]>
Commit | Line | Data |
---|---|---|
aafbe1cc MC |
1 | =pod |
2 | ||
3 | =head1 NAME | |
4 | ||
c952780c RS |
5 | EC_GROUP_get0_order, EC_GROUP_order_bits, EC_GROUP_get0_cofactor, |
6 | EC_GROUP_copy, EC_GROUP_dup, EC_GROUP_method_of, EC_GROUP_set_generator, | |
7 | EC_GROUP_get0_generator, EC_GROUP_get_order, EC_GROUP_get_cofactor, | |
8 | EC_GROUP_set_curve_name, EC_GROUP_get_curve_name, EC_GROUP_set_asn1_flag, | |
9 | EC_GROUP_get_asn1_flag, EC_GROUP_set_point_conversion_form, | |
10 | EC_GROUP_get_point_conversion_form, EC_GROUP_get0_seed, | |
11 | EC_GROUP_get_seed_len, EC_GROUP_set_seed, EC_GROUP_get_degree, | |
8402cd5f SL |
12 | EC_GROUP_check, EC_GROUP_check_named_curve, |
13 | EC_GROUP_check_discriminant, EC_GROUP_cmp, | |
c952780c | 14 | EC_GROUP_get_basis_type, EC_GROUP_get_trinomial_basis, |
fa1f0306 | 15 | EC_GROUP_get_pentanomial_basis, EC_GROUP_get0_field |
c952780c | 16 | - Functions for manipulating EC_GROUP objects |
aafbe1cc MC |
17 | |
18 | =head1 SYNOPSIS | |
19 | ||
20 | #include <openssl/ec.h> | |
aafbe1cc MC |
21 | |
22 | int EC_GROUP_copy(EC_GROUP *dst, const EC_GROUP *src); | |
23 | EC_GROUP *EC_GROUP_dup(const EC_GROUP *src); | |
24 | ||
e9b77246 BB |
25 | int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator, |
26 | const BIGNUM *order, const BIGNUM *cofactor); | |
aafbe1cc MC |
27 | const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group); |
28 | ||
29 | int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx); | |
be2e334f | 30 | const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group); |
14f46560 | 31 | int EC_GROUP_order_bits(const EC_GROUP *group); |
aafbe1cc | 32 | int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor, BN_CTX *ctx); |
be2e334f | 33 | const BIGNUM *EC_GROUP_get0_cofactor(const EC_GROUP *group); |
fa1f0306 | 34 | const BIGNUM *EC_GROUP_get0_field(const EC_GROUP *group); |
aafbe1cc MC |
35 | |
36 | void EC_GROUP_set_curve_name(EC_GROUP *group, int nid); | |
37 | int EC_GROUP_get_curve_name(const EC_GROUP *group); | |
38 | ||
39 | void EC_GROUP_set_asn1_flag(EC_GROUP *group, int flag); | |
40 | int EC_GROUP_get_asn1_flag(const EC_GROUP *group); | |
41 | ||
42 | void EC_GROUP_set_point_conversion_form(EC_GROUP *group, point_conversion_form_t form); | |
df3d1e84 | 43 | point_conversion_form_t EC_GROUP_get_point_conversion_form(const EC_GROUP *group); |
aafbe1cc MC |
44 | |
45 | unsigned char *EC_GROUP_get0_seed(const EC_GROUP *x); | |
46 | size_t EC_GROUP_get_seed_len(const EC_GROUP *); | |
47 | size_t EC_GROUP_set_seed(EC_GROUP *, const unsigned char *, size_t len); | |
48 | ||
49 | int EC_GROUP_get_degree(const EC_GROUP *group); | |
50 | ||
51 | int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx); | |
a9612d6c MC |
52 | int EC_GROUP_check_named_curve(const EC_GROUP *group, int nist_only, |
53 | BN_CTX *ctx); | |
aafbe1cc MC |
54 | |
55 | int EC_GROUP_check_discriminant(const EC_GROUP *group, BN_CTX *ctx); | |
56 | ||
57 | int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx); | |
58 | ||
59 | int EC_GROUP_get_basis_type(const EC_GROUP *); | |
60 | int EC_GROUP_get_trinomial_basis(const EC_GROUP *, unsigned int *k); | |
1bc74519 | 61 | int EC_GROUP_get_pentanomial_basis(const EC_GROUP *, unsigned int *k1, |
e9b77246 | 62 | unsigned int *k2, unsigned int *k3); |
aafbe1cc | 63 | |
23ccae80 BB |
64 | Deprecated since OpenSSL 3.0: |
65 | ||
66 | const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *group); | |
67 | ||
aafbe1cc MC |
68 | =head1 DESCRIPTION |
69 | ||
df3d1e84 | 70 | EC_GROUP_copy() copies the curve B<src> into B<dst>. Both B<src> and B<dst> must use the same EC_METHOD. |
aafbe1cc | 71 | |
df3d1e84 | 72 | EC_GROUP_dup() creates a new EC_GROUP object and copies the content from B<src> to the newly created |
aafbe1cc MC |
73 | EC_GROUP object. |
74 | ||
df3d1e84 | 75 | EC_GROUP_method_of() obtains the EC_METHOD of B<group>. |
23ccae80 | 76 | This function was deprecated in OpenSSL 3.0, since EC_METHOD is no longer a public concept. |
aafbe1cc | 77 | |
df3d1e84 | 78 | EC_GROUP_set_generator() sets curve parameters that must be agreed by all participants using the curve. These |
0d4fb843 | 79 | parameters include the B<generator>, the B<order> and the B<cofactor>. The B<generator> is a well defined point on the |
aafbe1cc | 80 | curve chosen for cryptographic operations. Integers used for point multiplications will be between 0 and |
186bb907 | 81 | n-1 where n is the B<order>. The B<order> multiplied by the B<cofactor> gives the number of points on the curve. |
aafbe1cc | 82 | |
df3d1e84 | 83 | EC_GROUP_get0_generator() returns the generator for the identified B<group>. |
aafbe1cc | 84 | |
df3d1e84 | 85 | EC_GROUP_get_order() retrieves the order of B<group> and copies its value into |
86 | B<order>. It fails in case B<group> is not fully initialized (i.e., its order | |
87 | is not set or set to zero). | |
aafbe1cc | 88 | |
df3d1e84 | 89 | EC_GROUP_get_cofactor() retrieves the cofactor of B<group> and copies its value |
90 | into B<cofactor>. It fails in case B<group> is not fully initialized or if the | |
91 | cofactor is not set (or set to zero). | |
92 | ||
93 | The functions EC_GROUP_set_curve_name() and EC_GROUP_get_curve_name(), set and get the NID for the curve respectively | |
9b86974e | 94 | (see L<EC_GROUP_new(3)>). If a curve does not have a NID associated with it, then EC_GROUP_get_curve_name |
df3d1e84 | 95 | will return NID_undef. |
aafbe1cc | 96 | |
146ca72c DSH |
97 | The asn1_flag value is used to determine whether the curve encoding uses |
98 | explicit parameters or a named curve using an ASN1 OID: many applications only | |
99 | support the latter form. If asn1_flag is B<OPENSSL_EC_NAMED_CURVE> then the | |
100 | named curve form is used and the parameters must have a corresponding | |
101 | named curve NID set. If asn1_flags is B<OPENSSL_EC_EXPLICIT_CURVE> the | |
df3d1e84 | 102 | parameters are explicitly encoded. The functions EC_GROUP_get_asn1_flag() and |
103 | EC_GROUP_set_asn1_flag() get and set the status of the asn1_flag for the curve. | |
fc5ecadd | 104 | Note: B<OPENSSL_EC_EXPLICIT_CURVE> was added in OpenSSL 1.1.0, for |
146ca72c DSH |
105 | previous versions of OpenSSL the value 0 must be used instead. Before OpenSSL |
106 | 1.1.0 the default form was to use explicit parameters (meaning that | |
107 | applications would have to explicitly set the named curve form) in OpenSSL | |
108 | 1.1.0 and later the named curve form is the default. | |
aafbe1cc | 109 | |
186bb907 | 110 | The point_conversion_form for a curve controls how EC_POINT data is encoded as ASN1 as defined in X9.62 (ECDSA). |
1bc74519 | 111 | point_conversion_form_t is an enum defined as follows: |
aafbe1cc MC |
112 | |
113 | typedef enum { | |
1bc74519 RS |
114 | /** the point is encoded as z||x, where the octet z specifies |
115 | * which solution of the quadratic equation y is */ | |
116 | POINT_CONVERSION_COMPRESSED = 2, | |
14f46560 | 117 | /** the point is encoded as z||x||y, where z is the octet 0x04 */ |
1bc74519 RS |
118 | POINT_CONVERSION_UNCOMPRESSED = 4, |
119 | /** the point is encoded as z||x||y, where the octet z specifies | |
aafbe1cc | 120 | * which solution of the quadratic equation y is */ |
1bc74519 | 121 | POINT_CONVERSION_HYBRID = 6 |
aafbe1cc MC |
122 | } point_conversion_form_t; |
123 | ||
aafbe1cc MC |
124 | For POINT_CONVERSION_UNCOMPRESSED the point is encoded as an octet signifying the UNCOMPRESSED form has been used followed by |
125 | the octets for x, followed by the octets for y. | |
126 | ||
127 | For any given x co-ordinate for a point on a curve it is possible to derive two possible y values. For | |
128 | POINT_CONVERSION_COMPRESSED the point is encoded as an octet signifying that the COMPRESSED form has been used AND which of | |
1bc74519 | 129 | the two possible solutions for y has been used, followed by the octets for x. |
aafbe1cc MC |
130 | |
131 | For POINT_CONVERSION_HYBRID the point is encoded as an octet signifying the HYBRID form has been used AND which of the two | |
132 | possible solutions for y has been used, followed by the octets for x, followed by the octets for y. | |
133 | ||
df3d1e84 | 134 | The functions EC_GROUP_set_point_conversion_form() and EC_GROUP_get_point_conversion_form(), set and get the point_conversion_form |
aafbe1cc MC |
135 | for the curve respectively. |
136 | ||
137 | ANSI X9.62 (ECDSA standard) defines a method of generating the curve parameter b from a random number. This provides advantages | |
138 | in that a parameter obtained in this way is highly unlikely to be susceptible to special purpose attacks, or have any trapdoors in it. | |
139 | If the seed is present for a curve then the b parameter was generated in a verifiable fashion using that seed. The OpenSSL EC library | |
df3d1e84 | 140 | does not use this seed value but does enable you to inspect it using EC_GROUP_get0_seed(). This returns a pointer to a memory block |
141 | containing the seed that was used. The length of the memory block can be obtained using EC_GROUP_get_seed_len(). A number of the | |
37f03b98 | 142 | built-in curves within the library provide seed values that can be obtained. It is also possible to set a custom seed using |
df3d1e84 | 143 | EC_GROUP_set_seed() and passing a pointer to a memory block, along with the length of the seed. Again, the EC library will not use |
aafbe1cc MC |
144 | this seed value, although it will be preserved in any ASN1 based communications. |
145 | ||
23ccae80 BB |
146 | EC_GROUP_get_degree() gets the degree of the field. |
147 | For Fp fields this will be the number of bits in p. | |
148 | For F2^m fields this will be the value m. | |
149 | ||
150 | EC_GROUP_get_field_type() identifies what type of field the EC_GROUP structure supports, | |
151 | which will be either F2^m or Fp. | |
aafbe1cc | 152 | |
df3d1e84 | 153 | The function EC_GROUP_check_discriminant() calculates the discriminant for the curve and verifies that it is valid. |
aafbe1cc MC |
154 | For a curve defined over Fp the discriminant is given by the formula 4*a^3 + 27*b^2 whilst for F2^m curves the discriminant is |
155 | simply b. In either case for the curve to be valid the discriminant must be non zero. | |
156 | ||
df3d1e84 | 157 | The function EC_GROUP_check() performs a number of checks on a curve to verify that it is valid. Checks performed include |
aafbe1cc MC |
158 | verifying that the discriminant is non zero; that a generator has been defined; that the generator is on the curve and has |
159 | the correct order. | |
160 | ||
df3d1e84 | 161 | The function EC_GROUP_check_named_curve() determines if the group's domain parameters match one of the built-in curves supported by the library. |
8402cd5f SL |
162 | The curve name is returned as a B<NID> if it matches. If the group's domain parameters have been modified then no match will be found. |
163 | If the curve name of the given group is B<NID_undef> (e.g. it has been created by using explicit parameters with no curve name), | |
37f03b98 | 164 | then this method can be used to lookup the name of the curve that matches the group domain parameters. The built-in curves contain |
8402cd5f SL |
165 | aliases, so that multiple NID's can map to the same domain parameters. For such curves it is unspecified which of the aliases will be |
166 | returned if the curve name of the given group is NID_undef. | |
37f03b98 | 167 | If B<nist_only> is 1 it will only look for NIST approved curves, otherwise it searches all built-in curves. |
a9612d6c MC |
168 | This function may be passed a BN_CTX object in the B<ctx> parameter. |
169 | The B<ctx> parameter may be NULL. | |
8402cd5f | 170 | |
df3d1e84 | 171 | EC_GROUP_cmp() compares B<a> and B<b> to determine whether they represent the same curve or not. |
aafbe1cc | 172 | |
df3d1e84 | 173 | The functions EC_GROUP_get_basis_type(), EC_GROUP_get_trinomial_basis() and EC_GROUP_get_pentanomial_basis() should only be called for curves |
aafbe1cc MC |
174 | defined over an F2^m field. Addition and multiplication operations within an F2^m field are performed using an irreducible polynomial |
175 | function f(x). This function is either a trinomial of the form: | |
176 | ||
177 | f(x) = x^m + x^k + 1 with m > k >= 1 | |
178 | ||
179 | or a pentanomial of the form: | |
180 | ||
181 | f(x) = x^m + x^k3 + x^k2 + x^k1 + 1 with m > k3 > k2 > k1 >= 1 | |
182 | ||
df3d1e84 | 183 | The function EC_GROUP_get_basis_type() returns a NID identifying whether a trinomial or pentanomial is in use for the field. The |
184 | function EC_GROUP_get_trinomial_basis() must only be called where f(x) is of the trinomial form, and returns the value of B<k>. Similarly | |
185 | the function EC_GROUP_get_pentanomial_basis() must only be called where f(x) is of the pentanomial form, and returns the values of B<k1>, | |
aafbe1cc MC |
186 | B<k2> and B<k3> respectively. |
187 | ||
188 | =head1 RETURN VALUES | |
189 | ||
df3d1e84 | 190 | The following functions return 1 on success or 0 on error: EC_GROUP_copy(), EC_GROUP_set_generator(), EC_GROUP_check(), |
191 | EC_GROUP_check_discriminant(), EC_GROUP_get_trinomial_basis() and EC_GROUP_get_pentanomial_basis(). | |
192 | ||
193 | EC_GROUP_dup() returns a pointer to the duplicated curve, or NULL on error. | |
194 | ||
195 | EC_GROUP_method_of() returns the EC_METHOD implementation in use for the given curve or NULL on error. | |
196 | ||
197 | EC_GROUP_get0_generator() returns the generator for the given curve or NULL on error. | |
198 | ||
199 | EC_GROUP_get_order() returns 0 if the order is not set (or set to zero) for | |
200 | B<group> or if copying into B<order> fails, 1 otherwise. | |
201 | ||
202 | EC_GROUP_get_cofactor() returns 0 if the cofactor is not set (or is set to zero) for B<group> or if copying into B<cofactor> fails, 1 otherwise. | |
aafbe1cc | 203 | |
df3d1e84 | 204 | EC_GROUP_get_curve_name() returns the curve name (NID) for B<group> or will return NID_undef if no curve name is associated. |
aafbe1cc | 205 | |
df3d1e84 | 206 | EC_GROUP_get_asn1_flag() returns the ASN1 flag for the specified B<group> . |
aafbe1cc | 207 | |
df3d1e84 | 208 | EC_GROUP_get_point_conversion_form() returns the point_conversion_form for B<group>. |
aafbe1cc | 209 | |
df3d1e84 | 210 | EC_GROUP_get_degree() returns the degree for B<group> or 0 if the operation is not supported by the underlying group implementation. |
aafbe1cc | 211 | |
23ccae80 BB |
212 | EC_GROUP_get_field_type() returns either B<NID_X9_62_prime_field> for prime curves |
213 | or B<NID_X9_62_characteristic_two_field> for binary curves; | |
214 | these values are defined in the obj_mac.h header file. | |
215 | ||
37f03b98 | 216 | EC_GROUP_check_named_curve() returns the nid of the matching named curve, otherwise it returns 0 for no match, or -1 on error. |
8402cd5f | 217 | |
be2e334f | 218 | EC_GROUP_get0_order() returns an internal pointer to the group order. |
829800b0 | 219 | EC_GROUP_order_bits() returns the number of bits in the group order. |
be2e334f | 220 | EC_GROUP_get0_cofactor() returns an internal pointer to the group cofactor. |
fa1f0306 DA |
221 | EC_GROUP_get0_field() returns an internal pointer to the group field. For curves over GF(p), this is the modulus; for curves |
222 | over GF(2^m), this is the irreducible polynomial defining the field. | |
be2e334f | 223 | |
df3d1e84 | 224 | EC_GROUP_get0_seed() returns a pointer to the seed that was used to generate the parameter b, or NULL if the seed is not |
225 | specified. EC_GROUP_get_seed_len() returns the length of the seed or 0 if the seed is not specified. | |
aafbe1cc | 226 | |
df3d1e84 | 227 | EC_GROUP_set_seed() returns the length of the seed that has been set. If the supplied seed is NULL, or the supplied seed length is |
d900a015 | 228 | 0, the return value will be 1. On error 0 is returned. |
aafbe1cc | 229 | |
df3d1e84 | 230 | EC_GROUP_cmp() returns 0 if the curves are equal, 1 if they are not equal, or -1 on error. |
aafbe1cc | 231 | |
df3d1e84 | 232 | EC_GROUP_get_basis_type() returns the values NID_X9_62_tpBasis or NID_X9_62_ppBasis (as defined in <openssl/obj_mac.h>) for a |
aafbe1cc MC |
233 | trinomial or pentanomial respectively. Alternatively in the event of an error a 0 is returned. |
234 | ||
235 | =head1 SEE ALSO | |
236 | ||
9e183d22 | 237 | L<crypto(7)>, L<EC_GROUP_new(3)>, |
9b86974e RS |
238 | L<EC_POINT_new(3)>, L<EC_POINT_add(3)>, L<EC_KEY_new(3)>, |
239 | L<EC_GFp_simple_method(3)>, L<d2i_ECPKParameters(3)> | |
aafbe1cc | 240 | |
8402cd5f SL |
241 | =head1 HISTORY |
242 | ||
23ccae80 BB |
243 | EC_GROUP_method_of() was deprecated in OpenSSL 3.0. |
244 | ||
245 | EC_GROUP_check_named_curve() and EC_GROUP_get_field_type() were added in OpenSSL 3.0. | |
8402cd5f | 246 | |
e2f92610 RS |
247 | =head1 COPYRIGHT |
248 | ||
37f03b98 | 249 | Copyright 2013-2019 The OpenSSL Project Authors. All Rights Reserved. |
e2f92610 | 250 | |
4746f25a | 251 | Licensed under the Apache License 2.0 (the "License"). You may not use |
e2f92610 RS |
252 | this file except in compliance with the License. You can obtain a copy |
253 | in the file LICENSE in the source distribution or at | |
254 | L<https://www.openssl.org/source/license.html>. | |
255 | ||
256 | =cut |