1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/security/nss/lib/freebl/ecl/tests/ecp_test.c Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,426 @@
1.4 +/* This Source Code Form is subject to the terms of the Mozilla Public
1.5 + * License, v. 2.0. If a copy of the MPL was not distributed with this
1.6 + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
1.7 +
1.8 +#include "mpi.h"
1.9 +#include "mplogic.h"
1.10 +#include "mpprime.h"
1.11 +#include "ecl.h"
1.12 +#include "ecl-curve.h"
1.13 +#include "ecp.h"
1.14 +#include <stdio.h>
1.15 +#include <strings.h>
1.16 +#include <assert.h>
1.17 +
1.18 +#include <time.h>
1.19 +#include <sys/time.h>
1.20 +#include <sys/resource.h>
1.21 +
1.22 +/* Time k repetitions of operation op. */
1.23 +#define M_TimeOperation(op, k) { \
1.24 + double dStart, dNow, dUserTime; \
1.25 + struct rusage ru; \
1.26 + int i; \
1.27 + getrusage(RUSAGE_SELF, &ru); \
1.28 + dStart = (double)ru.ru_utime.tv_sec+(double)ru.ru_utime.tv_usec*0.000001; \
1.29 + for (i = 0; i < k; i++) { \
1.30 + { op; } \
1.31 + }; \
1.32 + getrusage(RUSAGE_SELF, &ru); \
1.33 + dNow = (double)ru.ru_utime.tv_sec+(double)ru.ru_utime.tv_usec*0.000001; \
1.34 + dUserTime = dNow-dStart; \
1.35 + if (dUserTime) printf(" %-45s k: %6i, t: %6.2f sec\n", #op, k, dUserTime); \
1.36 +}
1.37 +
1.38 +/* Test curve using generic field arithmetic. */
1.39 +#define ECTEST_GENERIC_GFP(name_c, name) \
1.40 + printf("Testing %s using generic implementation...\n", name_c); \
1.41 + params = EC_GetNamedCurveParams(name); \
1.42 + if (params == NULL) { \
1.43 + printf(" Error: could not construct params.\n"); \
1.44 + res = MP_NO; \
1.45 + goto CLEANUP; \
1.46 + } \
1.47 + ECGroup_free(group); \
1.48 + group = ECGroup_fromHex(params); \
1.49 + if (group == NULL) { \
1.50 + printf(" Error: could not construct group.\n"); \
1.51 + res = MP_NO; \
1.52 + goto CLEANUP; \
1.53 + } \
1.54 + MP_CHECKOK( ectest_curve_GFp(group, ectestPrint, ectestTime, 1) ); \
1.55 + printf("... okay.\n");
1.56 +
1.57 +/* Test curve using specific field arithmetic. */
1.58 +#define ECTEST_NAMED_GFP(name_c, name) \
1.59 + printf("Testing %s using specific implementation...\n", name_c); \
1.60 + ECGroup_free(group); \
1.61 + group = ECGroup_fromName(name); \
1.62 + if (group == NULL) { \
1.63 + printf(" Warning: could not construct group.\n"); \
1.64 + printf("... failed; continuing with remaining tests.\n"); \
1.65 + } else { \
1.66 + MP_CHECKOK( ectest_curve_GFp(group, ectestPrint, ectestTime, 0) ); \
1.67 + printf("... okay.\n"); \
1.68 + }
1.69 +
1.70 +/* Performs basic tests of elliptic curve cryptography over prime fields.
1.71 + * If tests fail, then it prints an error message, aborts, and returns an
1.72 + * error code. Otherwise, returns 0. */
1.73 +int
1.74 +ectest_curve_GFp(ECGroup *group, int ectestPrint, int ectestTime,
1.75 + int generic)
1.76 +{
1.77 +
1.78 + mp_int one, order_1, gx, gy, rx, ry, n;
1.79 + int size;
1.80 + mp_err res;
1.81 + char s[1000];
1.82 +
1.83 + /* initialize values */
1.84 + MP_CHECKOK(mp_init(&one));
1.85 + MP_CHECKOK(mp_init(&order_1));
1.86 + MP_CHECKOK(mp_init(&gx));
1.87 + MP_CHECKOK(mp_init(&gy));
1.88 + MP_CHECKOK(mp_init(&rx));
1.89 + MP_CHECKOK(mp_init(&ry));
1.90 + MP_CHECKOK(mp_init(&n));
1.91 +
1.92 + MP_CHECKOK(mp_set_int(&one, 1));
1.93 + MP_CHECKOK(mp_sub(&group->order, &one, &order_1));
1.94 +
1.95 + /* encode base point */
1.96 + if (group->meth->field_dec) {
1.97 + MP_CHECKOK(group->meth->field_dec(&group->genx, &gx, group->meth));
1.98 + MP_CHECKOK(group->meth->field_dec(&group->geny, &gy, group->meth));
1.99 + } else {
1.100 + MP_CHECKOK(mp_copy(&group->genx, &gx));
1.101 + MP_CHECKOK(mp_copy(&group->geny, &gy));
1.102 + }
1.103 + if (ectestPrint) {
1.104 + /* output base point */
1.105 + printf(" base point P:\n");
1.106 + MP_CHECKOK(mp_toradix(&gx, s, 16));
1.107 + printf(" %s\n", s);
1.108 + MP_CHECKOK(mp_toradix(&gy, s, 16));
1.109 + printf(" %s\n", s);
1.110 + if (group->meth->field_enc) {
1.111 + printf(" base point P (encoded):\n");
1.112 + MP_CHECKOK(mp_toradix(&group->genx, s, 16));
1.113 + printf(" %s\n", s);
1.114 + MP_CHECKOK(mp_toradix(&group->geny, s, 16));
1.115 + printf(" %s\n", s);
1.116 + }
1.117 + }
1.118 +
1.119 +#ifdef ECL_ENABLE_GFP_PT_MUL_AFF
1.120 + /* multiply base point by order - 1 and check for negative of base
1.121 + * point */
1.122 + MP_CHECKOK(ec_GFp_pt_mul_aff
1.123 + (&order_1, &group->genx, &group->geny, &rx, &ry, group));
1.124 + if (ectestPrint) {
1.125 + printf(" (order-1)*P (affine):\n");
1.126 + MP_CHECKOK(mp_toradix(&rx, s, 16));
1.127 + printf(" %s\n", s);
1.128 + MP_CHECKOK(mp_toradix(&ry, s, 16));
1.129 + printf(" %s\n", s);
1.130 + }
1.131 + MP_CHECKOK(group->meth->field_neg(&ry, &ry, group->meth));
1.132 + if ((mp_cmp(&rx, &group->genx) != 0)
1.133 + || (mp_cmp(&ry, &group->geny) != 0)) {
1.134 + printf(" Error: invalid result (expected (- base point)).\n");
1.135 + res = MP_NO;
1.136 + goto CLEANUP;
1.137 + }
1.138 +#endif
1.139 +
1.140 +#ifdef ECL_ENABLE_GFP_PT_MUL_AFF
1.141 + /* multiply base point by order - 1 and check for negative of base
1.142 + * point */
1.143 + MP_CHECKOK(ec_GFp_pt_mul_jac
1.144 + (&order_1, &group->genx, &group->geny, &rx, &ry, group));
1.145 + if (ectestPrint) {
1.146 + printf(" (order-1)*P (jacobian):\n");
1.147 + MP_CHECKOK(mp_toradix(&rx, s, 16));
1.148 + printf(" %s\n", s);
1.149 + MP_CHECKOK(mp_toradix(&ry, s, 16));
1.150 + printf(" %s\n", s);
1.151 + }
1.152 + MP_CHECKOK(group->meth->field_neg(&ry, &ry, group->meth));
1.153 + if ((mp_cmp(&rx, &group->genx) != 0)
1.154 + || (mp_cmp(&ry, &group->geny) != 0)) {
1.155 + printf(" Error: invalid result (expected (- base point)).\n");
1.156 + res = MP_NO;
1.157 + goto CLEANUP;
1.158 + }
1.159 +#endif
1.160 +
1.161 + /* multiply base point by order - 1 and check for negative of base
1.162 + * point */
1.163 + MP_CHECKOK(ECPoint_mul(group, &order_1, NULL, NULL, &rx, &ry));
1.164 + if (ectestPrint) {
1.165 + printf(" (order-1)*P (ECPoint_mul):\n");
1.166 + MP_CHECKOK(mp_toradix(&rx, s, 16));
1.167 + printf(" %s\n", s);
1.168 + MP_CHECKOK(mp_toradix(&ry, s, 16));
1.169 + printf(" %s\n", s);
1.170 + }
1.171 + MP_CHECKOK(mp_submod(&group->meth->irr, &ry, &group->meth->irr, &ry));
1.172 + if ((mp_cmp(&rx, &gx) != 0) || (mp_cmp(&ry, &gy) != 0)) {
1.173 + printf(" Error: invalid result (expected (- base point)).\n");
1.174 + res = MP_NO;
1.175 + goto CLEANUP;
1.176 + }
1.177 +
1.178 + /* multiply base point by order - 1 and check for negative of base
1.179 + * point */
1.180 + MP_CHECKOK(ECPoint_mul(group, &order_1, &gx, &gy, &rx, &ry));
1.181 + if (ectestPrint) {
1.182 + printf(" (order-1)*P (ECPoint_mul):\n");
1.183 + MP_CHECKOK(mp_toradix(&rx, s, 16));
1.184 + printf(" %s\n", s);
1.185 + MP_CHECKOK(mp_toradix(&ry, s, 16));
1.186 + printf(" %s\n", s);
1.187 + }
1.188 + MP_CHECKOK(mp_submod(&group->meth->irr, &ry, &group->meth->irr, &ry));
1.189 + if ((mp_cmp(&rx, &gx) != 0) || (mp_cmp(&ry, &gy) != 0)) {
1.190 + printf(" Error: invalid result (expected (- base point)).\n");
1.191 + res = MP_NO;
1.192 + goto CLEANUP;
1.193 + }
1.194 +
1.195 +#ifdef ECL_ENABLE_GFP_PT_MUL_AFF
1.196 + /* multiply base point by order and check for point at infinity */
1.197 + MP_CHECKOK(ec_GFp_pt_mul_aff
1.198 + (&group->order, &group->genx, &group->geny, &rx, &ry,
1.199 + group));
1.200 + if (ectestPrint) {
1.201 + printf(" (order)*P (affine):\n");
1.202 + MP_CHECKOK(mp_toradix(&rx, s, 16));
1.203 + printf(" %s\n", s);
1.204 + MP_CHECKOK(mp_toradix(&ry, s, 16));
1.205 + printf(" %s\n", s);
1.206 + }
1.207 + if (ec_GFp_pt_is_inf_aff(&rx, &ry) != MP_YES) {
1.208 + printf(" Error: invalid result (expected point at infinity).\n");
1.209 + res = MP_NO;
1.210 + goto CLEANUP;
1.211 + }
1.212 +#endif
1.213 +
1.214 +#ifdef ECL_ENABLE_GFP_PT_MUL_JAC
1.215 + /* multiply base point by order and check for point at infinity */
1.216 + MP_CHECKOK(ec_GFp_pt_mul_jac
1.217 + (&group->order, &group->genx, &group->geny, &rx, &ry,
1.218 + group));
1.219 + if (ectestPrint) {
1.220 + printf(" (order)*P (jacobian):\n");
1.221 + MP_CHECKOK(mp_toradix(&rx, s, 16));
1.222 + printf(" %s\n", s);
1.223 + MP_CHECKOK(mp_toradix(&ry, s, 16));
1.224 + printf(" %s\n", s);
1.225 + }
1.226 + if (ec_GFp_pt_is_inf_aff(&rx, &ry) != MP_YES) {
1.227 + printf(" Error: invalid result (expected point at infinity).\n");
1.228 + res = MP_NO;
1.229 + goto CLEANUP;
1.230 + }
1.231 +#endif
1.232 +
1.233 + /* multiply base point by order and check for point at infinity */
1.234 + MP_CHECKOK(ECPoint_mul(group, &group->order, NULL, NULL, &rx, &ry));
1.235 + if (ectestPrint) {
1.236 + printf(" (order)*P (ECPoint_mul):\n");
1.237 + MP_CHECKOK(mp_toradix(&rx, s, 16));
1.238 + printf(" %s\n", s);
1.239 + MP_CHECKOK(mp_toradix(&ry, s, 16));
1.240 + printf(" %s\n", s);
1.241 + }
1.242 + if (ec_GFp_pt_is_inf_aff(&rx, &ry) != MP_YES) {
1.243 + printf(" Error: invalid result (expected point at infinity).\n");
1.244 + res = MP_NO;
1.245 + goto CLEANUP;
1.246 + }
1.247 +
1.248 + /* multiply base point by order and check for point at infinity */
1.249 + MP_CHECKOK(ECPoint_mul(group, &group->order, &gx, &gy, &rx, &ry));
1.250 + if (ectestPrint) {
1.251 + printf(" (order)*P (ECPoint_mul):\n");
1.252 + MP_CHECKOK(mp_toradix(&rx, s, 16));
1.253 + printf(" %s\n", s);
1.254 + MP_CHECKOK(mp_toradix(&ry, s, 16));
1.255 + printf(" %s\n", s);
1.256 + }
1.257 + if (ec_GFp_pt_is_inf_aff(&rx, &ry) != MP_YES) {
1.258 + printf(" Error: invalid result (expected point at infinity).\n");
1.259 + res = MP_NO;
1.260 + goto CLEANUP;
1.261 + }
1.262 +
1.263 + /* check that (order-1)P + (order-1)P + P == (order-1)P */
1.264 + MP_CHECKOK(ECPoints_mul
1.265 + (group, &order_1, &order_1, &gx, &gy, &rx, &ry));
1.266 + MP_CHECKOK(ECPoints_mul(group, &one, &one, &rx, &ry, &rx, &ry));
1.267 + if (ectestPrint) {
1.268 + printf
1.269 + (" (order-1)*P + (order-1)*P + P == (order-1)*P (ECPoints_mul):\n");
1.270 + MP_CHECKOK(mp_toradix(&rx, s, 16));
1.271 + printf(" %s\n", s);
1.272 + MP_CHECKOK(mp_toradix(&ry, s, 16));
1.273 + printf(" %s\n", s);
1.274 + }
1.275 + MP_CHECKOK(mp_submod(&group->meth->irr, &ry, &group->meth->irr, &ry));
1.276 + if ((mp_cmp(&rx, &gx) != 0) || (mp_cmp(&ry, &gy) != 0)) {
1.277 + printf(" Error: invalid result (expected (- base point)).\n");
1.278 + res = MP_NO;
1.279 + goto CLEANUP;
1.280 + }
1.281 +
1.282 + /* test validate_point function */
1.283 + if (ECPoint_validate(group, &gx, &gy) != MP_YES) {
1.284 + printf(" Error: validate point on base point failed.\n");
1.285 + res = MP_NO;
1.286 + goto CLEANUP;
1.287 + }
1.288 + MP_CHECKOK(mp_add_d(&gy, 1, &ry));
1.289 + if (ECPoint_validate(group, &gx, &ry) != MP_NO) {
1.290 + printf(" Error: validate point on invalid point passed.\n");
1.291 + res = MP_NO;
1.292 + goto CLEANUP;
1.293 + }
1.294 +
1.295 + if (ectestTime) {
1.296 + /* compute random scalar */
1.297 + size = mpl_significant_bits(&group->meth->irr);
1.298 + if (size < MP_OKAY) {
1.299 + goto CLEANUP;
1.300 + }
1.301 + MP_CHECKOK(mpp_random_size(&n, (size + ECL_BITS - 1) / ECL_BITS));
1.302 + MP_CHECKOK(group->meth->field_mod(&n, &n, group->meth));
1.303 + /* timed test */
1.304 + if (generic) {
1.305 +#ifdef ECL_ENABLE_GFP_PT_MUL_AFF
1.306 + M_TimeOperation(MP_CHECKOK
1.307 + (ec_GFp_pt_mul_aff
1.308 + (&n, &group->genx, &group->geny, &rx, &ry,
1.309 + group)), 100);
1.310 +#endif
1.311 + M_TimeOperation(MP_CHECKOK
1.312 + (ECPoint_mul(group, &n, NULL, NULL, &rx, &ry)),
1.313 + 100);
1.314 + M_TimeOperation(MP_CHECKOK
1.315 + (ECPoints_mul
1.316 + (group, &n, &n, &gx, &gy, &rx, &ry)), 100);
1.317 + } else {
1.318 + M_TimeOperation(MP_CHECKOK
1.319 + (ECPoint_mul(group, &n, NULL, NULL, &rx, &ry)),
1.320 + 100);
1.321 + M_TimeOperation(MP_CHECKOK
1.322 + (ECPoint_mul(group, &n, &gx, &gy, &rx, &ry)),
1.323 + 100);
1.324 + M_TimeOperation(MP_CHECKOK
1.325 + (ECPoints_mul
1.326 + (group, &n, &n, &gx, &gy, &rx, &ry)), 100);
1.327 + }
1.328 + }
1.329 +
1.330 + CLEANUP:
1.331 + mp_clear(&one);
1.332 + mp_clear(&order_1);
1.333 + mp_clear(&gx);
1.334 + mp_clear(&gy);
1.335 + mp_clear(&rx);
1.336 + mp_clear(&ry);
1.337 + mp_clear(&n);
1.338 + if (res != MP_OKAY) {
1.339 + printf(" Error: exiting with error value %i\n", res);
1.340 + }
1.341 + return res;
1.342 +}
1.343 +
1.344 +/* Prints help information. */
1.345 +void
1.346 +printUsage()
1.347 +{
1.348 + printf("Usage: ecp_test [--print] [--time]\n");
1.349 + printf
1.350 + (" --print Print out results of each point arithmetic test.\n");
1.351 + printf
1.352 + (" --time Benchmark point operations and print results.\n");
1.353 +}
1.354 +
1.355 +/* Performs tests of elliptic curve cryptography over prime fields If
1.356 + * tests fail, then it prints an error message, aborts, and returns an
1.357 + * error code. Otherwise, returns 0. */
1.358 +int
1.359 +main(int argv, char **argc)
1.360 +{
1.361 +
1.362 + int ectestTime = 0;
1.363 + int ectestPrint = 0;
1.364 + int i;
1.365 + ECGroup *group = NULL;
1.366 + ECCurveParams *params = NULL;
1.367 + mp_err res;
1.368 +
1.369 + /* read command-line arguments */
1.370 + for (i = 1; i < argv; i++) {
1.371 + if ((strcasecmp(argc[i], "time") == 0)
1.372 + || (strcasecmp(argc[i], "-time") == 0)
1.373 + || (strcasecmp(argc[i], "--time") == 0)) {
1.374 + ectestTime = 1;
1.375 + } else if ((strcasecmp(argc[i], "print") == 0)
1.376 + || (strcasecmp(argc[i], "-print") == 0)
1.377 + || (strcasecmp(argc[i], "--print") == 0)) {
1.378 + ectestPrint = 1;
1.379 + } else {
1.380 + printUsage();
1.381 + return 0;
1.382 + }
1.383 + }
1.384 +
1.385 + /* generic arithmetic tests */
1.386 + ECTEST_GENERIC_GFP("SECP-160R1", ECCurve_SECG_PRIME_160R1);
1.387 +
1.388 + /* specific arithmetic tests */
1.389 + ECTEST_NAMED_GFP("NIST-P192", ECCurve_NIST_P192);
1.390 + ECTEST_NAMED_GFP("NIST-P224", ECCurve_NIST_P224);
1.391 + ECTEST_NAMED_GFP("NIST-P256", ECCurve_NIST_P256);
1.392 + ECTEST_NAMED_GFP("NIST-P384", ECCurve_NIST_P384);
1.393 + ECTEST_NAMED_GFP("NIST-P521", ECCurve_NIST_P521);
1.394 + ECTEST_NAMED_GFP("ANSI X9.62 PRIME192v1", ECCurve_X9_62_PRIME_192V1);
1.395 + ECTEST_NAMED_GFP("ANSI X9.62 PRIME192v2", ECCurve_X9_62_PRIME_192V2);
1.396 + ECTEST_NAMED_GFP("ANSI X9.62 PRIME192v3", ECCurve_X9_62_PRIME_192V3);
1.397 + ECTEST_NAMED_GFP("ANSI X9.62 PRIME239v1", ECCurve_X9_62_PRIME_239V1);
1.398 + ECTEST_NAMED_GFP("ANSI X9.62 PRIME239v2", ECCurve_X9_62_PRIME_239V2);
1.399 + ECTEST_NAMED_GFP("ANSI X9.62 PRIME239v3", ECCurve_X9_62_PRIME_239V3);
1.400 + ECTEST_NAMED_GFP("ANSI X9.62 PRIME256v1", ECCurve_X9_62_PRIME_256V1);
1.401 + ECTEST_NAMED_GFP("SECP-112R1", ECCurve_SECG_PRIME_112R1);
1.402 + ECTEST_NAMED_GFP("SECP-112R2", ECCurve_SECG_PRIME_112R2);
1.403 + ECTEST_NAMED_GFP("SECP-128R1", ECCurve_SECG_PRIME_128R1);
1.404 + ECTEST_NAMED_GFP("SECP-128R2", ECCurve_SECG_PRIME_128R2);
1.405 + ECTEST_NAMED_GFP("SECP-160K1", ECCurve_SECG_PRIME_160K1);
1.406 + ECTEST_NAMED_GFP("SECP-160R1", ECCurve_SECG_PRIME_160R1);
1.407 + ECTEST_NAMED_GFP("SECP-160R2", ECCurve_SECG_PRIME_160R2);
1.408 + ECTEST_NAMED_GFP("SECP-192K1", ECCurve_SECG_PRIME_192K1);
1.409 + ECTEST_NAMED_GFP("SECP-192R1", ECCurve_SECG_PRIME_192R1);
1.410 + ECTEST_NAMED_GFP("SECP-224K1", ECCurve_SECG_PRIME_224K1);
1.411 + ECTEST_NAMED_GFP("SECP-224R1", ECCurve_SECG_PRIME_224R1);
1.412 + ECTEST_NAMED_GFP("SECP-256K1", ECCurve_SECG_PRIME_256K1);
1.413 + ECTEST_NAMED_GFP("SECP-256R1", ECCurve_SECG_PRIME_256R1);
1.414 + ECTEST_NAMED_GFP("SECP-384R1", ECCurve_SECG_PRIME_384R1);
1.415 + ECTEST_NAMED_GFP("SECP-521R1", ECCurve_SECG_PRIME_521R1);
1.416 + ECTEST_NAMED_GFP("WTLS-6 (112)", ECCurve_WTLS_6);
1.417 + ECTEST_NAMED_GFP("WTLS-7 (160)", ECCurve_WTLS_7);
1.418 + ECTEST_NAMED_GFP("WTLS-8 (112)", ECCurve_WTLS_8);
1.419 + ECTEST_NAMED_GFP("WTLS-9 (160)", ECCurve_WTLS_9);
1.420 + ECTEST_NAMED_GFP("WTLS-12 (224)", ECCurve_WTLS_12);
1.421 +
1.422 + CLEANUP:
1.423 + EC_FreeCurveParams(params);
1.424 + ECGroup_free(group);
1.425 + if (res != MP_OKAY) {
1.426 + printf("Error: exiting with error value %i\n", res);
1.427 + }
1.428 + return res;
1.429 +}
