1 /* ec.c - Elliptic Curve functions
2 * Copyright (C) 2007 Free Software Foundation, Inc.
3 * Copyright (C) 2013 g10 Code GmbH
5 * This file is part of Libgcrypt.
7 * Libgcrypt is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU Lesser General Public License as
9 * published by the Free Software Foundation; either version 2.1 of
10 * the License, or (at your option) any later version.
12 * Libgcrypt is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "mpi-internal.h"
24 #define point_init(a) mpi_point_init((a))
25 #define point_free(a) mpi_point_free_parts((a))
27 #define log_error(fmt, ...) pr_err(fmt, ##__VA_ARGS__)
28 #define log_fatal(fmt, ...) pr_err(fmt, ##__VA_ARGS__)
30 #define DIM(v) (sizeof(v)/sizeof((v)[0]))
33 /* Create a new point option. NBITS gives the size in bits of one
34 * coordinate; it is only used to pre-allocate some resources and
35 * might also be passed as 0 to use a default value.
37 MPI_POINT mpi_point_new(unsigned int nbits)
41 (void)nbits; /* Currently not used. */
43 p = kmalloc(sizeof(*p), GFP_KERNEL);
48 EXPORT_SYMBOL_GPL(mpi_point_new);
50 /* Release the point object P. P may be NULL. */
51 void mpi_point_release(MPI_POINT p)
54 mpi_point_free_parts(p);
58 EXPORT_SYMBOL_GPL(mpi_point_release);
60 /* Initialize the fields of a point object. gcry_mpi_point_free_parts
61 * may be used to release the fields.
63 void mpi_point_init(MPI_POINT p)
69 EXPORT_SYMBOL_GPL(mpi_point_init);
71 /* Release the parts of a point object. */
72 void mpi_point_free_parts(MPI_POINT p)
74 mpi_free(p->x); p->x = NULL;
75 mpi_free(p->y); p->y = NULL;
76 mpi_free(p->z); p->z = NULL;
78 EXPORT_SYMBOL_GPL(mpi_point_free_parts);
80 /* Set the value from S into D. */
81 static void point_set(MPI_POINT d, MPI_POINT s)
88 static void point_resize(MPI_POINT p, struct mpi_ec_ctx *ctx)
90 size_t nlimbs = ctx->p->nlimbs;
92 mpi_resize(p->x, nlimbs);
93 p->x->nlimbs = nlimbs;
94 mpi_resize(p->z, nlimbs);
95 p->z->nlimbs = nlimbs;
97 if (ctx->model != MPI_EC_MONTGOMERY) {
98 mpi_resize(p->y, nlimbs);
99 p->y->nlimbs = nlimbs;
103 static void point_swap_cond(MPI_POINT d, MPI_POINT s, unsigned long swap,
104 struct mpi_ec_ctx *ctx)
106 mpi_swap_cond(d->x, s->x, swap);
107 if (ctx->model != MPI_EC_MONTGOMERY)
108 mpi_swap_cond(d->y, s->y, swap);
109 mpi_swap_cond(d->z, s->z, swap);
114 static void ec_mod(MPI w, struct mpi_ec_ctx *ec)
117 mpi_mod_barrett(w, w, ec->t.p_barrett);
119 mpi_mod(w, w, ec->p);
122 static void ec_addm(MPI w, MPI u, MPI v, struct mpi_ec_ctx *ctx)
128 static void ec_subm(MPI w, MPI u, MPI v, struct mpi_ec_ctx *ec)
132 mpi_add(w, w, ec->p);
136 static void ec_mulm(MPI w, MPI u, MPI v, struct mpi_ec_ctx *ctx)
142 /* W = 2 * U mod P. */
143 static void ec_mul2(MPI w, MPI u, struct mpi_ec_ctx *ctx)
149 static void ec_powm(MPI w, const MPI b, const MPI e,
150 struct mpi_ec_ctx *ctx)
152 mpi_powm(w, b, e, ctx->p);
157 * ec_powm(B, B, mpi_const(MPI_C_TWO), ctx);
158 * for easier optimization.
160 static void ec_pow2(MPI w, const MPI b, struct mpi_ec_ctx *ctx)
162 /* Using mpi_mul is slightly faster (at least on amd64). */
163 /* mpi_powm(w, b, mpi_const(MPI_C_TWO), ctx->p); */
164 ec_mulm(w, b, b, ctx);
168 * ec_powm(B, B, mpi_const(MPI_C_THREE), ctx);
169 * for easier optimization.
171 static void ec_pow3(MPI w, const MPI b, struct mpi_ec_ctx *ctx)
173 mpi_powm(w, b, mpi_const(MPI_C_THREE), ctx->p);
176 static void ec_invm(MPI x, MPI a, struct mpi_ec_ctx *ctx)
178 if (!mpi_invm(x, a, ctx->p))
179 log_error("ec_invm: inverse does not exist:\n");
182 static void mpih_set_cond(mpi_ptr_t wp, mpi_ptr_t up,
183 mpi_size_t usize, unsigned long set)
186 mpi_limb_t mask = ((mpi_limb_t)0) - set;
189 for (i = 0; i < usize; i++) {
190 x = mask & (wp[i] ^ up[i]);
195 /* Routines for 2^255 - 19. */
197 #define LIMB_SIZE_25519 ((256+BITS_PER_MPI_LIMB-1)/BITS_PER_MPI_LIMB)
199 static void ec_addm_25519(MPI w, MPI u, MPI v, struct mpi_ec_ctx *ctx)
201 mpi_ptr_t wp, up, vp;
202 mpi_size_t wsize = LIMB_SIZE_25519;
203 mpi_limb_t n[LIMB_SIZE_25519];
206 if (w->nlimbs != wsize || u->nlimbs != wsize || v->nlimbs != wsize)
207 log_bug("addm_25519: different sizes\n");
209 memset(n, 0, sizeof(n));
214 mpihelp_add_n(wp, up, vp, wsize);
215 borrow = mpihelp_sub_n(wp, wp, ctx->p->d, wsize);
216 mpih_set_cond(n, ctx->p->d, wsize, (borrow != 0UL));
217 mpihelp_add_n(wp, wp, n, wsize);
218 wp[LIMB_SIZE_25519-1] &= ~((mpi_limb_t)1 << (255 % BITS_PER_MPI_LIMB));
221 static void ec_subm_25519(MPI w, MPI u, MPI v, struct mpi_ec_ctx *ctx)
223 mpi_ptr_t wp, up, vp;
224 mpi_size_t wsize = LIMB_SIZE_25519;
225 mpi_limb_t n[LIMB_SIZE_25519];
228 if (w->nlimbs != wsize || u->nlimbs != wsize || v->nlimbs != wsize)
229 log_bug("subm_25519: different sizes\n");
231 memset(n, 0, sizeof(n));
236 borrow = mpihelp_sub_n(wp, up, vp, wsize);
237 mpih_set_cond(n, ctx->p->d, wsize, (borrow != 0UL));
238 mpihelp_add_n(wp, wp, n, wsize);
239 wp[LIMB_SIZE_25519-1] &= ~((mpi_limb_t)1 << (255 % BITS_PER_MPI_LIMB));
242 static void ec_mulm_25519(MPI w, MPI u, MPI v, struct mpi_ec_ctx *ctx)
244 mpi_ptr_t wp, up, vp;
245 mpi_size_t wsize = LIMB_SIZE_25519;
246 mpi_limb_t n[LIMB_SIZE_25519*2];
247 mpi_limb_t m[LIMB_SIZE_25519+1];
252 if (w->nlimbs != wsize || u->nlimbs != wsize || v->nlimbs != wsize)
253 log_bug("mulm_25519: different sizes\n");
259 mpihelp_mul_n(n, up, vp, wsize);
260 memcpy(wp, n, wsize * BYTES_PER_MPI_LIMB);
261 wp[LIMB_SIZE_25519-1] &= ~((mpi_limb_t)1 << (255 % BITS_PER_MPI_LIMB));
263 memcpy(m, n+LIMB_SIZE_25519-1, (wsize+1) * BYTES_PER_MPI_LIMB);
264 mpihelp_rshift(m, m, LIMB_SIZE_25519+1, (255 % BITS_PER_MPI_LIMB));
266 memcpy(n, m, wsize * BYTES_PER_MPI_LIMB);
267 cy = mpihelp_lshift(m, m, LIMB_SIZE_25519, 4);
268 m[LIMB_SIZE_25519] = cy;
269 cy = mpihelp_add_n(m, m, n, wsize);
270 m[LIMB_SIZE_25519] += cy;
271 cy = mpihelp_add_n(m, m, n, wsize);
272 m[LIMB_SIZE_25519] += cy;
273 cy = mpihelp_add_n(m, m, n, wsize);
274 m[LIMB_SIZE_25519] += cy;
276 cy = mpihelp_add_n(wp, wp, m, wsize);
277 m[LIMB_SIZE_25519] += cy;
279 memset(m, 0, wsize * BYTES_PER_MPI_LIMB);
280 msb = (wp[LIMB_SIZE_25519-1] >> (255 % BITS_PER_MPI_LIMB));
281 m[0] = (m[LIMB_SIZE_25519] * 2 + msb) * 19;
282 wp[LIMB_SIZE_25519-1] &= ~((mpi_limb_t)1 << (255 % BITS_PER_MPI_LIMB));
283 mpihelp_add_n(wp, wp, m, wsize);
286 cy = mpihelp_sub_n(wp, wp, ctx->p->d, wsize);
287 mpih_set_cond(m, ctx->p->d, wsize, (cy != 0UL));
288 mpihelp_add_n(wp, wp, m, wsize);
291 static void ec_mul2_25519(MPI w, MPI u, struct mpi_ec_ctx *ctx)
293 ec_addm_25519(w, u, u, ctx);
296 static void ec_pow2_25519(MPI w, const MPI b, struct mpi_ec_ctx *ctx)
298 ec_mulm_25519(w, b, b, ctx);
301 /* Routines for 2^448 - 2^224 - 1. */
303 #define LIMB_SIZE_448 ((448+BITS_PER_MPI_LIMB-1)/BITS_PER_MPI_LIMB)
304 #define LIMB_SIZE_HALF_448 ((LIMB_SIZE_448+1)/2)
306 static void ec_addm_448(MPI w, MPI u, MPI v, struct mpi_ec_ctx *ctx)
308 mpi_ptr_t wp, up, vp;
309 mpi_size_t wsize = LIMB_SIZE_448;
310 mpi_limb_t n[LIMB_SIZE_448];
313 if (w->nlimbs != wsize || u->nlimbs != wsize || v->nlimbs != wsize)
314 log_bug("addm_448: different sizes\n");
316 memset(n, 0, sizeof(n));
321 cy = mpihelp_add_n(wp, up, vp, wsize);
322 mpih_set_cond(n, ctx->p->d, wsize, (cy != 0UL));
323 mpihelp_sub_n(wp, wp, n, wsize);
326 static void ec_subm_448(MPI w, MPI u, MPI v, struct mpi_ec_ctx *ctx)
328 mpi_ptr_t wp, up, vp;
329 mpi_size_t wsize = LIMB_SIZE_448;
330 mpi_limb_t n[LIMB_SIZE_448];
333 if (w->nlimbs != wsize || u->nlimbs != wsize || v->nlimbs != wsize)
334 log_bug("subm_448: different sizes\n");
336 memset(n, 0, sizeof(n));
341 borrow = mpihelp_sub_n(wp, up, vp, wsize);
342 mpih_set_cond(n, ctx->p->d, wsize, (borrow != 0UL));
343 mpihelp_add_n(wp, wp, n, wsize);
346 static void ec_mulm_448(MPI w, MPI u, MPI v, struct mpi_ec_ctx *ctx)
348 mpi_ptr_t wp, up, vp;
349 mpi_size_t wsize = LIMB_SIZE_448;
350 mpi_limb_t n[LIMB_SIZE_448*2];
351 mpi_limb_t a2[LIMB_SIZE_HALF_448];
352 mpi_limb_t a3[LIMB_SIZE_HALF_448];
353 mpi_limb_t b0[LIMB_SIZE_HALF_448];
354 mpi_limb_t b1[LIMB_SIZE_HALF_448];
357 #if (LIMB_SIZE_HALF_448 > LIMB_SIZE_448/2)
358 mpi_limb_t b1_rest, a3_rest;
361 if (w->nlimbs != wsize || u->nlimbs != wsize || v->nlimbs != wsize)
362 log_bug("mulm_448: different sizes\n");
368 mpihelp_mul_n(n, up, vp, wsize);
370 for (i = 0; i < (wsize + 1) / 2; i++) {
372 b1[i] = n[i+wsize/2];
374 a3[i] = n[i+wsize+wsize/2];
377 #if (LIMB_SIZE_HALF_448 > LIMB_SIZE_448/2)
378 b0[LIMB_SIZE_HALF_448-1] &= ((mpi_limb_t)1UL << 32)-1;
379 a2[LIMB_SIZE_HALF_448-1] &= ((mpi_limb_t)1UL << 32)-1;
384 for (i = (wsize + 1) / 2 - 1; i >= 0; i--) {
388 b1[i] = (b1_rest << 32) | (b1v >> 32);
389 a3[i] = (a3_rest << 32) | (a3v >> 32);
390 b1_rest = b1v & (((mpi_limb_t)1UL << 32)-1);
391 a3_rest = a3v & (((mpi_limb_t)1UL << 32)-1);
395 cy = mpihelp_add_n(b0, b0, a2, LIMB_SIZE_HALF_448);
396 cy += mpihelp_add_n(b0, b0, a3, LIMB_SIZE_HALF_448);
397 for (i = 0; i < (wsize + 1) / 2; i++)
399 #if (LIMB_SIZE_HALF_448 > LIMB_SIZE_448/2)
400 wp[LIMB_SIZE_HALF_448-1] &= (((mpi_limb_t)1UL << 32)-1);
403 #if (LIMB_SIZE_HALF_448 > LIMB_SIZE_448/2)
404 cy = b0[LIMB_SIZE_HALF_448-1] >> 32;
407 cy = mpihelp_add_1(b1, b1, LIMB_SIZE_HALF_448, cy);
408 cy += mpihelp_add_n(b1, b1, a2, LIMB_SIZE_HALF_448);
409 cy += mpihelp_add_n(b1, b1, a3, LIMB_SIZE_HALF_448);
410 cy += mpihelp_add_n(b1, b1, a3, LIMB_SIZE_HALF_448);
411 #if (LIMB_SIZE_HALF_448 > LIMB_SIZE_448/2)
413 for (i = (wsize + 1) / 2 - 1; i >= 0; i--) {
414 mpi_limb_t b1v = b1[i];
415 b1[i] = (b1_rest << 32) | (b1v >> 32);
416 b1_rest = b1v & (((mpi_limb_t)1UL << 32)-1);
418 wp[LIMB_SIZE_HALF_448-1] |= (b1_rest << 32);
420 for (i = 0; i < wsize / 2; i++)
421 wp[i+(wsize + 1) / 2] = b1[i];
423 #if (LIMB_SIZE_HALF_448 > LIMB_SIZE_448/2)
424 cy = b1[LIMB_SIZE_HALF_448-1];
427 memset(n, 0, wsize * BYTES_PER_MPI_LIMB);
429 #if (LIMB_SIZE_HALF_448 > LIMB_SIZE_448/2)
430 n[LIMB_SIZE_HALF_448-1] = cy << 32;
432 n[LIMB_SIZE_HALF_448] = cy;
435 mpihelp_add_n(wp, wp, n, wsize);
437 memset(n, 0, wsize * BYTES_PER_MPI_LIMB);
438 cy = mpihelp_sub_n(wp, wp, ctx->p->d, wsize);
439 mpih_set_cond(n, ctx->p->d, wsize, (cy != 0UL));
440 mpihelp_add_n(wp, wp, n, wsize);
443 static void ec_mul2_448(MPI w, MPI u, struct mpi_ec_ctx *ctx)
445 ec_addm_448(w, u, u, ctx);
448 static void ec_pow2_448(MPI w, const MPI b, struct mpi_ec_ctx *ctx)
450 ec_mulm_448(w, b, b, ctx);
456 /* computation routines for the field. */
457 void (*addm)(MPI w, MPI u, MPI v, struct mpi_ec_ctx *ctx);
458 void (*subm)(MPI w, MPI u, MPI v, struct mpi_ec_ctx *ctx);
459 void (*mulm)(MPI w, MPI u, MPI v, struct mpi_ec_ctx *ctx);
460 void (*mul2)(MPI w, MPI u, struct mpi_ec_ctx *ctx);
461 void (*pow2)(MPI w, const MPI b, struct mpi_ec_ctx *ctx);
464 static const struct field_table field_table[] = {
466 "0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFED",
474 "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE"
475 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
482 { NULL, NULL, NULL, NULL, NULL, NULL },
485 /* Force recomputation of all helper variables. */
486 static void mpi_ec_get_reset(struct mpi_ec_ctx *ec)
488 ec->t.valid.a_is_pminus3 = 0;
489 ec->t.valid.two_inv_p = 0;
492 /* Accessor for helper variable. */
493 static int ec_get_a_is_pminus3(struct mpi_ec_ctx *ec)
497 if (!ec->t.valid.a_is_pminus3) {
498 ec->t.valid.a_is_pminus3 = 1;
499 tmp = mpi_alloc_like(ec->p);
500 mpi_sub_ui(tmp, ec->p, 3);
501 ec->t.a_is_pminus3 = !mpi_cmp(ec->a, tmp);
505 return ec->t.a_is_pminus3;
508 /* Accessor for helper variable. */
509 static MPI ec_get_two_inv_p(struct mpi_ec_ctx *ec)
511 if (!ec->t.valid.two_inv_p) {
512 ec->t.valid.two_inv_p = 1;
513 if (!ec->t.two_inv_p)
514 ec->t.two_inv_p = mpi_alloc(0);
515 ec_invm(ec->t.two_inv_p, mpi_const(MPI_C_TWO), ec);
517 return ec->t.two_inv_p;
520 static const char *const curve25519_bad_points[] = {
521 "0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed",
522 "0x0000000000000000000000000000000000000000000000000000000000000000",
523 "0x0000000000000000000000000000000000000000000000000000000000000001",
524 "0x00b8495f16056286fdb1329ceb8d09da6ac49ff1fae35616aeb8413b7c7aebe0",
525 "0x57119fd0dd4e22d8868e1c58c45c44045bef839c55b1d0b1248c50a3bc959c5f",
526 "0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec",
527 "0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffee",
531 static const char *const curve448_bad_points[] = {
532 "0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffe"
533 "ffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
534 "0x00000000000000000000000000000000000000000000000000000000"
535 "00000000000000000000000000000000000000000000000000000000",
536 "0x00000000000000000000000000000000000000000000000000000000"
537 "00000000000000000000000000000000000000000000000000000001",
538 "0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffe"
539 "fffffffffffffffffffffffffffffffffffffffffffffffffffffffe",
540 "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
541 "00000000000000000000000000000000000000000000000000000000",
545 static const char *const *bad_points_table[] = {
546 curve25519_bad_points,
550 static void mpi_ec_coefficient_normalize(MPI a, MPI p)
553 mpi_resize(a, p->nlimbs);
554 mpihelp_sub_n(a->d, p->d, a->d, p->nlimbs);
555 a->nlimbs = p->nlimbs;
560 /* This function initialized a context for elliptic curve based on the
561 * field GF(p). P is the prime specifying this field, A is the first
562 * coefficient. CTX is expected to be zeroized.
564 void mpi_ec_init(struct mpi_ec_ctx *ctx, enum gcry_mpi_ec_models model,
565 enum ecc_dialects dialect,
566 int flags, MPI p, MPI a, MPI b)
569 static int use_barrett = -1 /* TODO: 1 or -1 */;
571 mpi_ec_coefficient_normalize(a, p);
572 mpi_ec_coefficient_normalize(b, p);
574 /* Fixme: Do we want to check some constraints? e.g. a < p */
577 ctx->dialect = dialect;
579 if (dialect == ECC_DIALECT_ED25519)
582 ctx->nbits = mpi_get_nbits(p);
583 ctx->p = mpi_copy(p);
584 ctx->a = mpi_copy(a);
585 ctx->b = mpi_copy(b);
588 ctx->t.two_inv_p = NULL;
590 ctx->t.p_barrett = use_barrett > 0 ? mpi_barrett_init(ctx->p, 0) : NULL;
592 mpi_ec_get_reset(ctx);
594 if (model == MPI_EC_MONTGOMERY) {
595 for (i = 0; i < DIM(bad_points_table); i++) {
596 MPI p_candidate = mpi_scanval(bad_points_table[i][0]);
597 int match_p = !mpi_cmp(ctx->p, p_candidate);
600 mpi_free(p_candidate);
604 for (j = 0; i < DIM(ctx->t.scratch) && bad_points_table[i][j]; j++)
605 ctx->t.scratch[j] = mpi_scanval(bad_points_table[i][j]);
608 /* Allocate scratch variables. */
609 for (i = 0; i < DIM(ctx->t.scratch); i++)
610 ctx->t.scratch[i] = mpi_alloc_like(ctx->p);
619 for (i = 0; field_table[i].p; i++) {
622 f_p = mpi_scanval(field_table[i].p);
626 if (!mpi_cmp(p, f_p)) {
627 ctx->addm = field_table[i].addm;
628 ctx->subm = field_table[i].subm;
629 ctx->mulm = field_table[i].mulm;
630 ctx->mul2 = field_table[i].mul2;
631 ctx->pow2 = field_table[i].pow2;
634 mpi_resize(ctx->a, ctx->p->nlimbs);
635 ctx->a->nlimbs = ctx->p->nlimbs;
637 mpi_resize(ctx->b, ctx->p->nlimbs);
638 ctx->b->nlimbs = ctx->p->nlimbs;
640 for (i = 0; i < DIM(ctx->t.scratch) && ctx->t.scratch[i]; i++)
641 ctx->t.scratch[i]->nlimbs = ctx->p->nlimbs;
649 EXPORT_SYMBOL_GPL(mpi_ec_init);
651 void mpi_ec_deinit(struct mpi_ec_ctx *ctx)
655 mpi_barrett_free(ctx->t.p_barrett);
657 /* Domain parameter. */
661 mpi_point_release(ctx->G);
665 mpi_point_release(ctx->Q);
668 /* Private data of ec.c. */
669 mpi_free(ctx->t.two_inv_p);
671 for (i = 0; i < DIM(ctx->t.scratch); i++)
672 mpi_free(ctx->t.scratch[i]);
674 EXPORT_SYMBOL_GPL(mpi_ec_deinit);
676 /* Compute the affine coordinates from the projective coordinates in
677 * POINT. Set them into X and Y. If one coordinate is not required,
678 * X or Y may be passed as NULL. CTX is the usual context. Returns: 0
679 * on success or !0 if POINT is at infinity.
681 int mpi_ec_get_affine(MPI x, MPI y, MPI_POINT point, struct mpi_ec_ctx *ctx)
683 if (!mpi_cmp_ui(point->z, 0))
686 switch (ctx->model) {
687 case MPI_EC_WEIERSTRASS: /* Using Jacobian coordinates. */
693 ec_invm(z1, point->z, ctx); /* z1 = z^(-1) mod p */
694 ec_mulm(z2, z1, z1, ctx); /* z2 = z^(-2) mod p */
697 ec_mulm(x, point->x, z2, ctx);
701 ec_mulm(z3, z2, z1, ctx); /* z3 = z^(-3) mod p */
702 ec_mulm(y, point->y, z3, ctx);
711 case MPI_EC_MONTGOMERY:
714 mpi_set(x, point->x);
717 log_fatal("%s: Getting Y-coordinate on %s is not supported\n",
718 "mpi_ec_get_affine", "Montgomery");
729 ec_invm(z, point->z, ctx);
731 mpi_resize(z, ctx->p->nlimbs);
732 z->nlimbs = ctx->p->nlimbs;
735 mpi_resize(x, ctx->p->nlimbs);
736 x->nlimbs = ctx->p->nlimbs;
737 ctx->mulm(x, point->x, z, ctx);
740 mpi_resize(y, ctx->p->nlimbs);
741 y->nlimbs = ctx->p->nlimbs;
742 ctx->mulm(y, point->y, z, ctx);
753 EXPORT_SYMBOL_GPL(mpi_ec_get_affine);
755 /* RESULT = 2 * POINT (Weierstrass version). */
756 static void dup_point_weierstrass(MPI_POINT result,
757 MPI_POINT point, struct mpi_ec_ctx *ctx)
759 #define x3 (result->x)
760 #define y3 (result->y)
761 #define z3 (result->z)
762 #define t1 (ctx->t.scratch[0])
763 #define t2 (ctx->t.scratch[1])
764 #define t3 (ctx->t.scratch[2])
765 #define l1 (ctx->t.scratch[3])
766 #define l2 (ctx->t.scratch[4])
767 #define l3 (ctx->t.scratch[5])
769 if (!mpi_cmp_ui(point->y, 0) || !mpi_cmp_ui(point->z, 0)) {
770 /* P_y == 0 || P_z == 0 => [1:1:0] */
775 if (ec_get_a_is_pminus3(ctx)) {
776 /* Use the faster case. */
777 /* L1 = 3(X - Z^2)(X + Z^2) */
778 /* T1: used for Z^2. */
779 /* T2: used for the right term. */
780 ec_pow2(t1, point->z, ctx);
781 ec_subm(l1, point->x, t1, ctx);
782 ec_mulm(l1, l1, mpi_const(MPI_C_THREE), ctx);
783 ec_addm(t2, point->x, t1, ctx);
784 ec_mulm(l1, l1, t2, ctx);
787 /* L1 = 3X^2 + aZ^4 */
788 /* T1: used for aZ^4. */
789 ec_pow2(l1, point->x, ctx);
790 ec_mulm(l1, l1, mpi_const(MPI_C_THREE), ctx);
791 ec_powm(t1, point->z, mpi_const(MPI_C_FOUR), ctx);
792 ec_mulm(t1, t1, ctx->a, ctx);
793 ec_addm(l1, l1, t1, ctx);
796 ec_mulm(z3, point->y, point->z, ctx);
797 ec_mul2(z3, z3, ctx);
800 /* T2: used for Y2; required later. */
801 ec_pow2(t2, point->y, ctx);
802 ec_mulm(l2, t2, point->x, ctx);
803 ec_mulm(l2, l2, mpi_const(MPI_C_FOUR), ctx);
805 /* X3 = L1^2 - 2L2 */
806 /* T1: used for L2^2. */
807 ec_pow2(x3, l1, ctx);
808 ec_mul2(t1, l2, ctx);
809 ec_subm(x3, x3, t1, ctx);
812 /* T2: taken from above. */
813 ec_pow2(t2, t2, ctx);
814 ec_mulm(l3, t2, mpi_const(MPI_C_EIGHT), ctx);
816 /* Y3 = L1(L2 - X3) - L3 */
817 ec_subm(y3, l2, x3, ctx);
818 ec_mulm(y3, y3, l1, ctx);
819 ec_subm(y3, y3, l3, ctx);
833 /* RESULT = 2 * POINT (Montgomery version). */
834 static void dup_point_montgomery(MPI_POINT result,
835 MPI_POINT point, struct mpi_ec_ctx *ctx)
840 log_fatal("%s: %s not yet supported\n",
841 "mpi_ec_dup_point", "Montgomery");
844 /* RESULT = 2 * POINT (Twisted Edwards version). */
845 static void dup_point_edwards(MPI_POINT result,
846 MPI_POINT point, struct mpi_ec_ctx *ctx)
848 #define X1 (point->x)
849 #define Y1 (point->y)
850 #define Z1 (point->z)
851 #define X3 (result->x)
852 #define Y3 (result->y)
853 #define Z3 (result->z)
854 #define B (ctx->t.scratch[0])
855 #define C (ctx->t.scratch[1])
856 #define D (ctx->t.scratch[2])
857 #define E (ctx->t.scratch[3])
858 #define F (ctx->t.scratch[4])
859 #define H (ctx->t.scratch[5])
860 #define J (ctx->t.scratch[6])
862 /* Compute: (X_3 : Y_3 : Z_3) = 2( X_1 : Y_1 : Z_1 ) */
864 /* B = (X_1 + Y_1)^2 */
865 ctx->addm(B, X1, Y1, ctx);
866 ctx->pow2(B, B, ctx);
870 ctx->pow2(C, X1, ctx);
871 ctx->pow2(D, Y1, ctx);
874 if (ctx->dialect == ECC_DIALECT_ED25519)
875 ctx->subm(E, ctx->p, C, ctx);
877 ctx->mulm(E, ctx->a, C, ctx);
880 ctx->addm(F, E, D, ctx);
883 ctx->pow2(H, Z1, ctx);
886 ctx->mul2(J, H, ctx);
887 ctx->subm(J, F, J, ctx);
889 /* X_3 = (B - C - D) · J */
890 ctx->subm(X3, B, C, ctx);
891 ctx->subm(X3, X3, D, ctx);
892 ctx->mulm(X3, X3, J, ctx);
894 /* Y_3 = F · (E - D) */
895 ctx->subm(Y3, E, D, ctx);
896 ctx->mulm(Y3, Y3, F, ctx);
899 ctx->mulm(Z3, F, J, ctx);
916 /* RESULT = 2 * POINT */
918 mpi_ec_dup_point(MPI_POINT result, MPI_POINT point, struct mpi_ec_ctx *ctx)
920 switch (ctx->model) {
921 case MPI_EC_WEIERSTRASS:
922 dup_point_weierstrass(result, point, ctx);
924 case MPI_EC_MONTGOMERY:
925 dup_point_montgomery(result, point, ctx);
928 dup_point_edwards(result, point, ctx);
933 /* RESULT = P1 + P2 (Weierstrass version).*/
934 static void add_points_weierstrass(MPI_POINT result,
935 MPI_POINT p1, MPI_POINT p2,
936 struct mpi_ec_ctx *ctx)
944 #define x3 (result->x)
945 #define y3 (result->y)
946 #define z3 (result->z)
947 #define l1 (ctx->t.scratch[0])
948 #define l2 (ctx->t.scratch[1])
949 #define l3 (ctx->t.scratch[2])
950 #define l4 (ctx->t.scratch[3])
951 #define l5 (ctx->t.scratch[4])
952 #define l6 (ctx->t.scratch[5])
953 #define l7 (ctx->t.scratch[6])
954 #define l8 (ctx->t.scratch[7])
955 #define l9 (ctx->t.scratch[8])
956 #define t1 (ctx->t.scratch[9])
957 #define t2 (ctx->t.scratch[10])
959 if ((!mpi_cmp(x1, x2)) && (!mpi_cmp(y1, y2)) && (!mpi_cmp(z1, z2))) {
960 /* Same point; need to call the duplicate function. */
961 mpi_ec_dup_point(result, p1, ctx);
962 } else if (!mpi_cmp_ui(z1, 0)) {
963 /* P1 is at infinity. */
967 } else if (!mpi_cmp_ui(z2, 0)) {
968 /* P2 is at infinity. */
973 int z1_is_one = !mpi_cmp_ui(z1, 1);
974 int z2_is_one = !mpi_cmp_ui(z2, 1);
981 ec_pow2(l1, z2, ctx);
982 ec_mulm(l1, l1, x1, ctx);
987 ec_pow2(l2, z1, ctx);
988 ec_mulm(l2, l2, x2, ctx);
991 ec_subm(l3, l1, l2, ctx);
993 ec_powm(l4, z2, mpi_const(MPI_C_THREE), ctx);
994 ec_mulm(l4, l4, y1, ctx);
996 ec_powm(l5, z1, mpi_const(MPI_C_THREE), ctx);
997 ec_mulm(l5, l5, y2, ctx);
999 ec_subm(l6, l4, l5, ctx);
1001 if (!mpi_cmp_ui(l3, 0)) {
1002 if (!mpi_cmp_ui(l6, 0)) {
1003 /* P1 and P2 are the same - use duplicate function. */
1004 mpi_ec_dup_point(result, p1, ctx);
1006 /* P1 is the inverse of P2. */
1013 ec_addm(l7, l1, l2, ctx);
1015 ec_addm(l8, l4, l5, ctx);
1017 ec_mulm(z3, z1, z2, ctx);
1018 ec_mulm(z3, z3, l3, ctx);
1019 /* x3 = l6^2 - l7 l3^2 */
1020 ec_pow2(t1, l6, ctx);
1021 ec_pow2(t2, l3, ctx);
1022 ec_mulm(t2, t2, l7, ctx);
1023 ec_subm(x3, t1, t2, ctx);
1024 /* l9 = l7 l3^2 - 2 x3 */
1025 ec_mul2(t1, x3, ctx);
1026 ec_subm(l9, t2, t1, ctx);
1027 /* y3 = (l9 l6 - l8 l3^3)/2 */
1028 ec_mulm(l9, l9, l6, ctx);
1029 ec_powm(t1, l3, mpi_const(MPI_C_THREE), ctx); /* fixme: Use saved value*/
1030 ec_mulm(t1, t1, l8, ctx);
1031 ec_subm(y3, l9, t1, ctx);
1032 ec_mulm(y3, y3, ec_get_two_inv_p(ctx), ctx);
1058 /* RESULT = P1 + P2 (Montgomery version).*/
1059 static void add_points_montgomery(MPI_POINT result,
1060 MPI_POINT p1, MPI_POINT p2,
1061 struct mpi_ec_ctx *ctx)
1067 log_fatal("%s: %s not yet supported\n",
1068 "mpi_ec_add_points", "Montgomery");
1071 /* RESULT = P1 + P2 (Twisted Edwards version).*/
1072 static void add_points_edwards(MPI_POINT result,
1073 MPI_POINT p1, MPI_POINT p2,
1074 struct mpi_ec_ctx *ctx)
1082 #define X3 (result->x)
1083 #define Y3 (result->y)
1084 #define Z3 (result->z)
1085 #define A (ctx->t.scratch[0])
1086 #define B (ctx->t.scratch[1])
1087 #define C (ctx->t.scratch[2])
1088 #define D (ctx->t.scratch[3])
1089 #define E (ctx->t.scratch[4])
1090 #define F (ctx->t.scratch[5])
1091 #define G (ctx->t.scratch[6])
1092 #define tmp (ctx->t.scratch[7])
1094 point_resize(result, ctx);
1096 /* Compute: (X_3 : Y_3 : Z_3) = (X_1 : Y_1 : Z_1) + (X_2 : Y_2 : Z_3) */
1099 ctx->mulm(A, Z1, Z2, ctx);
1102 ctx->pow2(B, A, ctx);
1105 ctx->mulm(C, X1, X2, ctx);
1108 ctx->mulm(D, Y1, Y2, ctx);
1111 ctx->mulm(E, ctx->b, C, ctx);
1112 ctx->mulm(E, E, D, ctx);
1115 ctx->subm(F, B, E, ctx);
1118 ctx->addm(G, B, E, ctx);
1120 /* X_3 = A · F · ((X_1 + Y_1) · (X_2 + Y_2) - C - D) */
1121 ctx->addm(tmp, X1, Y1, ctx);
1122 ctx->addm(X3, X2, Y2, ctx);
1123 ctx->mulm(X3, X3, tmp, ctx);
1124 ctx->subm(X3, X3, C, ctx);
1125 ctx->subm(X3, X3, D, ctx);
1126 ctx->mulm(X3, X3, F, ctx);
1127 ctx->mulm(X3, X3, A, ctx);
1129 /* Y_3 = A · G · (D - aC) */
1130 if (ctx->dialect == ECC_DIALECT_ED25519) {
1131 ctx->addm(Y3, D, C, ctx);
1133 ctx->mulm(Y3, ctx->a, C, ctx);
1134 ctx->subm(Y3, D, Y3, ctx);
1136 ctx->mulm(Y3, Y3, G, ctx);
1137 ctx->mulm(Y3, Y3, A, ctx);
1140 ctx->mulm(Z3, F, G, ctx);
1162 /* Compute a step of Montgomery Ladder (only use X and Z in the point).
1163 * Inputs: P1, P2, and x-coordinate of DIF = P1 - P1.
1164 * Outputs: PRD = 2 * P1 and SUM = P1 + P2.
1166 static void montgomery_ladder(MPI_POINT prd, MPI_POINT sum,
1167 MPI_POINT p1, MPI_POINT p2, MPI dif_x,
1168 struct mpi_ec_ctx *ctx)
1170 ctx->addm(sum->x, p2->x, p2->z, ctx);
1171 ctx->subm(p2->z, p2->x, p2->z, ctx);
1172 ctx->addm(prd->x, p1->x, p1->z, ctx);
1173 ctx->subm(p1->z, p1->x, p1->z, ctx);
1174 ctx->mulm(p2->x, p1->z, sum->x, ctx);
1175 ctx->mulm(p2->z, prd->x, p2->z, ctx);
1176 ctx->pow2(p1->x, prd->x, ctx);
1177 ctx->pow2(p1->z, p1->z, ctx);
1178 ctx->addm(sum->x, p2->x, p2->z, ctx);
1179 ctx->subm(p2->z, p2->x, p2->z, ctx);
1180 ctx->mulm(prd->x, p1->x, p1->z, ctx);
1181 ctx->subm(p1->z, p1->x, p1->z, ctx);
1182 ctx->pow2(sum->x, sum->x, ctx);
1183 ctx->pow2(sum->z, p2->z, ctx);
1184 ctx->mulm(prd->z, p1->z, ctx->a, ctx); /* CTX->A: (a-2)/4 */
1185 ctx->mulm(sum->z, sum->z, dif_x, ctx);
1186 ctx->addm(prd->z, p1->x, prd->z, ctx);
1187 ctx->mulm(prd->z, prd->z, p1->z, ctx);
1190 /* RESULT = P1 + P2 */
1191 void mpi_ec_add_points(MPI_POINT result,
1192 MPI_POINT p1, MPI_POINT p2,
1193 struct mpi_ec_ctx *ctx)
1195 switch (ctx->model) {
1196 case MPI_EC_WEIERSTRASS:
1197 add_points_weierstrass(result, p1, p2, ctx);
1199 case MPI_EC_MONTGOMERY:
1200 add_points_montgomery(result, p1, p2, ctx);
1202 case MPI_EC_EDWARDS:
1203 add_points_edwards(result, p1, p2, ctx);
1207 EXPORT_SYMBOL_GPL(mpi_ec_add_points);
1209 /* Scalar point multiplication - the main function for ECC. If takes
1210 * an integer SCALAR and a POINT as well as the usual context CTX.
1211 * RESULT will be set to the resulting point.
1213 void mpi_ec_mul_point(MPI_POINT result,
1214 MPI scalar, MPI_POINT point,
1215 struct mpi_ec_ctx *ctx)
1217 MPI x1, y1, z1, k, h, yy;
1218 unsigned int i, loops;
1219 struct gcry_mpi_point p1, p2, p1inv;
1221 if (ctx->model == MPI_EC_EDWARDS) {
1222 /* Simple left to right binary method. Algorithm 3.27 from
1223 * {author={Hankerson, Darrel and Menezes, Alfred J. and Vanstone, Scott},
1224 * title = {Guide to Elliptic Curve Cryptography},
1225 * year = {2003}, isbn = {038795273X},
1226 * url = {http://www.cacr.math.uwaterloo.ca/ecc/},
1227 * publisher = {Springer-Verlag New York, Inc.}}
1232 if (mpi_cmp(scalar, ctx->p) >= 0)
1233 nbits = mpi_get_nbits(scalar);
1235 nbits = mpi_get_nbits(ctx->p);
1237 mpi_set_ui(result->x, 0);
1238 mpi_set_ui(result->y, 1);
1239 mpi_set_ui(result->z, 1);
1240 point_resize(point, ctx);
1242 point_resize(result, ctx);
1243 point_resize(point, ctx);
1245 for (j = nbits-1; j >= 0; j--) {
1246 mpi_ec_dup_point(result, result, ctx);
1247 if (mpi_test_bit(scalar, j))
1248 mpi_ec_add_points(result, result, point, ctx);
1251 } else if (ctx->model == MPI_EC_MONTGOMERY) {
1254 struct gcry_mpi_point p1_, p2_;
1255 MPI_POINT q1, q2, prd, sum;
1258 int scalar_copied = 0;
1260 /* Compute scalar point multiplication with Montgomery Ladder.
1261 * Note that we don't use Y-coordinate in the points at all.
1262 * RESULT->Y will be filled by zero.
1265 nbits = mpi_get_nbits(scalar);
1270 mpi_set_ui(p1.x, 1);
1272 p2.x = mpi_copy(point->x);
1273 mpi_set_ui(p2.z, 1);
1275 point_resize(&p1, ctx);
1276 point_resize(&p2, ctx);
1277 point_resize(&p1_, ctx);
1278 point_resize(&p2_, ctx);
1280 mpi_resize(point->x, ctx->p->nlimbs);
1281 point->x->nlimbs = ctx->p->nlimbs;
1288 for (j = nbits-1; j >= 0; j--) {
1291 sw = mpi_test_bit(scalar, j);
1292 point_swap_cond(q1, q2, sw, ctx);
1293 montgomery_ladder(prd, sum, q1, q2, point->x, ctx);
1294 point_swap_cond(prd, sum, sw, ctx);
1295 t = q1; q1 = prd; prd = t;
1296 t = q2; q2 = sum; sum = t;
1299 mpi_clear(result->y);
1301 point_swap_cond(&p1, &p1_, sw, ctx);
1303 rsize = p1.z->nlimbs;
1304 MPN_NORMALIZE(p1.z->d, rsize);
1306 mpi_set_ui(result->x, 1);
1307 mpi_set_ui(result->z, 0);
1310 ec_invm(z1, p1.z, ctx);
1311 ec_mulm(result->x, p1.x, z1, ctx);
1312 mpi_set_ui(result->z, 1);
1325 x1 = mpi_alloc_like(ctx->p);
1326 y1 = mpi_alloc_like(ctx->p);
1327 h = mpi_alloc_like(ctx->p);
1328 k = mpi_copy(scalar);
1329 yy = mpi_copy(point->y);
1331 if (mpi_has_sign(k)) {
1333 ec_invm(yy, yy, ctx);
1336 if (!mpi_cmp_ui(point->z, 1)) {
1337 mpi_set(x1, point->x);
1342 z2 = mpi_alloc_like(ctx->p);
1343 z3 = mpi_alloc_like(ctx->p);
1344 ec_mulm(z2, point->z, point->z, ctx);
1345 ec_mulm(z3, point->z, z2, ctx);
1346 ec_invm(z2, z2, ctx);
1347 ec_mulm(x1, point->x, z2, ctx);
1348 ec_invm(z3, z3, ctx);
1349 ec_mulm(y1, yy, z3, ctx);
1353 z1 = mpi_copy(mpi_const(MPI_C_ONE));
1355 mpi_mul(h, k, mpi_const(MPI_C_THREE)); /* h = 3k */
1356 loops = mpi_get_nbits(h);
1358 /* If SCALAR is zero, the above mpi_mul sets H to zero and thus
1359 * LOOPs will be zero. To avoid an underflow of I in the main
1360 * loop we set LOOP to 2 and the result to (0,0,0).
1363 mpi_clear(result->x);
1364 mpi_clear(result->y);
1365 mpi_clear(result->z);
1367 mpi_set(result->x, point->x);
1368 mpi_set(result->y, yy);
1369 mpi_set(result->z, point->z);
1371 mpi_free(yy); yy = NULL;
1373 p1.x = x1; x1 = NULL;
1374 p1.y = y1; y1 = NULL;
1375 p1.z = z1; z1 = NULL;
1379 /* Invert point: y = p - y mod p */
1380 point_set(&p1inv, &p1);
1381 ec_subm(p1inv.y, ctx->p, p1inv.y, ctx);
1383 for (i = loops-2; i > 0; i--) {
1384 mpi_ec_dup_point(result, result, ctx);
1385 if (mpi_test_bit(h, i) == 1 && mpi_test_bit(k, i) == 0) {
1386 point_set(&p2, result);
1387 mpi_ec_add_points(result, &p2, &p1, ctx);
1389 if (mpi_test_bit(h, i) == 0 && mpi_test_bit(k, i) == 1) {
1390 point_set(&p2, result);
1391 mpi_ec_add_points(result, &p2, &p1inv, ctx);
1401 EXPORT_SYMBOL_GPL(mpi_ec_mul_point);
1403 /* Return true if POINT is on the curve described by CTX. */
1404 int mpi_ec_curve_point(MPI_POINT point, struct mpi_ec_ctx *ctx)
1413 /* Check that the point is in range. This needs to be done here and
1414 * not after conversion to affine coordinates.
1416 if (mpi_cmpabs(point->x, ctx->p) >= 0)
1418 if (mpi_cmpabs(point->y, ctx->p) >= 0)
1420 if (mpi_cmpabs(point->z, ctx->p) >= 0)
1423 switch (ctx->model) {
1424 case MPI_EC_WEIERSTRASS:
1428 if (mpi_ec_get_affine(x, y, point, ctx))
1433 /* y^2 == x^3 + a·x + b */
1436 ec_pow3(xxx, x, ctx);
1437 ec_mulm(w, ctx->a, x, ctx);
1438 ec_addm(w, w, ctx->b, ctx);
1439 ec_addm(w, w, xxx, ctx);
1448 case MPI_EC_MONTGOMERY:
1451 /* With Montgomery curve, only X-coordinate is valid. */
1452 if (mpi_ec_get_affine(x, NULL, point, ctx))
1455 /* The equation is: b * y^2 == x^3 + a · x^2 + x */
1456 /* We check if right hand is quadratic residue or not by
1457 * Euler's criterion.
1459 /* CTX->A has (a-2)/4 and CTX->B has b^-1 */
1460 ec_mulm(w, ctx->a, mpi_const(MPI_C_FOUR), ctx);
1461 ec_addm(w, w, mpi_const(MPI_C_TWO), ctx);
1462 ec_mulm(w, w, x, ctx);
1463 ec_pow2(xx, x, ctx);
1464 ec_addm(w, w, xx, ctx);
1465 ec_addm(w, w, mpi_const(MPI_C_ONE), ctx);
1466 ec_mulm(w, w, x, ctx);
1467 ec_mulm(w, w, ctx->b, ctx);
1469 /* Compute Euler's criterion: w^(p-1)/2 */
1471 ec_subm(p_minus1, ctx->p, mpi_const(MPI_C_ONE), ctx);
1472 mpi_rshift(p_minus1, p_minus1, 1);
1473 ec_powm(w, w, p_minus1, ctx);
1475 res = !mpi_cmp_ui(w, 1);
1480 case MPI_EC_EDWARDS:
1482 if (mpi_ec_get_affine(x, y, point, ctx))
1485 mpi_resize(w, ctx->p->nlimbs);
1486 w->nlimbs = ctx->p->nlimbs;
1488 /* a · x^2 + y^2 - 1 - b · x^2 · y^2 == 0 */
1489 ctx->pow2(x, x, ctx);
1490 ctx->pow2(y, y, ctx);
1491 if (ctx->dialect == ECC_DIALECT_ED25519)
1492 ctx->subm(w, ctx->p, x, ctx);
1494 ctx->mulm(w, ctx->a, x, ctx);
1495 ctx->addm(w, w, y, ctx);
1496 ctx->mulm(x, x, y, ctx);
1497 ctx->mulm(x, x, ctx->b, ctx);
1498 ctx->subm(w, w, x, ctx);
1499 if (!mpi_cmp_ui(w, 1))
1512 EXPORT_SYMBOL_GPL(mpi_ec_curve_point);