:f7c60d3e7b8a	1423	}
maclobdell	0:f7c60d3e7b8a	1424
maclobdell	0:f7c60d3e7b8a	1425	#endif /* ECP_SHORTWEIERSTRASS */
maclobdell	0:f7c60d3e7b8a	1426
maclobdell	0:f7c60d3e7b8a	1427	#if defined(ECP_MONTGOMERY)
maclobdell	0:f7c60d3e7b8a	1428	/*
maclobdell	0:f7c60d3e7b8a	1429	* For Montgomery curves, we do all the internal arithmetic in projective
maclobdell	0:f7c60d3e7b8a	1430	* coordinates. Import/export of points uses only the x coordinates, which is
maclobdell	0:f7c60d3e7b8a	1431	* internaly represented as X / Z.
maclobdell	0:f7c60d3e7b8a	1432	*
maclobdell	0:f7c60d3e7b8a	1433	* For scalar multiplication, we'll use a Montgomery ladder.
maclobdell	0:f7c60d3e7b8a	1434	*/
maclobdell	0:f7c60d3e7b8a	1435
maclobdell	0:f7c60d3e7b8a	1436	/*
maclobdell	0:f7c60d3e7b8a	1437	* Normalize Montgomery x/z coordinates: X = X/Z, Z = 1
maclobdell	0:f7c60d3e7b8a	1438	* Cost: 1M + 1I
maclobdell	0:f7c60d3e7b8a	1439	*/
maclobdell	0:f7c60d3e7b8a	1440	static int ecp_normalize_mxz( const mbedtls_ecp_group grp, mbedtls_ecp_point P )
maclobdell	0:f7c60d3e7b8a	1441	{
maclobdell	0:f7c60d3e7b8a	1442	int ret;
maclobdell	0:f7c60d3e7b8a	1443
maclobdell	0:f7c60d3e7b8a	1444	MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &P->Z, &P->Z, &grp->P ) );
maclobdell	0:f7c60d3e7b8a	1445	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &P->X, &P->X, &P->Z ) ); MOD_MUL( P->X );
maclobdell	0:f7c60d3e7b8a	1446	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &P->Z, 1 ) );
maclobdell	0:f7c60d3e7b8a	1447
maclobdell	0:f7c60d3e7b8a	1448	cleanup:
maclobdell	0:f7c60d3e7b8a	1449	return( ret );
maclobdell	0:f7c60d3e7b8a	1450	}
maclobdell	0:f7c60d3e7b8a	1451
maclobdell	0:f7c60d3e7b8a	1452	/*
maclobdell	0:f7c60d3e7b8a	1453	* Randomize projective x/z coordinates:
maclobdell	0:f7c60d3e7b8a	1454	* (X, Z) -> (l X, l Z) for random l
maclobdell	0:f7c60d3e7b8a	1455	* This is sort of the reverse operation of ecp_normalize_mxz().
maclobdell	0:f7c60d3e7b8a	1456	*
maclobdell	0:f7c60d3e7b8a	1457	* This countermeasure was first suggested in [2].
maclobdell	0:f7c60d3e7b8a	1458	* Cost: 2M
maclobdell	0:f7c60d3e7b8a	1459	*/
maclobdell	0:f7c60d3e7b8a	1460	static int ecp_randomize_mxz( const mbedtls_ecp_group grp, mbedtls_ecp_point P,
maclobdell	0:f7c60d3e7b8a	1461	int (f_rng)(void , unsigned char , size_t), void p_rng )
maclobdell	0:f7c60d3e7b8a	1462	{
maclobdell	0:f7c60d3e7b8a	1463	int ret;
maclobdell	0:f7c60d3e7b8a	1464	mbedtls_mpi l;
maclobdell	0:f7c60d3e7b8a	1465	size_t p_size = ( grp->pbits + 7 ) / 8;
maclobdell	0:f7c60d3e7b8a	1466	int count = 0;
maclobdell	0:f7c60d3e7b8a	1467
maclobdell	0:f7c60d3e7b8a	1468	mbedtls_mpi_init( &l );
maclobdell	0:f7c60d3e7b8a	1469
maclobdell	0:f7c60d3e7b8a	1470	/* Generate l such that 1 < l < p */
maclobdell	0:f7c60d3e7b8a	1471	do
maclobdell	0:f7c60d3e7b8a	1472	{
maclobdell	0:f7c60d3e7b8a	1473	mbedtls_mpi_fill_random( &l, p_size, f_rng, p_rng );
maclobdell	0:f7c60d3e7b8a	1474
maclobdell	0:f7c60d3e7b8a	1475	while( mbedtls_mpi_cmp_mpi( &l, &grp->P ) >= 0 )
maclobdell	0:f7c60d3e7b8a	1476	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, 1 ) );
maclobdell	0:f7c60d3e7b8a	1477
maclobdell	0:f7c60d3e7b8a	1478	if( count++ > 10 )
maclobdell	0:f7c60d3e7b8a	1479	return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
maclobdell	0:f7c60d3e7b8a	1480	}
maclobdell	0:f7c60d3e7b8a	1481	while( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 );
maclobdell	0:f7c60d3e7b8a	1482
maclobdell	0:f7c60d3e7b8a	1483	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &P->X, &P->X, &l ) ); MOD_MUL( P->X );
maclobdell	0:f7c60d3e7b8a	1484	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &P->Z, &P->Z, &l ) ); MOD_MUL( P->Z );
maclobdell	0:f7c60d3e7b8a	1485
maclobdell	0:f7c60d3e7b8a	1486	cleanup:
maclobdell	0:f7c60d3e7b8a	1487	mbedtls_mpi_free( &l );
maclobdell	0:f7c60d3e7b8a	1488
maclobdell	0:f7c60d3e7b8a	1489	return( ret );
maclobdell	0:f7c60d3e7b8a	1490	}
maclobdell	0:f7c60d3e7b8a	1491
maclobdell	0:f7c60d3e7b8a	1492	/*
maclobdell	0:f7c60d3e7b8a	1493	* Double-and-add: R = 2P, S = P + Q, with d = X(P - Q),
maclobdell	0:f7c60d3e7b8a	1494	* for Montgomery curves in x/z coordinates.
maclobdell	0:f7c60d3e7b8a	1495	*
maclobdell	0:f7c60d3e7b8a	1496	* http://www.hyperelliptic.org/EFD/g1p/auto-code/montgom/xz/ladder/mladd-1987-m.op3
maclobdell	0:f7c60d3e7b8a	1497	* with
maclobdell	0:f7c60d3e7b8a	1498	* d = X1
maclobdell	0:f7c60d3e7b8a	1499	* P = (X2, Z2)
maclobdell	0:f7c60d3e7b8a	1500	* Q = (X3, Z3)
maclobdell	0:f7c60d3e7b8a	1501	* R = (X4, Z4)
maclobdell	0:f7c60d3e7b8a	1502	* S = (X5, Z5)
maclobdell	0:f7c60d3e7b8a	1503	* and eliminating temporary variables tO, ..., t4.
maclobdell	0:f7c60d3e7b8a	1504	*
maclobdell	0:f7c60d3e7b8a	1505	* Cost: 5M + 4S
maclobdell	0:f7c60d3e7b8a	1506	*/
maclobdell	0:f7c60d3e7b8a	1507	static int ecp_double_add_mxz( const mbedtls_ecp_group *grp,
maclobdell	0:f7c60d3e7b8a	1508	mbedtls_ecp_point R, mbedtls_ecp_point S,
maclobdell	0:f7c60d3e7b8a	1509	const mbedtls_ecp_point P, const mbedtls_ecp_point Q,
maclobdell	0:f7c60d3e7b8a	1510	const mbedtls_mpi *d )
maclobdell	0:f7c60d3e7b8a	1511	{
maclobdell	0:f7c60d3e7b8a	1512	int ret;
maclobdell	0:f7c60d3e7b8a	1513	mbedtls_mpi A, AA, B, BB, E, C, D, DA, CB;
maclobdell	0:f7c60d3e7b8a	1514
maclobdell	0:f7c60d3e7b8a	1515	mbedtls_mpi_init( &A ); mbedtls_mpi_init( &AA ); mbedtls_mpi_init( &B );
maclobdell	0:f7c60d3e7b8a	1516	mbedtls_mpi_init( &BB ); mbedtls_mpi_init( &E ); mbedtls_mpi_init( &C );
maclobdell	0:f7c60d3e7b8a	1517	mbedtls_mpi_init( &D ); mbedtls_mpi_init( &DA ); mbedtls_mpi_init( &CB );
maclobdell	0:f7c60d3e7b8a	1518
maclobdell	0:f7c60d3e7b8a	1519	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &A, &P->X, &P->Z ) ); MOD_ADD( A );
maclobdell	0:f7c60d3e7b8a	1520	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &AA, &A, &A ) ); MOD_MUL( AA );
maclobdell	0:f7c60d3e7b8a	1521	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &B, &P->X, &P->Z ) ); MOD_SUB( B );
maclobdell	0:f7c60d3e7b8a	1522	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &BB, &B, &B ) ); MOD_MUL( BB );
maclobdell	0:f7c60d3e7b8a	1523	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &E, &AA, &BB ) ); MOD_SUB( E );
maclobdell	0:f7c60d3e7b8a	1524	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &C, &Q->X, &Q->Z ) ); MOD_ADD( C );
maclobdell	0:f7c60d3e7b8a	1525	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &D, &Q->X, &Q->Z ) ); MOD_SUB( D );
maclobdell	0:f7c60d3e7b8a	1526	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DA, &D, &A ) ); MOD_MUL( DA );
maclobdell	0:f7c60d3e7b8a	1527	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &CB, &C, &B ) ); MOD_MUL( CB );
maclobdell	0:f7c60d3e7b8a	1528	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &S->X, &DA, &CB ) ); MOD_MUL( S->X );
maclobdell	0:f7c60d3e7b8a	1529	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S->X, &S->X, &S->X ) ); MOD_MUL( S->X );
maclobdell	0:f7c60d3e7b8a	1530	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &S->Z, &DA, &CB ) ); MOD_SUB( S->Z );
maclobdell	0:f7c60d3e7b8a	1531	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S->Z, &S->Z, &S->Z ) ); MOD_MUL( S->Z );
maclobdell	0:f7c60d3e7b8a	1532	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &S->Z, d, &S->Z ) ); MOD_MUL( S->Z );
maclobdell	0:f7c60d3e7b8a	1533	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &R->X, &AA, &BB ) ); MOD_MUL( R->X );
maclobdell	0:f7c60d3e7b8a	1534	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &R->Z, &grp->A, &E ) ); MOD_MUL( R->Z );
maclobdell	0:f7c60d3e7b8a	1535	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &R->Z, &BB, &R->Z ) ); MOD_ADD( R->Z );
maclobdell	0:f7c60d3e7b8a	1536	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &R->Z, &E, &R->Z ) ); MOD_MUL( R->Z );
maclobdell	0:f7c60d3e7b8a	1537
maclobdell	0:f7c60d3e7b8a	1538	cleanup:
maclobdell	0:f7c60d3e7b8a	1539	mbedtls_mpi_free( &A ); mbedtls_mpi_free( &AA ); mbedtls_mpi_free( &B );
maclobdell	0:f7c60d3e7b8a	1540	mbedtls_mpi_free( &BB ); mbedtls_mpi_free( &E ); mbedtls_mpi_free( &C );
maclobdell	0:f7c60d3e7b8a	1541	mbedtls_mpi_free( &D ); mbedtls_mpi_free( &DA ); mbedtls_mpi_free( &CB );
maclobdell	0:f7c60d3e7b8a	1542
maclobdell	0:f7c60d3e7b8a	1543	return( ret );
maclobdell	0:f7c60d3e7b8a	1544	}
maclobdell	0:f7c60d3e7b8a	1545
maclobdell	0:f7c60d3e7b8a	1546	/*
maclobdell	0:f7c60d3e7b8a	1547	* Multiplication with Montgomery ladder in x/z coordinates,
maclobdell	0:f7c60d3e7b8a	1548	* for curves in Montgomery form
maclobdell	0:f7c60d3e7b8a	1549	*/
maclobdell	0:f7c60d3e7b8a	1550	static int ecp_mul_mxz( mbedtls_ecp_group grp, mbedtls_ecp_point R,
maclobdell	0:f7c60d3e7b8a	1551	const mbedtls_mpi m, const mbedtls_ecp_point P,
maclobdell	0:f7c60d3e7b8a	1552	int (f_rng)(void , unsigned char *, size_t),
maclobdell	0:f7c60d3e7b8a	1553	void *p_rng )
maclobdell	0:f7c60d3e7b8a	1554	{
maclobdell	0:f7c60d3e7b8a	1555	int ret;
maclobdell	0:f7c60d3e7b8a	1556	size_t i;
maclobdell	0:f7c60d3e7b8a	1557	unsigned char b;
maclobdell	0:f7c60d3e7b8a	1558	mbedtls_ecp_point RP;
maclobdell	0:f7c60d3e7b8a	1559	mbedtls_mpi PX;
maclobdell	0:f7c60d3e7b8a	1560
maclobdell	0:f7c60d3e7b8a	1561	mbedtls_ecp_point_init( &RP ); mbedtls_mpi_init( &PX );
maclobdell	0:f7c60d3e7b8a	1562
maclobdell	0:f7c60d3e7b8a	1563	/* Save PX and read from P before writing to R, in case P == R */
maclobdell	0:f7c60d3e7b8a	1564	MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &PX, &P->X ) );
maclobdell	0:f7c60d3e7b8a	1565	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &RP, P ) );
maclobdell	0:f7c60d3e7b8a	1566
maclobdell	0:f7c60d3e7b8a	1567	/* Set R to zero in modified x/z coordinates */
maclobdell	0:f7c60d3e7b8a	1568	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->X, 1 ) );
maclobdell	0:f7c60d3e7b8a	1569	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->Z, 0 ) );
maclobdell	0:f7c60d3e7b8a	1570	mbedtls_mpi_free( &R->Y );
maclobdell	0:f7c60d3e7b8a	1571
maclobdell	0:f7c60d3e7b8a	1572	/* RP.X might be sligtly larger than P, so reduce it */
maclobdell	0:f7c60d3e7b8a	1573	MOD_ADD( RP.X );
maclobdell	0:f7c60d3e7b8a	1574
maclobdell	0:f7c60d3e7b8a	1575	/* Randomize coordinates of the starting point */
maclobdell	0:f7c60d3e7b8a	1576	if( f_rng != NULL )
maclobdell	0:f7c60d3e7b8a	1577	MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, &RP, f_rng, p_rng ) );
maclobdell	0:f7c60d3e7b8a	1578
maclobdell	0:f7c60d3e7b8a	1579	/* Loop invariant: R = result so far, RP = R + P */
maclobdell	0:f7c60d3e7b8a	1580	i = mbedtls_mpi_bitlen( m ); /* one past the (zero-based) most significant bit */
maclobdell	0:f7c60d3e7b8a	1581	while( i-- > 0 )
maclobdell	0:f7c60d3e7b8a	1582	{
maclobdell	0:f7c60d3e7b8a	1583	b = mbedtls_mpi_get_bit( m, i );
maclobdell	0:f7c60d3e7b8a	1584	/*
maclobdell	0:f7c60d3e7b8a	1585	* if (b) R = 2R + P else R = 2R,
maclobdell	0:f7c60d3e7b8a	1586	* which is:
maclobdell	0:f7c60d3e7b8a	1587	* if (b) double_add( RP, R, RP, R )
maclobdell	0:f7c60d3e7b8a	1588	* else double_add( R, RP, R, RP )
maclobdell	0:f7c60d3e7b8a	1589	* but using safe conditional swaps to avoid leaks
maclobdell	0:f7c60d3e7b8a	1590	*/
maclobdell	0:f7c60d3e7b8a	1591	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->X, &RP.X, b ) );
maclobdell	0:f7c60d3e7b8a	1592	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->Z, &RP.Z, b ) );
maclobdell	0:f7c60d3e7b8a	1593	MBEDTLS_MPI_CHK( ecp_double_add_mxz( grp, R, &RP, R, &RP, &PX ) );
maclobdell	0:f7c60d3e7b8a	1594	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->X, &RP.X, b ) );
maclobdell	0:f7c60d3e7b8a	1595	MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->Z, &RP.Z, b ) );
maclobdell	0:f7c60d3e7b8a	1596	}
maclobdell	0:f7c60d3e7b8a	1597
maclobdell	0:f7c60d3e7b8a	1598	MBEDTLS_MPI_CHK( ecp_normalize_mxz( grp, R ) );
maclobdell	0:f7c60d3e7b8a	1599
maclobdell	0:f7c60d3e7b8a	1600	cleanup:
maclobdell	0:f7c60d3e7b8a	1601	mbedtls_ecp_point_free( &RP ); mbedtls_mpi_free( &PX );
maclobdell	0:f7c60d3e7b8a	1602
maclobdell	0:f7c60d3e7b8a	1603	return( ret );
maclobdell	0:f7c60d3e7b8a	1604	}
maclobdell	0:f7c60d3e7b8a	1605
maclobdell	0:f7c60d3e7b8a	1606	#endif /* ECP_MONTGOMERY */
maclobdell	0:f7c60d3e7b8a	1607
maclobdell	0:f7c60d3e7b8a	1608	/*
maclobdell	0:f7c60d3e7b8a	1609	* Multiplication R = m * P
maclobdell	0:f7c60d3e7b8a	1610	*/
maclobdell	0:f7c60d3e7b8a	1611	int mbedtls_ecp_mul( mbedtls_ecp_group grp, mbedtls_ecp_point R,
maclobdell	0:f7c60d3e7b8a	1612	const mbedtls_mpi m, const mbedtls_ecp_point P,
maclobdell	0:f7c60d3e7b8a	1613	int (f_rng)(void , unsigned char , size_t), void p_rng )
maclobdell	0:f7c60d3e7b8a	1614	{
maclobdell	0:f7c60d3e7b8a	1615	int ret;
maclobdell	0:f7c60d3e7b8a	1616
maclobdell	0:f7c60d3e7b8a	1617	/* Common sanity checks */
maclobdell	0:f7c60d3e7b8a	1618	if( mbedtls_mpi_cmp_int( &P->Z, 1 ) != 0 )
maclobdell	0:f7c60d3e7b8a	1619	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	1620
maclobdell	0:f7c60d3e7b8a	1621	if( ( ret = mbedtls_ecp_check_privkey( grp, m ) ) != 0 \|\|
maclobdell	0:f7c60d3e7b8a	1622	( ret = mbedtls_ecp_check_pubkey( grp, P ) ) != 0 )
maclobdell	0:f7c60d3e7b8a	1623	return( ret );
maclobdell	0:f7c60d3e7b8a	1624
maclobdell	0:f7c60d3e7b8a	1625	#if defined(ECP_MONTGOMERY)
maclobdell	0:f7c60d3e7b8a	1626	if( ecp_get_type( grp ) == ECP_TYPE_MONTGOMERY )
maclobdell	0:f7c60d3e7b8a	1627	return( ecp_mul_mxz( grp, R, m, P, f_rng, p_rng ) );
maclobdell	0:f7c60d3e7b8a	1628	#endif
maclobdell	0:f7c60d3e7b8a	1629	#if defined(ECP_SHORTWEIERSTRASS)
maclobdell	0:f7c60d3e7b8a	1630	if( ecp_get_type( grp ) == ECP_TYPE_SHORT_WEIERSTRASS )
maclobdell	0:f7c60d3e7b8a	1631	return( ecp_mul_comb( grp, R, m, P, f_rng, p_rng ) );
maclobdell	0:f7c60d3e7b8a	1632	#endif
maclobdell	0:f7c60d3e7b8a	1633	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	1634	}
maclobdell	0:f7c60d3e7b8a	1635
maclobdell	0:f7c60d3e7b8a	1636	#if defined(ECP_SHORTWEIERSTRASS)
maclobdell	0:f7c60d3e7b8a	1637	/*
maclobdell	0:f7c60d3e7b8a	1638	* Check that an affine point is valid as a public key,
maclobdell	0:f7c60d3e7b8a	1639	* short weierstrass curves (SEC1 3.2.3.1)
maclobdell	0:f7c60d3e7b8a	1640	*/
maclobdell	0:f7c60d3e7b8a	1641	static int ecp_check_pubkey_sw( const mbedtls_ecp_group grp, const mbedtls_ecp_point pt )
maclobdell	0:f7c60d3e7b8a	1642	{
maclobdell	0:f7c60d3e7b8a	1643	int ret;
maclobdell	0:f7c60d3e7b8a	1644	mbedtls_mpi YY, RHS;
maclobdell	0:f7c60d3e7b8a	1645
maclobdell	0:f7c60d3e7b8a	1646	/* pt coordinates must be normalized for our checks */
maclobdell	0:f7c60d3e7b8a	1647	if( mbedtls_mpi_cmp_int( &pt->X, 0 ) < 0 \|\|
maclobdell	0:f7c60d3e7b8a	1648	mbedtls_mpi_cmp_int( &pt->Y, 0 ) < 0 \|\|
maclobdell	0:f7c60d3e7b8a	1649	mbedtls_mpi_cmp_mpi( &pt->X, &grp->P ) >= 0 \|\|
maclobdell	0:f7c60d3e7b8a	1650	mbedtls_mpi_cmp_mpi( &pt->Y, &grp->P ) >= 0 )
maclobdell	0:f7c60d3e7b8a	1651	return( MBEDTLS_ERR_ECP_INVALID_KEY );
maclobdell	0:f7c60d3e7b8a	1652
maclobdell	0:f7c60d3e7b8a	1653	mbedtls_mpi_init( &YY ); mbedtls_mpi_init( &RHS );
maclobdell	0:f7c60d3e7b8a	1654
maclobdell	0:f7c60d3e7b8a	1655	/*
maclobdell	0:f7c60d3e7b8a	1656	* YY = Y^2
maclobdell	0:f7c60d3e7b8a	1657	* RHS = X (X^2 + A) + B = X^3 + A X + B
maclobdell	0:f7c60d3e7b8a	1658	*/
maclobdell	0:f7c60d3e7b8a	1659	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &YY, &pt->Y, &pt->Y ) ); MOD_MUL( YY );
maclobdell	0:f7c60d3e7b8a	1660	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &RHS, &pt->X, &pt->X ) ); MOD_MUL( RHS );
maclobdell	0:f7c60d3e7b8a	1661
maclobdell	0:f7c60d3e7b8a	1662	/* Special case for A = -3 */
maclobdell	0:f7c60d3e7b8a	1663	if( grp->A.p == NULL )
maclobdell	0:f7c60d3e7b8a	1664	{
maclobdell	0:f7c60d3e7b8a	1665	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &RHS, &RHS, 3 ) ); MOD_SUB( RHS );
maclobdell	0:f7c60d3e7b8a	1666	}
maclobdell	0:f7c60d3e7b8a	1667	else
maclobdell	0:f7c60d3e7b8a	1668	{
maclobdell	0:f7c60d3e7b8a	1669	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &RHS, &RHS, &grp->A ) ); MOD_ADD( RHS );
maclobdell	0:f7c60d3e7b8a	1670	}
maclobdell	0:f7c60d3e7b8a	1671
maclobdell	0:f7c60d3e7b8a	1672	MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &RHS, &RHS, &pt->X ) ); MOD_MUL( RHS );
maclobdell	0:f7c60d3e7b8a	1673	MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &RHS, &RHS, &grp->B ) ); MOD_ADD( RHS );
maclobdell	0:f7c60d3e7b8a	1674
maclobdell	0:f7c60d3e7b8a	1675	if( mbedtls_mpi_cmp_mpi( &YY, &RHS ) != 0 )
maclobdell	0:f7c60d3e7b8a	1676	ret = MBEDTLS_ERR_ECP_INVALID_KEY;
maclobdell	0:f7c60d3e7b8a	1677
maclobdell	0:f7c60d3e7b8a	1678	cleanup:
maclobdell	0:f7c60d3e7b8a	1679
maclobdell	0:f7c60d3e7b8a	1680	mbedtls_mpi_free( &YY ); mbedtls_mpi_free( &RHS );
maclobdell	0:f7c60d3e7b8a	1681
maclobdell	0:f7c60d3e7b8a	1682	return( ret );
maclobdell	0:f7c60d3e7b8a	1683	}
maclobdell	0:f7c60d3e7b8a	1684	#endif /* ECP_SHORTWEIERSTRASS */
maclobdell	0:f7c60d3e7b8a	1685
maclobdell	0:f7c60d3e7b8a	1686	/*
maclobdell	0:f7c60d3e7b8a	1687	* R = m * P with shortcuts for m == 1 and m == -1
maclobdell	0:f7c60d3e7b8a	1688	* NOT constant-time - ONLY for short Weierstrass!
maclobdell	0:f7c60d3e7b8a	1689	*/
maclobdell	0:f7c60d3e7b8a	1690	static int mbedtls_ecp_mul_shortcuts( mbedtls_ecp_group *grp,
maclobdell	0:f7c60d3e7b8a	1691	mbedtls_ecp_point *R,
maclobdell	0:f7c60d3e7b8a	1692	const mbedtls_mpi *m,
maclobdell	0:f7c60d3e7b8a	1693	const mbedtls_ecp_point *P )
maclobdell	0:f7c60d3e7b8a	1694	{
maclobdell	0:f7c60d3e7b8a	1695	int ret;
maclobdell	0:f7c60d3e7b8a	1696
maclobdell	0:f7c60d3e7b8a	1697	if( mbedtls_mpi_cmp_int( m, 1 ) == 0 )
maclobdell	0:f7c60d3e7b8a	1698	{
maclobdell	0:f7c60d3e7b8a	1699	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, P ) );
maclobdell	0:f7c60d3e7b8a	1700	}
maclobdell	0:f7c60d3e7b8a	1701	else if( mbedtls_mpi_cmp_int( m, -1 ) == 0 )
maclobdell	0:f7c60d3e7b8a	1702	{
maclobdell	0:f7c60d3e7b8a	1703	MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, P ) );
maclobdell	0:f7c60d3e7b8a	1704	if( mbedtls_mpi_cmp_int( &R->Y, 0 ) != 0 )
maclobdell	0:f7c60d3e7b8a	1705	MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &R->Y, &grp->P, &R->Y ) );
maclobdell	0:f7c60d3e7b8a	1706	}
maclobdell	0:f7c60d3e7b8a	1707	else
maclobdell	0:f7c60d3e7b8a	1708	{
maclobdell	0:f7c60d3e7b8a	1709	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, R, m, P, NULL, NULL ) );
maclobdell	0:f7c60d3e7b8a	1710	}
maclobdell	0:f7c60d3e7b8a	1711
maclobdell	0:f7c60d3e7b8a	1712	cleanup:
maclobdell	0:f7c60d3e7b8a	1713	return( ret );
maclobdell	0:f7c60d3e7b8a	1714	}
maclobdell	0:f7c60d3e7b8a	1715
maclobdell	0:f7c60d3e7b8a	1716	/*
maclobdell	0:f7c60d3e7b8a	1717	* Linear combination
maclobdell	0:f7c60d3e7b8a	1718	* NOT constant-time
maclobdell	0:f7c60d3e7b8a	1719	*/
maclobdell	0:f7c60d3e7b8a	1720	int mbedtls_ecp_muladd( mbedtls_ecp_group grp, mbedtls_ecp_point R,
maclobdell	0:f7c60d3e7b8a	1721	const mbedtls_mpi m, const mbedtls_ecp_point P,
maclobdell	0:f7c60d3e7b8a	1722	const mbedtls_mpi n, const mbedtls_ecp_point Q )
maclobdell	0:f7c60d3e7b8a	1723	{
maclobdell	0:f7c60d3e7b8a	1724	int ret;
maclobdell	0:f7c60d3e7b8a	1725	mbedtls_ecp_point mP;
maclobdell	0:f7c60d3e7b8a	1726
maclobdell	0:f7c60d3e7b8a	1727	if( ecp_get_type( grp ) != ECP_TYPE_SHORT_WEIERSTRASS )
maclobdell	0:f7c60d3e7b8a	1728	return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
maclobdell	0:f7c60d3e7b8a	1729
maclobdell	0:f7c60d3e7b8a	1730	mbedtls_ecp_point_init( &mP );
maclobdell	0:f7c60d3e7b8a	1731
maclobdell	0:f7c60d3e7b8a	1732	MBEDTLS_MPI_CHK( mbedtls_ecp_mul_shortcuts( grp, &mP, m, P ) );
maclobdell	0:f7c60d3e7b8a	1733	MBEDTLS_MPI_CHK( mbedtls_ecp_mul_shortcuts( grp, R, n, Q ) );
maclobdell	0:f7c60d3e7b8a	1734
maclobdell	0:f7c60d3e7b8a	1735	MBEDTLS_MPI_CHK( ecp_add_mixed( grp, R, &mP, R ) );
maclobdell	0:f7c60d3e7b8a	1736	MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, R ) );
maclobdell	0:f7c60d3e7b8a	1737
maclobdell	0:f7c60d3e7b8a	1738	cleanup:
maclobdell	0:f7c60d3e7b8a	1739	mbedtls_ecp_point_free( &mP );
maclobdell	0:f7c60d3e7b8a	1740
maclobdell	0:f7c60d3e7b8a	1741	return( ret );
maclobdell	0:f7c60d3e7b8a	1742	}
maclobdell	0:f7c60d3e7b8a	1743
maclobdell	0:f7c60d3e7b8a	1744
maclobdell	0:f7c60d3e7b8a	1745	#if defined(ECP_MONTGOMERY)
maclobdell	0:f7c60d3e7b8a	1746	/*
maclobdell	0:f7c60d3e7b8a	1747	* Check validity of a public key for Montgomery curves with x-only schemes
maclobdell	0:f7c60d3e7b8a	1748	*/
maclobdell	0:f7c60d3e7b8a	1749	static int ecp_check_pubkey_mx( const mbedtls_ecp_group grp, const mbedtls_ecp_point pt )
maclobdell	0:f7c60d3e7b8a	1750	{
maclobdell	0:f7c60d3e7b8a	1751	/* [Curve25519 p. 5] Just check X is the correct number of bytes */
maclobdell	0:f7c60d3e7b8a	1752	if( mbedtls_mpi_size( &pt->X ) > ( grp->nbits + 7 ) / 8 )
maclobdell	0:f7c60d3e7b8a	1753	return( MBEDTLS_ERR_ECP_INVALID_KEY );
maclobdell	0:f7c60d3e7b8a	1754
maclobdell	0:f7c60d3e7b8a	1755	return( 0 );
maclobdell	0:f7c60d3e7b8a	1756	}
maclobdell	0:f7c60d3e7b8a	1757	#endif /* ECP_MONTGOMERY */
maclobdell	0:f7c60d3e7b8a	1758
maclobdell	0:f7c60d3e7b8a	1759	/*
maclobdell	0:f7c60d3e7b8a	1760	* Check that a point is valid as a public key
maclobdell	0:f7c60d3e7b8a	1761	*/
maclobdell	0:f7c60d3e7b8a	1762	int mbedtls_ecp_check_pubkey( const mbedtls_ecp_group grp, const mbedtls_ecp_point pt )
maclobdell	0:f7c60d3e7b8a	1763	{
maclobdell	0:f7c60d3e7b8a	1764	/* Must use affine coordinates */
maclobdell	0:f7c60d3e7b8a	1765	if( mbedtls_mpi_cmp_int( &pt->Z, 1 ) != 0 )
maclobdell	0:f7c60d3e7b8a	1766	return( MBEDTLS_ERR_ECP_INVALID_KEY );
maclobdell	0:f7c60d3e7b8a	1767
maclobdell	0:f7c60d3e7b8a	1768	#if defined(ECP_MONTGOMERY)
maclobdell	0:f7c60d3e7b8a	1769	if( ecp_get_type( grp ) == ECP_TYPE_MONTGOMERY )
maclobdell	0:f7c60d3e7b8a	1770	return( ecp_check_pubkey_mx( grp, pt ) );
maclobdell	0:f7c60d3e7b8a	1771	#endif
maclobdell	0:f7c60d3e7b8a	1772	#if defined(ECP_SHORTWEIERSTRASS)
maclobdell	0:f7c60d3e7b8a	1773	if( ecp_get_type( grp ) == ECP_TYPE_SHORT_WEIERSTRASS )
maclobdell	0:f7c60d3e7b8a	1774	return( ecp_check_pubkey_sw( grp, pt ) );
maclobdell	0:f7c60d3e7b8a	1775	#endif
maclobdell	0:f7c60d3e7b8a	1776	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	1777	}
maclobdell	0:f7c60d3e7b8a	1778
maclobdell	0:f7c60d3e7b8a	1779	/*
maclobdell	0:f7c60d3e7b8a	1780	* Check that an mbedtls_mpi is valid as a private key
maclobdell	0:f7c60d3e7b8a	1781	*/
maclobdell	0:f7c60d3e7b8a	1782	int mbedtls_ecp_check_privkey( const mbedtls_ecp_group grp, const mbedtls_mpi d )
maclobdell	0:f7c60d3e7b8a	1783	{
maclobdell	0:f7c60d3e7b8a	1784	#if defined(ECP_MONTGOMERY)
maclobdell	0:f7c60d3e7b8a	1785	if( ecp_get_type( grp ) == ECP_TYPE_MONTGOMERY )
maclobdell	0:f7c60d3e7b8a	1786	{
maclobdell	0:f7c60d3e7b8a	1787	/* see [Curve25519] page 5 */
maclobdell	0:f7c60d3e7b8a	1788	if( mbedtls_mpi_get_bit( d, 0 ) != 0 \|\|
maclobdell	0:f7c60d3e7b8a	1789	mbedtls_mpi_get_bit( d, 1 ) != 0 \|\|
maclobdell	0:f7c60d3e7b8a	1790	mbedtls_mpi_get_bit( d, 2 ) != 0 \|\|
maclobdell	0:f7c60d3e7b8a	1791	mbedtls_mpi_bitlen( d ) - 1 != grp->nbits ) /* mbedtls_mpi_bitlen is one-based! */
maclobdell	0:f7c60d3e7b8a	1792	return( MBEDTLS_ERR_ECP_INVALID_KEY );
maclobdell	0:f7c60d3e7b8a	1793	else
maclobdell	0:f7c60d3e7b8a	1794	return( 0 );
maclobdell	0:f7c60d3e7b8a	1795	}
maclobdell	0:f7c60d3e7b8a	1796	#endif /* ECP_MONTGOMERY */
maclobdell	0:f7c60d3e7b8a	1797	#if defined(ECP_SHORTWEIERSTRASS)
maclobdell	0:f7c60d3e7b8a	1798	if( ecp_get_type( grp ) == ECP_TYPE_SHORT_WEIERSTRASS )
maclobdell	0:f7c60d3e7b8a	1799	{
maclobdell	0:f7c60d3e7b8a	1800	/* see SEC1 3.2 */
maclobdell	0:f7c60d3e7b8a	1801	if( mbedtls_mpi_cmp_int( d, 1 ) < 0 \|\|
maclobdell	0:f7c60d3e7b8a	1802	mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 )
maclobdell	0:f7c60d3e7b8a	1803	return( MBEDTLS_ERR_ECP_INVALID_KEY );
maclobdell	0:f7c60d3e7b8a	1804	else
maclobdell	0:f7c60d3e7b8a	1805	return( 0 );
maclobdell	0:f7c60d3e7b8a	1806	}
maclobdell	0:f7c60d3e7b8a	1807	#endif /* ECP_SHORTWEIERSTRASS */
maclobdell	0:f7c60d3e7b8a	1808
maclobdell	0:f7c60d3e7b8a	1809	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	1810	}
maclobdell	0:f7c60d3e7b8a	1811
maclobdell	0:f7c60d3e7b8a	1812	/*
maclobdell	0:f7c60d3e7b8a	1813	* Generate a keypair with configurable base point
maclobdell	0:f7c60d3e7b8a	1814	*/
maclobdell	0:f7c60d3e7b8a	1815	int mbedtls_ecp_gen_keypair_base( mbedtls_ecp_group *grp,
maclobdell	0:f7c60d3e7b8a	1816	const mbedtls_ecp_point *G,
maclobdell	0:f7c60d3e7b8a	1817	mbedtls_mpi d, mbedtls_ecp_point Q,
maclobdell	0:f7c60d3e7b8a	1818	int (f_rng)(void , unsigned char *, size_t),
maclobdell	0:f7c60d3e7b8a	1819	void *p_rng )
maclobdell	0:f7c60d3e7b8a	1820	{
maclobdell	0:f7c60d3e7b8a	1821	int ret;
maclobdell	0:f7c60d3e7b8a	1822	size_t n_size = ( grp->nbits + 7 ) / 8;
maclobdell	0:f7c60d3e7b8a	1823
maclobdell	0:f7c60d3e7b8a	1824	#if defined(ECP_MONTGOMERY)
maclobdell	0:f7c60d3e7b8a	1825	if( ecp_get_type( grp ) == ECP_TYPE_MONTGOMERY )
maclobdell	0:f7c60d3e7b8a	1826	{
maclobdell	0:f7c60d3e7b8a	1827	/* [M225] page 5 */
maclobdell	0:f7c60d3e7b8a	1828	size_t b;
maclobdell	0:f7c60d3e7b8a	1829
maclobdell	0:f7c60d3e7b8a	1830	MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( d, n_size, f_rng, p_rng ) );
maclobdell	0:f7c60d3e7b8a	1831
maclobdell	0:f7c60d3e7b8a	1832	/* Make sure the most significant bit is nbits */
maclobdell	0:f7c60d3e7b8a	1833	b = mbedtls_mpi_bitlen( d ) - 1; /* mbedtls_mpi_bitlen is one-based */
maclobdell	0:f7c60d3e7b8a	1834	if( b > grp->nbits )
maclobdell	0:f7c60d3e7b8a	1835	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( d, b - grp->nbits ) );
maclobdell	0:f7c60d3e7b8a	1836	else
maclobdell	0:f7c60d3e7b8a	1837	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, grp->nbits, 1 ) );
maclobdell	0:f7c60d3e7b8a	1838
maclobdell	0:f7c60d3e7b8a	1839	/* Make sure the last three bits are unset */
maclobdell	0:f7c60d3e7b8a	1840	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 0, 0 ) );
maclobdell	0:f7c60d3e7b8a	1841	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 1, 0 ) );
maclobdell	0:f7c60d3e7b8a	1842	MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 2, 0 ) );
maclobdell	0:f7c60d3e7b8a	1843	}
maclobdell	0:f7c60d3e7b8a	1844	else
maclobdell	0:f7c60d3e7b8a	1845	#endif /* ECP_MONTGOMERY */
maclobdell	0:f7c60d3e7b8a	1846	#if defined(ECP_SHORTWEIERSTRASS)
maclobdell	0:f7c60d3e7b8a	1847	if( ecp_get_type( grp ) == ECP_TYPE_SHORT_WEIERSTRASS )
maclobdell	0:f7c60d3e7b8a	1848	{
maclobdell	0:f7c60d3e7b8a	1849	/* SEC1 3.2.1: Generate d such that 1 <= n < N */
maclobdell	0:f7c60d3e7b8a	1850	int count = 0;
maclobdell	0:f7c60d3e7b8a	1851	unsigned char rnd[MBEDTLS_ECP_MAX_BYTES];
maclobdell	0:f7c60d3e7b8a	1852
maclobdell	0:f7c60d3e7b8a	1853	/*
maclobdell	0:f7c60d3e7b8a	1854	* Match the procedure given in RFC 6979 (deterministic ECDSA):
maclobdell	0:f7c60d3e7b8a	1855	* - use the same byte ordering;
maclobdell	0:f7c60d3e7b8a	1856	* - keep the leftmost nbits bits of the generated octet string;
maclobdell	0:f7c60d3e7b8a	1857	* - try until result is in the desired range.
maclobdell	0:f7c60d3e7b8a	1858	* This also avoids any biais, which is especially important for ECDSA.
maclobdell	0:f7c60d3e7b8a	1859	*/
maclobdell	0:f7c60d3e7b8a	1860	do
maclobdell	0:f7c60d3e7b8a	1861	{
maclobdell	0:f7c60d3e7b8a	1862	MBEDTLS_MPI_CHK( f_rng( p_rng, rnd, n_size ) );
maclobdell	0:f7c60d3e7b8a	1863	MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( d, rnd, n_size ) );
maclobdell	0:f7c60d3e7b8a	1864	MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( d, 8 * n_size - grp->nbits ) );
maclobdell	0:f7c60d3e7b8a	1865
maclobdell	0:f7c60d3e7b8a	1866	/*
maclobdell	0:f7c60d3e7b8a	1867	* Each try has at worst a probability 1/2 of failing (the msb has
maclobdell	0:f7c60d3e7b8a	1868	* a probability 1/2 of being 0, and then the result will be < N),
maclobdell	0:f7c60d3e7b8a	1869	* so after 30 tries failure probability is a most 2**(-30).
maclobdell	0:f7c60d3e7b8a	1870	*
maclobdell	0:f7c60d3e7b8a	1871	* For most curves, 1 try is enough with overwhelming probability,
maclobdell	0:f7c60d3e7b8a	1872	* since N starts with a lot of 1s in binary, but some curves
maclobdell	0:f7c60d3e7b8a	1873	* such as secp224k1 are actually very close to the worst case.
maclobdell	0:f7c60d3e7b8a	1874	*/
maclobdell	0:f7c60d3e7b8a	1875	if( ++count > 30 )
maclobdell	0:f7c60d3e7b8a	1876	return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
maclobdell	0:f7c60d3e7b8a	1877	}
maclobdell	0:f7c60d3e7b8a	1878	while( mbedtls_mpi_cmp_int( d, 1 ) < 0 \|\|
maclobdell	0:f7c60d3e7b8a	1879	mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 );
maclobdell	0:f7c60d3e7b8a	1880	}
maclobdell	0:f7c60d3e7b8a	1881	else
maclobdell	0:f7c60d3e7b8a	1882	#endif /* ECP_SHORTWEIERSTRASS */
maclobdell	0:f7c60d3e7b8a	1883	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	1884
maclobdell	0:f7c60d3e7b8a	1885	cleanup:
maclobdell	0:f7c60d3e7b8a	1886	if( ret != 0 )
maclobdell	0:f7c60d3e7b8a	1887	return( ret );
maclobdell	0:f7c60d3e7b8a	1888
maclobdell	0:f7c60d3e7b8a	1889	return( mbedtls_ecp_mul( grp, Q, d, G, f_rng, p_rng ) );
maclobdell	0:f7c60d3e7b8a	1890	}
maclobdell	0:f7c60d3e7b8a	1891
maclobdell	0:f7c60d3e7b8a	1892	/*
maclobdell	0:f7c60d3e7b8a	1893	* Generate key pair, wrapper for conventional base point
maclobdell	0:f7c60d3e7b8a	1894	*/
maclobdell	0:f7c60d3e7b8a	1895	int mbedtls_ecp_gen_keypair( mbedtls_ecp_group *grp,
maclobdell	0:f7c60d3e7b8a	1896	mbedtls_mpi d, mbedtls_ecp_point Q,
maclobdell	0:f7c60d3e7b8a	1897	int (f_rng)(void , unsigned char *, size_t),
maclobdell	0:f7c60d3e7b8a	1898	void *p_rng )
maclobdell	0:f7c60d3e7b8a	1899	{
maclobdell	0:f7c60d3e7b8a	1900	return( mbedtls_ecp_gen_keypair_base( grp, &grp->G, d, Q, f_rng, p_rng ) );
maclobdell	0:f7c60d3e7b8a	1901	}
maclobdell	0:f7c60d3e7b8a	1902
maclobdell	0:f7c60d3e7b8a	1903	/*
maclobdell	0:f7c60d3e7b8a	1904	* Generate a keypair, prettier wrapper
maclobdell	0:f7c60d3e7b8a	1905	*/
maclobdell	0:f7c60d3e7b8a	1906	int mbedtls_ecp_gen_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key,
maclobdell	0:f7c60d3e7b8a	1907	int (f_rng)(void , unsigned char , size_t), void p_rng )
maclobdell	0:f7c60d3e7b8a	1908	{
maclobdell	0:f7c60d3e7b8a	1909	int ret;
maclobdell	0:f7c60d3e7b8a	1910
maclobdell	0:f7c60d3e7b8a	1911	if( ( ret = mbedtls_ecp_group_load( &key->grp, grp_id ) ) != 0 )
maclobdell	0:f7c60d3e7b8a	1912	return( ret );
maclobdell	0:f7c60d3e7b8a	1913
maclobdell	0:f7c60d3e7b8a	1914	return( mbedtls_ecp_gen_keypair( &key->grp, &key->d, &key->Q, f_rng, p_rng ) );
maclobdell	0:f7c60d3e7b8a	1915	}
maclobdell	0:f7c60d3e7b8a	1916
maclobdell	0:f7c60d3e7b8a	1917	/*
maclobdell	0:f7c60d3e7b8a	1918	* Check a public-private key pair
maclobdell	0:f7c60d3e7b8a	1919	*/
maclobdell	0:f7c60d3e7b8a	1920	int mbedtls_ecp_check_pub_priv( const mbedtls_ecp_keypair pub, const mbedtls_ecp_keypair prv )
maclobdell	0:f7c60d3e7b8a	1921	{
maclobdell	0:f7c60d3e7b8a	1922	int ret;
maclobdell	0:f7c60d3e7b8a	1923	mbedtls_ecp_point Q;
maclobdell	0:f7c60d3e7b8a	1924	mbedtls_ecp_group grp;
maclobdell	0:f7c60d3e7b8a	1925
maclobdell	0:f7c60d3e7b8a	1926	if( pub->grp.id == MBEDTLS_ECP_DP_NONE \|\|
maclobdell	0:f7c60d3e7b8a	1927	pub->grp.id != prv->grp.id \|\|
maclobdell	0:f7c60d3e7b8a	1928	mbedtls_mpi_cmp_mpi( &pub->Q.X, &prv->Q.X ) \|\|
maclobdell	0:f7c60d3e7b8a	1929	mbedtls_mpi_cmp_mpi( &pub->Q.Y, &prv->Q.Y ) \|\|
maclobdell	0:f7c60d3e7b8a	1930	mbedtls_mpi_cmp_mpi( &pub->Q.Z, &prv->Q.Z ) )
maclobdell	0:f7c60d3e7b8a	1931	{
maclobdell	0:f7c60d3e7b8a	1932	return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
maclobdell	0:f7c60d3e7b8a	1933	}
maclobdell	0:f7c60d3e7b8a	1934
maclobdell	0:f7c60d3e7b8a	1935	mbedtls_ecp_point_init( &Q );
maclobdell	0:f7c60d3e7b8a	1936	mbedtls_ecp_group_init( &grp );
maclobdell	0:f7c60d3e7b8a	1937
maclobdell	0:f7c60d3e7b8a	1938	/* mbedtls_ecp_mul() needs a non-const group... */
maclobdell	0:f7c60d3e7b8a	1939	mbedtls_ecp_group_copy( &grp, &prv->grp );
maclobdell	0:f7c60d3e7b8a	1940
maclobdell	0:f7c60d3e7b8a	1941	/* Also checks d is valid */
maclobdell	0:f7c60d3e7b8a	1942	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &Q, &prv->d, &prv->grp.G, NULL, NULL ) );
maclobdell	0:f7c60d3e7b8a	1943
maclobdell	0:f7c60d3e7b8a	1944	if( mbedtls_mpi_cmp_mpi( &Q.X, &prv->Q.X ) \|\|
maclobdell	0:f7c60d3e7b8a	1945	mbedtls_mpi_cmp_mpi( &Q.Y, &prv->Q.Y ) \|\|
maclobdell	0:f7c60d3e7b8a	1946	mbedtls_mpi_cmp_mpi( &Q.Z, &prv->Q.Z ) )
maclobdell	0:f7c60d3e7b8a	1947	{
maclobdell	0:f7c60d3e7b8a	1948	ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
maclobdell	0:f7c60d3e7b8a	1949	goto cleanup;
maclobdell	0:f7c60d3e7b8a	1950	}
maclobdell	0:f7c60d3e7b8a	1951
maclobdell	0:f7c60d3e7b8a	1952	cleanup:
maclobdell	0:f7c60d3e7b8a	1953	mbedtls_ecp_point_free( &Q );
maclobdell	0:f7c60d3e7b8a	1954	mbedtls_ecp_group_free( &grp );
maclobdell	0:f7c60d3e7b8a	1955
maclobdell	0:f7c60d3e7b8a	1956	return( ret );
maclobdell	0:f7c60d3e7b8a	1957	}
maclobdell	0:f7c60d3e7b8a	1958
maclobdell	0:f7c60d3e7b8a	1959	#if defined(MBEDTLS_SELF_TEST)
maclobdell	0:f7c60d3e7b8a	1960
maclobdell	0:f7c60d3e7b8a	1961	/*
maclobdell	0:f7c60d3e7b8a	1962	* Checkup routine
maclobdell	0:f7c60d3e7b8a	1963	*/
maclobdell	0:f7c60d3e7b8a	1964	int mbedtls_ecp_self_test( int verbose )
maclobdell	0:f7c60d3e7b8a	1965	{
maclobdell	0:f7c60d3e7b8a	1966	int ret;
maclobdell	0:f7c60d3e7b8a	1967	size_t i;
maclobdell	0:f7c60d3e7b8a	1968	mbedtls_ecp_group grp;
maclobdell	0:f7c60d3e7b8a	1969	mbedtls_ecp_point R, P;
maclobdell	0:f7c60d3e7b8a	1970	mbedtls_mpi m;
maclobdell	0:f7c60d3e7b8a	1971	unsigned long add_c_prev, dbl_c_prev, mul_c_prev;
maclobdell	0:f7c60d3e7b8a	1972	/* exponents especially adapted for secp192r1 */
maclobdell	0:f7c60d3e7b8a	1973	const char *exponents[] =
maclobdell	0:f7c60d3e7b8a	1974	{
maclobdell	0:f7c60d3e7b8a	1975	"000000000000000000000000000000000000000000000001", /* one */
maclobdell	0:f7c60d3e7b8a	1976	"FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22830", /* N - 1 */
maclobdell	0:f7c60d3e7b8a	1977	"5EA6F389A38B8BC81E767753B15AA5569E1782E30ABE7D25", /* random */
maclobdell	0:f7c60d3e7b8a	1978	"400000000000000000000000000000000000000000000000", /* one and zeros */
maclobdell	0:f7c60d3e7b8a	1979	"7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", /* all ones */
maclobdell	0:f7c60d3e7b8a	1980	"555555555555555555555555555555555555555555555555", /* 101010... */
maclobdell	0:f7c60d3e7b8a	1981	};
maclobdell	0:f7c60d3e7b8a	1982
maclobdell	0:f7c60d3e7b8a	1983	mbedtls_ecp_group_init( &grp );
maclobdell	0:f7c60d3e7b8a	1984	mbedtls_ecp_point_init( &R );
maclobdell	0:f7c60d3e7b8a	1985	mbedtls_ecp_point_init( &P );
maclobdell	0:f7c60d3e7b8a	1986	mbedtls_mpi_init( &m );
maclobdell	0:f7c60d3e7b8a	1987
maclobdell	0:f7c60d3e7b8a	1988	/* Use secp192r1 if available, or any available curve */
maclobdell	0:f7c60d3e7b8a	1989	#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
maclobdell	0:f7c60d3e7b8a	1990	MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, MBEDTLS_ECP_DP_SECP192R1 ) );
maclobdell	0:f7c60d3e7b8a	1991	#else
maclobdell	0:f7c60d3e7b8a	1992	MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, mbedtls_ecp_curve_list()->grp_id ) );
maclobdell	0:f7c60d3e7b8a	1993	#endif
maclobdell	0:f7c60d3e7b8a	1994
maclobdell	0:f7c60d3e7b8a	1995	if( verbose != 0 )
maclobdell	0:f7c60d3e7b8a	1996	mbedtls_printf( " ECP test #1 (constant op_count, base point G): " );
maclobdell	0:f7c60d3e7b8a	1997
maclobdell	0:f7c60d3e7b8a	1998	/* Do a dummy multiplication first to trigger precomputation */
maclobdell	0:f7c60d3e7b8a	1999	MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &m, 2 ) );
maclobdell	0:f7c60d3e7b8a	2000	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &P, &m, &grp.G, NULL, NULL ) );
maclobdell	0:f7c60d3e7b8a	2001
maclobdell	0:f7c60d3e7b8a	2002	add_count = 0;
maclobdell	0:f7c60d3e7b8a	2003	dbl_count = 0;
maclobdell	0:f7c60d3e7b8a	2004	mul_count = 0;
maclobdell	0:f7c60d3e7b8a	2005	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[0] ) );
maclobdell	0:f7c60d3e7b8a	2006	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &grp.G, NULL, NULL ) );
maclobdell	0:f7c60d3e7b8a	2007
maclobdell	0:f7c60d3e7b8a	2008	for( i = 1; i < sizeof( exponents ) / sizeof( exponents[0] ); i++ )
maclobdell	0:f7c60d3e7b8a	2009	{
maclobdell	0:f7c60d3e7b8a	2010	add_c_prev = add_count;
maclobdell	0:f7c60d3e7b8a	2011	dbl_c_prev = dbl_count;
maclobdell	0:f7c60d3e7b8a	2012	mul_c_prev = mul_count;
maclobdell	0:f7c60d3e7b8a	2013	add_count = 0;
maclobdell	0:f7c60d3e7b8a	2014	dbl_count = 0;
maclobdell	0:f7c60d3e7b8a	2015	mul_count = 0;
maclobdell	0:f7c60d3e7b8a	2016
maclobdell	0:f7c60d3e7b8a	2017	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[i] ) );
maclobdell	0:f7c60d3e7b8a	2018	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &grp.G, NULL, NULL ) );
maclobdell	0:f7c60d3e7b8a	2019
maclobdell	0:f7c60d3e7b8a	2020	if( add_count != add_c_prev \|\|
maclobdell	0:f7c60d3e7b8a	2021	dbl_count != dbl_c_prev \|\|
maclobdell	0:f7c60d3e7b8a	2022	mul_count != mul_c_prev )
maclobdell	0:f7c60d3e7b8a	2023	{
maclobdell	0:f7c60d3e7b8a	2024	if( verbose != 0 )
maclobdell	0:f7c60d3e7b8a	2025	mbedtls_printf( "failed (%u)\n", (unsigned int) i );
maclobdell	0:f7c60d3e7b8a	2026
maclobdell	0:f7c60d3e7b8a	2027	ret = 1;
maclobdell	0:f7c60d3e7b8a	2028	goto cleanup;
maclobdell	0:f7c60d3e7b8a	2029	}
maclobdell	0:f7c60d3e7b8a	2030	}
maclobdell	0:f7c60d3e7b8a	2031
maclobdell	0:f7c60d3e7b8a	2032	if( verbose != 0 )
maclobdell	0:f7c60d3e7b8a	2033	mbedtls_printf( "passed\n" );
maclobdell	0:f7c60d3e7b8a	2034
maclobdell	0:f7c60d3e7b8a	2035	if( verbose != 0 )
maclobdell	0:f7c60d3e7b8a	2036	mbedtls_printf( " ECP test #2 (constant op_count, other point): " );
maclobdell	0:f7c60d3e7b8a	2037	/* We computed P = 2G last time, use it */
maclobdell	0:f7c60d3e7b8a	2038
maclobdell	0:f7c60d3e7b8a	2039	add_count = 0;
maclobdell	0:f7c60d3e7b8a	2040	dbl_count = 0;
maclobdell	0:f7c60d3e7b8a	2041	mul_count = 0;
maclobdell	0:f7c60d3e7b8a	2042	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[0] ) );
maclobdell	0:f7c60d3e7b8a	2043	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &P, NULL, NULL ) );
maclobdell	0:f7c60d3e7b8a	2044
maclobdell	0:f7c60d3e7b8a	2045	for( i = 1; i < sizeof( exponents ) / sizeof( exponents[0] ); i++ )
maclobdell	0:f7c60d3e7b8a	2046	{
maclobdell	0:f7c60d3e7b8a	2047	add_c_prev = add_count;
maclobdell	0:f7c60d3e7b8a	2048	dbl_c_prev = dbl_count;
maclobdell	0:f7c60d3e7b8a	2049	mul_c_prev = mul_count;
maclobdell	0:f7c60d3e7b8a	2050	add_count = 0;
maclobdell	0:f7c60d3e7b8a	2051	dbl_count = 0;
maclobdell	0:f7c60d3e7b8a	2052	mul_count = 0;
maclobdell	0:f7c60d3e7b8a	2053
maclobdell	0:f7c60d3e7b8a	2054	MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &m, 16, exponents[i] ) );
maclobdell	0:f7c60d3e7b8a	2055	MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &R, &m, &P, NULL, NULL ) );
maclobdell	0:f7c60d3e7b8a	2056
maclobdell	0:f7c60d3e7b8a	2057	if( add_count != add_c_prev \|\|
maclobdell	0:f7c60d3e7b8a	2058	dbl_count != dbl_c_prev \|\|
maclobdell	0:f7c60d3e7b8a	2059	mul_count != mul_c_prev )
maclobdell	0:f7c60d3e7b8a	2060	{
maclobdell	0:f7c60d3e7b8a	2061	if( verbose != 0 )
maclobdell	0:f7c60d3e7b8a	2062	mbedtls_printf( "failed (%u)\n", (unsigned int) i );
maclobdell	0:f7c60d3e7b8a	2063
maclobdell	0:f7c60d3e7b8a	2064	ret = 1;
maclobdell	0:f7c60d3e7b8a	2065	goto cleanup;
maclobdell	0:f7c60d3e7b8a	2066	}
maclobdell	0:f7c60d3e7b8a	2067	}
maclobdell	0:f7c60d3e7b8a	2068
maclobdell	0:f7c60d3e7b8a	2069	if( verbose != 0 )
maclobdell	0:f7c60d3e7b8a	2070	mbedtls_printf( "passed\n" );
maclobdell	0:f7c60d3e7b8a	2071
maclobdell	0:f7c60d3e7b8a	2072	cleanup:
maclobdell	0:f7c60d3e7b8a	2073
maclobdell	0:f7c60d3e7b8a	2074	if( ret < 0 && verbose != 0 )
maclobdell	0:f7c60d3e7b8a	2075	mbedtls_printf( "Unexpected error, return code = %08X\n", ret );
maclobdell	0:f7c60d3e7b8a	2076
maclobdell	0:f7c60d3e7b8a	2077	mbedtls_ecp_group_free( &grp );
maclobdell	0:f7c60d3e7b8a	2078	mbedtls_ecp_point_free( &R );
maclobdell	0:f7c60d3e7b8a	2079	mbedtls_ecp_point_free( &P );
maclobdell	0:f7c60d3e7b8a	2080	mbedtls_mpi_free( &m );
maclobdell	0:f7c60d3e7b8a	2081
maclobdell	0:f7c60d3e7b8a	2082	if( verbose != 0 )
maclobdell	0:f7c60d3e7b8a	2083	mbedtls_printf( "\n" );
maclobdell	0:f7c60d3e7b8a	2084
maclobdell	0:f7c60d3e7b8a	2085	return( ret );
maclobdell	0:f7c60d3e7b8a	2086	}
maclobdell	0:f7c60d3e7b8a	2087
maclobdell	0:f7c60d3e7b8a	2088	#endif /* MBEDTLS_SELF_TEST */
maclobdell	0:f7c60d3e7b8a	2089
maclobdell	0:f7c60d3e7b8a	2090	#endif /* MBEDTLS_ECP_C */

Repository toolbox

Export to desktop IDE

Build repository

Repository details

Type:	Program
Mbed OS support:	Mbed 2 deprecated
Created:	19 May 2016
Imports:	0
Forks:	0
Commits:	2
Dependents:	0
Dependencies:	5
Followers:	1

mbed-client/mbedtls/source/ecp.c@1:0ddbe2d3319c, 2016-05-19 (annotated)

Who changed what in which revision?

Repository toolbox

Repository details

Important Information for this Arm website

Access Warning