crypto/ec/ec_lib.c

   1 /*
   2  * Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
   3  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
   4  *
   5  * Licensed under the OpenSSL license (the "License").  You may not use
   6  * this file except in compliance with the License.  You can obtain a copy
   7  * in the file LICENSE in the source distribution or at
   8  * https://www.openssl.org/source/license.html
   9  */
  10
  11 #include <string.h>
  12
  13 #include <openssl/err.h>
  14 #include <openssl/opensslv.h>
  15
  16 #include "ec_lcl.h"
  17
  18 /* functions for EC_GROUP objects */
  19
  20 EC_GROUP *EC_GROUP_new(const EC_METHOD *meth)
  21 {
  22     EC_GROUP *ret;
  23
  24     if (meth == NULL) {
  25         ECerr(EC_F_EC_GROUP_NEW, EC_R_SLOT_FULL);
  26         return NULL;
  27     }
  28     if (meth->group_init == 0) {
  29         ECerr(EC_F_EC_GROUP_NEW, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
  30         return NULL;
  31     }
  32
  33     ret = OPENSSL_zalloc(sizeof(*ret));
  34     if (ret == NULL) {
  35         ECerr(EC_F_EC_GROUP_NEW, ERR_R_MALLOC_FAILURE);
  36         return NULL;
  37     }
  38
  39     ret->meth = meth;
  40     if ((ret->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {
  41         ret->order = BN_new();
  42         if (ret->order == NULL)
  43             goto err;
  44         ret->cofactor = BN_new();
  45         if (ret->cofactor == NULL)
  46             goto err;
  47     }
  48     ret->asn1_flag = OPENSSL_EC_NAMED_CURVE;
  49     ret->asn1_form = POINT_CONVERSION_UNCOMPRESSED;
  50     if (!meth->group_init(ret))
  51         goto err;
  52     return ret;
  53
  54  err:
  55     BN_free(ret->order);
  56     BN_free(ret->cofactor);
  57     OPENSSL_free(ret);
  58     return NULL;
  59 }
  60
  61 void EC_pre_comp_free(EC_GROUP *group)
  62 {
  63     switch (group->pre_comp_type) {
  64     case PCT_none:
  65         break;
  66     case PCT_nistz256:
  67 #ifdef ECP_NISTZ256_ASM
  68         EC_nistz256_pre_comp_free(group->pre_comp.nistz256);
  69 #endif
  70         break;
  71 #ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
  72     case PCT_nistp224:
  73         EC_nistp224_pre_comp_free(group->pre_comp.nistp224);
  74         break;
  75     case PCT_nistp256:
  76         EC_nistp256_pre_comp_free(group->pre_comp.nistp256);
  77         break;
  78     case PCT_nistp521:
  79         EC_nistp521_pre_comp_free(group->pre_comp.nistp521);
  80         break;
  81 #else
  82     case PCT_nistp224:
  83     case PCT_nistp256:
  84     case PCT_nistp521:
  85         break;
  86 #endif
  87     case PCT_ec:
  88         EC_ec_pre_comp_free(group->pre_comp.ec);
  89         break;
  90     }
  91     group->pre_comp.ec = NULL;
  92 }
  93
  94 void EC_GROUP_free(EC_GROUP *group)
  95 {
  96     if (!group)
  97         return;
  98
  99     if (group->meth->group_finish != 0)
 100         group->meth->group_finish(group);
 101
 102     EC_pre_comp_free(group);
 103     BN_MONT_CTX_free(group->mont_data);
 104     EC_POINT_free(group->generator);
 105     BN_free(group->order);
 106     BN_free(group->cofactor);
 107     OPENSSL_free(group->seed);
 108     OPENSSL_free(group);
 109 }
 110
 111 void EC_GROUP_clear_free(EC_GROUP *group)
 112 {
 113     if (!group)
 114         return;
 115
 116     if (group->meth->group_clear_finish != 0)
 117         group->meth->group_clear_finish(group);
 118     else if (group->meth->group_finish != 0)
 119         group->meth->group_finish(group);
 120
 121     EC_pre_comp_free(group);
 122     BN_MONT_CTX_free(group->mont_data);
 123     EC_POINT_clear_free(group->generator);
 124     BN_clear_free(group->order);
 125     BN_clear_free(group->cofactor);
 126     OPENSSL_clear_free(group->seed, group->seed_len);
 127     OPENSSL_clear_free(group, sizeof(*group));
 128 }
 129
 130 int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
 131 {
 132     if (dest->meth->group_copy == 0) {
 133         ECerr(EC_F_EC_GROUP_COPY, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 134         return 0;
 135     }
 136     if (dest->meth != src->meth) {
 137         ECerr(EC_F_EC_GROUP_COPY, EC_R_INCOMPATIBLE_OBJECTS);
 138         return 0;
 139     }
 140     if (dest == src)
 141         return 1;
 142
 143     /* Copy precomputed */
 144     dest->pre_comp_type = src->pre_comp_type;
 145     switch (src->pre_comp_type) {
 146     case PCT_none:
 147         dest->pre_comp.ec = NULL;
 148         break;
 149     case PCT_nistz256:
 150 #ifdef ECP_NISTZ256_ASM
 151         dest->pre_comp.nistz256 = EC_nistz256_pre_comp_dup(src->pre_comp.nistz256);
 152 #endif
 153         break;
 154 #ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
 155     case PCT_nistp224:
 156         dest->pre_comp.nistp224 = EC_nistp224_pre_comp_dup(src->pre_comp.nistp224);
 157         break;
 158     case PCT_nistp256:
 159         dest->pre_comp.nistp256 = EC_nistp256_pre_comp_dup(src->pre_comp.nistp256);
 160         break;
 161     case PCT_nistp521:
 162         dest->pre_comp.nistp521 = EC_nistp521_pre_comp_dup(src->pre_comp.nistp521);
 163         break;
 164 #else
 165     case PCT_nistp224:
 166     case PCT_nistp256:
 167     case PCT_nistp521:
 168         break;
 169 #endif
 170     case PCT_ec:
 171         dest->pre_comp.ec = EC_ec_pre_comp_dup(src->pre_comp.ec);
 172         break;
 173     }
 174
 175     if (src->mont_data != NULL) {
 176         if (dest->mont_data == NULL) {
 177             dest->mont_data = BN_MONT_CTX_new();
 178             if (dest->mont_data == NULL)
 179                 return 0;
 180         }
 181         if (!BN_MONT_CTX_copy(dest->mont_data, src->mont_data))
 182             return 0;
 183     } else {
 184         /* src->generator == NULL */
 185         BN_MONT_CTX_free(dest->mont_data);
 186         dest->mont_data = NULL;
 187     }
 188
 189     if (src->generator != NULL) {
 190         if (dest->generator == NULL) {
 191             dest->generator = EC_POINT_new(dest);
 192             if (dest->generator == NULL)
 193                 return 0;
 194         }
 195         if (!EC_POINT_copy(dest->generator, src->generator))
 196             return 0;
 197     } else {
 198         /* src->generator == NULL */
 199         EC_POINT_clear_free(dest->generator);
 200         dest->generator = NULL;
 201     }
 202
 203     if ((src->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {
 204         if (!BN_copy(dest->order, src->order))
 205             return 0;
 206         if (!BN_copy(dest->cofactor, src->cofactor))
 207             return 0;
 208     }
 209
 210     dest->curve_name = src->curve_name;
 211     dest->asn1_flag = src->asn1_flag;
 212     dest->asn1_form = src->asn1_form;
 213
 214     if (src->seed) {
 215         OPENSSL_free(dest->seed);
 216         dest->seed = OPENSSL_malloc(src->seed_len);
 217         if (dest->seed == NULL)
 218             return 0;
 219         if (!memcpy(dest->seed, src->seed, src->seed_len))
 220             return 0;
 221         dest->seed_len = src->seed_len;
 222     } else {
 223         OPENSSL_free(dest->seed);
 224         dest->seed = NULL;
 225         dest->seed_len = 0;
 226     }
 227
 228     return dest->meth->group_copy(dest, src);
 229 }
 230
 231 EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
 232 {
 233     EC_GROUP *t = NULL;
 234     int ok = 0;
 235
 236     if (a == NULL)
 237         return NULL;
 238
 239     if ((t = EC_GROUP_new(a->meth)) == NULL)
 240         return NULL;
 241     if (!EC_GROUP_copy(t, a))
 242         goto err;
 243
 244     ok = 1;
 245
 246  err:
 247     if (!ok) {
 248         EC_GROUP_free(t);
 249         return NULL;
 250     }
 251         return t;
 252 }
 253
 254 const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *group)
 255 {
 256     return group->meth;
 257 }
 258
 259 int EC_METHOD_get_field_type(const EC_METHOD *meth)
 260 {
 261     return meth->field_type;
 262 }
 263
 264 static int ec_precompute_mont_data(EC_GROUP *);
 265
 266 int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
 267                            const BIGNUM *order, const BIGNUM *cofactor)
 268 {
 269     if (generator == NULL) {
 270         ECerr(EC_F_EC_GROUP_SET_GENERATOR, ERR_R_PASSED_NULL_PARAMETER);
 271         return 0;
 272     }
 273
 274     if (group->generator == NULL) {
 275         group->generator = EC_POINT_new(group);
 276         if (group->generator == NULL)
 277             return 0;
 278     }
 279     if (!EC_POINT_copy(group->generator, generator))
 280         return 0;
 281
 282     if (order != NULL) {
 283         if (!BN_copy(group->order, order))
 284             return 0;
 285     } else
 286         BN_zero(group->order);
 287
 288     if (cofactor != NULL) {
 289         if (!BN_copy(group->cofactor, cofactor))
 290             return 0;
 291     } else
 292         BN_zero(group->cofactor);
 293
 294     /*
 295      * Some groups have an order with
 296      * factors of two, which makes the Montgomery setup fail.
 297      * |group->mont_data| will be NULL in this case.
 298      */
 299     if (BN_is_odd(group->order)) {
 300         return ec_precompute_mont_data(group);
 301     }
 302
 303     BN_MONT_CTX_free(group->mont_data);
 304     group->mont_data = NULL;
 305     return 1;
 306 }
 307
 308 const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group)
 309 {
 310     return group->generator;
 311 }
 312
 313 BN_MONT_CTX *EC_GROUP_get_mont_data(const EC_GROUP *group)
 314 {
 315     return group->mont_data;
 316 }
 317
 318 int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx)
 319 {
 320     if (group->order == NULL)
 321         return 0;
 322     if (!BN_copy(order, group->order))
 323         return 0;
 324
 325     return !BN_is_zero(order);
 326 }
 327
 328 const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group)
 329 {
 330     return group->order;
 331 }
 332
 333 int EC_GROUP_order_bits(const EC_GROUP *group)
 334 {
 335     return group->meth->group_order_bits(group);
 336 }
 337
 338 int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor,
 339                           BN_CTX *ctx)
 340 {
 341
 342     if (group->cofactor == NULL)
 343         return 0;
 344     if (!BN_copy(cofactor, group->cofactor))
 345         return 0;
 346
 347     return !BN_is_zero(group->cofactor);
 348 }
 349
 350 const BIGNUM *EC_GROUP_get0_cofactor(const EC_GROUP *group)
 351 {
 352     return group->cofactor;
 353 }
 354
 355 void EC_GROUP_set_curve_name(EC_GROUP *group, int nid)
 356 {
 357     group->curve_name = nid;
 358 }
 359
 360 int EC_GROUP_get_curve_name(const EC_GROUP *group)
 361 {
 362     return group->curve_name;
 363 }
 364
 365 void EC_GROUP_set_asn1_flag(EC_GROUP *group, int flag)
 366 {
 367     group->asn1_flag = flag;
 368 }
 369
 370 int EC_GROUP_get_asn1_flag(const EC_GROUP *group)
 371 {
 372     return group->asn1_flag;
 373 }
 374
 375 void EC_GROUP_set_point_conversion_form(EC_GROUP *group,
 376                                         point_conversion_form_t form)
 377 {
 378     group->asn1_form = form;
 379 }
 380
 381 point_conversion_form_t EC_GROUP_get_point_conversion_form(const EC_GROUP
 382                                                            *group)
 383 {
 384     return group->asn1_form;
 385 }
 386
 387 size_t EC_GROUP_set_seed(EC_GROUP *group, const unsigned char *p, size_t len)
 388 {
 389     OPENSSL_free(group->seed);
 390     group->seed = NULL;
 391     group->seed_len = 0;
 392
 393     if (!len || !p)
 394         return 1;
 395
 396     if ((group->seed = OPENSSL_malloc(len)) == NULL)
 397         return 0;
 398     memcpy(group->seed, p, len);
 399     group->seed_len = len;
 400
 401     return len;
 402 }
 403
 404 unsigned char *EC_GROUP_get0_seed(const EC_GROUP *group)
 405 {
 406     return group->seed;
 407 }
 408
 409 size_t EC_GROUP_get_seed_len(const EC_GROUP *group)
 410 {
 411     return group->seed_len;
 412 }
 413
 414 int EC_GROUP_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
 415                            const BIGNUM *b, BN_CTX *ctx)
 416 {
 417     if (group->meth->group_set_curve == 0) {
 418         ECerr(EC_F_EC_GROUP_SET_CURVE_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 419         return 0;
 420     }
 421     return group->meth->group_set_curve(group, p, a, b, ctx);
 422 }
 423
 424 int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
 425                            BIGNUM *b, BN_CTX *ctx)
 426 {
 427     if (group->meth->group_get_curve == 0) {
 428         ECerr(EC_F_EC_GROUP_GET_CURVE_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 429         return 0;
 430     }
 431     return group->meth->group_get_curve(group, p, a, b, ctx);
 432 }
 433
 434 #ifndef OPENSSL_NO_EC2M
 435 int EC_GROUP_set_curve_GF2m(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
 436                             const BIGNUM *b, BN_CTX *ctx)
 437 {
 438     if (group->meth->group_set_curve == 0) {
 439         ECerr(EC_F_EC_GROUP_SET_CURVE_GF2M,
 440               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 441         return 0;
 442     }
 443     return group->meth->group_set_curve(group, p, a, b, ctx);
 444 }
 445
 446 int EC_GROUP_get_curve_GF2m(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
 447                             BIGNUM *b, BN_CTX *ctx)
 448 {
 449     if (group->meth->group_get_curve == 0) {
 450         ECerr(EC_F_EC_GROUP_GET_CURVE_GF2M,
 451               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 452         return 0;
 453     }
 454     return group->meth->group_get_curve(group, p, a, b, ctx);
 455 }
 456 #endif
 457
 458 int EC_GROUP_get_degree(const EC_GROUP *group)
 459 {
 460     if (group->meth->group_get_degree == 0) {
 461         ECerr(EC_F_EC_GROUP_GET_DEGREE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 462         return 0;
 463     }
 464     return group->meth->group_get_degree(group);
 465 }
 466
 467 int EC_GROUP_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
 468 {
 469     if (group->meth->group_check_discriminant == 0) {
 470         ECerr(EC_F_EC_GROUP_CHECK_DISCRIMINANT,
 471               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 472         return 0;
 473     }
 474     return group->meth->group_check_discriminant(group, ctx);
 475 }
 476
 477 int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx)
 478 {
 479     int r = 0;
 480     BIGNUM *a1, *a2, *a3, *b1, *b2, *b3;
 481     BN_CTX *ctx_new = NULL;
 482
 483     /* compare the field types */
 484     if (EC_METHOD_get_field_type(EC_GROUP_method_of(a)) !=
 485         EC_METHOD_get_field_type(EC_GROUP_method_of(b)))
 486         return 1;
 487     /* compare the curve name (if present in both) */
 488     if (EC_GROUP_get_curve_name(a) && EC_GROUP_get_curve_name(b) &&
 489         EC_GROUP_get_curve_name(a) != EC_GROUP_get_curve_name(b))
 490         return 1;
 491     if (a->meth->flags & EC_FLAGS_CUSTOM_CURVE)
 492         return 0;
 493
 494     if (ctx == NULL)
 495         ctx_new = ctx = BN_CTX_new();
 496     if (ctx == NULL)
 497         return -1;
 498
 499     BN_CTX_start(ctx);
 500     a1 = BN_CTX_get(ctx);
 501     a2 = BN_CTX_get(ctx);
 502     a3 = BN_CTX_get(ctx);
 503     b1 = BN_CTX_get(ctx);
 504     b2 = BN_CTX_get(ctx);
 505     b3 = BN_CTX_get(ctx);
 506     if (b3 == NULL) {
 507         BN_CTX_end(ctx);
 508         BN_CTX_free(ctx_new);
 509         return -1;
 510     }
 511
 512     /*
 513      * XXX This approach assumes that the external representation of curves
 514      * over the same field type is the same.
 515      */
 516     if (!a->meth->group_get_curve(a, a1, a2, a3, ctx) ||
 517         !b->meth->group_get_curve(b, b1, b2, b3, ctx))
 518         r = 1;
 519
 520     if (r || BN_cmp(a1, b1) || BN_cmp(a2, b2) || BN_cmp(a3, b3))
 521         r = 1;
 522
 523     /* XXX EC_POINT_cmp() assumes that the methods are equal */
 524     if (r || EC_POINT_cmp(a, EC_GROUP_get0_generator(a),
 525                           EC_GROUP_get0_generator(b), ctx))
 526         r = 1;
 527
 528     if (!r) {
 529         const BIGNUM *ao, *bo, *ac, *bc;
 530         /* compare the order and cofactor */
 531         ao = EC_GROUP_get0_order(a);
 532         bo = EC_GROUP_get0_order(b);
 533         ac = EC_GROUP_get0_cofactor(a);
 534         bc = EC_GROUP_get0_cofactor(b);
 535         if (ao == NULL || bo == NULL) {
 536             BN_CTX_end(ctx);
 537             BN_CTX_free(ctx_new);
 538             return -1;
 539         }
 540         if (BN_cmp(ao, bo) || BN_cmp(ac, bc))
 541             r = 1;
 542     }
 543
 544     BN_CTX_end(ctx);
 545     BN_CTX_free(ctx_new);
 546
 547     return r;
 548 }
 549
 550 /* functions for EC_POINT objects */
 551
 552 EC_POINT *EC_POINT_new(const EC_GROUP *group)
 553 {
 554     EC_POINT *ret;
 555
 556     if (group == NULL) {
 557         ECerr(EC_F_EC_POINT_NEW, ERR_R_PASSED_NULL_PARAMETER);
 558         return NULL;
 559     }
 560     if (group->meth->point_init == 0) {
 561         ECerr(EC_F_EC_POINT_NEW, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 562         return NULL;
 563     }
 564
 565     ret = OPENSSL_zalloc(sizeof(*ret));
 566     if (ret == NULL) {
 567         ECerr(EC_F_EC_POINT_NEW, ERR_R_MALLOC_FAILURE);
 568         return NULL;
 569     }
 570
 571     ret->meth = group->meth;
 572
 573     if (!ret->meth->point_init(ret)) {
 574         OPENSSL_free(ret);
 575         return NULL;
 576     }
 577
 578     return ret;
 579 }
 580
 581 void EC_POINT_free(EC_POINT *point)
 582 {
 583     if (!point)
 584         return;
 585
 586     if (point->meth->point_finish != 0)
 587         point->meth->point_finish(point);
 588     OPENSSL_free(point);
 589 }
 590
 591 void EC_POINT_clear_free(EC_POINT *point)
 592 {
 593     if (!point)
 594         return;
 595
 596     if (point->meth->point_clear_finish != 0)
 597         point->meth->point_clear_finish(point);
 598     else if (point->meth->point_finish != 0)
 599         point->meth->point_finish(point);
 600     OPENSSL_clear_free(point, sizeof(*point));
 601 }
 602
 603 int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src)
 604 {
 605     if (dest->meth->point_copy == 0) {
 606         ECerr(EC_F_EC_POINT_COPY, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 607         return 0;
 608     }
 609     if (dest->meth != src->meth) {
 610         ECerr(EC_F_EC_POINT_COPY, EC_R_INCOMPATIBLE_OBJECTS);
 611         return 0;
 612     }
 613     if (dest == src)
 614         return 1;
 615     return dest->meth->point_copy(dest, src);
 616 }
 617
 618 EC_POINT *EC_POINT_dup(const EC_POINT *a, const EC_GROUP *group)
 619 {
 620     EC_POINT *t;
 621     int r;
 622
 623     if (a == NULL)
 624         return NULL;
 625
 626     t = EC_POINT_new(group);
 627     if (t == NULL)
 628         return NULL;
 629     r = EC_POINT_copy(t, a);
 630     if (!r) {
 631         EC_POINT_free(t);
 632         return NULL;
 633     }
 634     return t;
 635 }
 636
 637 const EC_METHOD *EC_POINT_method_of(const EC_POINT *point)
 638 {
 639     return point->meth;
 640 }
 641
 642 int EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point)
 643 {
 644     if (group->meth->point_set_to_infinity == 0) {
 645         ECerr(EC_F_EC_POINT_SET_TO_INFINITY,
 646               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 647         return 0;
 648     }
 649     if (group->meth != point->meth) {
 650         ECerr(EC_F_EC_POINT_SET_TO_INFINITY, EC_R_INCOMPATIBLE_OBJECTS);
 651         return 0;
 652     }
 653     return group->meth->point_set_to_infinity(group, point);
 654 }
 655
 656 int EC_POINT_set_Jprojective_coordinates_GFp(const EC_GROUP *group,
 657                                              EC_POINT *point, const BIGNUM *x,
 658                                              const BIGNUM *y, const BIGNUM *z,
 659                                              BN_CTX *ctx)
 660 {
 661     if (group->meth->point_set_Jprojective_coordinates_GFp == 0) {
 662         ECerr(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP,
 663               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 664         return 0;
 665     }
 666     if (group->meth != point->meth) {
 667         ECerr(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP,
 668               EC_R_INCOMPATIBLE_OBJECTS);
 669         return 0;
 670     }
 671     return group->meth->point_set_Jprojective_coordinates_GFp(group, point, x,
 672                                                               y, z, ctx);
 673 }
 674
 675 int EC_POINT_get_Jprojective_coordinates_GFp(const EC_GROUP *group,
 676                                              const EC_POINT *point, BIGNUM *x,
 677                                              BIGNUM *y, BIGNUM *z,
 678                                              BN_CTX *ctx)
 679 {
 680     if (group->meth->point_get_Jprojective_coordinates_GFp == 0) {
 681         ECerr(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP,
 682               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 683         return 0;
 684     }
 685     if (group->meth != point->meth) {
 686         ECerr(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP,
 687               EC_R_INCOMPATIBLE_OBJECTS);
 688         return 0;
 689     }
 690     return group->meth->point_get_Jprojective_coordinates_GFp(group, point, x,
 691                                                               y, z, ctx);
 692 }
 693
 694 int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group,
 695                                         EC_POINT *point, const BIGNUM *x,
 696                                         const BIGNUM *y, BN_CTX *ctx)
 697 {
 698     if (group->meth->point_set_affine_coordinates == 0) {
 699         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP,
 700               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 701         return 0;
 702     }
 703     if (group->meth != point->meth) {
 704         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP,
 705               EC_R_INCOMPATIBLE_OBJECTS);
 706         return 0;
 707     }
 708     if (!group->meth->point_set_affine_coordinates(group, point, x, y, ctx))
 709         return 0;
 710
 711     if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
 712         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP,
 713               EC_R_POINT_IS_NOT_ON_CURVE);
 714         return 0;
 715     }
 716     return 1;
 717 }
 718
 719 #ifndef OPENSSL_NO_EC2M
 720 int EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP *group,
 721                                          EC_POINT *point, const BIGNUM *x,
 722                                          const BIGNUM *y, BN_CTX *ctx)
 723 {
 724     if (group->meth->point_set_affine_coordinates == 0) {
 725         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M,
 726               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 727         return 0;
 728     }
 729     if (group->meth != point->meth) {
 730         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M,
 731               EC_R_INCOMPATIBLE_OBJECTS);
 732         return 0;
 733     }
 734     if (!group->meth->point_set_affine_coordinates(group, point, x, y, ctx))
 735         return 0;
 736
 737     if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
 738         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M,
 739               EC_R_POINT_IS_NOT_ON_CURVE);
 740         return 0;
 741     }
 742     return 1;
 743 }
 744 #endif
 745
 746 int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group,
 747                                         const EC_POINT *point, BIGNUM *x,
 748                                         BIGNUM *y, BN_CTX *ctx)
 749 {
 750     if (group->meth->point_get_affine_coordinates == 0) {
 751         ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP,
 752               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 753         return 0;
 754     }
 755     if (group->meth != point->meth) {
 756         ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP,
 757               EC_R_INCOMPATIBLE_OBJECTS);
 758         return 0;
 759     }
 760     return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
 761 }
 762
 763 #ifndef OPENSSL_NO_EC2M
 764 int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *group,
 765                                          const EC_POINT *point, BIGNUM *x,
 766                                          BIGNUM *y, BN_CTX *ctx)
 767 {
 768     if (group->meth->point_get_affine_coordinates == 0) {
 769         ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M,
 770               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 771         return 0;
 772     }
 773     if (group->meth != point->meth) {
 774         ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M,
 775               EC_R_INCOMPATIBLE_OBJECTS);
 776         return 0;
 777     }
 778     return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
 779 }
 780 #endif
 781
 782 int EC_POINT_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
 783                  const EC_POINT *b, BN_CTX *ctx)
 784 {
 785     if (group->meth->add == 0) {
 786         ECerr(EC_F_EC_POINT_ADD, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 787         return 0;
 788     }
 789     if ((group->meth != r->meth) || (r->meth != a->meth)
 790         || (a->meth != b->meth)) {
 791         ECerr(EC_F_EC_POINT_ADD, EC_R_INCOMPATIBLE_OBJECTS);
 792         return 0;
 793     }
 794     return group->meth->add(group, r, a, b, ctx);
 795 }
 796
 797 int EC_POINT_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
 798                  BN_CTX *ctx)
 799 {
 800     if (group->meth->dbl == 0) {
 801         ECerr(EC_F_EC_POINT_DBL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 802         return 0;
 803     }
 804     if ((group->meth != r->meth) || (r->meth != a->meth)) {
 805         ECerr(EC_F_EC_POINT_DBL, EC_R_INCOMPATIBLE_OBJECTS);
 806         return 0;
 807     }
 808     return group->meth->dbl(group, r, a, ctx);
 809 }
 810
 811 int EC_POINT_invert(const EC_GROUP *group, EC_POINT *a, BN_CTX *ctx)
 812 {
 813     if (group->meth->invert == 0) {
 814         ECerr(EC_F_EC_POINT_INVERT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 815         return 0;
 816     }
 817     if (group->meth != a->meth) {
 818         ECerr(EC_F_EC_POINT_INVERT, EC_R_INCOMPATIBLE_OBJECTS);
 819         return 0;
 820     }
 821     return group->meth->invert(group, a, ctx);
 822 }
 823
 824 int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
 825 {
 826     if (group->meth->is_at_infinity == 0) {
 827         ECerr(EC_F_EC_POINT_IS_AT_INFINITY,
 828               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 829         return 0;
 830     }
 831     if (group->meth != point->meth) {
 832         ECerr(EC_F_EC_POINT_IS_AT_INFINITY, EC_R_INCOMPATIBLE_OBJECTS);
 833         return 0;
 834     }
 835     return group->meth->is_at_infinity(group, point);
 836 }
 837
 838 /*
 839  * Check whether an EC_POINT is on the curve or not. Note that the return
 840  * value for this function should NOT be treated as a boolean. Return values:
 841  *  1: The point is on the curve
 842  *  0: The point is not on the curve
 843  * -1: An error occurred
 844  */
 845 int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
 846                          BN_CTX *ctx)
 847 {
 848     if (group->meth->is_on_curve == 0) {
 849         ECerr(EC_F_EC_POINT_IS_ON_CURVE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 850         return 0;
 851     }
 852     if (group->meth != point->meth) {
 853         ECerr(EC_F_EC_POINT_IS_ON_CURVE, EC_R_INCOMPATIBLE_OBJECTS);
 854         return 0;
 855     }
 856     return group->meth->is_on_curve(group, point, ctx);
 857 }
 858
 859 int EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b,
 860                  BN_CTX *ctx)
 861 {
 862     if (group->meth->point_cmp == 0) {
 863         ECerr(EC_F_EC_POINT_CMP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 864         return -1;
 865     }
 866     if ((group->meth != a->meth) || (a->meth != b->meth)) {
 867         ECerr(EC_F_EC_POINT_CMP, EC_R_INCOMPATIBLE_OBJECTS);
 868         return -1;
 869     }
 870     return group->meth->point_cmp(group, a, b, ctx);
 871 }
 872
 873 int EC_POINT_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx)
 874 {
 875     if (group->meth->make_affine == 0) {
 876         ECerr(EC_F_EC_POINT_MAKE_AFFINE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 877         return 0;
 878     }
 879     if (group->meth != point->meth) {
 880         ECerr(EC_F_EC_POINT_MAKE_AFFINE, EC_R_INCOMPATIBLE_OBJECTS);
 881         return 0;
 882     }
 883     return group->meth->make_affine(group, point, ctx);
 884 }
 885
 886 int EC_POINTs_make_affine(const EC_GROUP *group, size_t num,
 887                           EC_POINT *points[], BN_CTX *ctx)
 888 {
 889     size_t i;
 890
 891     if (group->meth->points_make_affine == 0) {
 892         ECerr(EC_F_EC_POINTS_MAKE_AFFINE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 893         return 0;
 894     }
 895     for (i = 0; i < num; i++) {
 896         if (group->meth != points[i]->meth) {
 897             ECerr(EC_F_EC_POINTS_MAKE_AFFINE, EC_R_INCOMPATIBLE_OBJECTS);
 898             return 0;
 899         }
 900     }
 901     return group->meth->points_make_affine(group, num, points, ctx);
 902 }
 903
 904 /*
 905  * Functions for point multiplication. If group->meth->mul is 0, we use the
 906  * wNAF-based implementations in ec_mult.c; otherwise we dispatch through
 907  * methods.
 908  */
 909
 910 int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
 911                   size_t num, const EC_POINT *points[],
 912                   const BIGNUM *scalars[], BN_CTX *ctx)
 913 {
 914     if (group->meth->mul == 0)
 915         /* use default */
 916         return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
 917
 918     return group->meth->mul(group, r, scalar, num, points, scalars, ctx);
 919 }
 920
 921 int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
 922                  const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
 923 {
 924     /* just a convenient interface to EC_POINTs_mul() */
 925
 926     const EC_POINT *points[1];
 927     const BIGNUM *scalars[1];
 928
 929     points[0] = point;
 930     scalars[0] = p_scalar;
 931
 932     return EC_POINTs_mul(group, r, g_scalar,
 933                          (point != NULL
 934                           && p_scalar != NULL), points, scalars, ctx);
 935 }
 936
 937 int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
 938 {
 939     if (group->meth->mul == 0)
 940         /* use default */
 941         return ec_wNAF_precompute_mult(group, ctx);
 942
 943     if (group->meth->precompute_mult != 0)
 944         return group->meth->precompute_mult(group, ctx);
 945     else
 946         return 1;               /* nothing to do, so report success */
 947 }
 948
 949 int EC_GROUP_have_precompute_mult(const EC_GROUP *group)
 950 {
 951     if (group->meth->mul == 0)
 952         /* use default */
 953         return ec_wNAF_have_precompute_mult(group);
 954
 955     if (group->meth->have_precompute_mult != 0)
 956         return group->meth->have_precompute_mult(group);
 957     else
 958         return 0;               /* cannot tell whether precomputation has
 959                                  * been performed */
 960 }
 961
 962 /*
 963  * ec_precompute_mont_data sets |group->mont_data| from |group->order| and
 964  * returns one on success. On error it returns zero.
 965  */
 966 static int ec_precompute_mont_data(EC_GROUP *group)
 967 {
 968     BN_CTX *ctx = BN_CTX_new();
 969     int ret = 0;
 970
 971     BN_MONT_CTX_free(group->mont_data);
 972     group->mont_data = NULL;
 973
 974     if (ctx == NULL)
 975         goto err;
 976
 977     group->mont_data = BN_MONT_CTX_new();
 978     if (group->mont_data == NULL)
 979         goto err;
 980
 981     if (!BN_MONT_CTX_set(group->mont_data, group->order, ctx)) {
 982         BN_MONT_CTX_free(group->mont_data);
 983         group->mont_data = NULL;
 984         goto err;
 985     }
 986
 987     ret = 1;
 988
 989  err:
 990
 991     BN_CTX_free(ctx);
 992     return ret;
 993 }
 994
 995 int EC_KEY_set_ex_data(EC_KEY *key, int idx, void *arg)
 996 {
 997     return CRYPTO_set_ex_data(&key->ex_data, idx, arg);
 998 }
 999
1000 void *EC_KEY_get_ex_data(const EC_KEY *key, int idx)
1001 {
1002     return CRYPTO_get_ex_data(&key->ex_data, idx);
1003 }
1004
1005 int ec_group_simple_order_bits(const EC_GROUP *group)
1006 {
1007     if (group->order == NULL)
1008         return 0;
1009     return BN_num_bits(group->order);
1010 }
1011
1012 int EC_GROUP_do_inverse_ord(const EC_GROUP *group, BIGNUM *res,
1013                             BIGNUM *x, BN_CTX *ctx)
1014 {
1015     if (group->meth->field_inverse_mod_ord != NULL)
1016         return group->meth->field_inverse_mod_ord(group, res, x, ctx);
1017     else
1018         return 0;
1019 }