The Tor Browser / annotate

security/nss/lib/freebl/ecl/ec2_aff.c@b8a032363ba2 (annotated)

security/nss/lib/freebl/ecl/ec2_aff.c

Thu, 22 Jan 2015 13:21:57 +0100

author
Michael Schloh von Bennewitz <michael@schloh.com>
date
Thu, 22 Jan 2015 13:21:57 +0100
branch
TOR_BUG_9701
changeset 15
b8a032363ba2
permissions
-rw-r--r--

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

michael@0 1 /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0 2 * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0 4
michael@0 5 #include "ec2.h"
michael@0 6 #include "mplogic.h"
michael@0 7 #include "mp_gf2m.h"
michael@0 8 #include <stdlib.h>
michael@0 9
michael@0 10 /* Checks if point P(px, py) is at infinity. Uses affine coordinates. */
michael@0 11 mp_err
michael@0 12 ec_GF2m_pt_is_inf_aff(const mp_int *px, const mp_int *py)
michael@0 13 {
michael@0 14
michael@0 15 if ((mp_cmp_z(px) == 0) && (mp_cmp_z(py) == 0)) {
michael@0 16 return MP_YES;
michael@0 17 } else {
michael@0 18 return MP_NO;
michael@0 19 }
michael@0 20
michael@0 21 }
michael@0 22
michael@0 23 /* Sets P(px, py) to be the point at infinity. Uses affine coordinates. */
michael@0 24 mp_err
michael@0 25 ec_GF2m_pt_set_inf_aff(mp_int *px, mp_int *py)
michael@0 26 {
michael@0 27 mp_zero(px);
michael@0 28 mp_zero(py);
michael@0 29 return MP_OKAY;
michael@0 30 }
michael@0 31
michael@0 32 /* Computes R = P + Q based on IEEE P1363 A.10.2. Elliptic curve points P,
michael@0 33 * Q, and R can all be identical. Uses affine coordinates. */
michael@0 34 mp_err
michael@0 35 ec_GF2m_pt_add_aff(const mp_int *px, const mp_int *py, const mp_int *qx,
michael@0 36 const mp_int *qy, mp_int *rx, mp_int *ry,
michael@0 37 const ECGroup *group)
michael@0 38 {
michael@0 39 mp_err res = MP_OKAY;
michael@0 40 mp_int lambda, tempx, tempy;
michael@0 41
michael@0 42 MP_DIGITS(&lambda) = 0;
michael@0 43 MP_DIGITS(&tempx) = 0;
michael@0 44 MP_DIGITS(&tempy) = 0;
michael@0 45 MP_CHECKOK(mp_init(&lambda));
michael@0 46 MP_CHECKOK(mp_init(&tempx));
michael@0 47 MP_CHECKOK(mp_init(&tempy));
michael@0 48 /* if P = inf, then R = Q */
michael@0 49 if (ec_GF2m_pt_is_inf_aff(px, py) == 0) {
michael@0 50 MP_CHECKOK(mp_copy(qx, rx));
michael@0 51 MP_CHECKOK(mp_copy(qy, ry));
michael@0 52 res = MP_OKAY;
michael@0 53 goto CLEANUP;
michael@0 54 }
michael@0 55 /* if Q = inf, then R = P */
michael@0 56 if (ec_GF2m_pt_is_inf_aff(qx, qy) == 0) {
michael@0 57 MP_CHECKOK(mp_copy(px, rx));
michael@0 58 MP_CHECKOK(mp_copy(py, ry));
michael@0 59 res = MP_OKAY;
michael@0 60 goto CLEANUP;
michael@0 61 }
michael@0 62 /* if px != qx, then lambda = (py+qy) / (px+qx), tempx = a + lambda^2
michael@0 63 * + lambda + px + qx */
michael@0 64 if (mp_cmp(px, qx) != 0) {
michael@0 65 MP_CHECKOK(group->meth->field_add(py, qy, &tempy, group->meth));
michael@0 66 MP_CHECKOK(group->meth->field_add(px, qx, &tempx, group->meth));
michael@0 67 MP_CHECKOK(group->meth->
michael@0 68 field_div(&tempy, &tempx, &lambda, group->meth));
michael@0 69 MP_CHECKOK(group->meth->field_sqr(&lambda, &tempx, group->meth));
michael@0 70 MP_CHECKOK(group->meth->
michael@0 71 field_add(&tempx, &lambda, &tempx, group->meth));
michael@0 72 MP_CHECKOK(group->meth->
michael@0 73 field_add(&tempx, &group->curvea, &tempx, group->meth));
michael@0 74 MP_CHECKOK(group->meth->
michael@0 75 field_add(&tempx, px, &tempx, group->meth));
michael@0 76 MP_CHECKOK(group->meth->
michael@0 77 field_add(&tempx, qx, &tempx, group->meth));
michael@0 78 } else {
michael@0 79 /* if py != qy or qx = 0, then R = inf */
michael@0 80 if (((mp_cmp(py, qy) != 0)) || (mp_cmp_z(qx) == 0)) {
michael@0 81 mp_zero(rx);
michael@0 82 mp_zero(ry);
michael@0 83 res = MP_OKAY;
michael@0 84 goto CLEANUP;
michael@0 85 }
michael@0 86 /* lambda = qx + qy / qx */
michael@0 87 MP_CHECKOK(group->meth->field_div(qy, qx, &lambda, group->meth));
michael@0 88 MP_CHECKOK(group->meth->
michael@0 89 field_add(&lambda, qx, &lambda, group->meth));
michael@0 90 /* tempx = a + lambda^2 + lambda */
michael@0 91 MP_CHECKOK(group->meth->field_sqr(&lambda, &tempx, group->meth));
michael@0 92 MP_CHECKOK(group->meth->
michael@0 93 field_add(&tempx, &lambda, &tempx, group->meth));
michael@0 94 MP_CHECKOK(group->meth->
michael@0 95 field_add(&tempx, &group->curvea, &tempx, group->meth));
michael@0 96 }
michael@0 97 /* ry = (qx + tempx) * lambda + tempx + qy */
michael@0 98 MP_CHECKOK(group->meth->field_add(qx, &tempx, &tempy, group->meth));
michael@0 99 MP_CHECKOK(group->meth->
michael@0 100 field_mul(&tempy, &lambda, &tempy, group->meth));
michael@0 101 MP_CHECKOK(group->meth->
michael@0 102 field_add(&tempy, &tempx, &tempy, group->meth));
michael@0 103 MP_CHECKOK(group->meth->field_add(&tempy, qy, ry, group->meth));
michael@0 104 /* rx = tempx */
michael@0 105 MP_CHECKOK(mp_copy(&tempx, rx));
michael@0 106
michael@0 107 CLEANUP:
michael@0 108 mp_clear(&lambda);
michael@0 109 mp_clear(&tempx);
michael@0 110 mp_clear(&tempy);
michael@0 111 return res;
michael@0 112 }
michael@0 113
michael@0 114 /* Computes R = P - Q. Elliptic curve points P, Q, and R can all be
michael@0 115 * identical. Uses affine coordinates. */
michael@0 116 mp_err
michael@0 117 ec_GF2m_pt_sub_aff(const mp_int *px, const mp_int *py, const mp_int *qx,
michael@0 118 const mp_int *qy, mp_int *rx, mp_int *ry,
michael@0 119 const ECGroup *group)
michael@0 120 {
michael@0 121 mp_err res = MP_OKAY;
michael@0 122 mp_int nqy;
michael@0 123
michael@0 124 MP_DIGITS(&nqy) = 0;
michael@0 125 MP_CHECKOK(mp_init(&nqy));
michael@0 126 /* nqy = qx+qy */
michael@0 127 MP_CHECKOK(group->meth->field_add(qx, qy, &nqy, group->meth));
michael@0 128 MP_CHECKOK(group->point_add(px, py, qx, &nqy, rx, ry, group));
michael@0 129 CLEANUP:
michael@0 130 mp_clear(&nqy);
michael@0 131 return res;
michael@0 132 }
michael@0 133
michael@0 134 /* Computes R = 2P. Elliptic curve points P and R can be identical. Uses
michael@0 135 * affine coordinates. */
michael@0 136 mp_err
michael@0 137 ec_GF2m_pt_dbl_aff(const mp_int *px, const mp_int *py, mp_int *rx,
michael@0 138 mp_int *ry, const ECGroup *group)
michael@0 139 {
michael@0 140 return group->point_add(px, py, px, py, rx, ry, group);
michael@0 141 }
michael@0 142
michael@0 143 /* by default, this routine is unused and thus doesn't need to be compiled */
michael@0 144 #ifdef ECL_ENABLE_GF2M_PT_MUL_AFF
michael@0 145 /* Computes R = nP based on IEEE P1363 A.10.3. Elliptic curve points P and
michael@0 146 * R can be identical. Uses affine coordinates. */
michael@0 147 mp_err
michael@0 148 ec_GF2m_pt_mul_aff(const mp_int *n, const mp_int *px, const mp_int *py,
michael@0 149 mp_int *rx, mp_int *ry, const ECGroup *group)
michael@0 150 {
michael@0 151 mp_err res = MP_OKAY;
michael@0 152 mp_int k, k3, qx, qy, sx, sy;
michael@0 153 int b1, b3, i, l;
michael@0 154
michael@0 155 MP_DIGITS(&k) = 0;
michael@0 156 MP_DIGITS(&k3) = 0;
michael@0 157 MP_DIGITS(&qx) = 0;
michael@0 158 MP_DIGITS(&qy) = 0;
michael@0 159 MP_DIGITS(&sx) = 0;
michael@0 160 MP_DIGITS(&sy) = 0;
michael@0 161 MP_CHECKOK(mp_init(&k));
michael@0 162 MP_CHECKOK(mp_init(&k3));
michael@0 163 MP_CHECKOK(mp_init(&qx));
michael@0 164 MP_CHECKOK(mp_init(&qy));
michael@0 165 MP_CHECKOK(mp_init(&sx));
michael@0 166 MP_CHECKOK(mp_init(&sy));
michael@0 167
michael@0 168 /* if n = 0 then r = inf */
michael@0 169 if (mp_cmp_z(n) == 0) {
michael@0 170 mp_zero(rx);
michael@0 171 mp_zero(ry);
michael@0 172 res = MP_OKAY;
michael@0 173 goto CLEANUP;
michael@0 174 }
michael@0 175 /* Q = P, k = n */
michael@0 176 MP_CHECKOK(mp_copy(px, &qx));
michael@0 177 MP_CHECKOK(mp_copy(py, &qy));
michael@0 178 MP_CHECKOK(mp_copy(n, &k));
michael@0 179 /* if n < 0 then Q = -Q, k = -k */
michael@0 180 if (mp_cmp_z(n) < 0) {
michael@0 181 MP_CHECKOK(group->meth->field_add(&qx, &qy, &qy, group->meth));
michael@0 182 MP_CHECKOK(mp_neg(&k, &k));
michael@0 183 }
michael@0 184 #ifdef ECL_DEBUG /* basic double and add method */
michael@0 185 l = mpl_significant_bits(&k) - 1;
michael@0 186 MP_CHECKOK(mp_copy(&qx, &sx));
michael@0 187 MP_CHECKOK(mp_copy(&qy, &sy));
michael@0 188 for (i = l - 1; i >= 0; i--) {
michael@0 189 /* S = 2S */
michael@0 190 MP_CHECKOK(group->point_dbl(&sx, &sy, &sx, &sy, group));
michael@0 191 /* if k_i = 1, then S = S + Q */
michael@0 192 if (mpl_get_bit(&k, i) != 0) {
michael@0 193 MP_CHECKOK(group->
michael@0 194 point_add(&sx, &sy, &qx, &qy, &sx, &sy, group));
michael@0 195 }
michael@0 196 }
michael@0 197 #else /* double and add/subtract method from
michael@0 198 * standard */
michael@0 199 /* k3 = 3 * k */
michael@0 200 MP_CHECKOK(mp_set_int(&k3, 3));
michael@0 201 MP_CHECKOK(mp_mul(&k, &k3, &k3));
michael@0 202 /* S = Q */
michael@0 203 MP_CHECKOK(mp_copy(&qx, &sx));
michael@0 204 MP_CHECKOK(mp_copy(&qy, &sy));
michael@0 205 /* l = index of high order bit in binary representation of 3*k */
michael@0 206 l = mpl_significant_bits(&k3) - 1;
michael@0 207 /* for i = l-1 downto 1 */
michael@0 208 for (i = l - 1; i >= 1; i--) {
michael@0 209 /* S = 2S */
michael@0 210 MP_CHECKOK(group->point_dbl(&sx, &sy, &sx, &sy, group));
michael@0 211 b3 = MP_GET_BIT(&k3, i);
michael@0 212 b1 = MP_GET_BIT(&k, i);
michael@0 213 /* if k3_i = 1 and k_i = 0, then S = S + Q */
michael@0 214 if ((b3 == 1) && (b1 == 0)) {
michael@0 215 MP_CHECKOK(group->
michael@0 216 point_add(&sx, &sy, &qx, &qy, &sx, &sy, group));
michael@0 217 /* if k3_i = 0 and k_i = 1, then S = S - Q */
michael@0 218 } else if ((b3 == 0) && (b1 == 1)) {
michael@0 219 MP_CHECKOK(group->
michael@0 220 point_sub(&sx, &sy, &qx, &qy, &sx, &sy, group));
michael@0 221 }
michael@0 222 }
michael@0 223 #endif
michael@0 224 /* output S */
michael@0 225 MP_CHECKOK(mp_copy(&sx, rx));
michael@0 226 MP_CHECKOK(mp_copy(&sy, ry));
michael@0 227
michael@0 228 CLEANUP:
michael@0 229 mp_clear(&k);
michael@0 230 mp_clear(&k3);
michael@0 231 mp_clear(&qx);
michael@0 232 mp_clear(&qy);
michael@0 233 mp_clear(&sx);
michael@0 234 mp_clear(&sy);
michael@0 235 return res;
michael@0 236 }
michael@0 237 #endif
michael@0 238
michael@0 239 /* Validates a point on a GF2m curve. */
michael@0 240 mp_err
michael@0 241 ec_GF2m_validate_point(const mp_int *px, const mp_int *py, const ECGroup *group)
michael@0 242 {
michael@0 243 mp_err res = MP_NO;
michael@0 244 mp_int accl, accr, tmp, pxt, pyt;
michael@0 245
michael@0 246 MP_DIGITS(&accl) = 0;
michael@0 247 MP_DIGITS(&accr) = 0;
michael@0 248 MP_DIGITS(&tmp) = 0;
michael@0 249 MP_DIGITS(&pxt) = 0;
michael@0 250 MP_DIGITS(&pyt) = 0;
michael@0 251 MP_CHECKOK(mp_init(&accl));
michael@0 252 MP_CHECKOK(mp_init(&accr));
michael@0 253 MP_CHECKOK(mp_init(&tmp));
michael@0 254 MP_CHECKOK(mp_init(&pxt));
michael@0 255 MP_CHECKOK(mp_init(&pyt));
michael@0 256
michael@0 257 /* 1: Verify that publicValue is not the point at infinity */
michael@0 258 if (ec_GF2m_pt_is_inf_aff(px, py) == MP_YES) {
michael@0 259 res = MP_NO;
michael@0 260 goto CLEANUP;
michael@0 261 }
michael@0 262 /* 2: Verify that the coordinates of publicValue are elements
michael@0 263 * of the field.
michael@0 264 */
michael@0 265 if ((MP_SIGN(px) == MP_NEG) || (mp_cmp(px, &group->meth->irr) >= 0) ||
michael@0 266 (MP_SIGN(py) == MP_NEG) || (mp_cmp(py, &group->meth->irr) >= 0)) {
michael@0 267 res = MP_NO;
michael@0 268 goto CLEANUP;
michael@0 269 }
michael@0 270 /* 3: Verify that publicValue is on the curve. */
michael@0 271 if (group->meth->field_enc) {
michael@0 272 group->meth->field_enc(px, &pxt, group->meth);
michael@0 273 group->meth->field_enc(py, &pyt, group->meth);
michael@0 274 } else {
michael@0 275 mp_copy(px, &pxt);
michael@0 276 mp_copy(py, &pyt);
michael@0 277 }
michael@0 278 /* left-hand side: y^2 + x*y */
michael@0 279 MP_CHECKOK( group->meth->field_sqr(&pyt, &accl, group->meth) );
michael@0 280 MP_CHECKOK( group->meth->field_mul(&pxt, &pyt, &tmp, group->meth) );
michael@0 281 MP_CHECKOK( group->meth->field_add(&accl, &tmp, &accl, group->meth) );
michael@0 282 /* right-hand side: x^3 + a*x^2 + b */
michael@0 283 MP_CHECKOK( group->meth->field_sqr(&pxt, &tmp, group->meth) );
michael@0 284 MP_CHECKOK( group->meth->field_mul(&pxt, &tmp, &accr, group->meth) );
michael@0 285 MP_CHECKOK( group->meth->field_mul(&group->curvea, &tmp, &tmp, group->meth) );
michael@0 286 MP_CHECKOK( group->meth->field_add(&tmp, &accr, &accr, group->meth) );
michael@0 287 MP_CHECKOK( group->meth->field_add(&accr, &group->curveb, &accr, group->meth) );
michael@0 288 /* check LHS - RHS == 0 */
michael@0 289 MP_CHECKOK( group->meth->field_add(&accl, &accr, &accr, group->meth) );
michael@0 290 if (mp_cmp_z(&accr) != 0) {
michael@0 291 res = MP_NO;
michael@0 292 goto CLEANUP;
michael@0 293 }
michael@0 294 /* 4: Verify that the order of the curve times the publicValue
michael@0 295 * is the point at infinity.
michael@0 296 */
michael@0 297 MP_CHECKOK( ECPoint_mul(group, &group->order, px, py, &pxt, &pyt) );
michael@0 298 if (ec_GF2m_pt_is_inf_aff(&pxt, &pyt) != MP_YES) {
michael@0 299 res = MP_NO;
michael@0 300 goto CLEANUP;
michael@0 301 }
michael@0 302
michael@0 303 res = MP_YES;
michael@0 304
michael@0 305 CLEANUP:
michael@0 306 mp_clear(&accl);
michael@0 307 mp_clear(&accr);
michael@0 308 mp_clear(&tmp);
michael@0 309 mp_clear(&pxt);
michael@0 310 mp_clear(&pyt);
michael@0 311 return res;
michael@0 312 }

Mercurial Repository: The Tor Browser

Europalab SCM Repository Server

mercurial