]>
Commit | Line | Data |
---|---|---|
35b73a1f | 1 | /* |
33388b44 | 2 | * Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved. |
aa8f3d76 | 3 | * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved |
65e81670 | 4 | * |
a7f182b7 | 5 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
aa6bb135 RS |
6 | * this file except in compliance with the License. You can obtain a copy |
7 | * in the file LICENSE in the source distribution or at | |
8 | * https://www.openssl.org/source/license.html | |
65e81670 | 9 | */ |
aa6bb135 | 10 | |
3a12ce01 BM |
11 | #include <stdlib.h> |
12 | ||
458c2917 | 13 | #include <openssl/obj_mac.h> |
38e3c581 | 14 | #include <openssl/ec.h> |
0f814687 | 15 | #include <openssl/bn.h> |
2f545ae4 | 16 | #include "internal/refcount.h" |
25f2138b | 17 | #include "crypto/ec.h" |
3a12ce01 | 18 | |
7f24b1c3 AP |
19 | #if defined(__SUNPRO_C) |
20 | # if __SUNPRO_C >= 0x520 | |
0f113f3e | 21 | # pragma error_messages (off,E_ARRAY_OF_INCOMPLETE_NONAME,E_ARRAY_OF_INCOMPLETE) |
7f24b1c3 AP |
22 | # endif |
23 | #endif | |
3a12ce01 | 24 | |
84b08eee | 25 | /* Use default functions for poin2oct, oct2point and compressed coordinates */ |
0f113f3e | 26 | #define EC_FLAGS_DEFAULT_OCT 0x1 |
84b08eee | 27 | |
474d84ec DSH |
28 | /* Use custom formats for EC_GROUP, EC_POINT and EC_KEY */ |
29 | #define EC_FLAGS_CUSTOM_CURVE 0x2 | |
30 | ||
4b0555ec DSH |
31 | /* Curve does not support signing operations */ |
32 | #define EC_FLAGS_NO_SIGN 0x4 | |
33 | ||
23ccae80 BB |
34 | #ifdef OPENSSL_NO_DEPRECATED_3_0 |
35 | typedef struct ec_method_st EC_METHOD; | |
36 | #endif | |
37 | ||
0f113f3e MC |
38 | /* |
39 | * Structure details are not part of the exported interface, so all this may | |
40 | * change in future versions. | |
41 | */ | |
3a12ce01 BM |
42 | |
43 | struct ec_method_st { | |
0f113f3e MC |
44 | /* Various method flags */ |
45 | int flags; | |
46 | /* used by EC_METHOD_get_field_type: */ | |
47 | int field_type; /* a NID */ | |
48 | /* | |
49 | * used by EC_GROUP_new, EC_GROUP_free, EC_GROUP_clear_free, | |
50 | * EC_GROUP_copy: | |
51 | */ | |
52 | int (*group_init) (EC_GROUP *); | |
53 | void (*group_finish) (EC_GROUP *); | |
54 | void (*group_clear_finish) (EC_GROUP *); | |
55 | int (*group_copy) (EC_GROUP *, const EC_GROUP *); | |
9cc570d4 | 56 | /* used by EC_GROUP_set_curve, EC_GROUP_get_curve: */ |
0f113f3e MC |
57 | int (*group_set_curve) (EC_GROUP *, const BIGNUM *p, const BIGNUM *a, |
58 | const BIGNUM *b, BN_CTX *); | |
59 | int (*group_get_curve) (const EC_GROUP *, BIGNUM *p, BIGNUM *a, BIGNUM *b, | |
60 | BN_CTX *); | |
61 | /* used by EC_GROUP_get_degree: */ | |
62 | int (*group_get_degree) (const EC_GROUP *); | |
e5b2ea0a | 63 | int (*group_order_bits) (const EC_GROUP *); |
0f113f3e MC |
64 | /* used by EC_GROUP_check: */ |
65 | int (*group_check_discriminant) (const EC_GROUP *, BN_CTX *); | |
66 | /* | |
67 | * used by EC_POINT_new, EC_POINT_free, EC_POINT_clear_free, | |
68 | * EC_POINT_copy: | |
69 | */ | |
70 | int (*point_init) (EC_POINT *); | |
71 | void (*point_finish) (EC_POINT *); | |
72 | void (*point_clear_finish) (EC_POINT *); | |
73 | int (*point_copy) (EC_POINT *, const EC_POINT *); | |
50e735f9 MC |
74 | /*- |
75 | * used by EC_POINT_set_to_infinity, | |
76 | * EC_POINT_set_Jprojective_coordinates_GFp, | |
77 | * EC_POINT_get_Jprojective_coordinates_GFp, | |
9cc570d4 MC |
78 | * EC_POINT_set_affine_coordinates, |
79 | * EC_POINT_get_affine_coordinates, | |
80 | * EC_POINT_set_compressed_coordinates: | |
50e735f9 | 81 | */ |
0f113f3e | 82 | int (*point_set_to_infinity) (const EC_GROUP *, EC_POINT *); |
0f113f3e MC |
83 | int (*point_set_affine_coordinates) (const EC_GROUP *, EC_POINT *, |
84 | const BIGNUM *x, const BIGNUM *y, | |
85 | BN_CTX *); | |
86 | int (*point_get_affine_coordinates) (const EC_GROUP *, const EC_POINT *, | |
87 | BIGNUM *x, BIGNUM *y, BN_CTX *); | |
88 | int (*point_set_compressed_coordinates) (const EC_GROUP *, EC_POINT *, | |
89 | const BIGNUM *x, int y_bit, | |
90 | BN_CTX *); | |
91 | /* used by EC_POINT_point2oct, EC_POINT_oct2point: */ | |
92 | size_t (*point2oct) (const EC_GROUP *, const EC_POINT *, | |
93 | point_conversion_form_t form, unsigned char *buf, | |
94 | size_t len, BN_CTX *); | |
95 | int (*oct2point) (const EC_GROUP *, EC_POINT *, const unsigned char *buf, | |
96 | size_t len, BN_CTX *); | |
97 | /* used by EC_POINT_add, EC_POINT_dbl, ECP_POINT_invert: */ | |
98 | int (*add) (const EC_GROUP *, EC_POINT *r, const EC_POINT *a, | |
99 | const EC_POINT *b, BN_CTX *); | |
100 | int (*dbl) (const EC_GROUP *, EC_POINT *r, const EC_POINT *a, BN_CTX *); | |
101 | int (*invert) (const EC_GROUP *, EC_POINT *, BN_CTX *); | |
102 | /* | |
103 | * used by EC_POINT_is_at_infinity, EC_POINT_is_on_curve, EC_POINT_cmp: | |
104 | */ | |
105 | int (*is_at_infinity) (const EC_GROUP *, const EC_POINT *); | |
106 | int (*is_on_curve) (const EC_GROUP *, const EC_POINT *, BN_CTX *); | |
107 | int (*point_cmp) (const EC_GROUP *, const EC_POINT *a, const EC_POINT *b, | |
108 | BN_CTX *); | |
109 | /* used by EC_POINT_make_affine, EC_POINTs_make_affine: */ | |
110 | int (*make_affine) (const EC_GROUP *, EC_POINT *, BN_CTX *); | |
111 | int (*points_make_affine) (const EC_GROUP *, size_t num, EC_POINT *[], | |
112 | BN_CTX *); | |
113 | /* | |
114 | * used by EC_POINTs_mul, EC_POINT_mul, EC_POINT_precompute_mult, | |
115 | * EC_POINT_have_precompute_mult (default implementations are used if the | |
116 | * 'mul' pointer is 0): | |
117 | */ | |
fe2d3975 BB |
118 | /*- |
119 | * mul() calculates the value | |
120 | * | |
121 | * r := generator * scalar | |
122 | * + points[0] * scalars[0] | |
123 | * + ... | |
124 | * + points[num-1] * scalars[num-1]. | |
125 | * | |
126 | * For a fixed point multiplication (scalar != NULL, num == 0) | |
127 | * or a variable point multiplication (scalar == NULL, num == 1), | |
128 | * mul() must use a constant time algorithm: in both cases callers | |
129 | * should provide an input scalar (either scalar or scalars[0]) | |
130 | * in the range [0, ec_group_order); for robustness, implementers | |
131 | * should handle the case when the scalar has not been reduced, but | |
132 | * may treat it as an unusual input, without any constant-timeness | |
133 | * guarantee. | |
134 | */ | |
0f113f3e MC |
135 | int (*mul) (const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, |
136 | size_t num, const EC_POINT *points[], const BIGNUM *scalars[], | |
137 | BN_CTX *); | |
138 | int (*precompute_mult) (EC_GROUP *group, BN_CTX *); | |
139 | int (*have_precompute_mult) (const EC_GROUP *group); | |
140 | /* internal functions */ | |
141 | /* | |
142 | * 'field_mul', 'field_sqr', and 'field_div' can be used by 'add' and | |
143 | * 'dbl' so that the same implementations of point operations can be used | |
144 | * with different optimized implementations of expensive field | |
145 | * operations: | |
146 | */ | |
147 | int (*field_mul) (const EC_GROUP *, BIGNUM *r, const BIGNUM *a, | |
148 | const BIGNUM *b, BN_CTX *); | |
149 | int (*field_sqr) (const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *); | |
150 | int (*field_div) (const EC_GROUP *, BIGNUM *r, const BIGNUM *a, | |
151 | const BIGNUM *b, BN_CTX *); | |
e0033efc | 152 | /*- |
c2969ff6 | 153 | * 'field_inv' computes the multiplicative inverse of a in the field, |
e0033efc BB |
154 | * storing the result in r. |
155 | * | |
156 | * If 'a' is zero (or equivalent), you'll get an EC_R_CANNOT_INVERT error. | |
157 | */ | |
158 | int (*field_inv) (const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *); | |
0f113f3e MC |
159 | /* e.g. to Montgomery */ |
160 | int (*field_encode) (const EC_GROUP *, BIGNUM *r, const BIGNUM *a, | |
161 | BN_CTX *); | |
162 | /* e.g. from Montgomery */ | |
163 | int (*field_decode) (const EC_GROUP *, BIGNUM *r, const BIGNUM *a, | |
164 | BN_CTX *); | |
165 | int (*field_set_to_one) (const EC_GROUP *, BIGNUM *r, BN_CTX *); | |
474d84ec DSH |
166 | /* private key operations */ |
167 | size_t (*priv2oct)(const EC_KEY *eckey, unsigned char *buf, size_t len); | |
25d57dc7 | 168 | int (*oct2priv)(EC_KEY *eckey, const unsigned char *buf, size_t len); |
474d84ec DSH |
169 | int (*set_private)(EC_KEY *eckey, const BIGNUM *priv_key); |
170 | int (*keygen)(EC_KEY *eckey); | |
171 | int (*keycheck)(const EC_KEY *eckey); | |
172 | int (*keygenpub)(EC_KEY *eckey); | |
173 | int (*keycopy)(EC_KEY *dst, const EC_KEY *src); | |
174 | void (*keyfinish)(EC_KEY *eckey); | |
175 | /* custom ECDH operation */ | |
e2285d87 DSH |
176 | int (*ecdh_compute_key)(unsigned char **pout, size_t *poutlen, |
177 | const EC_POINT *pub_key, const EC_KEY *ecdh); | |
9bf682f6 PS |
178 | /* custom ECDSA */ |
179 | int (*ecdsa_sign_setup)(EC_KEY *eckey, BN_CTX *ctx, BIGNUM **kinvp, | |
180 | BIGNUM **rp); | |
181 | ECDSA_SIG *(*ecdsa_sign_sig)(const unsigned char *dgst, int dgstlen, | |
182 | const BIGNUM *kinv, const BIGNUM *r, | |
183 | EC_KEY *eckey); | |
184 | int (*ecdsa_verify_sig)(const unsigned char *dgst, int dgstlen, | |
185 | const ECDSA_SIG *sig, EC_KEY *eckey); | |
eb791696 | 186 | /* Inverse modulo order */ |
792546eb BB |
187 | int (*field_inverse_mod_ord)(const EC_GROUP *, BIGNUM *r, |
188 | const BIGNUM *x, BN_CTX *); | |
f667820c | 189 | int (*blind_coordinates)(const EC_GROUP *group, EC_POINT *p, BN_CTX *ctx); |
37124360 NT |
190 | int (*ladder_pre)(const EC_GROUP *group, |
191 | EC_POINT *r, EC_POINT *s, | |
192 | EC_POINT *p, BN_CTX *ctx); | |
193 | int (*ladder_step)(const EC_GROUP *group, | |
194 | EC_POINT *r, EC_POINT *s, | |
195 | EC_POINT *p, BN_CTX *ctx); | |
196 | int (*ladder_post)(const EC_GROUP *group, | |
197 | EC_POINT *r, EC_POINT *s, | |
198 | EC_POINT *p, BN_CTX *ctx); | |
d196305a | 199 | }; |
3a12ce01 | 200 | |
3aef36ff RS |
201 | /* |
202 | * Types and functions to manipulate pre-computed values. | |
203 | */ | |
204 | typedef struct nistp224_pre_comp_st NISTP224_PRE_COMP; | |
205 | typedef struct nistp256_pre_comp_st NISTP256_PRE_COMP; | |
126d6864 | 206 | typedef struct nistp521_pre_comp_st NISTP521_PRE_COMP; |
3aef36ff RS |
207 | typedef struct nistz256_pre_comp_st NISTZ256_PRE_COMP; |
208 | typedef struct ec_pre_comp_st EC_PRE_COMP; | |
3a12ce01 BM |
209 | |
210 | struct ec_group_st { | |
0f113f3e MC |
211 | const EC_METHOD *meth; |
212 | EC_POINT *generator; /* optional */ | |
213 | BIGNUM *order, *cofactor; | |
214 | int curve_name; /* optional NID for named curve */ | |
215 | int asn1_flag; /* flag to control the asn1 encoding */ | |
216 | point_conversion_form_t asn1_form; | |
217 | unsigned char *seed; /* optional seed for parameters (appears in | |
218 | * ASN1) */ | |
219 | size_t seed_len; | |
0f113f3e MC |
220 | /* |
221 | * The following members are handled by the method functions, even if | |
222 | * they appear generic | |
223 | */ | |
224 | /* | |
225 | * Field specification. For curves over GF(p), this is the modulus; for | |
226 | * curves over GF(2^m), this is the irreducible polynomial defining the | |
227 | * field. | |
228 | */ | |
229 | BIGNUM *field; | |
230 | /* | |
231 | * Field specification for curves over GF(2^m). The irreducible f(t) is | |
232 | * then of the form: t^poly[0] + t^poly[1] + ... + t^poly[k] where m = | |
233 | * poly[0] > poly[1] > ... > poly[k] = 0. The array is terminated with | |
234 | * poly[k+1]=-1. All elliptic curve irreducibles have at most 5 non-zero | |
235 | * terms. | |
236 | */ | |
237 | int poly[6]; | |
238 | /* | |
239 | * Curve coefficients. (Here the assumption is that BIGNUMs can be used | |
240 | * or abused for all kinds of fields, not just GF(p).) For characteristic | |
241 | * > 3, the curve is defined by a Weierstrass equation of the form y^2 = | |
242 | * x^3 + a*x + b. For characteristic 2, the curve is defined by an | |
243 | * equation of the form y^2 + x*y = x^3 + a*x^2 + b. | |
244 | */ | |
245 | BIGNUM *a, *b; | |
246 | /* enable optimized point arithmetics for special case */ | |
247 | int a_is_minus3; | |
248 | /* method-specific (e.g., Montgomery structure) */ | |
249 | void *field_data1; | |
250 | /* method-specific */ | |
251 | void *field_data2; | |
252 | /* method-specific */ | |
253 | int (*field_mod_func) (BIGNUM *, const BIGNUM *, const BIGNUM *, | |
254 | BN_CTX *); | |
255 | /* data for ECDSA inverse */ | |
256 | BN_MONT_CTX *mont_data; | |
3aef36ff | 257 | |
66117ab0 RS |
258 | /* |
259 | * Precomputed values for speed. The PCT_xxx names match the | |
260 | * pre_comp.xxx union names; see the SETPRECOMP and HAVEPRECOMP | |
261 | * macros, below. | |
262 | */ | |
3aef36ff | 263 | enum { |
66117ab0 RS |
264 | PCT_none, |
265 | PCT_nistp224, PCT_nistp256, PCT_nistp521, PCT_nistz256, | |
266 | PCT_ec | |
267 | } pre_comp_type; | |
3aef36ff RS |
268 | union { |
269 | NISTP224_PRE_COMP *nistp224; | |
270 | NISTP256_PRE_COMP *nistp256; | |
271 | NISTP521_PRE_COMP *nistp521; | |
272 | NISTZ256_PRE_COMP *nistz256; | |
273 | EC_PRE_COMP *ec; | |
274 | } pre_comp; | |
a9612d6c MC |
275 | |
276 | OPENSSL_CTX *libctx; | |
2da8d4eb | 277 | char *propq; |
d196305a | 278 | }; |
3a12ce01 | 279 | |
3aef36ff | 280 | #define SETPRECOMP(g, type, pre) \ |
66117ab0 | 281 | g->pre_comp_type = PCT_##type, g->pre_comp.type = pre |
3aef36ff | 282 | #define HAVEPRECOMP(g, type) \ |
66117ab0 | 283 | g->pre_comp_type == PCT_##type && g->pre_comp.type != NULL |
3aef36ff | 284 | |
9dd84053 | 285 | struct ec_key_st { |
28572b57 DSH |
286 | const EC_KEY_METHOD *meth; |
287 | ENGINE *engine; | |
0f113f3e MC |
288 | int version; |
289 | EC_GROUP *group; | |
290 | EC_POINT *pub_key; | |
291 | BIGNUM *priv_key; | |
292 | unsigned int enc_flag; | |
293 | point_conversion_form_t conv_form; | |
2f545ae4 | 294 | CRYPTO_REF_COUNT references; |
0f113f3e | 295 | int flags; |
f844f9eb | 296 | #ifndef FIPS_MODULE |
3aef36ff | 297 | CRYPTO_EX_DATA ex_data; |
a9612d6c | 298 | #endif |
9b398ef2 | 299 | CRYPTO_RWLOCK *lock; |
a9612d6c | 300 | OPENSSL_CTX *libctx; |
2da8d4eb | 301 | char *propq; |
4fe54d67 NT |
302 | |
303 | /* Provider data */ | |
304 | size_t dirty_cnt; /* If any key material changes, increment this */ | |
d196305a | 305 | }; |
9dd84053 | 306 | |
3a12ce01 | 307 | struct ec_point_st { |
0f113f3e | 308 | const EC_METHOD *meth; |
b14e6015 MC |
309 | /* NID for the curve if known */ |
310 | int curve_name; | |
0f113f3e MC |
311 | /* |
312 | * All members except 'meth' are handled by the method functions, even if | |
313 | * they appear generic | |
314 | */ | |
315 | BIGNUM *X; | |
316 | BIGNUM *Y; | |
317 | BIGNUM *Z; /* Jacobian projective coordinates: * (X, Y, | |
318 | * Z) represents (X/Z^2, Y/Z^3) if Z != 0 */ | |
319 | int Z_is_one; /* enable optimized point arithmetics for | |
320 | * special case */ | |
d196305a | 321 | }; |
58fc6229 | 322 | |
b14e6015 MC |
323 | static ossl_inline int ec_point_is_compat(const EC_POINT *point, |
324 | const EC_GROUP *group) | |
325 | { | |
8402cd5f SL |
326 | return group->meth == point->meth |
327 | && (group->curve_name == 0 | |
328 | || point->curve_name == 0 | |
329 | || group->curve_name == point->curve_name); | |
b14e6015 MC |
330 | } |
331 | ||
3aef36ff RS |
332 | NISTP224_PRE_COMP *EC_nistp224_pre_comp_dup(NISTP224_PRE_COMP *); |
333 | NISTP256_PRE_COMP *EC_nistp256_pre_comp_dup(NISTP256_PRE_COMP *); | |
334 | NISTP521_PRE_COMP *EC_nistp521_pre_comp_dup(NISTP521_PRE_COMP *); | |
335 | NISTZ256_PRE_COMP *EC_nistz256_pre_comp_dup(NISTZ256_PRE_COMP *); | |
336 | NISTP256_PRE_COMP *EC_nistp256_pre_comp_dup(NISTP256_PRE_COMP *); | |
337 | EC_PRE_COMP *EC_ec_pre_comp_dup(EC_PRE_COMP *); | |
2c52ac9b RS |
338 | |
339 | void EC_pre_comp_free(EC_GROUP *group); | |
3aef36ff RS |
340 | void EC_nistp224_pre_comp_free(NISTP224_PRE_COMP *); |
341 | void EC_nistp256_pre_comp_free(NISTP256_PRE_COMP *); | |
342 | void EC_nistp521_pre_comp_free(NISTP521_PRE_COMP *); | |
343 | void EC_nistz256_pre_comp_free(NISTZ256_PRE_COMP *); | |
344 | void EC_ec_pre_comp_free(EC_PRE_COMP *); | |
345 | ||
0f113f3e MC |
346 | /* |
347 | * method functions in ec_mult.c (ec_lib.c uses these as defaults if | |
348 | * group->method->mul is 0) | |
349 | */ | |
7793f30e | 350 | int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, |
0f113f3e MC |
351 | size_t num, const EC_POINT *points[], const BIGNUM *scalars[], |
352 | BN_CTX *); | |
7793f30e | 353 | int ec_wNAF_precompute_mult(EC_GROUP *group, BN_CTX *); |
37c660ff BM |
354 | int ec_wNAF_have_precompute_mult(const EC_GROUP *group); |
355 | ||
58fc6229 BM |
356 | /* method functions in ecp_smpl.c */ |
357 | int ec_GFp_simple_group_init(EC_GROUP *); | |
58fc6229 BM |
358 | void ec_GFp_simple_group_finish(EC_GROUP *); |
359 | void ec_GFp_simple_group_clear_finish(EC_GROUP *); | |
360 | int ec_GFp_simple_group_copy(EC_GROUP *, const EC_GROUP *); | |
0f113f3e MC |
361 | int ec_GFp_simple_group_set_curve(EC_GROUP *, const BIGNUM *p, |
362 | const BIGNUM *a, const BIGNUM *b, BN_CTX *); | |
363 | int ec_GFp_simple_group_get_curve(const EC_GROUP *, BIGNUM *p, BIGNUM *a, | |
364 | BIGNUM *b, BN_CTX *); | |
7793f30e | 365 | int ec_GFp_simple_group_get_degree(const EC_GROUP *); |
17d6bb81 | 366 | int ec_GFp_simple_group_check_discriminant(const EC_GROUP *, BN_CTX *); |
58fc6229 BM |
367 | int ec_GFp_simple_point_init(EC_POINT *); |
368 | void ec_GFp_simple_point_finish(EC_POINT *); | |
369 | void ec_GFp_simple_point_clear_finish(EC_POINT *); | |
370 | int ec_GFp_simple_point_copy(EC_POINT *, const EC_POINT *); | |
226cc7de | 371 | int ec_GFp_simple_point_set_to_infinity(const EC_GROUP *, EC_POINT *); |
0f113f3e MC |
372 | int ec_GFp_simple_set_Jprojective_coordinates_GFp(const EC_GROUP *, |
373 | EC_POINT *, const BIGNUM *x, | |
374 | const BIGNUM *y, | |
375 | const BIGNUM *z, BN_CTX *); | |
376 | int ec_GFp_simple_get_Jprojective_coordinates_GFp(const EC_GROUP *, | |
377 | const EC_POINT *, BIGNUM *x, | |
378 | BIGNUM *y, BIGNUM *z, | |
379 | BN_CTX *); | |
35b73a1f | 380 | int ec_GFp_simple_point_set_affine_coordinates(const EC_GROUP *, EC_POINT *, |
0f113f3e MC |
381 | const BIGNUM *x, |
382 | const BIGNUM *y, BN_CTX *); | |
383 | int ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP *, | |
384 | const EC_POINT *, BIGNUM *x, | |
385 | BIGNUM *y, BN_CTX *); | |
35b73a1f | 386 | int ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *, EC_POINT *, |
0f113f3e MC |
387 | const BIGNUM *x, int y_bit, |
388 | BN_CTX *); | |
389 | size_t ec_GFp_simple_point2oct(const EC_GROUP *, const EC_POINT *, | |
390 | point_conversion_form_t form, | |
391 | unsigned char *buf, size_t len, BN_CTX *); | |
58fc6229 | 392 | int ec_GFp_simple_oct2point(const EC_GROUP *, EC_POINT *, |
0f113f3e MC |
393 | const unsigned char *buf, size_t len, BN_CTX *); |
394 | int ec_GFp_simple_add(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, | |
395 | const EC_POINT *b, BN_CTX *); | |
396 | int ec_GFp_simple_dbl(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, | |
397 | BN_CTX *); | |
1d5bd6cf | 398 | int ec_GFp_simple_invert(const EC_GROUP *, EC_POINT *, BN_CTX *); |
58fc6229 BM |
399 | int ec_GFp_simple_is_at_infinity(const EC_GROUP *, const EC_POINT *); |
400 | int ec_GFp_simple_is_on_curve(const EC_GROUP *, const EC_POINT *, BN_CTX *); | |
0f113f3e MC |
401 | int ec_GFp_simple_cmp(const EC_GROUP *, const EC_POINT *a, const EC_POINT *b, |
402 | BN_CTX *); | |
e869d4bd | 403 | int ec_GFp_simple_make_affine(const EC_GROUP *, EC_POINT *, BN_CTX *); |
0f113f3e MC |
404 | int ec_GFp_simple_points_make_affine(const EC_GROUP *, size_t num, |
405 | EC_POINT *[], BN_CTX *); | |
406 | int ec_GFp_simple_field_mul(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, | |
407 | const BIGNUM *b, BN_CTX *); | |
408 | int ec_GFp_simple_field_sqr(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, | |
409 | BN_CTX *); | |
e0033efc BB |
410 | int ec_GFp_simple_field_inv(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, |
411 | BN_CTX *); | |
f667820c | 412 | int ec_GFp_simple_blind_coordinates(const EC_GROUP *group, EC_POINT *p, |
9d91530d BB |
413 | BN_CTX *ctx); |
414 | int ec_GFp_simple_ladder_pre(const EC_GROUP *group, | |
415 | EC_POINT *r, EC_POINT *s, | |
416 | EC_POINT *p, BN_CTX *ctx); | |
417 | int ec_GFp_simple_ladder_step(const EC_GROUP *group, | |
418 | EC_POINT *r, EC_POINT *s, | |
419 | EC_POINT *p, BN_CTX *ctx); | |
420 | int ec_GFp_simple_ladder_post(const EC_GROUP *group, | |
421 | EC_POINT *r, EC_POINT *s, | |
422 | EC_POINT *p, BN_CTX *ctx); | |
58fc6229 BM |
423 | |
424 | /* method functions in ecp_mont.c */ | |
f1f25544 | 425 | int ec_GFp_mont_group_init(EC_GROUP *); |
0f113f3e MC |
426 | int ec_GFp_mont_group_set_curve(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, |
427 | const BIGNUM *b, BN_CTX *); | |
2e0db076 BM |
428 | void ec_GFp_mont_group_finish(EC_GROUP *); |
429 | void ec_GFp_mont_group_clear_finish(EC_GROUP *); | |
60428dbf | 430 | int ec_GFp_mont_group_copy(EC_GROUP *, const EC_GROUP *); |
0f113f3e MC |
431 | int ec_GFp_mont_field_mul(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, |
432 | const BIGNUM *b, BN_CTX *); | |
433 | int ec_GFp_mont_field_sqr(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, | |
434 | BN_CTX *); | |
e0033efc BB |
435 | int ec_GFp_mont_field_inv(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, |
436 | BN_CTX *); | |
0f113f3e MC |
437 | int ec_GFp_mont_field_encode(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, |
438 | BN_CTX *); | |
439 | int ec_GFp_mont_field_decode(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, | |
440 | BN_CTX *); | |
48fe4d62 | 441 | int ec_GFp_mont_field_set_to_one(const EC_GROUP *, BIGNUM *r, BN_CTX *); |
58fc6229 | 442 | |
58fc6229 | 443 | /* method functions in ecp_nist.c */ |
e2c9c91b | 444 | int ec_GFp_nist_group_copy(EC_GROUP *dest, const EC_GROUP *src); |
0f113f3e MC |
445 | int ec_GFp_nist_group_set_curve(EC_GROUP *, const BIGNUM *p, const BIGNUM *a, |
446 | const BIGNUM *b, BN_CTX *); | |
447 | int ec_GFp_nist_field_mul(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, | |
448 | const BIGNUM *b, BN_CTX *); | |
449 | int ec_GFp_nist_field_sqr(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, | |
450 | BN_CTX *); | |
7793f30e BM |
451 | |
452 | /* method functions in ec2_smpl.c */ | |
453 | int ec_GF2m_simple_group_init(EC_GROUP *); | |
454 | void ec_GF2m_simple_group_finish(EC_GROUP *); | |
455 | void ec_GF2m_simple_group_clear_finish(EC_GROUP *); | |
456 | int ec_GF2m_simple_group_copy(EC_GROUP *, const EC_GROUP *); | |
0f113f3e MC |
457 | int ec_GF2m_simple_group_set_curve(EC_GROUP *, const BIGNUM *p, |
458 | const BIGNUM *a, const BIGNUM *b, | |
459 | BN_CTX *); | |
460 | int ec_GF2m_simple_group_get_curve(const EC_GROUP *, BIGNUM *p, BIGNUM *a, | |
461 | BIGNUM *b, BN_CTX *); | |
7793f30e BM |
462 | int ec_GF2m_simple_group_get_degree(const EC_GROUP *); |
463 | int ec_GF2m_simple_group_check_discriminant(const EC_GROUP *, BN_CTX *); | |
464 | int ec_GF2m_simple_point_init(EC_POINT *); | |
465 | void ec_GF2m_simple_point_finish(EC_POINT *); | |
466 | void ec_GF2m_simple_point_clear_finish(EC_POINT *); | |
467 | int ec_GF2m_simple_point_copy(EC_POINT *, const EC_POINT *); | |
468 | int ec_GF2m_simple_point_set_to_infinity(const EC_GROUP *, EC_POINT *); | |
35b73a1f | 469 | int ec_GF2m_simple_point_set_affine_coordinates(const EC_GROUP *, EC_POINT *, |
0f113f3e MC |
470 | const BIGNUM *x, |
471 | const BIGNUM *y, BN_CTX *); | |
472 | int ec_GF2m_simple_point_get_affine_coordinates(const EC_GROUP *, | |
473 | const EC_POINT *, BIGNUM *x, | |
474 | BIGNUM *y, BN_CTX *); | |
35b73a1f | 475 | int ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP *, EC_POINT *, |
0f113f3e MC |
476 | const BIGNUM *x, int y_bit, |
477 | BN_CTX *); | |
478 | size_t ec_GF2m_simple_point2oct(const EC_GROUP *, const EC_POINT *, | |
479 | point_conversion_form_t form, | |
480 | unsigned char *buf, size_t len, BN_CTX *); | |
7793f30e | 481 | int ec_GF2m_simple_oct2point(const EC_GROUP *, EC_POINT *, |
0f113f3e MC |
482 | const unsigned char *buf, size_t len, BN_CTX *); |
483 | int ec_GF2m_simple_add(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, | |
484 | const EC_POINT *b, BN_CTX *); | |
485 | int ec_GF2m_simple_dbl(const EC_GROUP *, EC_POINT *r, const EC_POINT *a, | |
486 | BN_CTX *); | |
7793f30e BM |
487 | int ec_GF2m_simple_invert(const EC_GROUP *, EC_POINT *, BN_CTX *); |
488 | int ec_GF2m_simple_is_at_infinity(const EC_GROUP *, const EC_POINT *); | |
489 | int ec_GF2m_simple_is_on_curve(const EC_GROUP *, const EC_POINT *, BN_CTX *); | |
0f113f3e MC |
490 | int ec_GF2m_simple_cmp(const EC_GROUP *, const EC_POINT *a, const EC_POINT *b, |
491 | BN_CTX *); | |
7793f30e | 492 | int ec_GF2m_simple_make_affine(const EC_GROUP *, EC_POINT *, BN_CTX *); |
0f113f3e MC |
493 | int ec_GF2m_simple_points_make_affine(const EC_GROUP *, size_t num, |
494 | EC_POINT *[], BN_CTX *); | |
495 | int ec_GF2m_simple_field_mul(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, | |
496 | const BIGNUM *b, BN_CTX *); | |
497 | int ec_GF2m_simple_field_sqr(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, | |
498 | BN_CTX *); | |
499 | int ec_GF2m_simple_field_div(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, | |
500 | const BIGNUM *b, BN_CTX *); | |
7793f30e | 501 | |
8e323164 | 502 | #ifndef OPENSSL_NO_EC_NISTP_64_GCC_128 |
04daec86 BM |
503 | /* method functions in ecp_nistp224.c */ |
504 | int ec_GFp_nistp224_group_init(EC_GROUP *group); | |
0f113f3e MC |
505 | int ec_GFp_nistp224_group_set_curve(EC_GROUP *group, const BIGNUM *p, |
506 | const BIGNUM *a, const BIGNUM *n, | |
507 | BN_CTX *); | |
508 | int ec_GFp_nistp224_point_get_affine_coordinates(const EC_GROUP *group, | |
509 | const EC_POINT *point, | |
510 | BIGNUM *x, BIGNUM *y, | |
511 | BN_CTX *ctx); | |
512 | int ec_GFp_nistp224_mul(const EC_GROUP *group, EC_POINT *r, | |
513 | const BIGNUM *scalar, size_t num, | |
514 | const EC_POINT *points[], const BIGNUM *scalars[], | |
515 | BN_CTX *); | |
516 | int ec_GFp_nistp224_points_mul(const EC_GROUP *group, EC_POINT *r, | |
517 | const BIGNUM *scalar, size_t num, | |
518 | const EC_POINT *points[], | |
519 | const BIGNUM *scalars[], BN_CTX *ctx); | |
04daec86 BM |
520 | int ec_GFp_nistp224_precompute_mult(EC_GROUP *group, BN_CTX *ctx); |
521 | int ec_GFp_nistp224_have_precompute_mult(const EC_GROUP *group); | |
3e00b4c9 BM |
522 | |
523 | /* method functions in ecp_nistp256.c */ | |
524 | int ec_GFp_nistp256_group_init(EC_GROUP *group); | |
0f113f3e MC |
525 | int ec_GFp_nistp256_group_set_curve(EC_GROUP *group, const BIGNUM *p, |
526 | const BIGNUM *a, const BIGNUM *n, | |
527 | BN_CTX *); | |
528 | int ec_GFp_nistp256_point_get_affine_coordinates(const EC_GROUP *group, | |
529 | const EC_POINT *point, | |
530 | BIGNUM *x, BIGNUM *y, | |
531 | BN_CTX *ctx); | |
532 | int ec_GFp_nistp256_mul(const EC_GROUP *group, EC_POINT *r, | |
533 | const BIGNUM *scalar, size_t num, | |
534 | const EC_POINT *points[], const BIGNUM *scalars[], | |
535 | BN_CTX *); | |
536 | int ec_GFp_nistp256_points_mul(const EC_GROUP *group, EC_POINT *r, | |
537 | const BIGNUM *scalar, size_t num, | |
538 | const EC_POINT *points[], | |
539 | const BIGNUM *scalars[], BN_CTX *ctx); | |
3e00b4c9 BM |
540 | int ec_GFp_nistp256_precompute_mult(EC_GROUP *group, BN_CTX *ctx); |
541 | int ec_GFp_nistp256_have_precompute_mult(const EC_GROUP *group); | |
542 | ||
543 | /* method functions in ecp_nistp521.c */ | |
544 | int ec_GFp_nistp521_group_init(EC_GROUP *group); | |
0f113f3e MC |
545 | int ec_GFp_nistp521_group_set_curve(EC_GROUP *group, const BIGNUM *p, |
546 | const BIGNUM *a, const BIGNUM *n, | |
547 | BN_CTX *); | |
548 | int ec_GFp_nistp521_point_get_affine_coordinates(const EC_GROUP *group, | |
549 | const EC_POINT *point, | |
550 | BIGNUM *x, BIGNUM *y, | |
551 | BN_CTX *ctx); | |
552 | int ec_GFp_nistp521_mul(const EC_GROUP *group, EC_POINT *r, | |
553 | const BIGNUM *scalar, size_t num, | |
554 | const EC_POINT *points[], const BIGNUM *scalars[], | |
555 | BN_CTX *); | |
556 | int ec_GFp_nistp521_points_mul(const EC_GROUP *group, EC_POINT *r, | |
557 | const BIGNUM *scalar, size_t num, | |
558 | const EC_POINT *points[], | |
559 | const BIGNUM *scalars[], BN_CTX *ctx); | |
3e00b4c9 BM |
560 | int ec_GFp_nistp521_precompute_mult(EC_GROUP *group, BN_CTX *ctx); |
561 | int ec_GFp_nistp521_have_precompute_mult(const EC_GROUP *group); | |
562 | ||
563 | /* utility functions in ecp_nistputil.c */ | |
564 | void ec_GFp_nistp_points_make_affine_internal(size_t num, void *point_array, | |
0f113f3e MC |
565 | size_t felem_size, |
566 | void *tmp_felems, | |
567 | void (*felem_one) (void *out), | |
568 | int (*felem_is_zero) (const void | |
569 | *in), | |
570 | void (*felem_assign) (void *out, | |
571 | const void | |
572 | *in), | |
573 | void (*felem_square) (void *out, | |
574 | const void | |
575 | *in), | |
576 | void (*felem_mul) (void *out, | |
577 | const void | |
578 | *in1, | |
579 | const void | |
580 | *in2), | |
581 | void (*felem_inv) (void *out, | |
582 | const void | |
583 | *in), | |
584 | void (*felem_contract) (void | |
585 | *out, | |
586 | const | |
587 | void | |
588 | *in)); | |
589 | void ec_GFp_nistp_recode_scalar_bits(unsigned char *sign, | |
590 | unsigned char *digit, unsigned char in); | |
04daec86 | 591 | #endif |
77470e98 | 592 | int ec_group_simple_order_bits(const EC_GROUP *group); |
f54be179 | 593 | |
23ccae80 BB |
594 | /** |
595 | * Creates a new EC_GROUP object | |
596 | * \param libctx The associated library context or NULL for the default | |
597 | * library context | |
2da8d4eb | 598 | * \param propq Any property query string |
23ccae80 BB |
599 | * \param meth EC_METHOD to use |
600 | * \return newly created EC_GROUP object or NULL in case of an error. | |
601 | */ | |
2da8d4eb MC |
602 | EC_GROUP *ec_group_new_with_libctx(OPENSSL_CTX *libctx, const char *propq, |
603 | const EC_METHOD *meth); | |
23ccae80 | 604 | |
f54be179 AP |
605 | #ifdef ECP_NISTZ256_ASM |
606 | /** Returns GFp methods using montgomery multiplication, with x86-64 optimized | |
607 | * P256. See http://eprint.iacr.org/2013/816. | |
608 | * \return EC_METHOD object | |
609 | */ | |
610 | const EC_METHOD *EC_GFp_nistz256_method(void); | |
611 | #endif | |
19bd1fa1 | 612 | #ifdef S390X_EC_ASM |
1461e667 PS |
613 | const EC_METHOD *EC_GFp_s390x_nistp256_method(void); |
614 | const EC_METHOD *EC_GFp_s390x_nistp384_method(void); | |
615 | const EC_METHOD *EC_GFp_s390x_nistp521_method(void); | |
616 | #endif | |
28572b57 | 617 | |
77470e98 DSH |
618 | size_t ec_key_simple_priv2oct(const EC_KEY *eckey, |
619 | unsigned char *buf, size_t len); | |
25d57dc7 | 620 | int ec_key_simple_oct2priv(EC_KEY *eckey, const unsigned char *buf, size_t len); |
77470e98 DSH |
621 | int ec_key_simple_generate_key(EC_KEY *eckey); |
622 | int ec_key_simple_generate_public_key(EC_KEY *eckey); | |
623 | int ec_key_simple_check_key(const EC_KEY *eckey); | |
624 | ||
a9612d6c | 625 | int ec_curve_nid_from_params(const EC_GROUP *group, BN_CTX *ctx); |
8402cd5f | 626 | |
28572b57 DSH |
627 | /* EC_METHOD definitions */ |
628 | ||
629 | struct ec_key_method_st { | |
630 | const char *name; | |
631 | int32_t flags; | |
0d6ff6d3 DSH |
632 | int (*init)(EC_KEY *key); |
633 | void (*finish)(EC_KEY *key); | |
ea0392b9 | 634 | int (*copy)(EC_KEY *dest, const EC_KEY *src); |
3475bc96 DSH |
635 | int (*set_group)(EC_KEY *key, const EC_GROUP *grp); |
636 | int (*set_private)(EC_KEY *key, const BIGNUM *priv_key); | |
637 | int (*set_public)(EC_KEY *key, const EC_POINT *pub_key); | |
5a6a1029 | 638 | int (*keygen)(EC_KEY *key); |
e2285d87 DSH |
639 | int (*compute_key)(unsigned char **pout, size_t *poutlen, |
640 | const EC_POINT *pub_key, const EC_KEY *ecdh); | |
a200a817 DSH |
641 | int (*sign)(int type, const unsigned char *dgst, int dlen, unsigned char |
642 | *sig, unsigned int *siglen, const BIGNUM *kinv, | |
643 | const BIGNUM *r, EC_KEY *eckey); | |
c0efda00 DSH |
644 | int (*sign_setup)(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, |
645 | BIGNUM **rp); | |
646 | ECDSA_SIG *(*sign_sig)(const unsigned char *dgst, int dgst_len, | |
647 | const BIGNUM *in_kinv, const BIGNUM *in_r, | |
648 | EC_KEY *eckey); | |
a200a817 DSH |
649 | |
650 | int (*verify)(int type, const unsigned char *dgst, int dgst_len, | |
651 | const unsigned char *sigbuf, int sig_len, EC_KEY *eckey); | |
c0efda00 DSH |
652 | int (*verify_sig)(const unsigned char *dgst, int dgst_len, |
653 | const ECDSA_SIG *sig, EC_KEY *eckey); | |
d196305a | 654 | }; |
28572b57 DSH |
655 | |
656 | #define EC_KEY_METHOD_DYNAMIC 1 | |
5a6a1029 | 657 | |
2da8d4eb MC |
658 | EC_KEY *ec_key_new_method_int(OPENSSL_CTX *libctx, const char *propq, |
659 | ENGINE *engine); | |
a9612d6c | 660 | |
5a6a1029 | 661 | int ossl_ec_key_gen(EC_KEY *eckey); |
e2285d87 DSH |
662 | int ossl_ecdh_compute_key(unsigned char **pout, size_t *poutlen, |
663 | const EC_POINT *pub_key, const EC_KEY *ecdh); | |
664 | int ecdh_simple_compute_key(unsigned char **pout, size_t *poutlen, | |
665 | const EC_POINT *pub_key, const EC_KEY *ecdh); | |
714b2abb DSH |
666 | |
667 | struct ECDSA_SIG_st { | |
668 | BIGNUM *r; | |
669 | BIGNUM *s; | |
670 | }; | |
c0efda00 DSH |
671 | |
672 | int ossl_ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, | |
673 | BIGNUM **rp); | |
a200a817 DSH |
674 | int ossl_ecdsa_sign(int type, const unsigned char *dgst, int dlen, |
675 | unsigned char *sig, unsigned int *siglen, | |
676 | const BIGNUM *kinv, const BIGNUM *r, EC_KEY *eckey); | |
c0efda00 DSH |
677 | ECDSA_SIG *ossl_ecdsa_sign_sig(const unsigned char *dgst, int dgst_len, |
678 | const BIGNUM *in_kinv, const BIGNUM *in_r, | |
679 | EC_KEY *eckey); | |
a200a817 DSH |
680 | int ossl_ecdsa_verify(int type, const unsigned char *dgst, int dgst_len, |
681 | const unsigned char *sigbuf, int sig_len, EC_KEY *eckey); | |
c0efda00 DSH |
682 | int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len, |
683 | const ECDSA_SIG *sig, EC_KEY *eckey); | |
9bf682f6 PS |
684 | int ecdsa_simple_sign_setup(EC_KEY *eckey, BN_CTX *ctx_in, BIGNUM **kinvp, |
685 | BIGNUM **rp); | |
686 | ECDSA_SIG *ecdsa_simple_sign_sig(const unsigned char *dgst, int dgst_len, | |
687 | const BIGNUM *in_kinv, const BIGNUM *in_r, | |
688 | EC_KEY *eckey); | |
689 | int ecdsa_simple_verify_sig(const unsigned char *dgst, int dgst_len, | |
690 | const ECDSA_SIG *sig, EC_KEY *eckey); | |
8dcfdbf5 | 691 | |
06c6d05f | 692 | |
01ad66f8 NT |
693 | /*- |
694 | * This functions computes a single point multiplication over the EC group, | |
695 | * using, at a high level, a Montgomery ladder with conditional swaps, with | |
696 | * various timing attack defenses. | |
697 | * | |
698 | * It performs either a fixed point multiplication | |
699 | * (scalar * generator) | |
700 | * when point is NULL, or a variable point multiplication | |
701 | * (scalar * point) | |
702 | * when point is not NULL. | |
703 | * | |
704 | * `scalar` cannot be NULL and should be in the range [0,n) otherwise all | |
705 | * constant time bets are off (where n is the cardinality of the EC group). | |
706 | * | |
707 | * This function expects `group->order` and `group->cardinality` to be well | |
708 | * defined and non-zero: it fails with an error code otherwise. | |
709 | * | |
710 | * NB: This says nothing about the constant-timeness of the ladder step | |
711 | * implementation (i.e., the default implementation is based on EC_POINT_add and | |
712 | * EC_POINT_dbl, which of course are not constant time themselves) or the | |
713 | * underlying multiprecision arithmetic. | |
714 | * | |
715 | * The product is stored in `r`. | |
716 | * | |
717 | * This is an internal function: callers are in charge of ensuring that the | |
718 | * input parameters `group`, `r`, `scalar` and `ctx` are not NULL. | |
719 | * | |
720 | * Returns 1 on success, 0 otherwise. | |
721 | */ | |
722 | int ec_scalar_mul_ladder(const EC_GROUP *group, EC_POINT *r, | |
723 | const BIGNUM *scalar, const EC_POINT *point, | |
724 | BN_CTX *ctx); | |
725 | ||
f667820c | 726 | int ec_point_blind_coordinates(const EC_GROUP *group, EC_POINT *p, BN_CTX *ctx); |
37124360 | 727 | |
756c91b1 AP |
728 | static ossl_inline int ec_point_ladder_pre(const EC_GROUP *group, |
729 | EC_POINT *r, EC_POINT *s, | |
730 | EC_POINT *p, BN_CTX *ctx) | |
37124360 NT |
731 | { |
732 | if (group->meth->ladder_pre != NULL) | |
733 | return group->meth->ladder_pre(group, r, s, p, ctx); | |
734 | ||
735 | if (!EC_POINT_copy(s, p) | |
736 | || !EC_POINT_dbl(group, r, s, ctx)) | |
737 | return 0; | |
738 | ||
739 | return 1; | |
740 | } | |
741 | ||
756c91b1 AP |
742 | static ossl_inline int ec_point_ladder_step(const EC_GROUP *group, |
743 | EC_POINT *r, EC_POINT *s, | |
744 | EC_POINT *p, BN_CTX *ctx) | |
37124360 NT |
745 | { |
746 | if (group->meth->ladder_step != NULL) | |
747 | return group->meth->ladder_step(group, r, s, p, ctx); | |
748 | ||
749 | if (!EC_POINT_add(group, s, r, s, ctx) | |
750 | || !EC_POINT_dbl(group, r, r, ctx)) | |
751 | return 0; | |
752 | ||
753 | return 1; | |
754 | ||
755 | } | |
756 | ||
756c91b1 AP |
757 | static ossl_inline int ec_point_ladder_post(const EC_GROUP *group, |
758 | EC_POINT *r, EC_POINT *s, | |
759 | EC_POINT *p, BN_CTX *ctx) | |
37124360 NT |
760 | { |
761 | if (group->meth->ladder_post != NULL) | |
762 | return group->meth->ladder_post(group, r, s, p, ctx); | |
763 | ||
764 | return 1; | |
765 | } |