]> git.ipfire.org Git - thirdparty/openssl.git/blob - crypto/ec/ec_lib.c
projects / thirdparty / openssl.git / blob
? search:


1b2ddc2b4437632a49caec8ebb3ce365d751e801
[thirdparty/openssl.git] / crypto / ec / ec_lib.c
1 /*
2 * Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4 *
5 * Licensed under the Apache License 2.0 (the "License"). You may not use
6 * this file except in compliance with the License. You can obtain a copy
7 * in the file LICENSE in the source distribution or at
8 * https://www.openssl.org/source/license.html
9 */
10
11 /*
12 * ECDSA low level APIs are deprecated for public use, but still ok for
13 * internal use.
14 */
15 #include "internal/deprecated.h"
16
17 #include <string.h>
18
19 #include <openssl/err.h>
20 #include <openssl/opensslv.h>
21
22 #include "ec_local.h"
23
24 /* functions for EC_GROUP objects */
25
26 EC_GROUP *EC_GROUP_new_ex(OPENSSL_CTX *libctx, const EC_METHOD *meth)
27 {
28 EC_GROUP *ret;
29
30 if (meth == NULL) {
31 ECerr(EC_F_EC_GROUP_NEW_EX, EC_R_SLOT_FULL);
32 return NULL;
33 }
34 if (meth->group_init == 0) {
35 ECerr(EC_F_EC_GROUP_NEW_EX, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
36 return NULL;
37 }
38
39 ret = OPENSSL_zalloc(sizeof(*ret));
40 if (ret == NULL) {
41 ECerr(EC_F_EC_GROUP_NEW_EX, ERR_R_MALLOC_FAILURE);
42 return NULL;
43 }
44
45 ret->libctx = libctx;
46 ret->meth = meth;
47 if ((ret->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {
48 ret->order = BN_new();
49 if (ret->order == NULL)
50 goto err;
51 ret->cofactor = BN_new();
52 if (ret->cofactor == NULL)
53 goto err;
54 }
55 ret->asn1_flag = OPENSSL_EC_NAMED_CURVE;
56 ret->asn1_form = POINT_CONVERSION_UNCOMPRESSED;
57 if (!meth->group_init(ret))
58 goto err;
59 return ret;
60
61 err:
62 BN_free(ret->order);
63 BN_free(ret->cofactor);
64 OPENSSL_free(ret);
65 return NULL;
66 }
67
68 #ifndef FIPS_MODULE
69 EC_GROUP *EC_GROUP_new(const EC_METHOD *meth)
70 {
71 return EC_GROUP_new_ex(NULL, meth);
72 }
73 #endif
74
75 void EC_pre_comp_free(EC_GROUP *group)
76 {
77 switch (group->pre_comp_type) {
78 case PCT_none:
79 break;
80 case PCT_nistz256:
81 #ifdef ECP_NISTZ256_ASM
82 EC_nistz256_pre_comp_free(group->pre_comp.nistz256);
83 #endif
84 break;
85 #ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
86 case PCT_nistp224:
87 EC_nistp224_pre_comp_free(group->pre_comp.nistp224);
88 break;
89 case PCT_nistp256:
90 EC_nistp256_pre_comp_free(group->pre_comp.nistp256);
91 break;
92 case PCT_nistp521:
93 EC_nistp521_pre_comp_free(group->pre_comp.nistp521);
94 break;
95 #else
96 case PCT_nistp224:
97 case PCT_nistp256:
98 case PCT_nistp521:
99 break;
100 #endif
101 case PCT_ec:
102 EC_ec_pre_comp_free(group->pre_comp.ec);
103 break;
104 }
105 group->pre_comp.ec = NULL;
106 }
107
108 void EC_GROUP_free(EC_GROUP *group)
109 {
110 if (!group)
111 return;
112
113 if (group->meth->group_finish != 0)
114 group->meth->group_finish(group);
115
116 EC_pre_comp_free(group);
117 BN_MONT_CTX_free(group->mont_data);
118 EC_POINT_free(group->generator);
119 BN_free(group->order);
120 BN_free(group->cofactor);
121 OPENSSL_free(group->seed);
122 OPENSSL_free(group);
123 }
124
125 #ifndef OPENSSL_NO_DEPRECATED_3_0
126 void EC_GROUP_clear_free(EC_GROUP *group)
127 {
128 if (!group)
129 return;
130
131 if (group->meth->group_clear_finish != 0)
132 group->meth->group_clear_finish(group);
133 else if (group->meth->group_finish != 0)
134 group->meth->group_finish(group);
135
136 EC_pre_comp_free(group);
137 BN_MONT_CTX_free(group->mont_data);
138 EC_POINT_clear_free(group->generator);
139 BN_clear_free(group->order);
140 BN_clear_free(group->cofactor);
141 OPENSSL_clear_free(group->seed, group->seed_len);
142 OPENSSL_clear_free(group, sizeof(*group));
143 }
144 #endif
145
146 int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
147 {
148 if (dest->meth->group_copy == 0) {
149 ECerr(EC_F_EC_GROUP_COPY, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
150 return 0;
151 }
152 if (dest->meth != src->meth) {
153 ECerr(EC_F_EC_GROUP_COPY, EC_R_INCOMPATIBLE_OBJECTS);
154 return 0;
155 }
156 if (dest == src)
157 return 1;
158
159 dest->libctx = src->libctx;
160 dest->curve_name = src->curve_name;
161
162 /* Copy precomputed */
163 dest->pre_comp_type = src->pre_comp_type;
164 switch (src->pre_comp_type) {
165 case PCT_none:
166 dest->pre_comp.ec = NULL;
167 break;
168 case PCT_nistz256:
169 #ifdef ECP_NISTZ256_ASM
170 dest->pre_comp.nistz256 = EC_nistz256_pre_comp_dup(src->pre_comp.nistz256);
171 #endif
172 break;
173 #ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
174 case PCT_nistp224:
175 dest->pre_comp.nistp224 = EC_nistp224_pre_comp_dup(src->pre_comp.nistp224);
176 break;
177 case PCT_nistp256:
178 dest->pre_comp.nistp256 = EC_nistp256_pre_comp_dup(src->pre_comp.nistp256);
179 break;
180 case PCT_nistp521:
181 dest->pre_comp.nistp521 = EC_nistp521_pre_comp_dup(src->pre_comp.nistp521);
182 break;
183 #else
184 case PCT_nistp224:
185 case PCT_nistp256:
186 case PCT_nistp521:
187 break;
188 #endif
189 case PCT_ec:
190 dest->pre_comp.ec = EC_ec_pre_comp_dup(src->pre_comp.ec);
191 break;
192 }
193
194 if (src->mont_data != NULL) {
195 if (dest->mont_data == NULL) {
196 dest->mont_data = BN_MONT_CTX_new();
197 if (dest->mont_data == NULL)
198 return 0;
199 }
200 if (!BN_MONT_CTX_copy(dest->mont_data, src->mont_data))
201 return 0;
202 } else {
203 /* src->generator == NULL */
204 BN_MONT_CTX_free(dest->mont_data);
205 dest->mont_data = NULL;
206 }
207
208 if (src->generator != NULL) {
209 if (dest->generator == NULL) {
210 dest->generator = EC_POINT_new(dest);
211 if (dest->generator == NULL)
212 return 0;
213 }
214 if (!EC_POINT_copy(dest->generator, src->generator))
215 return 0;
216 } else {
217 /* src->generator == NULL */
218 EC_POINT_clear_free(dest->generator);
219 dest->generator = NULL;
220 }
221
222 if ((src->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {
223 if (!BN_copy(dest->order, src->order))
224 return 0;
225 if (!BN_copy(dest->cofactor, src->cofactor))
226 return 0;
227 }
228
229 dest->asn1_flag = src->asn1_flag;
230 dest->asn1_form = src->asn1_form;
231
232 if (src->seed) {
233 OPENSSL_free(dest->seed);
234 if ((dest->seed = OPENSSL_malloc(src->seed_len)) == NULL) {
235 ECerr(EC_F_EC_GROUP_COPY, ERR_R_MALLOC_FAILURE);
236 return 0;
237 }
238 if (!memcpy(dest->seed, src->seed, src->seed_len))
239 return 0;
240 dest->seed_len = src->seed_len;
241 } else {
242 OPENSSL_free(dest->seed);
243 dest->seed = NULL;
244 dest->seed_len = 0;
245 }
246
247 return dest->meth->group_copy(dest, src);
248 }
249
250 EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
251 {
252 EC_GROUP *t = NULL;
253 int ok = 0;
254
255 if (a == NULL)
256 return NULL;
257
258 if ((t = EC_GROUP_new_ex(a->libctx, a->meth)) == NULL)
259 return NULL;
260 if (!EC_GROUP_copy(t, a))
261 goto err;
262
263 ok = 1;
264
265 err:
266 if (!ok) {
267 EC_GROUP_free(t);
268 return NULL;
269 }
270 return t;
271 }
272
273 const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *group)
274 {
275 return group->meth;
276 }
277
278 int EC_METHOD_get_field_type(const EC_METHOD *meth)
279 {
280 return meth->field_type;
281 }
282
283 static int ec_precompute_mont_data(EC_GROUP *);
284
285 /*-
286 * Try computing cofactor from the generator order (n) and field cardinality (q).
287 * This works for all curves of cryptographic interest.
288 *
289 * Hasse thm: q + 1 - 2*sqrt(q) <= n*h <= q + 1 + 2*sqrt(q)
290 * h_min = (q + 1 - 2*sqrt(q))/n
291 * h_max = (q + 1 + 2*sqrt(q))/n
292 * h_max - h_min = 4*sqrt(q)/n
293 * So if n > 4*sqrt(q) holds, there is only one possible value for h:
294 * h = \lfloor (h_min + h_max)/2 \rceil = \lfloor (q + 1)/n \rceil
295 *
296 * Otherwise, zero cofactor and return success.
297 */
298 static int ec_guess_cofactor(EC_GROUP *group) {
299 int ret = 0;
300 BN_CTX *ctx = NULL;
301 BIGNUM *q = NULL;
302
303 /*-
304 * If the cofactor is too large, we cannot guess it.
305 * The RHS of below is a strict overestimate of lg(4 * sqrt(q))
306 */
307 if (BN_num_bits(group->order) <= (BN_num_bits(group->field) + 1) / 2 + 3) {
308 /* default to 0 */
309 BN_zero(group->cofactor);
310 /* return success */
311 return 1;
312 }
313
314 if ((ctx = BN_CTX_new_ex(group->libctx)) == NULL)
315 return 0;
316
317 BN_CTX_start(ctx);
318 if ((q = BN_CTX_get(ctx)) == NULL)
319 goto err;
320
321 /* set q = 2**m for binary fields; q = p otherwise */
322 if (group->meth->field_type == NID_X9_62_characteristic_two_field) {
323 BN_zero(q);
324 if (!BN_set_bit(q, BN_num_bits(group->field) - 1))
325 goto err;
326 } else {
327 if (!BN_copy(q, group->field))
328 goto err;
329 }
330
331 /* compute h = \lfloor (q + 1)/n \rceil = \lfloor (q + 1 + n/2)/n \rfloor */
332 if (!BN_rshift1(group->cofactor, group->order) /* n/2 */
333 || !BN_add(group->cofactor, group->cofactor, q) /* q + n/2 */
334 /* q + 1 + n/2 */
335 || !BN_add(group->cofactor, group->cofactor, BN_value_one())
336 /* (q + 1 + n/2)/n */
337 || !BN_div(group->cofactor, NULL, group->cofactor, group->order, ctx))
338 goto err;
339 ret = 1;
340 err:
341 BN_CTX_end(ctx);
342 BN_CTX_free(ctx);
343 return ret;
344 }
345
346 int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
347 const BIGNUM *order, const BIGNUM *cofactor)
348 {
349 if (generator == NULL) {
350 ECerr(EC_F_EC_GROUP_SET_GENERATOR, ERR_R_PASSED_NULL_PARAMETER);
351 return 0;
352 }
353
354 /* require group->field >= 1 */
355 if (group->field == NULL || BN_is_zero(group->field)
356 || BN_is_negative(group->field)) {
357 ECerr(EC_F_EC_GROUP_SET_GENERATOR, EC_R_INVALID_FIELD);
358 return 0;
359 }
360
361 /*-
362 * - require order >= 1
363 * - enforce upper bound due to Hasse thm: order can be no more than one bit
364 * longer than field cardinality
365 */
366 if (order == NULL || BN_is_zero(order) || BN_is_negative(order)
367 || BN_num_bits(order) > BN_num_bits(group->field) + 1) {
368 ECerr(EC_F_EC_GROUP_SET_GENERATOR, EC_R_INVALID_GROUP_ORDER);
369 return 0;
370 }
371
372 /*-
373 * Unfortunately the cofactor is an optional field in many standards.
374 * Internally, the lib uses 0 cofactor as a marker for "unknown cofactor".
375 * So accept cofactor == NULL or cofactor >= 0.
376 */
377 if (cofactor != NULL && BN_is_negative(cofactor)) {
378 ECerr(EC_F_EC_GROUP_SET_GENERATOR, EC_R_UNKNOWN_COFACTOR);
379 return 0;
380 }
381
382 if (group->generator == NULL) {
383 group->generator = EC_POINT_new(group);
384 if (group->generator == NULL)
385 return 0;
386 }
387 if (!EC_POINT_copy(group->generator, generator))
388 return 0;
389
390 if (!BN_copy(group->order, order))
391 return 0;
392
393 /* Either take the provided positive cofactor, or try to compute it */
394 if (cofactor != NULL && !BN_is_zero(cofactor)) {
395 if (!BN_copy(group->cofactor, cofactor))
396 return 0;
397 } else if (!ec_guess_cofactor(group)) {
398 BN_zero(group->cofactor);
399 return 0;
400 }
401
402 /*
403 * Some groups have an order with
404 * factors of two, which makes the Montgomery setup fail.
405 * |group->mont_data| will be NULL in this case.
406 */
407 if (BN_is_odd(group->order)) {
408 return ec_precompute_mont_data(group);
409 }
410
411 BN_MONT_CTX_free(group->mont_data);
412 group->mont_data = NULL;
413 return 1;
414 }
415
416 const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group)
417 {
418 return group->generator;
419 }
420
421 BN_MONT_CTX *EC_GROUP_get_mont_data(const EC_GROUP *group)
422 {
423 return group->mont_data;
424 }
425
426 int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx)
427 {
428 if (group->order == NULL)
429 return 0;
430 if (!BN_copy(order, group->order))
431 return 0;
432
433 return !BN_is_zero(order);
434 }
435
436 const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group)
437 {
438 return group->order;
439 }
440
441 int EC_GROUP_order_bits(const EC_GROUP *group)
442 {
443 return group->meth->group_order_bits(group);
444 }
445
446 int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor,
447 BN_CTX *ctx)
448 {
449
450 if (group->cofactor == NULL)
451 return 0;
452 if (!BN_copy(cofactor, group->cofactor))
453 return 0;
454
455 return !BN_is_zero(group->cofactor);
456 }
457
458 const BIGNUM *EC_GROUP_get0_cofactor(const EC_GROUP *group)
459 {
460 return group->cofactor;
461 }
462
463 void EC_GROUP_set_curve_name(EC_GROUP *group, int nid)
464 {
465 group->curve_name = nid;
466 }
467
468 int EC_GROUP_get_curve_name(const EC_GROUP *group)
469 {
470 return group->curve_name;
471 }
472
473 const BIGNUM *EC_GROUP_get0_field(const EC_GROUP *group)
474 {
475 return group->field;
476 }
477
478 void EC_GROUP_set_asn1_flag(EC_GROUP *group, int flag)
479 {
480 group->asn1_flag = flag;
481 }
482
483 int EC_GROUP_get_asn1_flag(const EC_GROUP *group)
484 {
485 return group->asn1_flag;
486 }
487
488 void EC_GROUP_set_point_conversion_form(EC_GROUP *group,
489 point_conversion_form_t form)
490 {
491 group->asn1_form = form;
492 }
493
494 point_conversion_form_t EC_GROUP_get_point_conversion_form(const EC_GROUP
495 *group)
496 {
497 return group->asn1_form;
498 }
499
500 size_t EC_GROUP_set_seed(EC_GROUP *group, const unsigned char *p, size_t len)
501 {
502 OPENSSL_free(group->seed);
503 group->seed = NULL;
504 group->seed_len = 0;
505
506 if (!len || !p)
507 return 1;
508
509 if ((group->seed = OPENSSL_malloc(len)) == NULL) {
510 ECerr(EC_F_EC_GROUP_SET_SEED, ERR_R_MALLOC_FAILURE);
511 return 0;
512 }
513 memcpy(group->seed, p, len);
514 group->seed_len = len;
515
516 return len;
517 }
518
519 unsigned char *EC_GROUP_get0_seed(const EC_GROUP *group)
520 {
521 return group->seed;
522 }
523
524 size_t EC_GROUP_get_seed_len(const EC_GROUP *group)
525 {
526 return group->seed_len;
527 }
528
529 int EC_GROUP_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
530 const BIGNUM *b, BN_CTX *ctx)
531 {
532 if (group->meth->group_set_curve == 0) {
533 ECerr(EC_F_EC_GROUP_SET_CURVE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
534 return 0;
535 }
536 return group->meth->group_set_curve(group, p, a, b, ctx);
537 }
538
539 int EC_GROUP_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b,
540 BN_CTX *ctx)
541 {
542 if (group->meth->group_get_curve == NULL) {
543 ECerr(EC_F_EC_GROUP_GET_CURVE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
544 return 0;
545 }
546 return group->meth->group_get_curve(group, p, a, b, ctx);
547 }
548
549 #ifndef OPENSSL_NO_DEPRECATED_3_0
550 int EC_GROUP_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
551 const BIGNUM *b, BN_CTX *ctx)
552 {
553 return EC_GROUP_set_curve(group, p, a, b, ctx);
554 }
555
556 int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
557 BIGNUM *b, BN_CTX *ctx)
558 {
559 return EC_GROUP_get_curve(group, p, a, b, ctx);
560 }
561
562 # ifndef OPENSSL_NO_EC2M
563 int EC_GROUP_set_curve_GF2m(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
564 const BIGNUM *b, BN_CTX *ctx)
565 {
566 return EC_GROUP_set_curve(group, p, a, b, ctx);
567 }
568
569 int EC_GROUP_get_curve_GF2m(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
570 BIGNUM *b, BN_CTX *ctx)
571 {
572 return EC_GROUP_get_curve(group, p, a, b, ctx);
573 }
574 # endif
575 #endif
576
577 int EC_GROUP_get_degree(const EC_GROUP *group)
578 {
579 if (group->meth->group_get_degree == 0) {
580 ECerr(EC_F_EC_GROUP_GET_DEGREE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
581 return 0;
582 }
583 return group->meth->group_get_degree(group);
584 }
585
586 int EC_GROUP_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
587 {
588 if (group->meth->group_check_discriminant == 0) {
589 ECerr(EC_F_EC_GROUP_CHECK_DISCRIMINANT,
590 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
591 return 0;
592 }
593 return group->meth->group_check_discriminant(group, ctx);
594 }
595
596 int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx)
597 {
598 int r = 0;
599 BIGNUM *a1, *a2, *a3, *b1, *b2, *b3;
600 #ifndef FIPS_MODULE
601 BN_CTX *ctx_new = NULL;
602 #endif
603
604 /* compare the field types */
605 if (EC_METHOD_get_field_type(EC_GROUP_method_of(a)) !=
606 EC_METHOD_get_field_type(EC_GROUP_method_of(b)))
607 return 1;
608 /* compare the curve name (if present in both) */
609 if (EC_GROUP_get_curve_name(a) && EC_GROUP_get_curve_name(b) &&
610 EC_GROUP_get_curve_name(a) != EC_GROUP_get_curve_name(b))
611 return 1;
612 if (a->meth->flags & EC_FLAGS_CUSTOM_CURVE)
613 return 0;
614
615 #ifndef FIPS_MODULE
616 if (ctx == NULL)
617 ctx_new = ctx = BN_CTX_new();
618 #endif
619 if (ctx == NULL)
620 return -1;
621
622 BN_CTX_start(ctx);
623 a1 = BN_CTX_get(ctx);
624 a2 = BN_CTX_get(ctx);
625 a3 = BN_CTX_get(ctx);
626 b1 = BN_CTX_get(ctx);
627 b2 = BN_CTX_get(ctx);
628 b3 = BN_CTX_get(ctx);
629 if (b3 == NULL) {
630 BN_CTX_end(ctx);
631 #ifndef FIPS_MODULE
632 BN_CTX_free(ctx_new);
633 #endif
634 return -1;
635 }
636
637 /*
638 * XXX This approach assumes that the external representation of curves
639 * over the same field type is the same.
640 */
641 if (!a->meth->group_get_curve(a, a1, a2, a3, ctx) ||
642 !b->meth->group_get_curve(b, b1, b2, b3, ctx))
643 r = 1;
644
645 /* return 1 if the curve parameters are different */
646 if (r || BN_cmp(a1, b1) != 0 || BN_cmp(a2, b2) != 0 || BN_cmp(a3, b3) != 0)
647 r = 1;
648
649 /* XXX EC_POINT_cmp() assumes that the methods are equal */
650 /* return 1 if the generators are different */
651 if (r || EC_POINT_cmp(a, EC_GROUP_get0_generator(a),
652 EC_GROUP_get0_generator(b), ctx) != 0)
653 r = 1;
654
655 if (!r) {
656 const BIGNUM *ao, *bo, *ac, *bc;
657 /* compare the orders */
658 ao = EC_GROUP_get0_order(a);
659 bo = EC_GROUP_get0_order(b);
660 if (ao == NULL || bo == NULL) {
661 /* return an error if either order is NULL */
662 r = -1;
663 goto end;
664 }
665 if (BN_cmp(ao, bo) != 0) {
666 /* return 1 if orders are different */
667 r = 1;
668 goto end;
669 }
670 /*
671 * It gets here if the curve parameters and generator matched.
672 * Now check the optional cofactors (if both are present).
673 */
674 ac = EC_GROUP_get0_cofactor(a);
675 bc = EC_GROUP_get0_cofactor(b);
676 /* Returns 1 (mismatch) if both cofactors are specified and different */
677 if (!BN_is_zero(ac) && !BN_is_zero(bc) && BN_cmp(ac, bc) != 0)
678 r = 1;
679 /* Returns 0 if the parameters matched */
680 }
681 end:
682 BN_CTX_end(ctx);
683 #ifndef FIPS_MODULE
684 BN_CTX_free(ctx_new);
685 #endif
686 return r;
687 }
688
689 /* functions for EC_POINT objects */
690
691 EC_POINT *EC_POINT_new(const EC_GROUP *group)
692 {
693 EC_POINT *ret;
694
695 if (group == NULL) {
696 ECerr(EC_F_EC_POINT_NEW, ERR_R_PASSED_NULL_PARAMETER);
697 return NULL;
698 }
699 if (group->meth->point_init == NULL) {
700 ECerr(EC_F_EC_POINT_NEW, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
701 return NULL;
702 }
703
704 ret = OPENSSL_zalloc(sizeof(*ret));
705 if (ret == NULL) {
706 ECerr(EC_F_EC_POINT_NEW, ERR_R_MALLOC_FAILURE);
707 return NULL;
708 }
709
710 ret->meth = group->meth;
711 ret->curve_name = group->curve_name;
712
713 if (!ret->meth->point_init(ret)) {
714 OPENSSL_free(ret);
715 return NULL;
716 }
717
718 return ret;
719 }
720
721 void EC_POINT_free(EC_POINT *point)
722 {
723 if (point == NULL)
724 return;
725
726 if (point->meth->point_finish != 0)
727 point->meth->point_finish(point);
728 OPENSSL_free(point);
729 }
730
731 void EC_POINT_clear_free(EC_POINT *point)
732 {
733 if (point == NULL)
734 return;
735
736 if (point->meth->point_clear_finish != 0)
737 point->meth->point_clear_finish(point);
738 else if (point->meth->point_finish != 0)
739 point->meth->point_finish(point);
740 OPENSSL_clear_free(point, sizeof(*point));
741 }
742
743 int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src)
744 {
745 if (dest->meth->point_copy == 0) {
746 ECerr(EC_F_EC_POINT_COPY, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
747 return 0;
748 }
749 if (dest->meth != src->meth
750 || (dest->curve_name != src->curve_name
751 && dest->curve_name != 0
752 && src->curve_name != 0)) {
753 ECerr(EC_F_EC_POINT_COPY, EC_R_INCOMPATIBLE_OBJECTS);
754 return 0;
755 }
756 if (dest == src)
757 return 1;
758 return dest->meth->point_copy(dest, src);
759 }
760
761 EC_POINT *EC_POINT_dup(const EC_POINT *a, const EC_GROUP *group)
762 {
763 EC_POINT *t;
764 int r;
765
766 if (a == NULL)
767 return NULL;
768
769 t = EC_POINT_new(group);
770 if (t == NULL)
771 return NULL;
772 r = EC_POINT_copy(t, a);
773 if (!r) {
774 EC_POINT_free(t);
775 return NULL;
776 }
777 return t;
778 }
779
780 const EC_METHOD *EC_POINT_method_of(const EC_POINT *point)
781 {
782 return point->meth;
783 }
784
785 int EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point)
786 {
787 if (group->meth->point_set_to_infinity == 0) {
788 ECerr(EC_F_EC_POINT_SET_TO_INFINITY,
789 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
790 return 0;
791 }
792 if (group->meth != point->meth) {
793 ECerr(EC_F_EC_POINT_SET_TO_INFINITY, EC_R_INCOMPATIBLE_OBJECTS);
794 return 0;
795 }
796 return group->meth->point_set_to_infinity(group, point);
797 }
798
799 #ifndef OPENSSL_NO_DEPRECATED_3_0
800 int EC_POINT_set_Jprojective_coordinates_GFp(const EC_GROUP *group,
801 EC_POINT *point, const BIGNUM *x,
802 const BIGNUM *y, const BIGNUM *z,
803 BN_CTX *ctx)
804 {
805 if (group->meth->field_type != NID_X9_62_prime_field) {
806 ECerr(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP,
807 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
808 return 0;
809 }
810 if (!ec_point_is_compat(point, group)) {
811 ECerr(EC_F_EC_POINT_SET_JPROJECTIVE_COORDINATES_GFP,
812 EC_R_INCOMPATIBLE_OBJECTS);
813 return 0;
814 }
815 return ec_GFp_simple_set_Jprojective_coordinates_GFp(group, point, x, y, z, ctx);
816 }
817
818 int EC_POINT_get_Jprojective_coordinates_GFp(const EC_GROUP *group,
819 const EC_POINT *point, BIGNUM *x,
820 BIGNUM *y, BIGNUM *z,
821 BN_CTX *ctx)
822 {
823 if (group->meth->field_type != NID_X9_62_prime_field) {
824 ECerr(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP,
825 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
826 return 0;
827 }
828 if (!ec_point_is_compat(point, group)) {
829 ECerr(EC_F_EC_POINT_GET_JPROJECTIVE_COORDINATES_GFP,
830 EC_R_INCOMPATIBLE_OBJECTS);
831 return 0;
832 }
833 return ec_GFp_simple_get_Jprojective_coordinates_GFp(group, point, x, y, z, ctx);
834 }
835 #endif
836
837 int EC_POINT_set_affine_coordinates(const EC_GROUP *group, EC_POINT *point,
838 const BIGNUM *x, const BIGNUM *y,
839 BN_CTX *ctx)
840 {
841 if (group->meth->point_set_affine_coordinates == NULL) {
842 ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES,
843 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
844 return 0;
845 }
846 if (!ec_point_is_compat(point, group)) {
847 ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES, EC_R_INCOMPATIBLE_OBJECTS);
848 return 0;
849 }
850 if (!group->meth->point_set_affine_coordinates(group, point, x, y, ctx))
851 return 0;
852
853 if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
854 ECerr(EC_F_EC_POINT_SET_AFFINE_COORDINATES, EC_R_POINT_IS_NOT_ON_CURVE);
855 return 0;
856 }
857 return 1;
858 }
859
860 #ifndef OPENSSL_NO_DEPRECATED_3_0
861 int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group,
862 EC_POINT *point, const BIGNUM *x,
863 const BIGNUM *y, BN_CTX *ctx)
864 {
865 return EC_POINT_set_affine_coordinates(group, point, x, y, ctx);
866 }
867
868 # ifndef OPENSSL_NO_EC2M
869 int EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP *group,
870 EC_POINT *point, const BIGNUM *x,
871 const BIGNUM *y, BN_CTX *ctx)
872 {
873 return EC_POINT_set_affine_coordinates(group, point, x, y, ctx);
874 }
875 # endif
876 #endif
877
878 int EC_POINT_get_affine_coordinates(const EC_GROUP *group,
879 const EC_POINT *point, BIGNUM *x, BIGNUM *y,
880 BN_CTX *ctx)
881 {
882 if (group->meth->point_get_affine_coordinates == NULL) {
883 ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES,
884 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
885 return 0;
886 }
887 if (!ec_point_is_compat(point, group)) {
888 ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES, EC_R_INCOMPATIBLE_OBJECTS);
889 return 0;
890 }
891 if (EC_POINT_is_at_infinity(group, point)) {
892 ECerr(EC_F_EC_POINT_GET_AFFINE_COORDINATES, EC_R_POINT_AT_INFINITY);
893 return 0;
894 }
895 return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
896 }
897
898 #ifndef OPENSSL_NO_DEPRECATED_3_0
899 int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group,
900 const EC_POINT *point, BIGNUM *x,
901 BIGNUM *y, BN_CTX *ctx)
902 {
903 return EC_POINT_get_affine_coordinates(group, point, x, y, ctx);
904 }
905
906 # ifndef OPENSSL_NO_EC2M
907 int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *group,
908 const EC_POINT *point, BIGNUM *x,
909 BIGNUM *y, BN_CTX *ctx)
910 {
911 return EC_POINT_get_affine_coordinates(group, point, x, y, ctx);
912 }
913 # endif
914 #endif
915
916 int EC_POINT_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
917 const EC_POINT *b, BN_CTX *ctx)
918 {
919 if (group->meth->add == 0) {
920 ECerr(EC_F_EC_POINT_ADD, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
921 return 0;
922 }
923 if (!ec_point_is_compat(r, group) || !ec_point_is_compat(a, group)
924 || !ec_point_is_compat(b, group)) {
925 ECerr(EC_F_EC_POINT_ADD, EC_R_INCOMPATIBLE_OBJECTS);
926 return 0;
927 }
928 return group->meth->add(group, r, a, b, ctx);
929 }
930
931 int EC_POINT_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
932 BN_CTX *ctx)
933 {
934 if (group->meth->dbl == 0) {
935 ECerr(EC_F_EC_POINT_DBL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
936 return 0;
937 }
938 if (!ec_point_is_compat(r, group) || !ec_point_is_compat(a, group)) {
939 ECerr(EC_F_EC_POINT_DBL, EC_R_INCOMPATIBLE_OBJECTS);
940 return 0;
941 }
942 return group->meth->dbl(group, r, a, ctx);
943 }
944
945 int EC_POINT_invert(const EC_GROUP *group, EC_POINT *a, BN_CTX *ctx)
946 {
947 if (group->meth->invert == 0) {
948 ECerr(EC_F_EC_POINT_INVERT, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
949 return 0;
950 }
951 if (!ec_point_is_compat(a, group)) {
952 ECerr(EC_F_EC_POINT_INVERT, EC_R_INCOMPATIBLE_OBJECTS);
953 return 0;
954 }
955 return group->meth->invert(group, a, ctx);
956 }
957
958 int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
959 {
960 if (group->meth->is_at_infinity == 0) {
961 ECerr(EC_F_EC_POINT_IS_AT_INFINITY,
962 ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
963 return 0;
964 }
965 if (!ec_point_is_compat(point, group)) {
966 ECerr(EC_F_EC_POINT_IS_AT_INFINITY, EC_R_INCOMPATIBLE_OBJECTS);
967 return 0;
968 }
969 return group->meth->is_at_infinity(group, point);
970 }
971
972 /*
973 * Check whether an EC_POINT is on the curve or not. Note that the return
974 * value for this function should NOT be treated as a boolean. Return values:
975 * 1: The point is on the curve
976 * 0: The point is not on the curve
977 * -1: An error occurred
978 */
979 int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
980 BN_CTX *ctx)
981 {
982 if (group->meth->is_on_curve == 0) {
983 ECerr(EC_F_EC_POINT_IS_ON_CURVE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
984 return 0;
985 }
986 if (!ec_point_is_compat(point, group)) {
987 ECerr(EC_F_EC_POINT_IS_ON_CURVE, EC_R_INCOMPATIBLE_OBJECTS);
988 return 0;
989 }
990 return group->meth->is_on_curve(group, point, ctx);
991 }
992
993 int EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b,
994 BN_CTX *ctx)
995 {
996 if (group->meth->point_cmp == 0) {
997 ECerr(EC_F_EC_POINT_CMP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
998 return -1;
999 }
1000 if (!ec_point_is_compat(a, group) || !ec_point_is_compat(b, group)) {
1001 ECerr(EC_F_EC_POINT_CMP, EC_R_INCOMPATIBLE_OBJECTS);
1002 return -1;
1003 }
1004 return group->meth->point_cmp(group, a, b, ctx);
1005 }
1006
1007 #ifndef OPENSSL_NO_DEPRECATED_3_0
1008 int EC_POINT_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx)
1009 {
1010 if (group->meth->make_affine == 0) {
1011 ECerr(EC_F_EC_POINT_MAKE_AFFINE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1012 return 0;
1013 }
1014 if (!ec_point_is_compat(point, group)) {
1015 ECerr(EC_F_EC_POINT_MAKE_AFFINE, EC_R_INCOMPATIBLE_OBJECTS);
1016 return 0;
1017 }
1018 return group->meth->make_affine(group, point, ctx);
1019 }
1020
1021 int EC_POINTs_make_affine(const EC_GROUP *group, size_t num,
1022 EC_POINT *points[], BN_CTX *ctx)
1023 {
1024 size_t i;
1025
1026 if (group->meth->points_make_affine == 0) {
1027 ECerr(EC_F_EC_POINTS_MAKE_AFFINE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1028 return 0;
1029 }
1030 for (i = 0; i < num; i++) {
1031 if (!ec_point_is_compat(points[i], group)) {
1032 ECerr(EC_F_EC_POINTS_MAKE_AFFINE, EC_R_INCOMPATIBLE_OBJECTS);
1033 return 0;
1034 }
1035 }
1036 return group->meth->points_make_affine(group, num, points, ctx);
1037 }
1038 #endif
1039
1040 /*
1041 * Functions for point multiplication. If group->meth->mul is 0, we use the
1042 * wNAF-based implementations in ec_mult.c; otherwise we dispatch through
1043 * methods.
1044 */
1045
1046 #ifndef OPENSSL_NO_DEPRECATED_3_0
1047 int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
1048 size_t num, const EC_POINT *points[],
1049 const BIGNUM *scalars[], BN_CTX *ctx)
1050 {
1051 int ret = 0;
1052 size_t i = 0;
1053 #ifndef FIPS_MODULE
1054 BN_CTX *new_ctx = NULL;
1055 #endif
1056
1057 if (!ec_point_is_compat(r, group)) {
1058 ECerr(EC_F_EC_POINTS_MUL, EC_R_INCOMPATIBLE_OBJECTS);
1059 return 0;
1060 }
1061
1062 if (scalar == NULL && num == 0)
1063 return EC_POINT_set_to_infinity(group, r);
1064
1065 for (i = 0; i < num; i++) {
1066 if (!ec_point_is_compat(points[i], group)) {
1067 ECerr(EC_F_EC_POINTS_MUL, EC_R_INCOMPATIBLE_OBJECTS);
1068 return 0;
1069 }
1070 }
1071
1072 #ifndef FIPS_MODULE
1073 if (ctx == NULL)
1074 ctx = new_ctx = BN_CTX_secure_new();
1075 #endif
1076 if (ctx == NULL) {
1077 ECerr(EC_F_EC_POINTS_MUL, ERR_R_INTERNAL_ERROR);
1078 return 0;
1079 }
1080
1081 if (group->meth->mul != NULL)
1082 ret = group->meth->mul(group, r, scalar, num, points, scalars, ctx);
1083 else
1084 /* use default */
1085 ret = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
1086
1087 #ifndef FIPS_MODULE
1088 BN_CTX_free(new_ctx);
1089 #endif
1090 return ret;
1091 }
1092 #endif
1093
1094 int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
1095 const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
1096 {
1097 int ret = 0;
1098 size_t num;
1099 #ifndef FIPS_MODULE
1100 BN_CTX *new_ctx = NULL;
1101 #endif
1102
1103 if (!ec_point_is_compat(r, group)
1104 || (point != NULL && !ec_point_is_compat(point, group))) {
1105 ECerr(EC_F_EC_POINT_MUL, EC_R_INCOMPATIBLE_OBJECTS);
1106 return 0;
1107 }
1108
1109 if (g_scalar == NULL && p_scalar == NULL)
1110 return EC_POINT_set_to_infinity(group, r);
1111
1112 #ifndef FIPS_MODULE
1113 if (ctx == NULL)
1114 ctx = new_ctx = BN_CTX_secure_new();
1115 #endif
1116 if (ctx == NULL) {
1117 ECerr(EC_F_EC_POINT_MUL, ERR_R_INTERNAL_ERROR);
1118 return 0;
1119 }
1120
1121 num = (point != NULL && p_scalar != NULL) ? 1 : 0;
1122 if (group->meth->mul != NULL)
1123 ret = group->meth->mul(group, r, g_scalar, num, &point, &p_scalar, ctx);
1124 else
1125 /* use default */
1126 ret = ec_wNAF_mul(group, r, g_scalar, num, &point, &p_scalar, ctx);
1127
1128 #ifndef FIPS_MODULE
1129 BN_CTX_free(new_ctx);
1130 #endif
1131 return ret;
1132 }
1133
1134 #ifndef OPENSSL_NO_DEPRECATED_3_0
1135 int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
1136 {
1137 if (group->meth->mul == 0)
1138 /* use default */
1139 return ec_wNAF_precompute_mult(group, ctx);
1140
1141 if (group->meth->precompute_mult != 0)
1142 return group->meth->precompute_mult(group, ctx);
1143 else
1144 return 1; /* nothing to do, so report success */
1145 }
1146
1147 int EC_GROUP_have_precompute_mult(const EC_GROUP *group)
1148 {
1149 if (group->meth->mul == 0)
1150 /* use default */
1151 return ec_wNAF_have_precompute_mult(group);
1152
1153 if (group->meth->have_precompute_mult != 0)
1154 return group->meth->have_precompute_mult(group);
1155 else
1156 return 0; /* cannot tell whether precomputation has
1157 * been performed */
1158 }
1159 #endif
1160
1161 /*
1162 * ec_precompute_mont_data sets |group->mont_data| from |group->order| and
1163 * returns one on success. On error it returns zero.
1164 */
1165 static int ec_precompute_mont_data(EC_GROUP *group)
1166 {
1167 BN_CTX *ctx = BN_CTX_new_ex(group->libctx);
1168 int ret = 0;
1169
1170 BN_MONT_CTX_free(group->mont_data);
1171 group->mont_data = NULL;
1172
1173 if (ctx == NULL)
1174 goto err;
1175
1176 group->mont_data = BN_MONT_CTX_new();
1177 if (group->mont_data == NULL)
1178 goto err;
1179
1180 if (!BN_MONT_CTX_set(group->mont_data, group->order, ctx)) {
1181 BN_MONT_CTX_free(group->mont_data);
1182 group->mont_data = NULL;
1183 goto err;
1184 }
1185
1186 ret = 1;
1187
1188 err:
1189
1190 BN_CTX_free(ctx);
1191 return ret;
1192 }
1193
1194 #ifndef FIPS_MODULE
1195 int EC_KEY_set_ex_data(EC_KEY *key, int idx, void *arg)
1196 {
1197 return CRYPTO_set_ex_data(&key->ex_data, idx, arg);
1198 }
1199
1200 void *EC_KEY_get_ex_data(const EC_KEY *key, int idx)
1201 {
1202 return CRYPTO_get_ex_data(&key->ex_data, idx);
1203 }
1204 #endif
1205
1206 int ec_group_simple_order_bits(const EC_GROUP *group)
1207 {
1208 if (group->order == NULL)
1209 return 0;
1210 return BN_num_bits(group->order);
1211 }
1212
1213 static int ec_field_inverse_mod_ord(const EC_GROUP *group, BIGNUM *r,
1214 const BIGNUM *x, BN_CTX *ctx)
1215 {
1216 BIGNUM *e = NULL;
1217 int ret = 0;
1218 #ifndef FIPS_MODULE
1219 BN_CTX *new_ctx = NULL;
1220 #endif
1221
1222 if (group->mont_data == NULL)
1223 return 0;
1224
1225 #ifndef FIPS_MODULE
1226 if (ctx == NULL)
1227 ctx = new_ctx = BN_CTX_secure_new();
1228 #endif
1229 if (ctx == NULL)
1230 return 0;
1231
1232 BN_CTX_start(ctx);
1233 if ((e = BN_CTX_get(ctx)) == NULL)
1234 goto err;
1235
1236 /*-
1237 * We want inverse in constant time, therefore we utilize the fact
1238 * order must be prime and use Fermats Little Theorem instead.
1239 */
1240 if (!BN_set_word(e, 2))
1241 goto err;
1242 if (!BN_sub(e, group->order, e))
1243 goto err;
1244 /*-
1245 * Exponent e is public.
1246 * No need for scatter-gather or BN_FLG_CONSTTIME.
1247 */
1248 if (!BN_mod_exp_mont(r, x, e, group->order, ctx, group->mont_data))
1249 goto err;
1250
1251 ret = 1;
1252
1253 err:
1254 BN_CTX_end(ctx);
1255 #ifndef FIPS_MODULE
1256 BN_CTX_free(new_ctx);
1257 #endif
1258 return ret;
1259 }
1260
1261 /*-
1262 * Default behavior, if group->meth->field_inverse_mod_ord is NULL:
1263 * - When group->order is even, this function returns an error.
1264 * - When group->order is otherwise composite, the correctness
1265 * of the output is not guaranteed.
1266 * - When x is outside the range [1, group->order), the correctness
1267 * of the output is not guaranteed.
1268 * - Otherwise, this function returns the multiplicative inverse in the
1269 * range [1, group->order).
1270 *
1271 * EC_METHODs must implement their own field_inverse_mod_ord for
1272 * other functionality.
1273 */
1274 int ec_group_do_inverse_ord(const EC_GROUP *group, BIGNUM *res,
1275 const BIGNUM *x, BN_CTX *ctx)
1276 {
1277 if (group->meth->field_inverse_mod_ord != NULL)
1278 return group->meth->field_inverse_mod_ord(group, res, x, ctx);
1279 else
1280 return ec_field_inverse_mod_ord(group, res, x, ctx);
1281 }
1282
1283 /*-
1284 * Coordinate blinding for EC_POINT.
1285 *
1286 * The underlying EC_METHOD can optionally implement this function:
1287 * underlying implementations should return 0 on errors, or 1 on
1288 * success.
1289 *
1290 * This wrapper returns 1 in case the underlying EC_METHOD does not
1291 * support coordinate blinding.
1292 */
1293 int ec_point_blind_coordinates(const EC_GROUP *group, EC_POINT *p, BN_CTX *ctx)
1294 {
1295 if (group->meth->blind_coordinates == NULL)
1296 return 1; /* ignore if not implemented */
1297
1298 return group->meth->blind_coordinates(group, p, ctx);
1299 }
A mirror of the official openssl repository