[thirdparty/openssl.git] / crypto / ec / ec_mult.c

/* crypto/ec/ec_mult.c */
/* ====================================================================
 * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer. 
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    openssl-core@openssl.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */
/* ====================================================================
 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 * Portions of this software developed by SUN MICROSYSTEMS, INC.,
 * and contributed to the OpenSSL project.
 */

#include <openssl/err.h>

#include "ec_lcl.h"


/* TODO: optional precomputation of multiples of the generator */


/*
 * wNAF-based interleaving multi-exponentation method
 * (<URL:http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#multiexp>)
 */


/* Determine the modified width-(w+1) Non-Adjacent Form (wNAF) of 'scalar'.
 * This is an array  r[]  of values that are either zero or odd with an
 * absolute value less than  2^w  satisfying
 *     scalar = \sum_j r[j]*2^j
 * where at most one of any  w+1  consecutive digits is non-zero
 * with the exception that the most significant digit may be only
 * w-1 zeros away from that next non-zero digit.
 */
static signed char *compute_wNAF(const BIGNUM *scalar, int w, size_t *ret_len)
	{
	int window_val;
	int ok = 0;
	signed char *r = NULL;
	int sign = 1;
	int bit, next_bit, mask;
	size_t len = 0, j;
	
	if (w <= 0 || w > 7) /* 'signed char' can represent integers with absolute values less than 2^7 */
		{
		ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
		goto err;
		}
	bit = 1 << w; /* at most 128 */
	next_bit = bit << 1; /* at most 256 */
	mask = next_bit - 1; /* at most 255 */

	if (scalar->neg)
		{
		sign = -1;
		}

	len = BN_num_bits(scalar);
	r = OPENSSL_malloc(len + 1); /* modified wNAF may be one digit longer than binary representation */
	if (r == NULL) goto err;

	if (scalar->d == NULL || scalar->top == 0)
		{
		ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
		goto err;
		}
	window_val = scalar->d[0] & mask;
	j = 0;
	while ((window_val != 0) || (j + w + 1 < len)) /* if j+w+1 >= len, window_val will not increase */
		{
		int digit = 0;

		/* 0 <= window_val <= 2^(w+1) */

		if (window_val & 1)
			{
			/* 0 < window_val < 2^(w+1) */

			if (window_val & bit)
				{
				digit = window_val - next_bit; /* -2^w < digit < 0 */

#if 1 /* modified wNAF */
				if (j + w + 1 >= len)
					{
					/* special case for generating modified wNAFs:
					 * no new bits will be added into window_val,
					 * so using a positive digit here will decrease
					 * the total length of the representation */
					
					digit = window_val & (mask >> 1); /* 0 < digit < 2^w */
					}
#endif
				}
			else
				{
				digit = window_val; /* 0 < digit < 2^w */
				}
			
			if (digit <= -bit || digit >= bit || !(digit & 1))
				{
				ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
				goto err;
				}

			window_val -= digit;

			/* now window_val is 0 or 2^(w+1) in standard wNAF generation;
			 * for modified window NAFs, it may also be 2^w
			 */
			if (window_val != 0 && window_val != next_bit && window_val != bit)
				{
				ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
				goto err;
				}
			}

		r[j++] = sign * digit;

		window_val >>= 1;
		window_val += bit * BN_is_bit_set(scalar, j + w);

		if (window_val > next_bit)
			{
			ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
			goto err;
			}
		}

	if (j > len + 1)
		{
		ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
		goto err;
		}
	len = j;
	ok = 1;

 err:
	if (!ok)
		{
		OPENSSL_free(r);
		r = NULL;
		}
	if (ok)
		*ret_len = len;
	return r;
	}


/* TODO: table should be optimised for the wNAF-based implementation,
 *       sometimes smaller windows will give better performance
 *       (thus the boundaries should be increased)
 */
#define EC_window_bits_for_scalar_size(b) \
		((b) >= 2000 ? 6 : \
		 (b) >=  800 ? 5 : \
		 (b) >=  300 ? 4 : \
		 (b) >=   70 ? 3 : \
		 (b) >=   20 ? 2 : \
		  1)

/* Compute
 *      \sum scalars[i]*points[i],
 * also including
 *      scalar*generator
 * in the addition if scalar != NULL
 */
int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
	size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx)
	{
	BN_CTX *new_ctx = NULL;
	EC_POINT *generator = NULL;
	EC_POINT *tmp = NULL;
	size_t totalnum;
	size_t i, j;
	int k;
	int r_is_inverted = 0;
	int r_is_at_infinity = 1;
	size_t *wsize = NULL; /* individual window sizes */
	signed char **wNAF = NULL; /* individual wNAFs */
	size_t *wNAF_len = NULL;
	size_t max_len = 0;
	size_t num_val;
	EC_POINT **val = NULL; /* precomputation */
	EC_POINT **v;
	EC_POINT ***val_sub = NULL; /* pointers to sub-arrays of 'val' */
	int ret = 0;
	
	if (scalar != NULL)
		{
		generator = EC_GROUP_get0_generator(group);
		if (generator == NULL)
			{
			ECerr(EC_F_EC_WNAF_MUL, EC_R_UNDEFINED_GENERATOR);
			return 0;
			}
		}
	
	for (i = 0; i < num; i++)
		{
		if (group->meth != points[i]->meth)
			{
			ECerr(EC_F_EC_WNAF_MUL, EC_R_INCOMPATIBLE_OBJECTS);
			return 0;
			}
		}

	totalnum = num + (scalar != NULL);

	wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);
	wNAF_len = OPENSSL_malloc(totalnum * sizeof wNAF_len[0]);
	wNAF = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]);
	if (wNAF != NULL)
		{
		wNAF[0] = NULL; /* preliminary pivot */
		}
	if (wsize == NULL || wNAF_len == NULL || wNAF == NULL) goto err;

	/* num_val := total number of points to precompute */
	num_val = 0;
	for (i = 0; i < totalnum; i++)
		{
		size_t bits;

		bits = i < num ? BN_num_bits(scalars[i]) : BN_num_bits(scalar);
		wsize[i] = EC_window_bits_for_scalar_size(bits);
		num_val += 1u << (wsize[i] - 1);
		}

	/* all precomputed points go into a single array 'val',
	 * 'val_sub[i]' is a pointer to the subarray for the i-th point */
	val = OPENSSL_malloc((num_val + 1) * sizeof val[0]);
	if (val == NULL) goto err;
	val[num_val] = NULL; /* pivot element */

	val_sub = OPENSSL_malloc(totalnum * sizeof val_sub[0]);
	if (val_sub == NULL) goto err;

	/* allocate points for precomputation */
	v = val;
	for (i = 0; i < totalnum; i++)
		{
		val_sub[i] = v;
		for (j = 0; j < (1u << (wsize[i] - 1)); j++)
			{
			*v = EC_POINT_new(group);
			if (*v == NULL) goto err;
			v++;
			}
		}
	if (!(v == val + num_val))
		{
		ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);
		goto err;
		}

	if (ctx == NULL)
		{
		ctx = new_ctx = BN_CTX_new();
		if (ctx == NULL)
			goto err;
		}
	
	tmp = EC_POINT_new(group);
	if (tmp == NULL) goto err;

	/* prepare precomputed values:
	 *    val_sub[i][0] :=     points[i]
	 *    val_sub[i][1] := 3 * points[i]
	 *    val_sub[i][2] := 5 * points[i]
	 *    ...
	 */
	for (i = 0; i < totalnum; i++)
		{
		if (i < num)
			{
			if (!EC_POINT_copy(val_sub[i][0], points[i])) goto err;
			}
		else
			{
			if (!EC_POINT_copy(val_sub[i][0], generator)) goto err;
			}

		if (wsize[i] > 1)
			{
			if (!EC_POINT_dbl(group, tmp, val_sub[i][0], ctx)) goto err;
			for (j = 1; j < (1u << (wsize[i] - 1)); j++)
				{
				if (!EC_POINT_add(group, val_sub[i][j], val_sub[i][j - 1], tmp, ctx)) goto err;
				}
			}

		wNAF[i + 1] = NULL; /* make sure we always have a pivot */
		wNAF[i] = compute_wNAF((i < num ? scalars[i] : scalar), wsize[i], &wNAF_len[i]);
		if (wNAF[i] == NULL) goto err;
		if (wNAF_len[i] > max_len)
			max_len = wNAF_len[i];
		}

#if 1 /* optional; EC_window_bits_for_scalar_size assumes we do this step */
	if (!EC_POINTs_make_affine(group, num_val, val, ctx)) goto err;
#endif

	r_is_at_infinity = 1;

	for (k = max_len - 1; k >= 0; k--)
		{
		if (!r_is_at_infinity)
			{
			if (!EC_POINT_dbl(group, r, r, ctx)) goto err;
			}
		
		for (i = 0; i < totalnum; i++)
			{
			if (wNAF_len[i] > (size_t)k)
				{
				int digit = wNAF[i][k];
				int is_neg;

				if (digit) 
					{
					is_neg = digit < 0;

					if (is_neg)
						digit = -digit;

					if (is_neg != r_is_inverted)
						{
						if (!r_is_at_infinity)
							{
							if (!EC_POINT_invert(group, r, ctx)) goto err;
							}
						r_is_inverted = !r_is_inverted;
						}

					/* digit > 0 */

					if (r_is_at_infinity)
						{
						if (!EC_POINT_copy(r, val_sub[i][digit >> 1])) goto err;
						r_is_at_infinity = 0;
						}
					else
						{
						if (!EC_POINT_add(group, r, r, val_sub[i][digit >> 1], ctx)) goto err;
						}
					}
				}
			}
		}

	if (r_is_at_infinity)
		{
		if (!EC_POINT_set_to_infinity(group, r)) goto err;
		}
	else
		{
		if (r_is_inverted)
			if (!EC_POINT_invert(group, r, ctx)) goto err;
		}
	
	ret = 1;

 err:
	if (new_ctx != NULL)
		BN_CTX_free(new_ctx);
	if (tmp != NULL)
		EC_POINT_free(tmp);
	if (wsize != NULL)
		OPENSSL_free(wsize);
	if (wNAF_len != NULL)
		OPENSSL_free(wNAF_len);
	if (wNAF != NULL)
		{
		signed char **w;
		
		for (w = wNAF; *w != NULL; w++)
			OPENSSL_free(*w);
		
		OPENSSL_free(wNAF);
		}
	if (val != NULL)
		{
		for (v = val; *v != NULL; v++)
			EC_POINT_clear_free(*v);

		OPENSSL_free(val);
		}
	if (val_sub != NULL)
		{
		OPENSSL_free(val_sub);
		}
	return ret;
	}


/* Generic multiplication method.
 * If group->meth does not provide a multiplication method, default to ec_wNAF_mul;
 * otherwise use the group->meth's multiplication.
 */
int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
	size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx)
	{
	if (group->meth->mul == 0)
		return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
	else
		return group->meth->mul(group, r, scalar, num, points, scalars, ctx);
	}


int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar, const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
	{
	const EC_POINT *points[1];
	const BIGNUM *scalars[1];

	points[0] = point;
	scalars[0] = p_scalar;

	return EC_POINTs_mul(group, r, g_scalar, (point != NULL && p_scalar != NULL), points, scalars, ctx);
	}


int ec_wNAF_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
	{
	const EC_POINT *generator;
	BN_CTX *new_ctx = NULL;
	BIGNUM *order;
	int ret = 0;

	generator = EC_GROUP_get0_generator(group);
	if (generator == NULL)
		{
		ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, EC_R_UNDEFINED_GENERATOR);
		return 0;
		}

	if (ctx == NULL)
		{
		ctx = new_ctx = BN_CTX_new();
		if (ctx == NULL)
			return 0;
		}
	
	BN_CTX_start(ctx);
	order = BN_CTX_get(ctx);
	if (order == NULL) goto err;
	
	if (!EC_GROUP_get_order(group, order, ctx)) return 0;
	if (BN_is_zero(order))
		{
		ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, EC_R_UNKNOWN_ORDER);
		goto err;
		}

	/* TODO */

	ret = 1;
	
 err:
	BN_CTX_end(ctx);
	if (new_ctx != NULL)
		BN_CTX_free(new_ctx);
	return ret;
	}


/* Generic multiplicaiton precomputation method.
 * If group->meth does not provide a multiplication method, default to ec_wNAF_mul and do its
 * precomputation; otherwise use the group->meth's precomputation if it exists.
 */
int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
	{
	if (group->meth->mul == 0)
		return ec_wNAF_precompute_mult(group, ctx);
	else if (group->meth->precompute_mult != 0)
		return group->meth->precompute_mult(group, ctx);
	else
		return 1;
	}
Commit	Line	Data
65e81670 BM	1	/* crypto/ec/ec_mult.c */
65e81670 BM	2	/* ====================================================================
2c8d0dcc	3	* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
65e81670 BM	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions
	7	* are met:
	8	*
	9	* 1. Redistributions of source code must retain the above copyright
	10	* notice, this list of conditions and the following disclaimer.
	11	*
	12	* 2. Redistributions in binary form must reproduce the above copyright
	13	* notice, this list of conditions and the following disclaimer in
	14	* the documentation and/or other materials provided with the
	15	* distribution.
	16	*
	17	* 3. All advertising materials mentioning features or use of this
	18	* software must display the following acknowledgment:
	19	* "This product includes software developed by the OpenSSL Project
	20	* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
	21	*
	22	* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
	23	* endorse or promote products derived from this software without
	24	* prior written permission. For written permission, please contact
	25	* openssl-core@openssl.org.
	26	*
	27	* 5. Products derived from this software may not be called "OpenSSL"
	28	* nor may "OpenSSL" appear in their names without prior written
	29	* permission of the OpenSSL Project.
	30	*
	31	* 6. Redistributions of any form whatsoever must retain the following
	32	* acknowledgment:
	33	* "This product includes software developed by the OpenSSL Project
	34	* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
	35	*
	36	* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
	37	* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	38	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	39	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
	40	* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	41	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	42	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
	43	* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	44	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	45	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	46	* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
	47	* OF THE POSSIBILITY OF SUCH DAMAGE.
	48	* ====================================================================
	49	*
	50	* This product includes cryptographic software written by Eric Young
	51	* (eay@cryptsoft.com). This product includes software written by Tim
	52	* Hudson (tjh@cryptsoft.com).
	53	*
	54	*/
7793f30e BM	55	/* ====================================================================
	56	* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
	57	* Portions of this software developed by SUN MICROSYSTEMS, INC.,
	58	* and contributed to the OpenSSL project.
	59	*/
65e81670	60
48fe4d62 BM	61	#include <openssl/err.h>
48fe4d62 BM	62
65e81670	63	#include "ec_lcl.h"
48fe4d62 BM	64
48fe4d62 BM	65
e3a4f8b8	66	/* TODO: optional precomputation of multiples of the generator */
48fe4d62 BM	67
48fe4d62 BM	68
f916052e	69
3ba1f111 BM	70	/*
3ba1f111 BM	71	* wNAF-based interleaving multi-exponentation method
b19941ab	72	* (<URL:http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#multiexp>)
3ba1f111 BM	73	*/
	74
	75
2c8d0dcc	76	/* Determine the modified width-(w+1) Non-Adjacent Form (wNAF) of 'scalar'.
3ba1f111 BM	77	* This is an array r[] of values that are either zero or odd with an
	78	* absolute value less than 2^w satisfying
	79	* scalar = \sum_j r[j]*2^j
2c8d0dcc BM	80	* where at most one of any w+1 consecutive digits is non-zero
	81	* with the exception that the most significant digit may be only
	82	* w-1 zeros away from that next non-zero digit.
3ba1f111	83	*/
2c8d0dcc	84	static signed char compute_wNAF(const BIGNUM scalar, int w, size_t *ret_len)
3ba1f111	85	{
2c8d0dcc	86	int window_val;
3ba1f111 BM	87	int ok = 0;
	88	signed char *r = NULL;
	89	int sign = 1;
	90	int bit, next_bit, mask;
e71adb85	91	size_t len = 0, j;
3ba1f111	92
c78515f5	93	if (w <= 0 \|\| w > 7) /* 'signed char' can represent integers with absolute values less than 2^7 */
3ba1f111 BM	94	{
	95	ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
	96	goto err;
	97	}
	98	bit = 1 << w; /* at most 128 */
	99	next_bit = bit << 1; /* at most 256 */
	100	mask = next_bit - 1; /* at most 255 */
	101
2c8d0dcc	102	if (scalar->neg)
3ba1f111 BM	103	{
3ba1f111 BM	104	sign = -1;
3ba1f111 BM	105	}
3ba1f111 BM	106
2c8d0dcc BM	107	len = BN_num_bits(scalar);
2c8d0dcc BM	108	r = OPENSSL_malloc(len + 1); /* modified wNAF may be one digit longer than binary representation */
3ba1f111 BM	109	if (r == NULL) goto err;
3ba1f111 BM	110
2c8d0dcc BM	111	if (scalar->d == NULL \|\| scalar->top == 0)
	112	{
	113	ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
	114	goto err;
	115	}
	116	window_val = scalar->d[0] & mask;
3ba1f111	117	j = 0;
2c8d0dcc	118	while ((window_val != 0) \|\| (j + w + 1 < len)) /* if j+w+1 >= len, window_val will not increase */
3ba1f111	119	{
2c8d0dcc	120	int digit = 0;
3ba1f111	121
2c8d0dcc BM	122	/* 0 <= window_val <= 2^(w+1) */
	123
	124	if (window_val & 1)
3ba1f111	125	{
2c8d0dcc BM	126	/* 0 < window_val < 2^(w+1) */
	127
	128	if (window_val & bit)
3ba1f111	129	{
2c8d0dcc BM	130	digit = window_val - next_bit; /* -2^w < digit < 0 */
	131
	132	#if 1 /* modified wNAF */
	133	if (j + w + 1 >= len)
	134	{
	135	/* special case for generating modified wNAFs:
	136	* no new bits will be added into window_val,
	137	* so using a positive digit here will decrease
	138	* the total length of the representation */
	139
	140	digit = window_val & (mask >> 1); /* 0 < digit < 2^w */
	141	}
	142	#endif
3ba1f111	143	}
2c8d0dcc	144	else
3ba1f111	145	{
2c8d0dcc	146	digit = window_val; /* 0 < digit < 2^w */
3ba1f111	147	}
2c8d0dcc BM	148
2c8d0dcc BM	149	if (digit <= -bit \|\| digit >= bit \|\| !(digit & 1))
3ba1f111	150	{
2c8d0dcc BM	151	ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
2c8d0dcc BM	152	goto err;
3ba1f111 BM	153	}
3ba1f111 BM	154
2c8d0dcc BM	155	window_val -= digit;
	156
	157	/* now window_val is 0 or 2^(w+1) in standard wNAF generation;
	158	* for modified window NAFs, it may also be 2^w
	159	*/
	160	if (window_val != 0 && window_val != next_bit && window_val != bit)
3ba1f111 BM	161	{
	162	ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
	163	goto err;
	164	}
	165	}
	166
2c8d0dcc BM	167	r[j++] = sign * digit;
	168
	169	window_val >>= 1;
	170	window_val += bit * BN_is_bit_set(scalar, j + w);
	171
	172	if (window_val > next_bit)
3ba1f111 BM	173	{
	174	ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
	175	goto err;
	176	}
3ba1f111 BM	177	}
3ba1f111 BM	178
2c8d0dcc	179	if (j > len + 1)
3ba1f111 BM	180	{
	181	ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR);
	182	goto err;
	183	}
	184	len = j;
	185	ok = 1;
	186
	187	err:
3ba1f111 BM	188	if (!ok)
	189	{
	190	OPENSSL_free(r);
	191	r = NULL;
	192	}
	193	if (ok)
	194	*ret_len = len;
	195	return r;
	196	}
	197
	198
c05940ed BM	199	/* TODO: table should be optimised for the wNAF-based implementation,
	200	* sometimes smaller windows will give better performance
	201	* (thus the boundaries should be increased)
	202	*/
3ba1f111 BM	203	#define EC_window_bits_for_scalar_size(b) \
	204	((b) >= 2000 ? 6 : \
	205	(b) >= 800 ? 5 : \
	206	(b) >= 300 ? 4 : \
	207	(b) >= 70 ? 3 : \
	208	(b) >= 20 ? 2 : \
	209	1)
	210
	211	/* Compute
	212	* \sum scalars[i]*points[i],
	213	* also including
	214	* scalar*generator
	215	* in the addition if scalar != NULL
	216	*/
7793f30e	217	int ec_wNAF_mul(const EC_GROUP group, EC_POINT r, const BIGNUM *scalar,
3ba1f111 BM	218	size_t num, const EC_POINT points[], const BIGNUM scalars[], BN_CTX *ctx)
	219	{
	220	BN_CTX *new_ctx = NULL;
	221	EC_POINT *generator = NULL;
	222	EC_POINT *tmp = NULL;
	223	size_t totalnum;
	224	size_t i, j;
	225	int k;
	226	int r_is_inverted = 0;
	227	int r_is_at_infinity = 1;
	228	size_t wsize = NULL; / individual window sizes */
c78515f5	229	signed char *wNAF = NULL; / individual wNAFs */
3ba1f111 BM	230	size_t *wNAF_len = NULL;
3ba1f111 BM	231	size_t max_len = 0;
3ba1f111 BM	232	size_t num_val;
	233	EC_POINT *val = NULL; / precomputation */
	234	EC_POINT **v;
	235	EC_POINT **val_sub = NULL; / pointers to sub-arrays of 'val' */
	236	int ret = 0;
	237
	238	if (scalar != NULL)
	239	{
	240	generator = EC_GROUP_get0_generator(group);
	241	if (generator == NULL)
	242	{
7793f30e	243	ECerr(EC_F_EC_WNAF_MUL, EC_R_UNDEFINED_GENERATOR);
3ba1f111 BM	244	return 0;
	245	}
	246	}
	247
	248	for (i = 0; i < num; i++)
	249	{
	250	if (group->meth != points[i]->meth)
	251	{
7793f30e	252	ECerr(EC_F_EC_WNAF_MUL, EC_R_INCOMPATIBLE_OBJECTS);
3ba1f111 BM	253	return 0;
	254	}
	255	}
	256
	257	totalnum = num + (scalar != NULL);
	258
	259	wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);
	260	wNAF_len = OPENSSL_malloc(totalnum * sizeof wNAF_len[0]);
d009bcbf	261	wNAF = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]);
3ba1f111 BM	262	if (wNAF != NULL)
	263	{
	264	wNAF[0] = NULL; /* preliminary pivot */
	265	}
	266	if (wsize == NULL \|\| wNAF_len == NULL \|\| wNAF == NULL) goto err;
	267
	268	/* num_val := total number of points to precompute */
	269	num_val = 0;
	270	for (i = 0; i < totalnum; i++)
	271	{
	272	size_t bits;
	273
	274	bits = i < num ? BN_num_bits(scalars[i]) : BN_num_bits(scalar);
	275	wsize[i] = EC_window_bits_for_scalar_size(bits);
	276	num_val += 1u << (wsize[i] - 1);
	277	}
	278
	279	/* all precomputed points go into a single array 'val',
	280	* 'val_sub[i]' is a pointer to the subarray for the i-th point */
	281	val = OPENSSL_malloc((num_val + 1) * sizeof val[0]);
	282	if (val == NULL) goto err;
	283	val[num_val] = NULL; /* pivot element */
	284
	285	val_sub = OPENSSL_malloc(totalnum * sizeof val_sub[0]);
	286	if (val_sub == NULL) goto err;
	287
	288	/* allocate points for precomputation */
	289	v = val;
	290	for (i = 0; i < totalnum; i++)
	291	{
	292	val_sub[i] = v;
	293	for (j = 0; j < (1u << (wsize[i] - 1)); j++)
	294	{
	295	*v = EC_POINT_new(group);
	296	if (*v == NULL) goto err;
	297	v++;
	298	}
	299	}
	300	if (!(v == val + num_val))
	301	{
7793f30e	302	ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);
3ba1f111 BM	303	goto err;
	304	}
	305
	306	if (ctx == NULL)
	307	{
	308	ctx = new_ctx = BN_CTX_new();
	309	if (ctx == NULL)
	310	goto err;
	311	}
	312
	313	tmp = EC_POINT_new(group);
	314	if (tmp == NULL) goto err;
	315
	316	/* prepare precomputed values:
	317	* val_sub[i][0] := points[i]
	318	* val_sub[i][1] := 3 * points[i]
	319	* val_sub[i][2] := 5 * points[i]
	320	* ...
	321	*/
	322	for (i = 0; i < totalnum; i++)
	323	{
	324	if (i < num)
	325	{
	326	if (!EC_POINT_copy(val_sub[i][0], points[i])) goto err;
	327	}
	328	else
	329	{
	330	if (!EC_POINT_copy(val_sub[i][0], generator)) goto err;
	331	}
	332
	333	if (wsize[i] > 1)
	334	{
	335	if (!EC_POINT_dbl(group, tmp, val_sub[i][0], ctx)) goto err;
	336	for (j = 1; j < (1u << (wsize[i] - 1)); j++)
	337	{
	338	if (!EC_POINT_add(group, val_sub[i][j], val_sub[i][j - 1], tmp, ctx)) goto err;
	339	}
	340	}
	341
	342	wNAF[i + 1] = NULL; /* make sure we always have a pivot */
2c8d0dcc	343	wNAF[i] = compute_wNAF((i < num ? scalars[i] : scalar), wsize[i], &wNAF_len[i]);
3ba1f111 BM	344	if (wNAF[i] == NULL) goto err;
	345	if (wNAF_len[i] > max_len)
	346	max_len = wNAF_len[i];
	347	}
	348
	349	#if 1 /* optional; EC_window_bits_for_scalar_size assumes we do this step */
	350	if (!EC_POINTs_make_affine(group, num_val, val, ctx)) goto err;
	351	#endif
	352
	353	r_is_at_infinity = 1;
	354
	355	for (k = max_len - 1; k >= 0; k--)
	356	{
	357	if (!r_is_at_infinity)
	358	{
	359	if (!EC_POINT_dbl(group, r, r, ctx)) goto err;
	360	}
	361
	362	for (i = 0; i < totalnum; i++)
	363	{
b77fcddb	364	if (wNAF_len[i] > (size_t)k)
3ba1f111 BM	365	{
	366	int digit = wNAF[i][k];
	367	int is_neg;
	368
	369	if (digit)
	370	{
	371	is_neg = digit < 0;
	372
	373	if (is_neg)
	374	digit = -digit;
	375
	376	if (is_neg != r_is_inverted)
	377	{
	378	if (!r_is_at_infinity)
	379	{
	380	if (!EC_POINT_invert(group, r, ctx)) goto err;
	381	}
	382	r_is_inverted = !r_is_inverted;
	383	}
	384
	385	/* digit > 0 */
	386
	387	if (r_is_at_infinity)
	388	{
	389	if (!EC_POINT_copy(r, val_sub[i][digit >> 1])) goto err;
	390	r_is_at_infinity = 0;
	391	}
	392	else
	393	{
	394	if (!EC_POINT_add(group, r, r, val_sub[i][digit >> 1], ctx)) goto err;
	395	}
	396	}
	397	}
	398	}
	399	}
	400
	401	if (r_is_at_infinity)
	402	{
	403	if (!EC_POINT_set_to_infinity(group, r)) goto err;
	404	}
	405	else
	406	{
	407	if (r_is_inverted)
	408	if (!EC_POINT_invert(group, r, ctx)) goto err;
	409	}
	410
	411	ret = 1;
	412
	413	err:
	414	if (new_ctx != NULL)
	415	BN_CTX_free(new_ctx);
	416	if (tmp != NULL)
	417	EC_POINT_free(tmp);
	418	if (wsize != NULL)
	419	OPENSSL_free(wsize);
	420	if (wNAF_len != NULL)
	421	OPENSSL_free(wNAF_len);
	422	if (wNAF != NULL)
	423	{
	424	signed char **w;
	425
	426	for (w = wNAF; *w != NULL; w++)
	427	OPENSSL_free(*w);
	428
429	OPENSSL_free(wNAF);
430	}
431	if (val != NULL)
432	{
433	for (v = val; *v != NULL; v++)
434	EC_POINT_clear_free(*v);
435
436	OPENSSL_free(val);
437	}
438	if (val_sub != NULL)
439	{
440	OPENSSL_free(val_sub);
441	}
442	return ret;
443	}
444
38374911	445
7793f30e BM	446	/* Generic multiplication method.
	447	* If group->meth does not provide a multiplication method, default to ec_wNAF_mul;
	448	* otherwise use the group->meth's multiplication.
	449	*/
	450	int EC_POINTs_mul(const EC_GROUP group, EC_POINT r, const BIGNUM *scalar,
	451	size_t num, const EC_POINT points[], const BIGNUM scalars[], BN_CTX *ctx)
	452	{
	453	if (group->meth->mul == 0)
	454	return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
	455	else
	456	return group->meth->mul(group, r, scalar, num, points, scalars, ctx);
	457	}
	458
	459
38374911 BM	460	int EC_POINT_mul(const EC_GROUP group, EC_POINT r, const BIGNUM g_scalar, const EC_POINT point, const BIGNUM p_scalar, BN_CTX ctx)
	461	{
	462	const EC_POINT *points[1];
	463	const BIGNUM *scalars[1];
	464
	465	points[0] = point;
	466	scalars[0] = p_scalar;
	467
	468	return EC_POINTs_mul(group, r, g_scalar, (point != NULL && p_scalar != NULL), points, scalars, ctx);
	469	}
	470
	471
7793f30e	472	int ec_wNAF_precompute_mult(EC_GROUP group, BN_CTX ctx)
38374911 BM	473	{
	474	const EC_POINT *generator;
	475	BN_CTX *new_ctx = NULL;
	476	BIGNUM *order;
	477	int ret = 0;
	478
	479	generator = EC_GROUP_get0_generator(group);
	480	if (generator == NULL)
	481	{
7793f30e	482	ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, EC_R_UNDEFINED_GENERATOR);
38374911 BM	483	return 0;
	484	}
	485
	486	if (ctx == NULL)
	487	{
	488	ctx = new_ctx = BN_CTX_new();
	489	if (ctx == NULL)
	490	return 0;
	491	}
	492
	493	BN_CTX_start(ctx);
	494	order = BN_CTX_get(ctx);
	495	if (order == NULL) goto err;
	496
	497	if (!EC_GROUP_get_order(group, order, ctx)) return 0;
	498	if (BN_is_zero(order))
	499	{
7793f30e	500	ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, EC_R_UNKNOWN_ORDER);
38374911 BM	501	goto err;
	502	}
	503
	504	/* TODO */
	505
	506	ret = 1;
	507
	508	err:
	509	BN_CTX_end(ctx);
	510	if (new_ctx != NULL)
	511	BN_CTX_free(new_ctx);
	512	return ret;
	513	}
7793f30e BM	514
	515
	516	/* Generic multiplicaiton precomputation method.
	517	* If group->meth does not provide a multiplication method, default to ec_wNAF_mul and do its
	518	* precomputation; otherwise use the group->meth's precomputation if it exists.
	519	*/
	520	int EC_GROUP_precompute_mult(EC_GROUP group, BN_CTX ctx)
	521	{
	522	if (group->meth->mul == 0)
	523	return ec_wNAF_precompute_mult(group, ctx);
	524	else if (group->meth->precompute_mult != 0)
	525	return group->meth->precompute_mult(group, ctx);
	526	else
	527	return 1;
	528	}