]>
Commit | Line | Data |
---|---|---|
1308e022 | 1 | /* |
f53c7764 | 2 | * Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved. |
1308e022 | 3 | * Copyright 2015-2016 Cryptography Research, Inc. |
7324473f | 4 | * |
a7f182b7 | 5 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
1308e022 MC |
6 | * this file except in compliance with the License. You can obtain a copy |
7 | * in the file LICENSE in the source distribution or at | |
8 | * https://www.openssl.org/source/license.html | |
7324473f | 9 | * |
1308e022 | 10 | * Originally written by Mike Hamburg |
7324473f MC |
11 | */ |
12 | ||
ae4186b0 DMSP |
13 | #ifndef OSSL_CRYPTO_EC_CURVE448_POINT_448_H |
14 | # define OSSL_CRYPTO_EC_CURVE448_POINT_448_H | |
7324473f | 15 | |
205fd638 MC |
16 | # include "curve448utils.h" |
17 | # include "field.h" | |
7324473f | 18 | |
9fd3c858 MC |
19 | /* Comb config: number of combs, n, t, s. */ |
20 | #define COMBS_N 5 | |
21 | #define COMBS_T 5 | |
22 | #define COMBS_S 18 | |
23 | ||
24 | /* Projective Niels coordinates */ | |
25 | typedef struct { | |
26 | gf a, b, c; | |
27 | } niels_s, niels_t[1]; | |
28 | typedef struct { | |
29 | niels_t n; | |
30 | gf z; | |
2abe3cad | 31 | } pniels_t[1]; |
9fd3c858 MC |
32 | |
33 | /* Precomputed base */ | |
34 | struct curve448_precomputed_s { | |
35 | niels_t table[COMBS_N << (COMBS_T - 1)]; | |
36 | }; | |
7324473f | 37 | |
db90b274 | 38 | # define C448_SCALAR_LIMBS ((446-1)/C448_WORD_BITS+1) |
7324473f | 39 | |
8d55f844 | 40 | /* The number of bits in a scalar */ |
db90b274 | 41 | # define C448_SCALAR_BITS 446 |
7324473f | 42 | |
8d55f844 | 43 | /* Number of bytes in a serialized scalar. */ |
db90b274 | 44 | # define C448_SCALAR_BYTES 56 |
7324473f | 45 | |
8d55f844 | 46 | /* X448 encoding ratio. */ |
db90b274 | 47 | # define X448_ENCODE_RATIO 2 |
7324473f | 48 | |
8d55f844 | 49 | /* Number of bytes in an x448 public key */ |
db90b274 | 50 | # define X448_PUBLIC_BYTES 56 |
7324473f | 51 | |
8d55f844 | 52 | /* Number of bytes in an x448 private key */ |
db90b274 | 53 | # define X448_PRIVATE_BYTES 56 |
7324473f | 54 | |
8d55f844 | 55 | /* Twisted Edwards extended homogeneous coordinates */ |
e7772577 | 56 | typedef struct curve448_point_s { |
35b7c85a | 57 | gf x, y, z, t; |
e7772577 | 58 | } curve448_point_t[1]; |
7324473f | 59 | |
8d55f844 | 60 | /* Precomputed table based on a point. Can be trivial implementation. */ |
e7772577 | 61 | struct curve448_precomputed_s; |
7324473f | 62 | |
8d55f844 | 63 | /* Precomputed table based on a point. Can be trivial implementation. */ |
205fd638 | 64 | typedef struct curve448_precomputed_s curve448_precomputed_s; |
7324473f | 65 | |
8d55f844 | 66 | /* Scalar is stored packed, because we don't need the speed. */ |
e7772577 | 67 | typedef struct curve448_scalar_s { |
db90b274 | 68 | c448_word_t limb[C448_SCALAR_LIMBS]; |
e7772577 | 69 | } curve448_scalar_t[1]; |
7324473f | 70 | |
8d55f844 | 71 | /* A scalar equal to 1. */ |
09ffbc94 | 72 | extern const curve448_scalar_t curve448_scalar_one; |
7324473f | 73 | |
8d55f844 | 74 | /* A scalar equal to 0. */ |
09ffbc94 | 75 | extern const curve448_scalar_t curve448_scalar_zero; |
7324473f | 76 | |
8d55f844 | 77 | /* The identity point on the curve. */ |
09ffbc94 | 78 | extern const curve448_point_t curve448_point_identity; |
7324473f | 79 | |
8d55f844 | 80 | /* Precomputed table for the base point on the curve. */ |
09ffbc94 | 81 | extern const struct curve448_precomputed_s *curve448_precomputed_base; |
434149c7 | 82 | extern const niels_t *curve448_wnaf_base; |
7324473f | 83 | |
8d55f844 MC |
84 | /* |
85 | * Read a scalar from wire format or from bytes. | |
7324473f | 86 | * |
8d55f844 MC |
87 | * ser (in): Serialized form of a scalar. |
88 | * out (out): Deserialized form. | |
7324473f | 89 | * |
8d55f844 | 90 | * Returns: |
aeeef83c MC |
91 | * C448_SUCCESS: The scalar was correctly encoded. |
92 | * C448_FAILURE: The scalar was greater than the modulus, and has been reduced | |
8d55f844 | 93 | * modulo that modulus. |
7324473f | 94 | */ |
909c68ae MC |
95 | c448_error_t curve448_scalar_decode(curve448_scalar_t out, |
96 | const unsigned char ser[C448_SCALAR_BYTES]); | |
8d55f844 MC |
97 | |
98 | /* | |
99 | * Read a scalar from wire format or from bytes. Reduces mod scalar prime. | |
7324473f | 100 | * |
8d55f844 MC |
101 | * ser (in): Serialized form of a scalar. |
102 | * ser_len (in): Length of serialized form. | |
103 | * out (out): Deserialized form. | |
7324473f | 104 | */ |
205fd638 MC |
105 | void curve448_scalar_decode_long(curve448_scalar_t out, |
106 | const unsigned char *ser, size_t ser_len); | |
107 | ||
8d55f844 MC |
108 | /* |
109 | * Serialize a scalar to wire format. | |
7324473f | 110 | * |
8d55f844 MC |
111 | * ser (out): Serialized form of a scalar. |
112 | * s (in): Deserialized scalar. | |
7324473f | 113 | */ |
db90b274 | 114 | void curve448_scalar_encode(unsigned char ser[C448_SCALAR_BYTES], |
205fd638 MC |
115 | const curve448_scalar_t s); |
116 | ||
8d55f844 | 117 | /* |
53ef3252 | 118 | * Add two scalars. |a|, |b| and |out| may alias each other. |
df443918 | 119 | * |
8d55f844 MC |
120 | * a (in): One scalar. |
121 | * b (in): Another scalar. | |
122 | * out (out): a+b. | |
7324473f | 123 | */ |
205fd638 MC |
124 | void curve448_scalar_add(curve448_scalar_t out, |
125 | const curve448_scalar_t a, const curve448_scalar_t b); | |
7324473f | 126 | |
8d55f844 | 127 | /* |
53ef3252 | 128 | * Subtract two scalars. |a|, |b| and |out| may alias each other. |
8d55f844 MC |
129 | * a (in): One scalar. |
130 | * b (in): Another scalar. | |
131 | * out (out): a-b. | |
205fd638 MC |
132 | */ |
133 | void curve448_scalar_sub(curve448_scalar_t out, | |
134 | const curve448_scalar_t a, const curve448_scalar_t b); | |
7324473f | 135 | |
8d55f844 | 136 | /* |
53ef3252 | 137 | * Multiply two scalars. |a|, |b| and |out| may alias each other. |
df443918 | 138 | * |
8d55f844 MC |
139 | * a (in): One scalar. |
140 | * b (in): Another scalar. | |
141 | * out (out): a*b. | |
205fd638 MC |
142 | */ |
143 | void curve448_scalar_mul(curve448_scalar_t out, | |
144 | const curve448_scalar_t a, const curve448_scalar_t b); | |
145 | ||
8d55f844 | 146 | /* |
53ef3252 | 147 | * Halve a scalar. |a| and |out| may alias each other. |
df443918 | 148 | * |
8d55f844 MC |
149 | * a (in): A scalar. |
150 | * out (out): a/2. | |
7324473f | 151 | */ |
205fd638 | 152 | void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a); |
7324473f | 153 | |
8d55f844 | 154 | /* |
a4e6dd81 | 155 | * Copy a scalar. The scalars may alias each other, in which case this |
8d55f844 | 156 | * function does nothing. |
df443918 | 157 | * |
8d55f844 MC |
158 | * a (in): A scalar. |
159 | * out (out): Will become a copy of a. | |
7324473f | 160 | */ |
205fd638 MC |
161 | static ossl_inline void curve448_scalar_copy(curve448_scalar_t out, |
162 | const curve448_scalar_t a) | |
163 | { | |
7324473f MC |
164 | *out = *a; |
165 | } | |
166 | ||
8d55f844 MC |
167 | /* |
168 | * Copy a point. The input and output may alias, in which case this function | |
169 | * does nothing. | |
7324473f | 170 | * |
8d55f844 MC |
171 | * a (out): A copy of the point. |
172 | * b (in): Any point. | |
7324473f | 173 | */ |
205fd638 MC |
174 | static ossl_inline void curve448_point_copy(curve448_point_t a, |
175 | const curve448_point_t b) | |
176 | { | |
177 | *a = *b; | |
7324473f MC |
178 | } |
179 | ||
8d55f844 | 180 | /* |
aeeef83c MC |
181 | * Test whether two points are equal. If yes, return C448_TRUE, else return |
182 | * C448_FALSE. | |
7324473f | 183 | * |
8d55f844 MC |
184 | * a (in): A point. |
185 | * b (in): Another point. | |
df443918 | 186 | * |
8d55f844 | 187 | * Returns: |
aeeef83c MC |
188 | * C448_TRUE: The points are equal. |
189 | * C448_FALSE: The points are not equal. | |
7324473f | 190 | */ |
aeeef83c MC |
191 | __owur c448_bool_t curve448_point_eq(const curve448_point_t a, |
192 | const curve448_point_t b); | |
7324473f | 193 | |
8d55f844 MC |
194 | /* |
195 | * Double a point. Equivalent to curve448_point_add(two_a,a,a), but potentially | |
196 | * faster. | |
7324473f | 197 | * |
8d55f844 MC |
198 | * two_a (out): The sum a+a. |
199 | * a (in): A point. | |
7324473f | 200 | */ |
205fd638 | 201 | void curve448_point_double(curve448_point_t two_a, const curve448_point_t a); |
7324473f | 202 | |
8d55f844 MC |
203 | /* |
204 | * RFC 7748 Diffie-Hellman scalarmul. This function uses a different | |
7324473f MC |
205 | * (non-Decaf) encoding. |
206 | * | |
8d55f844 MC |
207 | * out (out): The scaled point base*scalar |
208 | * base (in): The point to be scaled. | |
209 | * scalar (in): The scalar to multiply by. | |
7324473f | 210 | * |
8d55f844 | 211 | * Returns: |
aeeef83c MC |
212 | * C448_SUCCESS: The scalarmul succeeded. |
213 | * C448_FAILURE: The scalarmul didn't succeed, because the base point is in a | |
8d55f844 | 214 | * small subgroup. |
7324473f | 215 | */ |
db90b274 MC |
216 | __owur c448_error_t x448_int(uint8_t out[X448_PUBLIC_BYTES], |
217 | const uint8_t base[X448_PUBLIC_BYTES], | |
218 | const uint8_t scalar[X448_PRIVATE_BYTES]); | |
7324473f | 219 | |
8d55f844 | 220 | /* |
db90b274 | 221 | * Multiply a point by X448_ENCODE_RATIO, then encode it like RFC 7748. |
7324473f MC |
222 | * |
223 | * This function is mainly used internally, but is exported in case | |
224 | * it will be useful. | |
225 | * | |
226 | * The ratio is necessary because the internal representation doesn't | |
227 | * track the cofactor information, so on output we must clear the cofactor. | |
aeeef83c MC |
228 | * This would multiply by the cofactor, but in fact internally points are always |
229 | * even, so it multiplies by half the cofactor instead. | |
7324473f MC |
230 | * |
231 | * As it happens, this aligns with the base point definitions; that is, | |
232 | * if you pass the Decaf/Ristretto base point to this function, the result | |
db90b274 | 233 | * will be X448_ENCODE_RATIO times the X448 |
7324473f MC |
234 | * base point. |
235 | * | |
8d55f844 MC |
236 | * out (out): The scaled and encoded point. |
237 | * p (in): The point to be scaled and encoded. | |
7324473f | 238 | */ |
8d55f844 | 239 | void curve448_point_mul_by_ratio_and_encode_like_x448( |
db90b274 | 240 | uint8_t out[X448_PUBLIC_BYTES], |
8d55f844 | 241 | const curve448_point_t p); |
7324473f | 242 | |
8d55f844 MC |
243 | /* |
244 | * RFC 7748 Diffie-Hellman base point scalarmul. This function uses a different | |
245 | * (non-Decaf) encoding. | |
df443918 | 246 | * |
8d55f844 MC |
247 | * out (out): The scaled point base*scalar |
248 | * scalar (in): The scalar to multiply by. | |
7324473f | 249 | */ |
db90b274 MC |
250 | void x448_derive_public_key(uint8_t out[X448_PUBLIC_BYTES], |
251 | const uint8_t scalar[X448_PRIVATE_BYTES]); | |
8d55f844 MC |
252 | |
253 | /* | |
254 | * Multiply a precomputed base point by a scalar: out = scalar*base. | |
7324473f | 255 | * |
8d55f844 MC |
256 | * scaled (out): The scaled point base*scalar |
257 | * base (in): The point to be scaled. | |
258 | * scalar (in): The scalar to multiply by. | |
7324473f | 259 | */ |
205fd638 MC |
260 | void curve448_precomputed_scalarmul(curve448_point_t scaled, |
261 | const curve448_precomputed_s * base, | |
262 | const curve448_scalar_t scalar); | |
7324473f | 263 | |
8d55f844 MC |
264 | /* |
265 | * Multiply two base points by two scalars: | |
266 | * combo = scalar1*curve448_point_base + scalar2*base2. | |
7324473f | 267 | * |
e7772577 | 268 | * Otherwise equivalent to curve448_point_double_scalarmul, but may be |
7324473f MC |
269 | * faster at the expense of being variable time. |
270 | * | |
8d55f844 MC |
271 | * combo (out): The linear combination scalar1*base + scalar2*base2. |
272 | * scalar1 (in): A first scalar to multiply by. | |
273 | * base2 (in): A second point to be scaled. | |
274 | * scalar2 (in) A second scalar to multiply by. | |
7324473f | 275 | * |
df443918 | 276 | * Warning: This function takes variable time, and may leak the scalars used. |
8d55f844 | 277 | * It is designed for signature verification. |
7324473f | 278 | */ |
205fd638 MC |
279 | void curve448_base_double_scalarmul_non_secret(curve448_point_t combo, |
280 | const curve448_scalar_t scalar1, | |
281 | const curve448_point_t base2, | |
282 | const curve448_scalar_t scalar2); | |
7324473f | 283 | |
8d55f844 MC |
284 | /* |
285 | * Test that a point is valid, for debugging purposes. | |
7324473f | 286 | * |
8d55f844 MC |
287 | * to_test (in): The point to test. |
288 | * | |
289 | * Returns: | |
aeeef83c MC |
290 | * C448_TRUE The point is valid. |
291 | * C448_FALSE The point is invalid. | |
7324473f | 292 | */ |
aeeef83c | 293 | __owur c448_bool_t curve448_point_valid(const curve448_point_t to_test); |
7324473f | 294 | |
8d55f844 | 295 | /* Overwrite scalar with zeros. */ |
205fd638 | 296 | void curve448_scalar_destroy(curve448_scalar_t scalar); |
7324473f | 297 | |
8d55f844 | 298 | /* Overwrite point with zeros. */ |
205fd638 | 299 | void curve448_point_destroy(curve448_point_t point); |
7324473f | 300 | |
ae4186b0 | 301 | #endif /* OSSL_CRYPTO_EC_CURVE448_POINT_448_H */ |