ecc_j_to_a interface change, optionally reduce x mod q.

diff --git a/ChangeLog b/ChangeLog
index 7919e7e0fe62dafaa88e39f968d3e579fef4dc42..be68acc18c8fd2969a63cbd8d37a3a473b42b1f7 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,15 @@
 2014-08-28  Niels Möller  <nisse@lysator.liu.se>
 
+       * ecc-j-to-a.c (ecc_j_to_a): For curves using redc, always convert
+       back from redc form. When producing x coordiante only optionally
+       reduce it modulo q. Completely changes the meaning of the "flags"
+       argument, and renames it to "op". Update all users of this
+       function or ecc->h_to_a.
+
+       * ecc-ecdsa-sign.c (ecc_ecdsa_sign): Use new ecc_j_to_a modulo q
+       feature.
+       * ecc-ecdsa-verify.c (ecc_ecdsa_verify): Likewise.
+
        * testsuite/symbols-test: Regexp fixes, to better filter out
        get_pc_thunk functions.
 

diff --git a/ecc-ecdsa-sign.c b/ecc-ecdsa-sign.c
index 19f4338c04232db18bb4cb8ffdd2364e02d833e0..4e0fbafcb317252e19b4ffe71d459e393b822667 100644 (file)
--- a/ecc-ecdsa-sign.c
+++ b/ecc-ecdsa-sign.c
@@ -79,13 +79,8 @@ ecc_ecdsa_sign (const struct ecc_curve *ecc,
   */
 
   ecc_mul_g (ecc, P, kp, P + 3*ecc->size);
-  /* x coordinate only */
-  ecc_j_to_a (ecc, 3, rp, P, P + 3*ecc->size);
-
-  /* We need to reduce x coordinate mod ecc->q. It should already
-     be < 2*ecc->q, so one subtraction should suffice. */
-  cy = mpn_sub_n (scratch, rp, ecc->q, ecc->size);
-  cnd_copy (cy == 0, rp, scratch, ecc->size);
+  /* x coordinate only, modulo q */
+  ecc_j_to_a (ecc, 2, rp, P, P + 3*ecc->size);
 
   /* Invert k, uses 5 * ecc->size including scratch */
   mpn_copyi (hp, kp, ecc->size);

diff --git a/ecc-ecdsa-verify.c b/ecc-ecdsa-verify.c
index 1310b3125c206ad1ae9ba6135b3fc0bcbd0ca2a4..797e73cda2e9d3db396f7f7d52c637d3dd5c6d17 100644 (file)
--- a/ecc-ecdsa-verify.c
+++ b/ecc-ecdsa-verify.c
@@ -144,10 +144,8 @@ ecc_ecdsa_verify (const struct ecc_curve *ecc,
       /* Total storage: 6*ecc->size + ECC_ADD_JJJ_ITCH (ecc->size) */
       ecc_add_jjj (ecc, P1, P1, P2, u1);
     }
-  ecc_j_to_a (ecc, 3, P2, P1, u1);
-
-  if (mpn_cmp (P2, ecc->q, ecc->size) >= 0)
-    mpn_sub_n (P2, P2, ecc->q, ecc->size);
+  /* x coordinate only, modulo q */
+  ecc_j_to_a (ecc, 2, P2, P1, u1);
 
   return (mpn_cmp (rp, P2, ecc->size) == 0);
 #undef P2

diff --git a/ecc-j-to-a.c b/ecc-j-to-a.c
index 0c0c84852f5c3457cff815884d99798d1e35eca3..e945929d549cc729ed0902df5027bf3534aa9747 100644 (file)
--- a/ecc-j-to-a.c
+++ b/ecc-j-to-a.c
@@ -47,7 +47,7 @@ ecc_j_to_a_itch (const struct ecc_curve *ecc)
 
 void
 ecc_j_to_a (const struct ecc_curve *ecc,
-           int flags,
+           int op,
            mp_limb_t *r, const mp_limb_t *p,
            mp_limb_t *scratch)
 {
@@ -79,17 +79,12 @@ ecc_j_to_a (const struct ecc_curve *ecc,
 
       ecc_modp_inv (ecc, izp, up, up + ecc->size);
 
-      if (flags & 1)
-       {
-         /* Divide this common factor by B */
-         mpn_copyi (izBp, izp, ecc->size);
-         mpn_zero (izBp + ecc->size, ecc->size);
-         ecc->redc (ecc, izBp);
+      /* Divide this common factor by B */
+      mpn_copyi (izBp, izp, ecc->size);
+      mpn_zero (izBp + ecc->size, ecc->size);
+      ecc->redc (ecc, izBp);
 
-         ecc_modp_mul (ecc, iz2p, izp, izBp);
-       }
-      else
-       ecc_modp_sqr (ecc, iz2p, izp);  
+      ecc_modp_mul (ecc, iz2p, izp, izBp);
     }
   else
     {
@@ -107,10 +102,19 @@ ecc_j_to_a (const struct ecc_curve *ecc,
   cy = mpn_sub_n (r, iz3p, ecc->p, ecc->size);
   cnd_copy (cy, r, iz3p, ecc->size);
 
-  if (flags & 2)
-    /* Skip y coordinate */
-    return;
-
+  if (op)
+    {
+      /* Skip y coordinate */
+      if (op > 1)
+       {
+         /* Also reduce the x coordinate mod ecc->q. It should
+            already be < 2*ecc->q, so one subtraction should
+            suffice. */
+         cy = mpn_sub_n (scratch, r, ecc->q, ecc->size);
+         cnd_copy (cy == 0, r, scratch, ecc->size);
+       }
+      return;
+    }
   ecc_modp_mul (ecc, iz3p, iz2p, izp);
   ecc_modp_mul (ecc, tp, iz3p, p + ecc->size);
   /* And a similar subtraction. */

diff --git a/ecc-point-mul-g.c b/ecc-point-mul-g.c
index bb9a2d760f48174ccb7903b2b1c967bc532773dc..7485fa2c0e48cba6dd1b46764f459542af1254be 100644 (file)
--- a/ecc-point-mul-g.c
+++ b/ecc-point-mul-g.c
@@ -54,5 +54,5 @@ ecc_point_mul_g (struct ecc_point *r, const struct ecc_scalar *n)
   TMP_ALLOC (scratch, itch);
 
   ecc->mul_g (ecc, scratch, n->p, scratch + 3*size);
-  ecc->h_to_a (ecc, 1, r->p, scratch, scratch + 3*size);
+  ecc->h_to_a (ecc, 0, r->p, scratch, scratch + 3*size);
 }

diff --git a/ecc-point-mul.c b/ecc-point-mul.c
index 2080b60815bcadeb1d91e615c91dd03f3e32b87a..d2ba9e8385feff85832c43b249d165b3f6c61ca7 100644 (file)
--- a/ecc-point-mul.c
+++ b/ecc-point-mul.c
@@ -53,6 +53,6 @@ ecc_point_mul (struct ecc_point *r, const struct ecc_scalar *n,
   assert (p->ecc == ecc);
 
   ecc->mul (ecc, scratch, n->p, p->p, scratch + 3*size);
-  ecc->h_to_a (ecc, 1, r->p, scratch, scratch + 3*size);
+  ecc->h_to_a (ecc, 0, r->p, scratch, scratch + 3*size);
   gmp_free_limbs (scratch, itch);
 }

diff --git a/ecc.h b/ecc.h
index 360d60b102195f94ece96a07bfa9f4466f10b319..2d8fc49f66c834e7884eb39775fcd4fdcbaf2033 100644 (file)
--- a/ecc.h
+++ b/ecc.h
@@ -146,11 +146,13 @@ ecc_point_mul_g (struct ecc_point *r, const struct ecc_scalar *n);
 \f
 /* Low-level interface */
   
-/* Points on a curve are represented as arrays of mp_limb_t. For some
-   curves, point coordinates are represented in montgomery form. We
-   use either affine coordinates x,y, or Jacobian coordinates X, Y, Z,
-   where x = X/Z^2 and y = X/Z^2.
-
+/* Points on a curve are represented as arrays of mp_limb_t, with
+   curve-specific representation. For the secp curves, we use Jacobian
+   coordinates (possibly in Montgomery for for mod multiplication).
+   For curve25519 we use homogeneous coordiantes on an equivalent
+   Edwards curve. The suffix "_h" denotes this internal
+   representation.
+   
    Since we use additive notation for the groups, the infinity point
    on the curve is denoted 0. The infinity point can be represented
    with x = y = 0 in affine coordinates, and Z = 0 in Jacobian
@@ -185,14 +187,15 @@ ecc_a_to_j (const struct ecc_curve *ecc,
            mp_limb_t *r, const mp_limb_t *p);
 
 /* Converts a point P in jacobian coordinates into a point R in affine
-   coordinates. If FLAGS has bit 0 set, and the curve uses montgomery
-   coordinates, also undo the montgomery conversion. If flags has bit
-   1 set, produce x coordinate only. */
+   coordinates. If op == 1, produce x coordinate only. If op == 2,
+   produce the x coordiante only, and in also it modulo q. FIXME: For
+   the public interface, have separate for the three cases, and use
+   this flag argument only for the internal ecc->h_to_a function. */
 mp_size_t
 ecc_j_to_a_itch (const struct ecc_curve *ecc);
 void
 ecc_j_to_a (const struct ecc_curve *ecc,
-           int flags,
+           int op,
            mp_limb_t *r, const mp_limb_t *p,
            mp_limb_t *scratch);
 

diff --git a/ecdsa-keygen.c b/ecdsa-keygen.c
index 613393db2933941daf93598bb3d85d47a9798125..d9f1240583c15d91d82190d0ed1d6995598b1903 100644 (file)
--- a/ecdsa-keygen.c
+++ b/ecdsa-keygen.c
@@ -56,5 +56,5 @@ ecdsa_generate_keypair (struct ecc_point *pub,
 
   ecc_modq_random (key->ecc, key->p, random_ctx, random, p);
   ecc_mul_g (pub->ecc, p, key->p, p + 3*pub->ecc->size);
-  ecc_j_to_a (pub->ecc, 1, pub->p, p, p + 3*pub->ecc->size);
+  ecc_j_to_a (pub->ecc, 0, pub->p, p, p + 3*pub->ecc->size);
 }

diff --git a/testsuite/ecc-mul-a-test.c b/testsuite/ecc-mul-a-test.c
index e182aacc44e45e0fe126590bf45ff1d95276d4e0..54421704e31d8c27a0cf2c81da577b3100cb6d43 100644 (file)
--- a/testsuite/ecc-mul-a-test.c
+++ b/testsuite/ecc-mul-a-test.c
@@ -32,7 +32,7 @@ test_main (void)
 
       n[0] = 1;
       ecc_mul_a (ecc, p, n, ecc->g, scratch);
-      ecc_j_to_a (ecc, 1, p, p, scratch);
+      ecc_j_to_a (ecc, 0, p, p, scratch);
 
       if (mpn_cmp (p, ecc->g, 2*size != 0))
        die ("curve %d: ecc_mul_a with n = 1 failed.\n", ecc->bit_size);
@@ -46,7 +46,7 @@ test_main (void)
       /* (order - 1) * g = - g */
       mpn_sub_1 (n, ecc->q, size, 1);
       ecc_mul_a (ecc, p, n, ecc->g, scratch);
-      ecc_j_to_a (ecc, 1, p, p, scratch);
+      ecc_j_to_a (ecc, 0, p, p, scratch);
       mpn_sub_n (p + size, ecc->p, p + size, size);
       if (mpn_cmp (p, ecc->g, 2*size) != 0)
        {
@@ -68,10 +68,10 @@ test_main (void)
          n[size - 1] %= ecc->q[size - 1];
 
          ecc_mul_a (ecc, p, n, ecc->g, scratch);
-         ecc_j_to_a (ecc, 1, p, p, scratch);
+         ecc_j_to_a (ecc, 0, p, p, scratch);
 
          ecc_mul_g (ecc, q, n, scratch);
-         ecc_j_to_a (ecc, 1, q, q, scratch);
+         ecc_j_to_a (ecc, 0, q, q, scratch);
 
          if (mpn_cmp (p, q, 2*size))
            {

diff --git a/testsuite/ecc-mul-g-test.c b/testsuite/ecc-mul-g-test.c
index 9db5b9ef46b15f35198852181c943c8d8d21c9c0..2f5a9e79d042720ae98f0726726b16a0e617bb5f 100644 (file)
--- a/testsuite/ecc-mul-g-test.c
+++ b/testsuite/ecc-mul-g-test.c
@@ -31,7 +31,7 @@ test_main (void)
 
       n[0] = 1;
       ecc_mul_g (ecc, p, n, scratch);
-      ecc_j_to_a (ecc, 1, p, p, scratch);
+      ecc_j_to_a (ecc, 0, p, p, scratch);
 
       if (mpn_cmp (p, ecc->g, 2*size != 0))
        {
@@ -48,7 +48,7 @@ test_main (void)
       /* (order - 1) * g = - g */
       mpn_sub_1 (n, ecc->q, size, 1);
       ecc_mul_g (ecc, p, n, scratch);
-      ecc_j_to_a (ecc, 1, p, p, scratch);
+      ecc_j_to_a (ecc, 0, p, p, scratch);
       mpn_sub_n (p + size, ecc->p, p + size, size);
       if (mpn_cmp (p, ecc->g, 2*size) != 0)
        {

diff --git a/testsuite/testutils.c b/testsuite/testutils.c
index 9739c9ed8d7bbd7ce2edc25613d1068f47eaaf00..33c3c40e266d0de80c645cd63f1b71b3fd0d0ace 100644 (file)
--- a/testsuite/testutils.c
+++ b/testsuite/testutils.c
@@ -1376,7 +1376,7 @@ test_ecc_mul_j (unsigned curve, unsigned n, const mp_limb_t *p)
   const struct ecc_curve *ecc = ecc_curves[curve];
   mp_limb_t *np = xalloc_limbs (ecc_size_a (ecc));
   mp_limb_t *scratch = xalloc_limbs (ecc_j_to_a_itch(ecc));
-  ecc_j_to_a (ecc, 1, np, p, scratch);
+  ecc_j_to_a (ecc, 0, np, p, scratch);
 
   test_ecc_mul_a (curve, n, np);