crypto/ec/ec_lib.c

   1 /*
   2  * Originally written by Bodo Moeller for the OpenSSL project.
   3  */
   4 /* ====================================================================
   5  * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  *
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in
  16  *    the documentation and/or other materials provided with the
  17  *    distribution.
  18  *
  19  * 3. All advertising materials mentioning features or use of this
  20  *    software must display the following acknowledgment:
  21  *    "This product includes software developed by the OpenSSL Project
  22  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  23  *
  24  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  25  *    endorse or promote products derived from this software without
  26  *    prior written permission. For written permission, please contact
  27  *    openssl-core@openssl.org.
  28  *
  29  * 5. Products derived from this software may not be called "OpenSSL"
  30  *    nor may "OpenSSL" appear in their names without prior written
  31  *    permission of the OpenSSL Project.
  32  *
  33  * 6. Redistributions of any form whatsoever must retain the following
  34  *    acknowledgment:
  35  *    "This product includes software developed by the OpenSSL Project
  36  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  37  *
  38  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  39  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  40  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  41  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  42  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  43  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  44  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  45  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  46  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  47  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  48  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  49  * OF THE POSSIBILITY OF SUCH DAMAGE.
  50  * ====================================================================
  51  *
  52  * This product includes cryptographic software written by Eric Young
  53  * (eay@cryptsoft.com).  This product includes software written by Tim
  54  * Hudson (tjh@cryptsoft.com).
  55  *
  56  */
  57 /* ====================================================================
  58  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
  59  * Binary polynomial ECC support in OpenSSL originally developed by
  60  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
  61  */
  62
  63 #include <string.h>
  64
  65 #include <openssl/err.h>
  66 #include <openssl/opensslv.h>
  67
  68 #include "ec_lcl.h"
  69
  70 /* functions for EC_GROUP objects */
  71
  72 EC_GROUP *EC_GROUP_new(const EC_METHOD *meth)
  73 {
  74     EC_GROUP *ret;
  75
  76     if (meth == NULL) {
  77         ECerr(EC_F_EC_GROUP_NEW, EC_R_SLOT_FULL);
  78         return NULL;
  79     }
  80     if (meth->group_init == 0) {
  81         ECerr(EC_F_EC_GROUP_NEW, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
  82         return NULL;
  83     }
  84
  85     ret = OPENSSL_zalloc(sizeof(*ret));
  86     if (ret == NULL) {
  87         ECerr(EC_F_EC_GROUP_NEW, ERR_R_MALLOC_FAILURE);
  88         return NULL;
  89     }
  90
  91     ret->meth = meth;
  92     if ((ret->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {
  93         ret->order = BN_new();
  94         if (ret->order == NULL)
  95             goto err;
  96         ret->cofactor = BN_new();
  97         if (ret->cofactor == NULL)
  98             goto err;
  99     }
 100     ret->asn1_flag = OPENSSL_EC_NAMED_CURVE;
 101     ret->asn1_form = POINT_CONVERSION_UNCOMPRESSED;
 102     if (!meth->group_init(ret))
 103         goto err;
 104     return ret;
 105
 106  err:
 107     BN_free(ret->order);
 108     BN_free(ret->cofactor);
 109     OPENSSL_free(ret);
 110     return NULL;
 111 }
 112
 113 void EC_pre_comp_free(EC_GROUP *group)
 114 {
 115     switch (group->pre_comp_type) {
 116     default:
 117         break;
 118 #ifdef ECP_NISTZ256_REFERENCE_IMPLEMENTATION
 119     case pct_nistz256:
 120         EC_nistz256_pre_comp_free(group->pre_comp.nistz256);
 121         break;
 122 #endif
 123 #ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
 124     case pct_nistp224:
 125         EC_nistp224_pre_comp_free(group->pre_comp.nistp224);
 126         break;
 127     case pct_nistp256:
 128         EC_nistp256_pre_comp_free(group->pre_comp.nistp256);
 129         break;
 130     case pct_nistp521:
 131         EC_nistp521_pre_comp_free(group->pre_comp.nistp521);
 132         break;
 133 #endif
 134     case pct_ec:
 135         EC_ec_pre_comp_free(group->pre_comp.ec);
 136         break;
 137     }
 138     group->pre_comp.ec = NULL;
 139 }
 140
 141 void EC_GROUP_free(EC_GROUP *group)
 142 {
 143     if (!group)
 144         return;
 145
 146     if (group->meth->group_finish != 0)
 147         group->meth->group_finish(group);
 148
 149     EC_pre_comp_free(group);
 150     BN_MONT_CTX_free(group->mont_data);
 151     EC_POINT_free(group->generator);
 152     BN_free(group->order);
 153     BN_free(group->cofactor);
 154     OPENSSL_free(group->seed);
 155     OPENSSL_free(group);
 156 }
 157
 158 void EC_GROUP_clear_free(EC_GROUP *group)
 159 {
 160     if (!group)
 161         return;
 162
 163     if (group->meth->group_clear_finish != 0)
 164         group->meth->group_clear_finish(group);
 165     else if (group->meth->group_finish != 0)
 166         group->meth->group_finish(group);
 167
 168     EC_pre_comp_free(group);
 169     BN_MONT_CTX_free(group->mont_data);
 170     EC_POINT_clear_free(group->generator);
 171     BN_clear_free(group->order);
 172     BN_clear_free(group->cofactor);
 173     OPENSSL_clear_free(group->seed, group->seed_len);
 174     OPENSSL_clear_free(group, sizeof(*group));
 175 }
 176
 177 int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
 178 {
 179     if (dest->meth->group_copy == 0) {
 180         ECerr(EC_F_EC_GROUP_COPY, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 181         return 0;
 182     }
 183     if (dest->meth != src->meth) {
 184         ECerr(EC_F_EC_GROUP_COPY, EC_R_INCOMPATIBLE_OBJECTS);
 185         return 0;
 186     }
 187     if (dest == src)
 188         return 1;
 189
 190     /* Copy precomputed */
 191     dest->pre_comp_type = src->pre_comp_type;
 192     switch (src->pre_comp_type) {
 193     default:
 194         dest->pre_comp.ec = NULL;
 195         break;
 196 #ifdef ECP_NISTZ256_REFERENCE_IMPLEMENTATION
 197     case pct_nistz256:
 198         dest->pre_comp.nistz256 = EC_nistz256_pre_comp_dup(src->pre_comp.nistz256);
 199         break;
 200 #endif
 201 #ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
 202     case pct_nistp224:
 203         dest->pre_comp.nistp224 = EC_nistp224_pre_comp_dup(src->pre_comp.nistp224);
 204         break;
 205     case pct_nistp256:
 206         dest->pre_comp.nistp256 = EC_nistp256_pre_comp_dup(src->pre_comp.nistp256);
 207         break;
 208     case pct_nistp521:
 209         dest->pre_comp.nistp521 = EC_nistp521_pre_comp_dup(src->pre_comp.nistp521);
 210         break;
 211 #endif
 212     case pct_ec:
 213         dest->pre_comp.ec = EC_ec_pre_comp_dup(src->pre_comp.ec);
 214         break;
 215     }
 216
 217     if (src->mont_data != NULL) {
 218         if (dest->mont_data == NULL) {
 219             dest->mont_data = BN_MONT_CTX_new();
 220             if (dest->mont_data == NULL)
 221                 return 0;
 222         }
 223         if (!BN_MONT_CTX_copy(dest->mont_data, src->mont_data))
 224             return 0;
 225     } else {
 226         /* src->generator == NULL */
 227         BN_MONT_CTX_free(dest->mont_data);
 228         dest->mont_data = NULL;
 229     }
 230
 231     if (src->generator != NULL) {
 232         if (dest->generator == NULL) {
 233             dest->generator = EC_POINT_new(dest);
 234             if (dest->generator == NULL)
 235                 return 0;
 236         }
 237         if (!EC_POINT_copy(dest->generator, src->generator))
 238             return 0;
 239     } else {
 240         /* src->generator == NULL */
 241         EC_POINT_clear_free(dest->generator);
 242         dest->generator = NULL;
 243     }
 244
 245     if ((src->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {
 246         if (!BN_copy(dest->order, src->order))
 247             return 0;
 248         if (!BN_copy(dest->cofactor, src->cofactor))
 249             return 0;
 250     }
 251
 252     dest->curve_name = src->curve_name;
 253     dest->asn1_flag = src->asn1_flag;
 254     dest->asn1_form = src->asn1_form;
 255
 256     if (src->seed) {
 257         OPENSSL_free(dest->seed);
 258         dest->seed = OPENSSL_malloc(src->seed_len);
 259         if (dest->seed == NULL)
 260             return 0;
 261         if (!memcpy(dest->seed, src->seed, src->seed_len))
 262             return 0;
 263         dest->seed_len = src->seed_len;
 264     } else {
 265         OPENSSL_free(dest->seed);
 266         dest->seed = NULL;
 267         dest->seed_len = 0;
 268     }
 269
 270     return dest->meth->group_copy(dest, src);
 271 }
 272
 273 EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
 274 {
 275     EC_GROUP *t = NULL;
 276     int ok = 0;
 277
 278     if (a == NULL)
 279         return NULL;
 280
 281     if ((t = EC_GROUP_new(a->meth)) == NULL)
 282         return (NULL);
 283     if (!EC_GROUP_copy(t, a))
 284         goto err;
 285
 286     ok = 1;
 287
 288  err:
 289     if (!ok) {
 290         EC_GROUP_free(t);
 291         return NULL;
 292     }
 293         return t;
 294 }
 295
 296 const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *group)
 297 {
 298     return group->meth;
 299 }
 300
 301 int EC_METHOD_get_field_type(const EC_METHOD *meth)
 302 {
 303     return meth->field_type;
 304 }
 305
 306 int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
 307                            const BIGNUM *order, const BIGNUM *cofactor)
 308 {
 309     if (generator == NULL) {
 310         ECerr(EC_F_EC_GROUP_SET_GENERATOR, ERR_R_PASSED_NULL_PARAMETER);
 311         return 0;
 312     }
 313
 314     if (group->generator == NULL) {
 315         group->generator = EC_POINT_new(group);
 316         if (group->generator == NULL)
 317             return 0;
 318     }
 319     if (!EC_POINT_copy(group->generator, generator))
 320         return 0;
 321
 322     if (order != NULL) {
 323         if (!BN_copy(group->order, order))
 324             return 0;
 325     } else
 326         BN_zero(group->order);
 327
 328     if (cofactor != NULL) {
 329         if (!BN_copy(group->cofactor, cofactor))
 330             return 0;
 331     } else
 332         BN_zero(group->cofactor);
 333
 334
 335     /*
 336      * Some groups have an order with
 337      * factors of two, which makes the Montgomery setup fail.
 338      * |group->mont_data| will be NULL in this case.
 339      */
 340     if (BN_is_odd(group->order)) {
 341         return ec_precompute_mont_data(group);
 342     }
 343
 344     BN_MONT_CTX_free(group->mont_data);
 345     group->mont_data = NULL;
 346     return 1;
 347 }
 348
 349 const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group)
 350 {
 351     return group->generator;
 352 }
 353
 354 BN_MONT_CTX *EC_GROUP_get_mont_data(const EC_GROUP *group)
 355 {
 356     return group->mont_data;
 357 }
 358
 359 int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx)
 360 {
 361     if (group->order == NULL)
 362         return 0;
 363     if (!BN_copy(order, group->order))
 364         return 0;
 365
 366     return !BN_is_zero(order);
 367 }
 368
 369 const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group)
 370 {
 371     return group->order;
 372 }
 373
 374 int EC_GROUP_order_bits(const EC_GROUP *group)
 375 {
 376     OPENSSL_assert(group->meth->group_order_bits != NULL);
 377     return group->meth->group_order_bits(group);
 378 }
 379
 380 int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor,
 381                           BN_CTX *ctx)
 382 {
 383
 384     if (group->cofactor == NULL)
 385         return 0;
 386     if (!BN_copy(cofactor, group->cofactor))
 387         return 0;
 388
 389     return !BN_is_zero(group->cofactor);
 390 }
 391
 392 const BIGNUM *EC_GROUP_get0_cofactor(const EC_GROUP *group)
 393 {
 394     return group->cofactor;
 395 }
 396
 397 void EC_GROUP_set_curve_name(EC_GROUP *group, int nid)
 398 {
 399     group->curve_name = nid;
 400 }
 401
 402 int EC_GROUP_get_curve_name(const EC_GROUP *group)
 403 {
 404     return group->curve_name;
 405 }
 406
 407 void EC_GROUP_set_asn1_flag(EC_GROUP *group, int flag)
 408 {
 409     group->asn1_flag = flag;
 410 }
 411
 412 int EC_GROUP_get_asn1_flag(const EC_GROUP *group)
 413 {
 414     return group->asn1_flag;
 415 }
 416
 417 void EC_GROUP_set_point_conversion_form(EC_GROUP *group,
 418                                         point_conversion_form_t form)
 419 {
 420     group->asn1_form = form;
 421 }
 422
 423 point_conversion_form_t EC_GROUP_get_point_conversion_form(const EC_GROUP
 424                                                            *group)
 425 {
 426     return group->asn1_form;
 427 }
 428
 429 size_t EC_GROUP_set_seed(EC_GROUP *group, const unsigned char *p, size_t len)
 430 {
 431     OPENSSL_free(group->seed);
 432     group->seed = NULL;
 433     group->seed_len = 0;
 434
 435     if (!len || !p)
 436         return 1;
 437
 438     if ((group->seed = OPENSSL_malloc(len)) == NULL)
 439         return 0;
 440     memcpy(group->seed, p, len);
 441     group->seed_len = len;
 442
 443     return len;
 444 }
 445
 446 unsigned char *EC_GROUP_get0_seed(const EC_GROUP *group)
 447 {
 448     return group->seed;
 449 }
 450
 451 size_t EC_GROUP_get_seed_len(const EC_GROUP *group)
 452 {
 453     return group->seed_len;
 454 }
 455
 456 int EC_GROUP_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
 457                            const BIGNUM *b, BN_CTX *ctx)
 458 {
 459     if (group->meth->group_set_curve == 0) {
 460         ECerr(EC_F_EC_GROUP_SET_CURVE_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 461         return 0;
 462     }
 463     return group->meth->group_set_curve(group, p, a, b, ctx);
 464 }
 465
 466 int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
 467                            BIGNUM *b, BN_CTX *ctx)
 468 {
 469     if (group->meth->group_get_curve == 0) {
 470         ECerr(EC_F_EC_GROUP_GET_CURVE_GFP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 471         return 0;
 472     }
 473     return group->meth->group_get_curve(group, p, a, b, ctx);
 474 }
 475
 476 #ifndef OPENSSL_NO_EC2M
 477 int EC_GROUP_set_curve_GF2m(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
 478                             const BIGNUM *b, BN_CTX *ctx)
 479 {
 480     if (group->meth->group_set_curve == 0) {
 481         ECerr(EC_F_EC_GROUP_SET_CURVE_GF2M,
 482               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 483         return 0;
 484     }
 485     return group->meth->group_set_curve(group, p, a, b, ctx);
 486 }
 487
 488 int EC_GROUP_get_curve_GF2m(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
 489                             BIGNUM *b, BN_CTX *ctx)
 490 {
 491     if (group->meth->group_get_curve == 0) {
 492         ECerr(EC_F_EC_GROUP_GET_CURVE_GF2M,
 493               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 494         return 0;
 495     }
 496     return group->meth->group_get_curve(group, p, a, b, ctx);
 497 }
 498 #endif
 499
 500 int EC_GROUP_get_degree(const EC_GROUP *group)
 501 {
 502     if (group->meth->group_get_degree == 0) {
 503         ECerr(EC_F_EC_GROUP_GET_DEGREE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 504         return 0;
 505     }
 506     return group->meth->group_get_degree(group);
 507 }
 508
 509 int EC_GROUP_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
 510 {
 511     if (group->meth->group_check_discriminant == 0) {
 512         ECerr(EC_F_EC_GROUP_CHECK_DISCRIMINANT,
 513               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 514         return 0;
 515     }
 516     return group->meth->group_check_discriminant(group, ctx);
 517 }
 518
 519 int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx)
 520 {
 521     int r = 0;
 522     BIGNUM *a1, *a2, *a3, *b1, *b2, *b3;
 523     BN_CTX *ctx_new = NULL;
 524
 525     /* compare the field types */
 526     if (EC_METHOD_get_field_type(EC_GROUP_method_of(a)) !=
 527         EC_METHOD_get_field_type(EC_GROUP_method_of(b)))
 528         return 1;
 529     /* compare the curve name (if present in both) */
 530     if (EC_GROUP_get_curve_name(a) && EC_GROUP_get_curve_name(b) &&
 531         EC_GROUP_get_curve_name(a) != EC_GROUP_get_curve_name(b))
 532         return 1;
 533     if (a->meth->flags & EC_FLAGS_CUSTOM_CURVE)
 534         return 0;
 535
 536     if (ctx == NULL)
 537         ctx_new = ctx = BN_CTX_new();
 538     if (ctx == NULL)
 539         return -1;
 540
 541     BN_CTX_start(ctx);
 542     a1 = BN_CTX_get(ctx);
 543     a2 = BN_CTX_get(ctx);
 544     a3 = BN_CTX_get(ctx);
 545     b1 = BN_CTX_get(ctx);
 546     b2 = BN_CTX_get(ctx);
 547     b3 = BN_CTX_get(ctx);
 548     if (b3 == NULL) {
 549         BN_CTX_end(ctx);
 550         BN_CTX_free(ctx_new);
 551         return -1;
 552     }
 553
 554     /*
 555      * XXX This approach assumes that the external representation of curves
 556      * over the same field type is the same.
 557      */
 558     if (!a->meth->group_get_curve(a, a1, a2, a3, ctx) ||
 559         !b->meth->group_get_curve(b, b1, b2, b3, ctx))
 560         r = 1;
 561
 562     if (r || BN_cmp(a1, b1) || BN_cmp(a2, b2) || BN_cmp(a3, b3))
 563         r = 1;
 564
 565     /* XXX EC_POINT_cmp() assumes that the methods are equal */
 566     if (r || EC_POINT_cmp(a, EC_GROUP_get0_generator(a),
 567                           EC_GROUP_get0_generator(b), ctx))
 568         r = 1;
 569
 570     if (!r) {
 571         const BIGNUM *ao, *bo, *ac, *bc;
 572         /* compare the order and cofactor */
 573         ao = EC_GROUP_get0_order(a);
 574         bo = EC_GROUP_get0_order(b);
 575         ac = EC_GROUP_get0_cofactor(a);
 576         bc = EC_GROUP_get0_cofactor(b);
 577         if (ao == NULL || bo == NULL) {
 578             BN_CTX_end(ctx);
 579             BN_CTX_free(ctx_new);
 580             return -1;
 581         }
 582         if (BN_cmp(ao, bo) || BN_cmp(ac, bc))
 583             r = 1;
 584     }
 585
 586     BN_CTX_end(ctx);
 587     BN_CTX_free(ctx_new);
 588
 589     return r;
 590 }
 591
 592 /* functions for EC_POINT objects */
 593
 594 EC_POINT *EC_POINT_new(const EC_GROUP *group)
 595 {
 596     EC_POINT *ret;
 597
 598     if (group == NULL) {
 599         ECerr(EC_F_EC_POINT_NEW, ERR_R_PASSED_NULL_PARAMETER);
 600         return NULL;
 601     }
 602     if (group->meth->point_init == 0) {
 603         ECerr(EC_F_EC_POINT_NEW, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 604         return NULL;
 605     }
 606
 607     ret = OPENSSL_zalloc(sizeof(*ret));
 608     if (ret == NULL) {
 609         ECerr(EC_F_EC_POINT_NEW, ERR_R_MALLOC_FAILURE);
 610         return NULL;
 611     }
 612
 613     ret->meth = group->meth;
 614
 615     if (!ret->meth->point_init(ret)) {
 616         OPENSSL_free(ret);
 617         return NULL;
 618     }
 619
 620     return ret;
 621 }
 622
 623 void EC_POINT_free(EC_POINT *point)
 624 {
 625     if (!point)
 626         return;
 627
 628     if (point->meth->point_finish != 0)
 629         point->meth->point_finish(point);
 630     OPENSSL_free(point);
 631 }
 632
 633 void EC_POINT_clear_free(EC_POINT *point)
 634 {
 635     if (!point)
 636         return;
 637
 638     if (point->meth->point_clear_finish != 0)
 639         point->meth->point_clear_finish(point);
 640     else if (point->meth->point_finish != 0)
 641         point->meth->point_finish(point);
 642     OPENSSL_clear_free(point, sizeof(*point));
 643 }
 644
 645 int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src)
 646 {
 647     if (dest->meth->point_copy == 0) {
 648         ECerr(EC_F_EC_POINT_COPY, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 649         return 0;
 650     }
 651     if (dest->meth != src->meth) {
 652         ECerr(EC_F_EC_POINT_COPY, EC_R_INCOMPATIBLE_OBJECTS);
 653         return 0;
 654     }
 655     if (dest == src)
 656         return 1;
 657     return dest->meth->point_copy(dest, src);
 658 }
 659
 660 EC_POINT *EC_POINT_dup(const EC_POINT *a, const EC_GROUP *group)
 661 {
 662     EC_POINT *t;
 663     int r;
 664
 665     if (a == NULL)
 666         return NULL;
 667
 668     t = EC_POINT_new(group);
 669     if (t == NULL)
 670         return (NULL);
 671     r = EC_POINT_copy(t, a);
 672     if (!r) {
 673         EC_POINT_free(t);
 674         return NULL;
 675     }
 676     return t;
 677 }
 678
 679 const EC_METHOD *EC_POINT_method_of(const EC_POINT *point)
 680 {
 681     return point->meth;
 682 }
 683
 684 int EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point)
 685 {
 686     if (group->meth->point_set_to_infinity == 0) {
 687         ECerr(EC_F_EC_POINT_SET_TO_INFINITY,
 688               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 689         return 0;
 690     }
 691     if (group->meth != point->meth) {
 692         ECerr(EC_F_EC_POINT_SET_TO_INFINITY, EC_R_INCOMPATIBLE_OBJECTS);
 693         return 0;
 694     }
 695     return group->meth->point_set_to_infinity(group, point);
 696 }
 697
 698 int EC_POINT_set_Jprojective_coordinates_GFp(const EC_GROUP *group,
 699                                              EC_POINT *point, const BIGNUM *x,
 700                                              const BIGNUM *y, const BIGNUM *z,
 701                                              BN_CTX *ctx)
 702 {
 703     if (group->meth->point_set_Jprojective_coordinates_GFp == 0) {
 704         ECerr(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP,
 705               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 706         return 0;
 707     }
 708     if (group->meth != point->meth) {
 709         ECerr(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP,
 710               EC_R_INCOMPATIBLE_OBJECTS);
 711         return 0;
 712     }
 713     return group->meth->point_set_Jprojective_coordinates_GFp(group, point, x,
 714                                                               y, z, ctx);
 715 }
 716
 717 int EC_POINT_get_Jprojective_coordinates_GFp(const EC_GROUP *group,
 718                                              const EC_POINT *point, BIGNUM *x,
 719                                              BIGNUM *y, BIGNUM *z,
 720                                              BN_CTX *ctx)
 721 {
 722     if (group->meth->point_get_Jprojective_coordinates_GFp == 0) {
 723         ECerr(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP,
 724               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 725         return 0;
 726     }
 727     if (group->meth != point->meth) {
 728         ECerr(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP,
 729               EC_R_INCOMPATIBLE_OBJECTS);
 730         return 0;
 731     }
 732     return group->meth->point_get_Jprojective_coordinates_GFp(group, point, x,
 733                                                               y, z, ctx);
 734 }
 735
 736 int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group,
 737                                         EC_POINT *point, const BIGNUM *x,
 738                                         const BIGNUM *y, BN_CTX *ctx)
 739 {
 740     if (group->meth->point_set_affine_coordinates == 0) {
 741         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP,
 742               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 743         return 0;
 744     }
 745     if (group->meth != point->meth) {
 746         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GFP,
 747               EC_R_INCOMPATIBLE_OBJECTS);
 748         return 0;
 749     }
 750     return group->meth->point_set_affine_coordinates(group, point, x, y, ctx);
 751 }
 752
 753 #ifndef OPENSSL_NO_EC2M
 754 int EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP *group,
 755                                          EC_POINT *point, const BIGNUM *x,
 756                                          const BIGNUM *y, BN_CTX *ctx)
 757 {
 758     if (group->meth->point_set_affine_coordinates == 0) {
 759         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M,
 760               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 761         return 0;
 762     }
 763     if (group->meth != point->meth) {
 764         ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES_GF2M,
 765               EC_R_INCOMPATIBLE_OBJECTS);
 766         return 0;
 767     }
 768     return group->meth->point_set_affine_coordinates(group, point, x, y, ctx);
 769 }
 770 #endif
 771
 772 int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group,
 773                                         const EC_POINT *point, BIGNUM *x,
 774                                         BIGNUM *y, BN_CTX *ctx)
 775 {
 776     if (group->meth->point_get_affine_coordinates == 0) {
 777         ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP,
 778               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 779         return 0;
 780     }
 781     if (group->meth != point->meth) {
 782         ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GFP,
 783               EC_R_INCOMPATIBLE_OBJECTS);
 784         return 0;
 785     }
 786     return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
 787 }
 788
 789 #ifndef OPENSSL_NO_EC2M
 790 int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *group,
 791                                          const EC_POINT *point, BIGNUM *x,
 792                                          BIGNUM *y, BN_CTX *ctx)
 793 {
 794     if (group->meth->point_get_affine_coordinates == 0) {
 795         ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M,
 796               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 797         return 0;
 798     }
 799     if (group->meth != point->meth) {
 800         ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES_GF2M,
 801               EC_R_INCOMPATIBLE_OBJECTS);
 802         return 0;
 803     }
 804     return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
 805 }
 806 #endif
 807
 808 int EC_POINT_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
 809                  const EC_POINT *b, BN_CTX *ctx)
 810 {
 811     if (group->meth->add == 0) {
 812         ECerr(EC_F_EC_POINT_ADD, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 813         return 0;
 814     }
 815     if ((group->meth != r->meth) || (r->meth != a->meth)
 816         || (a->meth != b->meth)) {
 817         ECerr(EC_F_EC_POINT_ADD, EC_R_INCOMPATIBLE_OBJECTS);
 818         return 0;
 819     }
 820     return group->meth->add(group, r, a, b, ctx);
 821 }
 822
 823 int EC_POINT_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
 824                  BN_CTX *ctx)
 825 {
 826     if (group->meth->dbl == 0) {
 827         ECerr(EC_F_EC_POINT_DBL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 828         return 0;
 829     }
 830     if ((group->meth != r->meth) || (r->meth != a->meth)) {
 831         ECerr(EC_F_EC_POINT_DBL, EC_R_INCOMPATIBLE_OBJECTS);
 832         return 0;
 833     }
 834     return group->meth->dbl(group, r, a, ctx);
 835 }
 836
 837 int EC_POINT_invert(const EC_GROUP *group, EC_POINT *a, BN_CTX *ctx)
 838 {
 839     if (group->meth->invert == 0) {
 840         ECerr(EC_F_EC_POINT_INVERT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 841         return 0;
 842     }
 843     if (group->meth != a->meth) {
 844         ECerr(EC_F_EC_POINT_INVERT, EC_R_INCOMPATIBLE_OBJECTS);
 845         return 0;
 846     }
 847     return group->meth->invert(group, a, ctx);
 848 }
 849
 850 int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
 851 {
 852     if (group->meth->is_at_infinity == 0) {
 853         ECerr(EC_F_EC_POINT_IS_AT_INFINITY,
 854               ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 855         return 0;
 856     }
 857     if (group->meth != point->meth) {
 858         ECerr(EC_F_EC_POINT_IS_AT_INFINITY, EC_R_INCOMPATIBLE_OBJECTS);
 859         return 0;
 860     }
 861     return group->meth->is_at_infinity(group, point);
 862 }
 863
 864 /*
 865  * Check whether an EC_POINT is on the curve or not. Note that the return
 866  * value for this function should NOT be treated as a boolean. Return values:
 867  *  1: The point is on the curve
 868  *  0: The point is not on the curve
 869  * -1: An error occurred
 870  */
 871 int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
 872                          BN_CTX *ctx)
 873 {
 874     if (group->meth->is_on_curve == 0) {
 875         ECerr(EC_F_EC_POINT_IS_ON_CURVE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 876         return 0;
 877     }
 878     if (group->meth != point->meth) {
 879         ECerr(EC_F_EC_POINT_IS_ON_CURVE, EC_R_INCOMPATIBLE_OBJECTS);
 880         return 0;
 881     }
 882     return group->meth->is_on_curve(group, point, ctx);
 883 }
 884
 885 int EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b,
 886                  BN_CTX *ctx)
 887 {
 888     if (group->meth->point_cmp == 0) {
 889         ECerr(EC_F_EC_POINT_CMP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 890         return -1;
 891     }
 892     if ((group->meth != a->meth) || (a->meth != b->meth)) {
 893         ECerr(EC_F_EC_POINT_CMP, EC_R_INCOMPATIBLE_OBJECTS);
 894         return -1;
 895     }
 896     return group->meth->point_cmp(group, a, b, ctx);
 897 }
 898
 899 int EC_POINT_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx)
 900 {
 901     if (group->meth->make_affine == 0) {
 902         ECerr(EC_F_EC_POINT_MAKE_AFFINE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 903         return 0;
 904     }
 905     if (group->meth != point->meth) {
 906         ECerr(EC_F_EC_POINT_MAKE_AFFINE, EC_R_INCOMPATIBLE_OBJECTS);
 907         return 0;
 908     }
 909     return group->meth->make_affine(group, point, ctx);
 910 }
 911
 912 int EC_POINTs_make_affine(const EC_GROUP *group, size_t num,
 913                           EC_POINT *points[], BN_CTX *ctx)
 914 {
 915     size_t i;
 916
 917     if (group->meth->points_make_affine == 0) {
 918         ECerr(EC_F_EC_POINTS_MAKE_AFFINE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 919         return 0;
 920     }
 921     for (i = 0; i < num; i++) {
 922         if (group->meth != points[i]->meth) {
 923             ECerr(EC_F_EC_POINTS_MAKE_AFFINE, EC_R_INCOMPATIBLE_OBJECTS);
 924             return 0;
 925         }
 926     }
 927     return group->meth->points_make_affine(group, num, points, ctx);
 928 }
 929
 930 /*
 931  * Functions for point multiplication. If group->meth->mul is 0, we use the
 932  * wNAF-based implementations in ec_mult.c; otherwise we dispatch through
 933  * methods.
 934  */
 935
 936 int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
 937                   size_t num, const EC_POINT *points[],
 938                   const BIGNUM *scalars[], BN_CTX *ctx)
 939 {
 940     if (group->meth->mul == 0)
 941         /* use default */
 942         return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
 943
 944     return group->meth->mul(group, r, scalar, num, points, scalars, ctx);
 945 }
 946
 947 int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
 948                  const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
 949 {
 950     /* just a convenient interface to EC_POINTs_mul() */
 951
 952     const EC_POINT *points[1];
 953     const BIGNUM *scalars[1];
 954
 955     points[0] = point;
 956     scalars[0] = p_scalar;
 957
 958     return EC_POINTs_mul(group, r, g_scalar,
 959                          (point != NULL
 960                           && p_scalar != NULL), points, scalars, ctx);
 961 }
 962
 963 int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
 964 {
 965     if (group->meth->mul == 0)
 966         /* use default */
 967         return ec_wNAF_precompute_mult(group, ctx);
 968
 969     if (group->meth->precompute_mult != 0)
 970         return group->meth->precompute_mult(group, ctx);
 971     else
 972         return 1;               /* nothing to do, so report success */
 973 }
 974
 975 int EC_GROUP_have_precompute_mult(const EC_GROUP *group)
 976 {
 977     if (group->meth->mul == 0)
 978         /* use default */
 979         return ec_wNAF_have_precompute_mult(group);
 980
 981     if (group->meth->have_precompute_mult != 0)
 982         return group->meth->have_precompute_mult(group);
 983     else
 984         return 0;               /* cannot tell whether precomputation has
 985                                  * been performed */
 986 }
 987
 988 /*
 989  * ec_precompute_mont_data sets |group->mont_data| from |group->order| and
 990  * returns one on success. On error it returns zero.
 991  */
 992 int ec_precompute_mont_data(EC_GROUP *group)
 993 {
 994     BN_CTX *ctx = BN_CTX_new();
 995     int ret = 0;
 996
 997     BN_MONT_CTX_free(group->mont_data);
 998     group->mont_data = NULL;
 999
1000     if (ctx == NULL)
1001         goto err;
1002
1003     group->mont_data = BN_MONT_CTX_new();
1004     if (group->mont_data == NULL)
1005         goto err;
1006
1007     if (!BN_MONT_CTX_set(group->mont_data, group->order, ctx)) {
1008         BN_MONT_CTX_free(group->mont_data);
1009         group->mont_data = NULL;
1010         goto err;
1011     }
1012
1013     ret = 1;
1014
1015  err:
1016
1017     BN_CTX_free(ctx);
1018     return ret;
1019 }
1020
1021 int EC_KEY_set_ex_data(EC_KEY *key, int idx, void *arg)
1022 {
1023     return CRYPTO_set_ex_data(&key->ex_data, idx, arg);
1024 }
1025
1026 void *EC_KEY_get_ex_data(const EC_KEY *key, int idx)
1027 {
1028     return CRYPTO_get_ex_data(&key->ex_data, idx);
1029 }
1030
1031 int ec_group_simple_order_bits(const EC_GROUP *group)
1032 {
1033     if (group->order == NULL)
1034         return 0;
1035     return BN_num_bits(group->order);
1036 }