2 * Copyright 2001-2019 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
5 * Licensed under the OpenSSL license (the "License"). You may not use
6 * this file except in compliance with the License. You can obtain a copy
7 * in the file LICENSE in the source distribution or at
8 * https://www.openssl.org/source/license.html
11 #include <openssl/err.h>
12 #include <openssl/symhacks.h>
16 const EC_METHOD
*EC_GFp_simple_method(void)
18 static const EC_METHOD ret
= {
20 NID_X9_62_prime_field
,
21 ec_GFp_simple_group_init
,
22 ec_GFp_simple_group_finish
,
23 ec_GFp_simple_group_clear_finish
,
24 ec_GFp_simple_group_copy
,
25 ec_GFp_simple_group_set_curve
,
26 ec_GFp_simple_group_get_curve
,
27 ec_GFp_simple_group_get_degree
,
28 ec_group_simple_order_bits
,
29 ec_GFp_simple_group_check_discriminant
,
30 ec_GFp_simple_point_init
,
31 ec_GFp_simple_point_finish
,
32 ec_GFp_simple_point_clear_finish
,
33 ec_GFp_simple_point_copy
,
34 ec_GFp_simple_point_set_to_infinity
,
35 ec_GFp_simple_set_Jprojective_coordinates_GFp
,
36 ec_GFp_simple_get_Jprojective_coordinates_GFp
,
37 ec_GFp_simple_point_set_affine_coordinates
,
38 ec_GFp_simple_point_get_affine_coordinates
,
43 ec_GFp_simple_is_at_infinity
,
44 ec_GFp_simple_is_on_curve
,
46 ec_GFp_simple_make_affine
,
47 ec_GFp_simple_points_make_affine
,
49 0 /* precompute_mult */ ,
50 0 /* have_precompute_mult */ ,
51 ec_GFp_simple_field_mul
,
52 ec_GFp_simple_field_sqr
,
54 ec_GFp_simple_field_inv
,
55 0 /* field_encode */ ,
56 0 /* field_decode */ ,
57 0, /* field_set_to_one */
58 ec_key_simple_priv2oct
,
59 ec_key_simple_oct2priv
,
61 ec_key_simple_generate_key
,
62 ec_key_simple_check_key
,
63 ec_key_simple_generate_public_key
,
66 ecdh_simple_compute_key
,
67 0, /* field_inverse_mod_ord */
68 ec_GFp_simple_blind_coordinates
,
69 ec_GFp_simple_ladder_pre
,
70 ec_GFp_simple_ladder_step
,
71 ec_GFp_simple_ladder_post
78 * Most method functions in this file are designed to work with
79 * non-trivial representations of field elements if necessary
80 * (see ecp_mont.c): while standard modular addition and subtraction
81 * are used, the field_mul and field_sqr methods will be used for
82 * multiplication, and field_encode and field_decode (if defined)
83 * will be used for converting between representations.
85 * Functions ec_GFp_simple_points_make_affine() and
86 * ec_GFp_simple_point_get_affine_coordinates() specifically assume
87 * that if a non-trivial representation is used, it is a Montgomery
88 * representation (i.e. 'encoding' means multiplying by some factor R).
91 int ec_GFp_simple_group_init(EC_GROUP
*group
)
93 group
->field
= BN_new();
96 if (group
->field
== NULL
|| group
->a
== NULL
|| group
->b
== NULL
) {
97 BN_free(group
->field
);
102 group
->a_is_minus3
= 0;
106 void ec_GFp_simple_group_finish(EC_GROUP
*group
)
108 BN_free(group
->field
);
113 void ec_GFp_simple_group_clear_finish(EC_GROUP
*group
)
115 BN_clear_free(group
->field
);
116 BN_clear_free(group
->a
);
117 BN_clear_free(group
->b
);
120 int ec_GFp_simple_group_copy(EC_GROUP
*dest
, const EC_GROUP
*src
)
122 if (!BN_copy(dest
->field
, src
->field
))
124 if (!BN_copy(dest
->a
, src
->a
))
126 if (!BN_copy(dest
->b
, src
->b
))
129 dest
->a_is_minus3
= src
->a_is_minus3
;
134 int ec_GFp_simple_group_set_curve(EC_GROUP
*group
,
135 const BIGNUM
*p
, const BIGNUM
*a
,
136 const BIGNUM
*b
, BN_CTX
*ctx
)
139 BN_CTX
*new_ctx
= NULL
;
142 /* p must be a prime > 3 */
143 if (BN_num_bits(p
) <= 2 || !BN_is_odd(p
)) {
144 ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE
, EC_R_INVALID_FIELD
);
149 ctx
= new_ctx
= BN_CTX_new();
155 tmp_a
= BN_CTX_get(ctx
);
160 if (!BN_copy(group
->field
, p
))
162 BN_set_negative(group
->field
, 0);
165 if (!BN_nnmod(tmp_a
, a
, p
, ctx
))
167 if (group
->meth
->field_encode
) {
168 if (!group
->meth
->field_encode(group
, group
->a
, tmp_a
, ctx
))
170 } else if (!BN_copy(group
->a
, tmp_a
))
174 if (!BN_nnmod(group
->b
, b
, p
, ctx
))
176 if (group
->meth
->field_encode
)
177 if (!group
->meth
->field_encode(group
, group
->b
, group
->b
, ctx
))
180 /* group->a_is_minus3 */
181 if (!BN_add_word(tmp_a
, 3))
183 group
->a_is_minus3
= (0 == BN_cmp(tmp_a
, group
->field
));
189 BN_CTX_free(new_ctx
);
193 int ec_GFp_simple_group_get_curve(const EC_GROUP
*group
, BIGNUM
*p
, BIGNUM
*a
,
194 BIGNUM
*b
, BN_CTX
*ctx
)
197 BN_CTX
*new_ctx
= NULL
;
200 if (!BN_copy(p
, group
->field
))
204 if (a
!= NULL
|| b
!= NULL
) {
205 if (group
->meth
->field_decode
) {
207 ctx
= new_ctx
= BN_CTX_new();
212 if (!group
->meth
->field_decode(group
, a
, group
->a
, ctx
))
216 if (!group
->meth
->field_decode(group
, b
, group
->b
, ctx
))
221 if (!BN_copy(a
, group
->a
))
225 if (!BN_copy(b
, group
->b
))
234 BN_CTX_free(new_ctx
);
238 int ec_GFp_simple_group_get_degree(const EC_GROUP
*group
)
240 return BN_num_bits(group
->field
);
243 int ec_GFp_simple_group_check_discriminant(const EC_GROUP
*group
, BN_CTX
*ctx
)
246 BIGNUM
*a
, *b
, *order
, *tmp_1
, *tmp_2
;
247 const BIGNUM
*p
= group
->field
;
248 BN_CTX
*new_ctx
= NULL
;
251 ctx
= new_ctx
= BN_CTX_new();
253 ECerr(EC_F_EC_GFP_SIMPLE_GROUP_CHECK_DISCRIMINANT
,
254 ERR_R_MALLOC_FAILURE
);
261 tmp_1
= BN_CTX_get(ctx
);
262 tmp_2
= BN_CTX_get(ctx
);
263 order
= BN_CTX_get(ctx
);
267 if (group
->meth
->field_decode
) {
268 if (!group
->meth
->field_decode(group
, a
, group
->a
, ctx
))
270 if (!group
->meth
->field_decode(group
, b
, group
->b
, ctx
))
273 if (!BN_copy(a
, group
->a
))
275 if (!BN_copy(b
, group
->b
))
280 * check the discriminant:
281 * y^2 = x^3 + a*x + b is an elliptic curve <=> 4*a^3 + 27*b^2 != 0 (mod p)
287 } else if (!BN_is_zero(b
)) {
288 if (!BN_mod_sqr(tmp_1
, a
, p
, ctx
))
290 if (!BN_mod_mul(tmp_2
, tmp_1
, a
, p
, ctx
))
292 if (!BN_lshift(tmp_1
, tmp_2
, 2))
296 if (!BN_mod_sqr(tmp_2
, b
, p
, ctx
))
298 if (!BN_mul_word(tmp_2
, 27))
302 if (!BN_mod_add(a
, tmp_1
, tmp_2
, p
, ctx
))
311 BN_CTX_free(new_ctx
);
315 int ec_GFp_simple_point_init(EC_POINT
*point
)
322 if (point
->X
== NULL
|| point
->Y
== NULL
|| point
->Z
== NULL
) {
331 void ec_GFp_simple_point_finish(EC_POINT
*point
)
338 void ec_GFp_simple_point_clear_finish(EC_POINT
*point
)
340 BN_clear_free(point
->X
);
341 BN_clear_free(point
->Y
);
342 BN_clear_free(point
->Z
);
346 int ec_GFp_simple_point_copy(EC_POINT
*dest
, const EC_POINT
*src
)
348 if (!BN_copy(dest
->X
, src
->X
))
350 if (!BN_copy(dest
->Y
, src
->Y
))
352 if (!BN_copy(dest
->Z
, src
->Z
))
354 dest
->Z_is_one
= src
->Z_is_one
;
355 dest
->curve_name
= src
->curve_name
;
360 int ec_GFp_simple_point_set_to_infinity(const EC_GROUP
*group
,
368 int ec_GFp_simple_set_Jprojective_coordinates_GFp(const EC_GROUP
*group
,
375 BN_CTX
*new_ctx
= NULL
;
379 ctx
= new_ctx
= BN_CTX_new();
385 if (!BN_nnmod(point
->X
, x
, group
->field
, ctx
))
387 if (group
->meth
->field_encode
) {
388 if (!group
->meth
->field_encode(group
, point
->X
, point
->X
, ctx
))
394 if (!BN_nnmod(point
->Y
, y
, group
->field
, ctx
))
396 if (group
->meth
->field_encode
) {
397 if (!group
->meth
->field_encode(group
, point
->Y
, point
->Y
, ctx
))
405 if (!BN_nnmod(point
->Z
, z
, group
->field
, ctx
))
407 Z_is_one
= BN_is_one(point
->Z
);
408 if (group
->meth
->field_encode
) {
409 if (Z_is_one
&& (group
->meth
->field_set_to_one
!= 0)) {
410 if (!group
->meth
->field_set_to_one(group
, point
->Z
, ctx
))
414 meth
->field_encode(group
, point
->Z
, point
->Z
, ctx
))
418 point
->Z_is_one
= Z_is_one
;
424 BN_CTX_free(new_ctx
);
428 int ec_GFp_simple_get_Jprojective_coordinates_GFp(const EC_GROUP
*group
,
429 const EC_POINT
*point
,
430 BIGNUM
*x
, BIGNUM
*y
,
431 BIGNUM
*z
, BN_CTX
*ctx
)
433 BN_CTX
*new_ctx
= NULL
;
436 if (group
->meth
->field_decode
!= 0) {
438 ctx
= new_ctx
= BN_CTX_new();
444 if (!group
->meth
->field_decode(group
, x
, point
->X
, ctx
))
448 if (!group
->meth
->field_decode(group
, y
, point
->Y
, ctx
))
452 if (!group
->meth
->field_decode(group
, z
, point
->Z
, ctx
))
457 if (!BN_copy(x
, point
->X
))
461 if (!BN_copy(y
, point
->Y
))
465 if (!BN_copy(z
, point
->Z
))
473 BN_CTX_free(new_ctx
);
477 int ec_GFp_simple_point_set_affine_coordinates(const EC_GROUP
*group
,
480 const BIGNUM
*y
, BN_CTX
*ctx
)
482 if (x
== NULL
|| y
== NULL
) {
484 * unlike for projective coordinates, we do not tolerate this
486 ECerr(EC_F_EC_GFP_SIMPLE_POINT_SET_AFFINE_COORDINATES
,
487 ERR_R_PASSED_NULL_PARAMETER
);
491 return EC_POINT_set_Jprojective_coordinates_GFp(group
, point
, x
, y
,
492 BN_value_one(), ctx
);
495 int ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP
*group
,
496 const EC_POINT
*point
,
497 BIGNUM
*x
, BIGNUM
*y
,
500 BN_CTX
*new_ctx
= NULL
;
501 BIGNUM
*Z
, *Z_1
, *Z_2
, *Z_3
;
505 if (EC_POINT_is_at_infinity(group
, point
)) {
506 ECerr(EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES
,
507 EC_R_POINT_AT_INFINITY
);
512 ctx
= new_ctx
= BN_CTX_new();
519 Z_1
= BN_CTX_get(ctx
);
520 Z_2
= BN_CTX_get(ctx
);
521 Z_3
= BN_CTX_get(ctx
);
525 /* transform (X, Y, Z) into (x, y) := (X/Z^2, Y/Z^3) */
527 if (group
->meth
->field_decode
) {
528 if (!group
->meth
->field_decode(group
, Z
, point
->Z
, ctx
))
536 if (group
->meth
->field_decode
) {
538 if (!group
->meth
->field_decode(group
, x
, point
->X
, ctx
))
542 if (!group
->meth
->field_decode(group
, y
, point
->Y
, ctx
))
547 if (!BN_copy(x
, point
->X
))
551 if (!BN_copy(y
, point
->Y
))
556 if (!group
->meth
->field_inv(group
, Z_1
, Z_
, ctx
)) {
557 ECerr(EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES
,
562 if (group
->meth
->field_encode
== 0) {
563 /* field_sqr works on standard representation */
564 if (!group
->meth
->field_sqr(group
, Z_2
, Z_1
, ctx
))
567 if (!BN_mod_sqr(Z_2
, Z_1
, group
->field
, ctx
))
573 * in the Montgomery case, field_mul will cancel out Montgomery
576 if (!group
->meth
->field_mul(group
, x
, point
->X
, Z_2
, ctx
))
581 if (group
->meth
->field_encode
== 0) {
583 * field_mul works on standard representation
585 if (!group
->meth
->field_mul(group
, Z_3
, Z_2
, Z_1
, ctx
))
588 if (!BN_mod_mul(Z_3
, Z_2
, Z_1
, group
->field
, ctx
))
593 * in the Montgomery case, field_mul will cancel out Montgomery
596 if (!group
->meth
->field_mul(group
, y
, point
->Y
, Z_3
, ctx
))
605 BN_CTX_free(new_ctx
);
609 int ec_GFp_simple_add(const EC_GROUP
*group
, EC_POINT
*r
, const EC_POINT
*a
,
610 const EC_POINT
*b
, BN_CTX
*ctx
)
612 int (*field_mul
) (const EC_GROUP
*, BIGNUM
*, const BIGNUM
*,
613 const BIGNUM
*, BN_CTX
*);
614 int (*field_sqr
) (const EC_GROUP
*, BIGNUM
*, const BIGNUM
*, BN_CTX
*);
616 BN_CTX
*new_ctx
= NULL
;
617 BIGNUM
*n0
, *n1
, *n2
, *n3
, *n4
, *n5
, *n6
;
621 return EC_POINT_dbl(group
, r
, a
, ctx
);
622 if (EC_POINT_is_at_infinity(group
, a
))
623 return EC_POINT_copy(r
, b
);
624 if (EC_POINT_is_at_infinity(group
, b
))
625 return EC_POINT_copy(r
, a
);
627 field_mul
= group
->meth
->field_mul
;
628 field_sqr
= group
->meth
->field_sqr
;
632 ctx
= new_ctx
= BN_CTX_new();
638 n0
= BN_CTX_get(ctx
);
639 n1
= BN_CTX_get(ctx
);
640 n2
= BN_CTX_get(ctx
);
641 n3
= BN_CTX_get(ctx
);
642 n4
= BN_CTX_get(ctx
);
643 n5
= BN_CTX_get(ctx
);
644 n6
= BN_CTX_get(ctx
);
649 * Note that in this function we must not read components of 'a' or 'b'
650 * once we have written the corresponding components of 'r'. ('r' might
651 * be one of 'a' or 'b'.)
656 if (!BN_copy(n1
, a
->X
))
658 if (!BN_copy(n2
, a
->Y
))
663 if (!field_sqr(group
, n0
, b
->Z
, ctx
))
665 if (!field_mul(group
, n1
, a
->X
, n0
, ctx
))
667 /* n1 = X_a * Z_b^2 */
669 if (!field_mul(group
, n0
, n0
, b
->Z
, ctx
))
671 if (!field_mul(group
, n2
, a
->Y
, n0
, ctx
))
673 /* n2 = Y_a * Z_b^3 */
678 if (!BN_copy(n3
, b
->X
))
680 if (!BN_copy(n4
, b
->Y
))
685 if (!field_sqr(group
, n0
, a
->Z
, ctx
))
687 if (!field_mul(group
, n3
, b
->X
, n0
, ctx
))
689 /* n3 = X_b * Z_a^2 */
691 if (!field_mul(group
, n0
, n0
, a
->Z
, ctx
))
693 if (!field_mul(group
, n4
, b
->Y
, n0
, ctx
))
695 /* n4 = Y_b * Z_a^3 */
699 if (!BN_mod_sub_quick(n5
, n1
, n3
, p
))
701 if (!BN_mod_sub_quick(n6
, n2
, n4
, p
))
706 if (BN_is_zero(n5
)) {
707 if (BN_is_zero(n6
)) {
708 /* a is the same point as b */
710 ret
= EC_POINT_dbl(group
, r
, a
, ctx
);
714 /* a is the inverse of b */
723 if (!BN_mod_add_quick(n1
, n1
, n3
, p
))
725 if (!BN_mod_add_quick(n2
, n2
, n4
, p
))
731 if (a
->Z_is_one
&& b
->Z_is_one
) {
732 if (!BN_copy(r
->Z
, n5
))
736 if (!BN_copy(n0
, b
->Z
))
738 } else if (b
->Z_is_one
) {
739 if (!BN_copy(n0
, a
->Z
))
742 if (!field_mul(group
, n0
, a
->Z
, b
->Z
, ctx
))
745 if (!field_mul(group
, r
->Z
, n0
, n5
, ctx
))
749 /* Z_r = Z_a * Z_b * n5 */
752 if (!field_sqr(group
, n0
, n6
, ctx
))
754 if (!field_sqr(group
, n4
, n5
, ctx
))
756 if (!field_mul(group
, n3
, n1
, n4
, ctx
))
758 if (!BN_mod_sub_quick(r
->X
, n0
, n3
, p
))
760 /* X_r = n6^2 - n5^2 * 'n7' */
763 if (!BN_mod_lshift1_quick(n0
, r
->X
, p
))
765 if (!BN_mod_sub_quick(n0
, n3
, n0
, p
))
767 /* n9 = n5^2 * 'n7' - 2 * X_r */
770 if (!field_mul(group
, n0
, n0
, n6
, ctx
))
772 if (!field_mul(group
, n5
, n4
, n5
, ctx
))
773 goto end
; /* now n5 is n5^3 */
774 if (!field_mul(group
, n1
, n2
, n5
, ctx
))
776 if (!BN_mod_sub_quick(n0
, n0
, n1
, p
))
779 if (!BN_add(n0
, n0
, p
))
781 /* now 0 <= n0 < 2*p, and n0 is even */
782 if (!BN_rshift1(r
->Y
, n0
))
784 /* Y_r = (n6 * 'n9' - 'n8' * 'n5^3') / 2 */
790 BN_CTX_free(new_ctx
);
794 int ec_GFp_simple_dbl(const EC_GROUP
*group
, EC_POINT
*r
, const EC_POINT
*a
,
797 int (*field_mul
) (const EC_GROUP
*, BIGNUM
*, const BIGNUM
*,
798 const BIGNUM
*, BN_CTX
*);
799 int (*field_sqr
) (const EC_GROUP
*, BIGNUM
*, const BIGNUM
*, BN_CTX
*);
801 BN_CTX
*new_ctx
= NULL
;
802 BIGNUM
*n0
, *n1
, *n2
, *n3
;
805 if (EC_POINT_is_at_infinity(group
, a
)) {
811 field_mul
= group
->meth
->field_mul
;
812 field_sqr
= group
->meth
->field_sqr
;
816 ctx
= new_ctx
= BN_CTX_new();
822 n0
= BN_CTX_get(ctx
);
823 n1
= BN_CTX_get(ctx
);
824 n2
= BN_CTX_get(ctx
);
825 n3
= BN_CTX_get(ctx
);
830 * Note that in this function we must not read components of 'a' once we
831 * have written the corresponding components of 'r'. ('r' might the same
837 if (!field_sqr(group
, n0
, a
->X
, ctx
))
839 if (!BN_mod_lshift1_quick(n1
, n0
, p
))
841 if (!BN_mod_add_quick(n0
, n0
, n1
, p
))
843 if (!BN_mod_add_quick(n1
, n0
, group
->a
, p
))
845 /* n1 = 3 * X_a^2 + a_curve */
846 } else if (group
->a_is_minus3
) {
847 if (!field_sqr(group
, n1
, a
->Z
, ctx
))
849 if (!BN_mod_add_quick(n0
, a
->X
, n1
, p
))
851 if (!BN_mod_sub_quick(n2
, a
->X
, n1
, p
))
853 if (!field_mul(group
, n1
, n0
, n2
, ctx
))
855 if (!BN_mod_lshift1_quick(n0
, n1
, p
))
857 if (!BN_mod_add_quick(n1
, n0
, n1
, p
))
860 * n1 = 3 * (X_a + Z_a^2) * (X_a - Z_a^2)
861 * = 3 * X_a^2 - 3 * Z_a^4
864 if (!field_sqr(group
, n0
, a
->X
, ctx
))
866 if (!BN_mod_lshift1_quick(n1
, n0
, p
))
868 if (!BN_mod_add_quick(n0
, n0
, n1
, p
))
870 if (!field_sqr(group
, n1
, a
->Z
, ctx
))
872 if (!field_sqr(group
, n1
, n1
, ctx
))
874 if (!field_mul(group
, n1
, n1
, group
->a
, ctx
))
876 if (!BN_mod_add_quick(n1
, n1
, n0
, p
))
878 /* n1 = 3 * X_a^2 + a_curve * Z_a^4 */
883 if (!BN_copy(n0
, a
->Y
))
886 if (!field_mul(group
, n0
, a
->Y
, a
->Z
, ctx
))
889 if (!BN_mod_lshift1_quick(r
->Z
, n0
, p
))
892 /* Z_r = 2 * Y_a * Z_a */
895 if (!field_sqr(group
, n3
, a
->Y
, ctx
))
897 if (!field_mul(group
, n2
, a
->X
, n3
, ctx
))
899 if (!BN_mod_lshift_quick(n2
, n2
, 2, p
))
901 /* n2 = 4 * X_a * Y_a^2 */
904 if (!BN_mod_lshift1_quick(n0
, n2
, p
))
906 if (!field_sqr(group
, r
->X
, n1
, ctx
))
908 if (!BN_mod_sub_quick(r
->X
, r
->X
, n0
, p
))
910 /* X_r = n1^2 - 2 * n2 */
913 if (!field_sqr(group
, n0
, n3
, ctx
))
915 if (!BN_mod_lshift_quick(n3
, n0
, 3, p
))
920 if (!BN_mod_sub_quick(n0
, n2
, r
->X
, p
))
922 if (!field_mul(group
, n0
, n1
, n0
, ctx
))
924 if (!BN_mod_sub_quick(r
->Y
, n0
, n3
, p
))
926 /* Y_r = n1 * (n2 - X_r) - n3 */
932 BN_CTX_free(new_ctx
);
936 int ec_GFp_simple_invert(const EC_GROUP
*group
, EC_POINT
*point
, BN_CTX
*ctx
)
938 if (EC_POINT_is_at_infinity(group
, point
) || BN_is_zero(point
->Y
))
939 /* point is its own inverse */
942 return BN_usub(point
->Y
, group
->field
, point
->Y
);
945 int ec_GFp_simple_is_at_infinity(const EC_GROUP
*group
, const EC_POINT
*point
)
947 return BN_is_zero(point
->Z
);
950 int ec_GFp_simple_is_on_curve(const EC_GROUP
*group
, const EC_POINT
*point
,
953 int (*field_mul
) (const EC_GROUP
*, BIGNUM
*, const BIGNUM
*,
954 const BIGNUM
*, BN_CTX
*);
955 int (*field_sqr
) (const EC_GROUP
*, BIGNUM
*, const BIGNUM
*, BN_CTX
*);
957 BN_CTX
*new_ctx
= NULL
;
958 BIGNUM
*rh
, *tmp
, *Z4
, *Z6
;
961 if (EC_POINT_is_at_infinity(group
, point
))
964 field_mul
= group
->meth
->field_mul
;
965 field_sqr
= group
->meth
->field_sqr
;
969 ctx
= new_ctx
= BN_CTX_new();
975 rh
= BN_CTX_get(ctx
);
976 tmp
= BN_CTX_get(ctx
);
977 Z4
= BN_CTX_get(ctx
);
978 Z6
= BN_CTX_get(ctx
);
983 * We have a curve defined by a Weierstrass equation
984 * y^2 = x^3 + a*x + b.
985 * The point to consider is given in Jacobian projective coordinates
986 * where (X, Y, Z) represents (x, y) = (X/Z^2, Y/Z^3).
987 * Substituting this and multiplying by Z^6 transforms the above equation into
988 * Y^2 = X^3 + a*X*Z^4 + b*Z^6.
989 * To test this, we add up the right-hand side in 'rh'.
993 if (!field_sqr(group
, rh
, point
->X
, ctx
))
996 if (!point
->Z_is_one
) {
997 if (!field_sqr(group
, tmp
, point
->Z
, ctx
))
999 if (!field_sqr(group
, Z4
, tmp
, ctx
))
1001 if (!field_mul(group
, Z6
, Z4
, tmp
, ctx
))
1004 /* rh := (rh + a*Z^4)*X */
1005 if (group
->a_is_minus3
) {
1006 if (!BN_mod_lshift1_quick(tmp
, Z4
, p
))
1008 if (!BN_mod_add_quick(tmp
, tmp
, Z4
, p
))
1010 if (!BN_mod_sub_quick(rh
, rh
, tmp
, p
))
1012 if (!field_mul(group
, rh
, rh
, point
->X
, ctx
))
1015 if (!field_mul(group
, tmp
, Z4
, group
->a
, ctx
))
1017 if (!BN_mod_add_quick(rh
, rh
, tmp
, p
))
1019 if (!field_mul(group
, rh
, rh
, point
->X
, ctx
))
1023 /* rh := rh + b*Z^6 */
1024 if (!field_mul(group
, tmp
, group
->b
, Z6
, ctx
))
1026 if (!BN_mod_add_quick(rh
, rh
, tmp
, p
))
1029 /* point->Z_is_one */
1031 /* rh := (rh + a)*X */
1032 if (!BN_mod_add_quick(rh
, rh
, group
->a
, p
))
1034 if (!field_mul(group
, rh
, rh
, point
->X
, ctx
))
1037 if (!BN_mod_add_quick(rh
, rh
, group
->b
, p
))
1042 if (!field_sqr(group
, tmp
, point
->Y
, ctx
))
1045 ret
= (0 == BN_ucmp(tmp
, rh
));
1049 BN_CTX_free(new_ctx
);
1053 int ec_GFp_simple_cmp(const EC_GROUP
*group
, const EC_POINT
*a
,
1054 const EC_POINT
*b
, BN_CTX
*ctx
)
1059 * 0 equal (in affine coordinates)
1063 int (*field_mul
) (const EC_GROUP
*, BIGNUM
*, const BIGNUM
*,
1064 const BIGNUM
*, BN_CTX
*);
1065 int (*field_sqr
) (const EC_GROUP
*, BIGNUM
*, const BIGNUM
*, BN_CTX
*);
1066 BN_CTX
*new_ctx
= NULL
;
1067 BIGNUM
*tmp1
, *tmp2
, *Za23
, *Zb23
;
1068 const BIGNUM
*tmp1_
, *tmp2_
;
1071 if (EC_POINT_is_at_infinity(group
, a
)) {
1072 return EC_POINT_is_at_infinity(group
, b
) ? 0 : 1;
1075 if (EC_POINT_is_at_infinity(group
, b
))
1078 if (a
->Z_is_one
&& b
->Z_is_one
) {
1079 return ((BN_cmp(a
->X
, b
->X
) == 0) && BN_cmp(a
->Y
, b
->Y
) == 0) ? 0 : 1;
1082 field_mul
= group
->meth
->field_mul
;
1083 field_sqr
= group
->meth
->field_sqr
;
1086 ctx
= new_ctx
= BN_CTX_new();
1092 tmp1
= BN_CTX_get(ctx
);
1093 tmp2
= BN_CTX_get(ctx
);
1094 Za23
= BN_CTX_get(ctx
);
1095 Zb23
= BN_CTX_get(ctx
);
1100 * We have to decide whether
1101 * (X_a/Z_a^2, Y_a/Z_a^3) = (X_b/Z_b^2, Y_b/Z_b^3),
1102 * or equivalently, whether
1103 * (X_a*Z_b^2, Y_a*Z_b^3) = (X_b*Z_a^2, Y_b*Z_a^3).
1107 if (!field_sqr(group
, Zb23
, b
->Z
, ctx
))
1109 if (!field_mul(group
, tmp1
, a
->X
, Zb23
, ctx
))
1115 if (!field_sqr(group
, Za23
, a
->Z
, ctx
))
1117 if (!field_mul(group
, tmp2
, b
->X
, Za23
, ctx
))
1123 /* compare X_a*Z_b^2 with X_b*Z_a^2 */
1124 if (BN_cmp(tmp1_
, tmp2_
) != 0) {
1125 ret
= 1; /* points differ */
1130 if (!field_mul(group
, Zb23
, Zb23
, b
->Z
, ctx
))
1132 if (!field_mul(group
, tmp1
, a
->Y
, Zb23
, ctx
))
1138 if (!field_mul(group
, Za23
, Za23
, a
->Z
, ctx
))
1140 if (!field_mul(group
, tmp2
, b
->Y
, Za23
, ctx
))
1146 /* compare Y_a*Z_b^3 with Y_b*Z_a^3 */
1147 if (BN_cmp(tmp1_
, tmp2_
) != 0) {
1148 ret
= 1; /* points differ */
1152 /* points are equal */
1157 BN_CTX_free(new_ctx
);
1161 int ec_GFp_simple_make_affine(const EC_GROUP
*group
, EC_POINT
*point
,
1164 BN_CTX
*new_ctx
= NULL
;
1168 if (point
->Z_is_one
|| EC_POINT_is_at_infinity(group
, point
))
1172 ctx
= new_ctx
= BN_CTX_new();
1178 x
= BN_CTX_get(ctx
);
1179 y
= BN_CTX_get(ctx
);
1183 if (!EC_POINT_get_affine_coordinates(group
, point
, x
, y
, ctx
))
1185 if (!EC_POINT_set_affine_coordinates(group
, point
, x
, y
, ctx
))
1187 if (!point
->Z_is_one
) {
1188 ECerr(EC_F_EC_GFP_SIMPLE_MAKE_AFFINE
, ERR_R_INTERNAL_ERROR
);
1196 BN_CTX_free(new_ctx
);
1200 int ec_GFp_simple_points_make_affine(const EC_GROUP
*group
, size_t num
,
1201 EC_POINT
*points
[], BN_CTX
*ctx
)
1203 BN_CTX
*new_ctx
= NULL
;
1204 BIGNUM
*tmp
, *tmp_Z
;
1205 BIGNUM
**prod_Z
= NULL
;
1213 ctx
= new_ctx
= BN_CTX_new();
1219 tmp
= BN_CTX_get(ctx
);
1220 tmp_Z
= BN_CTX_get(ctx
);
1224 prod_Z
= OPENSSL_malloc(num
* sizeof(prod_Z
[0]));
1227 for (i
= 0; i
< num
; i
++) {
1228 prod_Z
[i
] = BN_new();
1229 if (prod_Z
[i
] == NULL
)
1234 * Set each prod_Z[i] to the product of points[0]->Z .. points[i]->Z,
1235 * skipping any zero-valued inputs (pretend that they're 1).
1238 if (!BN_is_zero(points
[0]->Z
)) {
1239 if (!BN_copy(prod_Z
[0], points
[0]->Z
))
1242 if (group
->meth
->field_set_to_one
!= 0) {
1243 if (!group
->meth
->field_set_to_one(group
, prod_Z
[0], ctx
))
1246 if (!BN_one(prod_Z
[0]))
1251 for (i
= 1; i
< num
; i
++) {
1252 if (!BN_is_zero(points
[i
]->Z
)) {
1254 meth
->field_mul(group
, prod_Z
[i
], prod_Z
[i
- 1], points
[i
]->Z
,
1258 if (!BN_copy(prod_Z
[i
], prod_Z
[i
- 1]))
1264 * Now use a single explicit inversion to replace every non-zero
1265 * points[i]->Z by its inverse.
1268 if (!group
->meth
->field_inv(group
, tmp
, prod_Z
[num
- 1], ctx
)) {
1269 ECerr(EC_F_EC_GFP_SIMPLE_POINTS_MAKE_AFFINE
, ERR_R_BN_LIB
);
1272 if (group
->meth
->field_encode
!= 0) {
1274 * In the Montgomery case, we just turned R*H (representing H) into
1275 * 1/(R*H), but we need R*(1/H) (representing 1/H); i.e. we need to
1276 * multiply by the Montgomery factor twice.
1278 if (!group
->meth
->field_encode(group
, tmp
, tmp
, ctx
))
1280 if (!group
->meth
->field_encode(group
, tmp
, tmp
, ctx
))
1284 for (i
= num
- 1; i
> 0; --i
) {
1286 * Loop invariant: tmp is the product of the inverses of points[0]->Z
1287 * .. points[i]->Z (zero-valued inputs skipped).
1289 if (!BN_is_zero(points
[i
]->Z
)) {
1291 * Set tmp_Z to the inverse of points[i]->Z (as product of Z
1292 * inverses 0 .. i, Z values 0 .. i - 1).
1295 meth
->field_mul(group
, tmp_Z
, prod_Z
[i
- 1], tmp
, ctx
))
1298 * Update tmp to satisfy the loop invariant for i - 1.
1300 if (!group
->meth
->field_mul(group
, tmp
, tmp
, points
[i
]->Z
, ctx
))
1302 /* Replace points[i]->Z by its inverse. */
1303 if (!BN_copy(points
[i
]->Z
, tmp_Z
))
1308 if (!BN_is_zero(points
[0]->Z
)) {
1309 /* Replace points[0]->Z by its inverse. */
1310 if (!BN_copy(points
[0]->Z
, tmp
))
1314 /* Finally, fix up the X and Y coordinates for all points. */
1316 for (i
= 0; i
< num
; i
++) {
1317 EC_POINT
*p
= points
[i
];
1319 if (!BN_is_zero(p
->Z
)) {
1320 /* turn (X, Y, 1/Z) into (X/Z^2, Y/Z^3, 1) */
1322 if (!group
->meth
->field_sqr(group
, tmp
, p
->Z
, ctx
))
1324 if (!group
->meth
->field_mul(group
, p
->X
, p
->X
, tmp
, ctx
))
1327 if (!group
->meth
->field_mul(group
, tmp
, tmp
, p
->Z
, ctx
))
1329 if (!group
->meth
->field_mul(group
, p
->Y
, p
->Y
, tmp
, ctx
))
1332 if (group
->meth
->field_set_to_one
!= 0) {
1333 if (!group
->meth
->field_set_to_one(group
, p
->Z
, ctx
))
1347 BN_CTX_free(new_ctx
);
1348 if (prod_Z
!= NULL
) {
1349 for (i
= 0; i
< num
; i
++) {
1350 if (prod_Z
[i
] == NULL
)
1352 BN_clear_free(prod_Z
[i
]);
1354 OPENSSL_free(prod_Z
);
1359 int ec_GFp_simple_field_mul(const EC_GROUP
*group
, BIGNUM
*r
, const BIGNUM
*a
,
1360 const BIGNUM
*b
, BN_CTX
*ctx
)
1362 return BN_mod_mul(r
, a
, b
, group
->field
, ctx
);
1365 int ec_GFp_simple_field_sqr(const EC_GROUP
*group
, BIGNUM
*r
, const BIGNUM
*a
,
1368 return BN_mod_sqr(r
, a
, group
->field
, ctx
);
1372 * Computes the multiplicative inverse of a in GF(p), storing the result in r.
1373 * If a is zero (or equivalent), you'll get a EC_R_CANNOT_INVERT error.
1374 * Since we don't have a Mont structure here, SCA hardening is with blinding.
1376 int ec_GFp_simple_field_inv(const EC_GROUP
*group
, BIGNUM
*r
, const BIGNUM
*a
,
1380 BN_CTX
*new_ctx
= NULL
;
1383 if (ctx
== NULL
&& (ctx
= new_ctx
= BN_CTX_secure_new()) == NULL
)
1387 if ((e
= BN_CTX_get(ctx
)) == NULL
)
1391 if (!BN_priv_rand_range(e
, group
->field
))
1393 } while (BN_is_zero(e
));
1396 if (!group
->meth
->field_mul(group
, r
, a
, e
, ctx
))
1398 /* r := 1/(a * e) */
1399 if (!BN_mod_inverse(r
, r
, group
->field
, ctx
)) {
1400 ECerr(EC_F_EC_GFP_SIMPLE_FIELD_INV
, EC_R_CANNOT_INVERT
);
1403 /* r := e/(a * e) = 1/a */
1404 if (!group
->meth
->field_mul(group
, r
, r
, e
, ctx
))
1411 BN_CTX_free(new_ctx
);
1416 * Apply randomization of EC point projective coordinates:
1418 * (X, Y ,Z ) = (lambda^2*X, lambda^3*Y, lambda*Z)
1419 * lambda = [1,group->field)
1422 int ec_GFp_simple_blind_coordinates(const EC_GROUP
*group
, EC_POINT
*p
,
1426 BIGNUM
*lambda
= NULL
;
1427 BIGNUM
*temp
= NULL
;
1430 lambda
= BN_CTX_get(ctx
);
1431 temp
= BN_CTX_get(ctx
);
1433 ECerr(EC_F_EC_GFP_SIMPLE_BLIND_COORDINATES
, ERR_R_MALLOC_FAILURE
);
1437 /* make sure lambda is not zero */
1439 if (!BN_priv_rand_range(lambda
, group
->field
)) {
1440 ECerr(EC_F_EC_GFP_SIMPLE_BLIND_COORDINATES
, ERR_R_BN_LIB
);
1443 } while (BN_is_zero(lambda
));
1445 /* if field_encode defined convert between representations */
1446 if (group
->meth
->field_encode
!= NULL
1447 && !group
->meth
->field_encode(group
, lambda
, lambda
, ctx
))
1449 if (!group
->meth
->field_mul(group
, p
->Z
, p
->Z
, lambda
, ctx
))
1451 if (!group
->meth
->field_sqr(group
, temp
, lambda
, ctx
))
1453 if (!group
->meth
->field_mul(group
, p
->X
, p
->X
, temp
, ctx
))
1455 if (!group
->meth
->field_mul(group
, temp
, temp
, lambda
, ctx
))
1457 if (!group
->meth
->field_mul(group
, p
->Y
, p
->Y
, temp
, ctx
))
1469 * Set s := p, r := 2p.
1471 * For doubling we use Formula 3 from Izu-Takagi "A fast parallel elliptic curve
1472 * multiplication resistant against side channel attacks" appendix, as described
1474 * https://hyperelliptic.org/EFD/g1p/auto-shortw-xz.html#doubling-dbl-2002-it-2
1476 * The input point p will be in randomized Jacobian projective coords:
1477 * x = X/Z**2, y=Y/Z**3
1479 * The output points p, s, and r are converted to standard (homogeneous)
1480 * projective coords:
1483 int ec_GFp_simple_ladder_pre(const EC_GROUP
*group
,
1484 EC_POINT
*r
, EC_POINT
*s
,
1485 EC_POINT
*p
, BN_CTX
*ctx
)
1487 BIGNUM
*t1
, *t2
, *t3
, *t4
, *t5
, *t6
= NULL
;
1496 /* convert p: (X,Y,Z) -> (XZ,Y,Z**3) */
1497 if (!group
->meth
->field_mul(group
, p
->X
, p
->X
, p
->Z
, ctx
)
1498 || !group
->meth
->field_sqr(group
, t1
, p
->Z
, ctx
)
1499 || !group
->meth
->field_mul(group
, p
->Z
, p
->Z
, t1
, ctx
)
1501 || !group
->meth
->field_sqr(group
, t2
, p
->X
, ctx
)
1502 || !group
->meth
->field_sqr(group
, t3
, p
->Z
, ctx
)
1503 || !group
->meth
->field_mul(group
, t4
, t3
, group
->a
, ctx
)
1504 || !BN_mod_sub_quick(t5
, t2
, t4
, group
->field
)
1505 || !BN_mod_add_quick(t2
, t2
, t4
, group
->field
)
1506 || !group
->meth
->field_sqr(group
, t5
, t5
, ctx
)
1507 || !group
->meth
->field_mul(group
, t6
, t3
, group
->b
, ctx
)
1508 || !group
->meth
->field_mul(group
, t1
, p
->X
, p
->Z
, ctx
)
1509 || !group
->meth
->field_mul(group
, t4
, t1
, t6
, ctx
)
1510 || !BN_mod_lshift_quick(t4
, t4
, 3, group
->field
)
1511 /* r->X coord output */
1512 || !BN_mod_sub_quick(r
->X
, t5
, t4
, group
->field
)
1513 || !group
->meth
->field_mul(group
, t1
, t1
, t2
, ctx
)
1514 || !group
->meth
->field_mul(group
, t2
, t3
, t6
, ctx
)
1515 || !BN_mod_add_quick(t1
, t1
, t2
, group
->field
)
1516 /* r->Z coord output */
1517 || !BN_mod_lshift_quick(r
->Z
, t1
, 2, group
->field
)
1518 || !EC_POINT_copy(s
, p
))
1529 * Differential addition-and-doubling using Eq. (9) and (10) from Izu-Takagi
1530 * "A fast parallel elliptic curve multiplication resistant against side channel
1531 * attacks", as described at
1532 * https://hyperelliptic.org/EFD/g1p/auto-shortw-xz.html#ladder-ladd-2002-it-4
1534 int ec_GFp_simple_ladder_step(const EC_GROUP
*group
,
1535 EC_POINT
*r
, EC_POINT
*s
,
1536 EC_POINT
*p
, BN_CTX
*ctx
)
1539 BIGNUM
*t0
, *t1
, *t2
, *t3
, *t4
, *t5
, *t6
, *t7
= NULL
;
1542 t0
= BN_CTX_get(ctx
);
1543 t1
= BN_CTX_get(ctx
);
1544 t2
= BN_CTX_get(ctx
);
1545 t3
= BN_CTX_get(ctx
);
1546 t4
= BN_CTX_get(ctx
);
1547 t5
= BN_CTX_get(ctx
);
1548 t6
= BN_CTX_get(ctx
);
1549 t7
= BN_CTX_get(ctx
);
1552 || !group
->meth
->field_mul(group
, t0
, r
->X
, s
->X
, ctx
)
1553 || !group
->meth
->field_mul(group
, t1
, r
->Z
, s
->Z
, ctx
)
1554 || !group
->meth
->field_mul(group
, t2
, r
->X
, s
->Z
, ctx
)
1555 || !group
->meth
->field_mul(group
, t3
, r
->Z
, s
->X
, ctx
)
1556 || !group
->meth
->field_mul(group
, t4
, group
->a
, t1
, ctx
)
1557 || !BN_mod_add_quick(t0
, t0
, t4
, group
->field
)
1558 || !BN_mod_add_quick(t4
, t3
, t2
, group
->field
)
1559 || !group
->meth
->field_mul(group
, t0
, t4
, t0
, ctx
)
1560 || !group
->meth
->field_sqr(group
, t1
, t1
, ctx
)
1561 || !BN_mod_lshift_quick(t7
, group
->b
, 2, group
->field
)
1562 || !group
->meth
->field_mul(group
, t1
, t7
, t1
, ctx
)
1563 || !BN_mod_lshift1_quick(t0
, t0
, group
->field
)
1564 || !BN_mod_add_quick(t0
, t1
, t0
, group
->field
)
1565 || !BN_mod_sub_quick(t1
, t2
, t3
, group
->field
)
1566 || !group
->meth
->field_sqr(group
, t1
, t1
, ctx
)
1567 || !group
->meth
->field_mul(group
, t3
, t1
, p
->X
, ctx
)
1568 || !group
->meth
->field_mul(group
, t0
, p
->Z
, t0
, ctx
)
1569 /* s->X coord output */
1570 || !BN_mod_sub_quick(s
->X
, t0
, t3
, group
->field
)
1571 /* s->Z coord output */
1572 || !group
->meth
->field_mul(group
, s
->Z
, p
->Z
, t1
, ctx
)
1573 || !group
->meth
->field_sqr(group
, t3
, r
->X
, ctx
)
1574 || !group
->meth
->field_sqr(group
, t2
, r
->Z
, ctx
)
1575 || !group
->meth
->field_mul(group
, t4
, t2
, group
->a
, ctx
)
1576 || !BN_mod_add_quick(t5
, r
->X
, r
->Z
, group
->field
)
1577 || !group
->meth
->field_sqr(group
, t5
, t5
, ctx
)
1578 || !BN_mod_sub_quick(t5
, t5
, t3
, group
->field
)
1579 || !BN_mod_sub_quick(t5
, t5
, t2
, group
->field
)
1580 || !BN_mod_sub_quick(t6
, t3
, t4
, group
->field
)
1581 || !group
->meth
->field_sqr(group
, t6
, t6
, ctx
)
1582 || !group
->meth
->field_mul(group
, t0
, t2
, t5
, ctx
)
1583 || !group
->meth
->field_mul(group
, t0
, t7
, t0
, ctx
)
1584 /* r->X coord output */
1585 || !BN_mod_sub_quick(r
->X
, t6
, t0
, group
->field
)
1586 || !BN_mod_add_quick(t6
, t3
, t4
, group
->field
)
1587 || !group
->meth
->field_sqr(group
, t3
, t2
, ctx
)
1588 || !group
->meth
->field_mul(group
, t7
, t3
, t7
, ctx
)
1589 || !group
->meth
->field_mul(group
, t5
, t5
, t6
, ctx
)
1590 || !BN_mod_lshift1_quick(t5
, t5
, group
->field
)
1591 /* r->Z coord output */
1592 || !BN_mod_add_quick(r
->Z
, t7
, t5
, group
->field
))
1603 * Recovers the y-coordinate of r using Eq. (8) from Brier-Joye, "Weierstrass
1604 * Elliptic Curves and Side-Channel Attacks", modified to work in projective
1605 * coordinates and return r in Jacobian projective coordinates.
1607 * X4 = two*Y1*X2*Z3*Z2*Z1;
1608 * Y4 = two*b*Z3*SQR(Z2*Z1) + Z3*(a*Z2*Z1+X1*X2)*(X1*Z2+X2*Z1) - X3*SQR(X1*Z2-X2*Z1);
1609 * Z4 = two*Y1*Z3*SQR(Z2)*Z1;
1612 * - Z1==0 implies p is at infinity, which would have caused an early exit in
1614 * - Z2==0 implies r is at infinity (handled by the BN_is_zero(r->Z) branch);
1615 * - Z3==0 implies s is at infinity (handled by the BN_is_zero(s->Z) branch);
1616 * - Y1==0 implies p has order 2, so either r or s are infinity and handled by
1617 * one of the BN_is_zero(...) branches.
1619 int ec_GFp_simple_ladder_post(const EC_GROUP
*group
,
1620 EC_POINT
*r
, EC_POINT
*s
,
1621 EC_POINT
*p
, BN_CTX
*ctx
)
1624 BIGNUM
*t0
, *t1
, *t2
, *t3
, *t4
, *t5
, *t6
= NULL
;
1626 if (BN_is_zero(r
->Z
))
1627 return EC_POINT_set_to_infinity(group
, r
);
1629 if (BN_is_zero(s
->Z
)) {
1630 /* (X,Y,Z) -> (XZ,YZ**2,Z) */
1631 if (!group
->meth
->field_mul(group
, r
->X
, p
->X
, p
->Z
, ctx
)
1632 || !group
->meth
->field_sqr(group
, r
->Z
, p
->Z
, ctx
)
1633 || !group
->meth
->field_mul(group
, r
->Y
, p
->Y
, r
->Z
, ctx
)
1634 || !BN_copy(r
->Z
, p
->Z
)
1635 || !EC_POINT_invert(group
, r
, ctx
))
1641 t0
= BN_CTX_get(ctx
);
1642 t1
= BN_CTX_get(ctx
);
1643 t2
= BN_CTX_get(ctx
);
1644 t3
= BN_CTX_get(ctx
);
1645 t4
= BN_CTX_get(ctx
);
1646 t5
= BN_CTX_get(ctx
);
1647 t6
= BN_CTX_get(ctx
);
1650 || !BN_mod_lshift1_quick(t0
, p
->Y
, group
->field
)
1651 || !group
->meth
->field_mul(group
, t1
, r
->X
, p
->Z
, ctx
)
1652 || !group
->meth
->field_mul(group
, t2
, r
->Z
, s
->Z
, ctx
)
1653 || !group
->meth
->field_mul(group
, t2
, t1
, t2
, ctx
)
1654 || !group
->meth
->field_mul(group
, t3
, t2
, t0
, ctx
)
1655 || !group
->meth
->field_mul(group
, t2
, r
->Z
, p
->Z
, ctx
)
1656 || !group
->meth
->field_sqr(group
, t4
, t2
, ctx
)
1657 || !BN_mod_lshift1_quick(t5
, group
->b
, group
->field
)
1658 || !group
->meth
->field_mul(group
, t4
, t4
, t5
, ctx
)
1659 || !group
->meth
->field_mul(group
, t6
, t2
, group
->a
, ctx
)
1660 || !group
->meth
->field_mul(group
, t5
, r
->X
, p
->X
, ctx
)
1661 || !BN_mod_add_quick(t5
, t6
, t5
, group
->field
)
1662 || !group
->meth
->field_mul(group
, t6
, r
->Z
, p
->X
, ctx
)
1663 || !BN_mod_add_quick(t2
, t6
, t1
, group
->field
)
1664 || !group
->meth
->field_mul(group
, t5
, t5
, t2
, ctx
)
1665 || !BN_mod_sub_quick(t6
, t6
, t1
, group
->field
)
1666 || !group
->meth
->field_sqr(group
, t6
, t6
, ctx
)
1667 || !group
->meth
->field_mul(group
, t6
, t6
, s
->X
, ctx
)
1668 || !BN_mod_add_quick(t4
, t5
, t4
, group
->field
)
1669 || !group
->meth
->field_mul(group
, t4
, t4
, s
->Z
, ctx
)
1670 || !BN_mod_sub_quick(t4
, t4
, t6
, group
->field
)
1671 || !group
->meth
->field_sqr(group
, t5
, r
->Z
, ctx
)
1672 || !group
->meth
->field_mul(group
, r
->Z
, p
->Z
, s
->Z
, ctx
)
1673 || !group
->meth
->field_mul(group
, r
->Z
, t5
, r
->Z
, ctx
)
1674 || !group
->meth
->field_mul(group
, r
->Z
, r
->Z
, t0
, ctx
)
1675 /* t3 := X, t4 := Y */
1676 /* (X,Y,Z) -> (XZ,YZ**2,Z) */
1677 || !group
->meth
->field_mul(group
, r
->X
, t3
, r
->Z
, ctx
)
1678 || !group
->meth
->field_sqr(group
, t3
, r
->Z
, ctx
)
1679 || !group
->meth
->field_mul(group
, r
->Y
, t4
, t3
, ctx
))