[thirdparty/openssl.git] / crypto / ec / ec2_oct.c

/* crypto/ec/ec2_oct.c */
/* ====================================================================
 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 *
 * The Elliptic Curve Public-Key Crypto Library (ECC Code) included
 * herein is developed by SUN MICROSYSTEMS, INC., and is contributed
 * to the OpenSSL project.
 *
 * The ECC Code is licensed pursuant to the OpenSSL open source
 * license provided below.
 *
 * The software is originally written by Sheueling Chang Shantz and
 * Douglas Stebila of Sun Microsystems Laboratories.
 *
 */
/* ====================================================================
 * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer. 
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    openssl-core@openssl.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

#include <openssl/err.h>

#include "ec_lcl.h"

#ifndef OPENSSL_NO_EC2M

/*-
 * Calculates and sets the affine coordinates of an EC_POINT from the given
 * compressed coordinates.  Uses algorithm 2.3.4 of SEC 1. 
 * Note that the simple implementation only uses affine coordinates.
 *
 * The method is from the following publication:
 * 
 *     Harper, Menezes, Vanstone:
 *     "Public-Key Cryptosystems with Very Small Key Lengths",
 *     EUROCRYPT '92, Springer-Verlag LNCS 658,
 *     published February 1993
 *
 * US Patents 6,141,420 and 6,618,483 (Vanstone, Mullin, Agnew) describe
 * the same method, but claim no priority date earlier than July 29, 1994
 * (and additionally fail to cite the EUROCRYPT '92 publication as prior art).
 */
int ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
	const BIGNUM *x_, int y_bit, BN_CTX *ctx)
	{
	BN_CTX *new_ctx = NULL;
	BIGNUM *tmp, *x, *y, *z;
	int ret = 0, z0;

	/* clear error queue */
	ERR_clear_error();

	if (ctx == NULL)
		{
		ctx = new_ctx = BN_CTX_new();
		if (ctx == NULL)
			return 0;
		}

	y_bit = (y_bit != 0) ? 1 : 0;

	BN_CTX_start(ctx);
	tmp = BN_CTX_get(ctx);
	x = BN_CTX_get(ctx);
	y = BN_CTX_get(ctx);
	z = BN_CTX_get(ctx);
	if (z == NULL) goto err;

	if (!BN_GF2m_mod_arr(x, x_, group->poly)) goto err;
	if (BN_is_zero(x))
		{
		if (!BN_GF2m_mod_sqrt_arr(y, group->b, group->poly, ctx)) goto err;
		}
	else
		{
		if (!group->meth->field_sqr(group, tmp, x, ctx)) goto err;
		if (!group->meth->field_div(group, tmp, group->b, tmp, ctx)) goto err;
		if (!BN_GF2m_add(tmp, group->a, tmp)) goto err;
		if (!BN_GF2m_add(tmp, x, tmp)) goto err;
		if (!BN_GF2m_mod_solve_quad_arr(z, tmp, group->poly, ctx))
			{
			unsigned long err = ERR_peek_last_error();
			
			if (ERR_GET_LIB(err) == ERR_LIB_BN && ERR_GET_REASON(err) == BN_R_NO_SOLUTION)
				{
				ERR_clear_error();
				ECerr(EC_F_EC_GF2M_SIMPLE_SET_COMPRESSED_COORDINATES, EC_R_INVALID_COMPRESSED_POINT);
				}
			else
				ECerr(EC_F_EC_GF2M_SIMPLE_SET_COMPRESSED_COORDINATES, ERR_R_BN_LIB);
			goto err;
			}
		z0 = (BN_is_odd(z)) ? 1 : 0;
		if (!group->meth->field_mul(group, y, x, z, ctx)) goto err;
		if (z0 != y_bit)
			{
			if (!BN_GF2m_add(y, y, x)) goto err;
			}
		}

	if (!EC_POINT_set_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;

	ret = 1;

 err:
	BN_CTX_end(ctx);
	if (new_ctx != NULL)
		BN_CTX_free(new_ctx);
	return ret;
	}


/* Converts an EC_POINT to an octet string.  
 * If buf is NULL, the encoded length will be returned.
 * If the length len of buf is smaller than required an error will be returned.
 */
size_t ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point, point_conversion_form_t form,
	unsigned char *buf, size_t len, BN_CTX *ctx)
	{
	size_t ret;
	BN_CTX *new_ctx = NULL;
	int used_ctx = 0;
	BIGNUM *x, *y, *yxi;
	size_t field_len, i, skip;

	if ((form != POINT_CONVERSION_COMPRESSED)
		&& (form != POINT_CONVERSION_UNCOMPRESSED)
		&& (form != POINT_CONVERSION_HYBRID))
		{
		ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_INVALID_FORM);
		goto err;
		}

	if (EC_POINT_is_at_infinity(group, point))
		{
		/* encodes to a single 0 octet */
		if (buf != NULL)
			{
			if (len < 1)
				{
				ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
				return 0;
				}
			buf[0] = 0;
			}
		return 1;
		}


	/* ret := required output buffer length */
	field_len = (EC_GROUP_get_degree(group) + 7) / 8;
	ret = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2*field_len;

	/* if 'buf' is NULL, just return required length */
	if (buf != NULL)
		{
		if (len < ret)
			{
			ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
			goto err;
			}

		if (ctx == NULL)
			{
			ctx = new_ctx = BN_CTX_new();
			if (ctx == NULL)
				return 0;
			}

		BN_CTX_start(ctx);
		used_ctx = 1;
		x = BN_CTX_get(ctx);
		y = BN_CTX_get(ctx);
		yxi = BN_CTX_get(ctx);
		if (yxi == NULL) goto err;

		if (!EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;

		buf[0] = form;
		if ((form != POINT_CONVERSION_UNCOMPRESSED) && !BN_is_zero(x))
			{
			if (!group->meth->field_div(group, yxi, y, x, ctx)) goto err;
			if (BN_is_odd(yxi)) buf[0]++;
			}

		i = 1;
		
		skip = field_len - BN_num_bytes(x);
		if (skip > field_len)
			{
			ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
			goto err;
			}
		while (skip > 0)
			{
			buf[i++] = 0;
			skip--;
			}
		skip = BN_bn2bin(x, buf + i);
		i += skip;
		if (i != 1 + field_len)
			{
			ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
			goto err;
			}

		if (form == POINT_CONVERSION_UNCOMPRESSED || form == POINT_CONVERSION_HYBRID)
			{
			skip = field_len - BN_num_bytes(y);
			if (skip > field_len)
				{
				ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
				goto err;
				}
			while (skip > 0)
				{
				buf[i++] = 0;
				skip--;
				}
			skip = BN_bn2bin(y, buf + i);
			i += skip;
			}

		if (i != ret)
			{
			ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
			goto err;
			}
		}
	
	if (used_ctx)
		BN_CTX_end(ctx);
	if (new_ctx != NULL)
		BN_CTX_free(new_ctx);
	return ret;

 err:
	if (used_ctx)
		BN_CTX_end(ctx);
	if (new_ctx != NULL)
		BN_CTX_free(new_ctx);
	return 0;
	}


/* Converts an octet string representation to an EC_POINT. 
 * Note that the simple implementation only uses affine coordinates.
 */
int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
	const unsigned char *buf, size_t len, BN_CTX *ctx)
	{
	point_conversion_form_t form;
	int y_bit;
	BN_CTX *new_ctx = NULL;
	BIGNUM *x, *y, *yxi;
	size_t field_len, enc_len;
	int ret = 0;

	if (len == 0)
		{
		ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_BUFFER_TOO_SMALL);
		return 0;
		}
	form = buf[0];
	y_bit = form & 1;
	form = form & ~1U;
	if ((form != 0)	&& (form != POINT_CONVERSION_COMPRESSED)
		&& (form != POINT_CONVERSION_UNCOMPRESSED)
		&& (form != POINT_CONVERSION_HYBRID))
		{
		ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
		return 0;
		}
	if ((form == 0 || form == POINT_CONVERSION_UNCOMPRESSED) && y_bit)
		{
		ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
		return 0;
		}

	if (form == 0)
		{
		if (len != 1)
			{
			ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
			return 0;
			}

		return EC_POINT_set_to_infinity(group, point);
		}
	
	field_len = (EC_GROUP_get_degree(group) + 7) / 8;
	enc_len = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2*field_len;

	if (len != enc_len)
		{
		ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
		return 0;
		}

	if (ctx == NULL)
		{
		ctx = new_ctx = BN_CTX_new();
		if (ctx == NULL)
			return 0;
		}

	BN_CTX_start(ctx);
	x = BN_CTX_get(ctx);
	y = BN_CTX_get(ctx);
	yxi = BN_CTX_get(ctx);
	if (yxi == NULL) goto err;

	if (!BN_bin2bn(buf + 1, field_len, x)) goto err;
	if (BN_ucmp(x, group->field) >= 0)
		{
		ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
		goto err;
		}

	if (form == POINT_CONVERSION_COMPRESSED)
		{
		if (!EC_POINT_set_compressed_coordinates_GF2m(group, point, x, y_bit, ctx)) goto err;
		}
	else
		{
		if (!BN_bin2bn(buf + 1 + field_len, field_len, y)) goto err;
		if (BN_ucmp(y, group->field) >= 0)
			{
			ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
			goto err;
			}
		if (form == POINT_CONVERSION_HYBRID)
			{
			if (!group->meth->field_div(group, yxi, y, x, ctx)) goto err;
			if (y_bit != BN_is_odd(yxi))
				{
				ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
				goto err;
				}
			}

		if (!EC_POINT_set_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
		}

	/* test required by X9.62 */
	if (!EC_POINT_is_on_curve(group, point, ctx))
		{
		ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
		goto err;
		}

	ret = 1;
	
 err:
	BN_CTX_end(ctx);
	if (new_ctx != NULL)
		BN_CTX_free(new_ctx);
	return ret;
	}
#endif
Commit	Line	Data
84b08eee DSH	1	/* crypto/ec/ec2_oct.c */
	2	/* ====================================================================
	3	* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
	4	*
	5	* The Elliptic Curve Public-Key Crypto Library (ECC Code) included
	6	* herein is developed by SUN MICROSYSTEMS, INC., and is contributed
	7	* to the OpenSSL project.
	8	*
	9	* The ECC Code is licensed pursuant to the OpenSSL open source
	10	* license provided below.
	11	*
	12	* The software is originally written by Sheueling Chang Shantz and
	13	* Douglas Stebila of Sun Microsystems Laboratories.
	14	*
	15	*/
	16	/* ====================================================================
	17	* Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved.
	18	*
	19	* Redistribution and use in source and binary forms, with or without
	20	* modification, are permitted provided that the following conditions
	21	* are met:
	22	*
	23	* 1. Redistributions of source code must retain the above copyright
	24	* notice, this list of conditions and the following disclaimer.
	25	*
	26	* 2. Redistributions in binary form must reproduce the above copyright
	27	* notice, this list of conditions and the following disclaimer in
	28	* the documentation and/or other materials provided with the
	29	* distribution.
	30	*
	31	* 3. All advertising materials mentioning features or use of this
	32	* software must display the following acknowledgment:
	33	* "This product includes software developed by the OpenSSL Project
	34	* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
	35	*
	36	* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
	37	* endorse or promote products derived from this software without
	38	* prior written permission. For written permission, please contact
	39	* openssl-core@openssl.org.
	40	*
	41	* 5. Products derived from this software may not be called "OpenSSL"
	42	* nor may "OpenSSL" appear in their names without prior written
	43	* permission of the OpenSSL Project.
	44	*
	45	* 6. Redistributions of any form whatsoever must retain the following
	46	* acknowledgment:
	47	* "This product includes software developed by the OpenSSL Project
	48	* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
	49	*
	50	* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
	51	* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	52	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	53	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
	54	* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	55	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	56	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
	57	* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	58	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	59	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	60	* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
	61	* OF THE POSSIBILITY OF SUCH DAMAGE.
	62	* ====================================================================
	63	*
	64	* This product includes cryptographic software written by Eric Young
65	* (eay@cryptsoft.com). This product includes software written by Tim
66	* Hudson (tjh@cryptsoft.com).
67	*
68	*/
69
84b08eee DSH	70	#include <openssl/err.h>
	71
	72	#include "ec_lcl.h"
	73
	74	#ifndef OPENSSL_NO_EC2M
	75
3a83462d MC	76	/*-
3a83462d MC	77	* Calculates and sets the affine coordinates of an EC_POINT from the given
84b08eee DSH	78	* compressed coordinates. Uses algorithm 2.3.4 of SEC 1.
	79	* Note that the simple implementation only uses affine coordinates.
	80	*
	81	* The method is from the following publication:
	82	*
	83	* Harper, Menezes, Vanstone:
	84	* "Public-Key Cryptosystems with Very Small Key Lengths",
	85	* EUROCRYPT '92, Springer-Verlag LNCS 658,
	86	* published February 1993
	87	*
	88	* US Patents 6,141,420 and 6,618,483 (Vanstone, Mullin, Agnew) describe
	89	* the same method, but claim no priority date earlier than July 29, 1994
	90	* (and additionally fail to cite the EUROCRYPT '92 publication as prior art).
	91	*/
	92	int ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP group, EC_POINT point,
	93	const BIGNUM x_, int y_bit, BN_CTX ctx)
	94	{
	95	BN_CTX *new_ctx = NULL;
	96	BIGNUM tmp, x, y, z;
	97	int ret = 0, z0;
	98
	99	/* clear error queue */
	100	ERR_clear_error();
	101
	102	if (ctx == NULL)
	103	{
	104	ctx = new_ctx = BN_CTX_new();
	105	if (ctx == NULL)
	106	return 0;
	107	}
	108
	109	y_bit = (y_bit != 0) ? 1 : 0;
	110
	111	BN_CTX_start(ctx);
	112	tmp = BN_CTX_get(ctx);
	113	x = BN_CTX_get(ctx);
	114	y = BN_CTX_get(ctx);
	115	z = BN_CTX_get(ctx);
	116	if (z == NULL) goto err;
	117
	118	if (!BN_GF2m_mod_arr(x, x_, group->poly)) goto err;
	119	if (BN_is_zero(x))
	120	{
5784a521	121	if (!BN_GF2m_mod_sqrt_arr(y, group->b, group->poly, ctx)) goto err;
84b08eee DSH	122	}
	123	else
	124	{
	125	if (!group->meth->field_sqr(group, tmp, x, ctx)) goto err;
5784a521 MC	126	if (!group->meth->field_div(group, tmp, group->b, tmp, ctx)) goto err;
5784a521 MC	127	if (!BN_GF2m_add(tmp, group->a, tmp)) goto err;
84b08eee DSH	128	if (!BN_GF2m_add(tmp, x, tmp)) goto err;
	129	if (!BN_GF2m_mod_solve_quad_arr(z, tmp, group->poly, ctx))
	130	{
	131	unsigned long err = ERR_peek_last_error();
	132
	133	if (ERR_GET_LIB(err) == ERR_LIB_BN && ERR_GET_REASON(err) == BN_R_NO_SOLUTION)
	134	{
	135	ERR_clear_error();
	136	ECerr(EC_F_EC_GF2M_SIMPLE_SET_COMPRESSED_COORDINATES, EC_R_INVALID_COMPRESSED_POINT);
	137	}
	138	else
	139	ECerr(EC_F_EC_GF2M_SIMPLE_SET_COMPRESSED_COORDINATES, ERR_R_BN_LIB);
	140	goto err;
	141	}
	142	z0 = (BN_is_odd(z)) ? 1 : 0;
	143	if (!group->meth->field_mul(group, y, x, z, ctx)) goto err;
	144	if (z0 != y_bit)
	145	{
	146	if (!BN_GF2m_add(y, y, x)) goto err;
	147	}
	148	}
	149
	150	if (!EC_POINT_set_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
	151
	152	ret = 1;
	153
	154	err:
	155	BN_CTX_end(ctx);
	156	if (new_ctx != NULL)
	157	BN_CTX_free(new_ctx);
	158	return ret;
	159	}
	160
	161
	162	/* Converts an EC_POINT to an octet string.
	163	* If buf is NULL, the encoded length will be returned.
	164	* If the length len of buf is smaller than required an error will be returned.
	165	*/
	166	size_t ec_GF2m_simple_point2oct(const EC_GROUP group, const EC_POINT point, point_conversion_form_t form,
	167	unsigned char buf, size_t len, BN_CTX ctx)
	168	{
	169	size_t ret;
	170	BN_CTX *new_ctx = NULL;
	171	int used_ctx = 0;
	172	BIGNUM x, y, *yxi;
	173	size_t field_len, i, skip;
	174
	175	if ((form != POINT_CONVERSION_COMPRESSED)
	176	&& (form != POINT_CONVERSION_UNCOMPRESSED)
	177	&& (form != POINT_CONVERSION_HYBRID))
	178	{
	179	ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_INVALID_FORM);
	180	goto err;
	181	}
	182
	183	if (EC_POINT_is_at_infinity(group, point))
	184	{
	185	/* encodes to a single 0 octet */
	186	if (buf != NULL)
	187	{
	188	if (len < 1)
	189	{
	190	ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
	191	return 0;
192	}
193	buf[0] = 0;
194	}
195	return 1;
196	}
197
198
199	/* ret := required output buffer length */
200	field_len = (EC_GROUP_get_degree(group) + 7) / 8;
201	ret = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2*field_len;
202
203	/* if 'buf' is NULL, just return required length */
204	if (buf != NULL)
205	{
206	if (len < ret)
207	{
208	ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
209	goto err;
210	}
211
212	if (ctx == NULL)
213	{
214	ctx = new_ctx = BN_CTX_new();
215	if (ctx == NULL)
216	return 0;
217	}
218
219	BN_CTX_start(ctx);
220	used_ctx = 1;
221	x = BN_CTX_get(ctx);
222	y = BN_CTX_get(ctx);
223	yxi = BN_CTX_get(ctx);
224	if (yxi == NULL) goto err;
225
226	if (!EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
227
228	buf[0] = form;
229	if ((form != POINT_CONVERSION_UNCOMPRESSED) && !BN_is_zero(x))
230	{
231	if (!group->meth->field_div(group, yxi, y, x, ctx)) goto err;
232	if (BN_is_odd(yxi)) buf[0]++;
233	}
234
235	i = 1;
236
237	skip = field_len - BN_num_bytes(x);
238	if (skip > field_len)
239	{
240	ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
241	goto err;
242	}
243	while (skip > 0)
244	{
245	buf[i++] = 0;
246	skip--;
247	}
248	skip = BN_bn2bin(x, buf + i);
249	i += skip;
250	if (i != 1 + field_len)
251	{
252	ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
253	goto err;
254	}
255
256	if (form == POINT_CONVERSION_UNCOMPRESSED \|\| form == POINT_CONVERSION_HYBRID)
257	{
258	skip = field_len - BN_num_bytes(y);
259	if (skip > field_len)
260	{
261	ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
262	goto err;
263	}
264	while (skip > 0)
265	{
266	buf[i++] = 0;
267	skip--;
268	}
269	skip = BN_bn2bin(y, buf + i);
270	i += skip;
271	}
272
273	if (i != ret)
274	{
275	ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
276	goto err;
277	}
278	}
279
280	if (used_ctx)
281	BN_CTX_end(ctx);
282	if (new_ctx != NULL)
283	BN_CTX_free(new_ctx);
284	return ret;
285
286	err:
287	if (used_ctx)
288	BN_CTX_end(ctx);
289	if (new_ctx != NULL)
290	BN_CTX_free(new_ctx);
291	return 0;
292	}
293
294
295	/* Converts an octet string representation to an EC_POINT.
296	* Note that the simple implementation only uses affine coordinates.
297	*/
298	int ec_GF2m_simple_oct2point(const EC_GROUP group, EC_POINT point,
299	const unsigned char buf, size_t len, BN_CTX ctx)
300	{
301	point_conversion_form_t form;
302	int y_bit;
303	BN_CTX *new_ctx = NULL;
304	BIGNUM x, y, *yxi;
305	size_t field_len, enc_len;
306	int ret = 0;
307
308	if (len == 0)
309	{
310	ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_BUFFER_TOO_SMALL);
311	return 0;
312	}
313	form = buf[0];
314	y_bit = form & 1;
315	form = form & ~1U;
316	if ((form != 0) && (form != POINT_CONVERSION_COMPRESSED)
317	&& (form != POINT_CONVERSION_UNCOMPRESSED)
318	&& (form != POINT_CONVERSION_HYBRID))
319	{
320	ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
321	return 0;
322	}
323	if ((form == 0 \|\| form == POINT_CONVERSION_UNCOMPRESSED) && y_bit)
324	{
325	ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
326	return 0;
327	}
328
329	if (form == 0)
330	{
331	if (len != 1)
332	{
333	ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
334	return 0;
335	}
336
337	return EC_POINT_set_to_infinity(group, point);
338	}
339
340	field_len = (EC_GROUP_get_degree(group) + 7) / 8;
341	enc_len = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2*field_len;
342
343	if (len != enc_len)
344	{
345	ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
346	return 0;
347	}
348
349	if (ctx == NULL)
350	{
351	ctx = new_ctx = BN_CTX_new();
352	if (ctx == NULL)
353	return 0;
354	}
355
356	BN_CTX_start(ctx);
357	x = BN_CTX_get(ctx);
358	y = BN_CTX_get(ctx);
359	yxi = BN_CTX_get(ctx);
360	if (yxi == NULL) goto err;
361
362	if (!BN_bin2bn(buf + 1, field_len, x)) goto err;
5784a521	363	if (BN_ucmp(x, group->field) >= 0)
84b08eee DSH	364	{
	365	ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
	366	goto err;
	367	}
	368
	369	if (form == POINT_CONVERSION_COMPRESSED)
	370	{
	371	if (!EC_POINT_set_compressed_coordinates_GF2m(group, point, x, y_bit, ctx)) goto err;
	372	}
	373	else
	374	{
	375	if (!BN_bin2bn(buf + 1 + field_len, field_len, y)) goto err;
5784a521	376	if (BN_ucmp(y, group->field) >= 0)
84b08eee DSH	377	{
	378	ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
	379	goto err;
	380	}
	381	if (form == POINT_CONVERSION_HYBRID)
	382	{
	383	if (!group->meth->field_div(group, yxi, y, x, ctx)) goto err;
	384	if (y_bit != BN_is_odd(yxi))
	385	{
	386	ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
	387	goto err;
	388	}
	389	}
	390
	391	if (!EC_POINT_set_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err;
	392	}
68d39f3c MC	393
	394	/* test required by X9.62 */
	395	if (!EC_POINT_is_on_curve(group, point, ctx))
84b08eee DSH	396	{
	397	ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
	398	goto err;
	399	}
	400
	401	ret = 1;
	402
	403	err:
	404	BN_CTX_end(ctx);
	405	if (new_ctx != NULL)
	406	BN_CTX_free(new_ctx);
	407	return ret;
	408	}
	409	#endif