Manuel Pégourié-Gonnard | 39d2adb | 2012-10-31 09:26:55 +0100 | [diff] [blame] | 1 | /* |
Manuel Pégourié-Gonnard | 32b04c1 | 2013-12-02 15:49:09 +0100 | [diff] [blame] | 2 | * Elliptic curves over GF(p): generic functions |
Manuel Pégourié-Gonnard | 39d2adb | 2012-10-31 09:26:55 +0100 | [diff] [blame] | 3 | * |
Manuel Pégourié-Gonnard | 6fb8187 | 2015-07-27 11:11:48 +0200 | [diff] [blame] | 4 | * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved |
Manuel Pégourié-Gonnard | 37ff140 | 2015-09-04 14:21:07 +0200 | [diff] [blame] | 5 | * SPDX-License-Identifier: Apache-2.0 |
| 6 | * |
| 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 8 | * not use this file except in compliance with the License. |
| 9 | * You may obtain a copy of the License at |
| 10 | * |
| 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | * |
| 13 | * Unless required by applicable law or agreed to in writing, software |
| 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | * See the License for the specific language governing permissions and |
| 17 | * limitations under the License. |
Manuel Pégourié-Gonnard | 39d2adb | 2012-10-31 09:26:55 +0100 | [diff] [blame] | 18 | * |
Manuel Pégourié-Gonnard | fe44643 | 2015-03-06 13:17:10 +0000 | [diff] [blame] | 19 | * This file is part of mbed TLS (https://tls.mbed.org) |
Manuel Pégourié-Gonnard | 39d2adb | 2012-10-31 09:26:55 +0100 | [diff] [blame] | 20 | */ |
| 21 | |
| 22 | /* |
| 23 | * References: |
| 24 | * |
Manuel Pégourié-Gonnard | 883f313 | 2012-11-02 09:40:25 +0100 | [diff] [blame] | 25 | * SEC1 http://www.secg.org/index.php?action=secg,docs_secg |
Manuel Pégourié-Gonnard | d070f51 | 2012-11-08 17:40:51 +0100 | [diff] [blame] | 26 | * GECC = Guide to Elliptic Curve Cryptography - Hankerson, Menezes, Vanstone |
Manuel Pégourié-Gonnard | 62aad14 | 2012-11-10 00:27:12 +0100 | [diff] [blame] | 27 | * FIPS 186-3 http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf |
Manuel Pégourié-Gonnard | 1a96728 | 2013-02-09 17:03:58 +0100 | [diff] [blame] | 28 | * RFC 4492 for the related TLS structures and constants |
Nicholas Wilson | 08f3ef1 | 2015-11-10 13:10:01 +0000 | [diff] [blame] | 29 | * RFC 7748 for the Curve448 and Curve25519 curve definitions |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 30 | * |
Manuel Pégourié-Gonnard | 0789433 | 2015-06-23 00:18:41 +0200 | [diff] [blame] | 31 | * [Curve25519] http://cr.yp.to/ecdh/curve25519-20060209.pdf |
Manuel Pégourié-Gonnard | fe0af40 | 2013-12-04 18:14:55 +0100 | [diff] [blame] | 32 | * |
Manuel Pégourié-Gonnard | 998930a | 2015-04-03 13:48:06 +0200 | [diff] [blame] | 33 | * [2] CORON, Jean-S'ebastien. Resistance against differential power analysis |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 34 | * for elliptic curve cryptosystems. In : Cryptographic Hardware and |
| 35 | * Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302. |
| 36 | * <http://link.springer.com/chapter/10.1007/3-540-48059-5_25> |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 37 | * |
Manuel Pégourié-Gonnard | 998930a | 2015-04-03 13:48:06 +0200 | [diff] [blame] | 38 | * [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 39 | * render ECC resistant against Side Channel Attacks. IACR Cryptology |
| 40 | * ePrint Archive, 2004, vol. 2004, p. 342. |
| 41 | * <http://eprint.iacr.org/2004/342.pdf> |
Manuel Pégourié-Gonnard | 39d2adb | 2012-10-31 09:26:55 +0100 | [diff] [blame] | 42 | */ |
| 43 | |
Gilles Peskine | db09ef6 | 2020-06-03 01:43:33 +0200 | [diff] [blame] | 44 | #include "common.h" |
Manuel Pégourié-Gonnard | 39d2adb | 2012-10-31 09:26:55 +0100 | [diff] [blame] | 45 | |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 46 | /** |
| 47 | * \brief Function level alternative implementation. |
| 48 | * |
| 49 | * The MBEDTLS_ECP_INTERNAL_ALT macro enables alternative implementations to |
| 50 | * replace certain functions in this module. The alternative implementations are |
| 51 | * typically hardware accelerators and need to activate the hardware before the |
| 52 | * computation starts and deactivate it after it finishes. The |
| 53 | * mbedtls_internal_ecp_init() and mbedtls_internal_ecp_free() functions serve |
| 54 | * this purpose. |
| 55 | * |
| 56 | * To preserve the correct functionality the following conditions must hold: |
| 57 | * |
| 58 | * - The alternative implementation must be activated by |
| 59 | * mbedtls_internal_ecp_init() before any of the replaceable functions is |
| 60 | * called. |
| 61 | * - mbedtls_internal_ecp_free() must \b only be called when the alternative |
| 62 | * implementation is activated. |
| 63 | * - mbedtls_internal_ecp_init() must \b not be called when the alternative |
| 64 | * implementation is activated. |
| 65 | * - Public functions must not return while the alternative implementation is |
| 66 | * activated. |
| 67 | * - Replaceable functions are guarded by \c MBEDTLS_ECP_XXX_ALT macros and |
| 68 | * before calling them an \code if( mbedtls_internal_ecp_grp_capable( grp ) ) |
| 69 | * \endcode ensures that the alternative implementation supports the current |
| 70 | * group. |
| 71 | */ |
| 72 | #if defined(MBEDTLS_ECP_INTERNAL_ALT) |
| 73 | #endif |
| 74 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 75 | #if defined(MBEDTLS_ECP_C) |
Manuel Pégourié-Gonnard | 39d2adb | 2012-10-31 09:26:55 +0100 | [diff] [blame] | 76 | |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 77 | #include "mbedtls/ecp.h" |
Janos Follath | 430d337 | 2016-11-03 14:25:37 +0000 | [diff] [blame] | 78 | #include "mbedtls/threading.h" |
Andres Amaya Garcia | 1f6301b | 2018-04-17 09:51:09 -0500 | [diff] [blame] | 79 | #include "mbedtls/platform_util.h" |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 80 | #include "mbedtls/error.h" |
Paul Bakker | 6e339b5 | 2013-07-03 13:37:05 +0200 | [diff] [blame] | 81 | |
Rich Evans | 00ab470 | 2015-02-06 13:43:58 +0000 | [diff] [blame] | 82 | #include <string.h> |
| 83 | |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 84 | #if !defined(MBEDTLS_ECP_ALT) |
| 85 | |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 86 | /* Parameter validation macros based on platform_util.h */ |
| 87 | #define ECP_VALIDATE_RET( cond ) \ |
| 88 | MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_ECP_BAD_INPUT_DATA ) |
| 89 | #define ECP_VALIDATE( cond ) \ |
| 90 | MBEDTLS_INTERNAL_VALIDATE( cond ) |
| 91 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 92 | #if defined(MBEDTLS_PLATFORM_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 93 | #include "mbedtls/platform.h" |
Paul Bakker | 6e339b5 | 2013-07-03 13:37:05 +0200 | [diff] [blame] | 94 | #else |
Rich Evans | 00ab470 | 2015-02-06 13:43:58 +0000 | [diff] [blame] | 95 | #include <stdlib.h> |
Manuel Pégourié-Gonnard | 981732b | 2015-02-17 15:46:45 +0000 | [diff] [blame] | 96 | #include <stdio.h> |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 97 | #define mbedtls_printf printf |
Manuel Pégourié-Gonnard | 7551cb9 | 2015-05-26 16:04:06 +0200 | [diff] [blame] | 98 | #define mbedtls_calloc calloc |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 99 | #define mbedtls_free free |
Paul Bakker | 6e339b5 | 2013-07-03 13:37:05 +0200 | [diff] [blame] | 100 | #endif |
| 101 | |
Janos Follath | 47d28f0 | 2016-11-01 13:22:05 +0000 | [diff] [blame] | 102 | #include "mbedtls/ecp_internal.h" |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 103 | |
Manuel Pégourié-Gonnard | c52a43c | 2020-05-22 12:12:36 +0200 | [diff] [blame] | 104 | #if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
Manuel Pégourié-Gonnard | d53ef2f | 2020-06-04 12:32:14 +0200 | [diff] [blame] | 105 | #if defined(MBEDTLS_HMAC_DRBG_C) |
Manuel Pégourié-Gonnard | c52a43c | 2020-05-22 12:12:36 +0200 | [diff] [blame] | 106 | #include "mbedtls/hmac_drbg.h" |
Manuel Pégourié-Gonnard | d53ef2f | 2020-06-04 12:32:14 +0200 | [diff] [blame] | 107 | #elif defined(MBEDTLS_CTR_DRBG_C) |
| 108 | #include "mbedtls/ctr_drbg.h" |
Manuel Pégourié-Gonnard | c52a43c | 2020-05-22 12:12:36 +0200 | [diff] [blame] | 109 | #else |
| 110 | #error "Invalid configuration detected. Include check_config.h to ensure that the configuration is valid." |
| 111 | #endif |
| 112 | #endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */ |
| 113 | |
Manuel Pégourié-Gonnard | 0223ab9 | 2015-10-05 11:40:01 +0100 | [diff] [blame] | 114 | #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \ |
| 115 | !defined(inline) && !defined(__cplusplus) |
Paul Bakker | 6a6087e | 2013-10-28 18:53:08 +0100 | [diff] [blame] | 116 | #define inline __inline |
Manuel Pégourié-Gonnard | 20af64d | 2015-07-07 18:33:39 +0200 | [diff] [blame] | 117 | #endif |
Paul Bakker | 6a6087e | 2013-10-28 18:53:08 +0100 | [diff] [blame] | 118 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 119 | #if defined(MBEDTLS_SELF_TEST) |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 120 | /* |
Manuel Pégourié-Gonnard | 9181481 | 2013-11-21 20:23:55 +0100 | [diff] [blame] | 121 | * Counts of point addition and doubling, and field multiplications. |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 122 | * Used to test resistance of point multiplication to simple timing attacks. |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 123 | */ |
Manuel Pégourié-Gonnard | 43863ee | 2013-12-01 16:51:27 +0100 | [diff] [blame] | 124 | static unsigned long add_count, dbl_count, mul_count; |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 125 | #endif |
| 126 | |
Manuel Pégourié-Gonnard | c52a43c | 2020-05-22 12:12:36 +0200 | [diff] [blame] | 127 | #if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
| 128 | /* |
| 129 | * Currently ecp_mul() takes a RNG function as an argument, used for |
Manuel Pégourié-Gonnard | 25705e6 | 2020-06-10 09:18:25 +0200 | [diff] [blame] | 130 | * side-channel protection, but it can be NULL. The initial reasoning was |
Manuel Pégourié-Gonnard | c52a43c | 2020-05-22 12:12:36 +0200 | [diff] [blame] | 131 | * that people will pass non-NULL RNG when they care about side-channels, but |
| 132 | * unfortunately we have some APIs that call ecp_mul() with a NULL RNG, with |
| 133 | * no opportunity for the user to do anything about it. |
| 134 | * |
| 135 | * The obvious strategies for addressing that include: |
| 136 | * - change those APIs so that they take RNG arguments; |
| 137 | * - require a global RNG to be available to all crypto modules. |
| 138 | * |
| 139 | * Unfortunately those would break compatibility. So what we do instead is |
| 140 | * have our own internal DRBG instance, seeded from the secret scalar. |
| 141 | * |
| 142 | * The following is a light-weight abstraction layer for doing that with |
Manuel Pégourié-Gonnard | d53ef2f | 2020-06-04 12:32:14 +0200 | [diff] [blame] | 143 | * HMAC_DRBG (first choice) or CTR_DRBG. |
Manuel Pégourié-Gonnard | c52a43c | 2020-05-22 12:12:36 +0200 | [diff] [blame] | 144 | */ |
| 145 | |
Manuel Pégourié-Gonnard | d53ef2f | 2020-06-04 12:32:14 +0200 | [diff] [blame] | 146 | #if defined(MBEDTLS_HMAC_DRBG_C) |
| 147 | |
| 148 | /* DRBG context type */ |
| 149 | typedef mbedtls_hmac_drbg_context ecp_drbg_context; |
| 150 | |
| 151 | /* DRBG context init */ |
| 152 | static inline void ecp_drbg_init( ecp_drbg_context *ctx ) |
| 153 | { |
| 154 | mbedtls_hmac_drbg_init( ctx ); |
| 155 | } |
| 156 | |
| 157 | /* DRBG context free */ |
| 158 | static inline void ecp_drbg_free( ecp_drbg_context *ctx ) |
| 159 | { |
| 160 | mbedtls_hmac_drbg_free( ctx ); |
| 161 | } |
| 162 | |
| 163 | /* DRBG function */ |
| 164 | static inline int ecp_drbg_random( void *p_rng, |
| 165 | unsigned char *output, size_t output_len ) |
| 166 | { |
| 167 | return( mbedtls_hmac_drbg_random( p_rng, output, output_len ) ); |
| 168 | } |
| 169 | |
| 170 | /* DRBG context seeding */ |
Manuel Pégourié-Gonnard | 4539a45 | 2020-06-18 12:27:56 +0200 | [diff] [blame] | 171 | static int ecp_drbg_seed( ecp_drbg_context *ctx, |
| 172 | const mbedtls_mpi *secret, size_t secret_len ) |
Manuel Pégourié-Gonnard | d53ef2f | 2020-06-04 12:32:14 +0200 | [diff] [blame] | 173 | { |
Manuel Pégourié-Gonnard | 4539a45 | 2020-06-18 12:27:56 +0200 | [diff] [blame] | 174 | int ret; |
| 175 | unsigned char secret_bytes[MBEDTLS_ECP_MAX_BYTES]; |
Manuel Pégourié-Gonnard | d53ef2f | 2020-06-04 12:32:14 +0200 | [diff] [blame] | 176 | /* The list starts with strong hashes */ |
| 177 | const mbedtls_md_type_t md_type = mbedtls_md_list()[0]; |
| 178 | const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_type ); |
| 179 | |
Manuel Pégourié-Gonnard | 1215c54 | 2020-06-19 11:59:49 +0200 | [diff] [blame] | 180 | if( secret_len > MBEDTLS_ECP_MAX_BYTES ) |
| 181 | { |
| 182 | ret = MBEDTLS_ERR_ECP_RANDOM_FAILED; |
| 183 | goto cleanup; |
| 184 | } |
| 185 | |
Manuel Pégourié-Gonnard | 4539a45 | 2020-06-18 12:27:56 +0200 | [diff] [blame] | 186 | MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( secret, |
| 187 | secret_bytes, secret_len ) ); |
| 188 | |
| 189 | ret = mbedtls_hmac_drbg_seed_buf( ctx, md_info, secret_bytes, secret_len ); |
| 190 | |
| 191 | cleanup: |
| 192 | mbedtls_platform_zeroize( secret_bytes, secret_len ); |
| 193 | |
| 194 | return( ret ); |
Manuel Pégourié-Gonnard | d53ef2f | 2020-06-04 12:32:14 +0200 | [diff] [blame] | 195 | } |
| 196 | |
| 197 | #elif defined(MBEDTLS_CTR_DRBG_C) |
| 198 | |
Manuel Pégourié-Gonnard | c52a43c | 2020-05-22 12:12:36 +0200 | [diff] [blame] | 199 | /* DRBG context type */ |
| 200 | typedef mbedtls_ctr_drbg_context ecp_drbg_context; |
| 201 | |
| 202 | /* DRBG context init */ |
| 203 | static inline void ecp_drbg_init( ecp_drbg_context *ctx ) |
| 204 | { |
| 205 | mbedtls_ctr_drbg_init( ctx ); |
| 206 | } |
| 207 | |
| 208 | /* DRBG context free */ |
| 209 | static inline void ecp_drbg_free( ecp_drbg_context *ctx ) |
| 210 | { |
| 211 | mbedtls_ctr_drbg_free( ctx ); |
| 212 | } |
| 213 | |
| 214 | /* DRBG function */ |
| 215 | static inline int ecp_drbg_random( void *p_rng, |
| 216 | unsigned char *output, size_t output_len ) |
| 217 | { |
| 218 | return( mbedtls_ctr_drbg_random( p_rng, output, output_len ) ); |
| 219 | } |
| 220 | |
| 221 | /* |
| 222 | * Since CTR_DRBG doesn't have a seed_buf() function the way HMAC_DRBG does, |
| 223 | * we need to pass an entropy function when seeding. So we use a dummy |
| 224 | * function for that, and pass the actual entropy as customisation string. |
| 225 | * (During seeding of CTR_DRBG the entropy input and customisation string are |
| 226 | * concatenated before being used to update the secret state.) |
| 227 | */ |
| 228 | static int ecp_ctr_drbg_null_entropy(void *ctx, unsigned char *out, size_t len) |
| 229 | { |
| 230 | (void) ctx; |
| 231 | memset( out, 0, len ); |
| 232 | return( 0 ); |
| 233 | } |
| 234 | |
| 235 | /* DRBG context seeding */ |
Manuel Pégourié-Gonnard | 4539a45 | 2020-06-18 12:27:56 +0200 | [diff] [blame] | 236 | static int ecp_drbg_seed( ecp_drbg_context *ctx, |
| 237 | const mbedtls_mpi *secret, size_t secret_len ) |
Manuel Pégourié-Gonnard | c52a43c | 2020-05-22 12:12:36 +0200 | [diff] [blame] | 238 | { |
Manuel Pégourié-Gonnard | 4539a45 | 2020-06-18 12:27:56 +0200 | [diff] [blame] | 239 | int ret; |
| 240 | unsigned char secret_bytes[MBEDTLS_ECP_MAX_BYTES]; |
Manuel Pégourié-Gonnard | c52a43c | 2020-05-22 12:12:36 +0200 | [diff] [blame] | 241 | |
Manuel Pégourié-Gonnard | 1215c54 | 2020-06-19 11:59:49 +0200 | [diff] [blame] | 242 | if( secret_len > MBEDTLS_ECP_MAX_BYTES ) |
| 243 | { |
| 244 | ret = MBEDTLS_ERR_ECP_RANDOM_FAILED; |
| 245 | goto cleanup; |
| 246 | } |
| 247 | |
Manuel Pégourié-Gonnard | 4539a45 | 2020-06-18 12:27:56 +0200 | [diff] [blame] | 248 | MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( secret, |
| 249 | secret_bytes, secret_len ) ); |
| 250 | |
| 251 | ret = mbedtls_ctr_drbg_seed( ctx, ecp_ctr_drbg_null_entropy, NULL, |
| 252 | secret_bytes, secret_len ); |
| 253 | |
| 254 | cleanup: |
| 255 | mbedtls_platform_zeroize( secret_bytes, secret_len ); |
| 256 | |
| 257 | return( ret ); |
Manuel Pégourié-Gonnard | c52a43c | 2020-05-22 12:12:36 +0200 | [diff] [blame] | 258 | } |
| 259 | |
Manuel Pégourié-Gonnard | c52a43c | 2020-05-22 12:12:36 +0200 | [diff] [blame] | 260 | #else |
| 261 | #error "Invalid configuration detected. Include check_config.h to ensure that the configuration is valid." |
| 262 | #endif /* DRBG modules */ |
| 263 | #endif /* MBEDTLS_ECP_NO_INTERNAL_RNG */ |
| 264 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 265 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 054433c | 2017-03-22 11:18:33 +0100 | [diff] [blame] | 266 | /* |
| 267 | * Maximum number of "basic operations" to be done in a row. |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 268 | * |
| 269 | * Default value 0 means that ECC operations will not yield. |
| 270 | * Note that regardless of the value of ecp_max_ops, always at |
| 271 | * least one step is performed before yielding. |
| 272 | * |
| 273 | * Setting ecp_max_ops=1 can be suitable for testing purposes |
| 274 | * as it will interrupt computation at all possible points. |
Manuel Pégourié-Gonnard | 054433c | 2017-03-22 11:18:33 +0100 | [diff] [blame] | 275 | */ |
| 276 | static unsigned ecp_max_ops = 0; |
| 277 | |
| 278 | /* |
| 279 | * Set ecp_max_ops |
| 280 | */ |
| 281 | void mbedtls_ecp_set_max_ops( unsigned max_ops ) |
| 282 | { |
| 283 | ecp_max_ops = max_ops; |
| 284 | } |
Manuel Pégourié-Gonnard | 510d5ca | 2017-03-08 11:41:47 +0100 | [diff] [blame] | 285 | |
| 286 | /* |
Manuel Pégourié-Gonnard | a0c5bcc | 2017-04-21 11:33:57 +0200 | [diff] [blame] | 287 | * Check if restart is enabled |
| 288 | */ |
Manuel Pégourié-Gonnard | b843b15 | 2018-10-16 10:41:31 +0200 | [diff] [blame] | 289 | int mbedtls_ecp_restart_is_enabled( void ) |
Manuel Pégourié-Gonnard | a0c5bcc | 2017-04-21 11:33:57 +0200 | [diff] [blame] | 290 | { |
| 291 | return( ecp_max_ops != 0 ); |
| 292 | } |
| 293 | |
| 294 | /* |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 295 | * Restart sub-context for ecp_mul_comb() |
Manuel Pégourié-Gonnard | 510d5ca | 2017-03-08 11:41:47 +0100 | [diff] [blame] | 296 | */ |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 297 | struct mbedtls_ecp_restart_mul |
| 298 | { |
Manuel Pégourié-Gonnard | 8962ddb | 2017-03-14 12:11:21 +0100 | [diff] [blame] | 299 | mbedtls_ecp_point R; /* current intermediate result */ |
Manuel Pégourié-Gonnard | c5d844b | 2017-03-15 13:06:28 +0100 | [diff] [blame] | 300 | size_t i; /* current index in various loops, 0 outside */ |
Manuel Pégourié-Gonnard | c9c0aa6 | 2017-03-16 14:53:26 +0100 | [diff] [blame] | 301 | mbedtls_ecp_point *T; /* table for precomputed points */ |
| 302 | unsigned char T_size; /* number of points in table T */ |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 303 | enum { /* what were we doing last time we returned? */ |
| 304 | ecp_rsm_init = 0, /* nothing so far, dummy initial state */ |
| 305 | ecp_rsm_pre_dbl, /* precompute 2^n multiples */ |
Manuel Pégourié-Gonnard | 45fd016 | 2017-03-22 08:24:42 +0100 | [diff] [blame] | 306 | ecp_rsm_pre_norm_dbl, /* normalize precomputed 2^n multiples */ |
| 307 | ecp_rsm_pre_add, /* precompute remaining points by adding */ |
| 308 | ecp_rsm_pre_norm_add, /* normalize all precomputed points */ |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 309 | ecp_rsm_comb_core, /* ecp_mul_comb_core() */ |
Manuel Pégourié-Gonnard | 45fd016 | 2017-03-22 08:24:42 +0100 | [diff] [blame] | 310 | ecp_rsm_final_norm, /* do the final normalization */ |
Manuel Pégourié-Gonnard | 2fad7ae | 2017-03-14 13:13:13 +0100 | [diff] [blame] | 311 | } state; |
Manuel Pégourié-Gonnard | 53fb66d | 2020-06-04 09:43:14 +0200 | [diff] [blame] | 312 | #if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
| 313 | ecp_drbg_context drbg_ctx; |
| 314 | unsigned char drbg_seeded; |
| 315 | #endif |
Manuel Pégourié-Gonnard | 77af79a | 2017-03-14 10:58:00 +0100 | [diff] [blame] | 316 | }; |
Manuel Pégourié-Gonnard | 510d5ca | 2017-03-08 11:41:47 +0100 | [diff] [blame] | 317 | |
| 318 | /* |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 319 | * Init restart_mul sub-context |
Manuel Pégourié-Gonnard | 510d5ca | 2017-03-08 11:41:47 +0100 | [diff] [blame] | 320 | */ |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 321 | static void ecp_restart_rsm_init( mbedtls_ecp_restart_mul_ctx *ctx ) |
Manuel Pégourié-Gonnard | 77af79a | 2017-03-14 10:58:00 +0100 | [diff] [blame] | 322 | { |
Manuel Pégourié-Gonnard | 5bd38b1 | 2017-08-23 16:55:59 +0200 | [diff] [blame] | 323 | mbedtls_ecp_point_init( &ctx->R ); |
| 324 | ctx->i = 0; |
| 325 | ctx->T = NULL; |
| 326 | ctx->T_size = 0; |
| 327 | ctx->state = ecp_rsm_init; |
Manuel Pégourié-Gonnard | 53fb66d | 2020-06-04 09:43:14 +0200 | [diff] [blame] | 328 | #if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
| 329 | ecp_drbg_init( &ctx->drbg_ctx ); |
| 330 | ctx->drbg_seeded = 0; |
| 331 | #endif |
Manuel Pégourié-Gonnard | 77af79a | 2017-03-14 10:58:00 +0100 | [diff] [blame] | 332 | } |
| 333 | |
| 334 | /* |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 335 | * Free the components of a restart_mul sub-context |
Manuel Pégourié-Gonnard | 77af79a | 2017-03-14 10:58:00 +0100 | [diff] [blame] | 336 | */ |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 337 | static void ecp_restart_rsm_free( mbedtls_ecp_restart_mul_ctx *ctx ) |
Manuel Pégourié-Gonnard | 77af79a | 2017-03-14 10:58:00 +0100 | [diff] [blame] | 338 | { |
Manuel Pégourié-Gonnard | c9c0aa6 | 2017-03-16 14:53:26 +0100 | [diff] [blame] | 339 | unsigned char i; |
| 340 | |
Manuel Pégourié-Gonnard | 77af79a | 2017-03-14 10:58:00 +0100 | [diff] [blame] | 341 | if( ctx == NULL ) |
| 342 | return; |
Manuel Pégourié-Gonnard | 78d564a | 2017-03-14 11:48:38 +0100 | [diff] [blame] | 343 | |
Manuel Pégourié-Gonnard | 8962ddb | 2017-03-14 12:11:21 +0100 | [diff] [blame] | 344 | mbedtls_ecp_point_free( &ctx->R ); |
Manuel Pégourié-Gonnard | 2fad7ae | 2017-03-14 13:13:13 +0100 | [diff] [blame] | 345 | |
Manuel Pégourié-Gonnard | 31f0ef7 | 2017-05-17 10:05:58 +0200 | [diff] [blame] | 346 | if( ctx->T != NULL ) |
| 347 | { |
Manuel Pégourié-Gonnard | c9c0aa6 | 2017-03-16 14:53:26 +0100 | [diff] [blame] | 348 | for( i = 0; i < ctx->T_size; i++ ) |
| 349 | mbedtls_ecp_point_free( ctx->T + i ); |
| 350 | mbedtls_free( ctx->T ); |
| 351 | } |
| 352 | |
Manuel Pégourié-Gonnard | 53fb66d | 2020-06-04 09:43:14 +0200 | [diff] [blame] | 353 | #if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
| 354 | ecp_drbg_free( &ctx->drbg_ctx ); |
| 355 | #endif |
| 356 | |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 357 | ecp_restart_rsm_init( ctx ); |
Manuel Pégourié-Gonnard | 77af79a | 2017-03-14 10:58:00 +0100 | [diff] [blame] | 358 | } |
Manuel Pégourié-Gonnard | 2fad7ae | 2017-03-14 13:13:13 +0100 | [diff] [blame] | 359 | |
| 360 | /* |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 361 | * Restart context for ecp_muladd() |
| 362 | */ |
| 363 | struct mbedtls_ecp_restart_muladd |
| 364 | { |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 365 | mbedtls_ecp_point mP; /* mP value */ |
| 366 | mbedtls_ecp_point R; /* R intermediate result */ |
| 367 | enum { /* what should we do next? */ |
| 368 | ecp_rsma_mul1 = 0, /* first multiplication */ |
| 369 | ecp_rsma_mul2, /* second multiplication */ |
| 370 | ecp_rsma_add, /* addition */ |
| 371 | ecp_rsma_norm, /* normalization */ |
| 372 | } state; |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 373 | }; |
| 374 | |
| 375 | /* |
| 376 | * Init restart_muladd sub-context |
| 377 | */ |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 378 | static void ecp_restart_ma_init( mbedtls_ecp_restart_muladd_ctx *ctx ) |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 379 | { |
Manuel Pégourié-Gonnard | 5bd38b1 | 2017-08-23 16:55:59 +0200 | [diff] [blame] | 380 | mbedtls_ecp_point_init( &ctx->mP ); |
| 381 | mbedtls_ecp_point_init( &ctx->R ); |
| 382 | ctx->state = ecp_rsma_mul1; |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 383 | } |
| 384 | |
| 385 | /* |
| 386 | * Free the components of a restart_muladd sub-context |
| 387 | */ |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 388 | static void ecp_restart_ma_free( mbedtls_ecp_restart_muladd_ctx *ctx ) |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 389 | { |
| 390 | if( ctx == NULL ) |
| 391 | return; |
| 392 | |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 393 | mbedtls_ecp_point_free( &ctx->mP ); |
| 394 | mbedtls_ecp_point_free( &ctx->R ); |
| 395 | |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 396 | ecp_restart_ma_init( ctx ); |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 397 | } |
| 398 | |
| 399 | /* |
Manuel Pégourié-Gonnard | b739a71 | 2017-04-19 10:11:56 +0200 | [diff] [blame] | 400 | * Initialize a restart context |
| 401 | */ |
| 402 | void mbedtls_ecp_restart_init( mbedtls_ecp_restart_ctx *ctx ) |
| 403 | { |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 404 | ECP_VALIDATE( ctx != NULL ); |
Manuel Pégourié-Gonnard | 5bd38b1 | 2017-08-23 16:55:59 +0200 | [diff] [blame] | 405 | ctx->ops_done = 0; |
| 406 | ctx->depth = 0; |
| 407 | ctx->rsm = NULL; |
| 408 | ctx->ma = NULL; |
Manuel Pégourié-Gonnard | b739a71 | 2017-04-19 10:11:56 +0200 | [diff] [blame] | 409 | } |
| 410 | |
| 411 | /* |
| 412 | * Free the components of a restart context |
| 413 | */ |
| 414 | void mbedtls_ecp_restart_free( mbedtls_ecp_restart_ctx *ctx ) |
| 415 | { |
| 416 | if( ctx == NULL ) |
| 417 | return; |
| 418 | |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 419 | ecp_restart_rsm_free( ctx->rsm ); |
Manuel Pégourié-Gonnard | b739a71 | 2017-04-19 10:11:56 +0200 | [diff] [blame] | 420 | mbedtls_free( ctx->rsm ); |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 421 | |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 422 | ecp_restart_ma_free( ctx->ma ); |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 423 | mbedtls_free( ctx->ma ); |
Manuel Pégourié-Gonnard | 5bd38b1 | 2017-08-23 16:55:59 +0200 | [diff] [blame] | 424 | |
| 425 | mbedtls_ecp_restart_init( ctx ); |
Manuel Pégourié-Gonnard | b739a71 | 2017-04-19 10:11:56 +0200 | [diff] [blame] | 426 | } |
| 427 | |
| 428 | /* |
Manuel Pégourié-Gonnard | 2fad7ae | 2017-03-14 13:13:13 +0100 | [diff] [blame] | 429 | * Check if we can do the next step |
| 430 | */ |
Manuel Pégourié-Gonnard | c751148 | 2017-04-20 16:31:00 +0200 | [diff] [blame] | 431 | int mbedtls_ecp_check_budget( const mbedtls_ecp_group *grp, |
| 432 | mbedtls_ecp_restart_ctx *rs_ctx, |
| 433 | unsigned ops ) |
Manuel Pégourié-Gonnard | 2fad7ae | 2017-03-14 13:13:13 +0100 | [diff] [blame] | 434 | { |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 435 | ECP_VALIDATE_RET( grp != NULL ); |
| 436 | |
Manuel Pégourié-Gonnard | 646393b | 2017-04-20 10:03:45 +0200 | [diff] [blame] | 437 | if( rs_ctx != NULL && ecp_max_ops != 0 ) |
Manuel Pégourié-Gonnard | 2fad7ae | 2017-03-14 13:13:13 +0100 | [diff] [blame] | 438 | { |
Manuel Pégourié-Gonnard | e685449 | 2017-03-20 14:35:19 +0100 | [diff] [blame] | 439 | /* scale depending on curve size: the chosen reference is 256-bit, |
| 440 | * and multiplication is quadratic. Round to the closest integer. */ |
| 441 | if( grp->pbits >= 512 ) |
| 442 | ops *= 4; |
| 443 | else if( grp->pbits >= 384 ) |
| 444 | ops *= 2; |
| 445 | |
Hanno Becker | b10c660 | 2018-10-26 13:50:13 +0100 | [diff] [blame] | 446 | /* Avoid infinite loops: always allow first step. |
| 447 | * Because of that, however, it's not generally true |
| 448 | * that ops_done <= ecp_max_ops, so the check |
| 449 | * ops_done > ecp_max_ops below is mandatory. */ |
| 450 | if( ( rs_ctx->ops_done != 0 ) && |
| 451 | ( rs_ctx->ops_done > ecp_max_ops || |
| 452 | ops > ecp_max_ops - rs_ctx->ops_done ) ) |
| 453 | { |
Manuel Pégourié-Gonnard | 2fad7ae | 2017-03-14 13:13:13 +0100 | [diff] [blame] | 454 | return( MBEDTLS_ERR_ECP_IN_PROGRESS ); |
Hanno Becker | b10c660 | 2018-10-26 13:50:13 +0100 | [diff] [blame] | 455 | } |
Manuel Pégourié-Gonnard | 2fad7ae | 2017-03-14 13:13:13 +0100 | [diff] [blame] | 456 | |
Manuel Pégourié-Gonnard | e685449 | 2017-03-20 14:35:19 +0100 | [diff] [blame] | 457 | /* update running count */ |
Manuel Pégourié-Gonnard | 646393b | 2017-04-20 10:03:45 +0200 | [diff] [blame] | 458 | rs_ctx->ops_done += ops; |
Manuel Pégourié-Gonnard | 2fad7ae | 2017-03-14 13:13:13 +0100 | [diff] [blame] | 459 | } |
| 460 | |
| 461 | return( 0 ); |
| 462 | } |
| 463 | |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 464 | /* Call this when entering a function that needs its own sub-context */ |
Manuel Pégourié-Gonnard | a58e011 | 2018-10-16 10:42:47 +0200 | [diff] [blame] | 465 | #define ECP_RS_ENTER( SUB ) do { \ |
| 466 | /* reset ops count for this call if top-level */ \ |
| 467 | if( rs_ctx != NULL && rs_ctx->depth++ == 0 ) \ |
| 468 | rs_ctx->ops_done = 0; \ |
| 469 | \ |
| 470 | /* set up our own sub-context if needed */ \ |
| 471 | if( mbedtls_ecp_restart_is_enabled() && \ |
| 472 | rs_ctx != NULL && rs_ctx->SUB == NULL ) \ |
| 473 | { \ |
| 474 | rs_ctx->SUB = mbedtls_calloc( 1, sizeof( *rs_ctx->SUB ) ); \ |
| 475 | if( rs_ctx->SUB == NULL ) \ |
| 476 | return( MBEDTLS_ERR_ECP_ALLOC_FAILED ); \ |
| 477 | \ |
| 478 | ecp_restart_## SUB ##_init( rs_ctx->SUB ); \ |
| 479 | } \ |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 480 | } while( 0 ) |
| 481 | |
| 482 | /* Call this when leaving a function that needs its own sub-context */ |
Manuel Pégourié-Gonnard | a58e011 | 2018-10-16 10:42:47 +0200 | [diff] [blame] | 483 | #define ECP_RS_LEAVE( SUB ) do { \ |
| 484 | /* clear our sub-context when not in progress (done or error) */ \ |
| 485 | if( rs_ctx != NULL && rs_ctx->SUB != NULL && \ |
| 486 | ret != MBEDTLS_ERR_ECP_IN_PROGRESS ) \ |
| 487 | { \ |
| 488 | ecp_restart_## SUB ##_free( rs_ctx->SUB ); \ |
| 489 | mbedtls_free( rs_ctx->SUB ); \ |
| 490 | rs_ctx->SUB = NULL; \ |
| 491 | } \ |
| 492 | \ |
| 493 | if( rs_ctx != NULL ) \ |
| 494 | rs_ctx->depth--; \ |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 495 | } while( 0 ) |
| 496 | |
| 497 | #else /* MBEDTLS_ECP_RESTARTABLE */ |
| 498 | |
| 499 | #define ECP_RS_ENTER( sub ) (void) rs_ctx; |
| 500 | #define ECP_RS_LEAVE( sub ) (void) rs_ctx; |
| 501 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 502 | #endif /* MBEDTLS_ECP_RESTARTABLE */ |
Manuel Pégourié-Gonnard | 054433c | 2017-03-22 11:18:33 +0100 | [diff] [blame] | 503 | |
Manuel Pégourié-Gonnard | 7c94d8b | 2013-12-04 23:15:46 +0100 | [diff] [blame] | 504 | /* |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 505 | * List of supported curves: |
| 506 | * - internal ID |
Christoph M. Wintersteiger | cb31073 | 2019-02-15 15:50:38 +0000 | [diff] [blame] | 507 | * - TLS NamedCurve ID (RFC 4492 sec. 5.1.1, RFC 7071 sec. 2, RFC 8446 sec. 4.2.7) |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 508 | * - size in bits |
Manuel Pégourié-Gonnard | 8195c1a | 2013-10-07 19:40:41 +0200 | [diff] [blame] | 509 | * - readable name |
Gergely Budai | e40c469 | 2014-01-22 11:22:20 +0100 | [diff] [blame] | 510 | * |
Manuel Pégourié-Gonnard | ac71941 | 2014-02-04 14:48:50 +0100 | [diff] [blame] | 511 | * Curves are listed in order: largest curves first, and for a given size, |
| 512 | * fastest curves first. This provides the default order for the SSL module. |
Manuel Pégourié-Gonnard | 88db5da | 2015-06-15 14:34:59 +0200 | [diff] [blame] | 513 | * |
Gilles Peskine | 1174db5 | 2020-02-26 19:52:06 +0100 | [diff] [blame] | 514 | * Reminder: update profiles in x509_crt.c when adding a new curves! |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 515 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 516 | static const mbedtls_ecp_curve_info ecp_supported_curves[] = |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 517 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 518 | #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) |
| 519 | { MBEDTLS_ECP_DP_SECP521R1, 25, 521, "secp521r1" }, |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 520 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 521 | #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) |
| 522 | { MBEDTLS_ECP_DP_BP512R1, 28, 512, "brainpoolP512r1" }, |
Gergely Budai | e40c469 | 2014-01-22 11:22:20 +0100 | [diff] [blame] | 523 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 524 | #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) |
| 525 | { MBEDTLS_ECP_DP_SECP384R1, 24, 384, "secp384r1" }, |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 526 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 527 | #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) |
| 528 | { MBEDTLS_ECP_DP_BP384R1, 27, 384, "brainpoolP384r1" }, |
Gergely Budai | e40c469 | 2014-01-22 11:22:20 +0100 | [diff] [blame] | 529 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 530 | #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) |
| 531 | { MBEDTLS_ECP_DP_SECP256R1, 23, 256, "secp256r1" }, |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 532 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 533 | #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) |
| 534 | { MBEDTLS_ECP_DP_SECP256K1, 22, 256, "secp256k1" }, |
Manuel Pégourié-Gonnard | ac71941 | 2014-02-04 14:48:50 +0100 | [diff] [blame] | 535 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 536 | #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) |
| 537 | { MBEDTLS_ECP_DP_BP256R1, 26, 256, "brainpoolP256r1" }, |
Gergely Budai | e40c469 | 2014-01-22 11:22:20 +0100 | [diff] [blame] | 538 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 539 | #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) |
| 540 | { MBEDTLS_ECP_DP_SECP224R1, 21, 224, "secp224r1" }, |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 541 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 542 | #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) |
| 543 | { MBEDTLS_ECP_DP_SECP224K1, 20, 224, "secp224k1" }, |
Manuel Pégourié-Gonnard | 9bcff39 | 2014-01-10 18:26:48 +0100 | [diff] [blame] | 544 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 545 | #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) |
| 546 | { MBEDTLS_ECP_DP_SECP192R1, 19, 192, "secp192r1" }, |
Manuel Pégourié-Gonnard | ac71941 | 2014-02-04 14:48:50 +0100 | [diff] [blame] | 547 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 548 | #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) |
| 549 | { MBEDTLS_ECP_DP_SECP192K1, 18, 192, "secp192k1" }, |
Manuel Pégourié-Gonnard | 9bcff39 | 2014-01-10 18:26:48 +0100 | [diff] [blame] | 550 | #endif |
Christoph M. Wintersteiger | 2c69d10 | 2019-02-22 15:05:02 +0000 | [diff] [blame] | 551 | #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) && defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) |
Christoph M. Wintersteiger | 86e36c4 | 2018-12-06 17:27:31 +0000 | [diff] [blame] | 552 | { MBEDTLS_ECP_DP_CURVE25519, 29, 256, "x25519" }, |
Christoph M. Wintersteiger | c9f737b | 2018-10-25 13:03:05 +0100 | [diff] [blame] | 553 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 554 | { MBEDTLS_ECP_DP_NONE, 0, 0, NULL }, |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 555 | }; |
Manuel Pégourié-Gonnard | ac71941 | 2014-02-04 14:48:50 +0100 | [diff] [blame] | 556 | |
Manuel Pégourié-Gonnard | ba782bb | 2014-07-08 13:31:34 +0200 | [diff] [blame] | 557 | #define ECP_NB_CURVES sizeof( ecp_supported_curves ) / \ |
| 558 | sizeof( ecp_supported_curves[0] ) |
| 559 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 560 | static mbedtls_ecp_group_id ecp_supported_grp_id[ECP_NB_CURVES]; |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 561 | |
| 562 | /* |
Manuel Pégourié-Gonnard | da179e4 | 2013-09-18 15:31:24 +0200 | [diff] [blame] | 563 | * List of supported curves and associated info |
| 564 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 565 | const mbedtls_ecp_curve_info *mbedtls_ecp_curve_list( void ) |
Manuel Pégourié-Gonnard | da179e4 | 2013-09-18 15:31:24 +0200 | [diff] [blame] | 566 | { |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 567 | return( ecp_supported_curves ); |
Manuel Pégourié-Gonnard | da179e4 | 2013-09-18 15:31:24 +0200 | [diff] [blame] | 568 | } |
| 569 | |
| 570 | /* |
Manuel Pégourié-Gonnard | ac71941 | 2014-02-04 14:48:50 +0100 | [diff] [blame] | 571 | * List of supported curves, group ID only |
| 572 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 573 | const mbedtls_ecp_group_id *mbedtls_ecp_grp_id_list( void ) |
Manuel Pégourié-Gonnard | ac71941 | 2014-02-04 14:48:50 +0100 | [diff] [blame] | 574 | { |
| 575 | static int init_done = 0; |
| 576 | |
| 577 | if( ! init_done ) |
| 578 | { |
| 579 | size_t i = 0; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 580 | const mbedtls_ecp_curve_info *curve_info; |
Manuel Pégourié-Gonnard | ac71941 | 2014-02-04 14:48:50 +0100 | [diff] [blame] | 581 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 582 | for( curve_info = mbedtls_ecp_curve_list(); |
| 583 | curve_info->grp_id != MBEDTLS_ECP_DP_NONE; |
Manuel Pégourié-Gonnard | ac71941 | 2014-02-04 14:48:50 +0100 | [diff] [blame] | 584 | curve_info++ ) |
| 585 | { |
| 586 | ecp_supported_grp_id[i++] = curve_info->grp_id; |
| 587 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 588 | ecp_supported_grp_id[i] = MBEDTLS_ECP_DP_NONE; |
Manuel Pégourié-Gonnard | ac71941 | 2014-02-04 14:48:50 +0100 | [diff] [blame] | 589 | |
| 590 | init_done = 1; |
| 591 | } |
| 592 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 593 | return( ecp_supported_grp_id ); |
Manuel Pégourié-Gonnard | ac71941 | 2014-02-04 14:48:50 +0100 | [diff] [blame] | 594 | } |
| 595 | |
| 596 | /* |
| 597 | * Get the curve info for the internal identifier |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 598 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 599 | const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_grp_id( mbedtls_ecp_group_id grp_id ) |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 600 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 601 | const mbedtls_ecp_curve_info *curve_info; |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 602 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 603 | for( curve_info = mbedtls_ecp_curve_list(); |
| 604 | curve_info->grp_id != MBEDTLS_ECP_DP_NONE; |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 605 | curve_info++ ) |
| 606 | { |
| 607 | if( curve_info->grp_id == grp_id ) |
| 608 | return( curve_info ); |
| 609 | } |
| 610 | |
| 611 | return( NULL ); |
| 612 | } |
| 613 | |
| 614 | /* |
| 615 | * Get the curve info from the TLS identifier |
| 616 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 617 | const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_tls_id( uint16_t tls_id ) |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 618 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 619 | const mbedtls_ecp_curve_info *curve_info; |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 620 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 621 | for( curve_info = mbedtls_ecp_curve_list(); |
| 622 | curve_info->grp_id != MBEDTLS_ECP_DP_NONE; |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 623 | curve_info++ ) |
| 624 | { |
| 625 | if( curve_info->tls_id == tls_id ) |
| 626 | return( curve_info ); |
| 627 | } |
| 628 | |
| 629 | return( NULL ); |
| 630 | } |
| 631 | |
| 632 | /* |
Manuel Pégourié-Gonnard | 0267e3d | 2013-11-30 15:10:14 +0100 | [diff] [blame] | 633 | * Get the curve info from the name |
| 634 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 635 | const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_name( const char *name ) |
Manuel Pégourié-Gonnard | 0267e3d | 2013-11-30 15:10:14 +0100 | [diff] [blame] | 636 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 637 | const mbedtls_ecp_curve_info *curve_info; |
Manuel Pégourié-Gonnard | 0267e3d | 2013-11-30 15:10:14 +0100 | [diff] [blame] | 638 | |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 639 | if( name == NULL ) |
| 640 | return( NULL ); |
| 641 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 642 | for( curve_info = mbedtls_ecp_curve_list(); |
| 643 | curve_info->grp_id != MBEDTLS_ECP_DP_NONE; |
Manuel Pégourié-Gonnard | 0267e3d | 2013-11-30 15:10:14 +0100 | [diff] [blame] | 644 | curve_info++ ) |
| 645 | { |
Manuel Pégourié-Gonnard | cb46fd8 | 2015-05-28 17:06:07 +0200 | [diff] [blame] | 646 | if( strcmp( curve_info->name, name ) == 0 ) |
Manuel Pégourié-Gonnard | 0267e3d | 2013-11-30 15:10:14 +0100 | [diff] [blame] | 647 | return( curve_info ); |
| 648 | } |
| 649 | |
| 650 | return( NULL ); |
| 651 | } |
| 652 | |
| 653 | /* |
Manuel Pégourié-Gonnard | 7c94d8b | 2013-12-04 23:15:46 +0100 | [diff] [blame] | 654 | * Get the type of a curve |
Manuel Pégourié-Gonnard | 312d2e8 | 2013-12-04 11:08:01 +0100 | [diff] [blame] | 655 | */ |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 656 | mbedtls_ecp_curve_type mbedtls_ecp_get_type( const mbedtls_ecp_group *grp ) |
Manuel Pégourié-Gonnard | 312d2e8 | 2013-12-04 11:08:01 +0100 | [diff] [blame] | 657 | { |
Manuel Pégourié-Gonnard | 7c94d8b | 2013-12-04 23:15:46 +0100 | [diff] [blame] | 658 | if( grp->G.X.p == NULL ) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 659 | return( MBEDTLS_ECP_TYPE_NONE ); |
Manuel Pégourié-Gonnard | 7c94d8b | 2013-12-04 23:15:46 +0100 | [diff] [blame] | 660 | |
| 661 | if( grp->G.Y.p == NULL ) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 662 | return( MBEDTLS_ECP_TYPE_MONTGOMERY ); |
Manuel Pégourié-Gonnard | 7c94d8b | 2013-12-04 23:15:46 +0100 | [diff] [blame] | 663 | else |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 664 | return( MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS ); |
Manuel Pégourié-Gonnard | 312d2e8 | 2013-12-04 11:08:01 +0100 | [diff] [blame] | 665 | } |
| 666 | |
| 667 | /* |
Manuel Pégourié-Gonnard | b505c27 | 2012-11-05 17:27:54 +0100 | [diff] [blame] | 668 | * Initialize (the components of) a point |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 669 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 670 | void mbedtls_ecp_point_init( mbedtls_ecp_point *pt ) |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 671 | { |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 672 | ECP_VALIDATE( pt != NULL ); |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 673 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 674 | mbedtls_mpi_init( &pt->X ); |
| 675 | mbedtls_mpi_init( &pt->Y ); |
| 676 | mbedtls_mpi_init( &pt->Z ); |
Manuel Pégourié-Gonnard | b505c27 | 2012-11-05 17:27:54 +0100 | [diff] [blame] | 677 | } |
| 678 | |
| 679 | /* |
| 680 | * Initialize (the components of) a group |
| 681 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 682 | void mbedtls_ecp_group_init( mbedtls_ecp_group *grp ) |
Manuel Pégourié-Gonnard | b505c27 | 2012-11-05 17:27:54 +0100 | [diff] [blame] | 683 | { |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 684 | ECP_VALIDATE( grp != NULL ); |
Manuel Pégourié-Gonnard | b505c27 | 2012-11-05 17:27:54 +0100 | [diff] [blame] | 685 | |
Manuel Pégourié-Gonnard | 95e2eca | 2018-06-20 10:29:47 +0200 | [diff] [blame] | 686 | grp->id = MBEDTLS_ECP_DP_NONE; |
Manuel Pégourié-Gonnard | 5bd38b1 | 2017-08-23 16:55:59 +0200 | [diff] [blame] | 687 | mbedtls_mpi_init( &grp->P ); |
| 688 | mbedtls_mpi_init( &grp->A ); |
| 689 | mbedtls_mpi_init( &grp->B ); |
| 690 | mbedtls_ecp_point_init( &grp->G ); |
| 691 | mbedtls_mpi_init( &grp->N ); |
| 692 | grp->pbits = 0; |
| 693 | grp->nbits = 0; |
| 694 | grp->h = 0; |
| 695 | grp->modp = NULL; |
| 696 | grp->t_pre = NULL; |
| 697 | grp->t_post = NULL; |
| 698 | grp->t_data = NULL; |
| 699 | grp->T = NULL; |
| 700 | grp->T_size = 0; |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 701 | } |
| 702 | |
| 703 | /* |
Manuel Pégourié-Gonnard | b8c6e0e | 2013-07-01 13:40:52 +0200 | [diff] [blame] | 704 | * Initialize (the components of) a key pair |
| 705 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 706 | void mbedtls_ecp_keypair_init( mbedtls_ecp_keypair *key ) |
Manuel Pégourié-Gonnard | b8c6e0e | 2013-07-01 13:40:52 +0200 | [diff] [blame] | 707 | { |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 708 | ECP_VALIDATE( key != NULL ); |
Manuel Pégourié-Gonnard | b8c6e0e | 2013-07-01 13:40:52 +0200 | [diff] [blame] | 709 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 710 | mbedtls_ecp_group_init( &key->grp ); |
| 711 | mbedtls_mpi_init( &key->d ); |
| 712 | mbedtls_ecp_point_init( &key->Q ); |
Manuel Pégourié-Gonnard | b8c6e0e | 2013-07-01 13:40:52 +0200 | [diff] [blame] | 713 | } |
| 714 | |
| 715 | /* |
Manuel Pégourié-Gonnard | 1e8c8ec | 2012-10-31 19:24:21 +0100 | [diff] [blame] | 716 | * Unallocate (the components of) a point |
| 717 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 718 | void mbedtls_ecp_point_free( mbedtls_ecp_point *pt ) |
Manuel Pégourié-Gonnard | 1e8c8ec | 2012-10-31 19:24:21 +0100 | [diff] [blame] | 719 | { |
| 720 | if( pt == NULL ) |
| 721 | return; |
| 722 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 723 | mbedtls_mpi_free( &( pt->X ) ); |
| 724 | mbedtls_mpi_free( &( pt->Y ) ); |
| 725 | mbedtls_mpi_free( &( pt->Z ) ); |
Manuel Pégourié-Gonnard | 1e8c8ec | 2012-10-31 19:24:21 +0100 | [diff] [blame] | 726 | } |
| 727 | |
| 728 | /* |
| 729 | * Unallocate (the components of) a group |
| 730 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 731 | void mbedtls_ecp_group_free( mbedtls_ecp_group *grp ) |
Manuel Pégourié-Gonnard | 1e8c8ec | 2012-10-31 19:24:21 +0100 | [diff] [blame] | 732 | { |
Manuel Pégourié-Gonnard | 161ef96 | 2013-09-17 19:13:10 +0200 | [diff] [blame] | 733 | size_t i; |
| 734 | |
Manuel Pégourié-Gonnard | 1e8c8ec | 2012-10-31 19:24:21 +0100 | [diff] [blame] | 735 | if( grp == NULL ) |
| 736 | return; |
| 737 | |
Manuel Pégourié-Gonnard | 1f82b04 | 2013-12-06 12:51:50 +0100 | [diff] [blame] | 738 | if( grp->h != 1 ) |
| 739 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 740 | mbedtls_mpi_free( &grp->P ); |
| 741 | mbedtls_mpi_free( &grp->A ); |
| 742 | mbedtls_mpi_free( &grp->B ); |
| 743 | mbedtls_ecp_point_free( &grp->G ); |
| 744 | mbedtls_mpi_free( &grp->N ); |
Manuel Pégourié-Gonnard | 1f82b04 | 2013-12-06 12:51:50 +0100 | [diff] [blame] | 745 | } |
Manuel Pégourié-Gonnard | c972770 | 2013-09-16 18:56:28 +0200 | [diff] [blame] | 746 | |
Manuel Pégourié-Gonnard | 161ef96 | 2013-09-17 19:13:10 +0200 | [diff] [blame] | 747 | if( grp->T != NULL ) |
| 748 | { |
| 749 | for( i = 0; i < grp->T_size; i++ ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 750 | mbedtls_ecp_point_free( &grp->T[i] ); |
| 751 | mbedtls_free( grp->T ); |
Manuel Pégourié-Gonnard | 161ef96 | 2013-09-17 19:13:10 +0200 | [diff] [blame] | 752 | } |
| 753 | |
Andres Amaya Garcia | 1f6301b | 2018-04-17 09:51:09 -0500 | [diff] [blame] | 754 | mbedtls_platform_zeroize( grp, sizeof( mbedtls_ecp_group ) ); |
Manuel Pégourié-Gonnard | 1e8c8ec | 2012-10-31 19:24:21 +0100 | [diff] [blame] | 755 | } |
Manuel Pégourié-Gonnard | 39d2adb | 2012-10-31 09:26:55 +0100 | [diff] [blame] | 756 | |
Manuel Pégourié-Gonnard | 883f313 | 2012-11-02 09:40:25 +0100 | [diff] [blame] | 757 | /* |
Manuel Pégourié-Gonnard | b8c6e0e | 2013-07-01 13:40:52 +0200 | [diff] [blame] | 758 | * Unallocate (the components of) a key pair |
| 759 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 760 | void mbedtls_ecp_keypair_free( mbedtls_ecp_keypair *key ) |
Manuel Pégourié-Gonnard | b8c6e0e | 2013-07-01 13:40:52 +0200 | [diff] [blame] | 761 | { |
Paul Bakker | 66d5d07 | 2014-06-17 16:39:18 +0200 | [diff] [blame] | 762 | if( key == NULL ) |
Manuel Pégourié-Gonnard | b8c6e0e | 2013-07-01 13:40:52 +0200 | [diff] [blame] | 763 | return; |
| 764 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 765 | mbedtls_ecp_group_free( &key->grp ); |
| 766 | mbedtls_mpi_free( &key->d ); |
| 767 | mbedtls_ecp_point_free( &key->Q ); |
Manuel Pégourié-Gonnard | b8c6e0e | 2013-07-01 13:40:52 +0200 | [diff] [blame] | 768 | } |
| 769 | |
| 770 | /* |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 771 | * Copy the contents of a point |
| 772 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 773 | int mbedtls_ecp_copy( mbedtls_ecp_point *P, const mbedtls_ecp_point *Q ) |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 774 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 775 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 776 | ECP_VALIDATE_RET( P != NULL ); |
| 777 | ECP_VALIDATE_RET( Q != NULL ); |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 778 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 779 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->X, &Q->X ) ); |
| 780 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->Y, &Q->Y ) ); |
| 781 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &P->Z, &Q->Z ) ); |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 782 | |
| 783 | cleanup: |
| 784 | return( ret ); |
| 785 | } |
| 786 | |
| 787 | /* |
| 788 | * Copy the contents of a group object |
| 789 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 790 | int mbedtls_ecp_group_copy( mbedtls_ecp_group *dst, const mbedtls_ecp_group *src ) |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 791 | { |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 792 | ECP_VALIDATE_RET( dst != NULL ); |
| 793 | ECP_VALIDATE_RET( src != NULL ); |
| 794 | |
| 795 | return( mbedtls_ecp_group_load( dst, src->id ) ); |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 796 | } |
| 797 | |
| 798 | /* |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 799 | * Set point to zero |
| 800 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 801 | int mbedtls_ecp_set_zero( mbedtls_ecp_point *pt ) |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 802 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 803 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 804 | ECP_VALIDATE_RET( pt != NULL ); |
Manuel Pégourié-Gonnard | 1c2782c | 2012-11-19 20:16:28 +0100 | [diff] [blame] | 805 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 806 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->X , 1 ) ); |
| 807 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Y , 1 ) ); |
| 808 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z , 0 ) ); |
Manuel Pégourié-Gonnard | 1c2782c | 2012-11-19 20:16:28 +0100 | [diff] [blame] | 809 | |
| 810 | cleanup: |
| 811 | return( ret ); |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 812 | } |
| 813 | |
| 814 | /* |
Manuel Pégourié-Gonnard | 6545ca7 | 2013-01-26 16:05:22 +0100 | [diff] [blame] | 815 | * Tell if a point is zero |
| 816 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 817 | int mbedtls_ecp_is_zero( mbedtls_ecp_point *pt ) |
Manuel Pégourié-Gonnard | 6545ca7 | 2013-01-26 16:05:22 +0100 | [diff] [blame] | 818 | { |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 819 | ECP_VALIDATE_RET( pt != NULL ); |
| 820 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 821 | return( mbedtls_mpi_cmp_int( &pt->Z, 0 ) == 0 ); |
Manuel Pégourié-Gonnard | 6545ca7 | 2013-01-26 16:05:22 +0100 | [diff] [blame] | 822 | } |
| 823 | |
| 824 | /* |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 825 | * Compare two points lazily |
Manuel Pégourié-Gonnard | 6029a85 | 2015-08-11 15:44:41 +0200 | [diff] [blame] | 826 | */ |
| 827 | int mbedtls_ecp_point_cmp( const mbedtls_ecp_point *P, |
| 828 | const mbedtls_ecp_point *Q ) |
| 829 | { |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 830 | ECP_VALIDATE_RET( P != NULL ); |
| 831 | ECP_VALIDATE_RET( Q != NULL ); |
| 832 | |
Manuel Pégourié-Gonnard | 6029a85 | 2015-08-11 15:44:41 +0200 | [diff] [blame] | 833 | if( mbedtls_mpi_cmp_mpi( &P->X, &Q->X ) == 0 && |
| 834 | mbedtls_mpi_cmp_mpi( &P->Y, &Q->Y ) == 0 && |
| 835 | mbedtls_mpi_cmp_mpi( &P->Z, &Q->Z ) == 0 ) |
| 836 | { |
| 837 | return( 0 ); |
| 838 | } |
| 839 | |
| 840 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
| 841 | } |
| 842 | |
| 843 | /* |
Manuel Pégourié-Gonnard | 847395a | 2012-11-05 13:13:44 +0100 | [diff] [blame] | 844 | * Import a non-zero point from ASCII strings |
| 845 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 846 | int mbedtls_ecp_point_read_string( mbedtls_ecp_point *P, int radix, |
Manuel Pégourié-Gonnard | 847395a | 2012-11-05 13:13:44 +0100 | [diff] [blame] | 847 | const char *x, const char *y ) |
| 848 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 849 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 850 | ECP_VALIDATE_RET( P != NULL ); |
| 851 | ECP_VALIDATE_RET( x != NULL ); |
| 852 | ECP_VALIDATE_RET( y != NULL ); |
Manuel Pégourié-Gonnard | 847395a | 2012-11-05 13:13:44 +0100 | [diff] [blame] | 853 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 854 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &P->X, radix, x ) ); |
| 855 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &P->Y, radix, y ) ); |
| 856 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &P->Z, 1 ) ); |
Manuel Pégourié-Gonnard | 847395a | 2012-11-05 13:13:44 +0100 | [diff] [blame] | 857 | |
| 858 | cleanup: |
| 859 | return( ret ); |
| 860 | } |
| 861 | |
| 862 | /* |
Janos Follath | 7caf8e4 | 2019-02-20 12:00:22 +0000 | [diff] [blame] | 863 | * Export a point into unsigned binary data (SEC1 2.3.3 and RFC7748) |
Manuel Pégourié-Gonnard | e19feb5 | 2012-11-24 14:10:14 +0100 | [diff] [blame] | 864 | */ |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 865 | int mbedtls_ecp_point_write_binary( const mbedtls_ecp_group *grp, |
| 866 | const mbedtls_ecp_point *P, |
| 867 | int format, size_t *olen, |
| 868 | unsigned char *buf, size_t buflen ) |
Manuel Pégourié-Gonnard | e19feb5 | 2012-11-24 14:10:14 +0100 | [diff] [blame] | 869 | { |
Janos Follath | 28eb06d | 2019-02-26 10:53:34 +0000 | [diff] [blame] | 870 | int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; |
Manuel Pégourié-Gonnard | e19feb5 | 2012-11-24 14:10:14 +0100 | [diff] [blame] | 871 | size_t plen; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 872 | ECP_VALIDATE_RET( grp != NULL ); |
| 873 | ECP_VALIDATE_RET( P != NULL ); |
| 874 | ECP_VALIDATE_RET( olen != NULL ); |
| 875 | ECP_VALIDATE_RET( buf != NULL ); |
| 876 | ECP_VALIDATE_RET( format == MBEDTLS_ECP_PF_UNCOMPRESSED || |
| 877 | format == MBEDTLS_ECP_PF_COMPRESSED ); |
Manuel Pégourié-Gonnard | 37d218a | 2012-11-24 15:19:55 +0100 | [diff] [blame] | 878 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 879 | plen = mbedtls_mpi_size( &grp->P ); |
Manuel Pégourié-Gonnard | e19feb5 | 2012-11-24 14:10:14 +0100 | [diff] [blame] | 880 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 881 | #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) |
Gilles Peskine | 5997005 | 2019-02-28 13:12:06 +0100 | [diff] [blame] | 882 | (void) format; /* Montgomery curves always use the same point format */ |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 883 | if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY ) |
Manuel Pégourié-Gonnard | 37d218a | 2012-11-24 15:19:55 +0100 | [diff] [blame] | 884 | { |
Janos Follath | 7caf8e4 | 2019-02-20 12:00:22 +0000 | [diff] [blame] | 885 | *olen = plen; |
Manuel Pégourié-Gonnard | 37d218a | 2012-11-24 15:19:55 +0100 | [diff] [blame] | 886 | if( buflen < *olen ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 887 | return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); |
Manuel Pégourié-Gonnard | 37d218a | 2012-11-24 15:19:55 +0100 | [diff] [blame] | 888 | |
Janos Follath | 7caf8e4 | 2019-02-20 12:00:22 +0000 | [diff] [blame] | 889 | MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary_le( &P->X, buf, plen ) ); |
Manuel Pégourié-Gonnard | 37d218a | 2012-11-24 15:19:55 +0100 | [diff] [blame] | 890 | } |
Janos Follath | 7caf8e4 | 2019-02-20 12:00:22 +0000 | [diff] [blame] | 891 | #endif |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 892 | #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 893 | if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS ) |
Manuel Pégourié-Gonnard | 37d218a | 2012-11-24 15:19:55 +0100 | [diff] [blame] | 894 | { |
Janos Follath | 7caf8e4 | 2019-02-20 12:00:22 +0000 | [diff] [blame] | 895 | /* |
| 896 | * Common case: P == 0 |
| 897 | */ |
| 898 | if( mbedtls_mpi_cmp_int( &P->Z, 0 ) == 0 ) |
| 899 | { |
| 900 | if( buflen < 1 ) |
| 901 | return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); |
Manuel Pégourié-Gonnard | 37d218a | 2012-11-24 15:19:55 +0100 | [diff] [blame] | 902 | |
Janos Follath | 7caf8e4 | 2019-02-20 12:00:22 +0000 | [diff] [blame] | 903 | buf[0] = 0x00; |
| 904 | *olen = 1; |
Manuel Pégourié-Gonnard | 37d218a | 2012-11-24 15:19:55 +0100 | [diff] [blame] | 905 | |
Janos Follath | 7caf8e4 | 2019-02-20 12:00:22 +0000 | [diff] [blame] | 906 | return( 0 ); |
| 907 | } |
| 908 | |
| 909 | if( format == MBEDTLS_ECP_PF_UNCOMPRESSED ) |
| 910 | { |
| 911 | *olen = 2 * plen + 1; |
| 912 | |
| 913 | if( buflen < *olen ) |
| 914 | return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); |
| 915 | |
| 916 | buf[0] = 0x04; |
| 917 | MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->X, buf + 1, plen ) ); |
| 918 | MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->Y, buf + 1 + plen, plen ) ); |
| 919 | } |
| 920 | else if( format == MBEDTLS_ECP_PF_COMPRESSED ) |
| 921 | { |
| 922 | *olen = plen + 1; |
| 923 | |
| 924 | if( buflen < *olen ) |
| 925 | return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); |
| 926 | |
| 927 | buf[0] = 0x02 + mbedtls_mpi_get_bit( &P->Y, 0 ); |
| 928 | MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &P->X, buf + 1, plen ) ); |
| 929 | } |
Manuel Pégourié-Gonnard | 37d218a | 2012-11-24 15:19:55 +0100 | [diff] [blame] | 930 | } |
Janos Follath | 7caf8e4 | 2019-02-20 12:00:22 +0000 | [diff] [blame] | 931 | #endif |
Manuel Pégourié-Gonnard | e19feb5 | 2012-11-24 14:10:14 +0100 | [diff] [blame] | 932 | |
| 933 | cleanup: |
| 934 | return( ret ); |
| 935 | } |
| 936 | |
| 937 | /* |
Janos Follath | 59b813c | 2019-02-13 10:44:06 +0000 | [diff] [blame] | 938 | * Import a point from unsigned binary data (SEC1 2.3.4 and RFC7748) |
Manuel Pégourié-Gonnard | 5e402d8 | 2012-11-24 16:19:42 +0100 | [diff] [blame] | 939 | */ |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 940 | int mbedtls_ecp_point_read_binary( const mbedtls_ecp_group *grp, |
| 941 | mbedtls_ecp_point *pt, |
| 942 | const unsigned char *buf, size_t ilen ) |
Manuel Pégourié-Gonnard | 5246ee5 | 2014-03-19 16:18:38 +0100 | [diff] [blame] | 943 | { |
Janos Follath | 28eb06d | 2019-02-26 10:53:34 +0000 | [diff] [blame] | 944 | int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; |
Manuel Pégourié-Gonnard | 5e402d8 | 2012-11-24 16:19:42 +0100 | [diff] [blame] | 945 | size_t plen; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 946 | ECP_VALIDATE_RET( grp != NULL ); |
| 947 | ECP_VALIDATE_RET( pt != NULL ); |
| 948 | ECP_VALIDATE_RET( buf != NULL ); |
Manuel Pégourié-Gonnard | 5e402d8 | 2012-11-24 16:19:42 +0100 | [diff] [blame] | 949 | |
Paul Bakker | 82788fb | 2014-10-20 13:59:19 +0200 | [diff] [blame] | 950 | if( ilen < 1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 951 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 67dbe1e | 2014-07-08 13:09:24 +0200 | [diff] [blame] | 952 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 953 | plen = mbedtls_mpi_size( &grp->P ); |
Manuel Pégourié-Gonnard | 5e402d8 | 2012-11-24 16:19:42 +0100 | [diff] [blame] | 954 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 955 | #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 956 | if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY ) |
Janos Follath | 59b813c | 2019-02-13 10:44:06 +0000 | [diff] [blame] | 957 | { |
| 958 | if( plen != ilen ) |
| 959 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 5246ee5 | 2014-03-19 16:18:38 +0100 | [diff] [blame] | 960 | |
Janos Follath | 59b813c | 2019-02-13 10:44:06 +0000 | [diff] [blame] | 961 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary_le( &pt->X, buf, plen ) ); |
| 962 | mbedtls_mpi_free( &pt->Y ); |
Manuel Pégourié-Gonnard | 5e402d8 | 2012-11-24 16:19:42 +0100 | [diff] [blame] | 963 | |
Janos Follath | 59b813c | 2019-02-13 10:44:06 +0000 | [diff] [blame] | 964 | if( grp->id == MBEDTLS_ECP_DP_CURVE25519 ) |
Janos Follath | ffbd7e8 | 2019-02-25 11:35:20 +0000 | [diff] [blame] | 965 | /* Set most significant bit to 0 as prescribed in RFC7748 §5 */ |
Janos Follath | 59b813c | 2019-02-13 10:44:06 +0000 | [diff] [blame] | 966 | MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &pt->X, plen * 8 - 1, 0 ) ); |
Janos Follath | 28eb06d | 2019-02-26 10:53:34 +0000 | [diff] [blame] | 967 | |
| 968 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z, 1 ) ); |
Janos Follath | 59b813c | 2019-02-13 10:44:06 +0000 | [diff] [blame] | 969 | } |
| 970 | #endif |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 971 | #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 972 | if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS ) |
Janos Follath | 59b813c | 2019-02-13 10:44:06 +0000 | [diff] [blame] | 973 | { |
| 974 | if( buf[0] == 0x00 ) |
| 975 | { |
| 976 | if( ilen == 1 ) |
| 977 | return( mbedtls_ecp_set_zero( pt ) ); |
| 978 | else |
| 979 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
| 980 | } |
| 981 | |
| 982 | if( buf[0] != 0x04 ) |
| 983 | return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ); |
| 984 | |
| 985 | if( ilen != 2 * plen + 1 ) |
| 986 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
| 987 | |
| 988 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &pt->X, buf + 1, plen ) ); |
| 989 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &pt->Y, |
| 990 | buf + 1 + plen, plen ) ); |
Janos Follath | 28eb06d | 2019-02-26 10:53:34 +0000 | [diff] [blame] | 991 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z, 1 ) ); |
Janos Follath | 59b813c | 2019-02-13 10:44:06 +0000 | [diff] [blame] | 992 | } |
| 993 | #endif |
Manuel Pégourié-Gonnard | 5e402d8 | 2012-11-24 16:19:42 +0100 | [diff] [blame] | 994 | |
| 995 | cleanup: |
| 996 | return( ret ); |
| 997 | } |
| 998 | |
| 999 | /* |
Manuel Pégourié-Gonnard | 0079405 | 2013-02-09 19:00:07 +0100 | [diff] [blame] | 1000 | * Import a point from a TLS ECPoint record (RFC 4492) |
| 1001 | * struct { |
| 1002 | * opaque point <1..2^8-1>; |
| 1003 | * } ECPoint; |
| 1004 | */ |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 1005 | int mbedtls_ecp_tls_read_point( const mbedtls_ecp_group *grp, |
| 1006 | mbedtls_ecp_point *pt, |
| 1007 | const unsigned char **buf, size_t buf_len ) |
Manuel Pégourié-Gonnard | 0079405 | 2013-02-09 19:00:07 +0100 | [diff] [blame] | 1008 | { |
| 1009 | unsigned char data_len; |
Manuel Pégourié-Gonnard | 98f5181 | 2013-02-10 13:38:29 +0100 | [diff] [blame] | 1010 | const unsigned char *buf_start; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 1011 | ECP_VALIDATE_RET( grp != NULL ); |
| 1012 | ECP_VALIDATE_RET( pt != NULL ); |
| 1013 | ECP_VALIDATE_RET( buf != NULL ); |
| 1014 | ECP_VALIDATE_RET( *buf != NULL ); |
Manuel Pégourié-Gonnard | 0079405 | 2013-02-09 19:00:07 +0100 | [diff] [blame] | 1015 | |
| 1016 | /* |
Manuel Pégourié-Gonnard | 67dbe1e | 2014-07-08 13:09:24 +0200 | [diff] [blame] | 1017 | * We must have at least two bytes (1 for length, at least one for data) |
Manuel Pégourié-Gonnard | 0079405 | 2013-02-09 19:00:07 +0100 | [diff] [blame] | 1018 | */ |
| 1019 | if( buf_len < 2 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1020 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 0079405 | 2013-02-09 19:00:07 +0100 | [diff] [blame] | 1021 | |
Manuel Pégourié-Gonnard | 98f5181 | 2013-02-10 13:38:29 +0100 | [diff] [blame] | 1022 | data_len = *(*buf)++; |
Manuel Pégourié-Gonnard | 0079405 | 2013-02-09 19:00:07 +0100 | [diff] [blame] | 1023 | if( data_len < 1 || data_len > buf_len - 1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1024 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 0079405 | 2013-02-09 19:00:07 +0100 | [diff] [blame] | 1025 | |
Manuel Pégourié-Gonnard | 98f5181 | 2013-02-10 13:38:29 +0100 | [diff] [blame] | 1026 | /* |
| 1027 | * Save buffer start for read_binary and update buf |
| 1028 | */ |
| 1029 | buf_start = *buf; |
| 1030 | *buf += data_len; |
| 1031 | |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 1032 | return( mbedtls_ecp_point_read_binary( grp, pt, buf_start, data_len ) ); |
Manuel Pégourié-Gonnard | 0079405 | 2013-02-09 19:00:07 +0100 | [diff] [blame] | 1033 | } |
| 1034 | |
| 1035 | /* |
| 1036 | * Export a point as a TLS ECPoint record (RFC 4492) |
| 1037 | * struct { |
| 1038 | * opaque point <1..2^8-1>; |
| 1039 | * } ECPoint; |
| 1040 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1041 | int mbedtls_ecp_tls_write_point( const mbedtls_ecp_group *grp, const mbedtls_ecp_point *pt, |
Manuel Pégourié-Gonnard | 420f1eb | 2013-02-10 12:22:46 +0100 | [diff] [blame] | 1042 | int format, size_t *olen, |
| 1043 | unsigned char *buf, size_t blen ) |
Manuel Pégourié-Gonnard | 0079405 | 2013-02-09 19:00:07 +0100 | [diff] [blame] | 1044 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1045 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 1046 | ECP_VALIDATE_RET( grp != NULL ); |
| 1047 | ECP_VALIDATE_RET( pt != NULL ); |
| 1048 | ECP_VALIDATE_RET( olen != NULL ); |
| 1049 | ECP_VALIDATE_RET( buf != NULL ); |
| 1050 | ECP_VALIDATE_RET( format == MBEDTLS_ECP_PF_UNCOMPRESSED || |
| 1051 | format == MBEDTLS_ECP_PF_COMPRESSED ); |
Manuel Pégourié-Gonnard | 420f1eb | 2013-02-10 12:22:46 +0100 | [diff] [blame] | 1052 | |
Manuel Pégourié-Gonnard | 0079405 | 2013-02-09 19:00:07 +0100 | [diff] [blame] | 1053 | /* |
Manuel Pégourié-Gonnard | 420f1eb | 2013-02-10 12:22:46 +0100 | [diff] [blame] | 1054 | * buffer length must be at least one, for our length byte |
Manuel Pégourié-Gonnard | 0079405 | 2013-02-09 19:00:07 +0100 | [diff] [blame] | 1055 | */ |
Manuel Pégourié-Gonnard | 420f1eb | 2013-02-10 12:22:46 +0100 | [diff] [blame] | 1056 | if( blen < 1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1057 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 0079405 | 2013-02-09 19:00:07 +0100 | [diff] [blame] | 1058 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1059 | if( ( ret = mbedtls_ecp_point_write_binary( grp, pt, format, |
Manuel Pégourié-Gonnard | 420f1eb | 2013-02-10 12:22:46 +0100 | [diff] [blame] | 1060 | olen, buf + 1, blen - 1) ) != 0 ) |
| 1061 | return( ret ); |
| 1062 | |
| 1063 | /* |
| 1064 | * write length to the first byte and update total length |
| 1065 | */ |
Paul Bakker | b9cfaa0 | 2013-10-11 18:58:55 +0200 | [diff] [blame] | 1066 | buf[0] = (unsigned char) *olen; |
Manuel Pégourié-Gonnard | 420f1eb | 2013-02-10 12:22:46 +0100 | [diff] [blame] | 1067 | ++*olen; |
| 1068 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 1069 | return( 0 ); |
Manuel Pégourié-Gonnard | 0079405 | 2013-02-09 19:00:07 +0100 | [diff] [blame] | 1070 | } |
| 1071 | |
| 1072 | /* |
Manuel Pégourié-Gonnard | 1a96728 | 2013-02-09 17:03:58 +0100 | [diff] [blame] | 1073 | * Set a group from an ECParameters record (RFC 4492) |
| 1074 | */ |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 1075 | int mbedtls_ecp_tls_read_group( mbedtls_ecp_group *grp, |
| 1076 | const unsigned char **buf, size_t len ) |
| 1077 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1078 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 1079 | mbedtls_ecp_group_id grp_id; |
| 1080 | ECP_VALIDATE_RET( grp != NULL ); |
| 1081 | ECP_VALIDATE_RET( buf != NULL ); |
| 1082 | ECP_VALIDATE_RET( *buf != NULL ); |
| 1083 | |
| 1084 | if( ( ret = mbedtls_ecp_tls_read_group_id( &grp_id, buf, len ) ) != 0 ) |
| 1085 | return( ret ); |
| 1086 | |
| 1087 | return( mbedtls_ecp_group_load( grp, grp_id ) ); |
| 1088 | } |
| 1089 | |
| 1090 | /* |
| 1091 | * Read a group id from an ECParameters record (RFC 4492) and convert it to |
| 1092 | * mbedtls_ecp_group_id. |
| 1093 | */ |
| 1094 | int mbedtls_ecp_tls_read_group_id( mbedtls_ecp_group_id *grp, |
| 1095 | const unsigned char **buf, size_t len ) |
Manuel Pégourié-Gonnard | 1a96728 | 2013-02-09 17:03:58 +0100 | [diff] [blame] | 1096 | { |
Manuel Pégourié-Gonnard | f24b4a7 | 2013-09-23 18:14:50 +0200 | [diff] [blame] | 1097 | uint16_t tls_id; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1098 | const mbedtls_ecp_curve_info *curve_info; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 1099 | ECP_VALIDATE_RET( grp != NULL ); |
| 1100 | ECP_VALIDATE_RET( buf != NULL ); |
| 1101 | ECP_VALIDATE_RET( *buf != NULL ); |
Manuel Pégourié-Gonnard | 1a96728 | 2013-02-09 17:03:58 +0100 | [diff] [blame] | 1102 | |
| 1103 | /* |
| 1104 | * We expect at least three bytes (see below) |
| 1105 | */ |
| 1106 | if( len < 3 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1107 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 1a96728 | 2013-02-09 17:03:58 +0100 | [diff] [blame] | 1108 | |
| 1109 | /* |
| 1110 | * First byte is curve_type; only named_curve is handled |
| 1111 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1112 | if( *(*buf)++ != MBEDTLS_ECP_TLS_NAMED_CURVE ) |
| 1113 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 1a96728 | 2013-02-09 17:03:58 +0100 | [diff] [blame] | 1114 | |
| 1115 | /* |
Manuel Pégourié-Gonnard | b325887 | 2013-02-10 12:06:19 +0100 | [diff] [blame] | 1116 | * Next two bytes are the namedcurve value |
Manuel Pégourié-Gonnard | 1a96728 | 2013-02-09 17:03:58 +0100 | [diff] [blame] | 1117 | */ |
Manuel Pégourié-Gonnard | f24b4a7 | 2013-09-23 18:14:50 +0200 | [diff] [blame] | 1118 | tls_id = *(*buf)++; |
| 1119 | tls_id <<= 8; |
| 1120 | tls_id |= *(*buf)++; |
| 1121 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1122 | if( ( curve_info = mbedtls_ecp_curve_info_from_tls_id( tls_id ) ) == NULL ) |
| 1123 | return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ); |
Manuel Pégourié-Gonnard | f24b4a7 | 2013-09-23 18:14:50 +0200 | [diff] [blame] | 1124 | |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 1125 | *grp = curve_info->grp_id; |
| 1126 | |
| 1127 | return( 0 ); |
Manuel Pégourié-Gonnard | b325887 | 2013-02-10 12:06:19 +0100 | [diff] [blame] | 1128 | } |
| 1129 | |
| 1130 | /* |
| 1131 | * Write the ECParameters record corresponding to a group (RFC 4492) |
| 1132 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1133 | int mbedtls_ecp_tls_write_group( const mbedtls_ecp_group *grp, size_t *olen, |
Manuel Pégourié-Gonnard | b325887 | 2013-02-10 12:06:19 +0100 | [diff] [blame] | 1134 | unsigned char *buf, size_t blen ) |
| 1135 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1136 | const mbedtls_ecp_curve_info *curve_info; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 1137 | ECP_VALIDATE_RET( grp != NULL ); |
| 1138 | ECP_VALIDATE_RET( buf != NULL ); |
| 1139 | ECP_VALIDATE_RET( olen != NULL ); |
Manuel Pégourié-Gonnard | f24b4a7 | 2013-09-23 18:14:50 +0200 | [diff] [blame] | 1140 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1141 | if( ( curve_info = mbedtls_ecp_curve_info_from_grp_id( grp->id ) ) == NULL ) |
| 1142 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 7038039 | 2013-09-16 16:19:53 +0200 | [diff] [blame] | 1143 | |
Manuel Pégourié-Gonnard | b325887 | 2013-02-10 12:06:19 +0100 | [diff] [blame] | 1144 | /* |
| 1145 | * We are going to write 3 bytes (see below) |
| 1146 | */ |
| 1147 | *olen = 3; |
| 1148 | if( blen < *olen ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1149 | return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL ); |
Manuel Pégourié-Gonnard | b325887 | 2013-02-10 12:06:19 +0100 | [diff] [blame] | 1150 | |
| 1151 | /* |
| 1152 | * First byte is curve_type, always named_curve |
| 1153 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1154 | *buf++ = MBEDTLS_ECP_TLS_NAMED_CURVE; |
Manuel Pégourié-Gonnard | b325887 | 2013-02-10 12:06:19 +0100 | [diff] [blame] | 1155 | |
| 1156 | /* |
| 1157 | * Next two bytes are the namedcurve value |
| 1158 | */ |
Manuel Pégourié-Gonnard | f24b4a7 | 2013-09-23 18:14:50 +0200 | [diff] [blame] | 1159 | buf[0] = curve_info->tls_id >> 8; |
| 1160 | buf[1] = curve_info->tls_id & 0xFF; |
Manuel Pégourié-Gonnard | b325887 | 2013-02-10 12:06:19 +0100 | [diff] [blame] | 1161 | |
Paul Bakker | d8bb826 | 2014-06-17 14:06:49 +0200 | [diff] [blame] | 1162 | return( 0 ); |
Manuel Pégourié-Gonnard | a5402fe | 2012-11-07 20:24:05 +0100 | [diff] [blame] | 1163 | } |
Manuel Pégourié-Gonnard | ab38b70 | 2012-11-05 17:34:55 +0100 | [diff] [blame] | 1164 | |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 1165 | /* |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1166 | * Wrapper around fast quasi-modp functions, with fall-back to mbedtls_mpi_mod_mpi. |
| 1167 | * See the documentation of struct mbedtls_ecp_group. |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 1168 | * |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1169 | * This function is in the critial loop for mbedtls_ecp_mul, so pay attention to perf. |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 1170 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1171 | static int ecp_modp( mbedtls_mpi *N, const mbedtls_ecp_group *grp ) |
Manuel Pégourié-Gonnard | 7038039 | 2013-09-16 16:19:53 +0200 | [diff] [blame] | 1172 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1173 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 1174 | |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 1175 | if( grp->modp == NULL ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1176 | return( mbedtls_mpi_mod_mpi( N, N, &grp->P ) ); |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 1177 | |
| 1178 | /* N->s < 0 is a much faster test, which fails only if N is 0 */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1179 | if( ( N->s < 0 && mbedtls_mpi_cmp_int( N, 0 ) != 0 ) || |
Manuel Pégourié-Gonnard | c0696c2 | 2015-06-18 16:47:17 +0200 | [diff] [blame] | 1180 | mbedtls_mpi_bitlen( N ) > 2 * grp->pbits ) |
Manuel Pégourié-Gonnard | 7038039 | 2013-09-16 16:19:53 +0200 | [diff] [blame] | 1181 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1182 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 7038039 | 2013-09-16 16:19:53 +0200 | [diff] [blame] | 1183 | } |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 1184 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1185 | MBEDTLS_MPI_CHK( grp->modp( N ) ); |
Manuel Pégourié-Gonnard | 7038039 | 2013-09-16 16:19:53 +0200 | [diff] [blame] | 1186 | |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 1187 | /* N->s < 0 is a much faster test, which fails only if N is 0 */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1188 | while( N->s < 0 && mbedtls_mpi_cmp_int( N, 0 ) != 0 ) |
| 1189 | MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &grp->P ) ); |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 1190 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1191 | while( mbedtls_mpi_cmp_mpi( N, &grp->P ) >= 0 ) |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 1192 | /* we known P, N and the result are positive */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1193 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( N, N, &grp->P ) ); |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 1194 | |
Manuel Pégourié-Gonnard | cae6f3e | 2013-10-23 20:19:57 +0200 | [diff] [blame] | 1195 | cleanup: |
| 1196 | return( ret ); |
Manuel Pégourié-Gonnard | 7038039 | 2013-09-16 16:19:53 +0200 | [diff] [blame] | 1197 | } |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 1198 | |
Manuel Pégourié-Gonnard | 847395a | 2012-11-05 13:13:44 +0100 | [diff] [blame] | 1199 | /* |
Manuel Pégourié-Gonnard | 4712325 | 2012-11-10 14:44:24 +0100 | [diff] [blame] | 1200 | * Fast mod-p functions expect their argument to be in the 0..p^2 range. |
Manuel Pégourié-Gonnard | dada4da | 2012-11-10 14:23:17 +0100 | [diff] [blame] | 1201 | * |
Manuel Pégourié-Gonnard | 4712325 | 2012-11-10 14:44:24 +0100 | [diff] [blame] | 1202 | * In order to guarantee that, we need to ensure that operands of |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1203 | * mbedtls_mpi_mul_mpi are in the 0..p range. So, after each operation we will |
Manuel Pégourié-Gonnard | dada4da | 2012-11-10 14:23:17 +0100 | [diff] [blame] | 1204 | * bring the result back to this range. |
| 1205 | * |
Manuel Pégourié-Gonnard | 4712325 | 2012-11-10 14:44:24 +0100 | [diff] [blame] | 1206 | * The following macros are shortcuts for doing that. |
Manuel Pégourié-Gonnard | dada4da | 2012-11-10 14:23:17 +0100 | [diff] [blame] | 1207 | */ |
| 1208 | |
| 1209 | /* |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1210 | * Reduce a mbedtls_mpi mod p in-place, general case, to use after mbedtls_mpi_mul_mpi |
Manuel Pégourié-Gonnard | 84d1aea | 2012-11-09 02:09:38 +0100 | [diff] [blame] | 1211 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1212 | #if defined(MBEDTLS_SELF_TEST) |
Manuel Pégourié-Gonnard | 9181481 | 2013-11-21 20:23:55 +0100 | [diff] [blame] | 1213 | #define INC_MUL_COUNT mul_count++; |
| 1214 | #else |
| 1215 | #define INC_MUL_COUNT |
| 1216 | #endif |
| 1217 | |
Hanno Becker | 1eeca41 | 2018-10-15 12:01:35 +0100 | [diff] [blame] | 1218 | #define MOD_MUL( N ) \ |
| 1219 | do \ |
| 1220 | { \ |
| 1221 | MBEDTLS_MPI_CHK( ecp_modp( &(N), grp ) ); \ |
| 1222 | INC_MUL_COUNT \ |
| 1223 | } while( 0 ) |
Manuel Pégourié-Gonnard | 84d1aea | 2012-11-09 02:09:38 +0100 | [diff] [blame] | 1224 | |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1225 | static inline int mbedtls_mpi_mul_mod( const mbedtls_ecp_group *grp, |
| 1226 | mbedtls_mpi *X, |
| 1227 | const mbedtls_mpi *A, |
| 1228 | const mbedtls_mpi *B ) |
| 1229 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1230 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1231 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( X, A, B ) ); |
| 1232 | MOD_MUL( *X ); |
| 1233 | cleanup: |
| 1234 | return( ret ); |
| 1235 | } |
| 1236 | |
Manuel Pégourié-Gonnard | 84d1aea | 2012-11-09 02:09:38 +0100 | [diff] [blame] | 1237 | /* |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1238 | * Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_sub_mpi |
Manuel Pégourié-Gonnard | c9e387c | 2013-10-17 17:15:35 +0200 | [diff] [blame] | 1239 | * N->s < 0 is a very fast test, which fails only if N is 0 |
Manuel Pégourié-Gonnard | 84d1aea | 2012-11-09 02:09:38 +0100 | [diff] [blame] | 1240 | */ |
Hanno Becker | 1eeca41 | 2018-10-15 12:01:35 +0100 | [diff] [blame] | 1241 | #define MOD_SUB( N ) \ |
| 1242 | while( (N).s < 0 && mbedtls_mpi_cmp_int( &(N), 0 ) != 0 ) \ |
| 1243 | MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &(N), &(N), &grp->P ) ) |
Manuel Pégourié-Gonnard | 84d1aea | 2012-11-09 02:09:38 +0100 | [diff] [blame] | 1244 | |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1245 | static inline int mbedtls_mpi_sub_mod( const mbedtls_ecp_group *grp, |
| 1246 | mbedtls_mpi *X, |
| 1247 | const mbedtls_mpi *A, |
| 1248 | const mbedtls_mpi *B ) |
| 1249 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1250 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1251 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( X, A, B ) ); |
| 1252 | MOD_SUB( *X ); |
| 1253 | cleanup: |
| 1254 | return( ret ); |
| 1255 | } |
| 1256 | |
Manuel Pégourié-Gonnard | 84d1aea | 2012-11-09 02:09:38 +0100 | [diff] [blame] | 1257 | /* |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1258 | * Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_add_mpi and mbedtls_mpi_mul_int. |
Manuel Pégourié-Gonnard | c9e387c | 2013-10-17 17:15:35 +0200 | [diff] [blame] | 1259 | * We known P, N and the result are positive, so sub_abs is correct, and |
| 1260 | * a bit faster. |
Manuel Pégourié-Gonnard | 84d1aea | 2012-11-09 02:09:38 +0100 | [diff] [blame] | 1261 | */ |
Hanno Becker | 1eeca41 | 2018-10-15 12:01:35 +0100 | [diff] [blame] | 1262 | #define MOD_ADD( N ) \ |
| 1263 | while( mbedtls_mpi_cmp_mpi( &(N), &grp->P ) >= 0 ) \ |
| 1264 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_abs( &(N), &(N), &grp->P ) ) |
Manuel Pégourié-Gonnard | 84d1aea | 2012-11-09 02:09:38 +0100 | [diff] [blame] | 1265 | |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1266 | static inline int mbedtls_mpi_add_mod( const mbedtls_ecp_group *grp, |
| 1267 | mbedtls_mpi *X, |
| 1268 | const mbedtls_mpi *A, |
| 1269 | const mbedtls_mpi *B ) |
| 1270 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1271 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1272 | MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( X, A, B ) ); |
| 1273 | MOD_ADD( *X ); |
| 1274 | cleanup: |
| 1275 | return( ret ); |
| 1276 | } |
| 1277 | |
| 1278 | static inline int mbedtls_mpi_shift_l_mod( const mbedtls_ecp_group *grp, |
| 1279 | mbedtls_mpi *X, |
| 1280 | size_t count ) |
| 1281 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1282 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1283 | MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( X, count ) ); |
| 1284 | MOD_ADD( *X ); |
| 1285 | cleanup: |
| 1286 | return( ret ); |
| 1287 | } |
| 1288 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 1289 | #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) |
Manuel Pégourié-Gonnard | 7c94d8b | 2013-12-04 23:15:46 +0100 | [diff] [blame] | 1290 | /* |
| 1291 | * For curves in short Weierstrass form, we do all the internal operations in |
| 1292 | * Jacobian coordinates. |
| 1293 | * |
| 1294 | * For multiplication, we'll use a comb method with coutermeasueres against |
| 1295 | * SPA, hence timing attacks. |
| 1296 | */ |
| 1297 | |
Manuel Pégourié-Gonnard | 84d1aea | 2012-11-09 02:09:38 +0100 | [diff] [blame] | 1298 | /* |
Manuel Pégourié-Gonnard | 1c2782c | 2012-11-19 20:16:28 +0100 | [diff] [blame] | 1299 | * Normalize jacobian coordinates so that Z == 0 || Z == 1 (GECC 3.2.1) |
Manuel Pégourié-Gonnard | 04a0225 | 2013-11-20 22:57:38 +0100 | [diff] [blame] | 1300 | * Cost: 1N := 1I + 3M + 1S |
Manuel Pégourié-Gonnard | d070f51 | 2012-11-08 17:40:51 +0100 | [diff] [blame] | 1301 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1302 | static int ecp_normalize_jac( const mbedtls_ecp_group *grp, mbedtls_ecp_point *pt ) |
Manuel Pégourié-Gonnard | d070f51 | 2012-11-08 17:40:51 +0100 | [diff] [blame] | 1303 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1304 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1305 | mbedtls_mpi Zi, ZZi; |
Manuel Pégourié-Gonnard | d070f51 | 2012-11-08 17:40:51 +0100 | [diff] [blame] | 1306 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1307 | if( mbedtls_mpi_cmp_int( &pt->Z, 0 ) == 0 ) |
Manuel Pégourié-Gonnard | d070f51 | 2012-11-08 17:40:51 +0100 | [diff] [blame] | 1308 | return( 0 ); |
Manuel Pégourié-Gonnard | d070f51 | 2012-11-08 17:40:51 +0100 | [diff] [blame] | 1309 | |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 1310 | #if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT) |
Manuel Pégourié-Gonnard | ebac5d3 | 2017-08-23 16:23:36 +0200 | [diff] [blame] | 1311 | if( mbedtls_internal_ecp_grp_capable( grp ) ) |
| 1312 | return( mbedtls_internal_ecp_normalize_jac( grp, pt ) ); |
Janos Follath | 372697b | 2016-10-28 16:53:11 +0100 | [diff] [blame] | 1313 | #endif /* MBEDTLS_ECP_NORMALIZE_JAC_ALT */ |
Manuel Pégourié-Gonnard | ebac5d3 | 2017-08-23 16:23:36 +0200 | [diff] [blame] | 1314 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1315 | mbedtls_mpi_init( &Zi ); mbedtls_mpi_init( &ZZi ); |
Manuel Pégourié-Gonnard | d070f51 | 2012-11-08 17:40:51 +0100 | [diff] [blame] | 1316 | |
Manuel Pégourié-Gonnard | 1c2782c | 2012-11-19 20:16:28 +0100 | [diff] [blame] | 1317 | /* |
| 1318 | * X = X / Z^2 mod p |
| 1319 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1320 | MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &Zi, &pt->Z, &grp->P ) ); |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1321 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &ZZi, &Zi, &Zi ) ); |
| 1322 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &pt->X, &pt->X, &ZZi ) ); |
Manuel Pégourié-Gonnard | d070f51 | 2012-11-08 17:40:51 +0100 | [diff] [blame] | 1323 | |
| 1324 | /* |
Manuel Pégourié-Gonnard | 1c2782c | 2012-11-19 20:16:28 +0100 | [diff] [blame] | 1325 | * Y = Y / Z^3 mod p |
Manuel Pégourié-Gonnard | d070f51 | 2012-11-08 17:40:51 +0100 | [diff] [blame] | 1326 | */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1327 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &pt->Y, &pt->Y, &ZZi ) ); |
| 1328 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &pt->Y, &pt->Y, &Zi ) ); |
Manuel Pégourié-Gonnard | d070f51 | 2012-11-08 17:40:51 +0100 | [diff] [blame] | 1329 | |
| 1330 | /* |
Manuel Pégourié-Gonnard | 1c2782c | 2012-11-19 20:16:28 +0100 | [diff] [blame] | 1331 | * Z = 1 |
Manuel Pégourié-Gonnard | d070f51 | 2012-11-08 17:40:51 +0100 | [diff] [blame] | 1332 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1333 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &pt->Z, 1 ) ); |
Manuel Pégourié-Gonnard | d070f51 | 2012-11-08 17:40:51 +0100 | [diff] [blame] | 1334 | |
| 1335 | cleanup: |
| 1336 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1337 | mbedtls_mpi_free( &Zi ); mbedtls_mpi_free( &ZZi ); |
Manuel Pégourié-Gonnard | d070f51 | 2012-11-08 17:40:51 +0100 | [diff] [blame] | 1338 | |
| 1339 | return( ret ); |
| 1340 | } |
| 1341 | |
| 1342 | /* |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1343 | * Normalize jacobian coordinates of an array of (pointers to) points, |
Manuel Pégourié-Gonnard | 3680c82 | 2012-11-21 18:49:45 +0100 | [diff] [blame] | 1344 | * using Montgomery's trick to perform only one inversion mod P. |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1345 | * (See for example Cohen's "A Course in Computational Algebraic Number |
| 1346 | * Theory", Algorithm 10.3.4.) |
| 1347 | * |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1348 | * Warning: fails (returning an error) if one of the points is zero! |
Manuel Pégourié-Gonnard | 7a949d3 | 2013-12-05 10:26:01 +0100 | [diff] [blame] | 1349 | * This should never happen, see choice of w in ecp_mul_comb(). |
Manuel Pégourié-Gonnard | 04a0225 | 2013-11-20 22:57:38 +0100 | [diff] [blame] | 1350 | * |
| 1351 | * Cost: 1N(t) := 1I + (6t - 3)M + 1S |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1352 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1353 | static int ecp_normalize_jac_many( const mbedtls_ecp_group *grp, |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1354 | mbedtls_ecp_point *T[], size_t T_size ) |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1355 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1356 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1357 | size_t i; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1358 | mbedtls_mpi *c, u, Zi, ZZi; |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1359 | |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1360 | if( T_size < 2 ) |
Manuel Pégourié-Gonnard | 3c0b4ea | 2013-12-02 19:44:41 +0100 | [diff] [blame] | 1361 | return( ecp_normalize_jac( grp, *T ) ); |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1362 | |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 1363 | #if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT) |
Manuel Pégourié-Gonnard | ebac5d3 | 2017-08-23 16:23:36 +0200 | [diff] [blame] | 1364 | if( mbedtls_internal_ecp_grp_capable( grp ) ) |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1365 | return( mbedtls_internal_ecp_normalize_jac_many( grp, T, T_size ) ); |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 1366 | #endif |
| 1367 | |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1368 | if( ( c = mbedtls_calloc( T_size, sizeof( mbedtls_mpi ) ) ) == NULL ) |
Manuel Pégourié-Gonnard | 6a8ca33 | 2015-05-28 09:33:39 +0200 | [diff] [blame] | 1369 | return( MBEDTLS_ERR_ECP_ALLOC_FAILED ); |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1370 | |
Manuel Pégourié-Gonnard | 5bd38b1 | 2017-08-23 16:55:59 +0200 | [diff] [blame] | 1371 | for( i = 0; i < T_size; i++ ) |
| 1372 | mbedtls_mpi_init( &c[i] ); |
| 1373 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1374 | mbedtls_mpi_init( &u ); mbedtls_mpi_init( &Zi ); mbedtls_mpi_init( &ZZi ); |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1375 | |
| 1376 | /* |
| 1377 | * c[i] = Z_0 * ... * Z_i |
| 1378 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1379 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &c[0], &T[0]->Z ) ); |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1380 | for( i = 1; i < T_size; i++ ) |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1381 | { |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1382 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &c[i], &c[i-1], &T[i]->Z ) ); |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1383 | } |
| 1384 | |
| 1385 | /* |
| 1386 | * u = 1 / (Z_0 * ... * Z_n) mod P |
| 1387 | */ |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1388 | MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &u, &c[T_size-1], &grp->P ) ); |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1389 | |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1390 | for( i = T_size - 1; ; i-- ) |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1391 | { |
| 1392 | /* |
| 1393 | * Zi = 1 / Z_i mod p |
| 1394 | * u = 1 / (Z_0 * ... * Z_i) mod P |
| 1395 | */ |
| 1396 | if( i == 0 ) { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1397 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &Zi, &u ) ); |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1398 | } |
| 1399 | else |
| 1400 | { |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1401 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &Zi, &u, &c[i-1] ) ); |
| 1402 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &u, &u, &T[i]->Z ) ); |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1403 | } |
| 1404 | |
| 1405 | /* |
| 1406 | * proceed as in normalize() |
| 1407 | */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1408 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &ZZi, &Zi, &Zi ) ); |
| 1409 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T[i]->X, &T[i]->X, &ZZi ) ); |
| 1410 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T[i]->Y, &T[i]->Y, &ZZi ) ); |
| 1411 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T[i]->Y, &T[i]->Y, &Zi ) ); |
Manuel Pégourié-Gonnard | 1f789b8 | 2013-12-30 17:31:56 +0100 | [diff] [blame] | 1412 | |
| 1413 | /* |
| 1414 | * Post-precessing: reclaim some memory by shrinking coordinates |
| 1415 | * - not storing Z (always 1) |
| 1416 | * - shrinking other coordinates, but still keeping the same number of |
| 1417 | * limbs as P, as otherwise it will too likely be regrown too fast. |
| 1418 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1419 | MBEDTLS_MPI_CHK( mbedtls_mpi_shrink( &T[i]->X, grp->P.n ) ); |
| 1420 | MBEDTLS_MPI_CHK( mbedtls_mpi_shrink( &T[i]->Y, grp->P.n ) ); |
| 1421 | mbedtls_mpi_free( &T[i]->Z ); |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1422 | |
| 1423 | if( i == 0 ) |
| 1424 | break; |
| 1425 | } |
| 1426 | |
| 1427 | cleanup: |
| 1428 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1429 | mbedtls_mpi_free( &u ); mbedtls_mpi_free( &Zi ); mbedtls_mpi_free( &ZZi ); |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1430 | for( i = 0; i < T_size; i++ ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1431 | mbedtls_mpi_free( &c[i] ); |
| 1432 | mbedtls_free( c ); |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1433 | |
| 1434 | return( ret ); |
| 1435 | } |
| 1436 | |
Manuel Pégourié-Gonnard | cdd4432 | 2012-11-21 16:00:55 +0100 | [diff] [blame] | 1437 | /* |
Manuel Pégourié-Gonnard | 01fca5e | 2013-11-21 17:47:12 +0100 | [diff] [blame] | 1438 | * Conditional point inversion: Q -> -Q = (Q.X, -Q.Y, Q.Z) without leak. |
| 1439 | * "inv" must be 0 (don't invert) or 1 (invert) or the result will be invalid |
| 1440 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1441 | static int ecp_safe_invert_jac( const mbedtls_ecp_group *grp, |
| 1442 | mbedtls_ecp_point *Q, |
Manuel Pégourié-Gonnard | 01fca5e | 2013-11-21 17:47:12 +0100 | [diff] [blame] | 1443 | unsigned char inv ) |
| 1444 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1445 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 01fca5e | 2013-11-21 17:47:12 +0100 | [diff] [blame] | 1446 | unsigned char nonzero; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1447 | mbedtls_mpi mQY; |
Manuel Pégourié-Gonnard | 01fca5e | 2013-11-21 17:47:12 +0100 | [diff] [blame] | 1448 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1449 | mbedtls_mpi_init( &mQY ); |
Manuel Pégourié-Gonnard | 01fca5e | 2013-11-21 17:47:12 +0100 | [diff] [blame] | 1450 | |
| 1451 | /* Use the fact that -Q.Y mod P = P - Q.Y unless Q.Y == 0 */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1452 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &mQY, &grp->P, &Q->Y ) ); |
| 1453 | nonzero = mbedtls_mpi_cmp_int( &Q->Y, 0 ) != 0; |
| 1454 | MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &Q->Y, &mQY, inv & nonzero ) ); |
Manuel Pégourié-Gonnard | 01fca5e | 2013-11-21 17:47:12 +0100 | [diff] [blame] | 1455 | |
| 1456 | cleanup: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1457 | mbedtls_mpi_free( &mQY ); |
Manuel Pégourié-Gonnard | 01fca5e | 2013-11-21 17:47:12 +0100 | [diff] [blame] | 1458 | |
| 1459 | return( ret ); |
| 1460 | } |
| 1461 | |
| 1462 | /* |
Manuel Pégourié-Gonnard | 0cd6f98 | 2013-10-10 15:55:39 +0200 | [diff] [blame] | 1463 | * Point doubling R = 2 P, Jacobian coordinates |
Manuel Pégourié-Gonnard | 0ace4b3 | 2013-10-10 12:44:27 +0200 | [diff] [blame] | 1464 | * |
Peter Dettman | ce661b2 | 2015-02-07 14:43:51 +0700 | [diff] [blame] | 1465 | * Based on http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#doubling-dbl-1998-cmo-2 . |
Manuel Pégourié-Gonnard | 04a0225 | 2013-11-20 22:57:38 +0100 | [diff] [blame] | 1466 | * |
Peter Dettman | ce661b2 | 2015-02-07 14:43:51 +0700 | [diff] [blame] | 1467 | * We follow the variable naming fairly closely. The formula variations that trade a MUL for a SQR |
| 1468 | * (plus a few ADDs) aren't useful as our bignum implementation doesn't distinguish squaring. |
| 1469 | * |
| 1470 | * Standard optimizations are applied when curve parameter A is one of { 0, -3 }. |
| 1471 | * |
| 1472 | * Cost: 1D := 3M + 4S (A == 0) |
| 1473 | * 4M + 4S (A == -3) |
| 1474 | * 3M + 6S + 1a otherwise |
Manuel Pégourié-Gonnard | 1c4aa24 | 2013-10-09 16:09:46 +0200 | [diff] [blame] | 1475 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1476 | static int ecp_double_jac( const mbedtls_ecp_group *grp, mbedtls_ecp_point *R, |
| 1477 | const mbedtls_ecp_point *P ) |
Manuel Pégourié-Gonnard | 1c4aa24 | 2013-10-09 16:09:46 +0200 | [diff] [blame] | 1478 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1479 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2088ba6 | 2015-05-12 10:36:26 +0200 | [diff] [blame] | 1480 | mbedtls_mpi M, S, T, U; |
Manuel Pégourié-Gonnard | 1c4aa24 | 2013-10-09 16:09:46 +0200 | [diff] [blame] | 1481 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1482 | #if defined(MBEDTLS_SELF_TEST) |
Manuel Pégourié-Gonnard | 0cd6f98 | 2013-10-10 15:55:39 +0200 | [diff] [blame] | 1483 | dbl_count++; |
| 1484 | #endif |
| 1485 | |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 1486 | #if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) |
Manuel Pégourié-Gonnard | ebac5d3 | 2017-08-23 16:23:36 +0200 | [diff] [blame] | 1487 | if( mbedtls_internal_ecp_grp_capable( grp ) ) |
| 1488 | return( mbedtls_internal_ecp_double_jac( grp, R, P ) ); |
Janos Follath | 372697b | 2016-10-28 16:53:11 +0100 | [diff] [blame] | 1489 | #endif /* MBEDTLS_ECP_DOUBLE_JAC_ALT */ |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 1490 | |
Manuel Pégourié-Gonnard | 2088ba6 | 2015-05-12 10:36:26 +0200 | [diff] [blame] | 1491 | mbedtls_mpi_init( &M ); mbedtls_mpi_init( &S ); mbedtls_mpi_init( &T ); mbedtls_mpi_init( &U ); |
Manuel Pégourié-Gonnard | 73cc01d | 2013-12-06 12:41:30 +0100 | [diff] [blame] | 1492 | |
| 1493 | /* Special case for A = -3 */ |
| 1494 | if( grp->A.p == NULL ) |
| 1495 | { |
Peter Dettman | ce661b2 | 2015-02-07 14:43:51 +0700 | [diff] [blame] | 1496 | /* M = 3(X + Z^2)(X - Z^2) */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1497 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &P->Z, &P->Z ) ); |
| 1498 | MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &T, &P->X, &S ) ); |
| 1499 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &U, &P->X, &S ) ); |
| 1500 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &T, &U ) ); |
Manuel Pégourié-Gonnard | 2088ba6 | 2015-05-12 10:36:26 +0200 | [diff] [blame] | 1501 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &M, &S, 3 ) ); MOD_ADD( M ); |
Manuel Pégourié-Gonnard | 73cc01d | 2013-12-06 12:41:30 +0100 | [diff] [blame] | 1502 | } |
| 1503 | else |
Peter Vaskovic | a676acf | 2014-08-06 00:48:39 +0200 | [diff] [blame] | 1504 | { |
Peter Dettman | ce661b2 | 2015-02-07 14:43:51 +0700 | [diff] [blame] | 1505 | /* M = 3.X^2 */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1506 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &P->X, &P->X ) ); |
Manuel Pégourié-Gonnard | 2088ba6 | 2015-05-12 10:36:26 +0200 | [diff] [blame] | 1507 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &M, &S, 3 ) ); MOD_ADD( M ); |
Peter Dettman | ce661b2 | 2015-02-07 14:43:51 +0700 | [diff] [blame] | 1508 | |
| 1509 | /* Optimize away for "koblitz" curves with A = 0 */ |
Manuel Pégourié-Gonnard | 2088ba6 | 2015-05-12 10:36:26 +0200 | [diff] [blame] | 1510 | if( mbedtls_mpi_cmp_int( &grp->A, 0 ) != 0 ) |
Peter Dettman | ce661b2 | 2015-02-07 14:43:51 +0700 | [diff] [blame] | 1511 | { |
| 1512 | /* M += A.Z^4 */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1513 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &P->Z, &P->Z ) ); |
| 1514 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T, &S, &S ) ); |
| 1515 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &T, &grp->A ) ); |
| 1516 | MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &M, &M, &S ) ); |
Peter Dettman | ce661b2 | 2015-02-07 14:43:51 +0700 | [diff] [blame] | 1517 | } |
Peter Vaskovic | a676acf | 2014-08-06 00:48:39 +0200 | [diff] [blame] | 1518 | } |
Manuel Pégourié-Gonnard | 73cc01d | 2013-12-06 12:41:30 +0100 | [diff] [blame] | 1519 | |
Peter Dettman | ce661b2 | 2015-02-07 14:43:51 +0700 | [diff] [blame] | 1520 | /* S = 4.X.Y^2 */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1521 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T, &P->Y, &P->Y ) ); |
| 1522 | MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l_mod( grp, &T, 1 ) ); |
| 1523 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &P->X, &T ) ); |
| 1524 | MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l_mod( grp, &S, 1 ) ); |
Manuel Pégourié-Gonnard | 1c4aa24 | 2013-10-09 16:09:46 +0200 | [diff] [blame] | 1525 | |
Peter Dettman | ce661b2 | 2015-02-07 14:43:51 +0700 | [diff] [blame] | 1526 | /* U = 8.Y^4 */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1527 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &U, &T, &T ) ); |
| 1528 | MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l_mod( grp, &U, 1 ) ); |
Peter Dettman | ce661b2 | 2015-02-07 14:43:51 +0700 | [diff] [blame] | 1529 | |
| 1530 | /* T = M^2 - 2.S */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1531 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T, &M, &M ) ); |
| 1532 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &T, &T, &S ) ); |
| 1533 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &T, &T, &S ) ); |
Peter Dettman | ce661b2 | 2015-02-07 14:43:51 +0700 | [diff] [blame] | 1534 | |
| 1535 | /* S = M(S - T) - U */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1536 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &S, &S, &T ) ); |
| 1537 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S, &S, &M ) ); |
| 1538 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &S, &S, &U ) ); |
Peter Dettman | ce661b2 | 2015-02-07 14:43:51 +0700 | [diff] [blame] | 1539 | |
| 1540 | /* U = 2.Y.Z */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1541 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &U, &P->Y, &P->Z ) ); |
| 1542 | MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l_mod( grp, &U, 1 ) ); |
Peter Dettman | ce661b2 | 2015-02-07 14:43:51 +0700 | [diff] [blame] | 1543 | |
Manuel Pégourié-Gonnard | 2088ba6 | 2015-05-12 10:36:26 +0200 | [diff] [blame] | 1544 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->X, &T ) ); |
| 1545 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Y, &S ) ); |
| 1546 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Z, &U ) ); |
Manuel Pégourié-Gonnard | 1c4aa24 | 2013-10-09 16:09:46 +0200 | [diff] [blame] | 1547 | |
| 1548 | cleanup: |
Manuel Pégourié-Gonnard | 2088ba6 | 2015-05-12 10:36:26 +0200 | [diff] [blame] | 1549 | mbedtls_mpi_free( &M ); mbedtls_mpi_free( &S ); mbedtls_mpi_free( &T ); mbedtls_mpi_free( &U ); |
Manuel Pégourié-Gonnard | 1c4aa24 | 2013-10-09 16:09:46 +0200 | [diff] [blame] | 1550 | |
| 1551 | return( ret ); |
| 1552 | } |
| 1553 | |
| 1554 | /* |
Manuel Pégourié-Gonnard | 469a209 | 2013-11-21 18:20:43 +0100 | [diff] [blame] | 1555 | * Addition: R = P + Q, mixed affine-Jacobian coordinates (GECC 3.22) |
Manuel Pégourié-Gonnard | 9674fd0 | 2012-11-19 21:23:27 +0100 | [diff] [blame] | 1556 | * |
| 1557 | * The coordinates of Q must be normalized (= affine), |
| 1558 | * but those of P don't need to. R is not normalized. |
| 1559 | * |
Manuel Pégourié-Gonnard | aade42f | 2013-11-21 19:19:54 +0100 | [diff] [blame] | 1560 | * Special cases: (1) P or Q is zero, (2) R is zero, (3) P == Q. |
Manuel Pégourié-Gonnard | 7a949d3 | 2013-12-05 10:26:01 +0100 | [diff] [blame] | 1561 | * None of these cases can happen as intermediate step in ecp_mul_comb(): |
Manuel Pégourié-Gonnard | aade42f | 2013-11-21 19:19:54 +0100 | [diff] [blame] | 1562 | * - at each step, P, Q and R are multiples of the base point, the factor |
| 1563 | * being less than its order, so none of them is zero; |
| 1564 | * - Q is an odd multiple of the base point, P an even multiple, |
| 1565 | * due to the choice of precomputed points in the modified comb method. |
| 1566 | * So branches for these cases do not leak secret information. |
| 1567 | * |
Manuel Pégourié-Gonnard | 72c172a | 2013-12-30 16:04:55 +0100 | [diff] [blame] | 1568 | * We accept Q->Z being unset (saving memory in tables) as meaning 1. |
| 1569 | * |
Manuel Pégourié-Gonnard | 04a0225 | 2013-11-20 22:57:38 +0100 | [diff] [blame] | 1570 | * Cost: 1A := 8M + 3S |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 1571 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1572 | static int ecp_add_mixed( const mbedtls_ecp_group *grp, mbedtls_ecp_point *R, |
| 1573 | const mbedtls_ecp_point *P, const mbedtls_ecp_point *Q ) |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 1574 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1575 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1576 | mbedtls_mpi T1, T2, T3, T4, X, Y, Z; |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 1577 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1578 | #if defined(MBEDTLS_SELF_TEST) |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 1579 | add_count++; |
| 1580 | #endif |
| 1581 | |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 1582 | #if defined(MBEDTLS_ECP_ADD_MIXED_ALT) |
Manuel Pégourié-Gonnard | ebac5d3 | 2017-08-23 16:23:36 +0200 | [diff] [blame] | 1583 | if( mbedtls_internal_ecp_grp_capable( grp ) ) |
| 1584 | return( mbedtls_internal_ecp_add_mixed( grp, R, P, Q ) ); |
Janos Follath | 372697b | 2016-10-28 16:53:11 +0100 | [diff] [blame] | 1585 | #endif /* MBEDTLS_ECP_ADD_MIXED_ALT */ |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 1586 | |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 1587 | /* |
Manuel Pégourié-Gonnard | aade42f | 2013-11-21 19:19:54 +0100 | [diff] [blame] | 1588 | * Trivial cases: P == 0 or Q == 0 (case 1) |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 1589 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1590 | if( mbedtls_mpi_cmp_int( &P->Z, 0 ) == 0 ) |
| 1591 | return( mbedtls_ecp_copy( R, Q ) ); |
Manuel Pégourié-Gonnard | 469a209 | 2013-11-21 18:20:43 +0100 | [diff] [blame] | 1592 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1593 | if( Q->Z.p != NULL && mbedtls_mpi_cmp_int( &Q->Z, 0 ) == 0 ) |
| 1594 | return( mbedtls_ecp_copy( R, P ) ); |
Manuel Pégourié-Gonnard | 1c2782c | 2012-11-19 20:16:28 +0100 | [diff] [blame] | 1595 | |
| 1596 | /* |
| 1597 | * Make sure Q coordinates are normalized |
| 1598 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1599 | if( Q->Z.p != NULL && mbedtls_mpi_cmp_int( &Q->Z, 1 ) != 0 ) |
| 1600 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 1601 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1602 | mbedtls_mpi_init( &T1 ); mbedtls_mpi_init( &T2 ); mbedtls_mpi_init( &T3 ); mbedtls_mpi_init( &T4 ); |
| 1603 | mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y ); mbedtls_mpi_init( &Z ); |
Manuel Pégourié-Gonnard | ab38b70 | 2012-11-05 17:34:55 +0100 | [diff] [blame] | 1604 | |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1605 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T1, &P->Z, &P->Z ) ); |
| 1606 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T2, &T1, &P->Z ) ); |
| 1607 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T1, &T1, &Q->X ) ); |
| 1608 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T2, &T2, &Q->Y ) ); |
| 1609 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &T1, &T1, &P->X ) ); |
| 1610 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &T2, &T2, &P->Y ) ); |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 1611 | |
Manuel Pégourié-Gonnard | aade42f | 2013-11-21 19:19:54 +0100 | [diff] [blame] | 1612 | /* Special cases (2) and (3) */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1613 | if( mbedtls_mpi_cmp_int( &T1, 0 ) == 0 ) |
Manuel Pégourié-Gonnard | 7e0adfb | 2012-11-08 23:21:46 +0100 | [diff] [blame] | 1614 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1615 | if( mbedtls_mpi_cmp_int( &T2, 0 ) == 0 ) |
Manuel Pégourié-Gonnard | 7e0adfb | 2012-11-08 23:21:46 +0100 | [diff] [blame] | 1616 | { |
| 1617 | ret = ecp_double_jac( grp, R, P ); |
| 1618 | goto cleanup; |
| 1619 | } |
| 1620 | else |
| 1621 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1622 | ret = mbedtls_ecp_set_zero( R ); |
Manuel Pégourié-Gonnard | 7e0adfb | 2012-11-08 23:21:46 +0100 | [diff] [blame] | 1623 | goto cleanup; |
| 1624 | } |
| 1625 | } |
| 1626 | |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1627 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &Z, &P->Z, &T1 ) ); |
| 1628 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T3, &T1, &T1 ) ); |
| 1629 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T4, &T3, &T1 ) ); |
| 1630 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T3, &T3, &P->X ) ); |
| 1631 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &T1, &T3 ) ); |
| 1632 | MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l_mod( grp, &T1, 1 ) ); |
| 1633 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &X, &T2, &T2 ) ); |
| 1634 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &X, &X, &T1 ) ); |
| 1635 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &X, &X, &T4 ) ); |
| 1636 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &T3, &T3, &X ) ); |
| 1637 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T3, &T3, &T2 ) ); |
| 1638 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &T4, &T4, &P->Y ) ); |
| 1639 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &Y, &T3, &T4 ) ); |
Manuel Pégourié-Gonnard | 7e0adfb | 2012-11-08 23:21:46 +0100 | [diff] [blame] | 1640 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1641 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->X, &X ) ); |
| 1642 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Y, &Y ) ); |
| 1643 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &R->Z, &Z ) ); |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 1644 | |
| 1645 | cleanup: |
| 1646 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1647 | mbedtls_mpi_free( &T1 ); mbedtls_mpi_free( &T2 ); mbedtls_mpi_free( &T3 ); mbedtls_mpi_free( &T4 ); |
| 1648 | mbedtls_mpi_free( &X ); mbedtls_mpi_free( &Y ); mbedtls_mpi_free( &Z ); |
Manuel Pégourié-Gonnard | ae180d0 | 2012-11-02 18:14:40 +0100 | [diff] [blame] | 1649 | |
| 1650 | return( ret ); |
| 1651 | } |
| 1652 | |
| 1653 | /* |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1654 | * Randomize jacobian coordinates: |
| 1655 | * (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l |
Manuel Pégourié-Gonnard | 3c0b4ea | 2013-12-02 19:44:41 +0100 | [diff] [blame] | 1656 | * This is sort of the reverse operation of ecp_normalize_jac(). |
Manuel Pégourié-Gonnard | 44aab79 | 2013-11-21 10:53:59 +0100 | [diff] [blame] | 1657 | * |
| 1658 | * This countermeasure was first suggested in [2]. |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1659 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1660 | static int ecp_randomize_jac( const mbedtls_ecp_group *grp, mbedtls_ecp_point *pt, |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1661 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) |
| 1662 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1663 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1664 | mbedtls_mpi l, ll; |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 1665 | size_t p_size; |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1666 | int count = 0; |
| 1667 | |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 1668 | #if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT) |
Manuel Pégourié-Gonnard | ebac5d3 | 2017-08-23 16:23:36 +0200 | [diff] [blame] | 1669 | if( mbedtls_internal_ecp_grp_capable( grp ) ) |
| 1670 | return( mbedtls_internal_ecp_randomize_jac( grp, pt, f_rng, p_rng ) ); |
Janos Follath | 372697b | 2016-10-28 16:53:11 +0100 | [diff] [blame] | 1671 | #endif /* MBEDTLS_ECP_RANDOMIZE_JAC_ALT */ |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 1672 | |
| 1673 | p_size = ( grp->pbits + 7 ) / 8; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1674 | mbedtls_mpi_init( &l ); mbedtls_mpi_init( &ll ); |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1675 | |
| 1676 | /* Generate l such that 1 < l < p */ |
| 1677 | do |
| 1678 | { |
Ron Eldor | ca6ff58 | 2017-01-12 14:50:50 +0200 | [diff] [blame] | 1679 | MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &l, p_size, f_rng, p_rng ) ); |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1680 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1681 | while( mbedtls_mpi_cmp_mpi( &l, &grp->P ) >= 0 ) |
| 1682 | MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, 1 ) ); |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1683 | |
| 1684 | if( count++ > 10 ) |
Jonas | 6692a06 | 2020-05-08 16:57:18 +0900 | [diff] [blame] | 1685 | { |
| 1686 | ret = MBEDTLS_ERR_ECP_RANDOM_FAILED; |
| 1687 | goto cleanup; |
| 1688 | } |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1689 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1690 | while( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 ); |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1691 | |
| 1692 | /* Z = l * Z */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1693 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &pt->Z, &pt->Z, &l ) ); |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1694 | |
| 1695 | /* X = l^2 * X */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1696 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &ll, &l, &l ) ); |
| 1697 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &pt->X, &pt->X, &ll ) ); |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1698 | |
| 1699 | /* Y = l^3 * Y */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 1700 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &ll, &ll, &l ) ); |
| 1701 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &pt->Y, &pt->Y, &ll ) ); |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1702 | |
| 1703 | cleanup: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1704 | mbedtls_mpi_free( &l ); mbedtls_mpi_free( &ll ); |
Manuel Pégourié-Gonnard | 07de4b1 | 2013-09-02 16:26:04 +0200 | [diff] [blame] | 1705 | |
| 1706 | return( ret ); |
| 1707 | } |
| 1708 | |
| 1709 | /* |
Manuel Pégourié-Gonnard | c30200e | 2013-11-20 18:39:55 +0100 | [diff] [blame] | 1710 | * Check and define parameters used by the comb method (see below for details) |
| 1711 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1712 | #if MBEDTLS_ECP_WINDOW_SIZE < 2 || MBEDTLS_ECP_WINDOW_SIZE > 7 |
| 1713 | #error "MBEDTLS_ECP_WINDOW_SIZE out of bounds" |
Manuel Pégourié-Gonnard | c30200e | 2013-11-20 18:39:55 +0100 | [diff] [blame] | 1714 | #endif |
| 1715 | |
| 1716 | /* d = ceil( n / w ) */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1717 | #define COMB_MAX_D ( MBEDTLS_ECP_MAX_BITS + 1 ) / 2 |
Manuel Pégourié-Gonnard | c30200e | 2013-11-20 18:39:55 +0100 | [diff] [blame] | 1718 | |
| 1719 | /* number of precomputed points */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1720 | #define COMB_MAX_PRE ( 1 << ( MBEDTLS_ECP_WINDOW_SIZE - 1 ) ) |
Manuel Pégourié-Gonnard | c30200e | 2013-11-20 18:39:55 +0100 | [diff] [blame] | 1721 | |
| 1722 | /* |
| 1723 | * Compute the representation of m that will be used with our comb method. |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1724 | * |
| 1725 | * The basic comb method is described in GECC 3.44 for example. We use a |
Manuel Pégourié-Gonnard | 101a39f | 2013-11-20 14:47:19 +0100 | [diff] [blame] | 1726 | * modified version that provides resistance to SPA by avoiding zero |
| 1727 | * digits in the representation as in [3]. We modify the method further by |
| 1728 | * requiring that all K_i be odd, which has the small cost that our |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 1729 | * representation uses one more K_i, due to carries, but saves on the size of |
| 1730 | * the precomputed table. |
Manuel Pégourié-Gonnard | 101a39f | 2013-11-20 14:47:19 +0100 | [diff] [blame] | 1731 | * |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 1732 | * Summary of the comb method and its modifications: |
| 1733 | * |
| 1734 | * - The goal is to compute m*P for some w*d-bit integer m. |
| 1735 | * |
| 1736 | * - The basic comb method splits m into the w-bit integers |
| 1737 | * x[0] .. x[d-1] where x[i] consists of the bits in m whose |
| 1738 | * index has residue i modulo d, and computes m * P as |
| 1739 | * S[x[0]] + 2 * S[x[1]] + .. + 2^(d-1) S[x[d-1]], where |
| 1740 | * S[i_{w-1} .. i_0] := i_{w-1} 2^{(w-1)d} P + ... + i_1 2^d P + i_0 P. |
| 1741 | * |
| 1742 | * - If it happens that, say, x[i+1]=0 (=> S[x[i+1]]=0), one can replace the sum by |
| 1743 | * .. + 2^{i-1} S[x[i-1]] - 2^i S[x[i]] + 2^{i+1} S[x[i]] + 2^{i+2} S[x[i+2]] .., |
| 1744 | * thereby successively converting it into a form where all summands |
| 1745 | * are nonzero, at the cost of negative summands. This is the basic idea of [3]. |
| 1746 | * |
| 1747 | * - More generally, even if x[i+1] != 0, we can first transform the sum as |
| 1748 | * .. - 2^i S[x[i]] + 2^{i+1} ( S[x[i]] + S[x[i+1]] ) + 2^{i+2} S[x[i+2]] .., |
| 1749 | * and then replace S[x[i]] + S[x[i+1]] = S[x[i] ^ x[i+1]] + 2 S[x[i] & x[i+1]]. |
| 1750 | * Performing and iterating this procedure for those x[i] that are even |
| 1751 | * (keeping track of carry), we can transform the original sum into one of the form |
| 1752 | * S[x'[0]] +- 2 S[x'[1]] +- .. +- 2^{d-1} S[x'[d-1]] + 2^d S[x'[d]] |
| 1753 | * with all x'[i] odd. It is therefore only necessary to know S at odd indices, |
| 1754 | * which is why we are only computing half of it in the first place in |
| 1755 | * ecp_precompute_comb and accessing it with index abs(i) / 2 in ecp_select_comb. |
| 1756 | * |
| 1757 | * - For the sake of compactness, only the seven low-order bits of x[i] |
| 1758 | * are used to represent its absolute value (K_i in the paper), and the msb |
Manuel Pégourié-Gonnard | ee68cff | 2018-10-15 15:27:49 +0200 | [diff] [blame] | 1759 | * of x[i] encodes the sign (s_i in the paper): it is set if and only if |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 1760 | * if s_i == -1; |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1761 | * |
| 1762 | * Calling conventions: |
Manuel Pégourié-Gonnard | 101a39f | 2013-11-20 14:47:19 +0100 | [diff] [blame] | 1763 | * - x is an array of size d + 1 |
Manuel Pégourié-Gonnard | c30200e | 2013-11-20 18:39:55 +0100 | [diff] [blame] | 1764 | * - w is the size, ie number of teeth, of the comb, and must be between |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1765 | * 2 and 7 (in practice, between 2 and MBEDTLS_ECP_WINDOW_SIZE) |
Manuel Pégourié-Gonnard | 101a39f | 2013-11-20 14:47:19 +0100 | [diff] [blame] | 1766 | * - m is the MPI, expected to be odd and such that bitlength(m) <= w * d |
| 1767 | * (the result will be incorrect if these assumptions are not satisfied) |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1768 | */ |
Manuel Pégourié-Gonnard | 62738e9 | 2017-03-14 10:00:21 +0100 | [diff] [blame] | 1769 | static void ecp_comb_recode_core( unsigned char x[], size_t d, |
| 1770 | unsigned char w, const mbedtls_mpi *m ) |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1771 | { |
| 1772 | size_t i, j; |
Manuel Pégourié-Gonnard | 101a39f | 2013-11-20 14:47:19 +0100 | [diff] [blame] | 1773 | unsigned char c, cc, adjust; |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1774 | |
Manuel Pégourié-Gonnard | 101a39f | 2013-11-20 14:47:19 +0100 | [diff] [blame] | 1775 | memset( x, 0, d+1 ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1776 | |
Manuel Pégourié-Gonnard | edc1a1f | 2013-11-21 09:50:00 +0100 | [diff] [blame] | 1777 | /* First get the classical comb values (except for x_d = 0) */ |
| 1778 | for( i = 0; i < d; i++ ) |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1779 | for( j = 0; j < w; j++ ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1780 | x[i] |= mbedtls_mpi_get_bit( m, i + d * j ) << j; |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1781 | |
Manuel Pégourié-Gonnard | edc1a1f | 2013-11-21 09:50:00 +0100 | [diff] [blame] | 1782 | /* Now make sure x_1 .. x_d are odd */ |
| 1783 | c = 0; |
| 1784 | for( i = 1; i <= d; i++ ) |
| 1785 | { |
Manuel Pégourié-Gonnard | 101a39f | 2013-11-20 14:47:19 +0100 | [diff] [blame] | 1786 | /* Add carry and update it */ |
| 1787 | cc = x[i] & c; |
| 1788 | x[i] = x[i] ^ c; |
| 1789 | c = cc; |
| 1790 | |
Manuel Pégourié-Gonnard | edc1a1f | 2013-11-21 09:50:00 +0100 | [diff] [blame] | 1791 | /* Adjust if needed, avoiding branches */ |
Manuel Pégourié-Gonnard | 101a39f | 2013-11-20 14:47:19 +0100 | [diff] [blame] | 1792 | adjust = 1 - ( x[i] & 0x01 ); |
| 1793 | c |= x[i] & ( x[i-1] * adjust ); |
| 1794 | x[i] = x[i] ^ ( x[i-1] * adjust ); |
| 1795 | x[i-1] |= adjust << 7; |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1796 | } |
| 1797 | } |
| 1798 | |
| 1799 | /* |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 1800 | * Precompute points for the adapted comb method |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1801 | * |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 1802 | * Assumption: T must be able to hold 2^{w - 1} elements. |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1803 | * |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 1804 | * Operation: If i = i_{w-1} ... i_1 is the binary representation of i, |
| 1805 | * sets T[i] = i_{w-1} 2^{(w-1)d} P + ... + i_1 2^d P + P. |
Manuel Pégourié-Gonnard | 04a0225 | 2013-11-20 22:57:38 +0100 | [diff] [blame] | 1806 | * |
| 1807 | * Cost: d(w-1) D + (2^{w-1} - 1) A + 1 N(w-1) + 1 N(2^{w-1} - 1) |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 1808 | * |
| 1809 | * Note: Even comb values (those where P would be omitted from the |
| 1810 | * sum defining T[i] above) are not needed in our adaption |
Manuel Pégourié-Gonnard | ee68cff | 2018-10-15 15:27:49 +0200 | [diff] [blame] | 1811 | * the comb method. See ecp_comb_recode_core(). |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 1812 | * |
| 1813 | * This function currently works in four steps: |
Manuel Pégourié-Gonnard | ee68cff | 2018-10-15 15:27:49 +0200 | [diff] [blame] | 1814 | * (1) [dbl] Computation of intermediate T[i] for 2-power values of i |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 1815 | * (2) [norm_dbl] Normalization of coordinates of these T[i] |
| 1816 | * (3) [add] Computation of all T[i] |
| 1817 | * (4) [norm_add] Normalization of all T[i] |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 1818 | * |
| 1819 | * Step 1 can be interrupted but not the others; together with the final |
| 1820 | * coordinate normalization they are the largest steps done at once, depending |
| 1821 | * on the window size. Here are operation counts for P-256: |
| 1822 | * |
| 1823 | * step (2) (3) (4) |
| 1824 | * w = 5 142 165 208 |
| 1825 | * w = 4 136 77 160 |
| 1826 | * w = 3 130 33 136 |
| 1827 | * w = 2 124 11 124 |
| 1828 | * |
| 1829 | * So if ECC operations are blocking for too long even with a low max_ops |
| 1830 | * value, it's useful to set MBEDTLS_ECP_WINDOW_SIZE to a lower value in order |
| 1831 | * to minimize maximum blocking time. |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1832 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1833 | static int ecp_precompute_comb( const mbedtls_ecp_group *grp, |
| 1834 | mbedtls_ecp_point T[], const mbedtls_ecp_point *P, |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 1835 | unsigned char w, size_t d, |
| 1836 | mbedtls_ecp_restart_ctx *rs_ctx ) |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1837 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1838 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | fc3e0be | 2017-03-20 09:29:31 +0100 | [diff] [blame] | 1839 | unsigned char i; |
Manuel Pégourié-Gonnard | 213541a | 2017-03-20 12:50:41 +0100 | [diff] [blame] | 1840 | size_t j = 0; |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1841 | const unsigned char T_size = 1U << ( w - 1 ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1842 | mbedtls_ecp_point *cur, *TT[COMB_MAX_PRE - 1]; |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1843 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 1844 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 1845 | if( rs_ctx != NULL && rs_ctx->rsm != NULL ) |
Manuel Pégourié-Gonnard | 085b1df | 2017-03-16 16:56:04 +0100 | [diff] [blame] | 1846 | { |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 1847 | if( rs_ctx->rsm->state == ecp_rsm_pre_dbl ) |
| 1848 | goto dbl; |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 1849 | if( rs_ctx->rsm->state == ecp_rsm_pre_norm_dbl ) |
Manuel Pégourié-Gonnard | e2d7cb3 | 2017-03-20 10:24:17 +0100 | [diff] [blame] | 1850 | goto norm_dbl; |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 1851 | if( rs_ctx->rsm->state == ecp_rsm_pre_add ) |
| 1852 | goto add; |
| 1853 | if( rs_ctx->rsm->state == ecp_rsm_pre_norm_add ) |
| 1854 | goto norm_add; |
Manuel Pégourié-Gonnard | 085b1df | 2017-03-16 16:56:04 +0100 | [diff] [blame] | 1855 | } |
Manuel Pégourié-Gonnard | ee68cff | 2018-10-15 15:27:49 +0200 | [diff] [blame] | 1856 | #else |
| 1857 | (void) rs_ctx; |
Manuel Pégourié-Gonnard | 085b1df | 2017-03-16 16:56:04 +0100 | [diff] [blame] | 1858 | #endif |
| 1859 | |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 1860 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
| 1861 | if( rs_ctx != NULL && rs_ctx->rsm != NULL ) |
| 1862 | { |
| 1863 | rs_ctx->rsm->state = ecp_rsm_pre_dbl; |
| 1864 | |
| 1865 | /* initial state for the loop */ |
| 1866 | rs_ctx->rsm->i = 0; |
| 1867 | } |
| 1868 | |
| 1869 | dbl: |
| 1870 | #endif |
Manuel Pégourié-Gonnard | ee68cff | 2018-10-15 15:27:49 +0200 | [diff] [blame] | 1871 | /* |
| 1872 | * Set T[0] = P and |
| 1873 | * T[2^{l-1}] = 2^{dl} P for l = 1 .. w-1 (this is not the final value) |
| 1874 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1875 | MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &T[0], P ) ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1876 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 1877 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 1878 | if( rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->i != 0 ) |
| 1879 | j = rs_ctx->rsm->i; |
Manuel Pégourié-Gonnard | 213541a | 2017-03-20 12:50:41 +0100 | [diff] [blame] | 1880 | else |
| 1881 | #endif |
| 1882 | j = 0; |
| 1883 | |
| 1884 | for( ; j < d * ( w - 1 ); j++ ) |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1885 | { |
Manuel Pégourié-Gonnard | c751148 | 2017-04-20 16:31:00 +0200 | [diff] [blame] | 1886 | MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_DBL ); |
Manuel Pégourié-Gonnard | 213541a | 2017-03-20 12:50:41 +0100 | [diff] [blame] | 1887 | |
Manuel Pégourié-Gonnard | ae55707 | 2017-03-20 12:21:24 +0100 | [diff] [blame] | 1888 | i = 1U << ( j / d ); |
Manuel Pégourié-Gonnard | 101a39f | 2013-11-20 14:47:19 +0100 | [diff] [blame] | 1889 | cur = T + i; |
Manuel Pégourié-Gonnard | ae55707 | 2017-03-20 12:21:24 +0100 | [diff] [blame] | 1890 | |
| 1891 | if( j % d == 0 ) |
| 1892 | MBEDTLS_MPI_CHK( mbedtls_ecp_copy( cur, T + ( i >> 1 ) ) ); |
| 1893 | |
| 1894 | MBEDTLS_MPI_CHK( ecp_double_jac( grp, cur, cur ) ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1895 | } |
| 1896 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 1897 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 1898 | if( rs_ctx != NULL && rs_ctx->rsm != NULL ) |
| 1899 | rs_ctx->rsm->state = ecp_rsm_pre_norm_dbl; |
| 1900 | |
Manuel Pégourié-Gonnard | e2d7cb3 | 2017-03-20 10:24:17 +0100 | [diff] [blame] | 1901 | norm_dbl: |
| 1902 | #endif |
Manuel Pégourié-Gonnard | ee68cff | 2018-10-15 15:27:49 +0200 | [diff] [blame] | 1903 | /* |
| 1904 | * Normalize current elements in T. As T has holes, |
| 1905 | * use an auxiliary array of pointers to elements in T. |
| 1906 | */ |
Manuel Pégourié-Gonnard | fc3e0be | 2017-03-20 09:29:31 +0100 | [diff] [blame] | 1907 | j = 0; |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1908 | for( i = 1; i < T_size; i <<= 1 ) |
Manuel Pégourié-Gonnard | fc3e0be | 2017-03-20 09:29:31 +0100 | [diff] [blame] | 1909 | TT[j++] = T + i; |
| 1910 | |
Manuel Pégourié-Gonnard | c751148 | 2017-04-20 16:31:00 +0200 | [diff] [blame] | 1911 | MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV + 6 * j - 2 ); |
Manuel Pégourié-Gonnard | e2d7cb3 | 2017-03-20 10:24:17 +0100 | [diff] [blame] | 1912 | |
Manuel Pégourié-Gonnard | fc3e0be | 2017-03-20 09:29:31 +0100 | [diff] [blame] | 1913 | MBEDTLS_MPI_CHK( ecp_normalize_jac_many( grp, TT, j ) ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1914 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 1915 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 1916 | if( rs_ctx != NULL && rs_ctx->rsm != NULL ) |
| 1917 | rs_ctx->rsm->state = ecp_rsm_pre_add; |
| 1918 | |
Manuel Pégourié-Gonnard | e2d7cb3 | 2017-03-20 10:24:17 +0100 | [diff] [blame] | 1919 | add: |
| 1920 | #endif |
Manuel Pégourié-Gonnard | ee68cff | 2018-10-15 15:27:49 +0200 | [diff] [blame] | 1921 | /* |
| 1922 | * Compute the remaining ones using the minimal number of additions |
| 1923 | * Be careful to update T[2^l] only after using it! |
| 1924 | */ |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1925 | MBEDTLS_ECP_BUDGET( ( T_size - 1 ) * MBEDTLS_ECP_OPS_ADD ); |
Manuel Pégourié-Gonnard | e2d7cb3 | 2017-03-20 10:24:17 +0100 | [diff] [blame] | 1926 | |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1927 | for( i = 1; i < T_size; i <<= 1 ) |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1928 | { |
Manuel Pégourié-Gonnard | 101a39f | 2013-11-20 14:47:19 +0100 | [diff] [blame] | 1929 | j = i; |
| 1930 | while( j-- ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1931 | MBEDTLS_MPI_CHK( ecp_add_mixed( grp, &T[i + j], &T[j], &T[i] ) ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1932 | } |
| 1933 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 1934 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 1935 | if( rs_ctx != NULL && rs_ctx->rsm != NULL ) |
| 1936 | rs_ctx->rsm->state = ecp_rsm_pre_norm_add; |
| 1937 | |
Manuel Pégourié-Gonnard | e2d7cb3 | 2017-03-20 10:24:17 +0100 | [diff] [blame] | 1938 | norm_add: |
| 1939 | #endif |
Manuel Pégourié-Gonnard | ee68cff | 2018-10-15 15:27:49 +0200 | [diff] [blame] | 1940 | /* |
Manuel Pégourié-Gonnard | a966fde | 2018-10-23 10:41:11 +0200 | [diff] [blame] | 1941 | * Normalize final elements in T. Even though there are no holes now, we |
| 1942 | * still need the auxiliary array for homogeneity with the previous |
| 1943 | * call. Also, skip T[0] which is already normalised, being a copy of P. |
Manuel Pégourié-Gonnard | ee68cff | 2018-10-15 15:27:49 +0200 | [diff] [blame] | 1944 | */ |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1945 | for( j = 0; j + 1 < T_size; j++ ) |
Manuel Pégourié-Gonnard | fc3e0be | 2017-03-20 09:29:31 +0100 | [diff] [blame] | 1946 | TT[j] = T + j + 1; |
| 1947 | |
Manuel Pégourié-Gonnard | c751148 | 2017-04-20 16:31:00 +0200 | [diff] [blame] | 1948 | MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV + 6 * j - 2 ); |
Manuel Pégourié-Gonnard | e2d7cb3 | 2017-03-20 10:24:17 +0100 | [diff] [blame] | 1949 | |
Manuel Pégourié-Gonnard | fc3e0be | 2017-03-20 09:29:31 +0100 | [diff] [blame] | 1950 | MBEDTLS_MPI_CHK( ecp_normalize_jac_many( grp, TT, j ) ); |
Manuel Pégourié-Gonnard | e282012 | 2013-11-21 10:08:50 +0100 | [diff] [blame] | 1951 | |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1952 | cleanup: |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 1953 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 1954 | if( rs_ctx != NULL && rs_ctx->rsm != NULL && |
| 1955 | ret == MBEDTLS_ERR_ECP_IN_PROGRESS ) |
Manuel Pégourié-Gonnard | 213541a | 2017-03-20 12:50:41 +0100 | [diff] [blame] | 1956 | { |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 1957 | if( rs_ctx->rsm->state == ecp_rsm_pre_dbl ) |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 1958 | rs_ctx->rsm->i = j; |
Manuel Pégourié-Gonnard | 213541a | 2017-03-20 12:50:41 +0100 | [diff] [blame] | 1959 | } |
| 1960 | #endif |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 1961 | |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1962 | return( ret ); |
| 1963 | } |
| 1964 | |
| 1965 | /* |
Manuel Pégourié-Gonnard | 101a39f | 2013-11-20 14:47:19 +0100 | [diff] [blame] | 1966 | * Select precomputed point: R = sign(i) * T[ abs(i) / 2 ] |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 1967 | * |
| 1968 | * See ecp_comb_recode_core() for background |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1969 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1970 | static int ecp_select_comb( const mbedtls_ecp_group *grp, mbedtls_ecp_point *R, |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1971 | const mbedtls_ecp_point T[], unsigned char T_size, |
Manuel Pégourié-Gonnard | d728350 | 2013-11-21 20:00:38 +0100 | [diff] [blame] | 1972 | unsigned char i ) |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1973 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 1974 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | d728350 | 2013-11-21 20:00:38 +0100 | [diff] [blame] | 1975 | unsigned char ii, j; |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1976 | |
Manuel Pégourié-Gonnard | d728350 | 2013-11-21 20:00:38 +0100 | [diff] [blame] | 1977 | /* Ignore the "sign" bit and scale down */ |
| 1978 | ii = ( i & 0x7Fu ) >> 1; |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1979 | |
Manuel Pégourié-Gonnard | d728350 | 2013-11-21 20:00:38 +0100 | [diff] [blame] | 1980 | /* Read the whole table to thwart cache-based timing attacks */ |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 1981 | for( j = 0; j < T_size; j++ ) |
Manuel Pégourié-Gonnard | d728350 | 2013-11-21 20:00:38 +0100 | [diff] [blame] | 1982 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1983 | MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &R->X, &T[j].X, j == ii ) ); |
| 1984 | MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &R->Y, &T[j].Y, j == ii ) ); |
Manuel Pégourié-Gonnard | d728350 | 2013-11-21 20:00:38 +0100 | [diff] [blame] | 1985 | } |
| 1986 | |
Manuel Pégourié-Gonnard | 01fca5e | 2013-11-21 17:47:12 +0100 | [diff] [blame] | 1987 | /* Safely invert result if i is "negative" */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1988 | MBEDTLS_MPI_CHK( ecp_safe_invert_jac( grp, R, i >> 7 ) ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1989 | |
| 1990 | cleanup: |
| 1991 | return( ret ); |
| 1992 | } |
| 1993 | |
| 1994 | /* |
| 1995 | * Core multiplication algorithm for the (modified) comb method. |
| 1996 | * This part is actually common with the basic comb method (GECC 3.44) |
Manuel Pégourié-Gonnard | 04a0225 | 2013-11-20 22:57:38 +0100 | [diff] [blame] | 1997 | * |
| 1998 | * Cost: d A + d D + 1 R |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 1999 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2000 | static int ecp_mul_comb_core( const mbedtls_ecp_group *grp, mbedtls_ecp_point *R, |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 2001 | const mbedtls_ecp_point T[], unsigned char T_size, |
Manuel Pégourié-Gonnard | 70c1437 | 2013-11-20 20:07:26 +0100 | [diff] [blame] | 2002 | const unsigned char x[], size_t d, |
| 2003 | int (*f_rng)(void *, unsigned char *, size_t), |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 2004 | void *p_rng, |
| 2005 | mbedtls_ecp_restart_ctx *rs_ctx ) |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2006 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 2007 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2008 | mbedtls_ecp_point Txi; |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2009 | size_t i; |
| 2010 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2011 | mbedtls_ecp_point_init( &Txi ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2012 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2013 | #if !defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 2014 | (void) rs_ctx; |
| 2015 | #endif |
| 2016 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2017 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 2018 | if( rs_ctx != NULL && rs_ctx->rsm != NULL && |
| 2019 | rs_ctx->rsm->state != ecp_rsm_comb_core ) |
| 2020 | { |
| 2021 | rs_ctx->rsm->i = 0; |
| 2022 | rs_ctx->rsm->state = ecp_rsm_comb_core; |
| 2023 | } |
| 2024 | |
| 2025 | /* new 'if' instead of nested for the sake of the 'else' branch */ |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 2026 | if( rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->i != 0 ) |
Manuel Pégourié-Gonnard | c5d844b | 2017-03-15 13:06:28 +0100 | [diff] [blame] | 2027 | { |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 2028 | /* restore current index (R already pointing to rs_ctx->rsm->R) */ |
| 2029 | i = rs_ctx->rsm->i; |
Manuel Pégourié-Gonnard | c5d844b | 2017-03-15 13:06:28 +0100 | [diff] [blame] | 2030 | } |
| 2031 | else |
| 2032 | #endif |
| 2033 | { |
| 2034 | /* Start with a non-zero point and randomize its coordinates */ |
| 2035 | i = d; |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 2036 | MBEDTLS_MPI_CHK( ecp_select_comb( grp, R, T, T_size, x[i] ) ); |
Manuel Pégourié-Gonnard | c5d844b | 2017-03-15 13:06:28 +0100 | [diff] [blame] | 2037 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->Z, 1 ) ); |
Manuel Pégourié-Gonnard | 22b1de3 | 2020-06-04 10:43:29 +0200 | [diff] [blame] | 2038 | #if defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
Manuel Pégourié-Gonnard | c5d844b | 2017-03-15 13:06:28 +0100 | [diff] [blame] | 2039 | if( f_rng != 0 ) |
Manuel Pégourié-Gonnard | 22b1de3 | 2020-06-04 10:43:29 +0200 | [diff] [blame] | 2040 | #endif |
Manuel Pégourié-Gonnard | c5d844b | 2017-03-15 13:06:28 +0100 | [diff] [blame] | 2041 | MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, R, f_rng, p_rng ) ); |
| 2042 | } |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2043 | |
Manuel Pégourié-Gonnard | 90f31b7 | 2018-10-16 10:45:24 +0200 | [diff] [blame] | 2044 | while( i != 0 ) |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2045 | { |
Manuel Pégourié-Gonnard | c751148 | 2017-04-20 16:31:00 +0200 | [diff] [blame] | 2046 | MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_DBL + MBEDTLS_ECP_OPS_ADD ); |
Manuel Pégourié-Gonnard | 90f31b7 | 2018-10-16 10:45:24 +0200 | [diff] [blame] | 2047 | --i; |
| 2048 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2049 | MBEDTLS_MPI_CHK( ecp_double_jac( grp, R, R ) ); |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 2050 | MBEDTLS_MPI_CHK( ecp_select_comb( grp, &Txi, T, T_size, x[i] ) ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2051 | MBEDTLS_MPI_CHK( ecp_add_mixed( grp, R, R, &Txi ) ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2052 | } |
| 2053 | |
| 2054 | cleanup: |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 2055 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2056 | mbedtls_ecp_point_free( &Txi ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2057 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2058 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 2059 | if( rs_ctx != NULL && rs_ctx->rsm != NULL && |
| 2060 | ret == MBEDTLS_ERR_ECP_IN_PROGRESS ) |
Manuel Pégourié-Gonnard | c5d844b | 2017-03-15 13:06:28 +0100 | [diff] [blame] | 2061 | { |
Manuel Pégourié-Gonnard | 90f31b7 | 2018-10-16 10:45:24 +0200 | [diff] [blame] | 2062 | rs_ctx->rsm->i = i; |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 2063 | /* no need to save R, already pointing to rs_ctx->rsm->R */ |
Manuel Pégourié-Gonnard | c5d844b | 2017-03-15 13:06:28 +0100 | [diff] [blame] | 2064 | } |
| 2065 | #endif |
| 2066 | |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2067 | return( ret ); |
| 2068 | } |
| 2069 | |
| 2070 | /* |
Manuel Pégourié-Gonnard | 62738e9 | 2017-03-14 10:00:21 +0100 | [diff] [blame] | 2071 | * Recode the scalar to get constant-time comb multiplication |
| 2072 | * |
| 2073 | * As the actual scalar recoding needs an odd scalar as a starting point, |
| 2074 | * this wrapper ensures that by replacing m by N - m if necessary, and |
| 2075 | * informs the caller that the result of multiplication will be negated. |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 2076 | * |
Manuel Pégourié-Gonnard | fd87e35 | 2017-08-24 14:21:05 +0200 | [diff] [blame] | 2077 | * This works because we only support large prime order for Short Weierstrass |
| 2078 | * curves, so N is always odd hence either m or N - m is. |
| 2079 | * |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 2080 | * See ecp_comb_recode_core() for background. |
Manuel Pégourié-Gonnard | ec5606a | 2017-03-09 12:46:45 +0100 | [diff] [blame] | 2081 | */ |
Manuel Pégourié-Gonnard | 62738e9 | 2017-03-14 10:00:21 +0100 | [diff] [blame] | 2082 | static int ecp_comb_recode_scalar( const mbedtls_ecp_group *grp, |
| 2083 | const mbedtls_mpi *m, |
| 2084 | unsigned char k[COMB_MAX_D + 1], |
| 2085 | size_t d, |
| 2086 | unsigned char w, |
| 2087 | unsigned char *parity_trick ) |
Manuel Pégourié-Gonnard | ec5606a | 2017-03-09 12:46:45 +0100 | [diff] [blame] | 2088 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 2089 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 62738e9 | 2017-03-14 10:00:21 +0100 | [diff] [blame] | 2090 | mbedtls_mpi M, mm; |
Manuel Pégourié-Gonnard | ec5606a | 2017-03-09 12:46:45 +0100 | [diff] [blame] | 2091 | |
Manuel Pégourié-Gonnard | 62738e9 | 2017-03-14 10:00:21 +0100 | [diff] [blame] | 2092 | mbedtls_mpi_init( &M ); |
Manuel Pégourié-Gonnard | ec5606a | 2017-03-09 12:46:45 +0100 | [diff] [blame] | 2093 | mbedtls_mpi_init( &mm ); |
| 2094 | |
Manuel Pégourié-Gonnard | fd87e35 | 2017-08-24 14:21:05 +0200 | [diff] [blame] | 2095 | /* N is always odd (see above), just make extra sure */ |
Manuel Pégourié-Gonnard | ec5606a | 2017-03-09 12:46:45 +0100 | [diff] [blame] | 2096 | if( mbedtls_mpi_get_bit( &grp->N, 0 ) != 1 ) |
| 2097 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
| 2098 | |
Manuel Pégourié-Gonnard | 62738e9 | 2017-03-14 10:00:21 +0100 | [diff] [blame] | 2099 | /* do we need the parity trick? */ |
| 2100 | *parity_trick = ( mbedtls_mpi_get_bit( m, 0 ) == 0 ); |
| 2101 | |
| 2102 | /* execute parity fix in constant time */ |
| 2103 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &M, m ) ); |
Manuel Pégourié-Gonnard | ec5606a | 2017-03-09 12:46:45 +0100 | [diff] [blame] | 2104 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &mm, &grp->N, m ) ); |
Manuel Pégourié-Gonnard | 62738e9 | 2017-03-14 10:00:21 +0100 | [diff] [blame] | 2105 | MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_assign( &M, &mm, *parity_trick ) ); |
| 2106 | |
| 2107 | /* actual scalar recoding */ |
| 2108 | ecp_comb_recode_core( k, d, w, &M ); |
Manuel Pégourié-Gonnard | ec5606a | 2017-03-09 12:46:45 +0100 | [diff] [blame] | 2109 | |
| 2110 | cleanup: |
| 2111 | mbedtls_mpi_free( &mm ); |
Manuel Pégourié-Gonnard | 62738e9 | 2017-03-14 10:00:21 +0100 | [diff] [blame] | 2112 | mbedtls_mpi_free( &M ); |
Manuel Pégourié-Gonnard | ec5606a | 2017-03-09 12:46:45 +0100 | [diff] [blame] | 2113 | |
| 2114 | return( ret ); |
| 2115 | } |
| 2116 | |
| 2117 | /* |
Manuel Pégourié-Gonnard | 391f441 | 2017-03-13 12:26:21 +0100 | [diff] [blame] | 2118 | * Perform comb multiplication (for short Weierstrass curves) |
| 2119 | * once the auxiliary table has been pre-computed. |
Manuel Pégourié-Gonnard | 62738e9 | 2017-03-14 10:00:21 +0100 | [diff] [blame] | 2120 | * |
| 2121 | * Scalar recoding may use a parity trick that makes us compute -m * P, |
| 2122 | * if that is the case we'll need to recover m * P at the end. |
Manuel Pégourié-Gonnard | 391f441 | 2017-03-13 12:26:21 +0100 | [diff] [blame] | 2123 | */ |
| 2124 | static int ecp_mul_comb_after_precomp( const mbedtls_ecp_group *grp, |
| 2125 | mbedtls_ecp_point *R, |
| 2126 | const mbedtls_mpi *m, |
| 2127 | const mbedtls_ecp_point *T, |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 2128 | unsigned char T_size, |
Manuel Pégourié-Gonnard | 391f441 | 2017-03-13 12:26:21 +0100 | [diff] [blame] | 2129 | unsigned char w, |
| 2130 | size_t d, |
| 2131 | int (*f_rng)(void *, unsigned char *, size_t), |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 2132 | void *p_rng, |
| 2133 | mbedtls_ecp_restart_ctx *rs_ctx ) |
Manuel Pégourié-Gonnard | 391f441 | 2017-03-13 12:26:21 +0100 | [diff] [blame] | 2134 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 2135 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 62738e9 | 2017-03-14 10:00:21 +0100 | [diff] [blame] | 2136 | unsigned char parity_trick; |
Manuel Pégourié-Gonnard | 391f441 | 2017-03-13 12:26:21 +0100 | [diff] [blame] | 2137 | unsigned char k[COMB_MAX_D + 1]; |
Manuel Pégourié-Gonnard | 8962ddb | 2017-03-14 12:11:21 +0100 | [diff] [blame] | 2138 | mbedtls_ecp_point *RR = R; |
| 2139 | |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 2140 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
| 2141 | if( rs_ctx != NULL && rs_ctx->rsm != NULL ) |
| 2142 | { |
| 2143 | RR = &rs_ctx->rsm->R; |
| 2144 | |
| 2145 | if( rs_ctx->rsm->state == ecp_rsm_final_norm ) |
| 2146 | goto final_norm; |
| 2147 | } |
Manuel Pégourié-Gonnard | 8962ddb | 2017-03-14 12:11:21 +0100 | [diff] [blame] | 2148 | #endif |
Manuel Pégourié-Gonnard | 391f441 | 2017-03-13 12:26:21 +0100 | [diff] [blame] | 2149 | |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 2150 | MBEDTLS_MPI_CHK( ecp_comb_recode_scalar( grp, m, k, d, w, |
| 2151 | &parity_trick ) ); |
| 2152 | MBEDTLS_MPI_CHK( ecp_mul_comb_core( grp, RR, T, T_size, k, d, |
| 2153 | f_rng, p_rng, rs_ctx ) ); |
| 2154 | MBEDTLS_MPI_CHK( ecp_safe_invert_jac( grp, RR, parity_trick ) ); |
| 2155 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2156 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 2157 | if( rs_ctx != NULL && rs_ctx->rsm != NULL ) |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 2158 | rs_ctx->rsm->state = ecp_rsm_final_norm; |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 2159 | |
Manuel Pégourié-Gonnard | 4ed1dab | 2017-08-24 11:02:04 +0200 | [diff] [blame] | 2160 | final_norm: |
Manuel Pégourié-Gonnard | 9b8d34e | 2020-06-08 09:53:20 +0200 | [diff] [blame] | 2161 | MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV ); |
Manuel Pégourié-Gonnard | 2fad7ae | 2017-03-14 13:13:13 +0100 | [diff] [blame] | 2162 | #endif |
Manuel Pégourié-Gonnard | a4aa89b | 2020-03-25 12:41:29 +0100 | [diff] [blame] | 2163 | /* |
| 2164 | * Knowledge of the jacobian coordinates may leak the last few bits of the |
| 2165 | * scalar [1], and since our MPI implementation isn't constant-flow, |
| 2166 | * inversion (used for coordinate normalization) may leak the full value |
| 2167 | * of its input via side-channels [2]. |
| 2168 | * |
| 2169 | * [1] https://eprint.iacr.org/2003/191 |
| 2170 | * [2] https://eprint.iacr.org/2020/055 |
| 2171 | * |
| 2172 | * Avoid the leak by randomizing coordinates before we normalize them. |
| 2173 | */ |
Manuel Pégourié-Gonnard | 22b1de3 | 2020-06-04 10:43:29 +0200 | [diff] [blame] | 2174 | #if defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
Manuel Pégourié-Gonnard | a4aa89b | 2020-03-25 12:41:29 +0100 | [diff] [blame] | 2175 | if( f_rng != 0 ) |
Manuel Pégourié-Gonnard | 22b1de3 | 2020-06-04 10:43:29 +0200 | [diff] [blame] | 2176 | #endif |
Manuel Pégourié-Gonnard | a4aa89b | 2020-03-25 12:41:29 +0100 | [diff] [blame] | 2177 | MBEDTLS_MPI_CHK( ecp_randomize_jac( grp, RR, f_rng, p_rng ) ); |
| 2178 | |
Manuel Pégourié-Gonnard | 8962ddb | 2017-03-14 12:11:21 +0100 | [diff] [blame] | 2179 | MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, RR ) ); |
| 2180 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2181 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 28d1628 | 2017-08-23 17:33:27 +0200 | [diff] [blame] | 2182 | if( rs_ctx != NULL && rs_ctx->rsm != NULL ) |
| 2183 | MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, RR ) ); |
Manuel Pégourié-Gonnard | 8962ddb | 2017-03-14 12:11:21 +0100 | [diff] [blame] | 2184 | #endif |
Manuel Pégourié-Gonnard | 391f441 | 2017-03-13 12:26:21 +0100 | [diff] [blame] | 2185 | |
| 2186 | cleanup: |
Manuel Pégourié-Gonnard | 391f441 | 2017-03-13 12:26:21 +0100 | [diff] [blame] | 2187 | return( ret ); |
| 2188 | } |
| 2189 | |
Manuel Pégourié-Gonnard | 391f441 | 2017-03-13 12:26:21 +0100 | [diff] [blame] | 2190 | /* |
Manuel Pégourié-Gonnard | 4b2336d | 2017-03-09 13:23:50 +0100 | [diff] [blame] | 2191 | * Pick window size based on curve size and whether we optimize for base point |
| 2192 | */ |
| 2193 | static unsigned char ecp_pick_window_size( const mbedtls_ecp_group *grp, |
| 2194 | unsigned char p_eq_g ) |
| 2195 | { |
| 2196 | unsigned char w; |
| 2197 | |
| 2198 | /* |
| 2199 | * Minimize the number of multiplications, that is minimize |
| 2200 | * 10 * d * w + 18 * 2^(w-1) + 11 * d + 7 * w, with d = ceil( nbits / w ) |
| 2201 | * (see costs of the various parts, with 1S = 1M) |
| 2202 | */ |
| 2203 | w = grp->nbits >= 384 ? 5 : 4; |
| 2204 | |
| 2205 | /* |
| 2206 | * If P == G, pre-compute a bit more, since this may be re-used later. |
| 2207 | * Just adding one avoids upping the cost of the first mul too much, |
| 2208 | * and the memory cost too. |
| 2209 | */ |
| 2210 | if( p_eq_g ) |
| 2211 | w++; |
| 2212 | |
| 2213 | /* |
| 2214 | * Make sure w is within bounds. |
| 2215 | * (The last test is useful only for very small curves in the test suite.) |
| 2216 | */ |
k-stachowiak | 653a4a2 | 2019-07-03 14:31:09 +0200 | [diff] [blame] | 2217 | #if( MBEDTLS_ECP_WINDOW_SIZE < 6 ) |
Manuel Pégourié-Gonnard | 4b2336d | 2017-03-09 13:23:50 +0100 | [diff] [blame] | 2218 | if( w > MBEDTLS_ECP_WINDOW_SIZE ) |
| 2219 | w = MBEDTLS_ECP_WINDOW_SIZE; |
k-stachowiak | 653a4a2 | 2019-07-03 14:31:09 +0200 | [diff] [blame] | 2220 | #endif |
Manuel Pégourié-Gonnard | 4b2336d | 2017-03-09 13:23:50 +0100 | [diff] [blame] | 2221 | if( w >= grp->nbits ) |
| 2222 | w = 2; |
| 2223 | |
| 2224 | return( w ); |
| 2225 | } |
| 2226 | |
| 2227 | /* |
Manuel Pégourié-Gonnard | 07bf6f5 | 2017-03-16 17:21:38 +0100 | [diff] [blame] | 2228 | * Multiplication using the comb method - for curves in short Weierstrass form |
| 2229 | * |
| 2230 | * This function is mainly responsible for administrative work: |
| 2231 | * - managing the restart context if enabled |
Manuel Pégourié-Gonnard | 11556e2 | 2017-08-24 13:41:19 +0200 | [diff] [blame] | 2232 | * - managing the table of precomputed points (passed between the below two |
Manuel Pégourié-Gonnard | 07bf6f5 | 2017-03-16 17:21:38 +0100 | [diff] [blame] | 2233 | * functions): allocation, computation, ownership tranfer, freeing. |
| 2234 | * |
| 2235 | * It delegates the actual arithmetic work to: |
| 2236 | * ecp_precompute_comb() and ecp_mul_comb_with_precomp() |
| 2237 | * |
| 2238 | * See comments on ecp_comb_recode_core() regarding the computation strategy. |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2239 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2240 | static int ecp_mul_comb( mbedtls_ecp_group *grp, mbedtls_ecp_point *R, |
| 2241 | const mbedtls_mpi *m, const mbedtls_ecp_point *P, |
Manuel Pégourié-Gonnard | a0179b8 | 2013-12-04 11:49:20 +0100 | [diff] [blame] | 2242 | int (*f_rng)(void *, unsigned char *, size_t), |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 2243 | void *p_rng, |
| 2244 | mbedtls_ecp_restart_ctx *rs_ctx ) |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2245 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 2246 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 11556e2 | 2017-08-24 13:41:19 +0200 | [diff] [blame] | 2247 | unsigned char w, p_eq_g, i; |
Manuel Pégourié-Gonnard | d728350 | 2013-11-21 20:00:38 +0100 | [diff] [blame] | 2248 | size_t d; |
Manuel Pégourié-Gonnard | f2a9fcf | 2020-06-03 12:11:56 +0200 | [diff] [blame] | 2249 | unsigned char T_size = 0, T_ok = 0; |
| 2250 | mbedtls_ecp_point *T = NULL; |
| 2251 | #if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
| 2252 | ecp_drbg_context drbg_ctx; |
| 2253 | |
| 2254 | ecp_drbg_init( &drbg_ctx ); |
| 2255 | #endif |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2256 | |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 2257 | ECP_RS_ENTER( rsm ); |
Manuel Pégourié-Gonnard | 510d5ca | 2017-03-08 11:41:47 +0100 | [diff] [blame] | 2258 | |
Manuel Pégourié-Gonnard | f2a9fcf | 2020-06-03 12:11:56 +0200 | [diff] [blame] | 2259 | #if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
| 2260 | if( f_rng == NULL ) |
| 2261 | { |
Manuel Pégourié-Gonnard | 53fb66d | 2020-06-04 09:43:14 +0200 | [diff] [blame] | 2262 | /* Adjust pointers */ |
Manuel Pégourié-Gonnard | f2a9fcf | 2020-06-03 12:11:56 +0200 | [diff] [blame] | 2263 | f_rng = &ecp_drbg_random; |
Manuel Pégourié-Gonnard | 53fb66d | 2020-06-04 09:43:14 +0200 | [diff] [blame] | 2264 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
| 2265 | if( rs_ctx != NULL && rs_ctx->rsm != NULL ) |
| 2266 | p_rng = &rs_ctx->rsm->drbg_ctx; |
| 2267 | else |
| 2268 | #endif |
| 2269 | p_rng = &drbg_ctx; |
| 2270 | |
| 2271 | /* Initialize internal DRBG if necessary */ |
| 2272 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
| 2273 | if( rs_ctx == NULL || rs_ctx->rsm == NULL || |
| 2274 | rs_ctx->rsm->drbg_seeded == 0 ) |
| 2275 | #endif |
| 2276 | { |
Manuel Pégourié-Gonnard | 4539a45 | 2020-06-18 12:27:56 +0200 | [diff] [blame] | 2277 | const size_t m_len = ( grp->nbits + 7 ) / 8; |
| 2278 | MBEDTLS_MPI_CHK( ecp_drbg_seed( p_rng, m, m_len ) ); |
Manuel Pégourié-Gonnard | 53fb66d | 2020-06-04 09:43:14 +0200 | [diff] [blame] | 2279 | } |
| 2280 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
| 2281 | if( rs_ctx != NULL && rs_ctx->rsm != NULL ) |
| 2282 | rs_ctx->rsm->drbg_seeded = 1; |
| 2283 | #endif |
Manuel Pégourié-Gonnard | f2a9fcf | 2020-06-03 12:11:56 +0200 | [diff] [blame] | 2284 | } |
| 2285 | #endif /* !MBEDTLS_ECP_NO_INTERNAL_RNG */ |
| 2286 | |
Manuel Pégourié-Gonnard | 22be635 | 2017-03-09 13:02:35 +0100 | [diff] [blame] | 2287 | /* Is P the base point ? */ |
| 2288 | #if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1 |
| 2289 | p_eq_g = ( mbedtls_mpi_cmp_mpi( &P->Y, &grp->G.Y ) == 0 && |
| 2290 | mbedtls_mpi_cmp_mpi( &P->X, &grp->G.X ) == 0 ); |
Manuel Pégourié-Gonnard | 196d133 | 2017-08-28 13:14:27 +0200 | [diff] [blame] | 2291 | #else |
| 2292 | p_eq_g = 0; |
Manuel Pégourié-Gonnard | 22be635 | 2017-03-09 13:02:35 +0100 | [diff] [blame] | 2293 | #endif |
| 2294 | |
Manuel Pégourié-Gonnard | 391f441 | 2017-03-13 12:26:21 +0100 | [diff] [blame] | 2295 | /* Pick window size and deduce related sizes */ |
Manuel Pégourié-Gonnard | 4b2336d | 2017-03-09 13:23:50 +0100 | [diff] [blame] | 2296 | w = ecp_pick_window_size( grp, p_eq_g ); |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 2297 | T_size = 1U << ( w - 1 ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2298 | d = ( grp->nbits + w - 1 ) / w; |
| 2299 | |
Manuel Pégourié-Gonnard | 085b1df | 2017-03-16 16:56:04 +0100 | [diff] [blame] | 2300 | /* Pre-computed table: do we have it already for the base point? */ |
| 2301 | if( p_eq_g && grp->T != NULL ) |
| 2302 | { |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 2303 | /* second pointer to the same table, will be deleted on exit */ |
Manuel Pégourié-Gonnard | 085b1df | 2017-03-16 16:56:04 +0100 | [diff] [blame] | 2304 | T = grp->T; |
| 2305 | T_ok = 1; |
| 2306 | } |
Manuel Pégourié-Gonnard | 11556e2 | 2017-08-24 13:41:19 +0200 | [diff] [blame] | 2307 | else |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2308 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 085b1df | 2017-03-16 16:56:04 +0100 | [diff] [blame] | 2309 | /* Pre-computed table: do we have one in progress? complete? */ |
Manuel Pégourié-Gonnard | 11556e2 | 2017-08-24 13:41:19 +0200 | [diff] [blame] | 2310 | if( rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->T != NULL ) |
Manuel Pégourié-Gonnard | c9c0aa6 | 2017-03-16 14:53:26 +0100 | [diff] [blame] | 2311 | { |
Manuel Pégourié-Gonnard | 45fd016 | 2017-03-22 08:24:42 +0100 | [diff] [blame] | 2312 | /* transfer ownership of T from rsm to local function */ |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 2313 | T = rs_ctx->rsm->T; |
| 2314 | rs_ctx->rsm->T = NULL; |
| 2315 | rs_ctx->rsm->T_size = 0; |
Manuel Pégourié-Gonnard | 085b1df | 2017-03-16 16:56:04 +0100 | [diff] [blame] | 2316 | |
Manuel Pégourié-Gonnard | b25cb60 | 2018-10-16 11:48:09 +0200 | [diff] [blame] | 2317 | /* This effectively jumps to the call to mul_comb_after_precomp() */ |
Manuel Pégourié-Gonnard | 11556e2 | 2017-08-24 13:41:19 +0200 | [diff] [blame] | 2318 | T_ok = rs_ctx->rsm->state >= ecp_rsm_comb_core; |
Manuel Pégourié-Gonnard | c9c0aa6 | 2017-03-16 14:53:26 +0100 | [diff] [blame] | 2319 | } |
Manuel Pégourié-Gonnard | 11556e2 | 2017-08-24 13:41:19 +0200 | [diff] [blame] | 2320 | else |
Manuel Pégourié-Gonnard | c9c0aa6 | 2017-03-16 14:53:26 +0100 | [diff] [blame] | 2321 | #endif |
Manuel Pégourié-Gonnard | 085b1df | 2017-03-16 16:56:04 +0100 | [diff] [blame] | 2322 | /* Allocate table if we didn't have any */ |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2323 | { |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 2324 | T = mbedtls_calloc( T_size, sizeof( mbedtls_ecp_point ) ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2325 | if( T == NULL ) |
| 2326 | { |
Manuel Pégourié-Gonnard | 6a8ca33 | 2015-05-28 09:33:39 +0200 | [diff] [blame] | 2327 | ret = MBEDTLS_ERR_ECP_ALLOC_FAILED; |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2328 | goto cleanup; |
| 2329 | } |
Manuel Pégourié-Gonnard | 5bd38b1 | 2017-08-23 16:55:59 +0200 | [diff] [blame] | 2330 | |
| 2331 | for( i = 0; i < T_size; i++ ) |
| 2332 | mbedtls_ecp_point_init( &T[i] ); |
Manuel Pégourié-Gonnard | 11556e2 | 2017-08-24 13:41:19 +0200 | [diff] [blame] | 2333 | |
| 2334 | T_ok = 0; |
Manuel Pégourié-Gonnard | 085b1df | 2017-03-16 16:56:04 +0100 | [diff] [blame] | 2335 | } |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2336 | |
Manuel Pégourié-Gonnard | 085b1df | 2017-03-16 16:56:04 +0100 | [diff] [blame] | 2337 | /* Compute table (or finish computing it) if not done already */ |
| 2338 | if( !T_ok ) |
| 2339 | { |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 2340 | MBEDTLS_MPI_CHK( ecp_precompute_comb( grp, T, P, w, d, rs_ctx ) ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2341 | |
| 2342 | if( p_eq_g ) |
| 2343 | { |
Manuel Pégourié-Gonnard | 7037e22 | 2017-08-23 14:30:36 +0200 | [diff] [blame] | 2344 | /* almost transfer ownership of T to the group, but keep a copy of |
Manuel Pégourié-Gonnard | ee68cff | 2018-10-15 15:27:49 +0200 | [diff] [blame] | 2345 | * the pointer to use for calling the next function more easily */ |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2346 | grp->T = T; |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 2347 | grp->T_size = T_size; |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2348 | } |
| 2349 | } |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2350 | |
Manuel Pégourié-Gonnard | 391f441 | 2017-03-13 12:26:21 +0100 | [diff] [blame] | 2351 | /* Actual comb multiplication using precomputed points */ |
| 2352 | MBEDTLS_MPI_CHK( ecp_mul_comb_after_precomp( grp, R, m, |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 2353 | T, T_size, w, d, |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 2354 | f_rng, p_rng, rs_ctx ) ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2355 | |
| 2356 | cleanup: |
| 2357 | |
Manuel Pégourié-Gonnard | f2a9fcf | 2020-06-03 12:11:56 +0200 | [diff] [blame] | 2358 | #if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
| 2359 | ecp_drbg_free( &drbg_ctx ); |
| 2360 | #endif |
| 2361 | |
Manuel Pégourié-Gonnard | 07bf6f5 | 2017-03-16 17:21:38 +0100 | [diff] [blame] | 2362 | /* does T belong to the group? */ |
| 2363 | if( T == grp->T ) |
| 2364 | T = NULL; |
| 2365 | |
| 2366 | /* does T belong to the restart context? */ |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2367 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 2368 | if( rs_ctx != NULL && rs_ctx->rsm != NULL && ret == MBEDTLS_ERR_ECP_IN_PROGRESS && T != NULL ) |
Manuel Pégourié-Gonnard | c9c0aa6 | 2017-03-16 14:53:26 +0100 | [diff] [blame] | 2369 | { |
Manuel Pégourié-Gonnard | 45fd016 | 2017-03-22 08:24:42 +0100 | [diff] [blame] | 2370 | /* transfer ownership of T from local function to rsm */ |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 2371 | rs_ctx->rsm->T_size = T_size; |
Manuel Pégourié-Gonnard | 3cade22 | 2017-04-20 09:31:00 +0200 | [diff] [blame] | 2372 | rs_ctx->rsm->T = T; |
Manuel Pégourié-Gonnard | c9c0aa6 | 2017-03-16 14:53:26 +0100 | [diff] [blame] | 2373 | T = NULL; |
| 2374 | } |
| 2375 | #endif |
| 2376 | |
Manuel Pégourié-Gonnard | 07bf6f5 | 2017-03-16 17:21:38 +0100 | [diff] [blame] | 2377 | /* did T belong to us? then let's destroy it! */ |
| 2378 | if( T != NULL ) |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2379 | { |
Manuel Pégourié-Gonnard | 92cceb2 | 2017-08-23 16:27:29 +0200 | [diff] [blame] | 2380 | for( i = 0; i < T_size; i++ ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2381 | mbedtls_ecp_point_free( &T[i] ); |
| 2382 | mbedtls_free( T ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2383 | } |
| 2384 | |
Manuel Pégourié-Gonnard | 2fad7ae | 2017-03-14 13:13:13 +0100 | [diff] [blame] | 2385 | /* don't free R while in progress in case R == P */ |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2386 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 2fad7ae | 2017-03-14 13:13:13 +0100 | [diff] [blame] | 2387 | if( ret != MBEDTLS_ERR_ECP_IN_PROGRESS ) |
| 2388 | #endif |
Manuel Pégourié-Gonnard | 07bf6f5 | 2017-03-16 17:21:38 +0100 | [diff] [blame] | 2389 | /* prevent caller from using invalid value */ |
Manuel Pégourié-Gonnard | aade42f | 2013-11-21 19:19:54 +0100 | [diff] [blame] | 2390 | if( ret != 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2391 | mbedtls_ecp_point_free( R ); |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2392 | |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 2393 | ECP_RS_LEAVE( rsm ); |
Manuel Pégourié-Gonnard | 77af79a | 2017-03-14 10:58:00 +0100 | [diff] [blame] | 2394 | |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2395 | return( ret ); |
| 2396 | } |
| 2397 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2398 | #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ |
Manuel Pégourié-Gonnard | 7c94d8b | 2013-12-04 23:15:46 +0100 | [diff] [blame] | 2399 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2400 | #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) |
Manuel Pégourié-Gonnard | 7c94d8b | 2013-12-04 23:15:46 +0100 | [diff] [blame] | 2401 | /* |
| 2402 | * For Montgomery curves, we do all the internal arithmetic in projective |
| 2403 | * coordinates. Import/export of points uses only the x coordinates, which is |
| 2404 | * internaly represented as X / Z. |
| 2405 | * |
| 2406 | * For scalar multiplication, we'll use a Montgomery ladder. |
| 2407 | */ |
| 2408 | |
Manuel Pégourié-Gonnard | d1c1ba9 | 2013-11-16 15:50:12 +0100 | [diff] [blame] | 2409 | /* |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2410 | * Normalize Montgomery x/z coordinates: X = X/Z, Z = 1 |
| 2411 | * Cost: 1M + 1I |
| 2412 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2413 | static int ecp_normalize_mxz( const mbedtls_ecp_group *grp, mbedtls_ecp_point *P ) |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2414 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 2415 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2416 | |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 2417 | #if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT) |
Manuel Pégourié-Gonnard | ebac5d3 | 2017-08-23 16:23:36 +0200 | [diff] [blame] | 2418 | if( mbedtls_internal_ecp_grp_capable( grp ) ) |
| 2419 | return( mbedtls_internal_ecp_normalize_mxz( grp, P ) ); |
Janos Follath | 372697b | 2016-10-28 16:53:11 +0100 | [diff] [blame] | 2420 | #endif /* MBEDTLS_ECP_NORMALIZE_MXZ_ALT */ |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 2421 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2422 | MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &P->Z, &P->Z, &grp->P ) ); |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 2423 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &P->X, &P->X, &P->Z ) ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2424 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &P->Z, 1 ) ); |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2425 | |
| 2426 | cleanup: |
| 2427 | return( ret ); |
| 2428 | } |
| 2429 | |
| 2430 | /* |
Manuel Pégourié-Gonnard | 3afa07f | 2013-12-03 13:28:21 +0100 | [diff] [blame] | 2431 | * Randomize projective x/z coordinates: |
| 2432 | * (X, Z) -> (l X, l Z) for random l |
| 2433 | * This is sort of the reverse operation of ecp_normalize_mxz(). |
| 2434 | * |
| 2435 | * This countermeasure was first suggested in [2]. |
| 2436 | * Cost: 2M |
| 2437 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2438 | static int ecp_randomize_mxz( const mbedtls_ecp_group *grp, mbedtls_ecp_point *P, |
Manuel Pégourié-Gonnard | 3afa07f | 2013-12-03 13:28:21 +0100 | [diff] [blame] | 2439 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) |
| 2440 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 2441 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2442 | mbedtls_mpi l; |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 2443 | size_t p_size; |
Manuel Pégourié-Gonnard | 3afa07f | 2013-12-03 13:28:21 +0100 | [diff] [blame] | 2444 | int count = 0; |
| 2445 | |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 2446 | #if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT) |
Manuel Pégourié-Gonnard | ebac5d3 | 2017-08-23 16:23:36 +0200 | [diff] [blame] | 2447 | if( mbedtls_internal_ecp_grp_capable( grp ) ) |
| 2448 | return( mbedtls_internal_ecp_randomize_mxz( grp, P, f_rng, p_rng ); |
Janos Follath | 372697b | 2016-10-28 16:53:11 +0100 | [diff] [blame] | 2449 | #endif /* MBEDTLS_ECP_RANDOMIZE_MXZ_ALT */ |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 2450 | |
| 2451 | p_size = ( grp->pbits + 7 ) / 8; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2452 | mbedtls_mpi_init( &l ); |
Manuel Pégourié-Gonnard | 3afa07f | 2013-12-03 13:28:21 +0100 | [diff] [blame] | 2453 | |
| 2454 | /* Generate l such that 1 < l < p */ |
| 2455 | do |
| 2456 | { |
Ron Eldor | ca6ff58 | 2017-01-12 14:50:50 +0200 | [diff] [blame] | 2457 | MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &l, p_size, f_rng, p_rng ) ); |
Manuel Pégourié-Gonnard | 3afa07f | 2013-12-03 13:28:21 +0100 | [diff] [blame] | 2458 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2459 | while( mbedtls_mpi_cmp_mpi( &l, &grp->P ) >= 0 ) |
| 2460 | MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, 1 ) ); |
Manuel Pégourié-Gonnard | 3afa07f | 2013-12-03 13:28:21 +0100 | [diff] [blame] | 2461 | |
| 2462 | if( count++ > 10 ) |
Jonas | 6692a06 | 2020-05-08 16:57:18 +0900 | [diff] [blame] | 2463 | { |
| 2464 | ret = MBEDTLS_ERR_ECP_RANDOM_FAILED; |
| 2465 | goto cleanup; |
| 2466 | } |
Manuel Pégourié-Gonnard | 3afa07f | 2013-12-03 13:28:21 +0100 | [diff] [blame] | 2467 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2468 | while( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 ); |
Manuel Pégourié-Gonnard | 3afa07f | 2013-12-03 13:28:21 +0100 | [diff] [blame] | 2469 | |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 2470 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &P->X, &P->X, &l ) ); |
| 2471 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &P->Z, &P->Z, &l ) ); |
Manuel Pégourié-Gonnard | 3afa07f | 2013-12-03 13:28:21 +0100 | [diff] [blame] | 2472 | |
| 2473 | cleanup: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2474 | mbedtls_mpi_free( &l ); |
Manuel Pégourié-Gonnard | 3afa07f | 2013-12-03 13:28:21 +0100 | [diff] [blame] | 2475 | |
| 2476 | return( ret ); |
| 2477 | } |
| 2478 | |
| 2479 | /* |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2480 | * Double-and-add: R = 2P, S = P + Q, with d = X(P - Q), |
| 2481 | * for Montgomery curves in x/z coordinates. |
| 2482 | * |
| 2483 | * http://www.hyperelliptic.org/EFD/g1p/auto-code/montgom/xz/ladder/mladd-1987-m.op3 |
| 2484 | * with |
| 2485 | * d = X1 |
| 2486 | * P = (X2, Z2) |
| 2487 | * Q = (X3, Z3) |
| 2488 | * R = (X4, Z4) |
| 2489 | * S = (X5, Z5) |
| 2490 | * and eliminating temporary variables tO, ..., t4. |
| 2491 | * |
| 2492 | * Cost: 5M + 4S |
| 2493 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2494 | static int ecp_double_add_mxz( const mbedtls_ecp_group *grp, |
| 2495 | mbedtls_ecp_point *R, mbedtls_ecp_point *S, |
| 2496 | const mbedtls_ecp_point *P, const mbedtls_ecp_point *Q, |
| 2497 | const mbedtls_mpi *d ) |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2498 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 2499 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2500 | mbedtls_mpi A, AA, B, BB, E, C, D, DA, CB; |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2501 | |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 2502 | #if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) |
Manuel Pégourié-Gonnard | ebac5d3 | 2017-08-23 16:23:36 +0200 | [diff] [blame] | 2503 | if( mbedtls_internal_ecp_grp_capable( grp ) ) |
| 2504 | return( mbedtls_internal_ecp_double_add_mxz( grp, R, S, P, Q, d ) ); |
Janos Follath | 372697b | 2016-10-28 16:53:11 +0100 | [diff] [blame] | 2505 | #endif /* MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT */ |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 2506 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2507 | mbedtls_mpi_init( &A ); mbedtls_mpi_init( &AA ); mbedtls_mpi_init( &B ); |
| 2508 | mbedtls_mpi_init( &BB ); mbedtls_mpi_init( &E ); mbedtls_mpi_init( &C ); |
| 2509 | mbedtls_mpi_init( &D ); mbedtls_mpi_init( &DA ); mbedtls_mpi_init( &CB ); |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2510 | |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 2511 | MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &A, &P->X, &P->Z ) ); |
| 2512 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &AA, &A, &A ) ); |
| 2513 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &B, &P->X, &P->Z ) ); |
| 2514 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &BB, &B, &B ) ); |
| 2515 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &E, &AA, &BB ) ); |
| 2516 | MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &C, &Q->X, &Q->Z ) ); |
| 2517 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &D, &Q->X, &Q->Z ) ); |
| 2518 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &DA, &D, &A ) ); |
| 2519 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &CB, &C, &B ) ); |
Aurelien Jarno | 66deb38 | 2020-04-20 21:36:48 +0200 | [diff] [blame] | 2520 | MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &S->X, &DA, &CB ) ); |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 2521 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S->X, &S->X, &S->X ) ); |
| 2522 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mod( grp, &S->Z, &DA, &CB ) ); |
| 2523 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S->Z, &S->Z, &S->Z ) ); |
| 2524 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &S->Z, d, &S->Z ) ); |
| 2525 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &R->X, &AA, &BB ) ); |
| 2526 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &R->Z, &grp->A, &E ) ); |
| 2527 | MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &R->Z, &BB, &R->Z ) ); |
| 2528 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &R->Z, &E, &R->Z ) ); |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2529 | |
| 2530 | cleanup: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2531 | mbedtls_mpi_free( &A ); mbedtls_mpi_free( &AA ); mbedtls_mpi_free( &B ); |
| 2532 | mbedtls_mpi_free( &BB ); mbedtls_mpi_free( &E ); mbedtls_mpi_free( &C ); |
| 2533 | mbedtls_mpi_free( &D ); mbedtls_mpi_free( &DA ); mbedtls_mpi_free( &CB ); |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2534 | |
| 2535 | return( ret ); |
| 2536 | } |
| 2537 | |
| 2538 | /* |
Manuel Pégourié-Gonnard | a0179b8 | 2013-12-04 11:49:20 +0100 | [diff] [blame] | 2539 | * Multiplication with Montgomery ladder in x/z coordinates, |
| 2540 | * for curves in Montgomery form |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2541 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2542 | static int ecp_mul_mxz( mbedtls_ecp_group *grp, mbedtls_ecp_point *R, |
| 2543 | const mbedtls_mpi *m, const mbedtls_ecp_point *P, |
Manuel Pégourié-Gonnard | a0179b8 | 2013-12-04 11:49:20 +0100 | [diff] [blame] | 2544 | int (*f_rng)(void *, unsigned char *, size_t), |
| 2545 | void *p_rng ) |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2546 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 2547 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2548 | size_t i; |
Manuel Pégourié-Gonnard | b6f45a6 | 2013-12-04 21:54:36 +0100 | [diff] [blame] | 2549 | unsigned char b; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2550 | mbedtls_ecp_point RP; |
| 2551 | mbedtls_mpi PX; |
Manuel Pégourié-Gonnard | f2a9fcf | 2020-06-03 12:11:56 +0200 | [diff] [blame] | 2552 | #if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
| 2553 | ecp_drbg_context drbg_ctx; |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2554 | |
Manuel Pégourié-Gonnard | f2a9fcf | 2020-06-03 12:11:56 +0200 | [diff] [blame] | 2555 | ecp_drbg_init( &drbg_ctx ); |
| 2556 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2557 | mbedtls_ecp_point_init( &RP ); mbedtls_mpi_init( &PX ); |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2558 | |
Manuel Pégourié-Gonnard | f2a9fcf | 2020-06-03 12:11:56 +0200 | [diff] [blame] | 2559 | #if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
| 2560 | if( f_rng == NULL ) |
| 2561 | { |
Manuel Pégourié-Gonnard | 4539a45 | 2020-06-18 12:27:56 +0200 | [diff] [blame] | 2562 | const size_t m_len = ( grp->nbits + 7 ) / 8; |
| 2563 | MBEDTLS_MPI_CHK( ecp_drbg_seed( &drbg_ctx, m, m_len ) ); |
Manuel Pégourié-Gonnard | f2a9fcf | 2020-06-03 12:11:56 +0200 | [diff] [blame] | 2564 | f_rng = &ecp_drbg_random; |
| 2565 | p_rng = &drbg_ctx; |
| 2566 | } |
| 2567 | #endif /* !MBEDTLS_ECP_NO_INTERNAL_RNG */ |
| 2568 | |
Manuel Pégourié-Gonnard | 3afa07f | 2013-12-03 13:28:21 +0100 | [diff] [blame] | 2569 | /* Save PX and read from P before writing to R, in case P == R */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2570 | MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &PX, &P->X ) ); |
| 2571 | MBEDTLS_MPI_CHK( mbedtls_ecp_copy( &RP, P ) ); |
Manuel Pégourié-Gonnard | 357ff65 | 2013-12-04 18:39:17 +0100 | [diff] [blame] | 2572 | |
| 2573 | /* Set R to zero in modified x/z coordinates */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2574 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->X, 1 ) ); |
| 2575 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &R->Z, 0 ) ); |
| 2576 | mbedtls_mpi_free( &R->Y ); |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2577 | |
Manuel Pégourié-Gonnard | 93f41db | 2013-12-05 10:48:42 +0100 | [diff] [blame] | 2578 | /* RP.X might be sligtly larger than P, so reduce it */ |
| 2579 | MOD_ADD( RP.X ); |
| 2580 | |
Manuel Pégourié-Gonnard | 3afa07f | 2013-12-03 13:28:21 +0100 | [diff] [blame] | 2581 | /* Randomize coordinates of the starting point */ |
Manuel Pégourié-Gonnard | 22b1de3 | 2020-06-04 10:43:29 +0200 | [diff] [blame] | 2582 | #if defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
Manuel Pégourié-Gonnard | 357ff65 | 2013-12-04 18:39:17 +0100 | [diff] [blame] | 2583 | if( f_rng != NULL ) |
Manuel Pégourié-Gonnard | 22b1de3 | 2020-06-04 10:43:29 +0200 | [diff] [blame] | 2584 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2585 | MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, &RP, f_rng, p_rng ) ); |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2586 | |
Manuel Pégourié-Gonnard | b6f45a6 | 2013-12-04 21:54:36 +0100 | [diff] [blame] | 2587 | /* Loop invariant: R = result so far, RP = R + P */ |
Manuel Pégourié-Gonnard | c0696c2 | 2015-06-18 16:47:17 +0200 | [diff] [blame] | 2588 | i = mbedtls_mpi_bitlen( m ); /* one past the (zero-based) most significant bit */ |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2589 | while( i-- > 0 ) |
| 2590 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2591 | b = mbedtls_mpi_get_bit( m, i ); |
Manuel Pégourié-Gonnard | b6f45a6 | 2013-12-04 21:54:36 +0100 | [diff] [blame] | 2592 | /* |
| 2593 | * if (b) R = 2R + P else R = 2R, |
| 2594 | * which is: |
| 2595 | * if (b) double_add( RP, R, RP, R ) |
| 2596 | * else double_add( R, RP, R, RP ) |
| 2597 | * but using safe conditional swaps to avoid leaks |
| 2598 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2599 | MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->X, &RP.X, b ) ); |
| 2600 | MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->Z, &RP.Z, b ) ); |
| 2601 | MBEDTLS_MPI_CHK( ecp_double_add_mxz( grp, R, &RP, R, &RP, &PX ) ); |
| 2602 | MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->X, &RP.X, b ) ); |
| 2603 | MBEDTLS_MPI_CHK( mbedtls_mpi_safe_cond_swap( &R->Z, &RP.Z, b ) ); |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2604 | } |
| 2605 | |
Manuel Pégourié-Gonnard | a4aa89b | 2020-03-25 12:41:29 +0100 | [diff] [blame] | 2606 | /* |
| 2607 | * Knowledge of the projective coordinates may leak the last few bits of the |
| 2608 | * scalar [1], and since our MPI implementation isn't constant-flow, |
| 2609 | * inversion (used for coordinate normalization) may leak the full value |
| 2610 | * of its input via side-channels [2]. |
| 2611 | * |
| 2612 | * [1] https://eprint.iacr.org/2003/191 |
| 2613 | * [2] https://eprint.iacr.org/2020/055 |
| 2614 | * |
| 2615 | * Avoid the leak by randomizing coordinates before we normalize them. |
| 2616 | */ |
Manuel Pégourié-Gonnard | 22b1de3 | 2020-06-04 10:43:29 +0200 | [diff] [blame] | 2617 | #if defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
Manuel Pégourié-Gonnard | a4aa89b | 2020-03-25 12:41:29 +0100 | [diff] [blame] | 2618 | if( f_rng != NULL ) |
Manuel Pégourié-Gonnard | 22b1de3 | 2020-06-04 10:43:29 +0200 | [diff] [blame] | 2619 | #endif |
Manuel Pégourié-Gonnard | a4aa89b | 2020-03-25 12:41:29 +0100 | [diff] [blame] | 2620 | MBEDTLS_MPI_CHK( ecp_randomize_mxz( grp, R, f_rng, p_rng ) ); |
| 2621 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2622 | MBEDTLS_MPI_CHK( ecp_normalize_mxz( grp, R ) ); |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2623 | |
| 2624 | cleanup: |
Manuel Pégourié-Gonnard | f2a9fcf | 2020-06-03 12:11:56 +0200 | [diff] [blame] | 2625 | #if !defined(MBEDTLS_ECP_NO_INTERNAL_RNG) |
| 2626 | ecp_drbg_free( &drbg_ctx ); |
| 2627 | #endif |
| 2628 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2629 | mbedtls_ecp_point_free( &RP ); mbedtls_mpi_free( &PX ); |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2630 | |
| 2631 | return( ret ); |
| 2632 | } |
| 2633 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2634 | #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ |
Manuel Pégourié-Gonnard | 7c94d8b | 2013-12-04 23:15:46 +0100 | [diff] [blame] | 2635 | |
Manuel Pégourié-Gonnard | d9ea82e7 | 2013-12-03 12:02:28 +0100 | [diff] [blame] | 2636 | /* |
Manuel Pégourié-Gonnard | 884569c | 2017-04-20 10:10:59 +0200 | [diff] [blame] | 2637 | * Restartable multiplication R = m * P |
Manuel Pégourié-Gonnard | a0179b8 | 2013-12-04 11:49:20 +0100 | [diff] [blame] | 2638 | */ |
Manuel Pégourié-Gonnard | 884569c | 2017-04-20 10:10:59 +0200 | [diff] [blame] | 2639 | int mbedtls_ecp_mul_restartable( mbedtls_ecp_group *grp, mbedtls_ecp_point *R, |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2640 | const mbedtls_mpi *m, const mbedtls_ecp_point *P, |
Manuel Pégourié-Gonnard | 884569c | 2017-04-20 10:10:59 +0200 | [diff] [blame] | 2641 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, |
| 2642 | mbedtls_ecp_restart_ctx *rs_ctx ) |
Manuel Pégourié-Gonnard | a0179b8 | 2013-12-04 11:49:20 +0100 | [diff] [blame] | 2643 | { |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 2644 | int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; |
Janos Follath | c44ab97 | 2016-11-18 16:38:23 +0000 | [diff] [blame] | 2645 | #if defined(MBEDTLS_ECP_INTERNAL_ALT) |
| 2646 | char is_grp_capable = 0; |
| 2647 | #endif |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 2648 | ECP_VALIDATE_RET( grp != NULL ); |
| 2649 | ECP_VALIDATE_RET( R != NULL ); |
| 2650 | ECP_VALIDATE_RET( m != NULL ); |
| 2651 | ECP_VALIDATE_RET( P != NULL ); |
Manuel Pégourié-Gonnard | a0179b8 | 2013-12-04 11:49:20 +0100 | [diff] [blame] | 2652 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2653 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 3a25612 | 2017-04-20 11:20:26 +0200 | [diff] [blame] | 2654 | /* reset ops count for this call if top-level */ |
| 2655 | if( rs_ctx != NULL && rs_ctx->depth++ == 0 ) |
| 2656 | rs_ctx->ops_done = 0; |
Gilles Peskine | 5997005 | 2019-02-28 13:12:06 +0100 | [diff] [blame] | 2657 | #else |
| 2658 | (void) rs_ctx; |
Manuel Pégourié-Gonnard | 3a25612 | 2017-04-20 11:20:26 +0200 | [diff] [blame] | 2659 | #endif |
Manuel Pégourié-Gonnard | a0179b8 | 2013-12-04 11:49:20 +0100 | [diff] [blame] | 2660 | |
Janos Follath | c44ab97 | 2016-11-18 16:38:23 +0000 | [diff] [blame] | 2661 | #if defined(MBEDTLS_ECP_INTERNAL_ALT) |
Manuel Pégourié-Gonnard | ebac5d3 | 2017-08-23 16:23:36 +0200 | [diff] [blame] | 2662 | if( ( is_grp_capable = mbedtls_internal_ecp_grp_capable( grp ) ) ) |
Janos Follath | c44ab97 | 2016-11-18 16:38:23 +0000 | [diff] [blame] | 2663 | MBEDTLS_MPI_CHK( mbedtls_internal_ecp_init( grp ) ); |
Janos Follath | c44ab97 | 2016-11-18 16:38:23 +0000 | [diff] [blame] | 2664 | #endif /* MBEDTLS_ECP_INTERNAL_ALT */ |
Manuel Pégourié-Gonnard | 3a25612 | 2017-04-20 11:20:26 +0200 | [diff] [blame] | 2665 | |
Manuel Pégourié-Gonnard | 95aedfe | 2017-08-24 13:47:04 +0200 | [diff] [blame] | 2666 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | a08cd1a | 2017-04-20 11:29:43 +0200 | [diff] [blame] | 2667 | /* skip argument check when restarting */ |
Manuel Pégourié-Gonnard | 95aedfe | 2017-08-24 13:47:04 +0200 | [diff] [blame] | 2668 | if( rs_ctx == NULL || rs_ctx->rsm == NULL ) |
Manuel Pégourié-Gonnard | a08cd1a | 2017-04-20 11:29:43 +0200 | [diff] [blame] | 2669 | #endif |
| 2670 | { |
Manuel Pégourié-Gonnard | 5314f23 | 2017-04-21 12:36:59 +0200 | [diff] [blame] | 2671 | /* check_privkey is free */ |
| 2672 | MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_CHK ); |
| 2673 | |
Manuel Pégourié-Gonnard | a08cd1a | 2017-04-20 11:29:43 +0200 | [diff] [blame] | 2674 | /* Common sanity checks */ |
| 2675 | MBEDTLS_MPI_CHK( mbedtls_ecp_check_privkey( grp, m ) ); |
| 2676 | MBEDTLS_MPI_CHK( mbedtls_ecp_check_pubkey( grp, P ) ); |
Manuel Pégourié-Gonnard | a08cd1a | 2017-04-20 11:29:43 +0200 | [diff] [blame] | 2677 | } |
Manuel Pégourié-Gonnard | 3a25612 | 2017-04-20 11:20:26 +0200 | [diff] [blame] | 2678 | |
| 2679 | ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2680 | #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 2681 | if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY ) |
Manuel Pégourié-Gonnard | 3a25612 | 2017-04-20 11:20:26 +0200 | [diff] [blame] | 2682 | MBEDTLS_MPI_CHK( ecp_mul_mxz( grp, R, m, P, f_rng, p_rng ) ); |
Janos Follath | 430d337 | 2016-11-03 14:25:37 +0000 | [diff] [blame] | 2683 | #endif |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2684 | #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 2685 | if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS ) |
Manuel Pégourié-Gonnard | 3a25612 | 2017-04-20 11:20:26 +0200 | [diff] [blame] | 2686 | MBEDTLS_MPI_CHK( ecp_mul_comb( grp, R, m, P, f_rng, p_rng, rs_ctx ) ); |
Janos Follath | 430d337 | 2016-11-03 14:25:37 +0000 | [diff] [blame] | 2687 | #endif |
Manuel Pégourié-Gonnard | 3a25612 | 2017-04-20 11:20:26 +0200 | [diff] [blame] | 2688 | |
Janos Follath | 6c8ccd5 | 2016-11-29 15:37:09 +0000 | [diff] [blame] | 2689 | cleanup: |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 2690 | |
Manuel Pégourié-Gonnard | 3a25612 | 2017-04-20 11:20:26 +0200 | [diff] [blame] | 2691 | #if defined(MBEDTLS_ECP_INTERNAL_ALT) |
Manuel Pégourié-Gonnard | ebac5d3 | 2017-08-23 16:23:36 +0200 | [diff] [blame] | 2692 | if( is_grp_capable ) |
Janos Follath | c44ab97 | 2016-11-18 16:38:23 +0000 | [diff] [blame] | 2693 | mbedtls_internal_ecp_free( grp ); |
Janos Follath | c44ab97 | 2016-11-18 16:38:23 +0000 | [diff] [blame] | 2694 | #endif /* MBEDTLS_ECP_INTERNAL_ALT */ |
Manuel Pégourié-Gonnard | 3a25612 | 2017-04-20 11:20:26 +0200 | [diff] [blame] | 2695 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2696 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 3a25612 | 2017-04-20 11:20:26 +0200 | [diff] [blame] | 2697 | if( rs_ctx != NULL ) |
| 2698 | rs_ctx->depth--; |
| 2699 | #endif |
| 2700 | |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 2701 | return( ret ); |
Manuel Pégourié-Gonnard | a0179b8 | 2013-12-04 11:49:20 +0100 | [diff] [blame] | 2702 | } |
| 2703 | |
Manuel Pégourié-Gonnard | b739a71 | 2017-04-19 10:11:56 +0200 | [diff] [blame] | 2704 | /* |
Manuel Pégourié-Gonnard | 884569c | 2017-04-20 10:10:59 +0200 | [diff] [blame] | 2705 | * Multiplication R = m * P |
Manuel Pégourié-Gonnard | b739a71 | 2017-04-19 10:11:56 +0200 | [diff] [blame] | 2706 | */ |
Manuel Pégourié-Gonnard | 884569c | 2017-04-20 10:10:59 +0200 | [diff] [blame] | 2707 | int mbedtls_ecp_mul( mbedtls_ecp_group *grp, mbedtls_ecp_point *R, |
Manuel Pégourié-Gonnard | b739a71 | 2017-04-19 10:11:56 +0200 | [diff] [blame] | 2708 | const mbedtls_mpi *m, const mbedtls_ecp_point *P, |
Manuel Pégourié-Gonnard | 884569c | 2017-04-20 10:10:59 +0200 | [diff] [blame] | 2709 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) |
Manuel Pégourié-Gonnard | b739a71 | 2017-04-19 10:11:56 +0200 | [diff] [blame] | 2710 | { |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 2711 | ECP_VALIDATE_RET( grp != NULL ); |
| 2712 | ECP_VALIDATE_RET( R != NULL ); |
| 2713 | ECP_VALIDATE_RET( m != NULL ); |
| 2714 | ECP_VALIDATE_RET( P != NULL ); |
Manuel Pégourié-Gonnard | 884569c | 2017-04-20 10:10:59 +0200 | [diff] [blame] | 2715 | return( mbedtls_ecp_mul_restartable( grp, R, m, P, f_rng, p_rng, NULL ) ); |
Manuel Pégourié-Gonnard | b739a71 | 2017-04-19 10:11:56 +0200 | [diff] [blame] | 2716 | } |
Manuel Pégourié-Gonnard | b739a71 | 2017-04-19 10:11:56 +0200 | [diff] [blame] | 2717 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2718 | #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) |
Manuel Pégourié-Gonnard | a0179b8 | 2013-12-04 11:49:20 +0100 | [diff] [blame] | 2719 | /* |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2720 | * Check that an affine point is valid as a public key, |
| 2721 | * short weierstrass curves (SEC1 3.2.3.1) |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2722 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2723 | static int ecp_check_pubkey_sw( const mbedtls_ecp_group *grp, const mbedtls_ecp_point *pt ) |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2724 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 2725 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2726 | mbedtls_mpi YY, RHS; |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2727 | |
Manuel Pégourié-Gonnard | 312d2e8 | 2013-12-04 11:08:01 +0100 | [diff] [blame] | 2728 | /* pt coordinates must be normalized for our checks */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2729 | if( mbedtls_mpi_cmp_int( &pt->X, 0 ) < 0 || |
| 2730 | mbedtls_mpi_cmp_int( &pt->Y, 0 ) < 0 || |
| 2731 | mbedtls_mpi_cmp_mpi( &pt->X, &grp->P ) >= 0 || |
| 2732 | mbedtls_mpi_cmp_mpi( &pt->Y, &grp->P ) >= 0 ) |
| 2733 | return( MBEDTLS_ERR_ECP_INVALID_KEY ); |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2734 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2735 | mbedtls_mpi_init( &YY ); mbedtls_mpi_init( &RHS ); |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2736 | |
| 2737 | /* |
| 2738 | * YY = Y^2 |
Manuel Pégourié-Gonnard | cd7458a | 2013-10-08 13:11:30 +0200 | [diff] [blame] | 2739 | * RHS = X (X^2 + A) + B = X^3 + A X + B |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2740 | */ |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 2741 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &YY, &pt->Y, &pt->Y ) ); |
| 2742 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &RHS, &pt->X, &pt->X ) ); |
Manuel Pégourié-Gonnard | 73cc01d | 2013-12-06 12:41:30 +0100 | [diff] [blame] | 2743 | |
| 2744 | /* Special case for A = -3 */ |
| 2745 | if( grp->A.p == NULL ) |
| 2746 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2747 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &RHS, &RHS, 3 ) ); MOD_SUB( RHS ); |
Manuel Pégourié-Gonnard | 73cc01d | 2013-12-06 12:41:30 +0100 | [diff] [blame] | 2748 | } |
| 2749 | else |
| 2750 | { |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 2751 | MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &RHS, &RHS, &grp->A ) ); |
Manuel Pégourié-Gonnard | 73cc01d | 2013-12-06 12:41:30 +0100 | [diff] [blame] | 2752 | } |
| 2753 | |
Gilles Peskine | 3b3b34f | 2019-07-18 21:08:27 +0200 | [diff] [blame] | 2754 | MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mod( grp, &RHS, &RHS, &pt->X ) ); |
| 2755 | MBEDTLS_MPI_CHK( mbedtls_mpi_add_mod( grp, &RHS, &RHS, &grp->B ) ); |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2756 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2757 | if( mbedtls_mpi_cmp_mpi( &YY, &RHS ) != 0 ) |
| 2758 | ret = MBEDTLS_ERR_ECP_INVALID_KEY; |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2759 | |
| 2760 | cleanup: |
| 2761 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2762 | mbedtls_mpi_free( &YY ); mbedtls_mpi_free( &RHS ); |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2763 | |
| 2764 | return( ret ); |
| 2765 | } |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2766 | #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2767 | |
Gilles Peskine | 9b99a89 | 2018-09-14 18:32:19 +0200 | [diff] [blame] | 2768 | #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) |
Manuel Pégourié-Gonnard | 56cc88a | 2015-05-11 18:40:45 +0200 | [diff] [blame] | 2769 | /* |
Manuel Pégourié-Gonnard | de9f953 | 2015-10-23 15:50:37 +0200 | [diff] [blame] | 2770 | * R = m * P with shortcuts for m == 1 and m == -1 |
| 2771 | * NOT constant-time - ONLY for short Weierstrass! |
| 2772 | */ |
| 2773 | static int mbedtls_ecp_mul_shortcuts( mbedtls_ecp_group *grp, |
| 2774 | mbedtls_ecp_point *R, |
| 2775 | const mbedtls_mpi *m, |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2776 | const mbedtls_ecp_point *P, |
| 2777 | mbedtls_ecp_restart_ctx *rs_ctx ) |
Manuel Pégourié-Gonnard | de9f953 | 2015-10-23 15:50:37 +0200 | [diff] [blame] | 2778 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 2779 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | de9f953 | 2015-10-23 15:50:37 +0200 | [diff] [blame] | 2780 | |
| 2781 | if( mbedtls_mpi_cmp_int( m, 1 ) == 0 ) |
| 2782 | { |
| 2783 | MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, P ) ); |
| 2784 | } |
| 2785 | else if( mbedtls_mpi_cmp_int( m, -1 ) == 0 ) |
| 2786 | { |
| 2787 | MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, P ) ); |
| 2788 | if( mbedtls_mpi_cmp_int( &R->Y, 0 ) != 0 ) |
| 2789 | MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &R->Y, &grp->P, &R->Y ) ); |
| 2790 | } |
| 2791 | else |
| 2792 | { |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2793 | MBEDTLS_MPI_CHK( mbedtls_ecp_mul_restartable( grp, R, m, P, |
| 2794 | NULL, NULL, rs_ctx ) ); |
Manuel Pégourié-Gonnard | de9f953 | 2015-10-23 15:50:37 +0200 | [diff] [blame] | 2795 | } |
| 2796 | |
| 2797 | cleanup: |
| 2798 | return( ret ); |
| 2799 | } |
| 2800 | |
| 2801 | /* |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 2802 | * Restartable linear combination |
Manuel Pégourié-Gonnard | de9f953 | 2015-10-23 15:50:37 +0200 | [diff] [blame] | 2803 | * NOT constant-time |
Manuel Pégourié-Gonnard | 56cc88a | 2015-05-11 18:40:45 +0200 | [diff] [blame] | 2804 | */ |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 2805 | int mbedtls_ecp_muladd_restartable( |
| 2806 | mbedtls_ecp_group *grp, mbedtls_ecp_point *R, |
Manuel Pégourié-Gonnard | 56cc88a | 2015-05-11 18:40:45 +0200 | [diff] [blame] | 2807 | const mbedtls_mpi *m, const mbedtls_ecp_point *P, |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 2808 | const mbedtls_mpi *n, const mbedtls_ecp_point *Q, |
| 2809 | mbedtls_ecp_restart_ctx *rs_ctx ) |
Manuel Pégourié-Gonnard | 56cc88a | 2015-05-11 18:40:45 +0200 | [diff] [blame] | 2810 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 2811 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 56cc88a | 2015-05-11 18:40:45 +0200 | [diff] [blame] | 2812 | mbedtls_ecp_point mP; |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2813 | mbedtls_ecp_point *pmP = &mP; |
| 2814 | mbedtls_ecp_point *pR = R; |
Janos Follath | c44ab97 | 2016-11-18 16:38:23 +0000 | [diff] [blame] | 2815 | #if defined(MBEDTLS_ECP_INTERNAL_ALT) |
| 2816 | char is_grp_capable = 0; |
| 2817 | #endif |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 2818 | ECP_VALIDATE_RET( grp != NULL ); |
| 2819 | ECP_VALIDATE_RET( R != NULL ); |
| 2820 | ECP_VALIDATE_RET( m != NULL ); |
| 2821 | ECP_VALIDATE_RET( P != NULL ); |
| 2822 | ECP_VALIDATE_RET( n != NULL ); |
| 2823 | ECP_VALIDATE_RET( Q != NULL ); |
Manuel Pégourié-Gonnard | 56cc88a | 2015-05-11 18:40:45 +0200 | [diff] [blame] | 2824 | |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 2825 | if( mbedtls_ecp_get_type( grp ) != MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS ) |
Manuel Pégourié-Gonnard | 56cc88a | 2015-05-11 18:40:45 +0200 | [diff] [blame] | 2826 | return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ); |
| 2827 | |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2828 | mbedtls_ecp_point_init( &mP ); |
| 2829 | |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 2830 | ECP_RS_ENTER( ma ); |
| 2831 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2832 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2833 | if( rs_ctx != NULL && rs_ctx->ma != NULL ) |
| 2834 | { |
| 2835 | /* redirect intermediate results to restart context */ |
| 2836 | pmP = &rs_ctx->ma->mP; |
| 2837 | pR = &rs_ctx->ma->R; |
| 2838 | |
| 2839 | /* jump to next operation */ |
| 2840 | if( rs_ctx->ma->state == ecp_rsma_mul2 ) |
| 2841 | goto mul2; |
| 2842 | if( rs_ctx->ma->state == ecp_rsma_add ) |
| 2843 | goto add; |
| 2844 | if( rs_ctx->ma->state == ecp_rsma_norm ) |
| 2845 | goto norm; |
| 2846 | } |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2847 | #endif /* MBEDTLS_ECP_RESTARTABLE */ |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 2848 | |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2849 | MBEDTLS_MPI_CHK( mbedtls_ecp_mul_shortcuts( grp, pmP, m, P, rs_ctx ) ); |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2850 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2851 | if( rs_ctx != NULL && rs_ctx->ma != NULL ) |
Manuel Pégourié-Gonnard | c9efa00 | 2017-08-24 10:25:06 +0200 | [diff] [blame] | 2852 | rs_ctx->ma->state = ecp_rsma_mul2; |
Manuel Pégourié-Gonnard | 56cc88a | 2015-05-11 18:40:45 +0200 | [diff] [blame] | 2853 | |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2854 | mul2: |
| 2855 | #endif |
| 2856 | MBEDTLS_MPI_CHK( mbedtls_ecp_mul_shortcuts( grp, pR, n, Q, rs_ctx ) ); |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 2857 | |
| 2858 | #if defined(MBEDTLS_ECP_INTERNAL_ALT) |
| 2859 | if( ( is_grp_capable = mbedtls_internal_ecp_grp_capable( grp ) ) ) |
| 2860 | MBEDTLS_MPI_CHK( mbedtls_internal_ecp_init( grp ) ); |
| 2861 | #endif /* MBEDTLS_ECP_INTERNAL_ALT */ |
| 2862 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2863 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2864 | if( rs_ctx != NULL && rs_ctx->ma != NULL ) |
Manuel Pégourié-Gonnard | c9efa00 | 2017-08-24 10:25:06 +0200 | [diff] [blame] | 2865 | rs_ctx->ma->state = ecp_rsma_add; |
Manuel Pégourié-Gonnard | 1a7c5ef | 2015-08-13 10:19:09 +0200 | [diff] [blame] | 2866 | |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2867 | add: |
| 2868 | #endif |
Manuel Pégourié-Gonnard | c751148 | 2017-04-20 16:31:00 +0200 | [diff] [blame] | 2869 | MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_ADD ); |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2870 | MBEDTLS_MPI_CHK( ecp_add_mixed( grp, pR, pmP, pR ) ); |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2871 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2872 | if( rs_ctx != NULL && rs_ctx->ma != NULL ) |
Manuel Pégourié-Gonnard | c9efa00 | 2017-08-24 10:25:06 +0200 | [diff] [blame] | 2873 | rs_ctx->ma->state = ecp_rsma_norm; |
Janos Follath | 430d337 | 2016-11-03 14:25:37 +0000 | [diff] [blame] | 2874 | |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2875 | norm: |
| 2876 | #endif |
Manuel Pégourié-Gonnard | c751148 | 2017-04-20 16:31:00 +0200 | [diff] [blame] | 2877 | MBEDTLS_ECP_BUDGET( MBEDTLS_ECP_OPS_INV ); |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2878 | MBEDTLS_MPI_CHK( ecp_normalize_jac( grp, pR ) ); |
| 2879 | |
Manuel Pégourié-Gonnard | 4b9c51e | 2017-04-20 15:50:26 +0200 | [diff] [blame] | 2880 | #if defined(MBEDTLS_ECP_RESTARTABLE) |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2881 | if( rs_ctx != NULL && rs_ctx->ma != NULL ) |
| 2882 | MBEDTLS_MPI_CHK( mbedtls_ecp_copy( R, pR ) ); |
| 2883 | #endif |
Manuel Pégourié-Gonnard | 56cc88a | 2015-05-11 18:40:45 +0200 | [diff] [blame] | 2884 | |
| 2885 | cleanup: |
Janos Follath | c44ab97 | 2016-11-18 16:38:23 +0000 | [diff] [blame] | 2886 | #if defined(MBEDTLS_ECP_INTERNAL_ALT) |
Manuel Pégourié-Gonnard | ebac5d3 | 2017-08-23 16:23:36 +0200 | [diff] [blame] | 2887 | if( is_grp_capable ) |
Janos Follath | c44ab97 | 2016-11-18 16:38:23 +0000 | [diff] [blame] | 2888 | mbedtls_internal_ecp_free( grp ); |
Janos Follath | c44ab97 | 2016-11-18 16:38:23 +0000 | [diff] [blame] | 2889 | #endif /* MBEDTLS_ECP_INTERNAL_ALT */ |
Manuel Pégourié-Gonnard | 1631d63 | 2017-04-20 14:48:56 +0200 | [diff] [blame] | 2890 | |
Manuel Pégourié-Gonnard | 56cc88a | 2015-05-11 18:40:45 +0200 | [diff] [blame] | 2891 | mbedtls_ecp_point_free( &mP ); |
| 2892 | |
Manuel Pégourié-Gonnard | db4a8eb | 2017-08-23 18:18:22 +0200 | [diff] [blame] | 2893 | ECP_RS_LEAVE( ma ); |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 2894 | |
Manuel Pégourié-Gonnard | 56cc88a | 2015-05-11 18:40:45 +0200 | [diff] [blame] | 2895 | return( ret ); |
| 2896 | } |
| 2897 | |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 2898 | /* |
| 2899 | * Linear combination |
| 2900 | * NOT constant-time |
| 2901 | */ |
| 2902 | int mbedtls_ecp_muladd( mbedtls_ecp_group *grp, mbedtls_ecp_point *R, |
| 2903 | const mbedtls_mpi *m, const mbedtls_ecp_point *P, |
| 2904 | const mbedtls_mpi *n, const mbedtls_ecp_point *Q ) |
| 2905 | { |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 2906 | ECP_VALIDATE_RET( grp != NULL ); |
| 2907 | ECP_VALIDATE_RET( R != NULL ); |
| 2908 | ECP_VALIDATE_RET( m != NULL ); |
| 2909 | ECP_VALIDATE_RET( P != NULL ); |
| 2910 | ECP_VALIDATE_RET( n != NULL ); |
| 2911 | ECP_VALIDATE_RET( Q != NULL ); |
Manuel Pégourié-Gonnard | 54dd652 | 2017-04-20 13:36:18 +0200 | [diff] [blame] | 2912 | return( mbedtls_ecp_muladd_restartable( grp, R, m, P, n, Q, NULL ) ); |
| 2913 | } |
Gilles Peskine | 9b99a89 | 2018-09-14 18:32:19 +0200 | [diff] [blame] | 2914 | #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2915 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2916 | #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2917 | /* |
| 2918 | * Check validity of a public key for Montgomery curves with x-only schemes |
| 2919 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2920 | static int ecp_check_pubkey_mx( const mbedtls_ecp_group *grp, const mbedtls_ecp_point *pt ) |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2921 | { |
Manuel Pégourié-Gonnard | 0789433 | 2015-06-23 00:18:41 +0200 | [diff] [blame] | 2922 | /* [Curve25519 p. 5] Just check X is the correct number of bytes */ |
Nicholas Wilson | 08f3ef1 | 2015-11-10 13:10:01 +0000 | [diff] [blame] | 2923 | /* Allow any public value, if it's too big then we'll just reduce it mod p |
| 2924 | * (RFC 7748 sec. 5 para. 3). */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2925 | if( mbedtls_mpi_size( &pt->X ) > ( grp->nbits + 7 ) / 8 ) |
| 2926 | return( MBEDTLS_ERR_ECP_INVALID_KEY ); |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2927 | |
| 2928 | return( 0 ); |
| 2929 | } |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2930 | #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2931 | |
| 2932 | /* |
| 2933 | * Check that a point is valid as a public key |
| 2934 | */ |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 2935 | int mbedtls_ecp_check_pubkey( const mbedtls_ecp_group *grp, |
| 2936 | const mbedtls_ecp_point *pt ) |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2937 | { |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 2938 | ECP_VALIDATE_RET( grp != NULL ); |
| 2939 | ECP_VALIDATE_RET( pt != NULL ); |
| 2940 | |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2941 | /* Must use affine coordinates */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2942 | if( mbedtls_mpi_cmp_int( &pt->Z, 1 ) != 0 ) |
| 2943 | return( MBEDTLS_ERR_ECP_INVALID_KEY ); |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2944 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2945 | #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 2946 | if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY ) |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2947 | return( ecp_check_pubkey_mx( grp, pt ) ); |
| 2948 | #endif |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2949 | #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 2950 | if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS ) |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2951 | return( ecp_check_pubkey_sw( grp, pt ) ); |
| 2952 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2953 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2954 | } |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2955 | |
| 2956 | /* |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2957 | * Check that an mbedtls_mpi is valid as a private key |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2958 | */ |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 2959 | int mbedtls_ecp_check_privkey( const mbedtls_ecp_group *grp, |
| 2960 | const mbedtls_mpi *d ) |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2961 | { |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 2962 | ECP_VALIDATE_RET( grp != NULL ); |
| 2963 | ECP_VALIDATE_RET( d != NULL ); |
| 2964 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2965 | #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 2966 | if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY ) |
Manuel Pégourié-Gonnard | 312d2e8 | 2013-12-04 11:08:01 +0100 | [diff] [blame] | 2967 | { |
Nicholas Wilson | 08f3ef1 | 2015-11-10 13:10:01 +0000 | [diff] [blame] | 2968 | /* see RFC 7748 sec. 5 para. 5 */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2969 | if( mbedtls_mpi_get_bit( d, 0 ) != 0 || |
| 2970 | mbedtls_mpi_get_bit( d, 1 ) != 0 || |
Manuel Pégourié-Gonnard | c0696c2 | 2015-06-18 16:47:17 +0200 | [diff] [blame] | 2971 | mbedtls_mpi_bitlen( d ) - 1 != grp->nbits ) /* mbedtls_mpi_bitlen is one-based! */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2972 | return( MBEDTLS_ERR_ECP_INVALID_KEY ); |
Nicholas Wilson | 08f3ef1 | 2015-11-10 13:10:01 +0000 | [diff] [blame] | 2973 | |
| 2974 | /* see [Curve25519] page 5 */ |
| 2975 | if( grp->nbits == 254 && mbedtls_mpi_get_bit( d, 2 ) != 0 ) |
| 2976 | return( MBEDTLS_ERR_ECP_INVALID_KEY ); |
| 2977 | |
| 2978 | return( 0 ); |
Manuel Pégourié-Gonnard | 312d2e8 | 2013-12-04 11:08:01 +0100 | [diff] [blame] | 2979 | } |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2980 | #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ |
| 2981 | #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 2982 | if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS ) |
Manuel Pégourié-Gonnard | 312d2e8 | 2013-12-04 11:08:01 +0100 | [diff] [blame] | 2983 | { |
| 2984 | /* see SEC1 3.2 */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2985 | if( mbedtls_mpi_cmp_int( d, 1 ) < 0 || |
| 2986 | mbedtls_mpi_cmp_mpi( d, &grp->N ) >= 0 ) |
| 2987 | return( MBEDTLS_ERR_ECP_INVALID_KEY ); |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 2988 | else |
| 2989 | return( 0 ); |
Manuel Pégourié-Gonnard | 312d2e8 | 2013-12-04 11:08:01 +0100 | [diff] [blame] | 2990 | } |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 2991 | #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2992 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2993 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | c8dc295 | 2013-07-01 14:06:13 +0200 | [diff] [blame] | 2994 | } |
| 2995 | |
| 2996 | /* |
Manuel Pégourié-Gonnard | a7937f9 | 2017-04-20 15:37:46 +0200 | [diff] [blame] | 2997 | * Generate a private key |
Manuel Pégourié-Gonnard | 45a035a | 2013-01-26 14:42:45 +0100 | [diff] [blame] | 2998 | */ |
Manuel Pégourié-Gonnard | a7937f9 | 2017-04-20 15:37:46 +0200 | [diff] [blame] | 2999 | int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp, |
| 3000 | mbedtls_mpi *d, |
Manuel Pégourié-Gonnard | 45a035a | 2013-01-26 14:42:45 +0100 | [diff] [blame] | 3001 | int (*f_rng)(void *, unsigned char *, size_t), |
| 3002 | void *p_rng ) |
| 3003 | { |
Manuel Pégourié-Gonnard | a7937f9 | 2017-04-20 15:37:46 +0200 | [diff] [blame] | 3004 | int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 3005 | size_t n_size; |
| 3006 | |
| 3007 | ECP_VALIDATE_RET( grp != NULL ); |
| 3008 | ECP_VALIDATE_RET( d != NULL ); |
| 3009 | ECP_VALIDATE_RET( f_rng != NULL ); |
| 3010 | |
| 3011 | n_size = ( grp->nbits + 7 ) / 8; |
Manuel Pégourié-Gonnard | 45a035a | 2013-01-26 14:42:45 +0100 | [diff] [blame] | 3012 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 3013 | #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 3014 | if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY ) |
Manuel Pégourié-Gonnard | 45a035a | 2013-01-26 14:42:45 +0100 | [diff] [blame] | 3015 | { |
Manuel Pégourié-Gonnard | fe0af40 | 2013-12-04 18:14:55 +0100 | [diff] [blame] | 3016 | /* [M225] page 5 */ |
| 3017 | size_t b; |
| 3018 | |
Janos Follath | 98e28a7 | 2016-05-31 14:03:54 +0100 | [diff] [blame] | 3019 | do { |
| 3020 | MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( d, n_size, f_rng, p_rng ) ); |
| 3021 | } while( mbedtls_mpi_bitlen( d ) == 0); |
Manuel Pégourié-Gonnard | 45a035a | 2013-01-26 14:42:45 +0100 | [diff] [blame] | 3022 | |
Manuel Pégourié-Gonnard | fe0af40 | 2013-12-04 18:14:55 +0100 | [diff] [blame] | 3023 | /* Make sure the most significant bit is nbits */ |
Manuel Pégourié-Gonnard | c0696c2 | 2015-06-18 16:47:17 +0200 | [diff] [blame] | 3024 | b = mbedtls_mpi_bitlen( d ) - 1; /* mbedtls_mpi_bitlen is one-based */ |
Manuel Pégourié-Gonnard | fe0af40 | 2013-12-04 18:14:55 +0100 | [diff] [blame] | 3025 | if( b > grp->nbits ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3026 | MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( d, b - grp->nbits ) ); |
Manuel Pégourié-Gonnard | fe0af40 | 2013-12-04 18:14:55 +0100 | [diff] [blame] | 3027 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3028 | MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, grp->nbits, 1 ) ); |
Manuel Pégourié-Gonnard | 45a035a | 2013-01-26 14:42:45 +0100 | [diff] [blame] | 3029 | |
Nicholas Wilson | 08f3ef1 | 2015-11-10 13:10:01 +0000 | [diff] [blame] | 3030 | /* Make sure the last two bits are unset for Curve448, three bits for |
| 3031 | Curve25519 */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3032 | MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 0, 0 ) ); |
| 3033 | MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 1, 0 ) ); |
Nicholas Wilson | 08f3ef1 | 2015-11-10 13:10:01 +0000 | [diff] [blame] | 3034 | if( grp->nbits == 254 ) |
| 3035 | { |
| 3036 | MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( d, 2, 0 ) ); |
| 3037 | } |
Manuel Pégourié-Gonnard | 45a035a | 2013-01-26 14:42:45 +0100 | [diff] [blame] | 3038 | } |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 3039 | #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ |
Manuel Pégourié-Gonnard | a7937f9 | 2017-04-20 15:37:46 +0200 | [diff] [blame] | 3040 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 3041 | #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 3042 | if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS ) |
Manuel Pégourié-Gonnard | fe0af40 | 2013-12-04 18:14:55 +0100 | [diff] [blame] | 3043 | { |
| 3044 | /* SEC1 3.2.1: Generate d such that 1 <= n < N */ |
Manuel Pégourié-Gonnard | d962273 | 2013-12-05 10:06:06 +0100 | [diff] [blame] | 3045 | int count = 0; |
Janos Follath | 0e5532d | 2019-10-11 14:21:53 +0100 | [diff] [blame] | 3046 | unsigned cmp = 0; |
Manuel Pégourié-Gonnard | 79f73b9 | 2014-01-03 12:35:05 +0100 | [diff] [blame] | 3047 | |
| 3048 | /* |
| 3049 | * Match the procedure given in RFC 6979 (deterministic ECDSA): |
| 3050 | * - use the same byte ordering; |
| 3051 | * - keep the leftmost nbits bits of the generated octet string; |
| 3052 | * - try until result is in the desired range. |
| 3053 | * This also avoids any biais, which is especially important for ECDSA. |
| 3054 | */ |
Manuel Pégourié-Gonnard | fe0af40 | 2013-12-04 18:14:55 +0100 | [diff] [blame] | 3055 | do |
| 3056 | { |
Hanno Becker | 7c8cb9c | 2017-10-17 15:19:38 +0100 | [diff] [blame] | 3057 | MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( d, n_size, f_rng, p_rng ) ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3058 | MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( d, 8 * n_size - grp->nbits ) ); |
Manuel Pégourié-Gonnard | fe0af40 | 2013-12-04 18:14:55 +0100 | [diff] [blame] | 3059 | |
Manuel Pégourié-Gonnard | 6e8e34d | 2014-01-28 19:30:56 +0100 | [diff] [blame] | 3060 | /* |
| 3061 | * Each try has at worst a probability 1/2 of failing (the msb has |
| 3062 | * a probability 1/2 of being 0, and then the result will be < N), |
| 3063 | * so after 30 tries failure probability is a most 2**(-30). |
| 3064 | * |
| 3065 | * For most curves, 1 try is enough with overwhelming probability, |
| 3066 | * since N starts with a lot of 1s in binary, but some curves |
| 3067 | * such as secp224k1 are actually very close to the worst case. |
| 3068 | */ |
Manuel Pégourié-Gonnard | 6754396 | 2017-04-21 13:19:43 +0200 | [diff] [blame] | 3069 | if( ++count > 30 ) |
Jonas | b246214 | 2020-05-28 20:00:43 +0900 | [diff] [blame] | 3070 | { |
| 3071 | ret = MBEDTLS_ERR_ECP_RANDOM_FAILED; |
| 3072 | goto cleanup; |
| 3073 | } |
Janos Follath | a779b46 | 2019-09-16 14:27:39 +0100 | [diff] [blame] | 3074 | |
Janos Follath | 0e5532d | 2019-10-11 14:21:53 +0100 | [diff] [blame] | 3075 | ret = mbedtls_mpi_lt_mpi_ct( d, &grp->N, &cmp ); |
Janos Follath | a779b46 | 2019-09-16 14:27:39 +0100 | [diff] [blame] | 3076 | if( ret != 0 ) |
| 3077 | { |
| 3078 | goto cleanup; |
| 3079 | } |
Manuel Pégourié-Gonnard | fe0af40 | 2013-12-04 18:14:55 +0100 | [diff] [blame] | 3080 | } |
Janos Follath | 0e5532d | 2019-10-11 14:21:53 +0100 | [diff] [blame] | 3081 | while( mbedtls_mpi_cmp_int( d, 1 ) < 0 || cmp != 1 ); |
Manuel Pégourié-Gonnard | fe0af40 | 2013-12-04 18:14:55 +0100 | [diff] [blame] | 3082 | } |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 3083 | #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ |
Manuel Pégourié-Gonnard | 45a035a | 2013-01-26 14:42:45 +0100 | [diff] [blame] | 3084 | |
Manuel Pégourié-Gonnard | c957399 | 2014-01-03 12:54:00 +0100 | [diff] [blame] | 3085 | cleanup: |
Manuel Pégourié-Gonnard | a7937f9 | 2017-04-20 15:37:46 +0200 | [diff] [blame] | 3086 | return( ret ); |
| 3087 | } |
Manuel Pégourié-Gonnard | c957399 | 2014-01-03 12:54:00 +0100 | [diff] [blame] | 3088 | |
Manuel Pégourié-Gonnard | a7937f9 | 2017-04-20 15:37:46 +0200 | [diff] [blame] | 3089 | /* |
| 3090 | * Generate a keypair with configurable base point |
| 3091 | */ |
| 3092 | int mbedtls_ecp_gen_keypair_base( mbedtls_ecp_group *grp, |
| 3093 | const mbedtls_ecp_point *G, |
| 3094 | mbedtls_mpi *d, mbedtls_ecp_point *Q, |
| 3095 | int (*f_rng)(void *, unsigned char *, size_t), |
| 3096 | void *p_rng ) |
| 3097 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 3098 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 3099 | ECP_VALIDATE_RET( grp != NULL ); |
| 3100 | ECP_VALIDATE_RET( d != NULL ); |
| 3101 | ECP_VALIDATE_RET( G != NULL ); |
| 3102 | ECP_VALIDATE_RET( Q != NULL ); |
| 3103 | ECP_VALIDATE_RET( f_rng != NULL ); |
Manuel Pégourié-Gonnard | a7937f9 | 2017-04-20 15:37:46 +0200 | [diff] [blame] | 3104 | |
| 3105 | MBEDTLS_MPI_CHK( mbedtls_ecp_gen_privkey( grp, d, f_rng, p_rng ) ); |
| 3106 | MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, Q, d, G, f_rng, p_rng ) ); |
| 3107 | |
| 3108 | cleanup: |
| 3109 | return( ret ); |
Manuel Pégourié-Gonnard | d9a3f47 | 2015-08-11 14:31:03 +0200 | [diff] [blame] | 3110 | } |
| 3111 | |
| 3112 | /* |
| 3113 | * Generate key pair, wrapper for conventional base point |
| 3114 | */ |
| 3115 | int mbedtls_ecp_gen_keypair( mbedtls_ecp_group *grp, |
| 3116 | mbedtls_mpi *d, mbedtls_ecp_point *Q, |
| 3117 | int (*f_rng)(void *, unsigned char *, size_t), |
| 3118 | void *p_rng ) |
| 3119 | { |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 3120 | ECP_VALIDATE_RET( grp != NULL ); |
| 3121 | ECP_VALIDATE_RET( d != NULL ); |
| 3122 | ECP_VALIDATE_RET( Q != NULL ); |
| 3123 | ECP_VALIDATE_RET( f_rng != NULL ); |
| 3124 | |
Manuel Pégourié-Gonnard | d9a3f47 | 2015-08-11 14:31:03 +0200 | [diff] [blame] | 3125 | return( mbedtls_ecp_gen_keypair_base( grp, &grp->G, d, Q, f_rng, p_rng ) ); |
Manuel Pégourié-Gonnard | 45a035a | 2013-01-26 14:42:45 +0100 | [diff] [blame] | 3126 | } |
Manuel Pégourié-Gonnard | efaa31e | 2012-11-06 21:34:35 +0100 | [diff] [blame] | 3127 | |
Manuel Pégourié-Gonnard | 104ee1d | 2013-11-30 14:13:16 +0100 | [diff] [blame] | 3128 | /* |
| 3129 | * Generate a keypair, prettier wrapper |
| 3130 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3131 | int mbedtls_ecp_gen_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key, |
Manuel Pégourié-Gonnard | 104ee1d | 2013-11-30 14:13:16 +0100 | [diff] [blame] | 3132 | int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) |
| 3133 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 3134 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 3135 | ECP_VALIDATE_RET( key != NULL ); |
| 3136 | ECP_VALIDATE_RET( f_rng != NULL ); |
Manuel Pégourié-Gonnard | 104ee1d | 2013-11-30 14:13:16 +0100 | [diff] [blame] | 3137 | |
Manuel Pégourié-Gonnard | e3a062b | 2015-05-11 18:46:47 +0200 | [diff] [blame] | 3138 | if( ( ret = mbedtls_ecp_group_load( &key->grp, grp_id ) ) != 0 ) |
Manuel Pégourié-Gonnard | 104ee1d | 2013-11-30 14:13:16 +0100 | [diff] [blame] | 3139 | return( ret ); |
| 3140 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3141 | return( mbedtls_ecp_gen_keypair( &key->grp, &key->d, &key->Q, f_rng, p_rng ) ); |
Manuel Pégourié-Gonnard | 104ee1d | 2013-11-30 14:13:16 +0100 | [diff] [blame] | 3142 | } |
| 3143 | |
Janos Follath | 7780096 | 2019-02-25 16:32:08 +0000 | [diff] [blame] | 3144 | #define ECP_CURVE25519_KEY_SIZE 32 |
Janos Follath | 171a7ef | 2019-02-15 16:17:45 +0000 | [diff] [blame] | 3145 | /* |
| 3146 | * Read a private key. |
| 3147 | */ |
| 3148 | int mbedtls_ecp_read_key( mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key, |
| 3149 | const unsigned char *buf, size_t buflen ) |
| 3150 | { |
| 3151 | int ret = 0; |
| 3152 | |
Janos Follath | 28eb06d | 2019-02-26 10:53:34 +0000 | [diff] [blame] | 3153 | ECP_VALIDATE_RET( key != NULL ); |
| 3154 | ECP_VALIDATE_RET( buf != NULL ); |
| 3155 | |
Janos Follath | 171a7ef | 2019-02-15 16:17:45 +0000 | [diff] [blame] | 3156 | if( ( ret = mbedtls_ecp_group_load( &key->grp, grp_id ) ) != 0 ) |
| 3157 | return( ret ); |
| 3158 | |
Janos Follath | 28eb06d | 2019-02-26 10:53:34 +0000 | [diff] [blame] | 3159 | ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; |
| 3160 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 3161 | #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 3162 | if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY ) |
Janos Follath | 171a7ef | 2019-02-15 16:17:45 +0000 | [diff] [blame] | 3163 | { |
Janos Follath | 28eb06d | 2019-02-26 10:53:34 +0000 | [diff] [blame] | 3164 | /* |
| 3165 | * If it is Curve25519 curve then mask the key as mandated by RFC7748 |
| 3166 | */ |
| 3167 | if( grp_id == MBEDTLS_ECP_DP_CURVE25519 ) |
| 3168 | { |
| 3169 | if( buflen != ECP_CURVE25519_KEY_SIZE ) |
| 3170 | return MBEDTLS_ERR_ECP_INVALID_KEY; |
Janos Follath | 171a7ef | 2019-02-15 16:17:45 +0000 | [diff] [blame] | 3171 | |
Janos Follath | 28eb06d | 2019-02-26 10:53:34 +0000 | [diff] [blame] | 3172 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary_le( &key->d, buf, buflen ) ); |
Janos Follath | 171a7ef | 2019-02-15 16:17:45 +0000 | [diff] [blame] | 3173 | |
Janos Follath | 28eb06d | 2019-02-26 10:53:34 +0000 | [diff] [blame] | 3174 | /* Set the three least significant bits to 0 */ |
| 3175 | MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &key->d, 0, 0 ) ); |
| 3176 | MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &key->d, 1, 0 ) ); |
| 3177 | MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &key->d, 2, 0 ) ); |
Janos Follath | 171a7ef | 2019-02-15 16:17:45 +0000 | [diff] [blame] | 3178 | |
Janos Follath | 28eb06d | 2019-02-26 10:53:34 +0000 | [diff] [blame] | 3179 | /* Set the most significant bit to 0 */ |
| 3180 | MBEDTLS_MPI_CHK( |
| 3181 | mbedtls_mpi_set_bit( &key->d, |
| 3182 | ECP_CURVE25519_KEY_SIZE * 8 - 1, 0 ) |
| 3183 | ); |
Janos Follath | 171a7ef | 2019-02-15 16:17:45 +0000 | [diff] [blame] | 3184 | |
Janos Follath | 28eb06d | 2019-02-26 10:53:34 +0000 | [diff] [blame] | 3185 | /* Set the second most significant bit to 1 */ |
| 3186 | MBEDTLS_MPI_CHK( |
| 3187 | mbedtls_mpi_set_bit( &key->d, |
| 3188 | ECP_CURVE25519_KEY_SIZE * 8 - 2, 1 ) |
| 3189 | ); |
| 3190 | } |
| 3191 | else |
| 3192 | ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; |
Janos Follath | 171a7ef | 2019-02-15 16:17:45 +0000 | [diff] [blame] | 3193 | } |
| 3194 | |
| 3195 | #endif |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 3196 | #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) |
Janos Follath | df9295b | 2019-02-26 12:36:52 +0000 | [diff] [blame] | 3197 | if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS ) |
Janos Follath | 171a7ef | 2019-02-15 16:17:45 +0000 | [diff] [blame] | 3198 | { |
| 3199 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &key->d, buf, buflen ) ); |
| 3200 | |
| 3201 | MBEDTLS_MPI_CHK( mbedtls_ecp_check_privkey( &key->grp, &key->d ) ); |
| 3202 | } |
| 3203 | |
| 3204 | #endif |
| 3205 | cleanup: |
| 3206 | |
| 3207 | if( ret != 0 ) |
| 3208 | mbedtls_mpi_free( &key->d ); |
| 3209 | |
| 3210 | return( ret ); |
| 3211 | } |
| 3212 | |
Manuel Pégourié-Gonnard | 30668d6 | 2014-11-06 15:25:32 +0100 | [diff] [blame] | 3213 | /* |
Steven Cooreman | de8593f | 2020-06-09 19:55:26 +0200 | [diff] [blame] | 3214 | * Write a private key. |
| 3215 | */ |
Steven Cooreman | 0024df6 | 2020-07-13 10:59:40 +0200 | [diff] [blame] | 3216 | int mbedtls_ecp_write_key( mbedtls_ecp_keypair *key, |
Steven Cooreman | c9b7f78 | 2020-06-11 17:00:36 +0200 | [diff] [blame] | 3217 | unsigned char *buf, size_t buflen ) |
Steven Cooreman | de8593f | 2020-06-09 19:55:26 +0200 | [diff] [blame] | 3218 | { |
Steven Cooreman | 0024df6 | 2020-07-13 10:59:40 +0200 | [diff] [blame] | 3219 | int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; |
Steven Cooreman | de8593f | 2020-06-09 19:55:26 +0200 | [diff] [blame] | 3220 | |
Steven Cooreman | 0024df6 | 2020-07-13 10:59:40 +0200 | [diff] [blame] | 3221 | ECP_VALIDATE_RET( key != NULL ); |
| 3222 | ECP_VALIDATE_RET( buf != NULL ); |
Steven Cooreman | de8593f | 2020-06-09 19:55:26 +0200 | [diff] [blame] | 3223 | |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 3224 | #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) |
Steven Cooreman | de8593f | 2020-06-09 19:55:26 +0200 | [diff] [blame] | 3225 | if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY ) |
| 3226 | { |
Steven Cooreman | 0024df6 | 2020-07-13 10:59:40 +0200 | [diff] [blame] | 3227 | if( key->grp.id == MBEDTLS_ECP_DP_CURVE25519 ) |
Steven Cooreman | de8593f | 2020-06-09 19:55:26 +0200 | [diff] [blame] | 3228 | { |
| 3229 | if( buflen < ECP_CURVE25519_KEY_SIZE ) |
| 3230 | return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL; |
| 3231 | |
| 3232 | MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary_le( &key->d, buf, buflen ) ); |
Steven Cooreman | de8593f | 2020-06-09 19:55:26 +0200 | [diff] [blame] | 3233 | } |
| 3234 | else |
| 3235 | ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; |
| 3236 | } |
| 3237 | |
| 3238 | #endif |
Gilles Peskine | e8c04fe | 2018-09-14 17:44:21 +0200 | [diff] [blame] | 3239 | #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) |
Steven Cooreman | de8593f | 2020-06-09 19:55:26 +0200 | [diff] [blame] | 3240 | if( mbedtls_ecp_get_type( &key->grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS ) |
| 3241 | { |
| 3242 | MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &key->d, buf, buflen ) ); |
Steven Cooreman | de8593f | 2020-06-09 19:55:26 +0200 | [diff] [blame] | 3243 | } |
| 3244 | |
| 3245 | #endif |
| 3246 | cleanup: |
| 3247 | |
| 3248 | return( ret ); |
| 3249 | } |
| 3250 | |
| 3251 | |
| 3252 | /* |
Manuel Pégourié-Gonnard | 30668d6 | 2014-11-06 15:25:32 +0100 | [diff] [blame] | 3253 | * Check a public-private key pair |
| 3254 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3255 | int mbedtls_ecp_check_pub_priv( const mbedtls_ecp_keypair *pub, const mbedtls_ecp_keypair *prv ) |
Manuel Pégourié-Gonnard | 30668d6 | 2014-11-06 15:25:32 +0100 | [diff] [blame] | 3256 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 3257 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3258 | mbedtls_ecp_point Q; |
| 3259 | mbedtls_ecp_group grp; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 3260 | ECP_VALIDATE_RET( pub != NULL ); |
| 3261 | ECP_VALIDATE_RET( prv != NULL ); |
Manuel Pégourié-Gonnard | 30668d6 | 2014-11-06 15:25:32 +0100 | [diff] [blame] | 3262 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3263 | if( pub->grp.id == MBEDTLS_ECP_DP_NONE || |
Manuel Pégourié-Gonnard | 30668d6 | 2014-11-06 15:25:32 +0100 | [diff] [blame] | 3264 | pub->grp.id != prv->grp.id || |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3265 | mbedtls_mpi_cmp_mpi( &pub->Q.X, &prv->Q.X ) || |
| 3266 | mbedtls_mpi_cmp_mpi( &pub->Q.Y, &prv->Q.Y ) || |
| 3267 | mbedtls_mpi_cmp_mpi( &pub->Q.Z, &prv->Q.Z ) ) |
Manuel Pégourié-Gonnard | 30668d6 | 2014-11-06 15:25:32 +0100 | [diff] [blame] | 3268 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3269 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 30668d6 | 2014-11-06 15:25:32 +0100 | [diff] [blame] | 3270 | } |
| 3271 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3272 | mbedtls_ecp_point_init( &Q ); |
| 3273 | mbedtls_ecp_group_init( &grp ); |
Manuel Pégourié-Gonnard | 30668d6 | 2014-11-06 15:25:32 +0100 | [diff] [blame] | 3274 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3275 | /* mbedtls_ecp_mul() needs a non-const group... */ |
| 3276 | mbedtls_ecp_group_copy( &grp, &prv->grp ); |
Manuel Pégourié-Gonnard | 30668d6 | 2014-11-06 15:25:32 +0100 | [diff] [blame] | 3277 | |
| 3278 | /* Also checks d is valid */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3279 | MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &Q, &prv->d, &prv->grp.G, NULL, NULL ) ); |
Manuel Pégourié-Gonnard | 30668d6 | 2014-11-06 15:25:32 +0100 | [diff] [blame] | 3280 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3281 | if( mbedtls_mpi_cmp_mpi( &Q.X, &prv->Q.X ) || |
| 3282 | mbedtls_mpi_cmp_mpi( &Q.Y, &prv->Q.Y ) || |
| 3283 | mbedtls_mpi_cmp_mpi( &Q.Z, &prv->Q.Z ) ) |
Manuel Pégourié-Gonnard | 30668d6 | 2014-11-06 15:25:32 +0100 | [diff] [blame] | 3284 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3285 | ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; |
Manuel Pégourié-Gonnard | 30668d6 | 2014-11-06 15:25:32 +0100 | [diff] [blame] | 3286 | goto cleanup; |
| 3287 | } |
| 3288 | |
| 3289 | cleanup: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3290 | mbedtls_ecp_point_free( &Q ); |
| 3291 | mbedtls_ecp_group_free( &grp ); |
Manuel Pégourié-Gonnard | 30668d6 | 2014-11-06 15:25:32 +0100 | [diff] [blame] | 3292 | |
| 3293 | return( ret ); |
| 3294 | } |
| 3295 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3296 | #if defined(MBEDTLS_SELF_TEST) |
Manuel Pégourié-Gonnard | 39d2adb | 2012-10-31 09:26:55 +0100 | [diff] [blame] | 3297 | |
Gilles Peskine | 6d9c8d7 | 2020-07-22 01:26:25 +0200 | [diff] [blame^] | 3298 | /* Adjust the exponent to be a valid private point for the specified curve. |
| 3299 | * This is sometimes necessary because we use a single set of exponents |
| 3300 | * for all curves but the validity of values depends on the curve. */ |
Gilles Peskine | a088c81 | 2018-09-17 18:31:15 +0200 | [diff] [blame] | 3301 | static int self_test_adjust_exponent( const mbedtls_ecp_group *grp, |
| 3302 | mbedtls_mpi *m ) |
| 3303 | { |
| 3304 | int ret = 0; |
| 3305 | switch( grp->id ) |
| 3306 | { |
| 3307 | /* If Curve25519 is available, then that's what we use for the |
| 3308 | * Montgomery test, so we don't need the adjustment code. */ |
| 3309 | #if ! defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) |
| 3310 | #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) |
| 3311 | case MBEDTLS_ECP_DP_CURVE448: |
| 3312 | /* Move highest bit from 254 to N-1. Setting bit N-1 is |
| 3313 | * necessary to enforce the highest-bit-set constraint. */ |
| 3314 | MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( m, 254, 0 ) ); |
| 3315 | MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( m, grp->nbits, 1 ) ); |
| 3316 | /* Copy second-highest bit from 253 to N-2. This is not |
| 3317 | * necessary but improves the test variety a bit. */ |
| 3318 | MBEDTLS_MPI_CHK( |
| 3319 | mbedtls_mpi_set_bit( m, grp->nbits - 1, |
| 3320 | mbedtls_mpi_get_bit( m, 253 ) ) ); |
| 3321 | break; |
| 3322 | #endif |
| 3323 | #endif /* ! defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) */ |
| 3324 | default: |
| 3325 | /* Non-Montgomery curves and Curve25519 need no adjustment. */ |
| 3326 | (void) grp; |
| 3327 | (void) m; |
| 3328 | goto cleanup; |
| 3329 | } |
| 3330 | cleanup: |
| 3331 | return( ret ); |
| 3332 | } |
| 3333 | |
Gilles Peskine | 6d9c8d7 | 2020-07-22 01:26:25 +0200 | [diff] [blame^] | 3334 | /* Calculate R = m.P for each m in exponents. Check that the number of |
| 3335 | * basic operations doesn't depend on the value of m. */ |
Gilles Peskine | c95696f | 2018-09-17 15:59:01 +0200 | [diff] [blame] | 3336 | static int self_test_point( int verbose, |
| 3337 | mbedtls_ecp_group *grp, |
| 3338 | mbedtls_ecp_point *R, |
| 3339 | mbedtls_mpi *m, |
Gilles Peskine | 6d9c8d7 | 2020-07-22 01:26:25 +0200 | [diff] [blame^] | 3340 | const mbedtls_ecp_point *P, |
Gilles Peskine | c95696f | 2018-09-17 15:59:01 +0200 | [diff] [blame] | 3341 | const char *const *exponents, |
| 3342 | size_t n_exponents ) |
| 3343 | { |
| 3344 | int ret = 0; |
Gilles Peskine | 2466679 | 2018-09-17 18:29:49 +0200 | [diff] [blame] | 3345 | size_t i = 0; |
Gilles Peskine | c95696f | 2018-09-17 15:59:01 +0200 | [diff] [blame] | 3346 | unsigned long add_c_prev, dbl_c_prev, mul_c_prev; |
| 3347 | add_count = 0; |
| 3348 | dbl_count = 0; |
| 3349 | mul_count = 0; |
Gilles Peskine | a088c81 | 2018-09-17 18:31:15 +0200 | [diff] [blame] | 3350 | |
Gilles Peskine | c95696f | 2018-09-17 15:59:01 +0200 | [diff] [blame] | 3351 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( m, 16, exponents[0] ) ); |
Gilles Peskine | a088c81 | 2018-09-17 18:31:15 +0200 | [diff] [blame] | 3352 | MBEDTLS_MPI_CHK( self_test_adjust_exponent( grp, m ) ); |
Gilles Peskine | c95696f | 2018-09-17 15:59:01 +0200 | [diff] [blame] | 3353 | MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, R, m, P, NULL, NULL ) ); |
| 3354 | |
| 3355 | for( i = 1; i < n_exponents; i++ ) |
| 3356 | { |
| 3357 | add_c_prev = add_count; |
| 3358 | dbl_c_prev = dbl_count; |
| 3359 | mul_c_prev = mul_count; |
| 3360 | add_count = 0; |
| 3361 | dbl_count = 0; |
| 3362 | mul_count = 0; |
| 3363 | |
| 3364 | MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( m, 16, exponents[i] ) ); |
Gilles Peskine | a088c81 | 2018-09-17 18:31:15 +0200 | [diff] [blame] | 3365 | MBEDTLS_MPI_CHK( self_test_adjust_exponent( grp, m ) ); |
Gilles Peskine | c95696f | 2018-09-17 15:59:01 +0200 | [diff] [blame] | 3366 | MBEDTLS_MPI_CHK( mbedtls_ecp_mul( grp, R, m, P, NULL, NULL ) ); |
| 3367 | |
| 3368 | if( add_count != add_c_prev || |
| 3369 | dbl_count != dbl_c_prev || |
| 3370 | mul_count != mul_c_prev ) |
| 3371 | { |
| 3372 | ret = 1; |
| 3373 | break; |
| 3374 | } |
| 3375 | } |
| 3376 | |
| 3377 | cleanup: |
| 3378 | if( verbose != 0 ) |
| 3379 | { |
| 3380 | if( ret != 0 ) |
| 3381 | mbedtls_printf( "failed (%u)\n", (unsigned int) i ); |
| 3382 | else |
| 3383 | mbedtls_printf( "passed\n" ); |
| 3384 | } |
| 3385 | return( ret ); |
| 3386 | } |
| 3387 | |
Manuel Pégourié-Gonnard | b505c27 | 2012-11-05 17:27:54 +0100 | [diff] [blame] | 3388 | /* |
Manuel Pégourié-Gonnard | 39d2adb | 2012-10-31 09:26:55 +0100 | [diff] [blame] | 3389 | * Checkup routine |
| 3390 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3391 | int mbedtls_ecp_self_test( int verbose ) |
Manuel Pégourié-Gonnard | 39d2adb | 2012-10-31 09:26:55 +0100 | [diff] [blame] | 3392 | { |
Janos Follath | 24eed8d | 2019-11-22 13:21:35 +0000 | [diff] [blame] | 3393 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3394 | mbedtls_ecp_group grp; |
| 3395 | mbedtls_ecp_point R, P; |
| 3396 | mbedtls_mpi m; |
Gilles Peskine | 2466679 | 2018-09-17 18:29:49 +0200 | [diff] [blame] | 3397 | |
| 3398 | #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) |
Gilles Peskine | d9767a5 | 2018-09-14 19:29:47 +0200 | [diff] [blame] | 3399 | /* Exponents especially adapted for secp192k1, which has the lowest |
| 3400 | * order n of all supported curves (secp192r1 is in a slightly larger |
| 3401 | * field but the order of its base point is slightly smaller). */ |
Gilles Peskine | 2466679 | 2018-09-17 18:29:49 +0200 | [diff] [blame] | 3402 | const char *sw_exponents[] = |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 3403 | { |
Manuel Pégourié-Gonnard | b63f9e9 | 2012-11-21 13:00:58 +0100 | [diff] [blame] | 3404 | "000000000000000000000000000000000000000000000001", /* one */ |
Gilles Peskine | d9767a5 | 2018-09-14 19:29:47 +0200 | [diff] [blame] | 3405 | "FFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8C", /* n - 1 */ |
Manuel Pégourié-Gonnard | b63f9e9 | 2012-11-21 13:00:58 +0100 | [diff] [blame] | 3406 | "5EA6F389A38B8BC81E767753B15AA5569E1782E30ABE7D25", /* random */ |
Manuel Pégourié-Gonnard | ff27b7c | 2013-11-21 09:28:03 +0100 | [diff] [blame] | 3407 | "400000000000000000000000000000000000000000000000", /* one and zeros */ |
| 3408 | "7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", /* all ones */ |
| 3409 | "555555555555555555555555555555555555555555555555", /* 101010... */ |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 3410 | }; |
Gilles Peskine | 2466679 | 2018-09-17 18:29:49 +0200 | [diff] [blame] | 3411 | #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ |
| 3412 | #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) |
| 3413 | const char *m_exponents[] = |
| 3414 | { |
Gilles Peskine | 6d9c8d7 | 2020-07-22 01:26:25 +0200 | [diff] [blame^] | 3415 | /* Valid private values for Curve25519. In a build with Curve448 |
| 3416 | * but not Curve25519, they will be adjusted in |
| 3417 | * self_test_adjust_exponent(). */ |
Gilles Peskine | 2466679 | 2018-09-17 18:29:49 +0200 | [diff] [blame] | 3418 | "4000000000000000000000000000000000000000000000000000000000000000", |
| 3419 | "5C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C30", |
| 3420 | "5715ECCE24583F7A7023C24164390586842E816D7280A49EF6DF4EAE6B280BF8", |
| 3421 | "41A2B017516F6D254E1F002BCCBADD54BE30F8CEC737A0E912B4963B6BA74460", |
| 3422 | "5555555555555555555555555555555555555555555555555555555555555550", |
| 3423 | "7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8", |
| 3424 | }; |
| 3425 | #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 3426 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3427 | mbedtls_ecp_group_init( &grp ); |
| 3428 | mbedtls_ecp_point_init( &R ); |
| 3429 | mbedtls_ecp_point_init( &P ); |
| 3430 | mbedtls_mpi_init( &m ); |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 3431 | |
Gilles Peskine | 2466679 | 2018-09-17 18:29:49 +0200 | [diff] [blame] | 3432 | #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) |
Manuel Pégourié-Gonnard | b8012fc | 2013-10-10 15:40:49 +0200 | [diff] [blame] | 3433 | /* Use secp192r1 if available, or any available curve */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3434 | #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) |
Manuel Pégourié-Gonnard | e3a062b | 2015-05-11 18:46:47 +0200 | [diff] [blame] | 3435 | MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, MBEDTLS_ECP_DP_SECP192R1 ) ); |
Paul Bakker | 5dc6b5f | 2013-06-29 23:26:34 +0200 | [diff] [blame] | 3436 | #else |
Manuel Pégourié-Gonnard | e3a062b | 2015-05-11 18:46:47 +0200 | [diff] [blame] | 3437 | MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, mbedtls_ecp_curve_list()->grp_id ) ); |
Manuel Pégourié-Gonnard | b8012fc | 2013-10-10 15:40:49 +0200 | [diff] [blame] | 3438 | #endif |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 3439 | |
| 3440 | if( verbose != 0 ) |
Gilles Peskine | 2466679 | 2018-09-17 18:29:49 +0200 | [diff] [blame] | 3441 | mbedtls_printf( " ECP SW test #1 (constant op_count, base point G): " ); |
Manuel Pégourié-Gonnard | 161ef96 | 2013-09-17 19:13:10 +0200 | [diff] [blame] | 3442 | /* Do a dummy multiplication first to trigger precomputation */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3443 | MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &m, 2 ) ); |
| 3444 | MBEDTLS_MPI_CHK( mbedtls_ecp_mul( &grp, &P, &m, &grp.G, NULL, NULL ) ); |
Gilles Peskine | c95696f | 2018-09-17 15:59:01 +0200 | [diff] [blame] | 3445 | ret = self_test_point( verbose, |
| 3446 | &grp, &R, &m, &grp.G, |
Gilles Peskine | 2466679 | 2018-09-17 18:29:49 +0200 | [diff] [blame] | 3447 | sw_exponents, |
| 3448 | sizeof( sw_exponents ) / sizeof( sw_exponents[0] )); |
Gilles Peskine | c95696f | 2018-09-17 15:59:01 +0200 | [diff] [blame] | 3449 | if( ret != 0 ) |
| 3450 | goto cleanup; |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 3451 | |
Manuel Pégourié-Gonnard | 161ef96 | 2013-09-17 19:13:10 +0200 | [diff] [blame] | 3452 | if( verbose != 0 ) |
Gilles Peskine | 2466679 | 2018-09-17 18:29:49 +0200 | [diff] [blame] | 3453 | mbedtls_printf( " ECP SW test #2 (constant op_count, other point): " ); |
Manuel Pégourié-Gonnard | 161ef96 | 2013-09-17 19:13:10 +0200 | [diff] [blame] | 3454 | /* We computed P = 2G last time, use it */ |
Gilles Peskine | c95696f | 2018-09-17 15:59:01 +0200 | [diff] [blame] | 3455 | ret = self_test_point( verbose, |
| 3456 | &grp, &R, &m, &P, |
Gilles Peskine | 2466679 | 2018-09-17 18:29:49 +0200 | [diff] [blame] | 3457 | sw_exponents, |
| 3458 | sizeof( sw_exponents ) / sizeof( sw_exponents[0] )); |
| 3459 | if( ret != 0 ) |
| 3460 | goto cleanup; |
| 3461 | |
| 3462 | mbedtls_ecp_group_free( &grp ); |
| 3463 | mbedtls_ecp_point_free( &R ); |
| 3464 | #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ |
| 3465 | |
| 3466 | #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) |
| 3467 | if( verbose != 0 ) |
| 3468 | mbedtls_printf( " ECP Montgomery test (constant op_count): " ); |
| 3469 | #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) |
| 3470 | MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, MBEDTLS_ECP_DP_CURVE25519 ) ); |
| 3471 | #elif defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) |
| 3472 | MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &grp, MBEDTLS_ECP_DP_CURVE448 ) ); |
| 3473 | #else |
| 3474 | #error "MBEDTLS_ECP_MONTGOMERY_ENABLED is defined, but no curve is supported for self-test" |
| 3475 | #endif |
| 3476 | ret = self_test_point( verbose, |
| 3477 | &grp, &R, &m, &grp.G, |
| 3478 | m_exponents, |
| 3479 | sizeof( m_exponents ) / sizeof( m_exponents[0] )); |
| 3480 | if( ret != 0 ) |
| 3481 | goto cleanup; |
| 3482 | #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ |
Manuel Pégourié-Gonnard | 161ef96 | 2013-09-17 19:13:10 +0200 | [diff] [blame] | 3483 | |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 3484 | cleanup: |
| 3485 | |
| 3486 | if( ret < 0 && verbose != 0 ) |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 3487 | mbedtls_printf( "Unexpected error, return code = %08X\n", (unsigned int) ret ); |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 3488 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3489 | mbedtls_ecp_group_free( &grp ); |
| 3490 | mbedtls_ecp_point_free( &R ); |
| 3491 | mbedtls_ecp_point_free( &P ); |
| 3492 | mbedtls_mpi_free( &m ); |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 3493 | |
| 3494 | if( verbose != 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3495 | mbedtls_printf( "\n" ); |
Manuel Pégourié-Gonnard | b4a310b | 2012-11-13 20:57:00 +0100 | [diff] [blame] | 3496 | |
| 3497 | return( ret ); |
Manuel Pégourié-Gonnard | 39d2adb | 2012-10-31 09:26:55 +0100 | [diff] [blame] | 3498 | } |
| 3499 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3500 | #endif /* MBEDTLS_SELF_TEST */ |
Manuel Pégourié-Gonnard | 39d2adb | 2012-10-31 09:26:55 +0100 | [diff] [blame] | 3501 | |
Janos Follath | b069753 | 2016-08-18 12:38:46 +0100 | [diff] [blame] | 3502 | #endif /* !MBEDTLS_ECP_ALT */ |
| 3503 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3504 | #endif /* MBEDTLS_ECP_C */ |