- BN_CTX_end(ctx);
- if (new_ctx != NULL)
- BN_CTX_free(new_ctx);
- return ret;
- }
-
-
-int ec_GFp_simple_points_make_affine(const EC_GROUP *group, size_t num, EC_POINT *points[], BN_CTX *ctx)
- {
- BN_CTX *new_ctx = NULL;
- BIGNUM *tmp0, *tmp1;
- size_t pow2 = 0;
- BIGNUM **heap = NULL;
- size_t i;
- int ret = 0;
-
- if (num == 0)
- return 1;
-
- if (ctx == NULL)
- {
- ctx = new_ctx = BN_CTX_new();
- if (ctx == NULL)
- return 0;
- }
-
- BN_CTX_start(ctx);
- tmp0 = BN_CTX_get(ctx);
- tmp1 = BN_CTX_get(ctx);
- if (tmp0 == NULL || tmp1 == NULL) goto err;
-
- /* Before converting the individual points, compute inverses of all Z values.
- * Modular inversion is rather slow, but luckily we can do with a single
- * explicit inversion, plus about 3 multiplications per input value.
- */
-
- pow2 = 1;
- while (num > pow2)
- pow2 <<= 1;
- /* Now pow2 is the smallest power of 2 satifsying pow2 >= num.
- * We need twice that. */
- pow2 <<= 1;
-
- heap = OPENSSL_malloc(pow2 * sizeof heap[0]);
- if (heap == NULL) goto err;
-
- /* The array is used as a binary tree, exactly as in heapsort:
- *
- * heap[1]
- * heap[2] heap[3]
- * heap[4] heap[5] heap[6] heap[7]
- * heap[8]heap[9] heap[10]heap[11] heap[12]heap[13] heap[14] heap[15]
- *
- * We put the Z's in the last line;
- * then we set each other node to the product of its two child-nodes (where
- * empty or 0 entries are treated as ones);
- * then we invert heap[1];
- * then we invert each other node by replacing it by the product of its
- * parent (after inversion) and its sibling (before inversion).
- */
- heap[0] = NULL;
- for (i = pow2/2 - 1; i > 0; i--)
- heap[i] = NULL;
- for (i = 0; i < num; i++)
- heap[pow2/2 + i] = &points[i]->Z;
- for (i = pow2/2 + num; i < pow2; i++)
- heap[i] = NULL;
-
- /* set each node to the product of its children */
- for (i = pow2/2 - 1; i > 0; i--)
- {
- heap[i] = BN_new();
- if (heap[i] == NULL) goto err;
-
- if (heap[2*i] != NULL)
- {
- if ((heap[2*i + 1] == NULL) || BN_is_zero(heap[2*i + 1]))
- {
- if (!BN_copy(heap[i], heap[2*i])) goto err;
- }
- else
- {
- if (BN_is_zero(heap[2*i]))
- {
- if (!BN_copy(heap[i], heap[2*i + 1])) goto err;
- }
- else
- {
- if (!group->meth->field_mul(group, heap[i],
- heap[2*i], heap[2*i + 1], ctx)) goto err;
- }
- }
- }
- }
-
- /* invert heap[1] */
- if (!BN_is_zero(heap[1]))
- {
- if (!BN_mod_inverse(heap[1], heap[1], &group->field, ctx))
- {
- ECerr(EC_F_EC_GFP_SIMPLE_POINTS_MAKE_AFFINE, ERR_R_BN_LIB);
- goto err;
- }
- }
- if (group->meth->field_encode != 0)
- {
- /* in the Montgomery case, we just turned R*H (representing H)
- * into 1/(R*H), but we need R*(1/H) (representing 1/H);
- * i.e. we have need to multiply by the Montgomery factor twice */
- if (!group->meth->field_encode(group, heap[1], heap[1], ctx)) goto err;
- if (!group->meth->field_encode(group, heap[1], heap[1], ctx)) goto err;
- }
-
- /* set other heap[i]'s to their inverses */
- for (i = 2; i < pow2/2 + num; i += 2)
- {
- /* i is even */
- if ((heap[i + 1] != NULL) && !BN_is_zero(heap[i + 1]))
- {
- if (!group->meth->field_mul(group, tmp0, heap[i/2], heap[i + 1], ctx)) goto err;
- if (!group->meth->field_mul(group, tmp1, heap[i/2], heap[i], ctx)) goto err;
- if (!BN_copy(heap[i], tmp0)) goto err;
- if (!BN_copy(heap[i + 1], tmp1)) goto err;
- }
- else
- {
- if (!BN_copy(heap[i], heap[i/2])) goto err;
- }
- }
-
- /* we have replaced all non-zero Z's by their inverses, now fix up all the points */
- for (i = 0; i < num; i++)
- {
- EC_POINT *p = points[i];
-
- if (!BN_is_zero(&p->Z))
- {
- /* turn (X, Y, 1/Z) into (X/Z^2, Y/Z^3, 1) */
-
- if (!group->meth->field_sqr(group, tmp1, &p->Z, ctx)) goto err;
- if (!group->meth->field_mul(group, &p->X, &p->X, tmp1, ctx)) goto err;
-
- if (!group->meth->field_mul(group, tmp1, tmp1, &p->Z, ctx)) goto err;
- if (!group->meth->field_mul(group, &p->Y, &p->Y, tmp1, ctx)) goto err;
-
- if (group->meth->field_set_to_one != 0)
- {
- if (!group->meth->field_set_to_one(group, &p->Z, ctx)) goto err;
- }
- else
- {
- if (!BN_one(&p->Z)) goto err;
- }
- p->Z_is_one = 1;
- }
- }
-
- ret = 1;
-
+ BN_CTX_end(ctx);
+ return ret;
+}
+
+/*-
+ * Set s := p, r := 2p.
+ *
+ * For doubling we use Formula 3 from Izu-Takagi "A fast parallel elliptic curve
+ * multiplication resistant against side channel attacks" appendix, as described
+ * at
+ * https://hyperelliptic.org/EFD/g1p/auto-shortw-xz.html#doubling-dbl-2002-it-2
+ *
+ * The input point p will be in randomized Jacobian projective coords:
+ * x = X/Z**2, y=Y/Z**3
+ *
+ * The output points p, s, and r are converted to standard (homogeneous)
+ * projective coords:
+ * x = X/Z, y=Y/Z
+ */
+int ec_GFp_simple_ladder_pre(const EC_GROUP *group,
+ EC_POINT *r, EC_POINT *s,
+ EC_POINT *p, BN_CTX *ctx)
+{
+ BIGNUM *t1, *t2, *t3, *t4, *t5, *t6 = NULL;
+
+ t1 = r->Z;
+ t2 = r->Y;
+ t3 = s->X;
+ t4 = r->X;
+ t5 = s->Y;
+ t6 = s->Z;
+
+ /* convert p: (X,Y,Z) -> (XZ,Y,Z**3) */
+ if (!group->meth->field_mul(group, p->X, p->X, p->Z, ctx)
+ || !group->meth->field_sqr(group, t1, p->Z, ctx)
+ || !group->meth->field_mul(group, p->Z, p->Z, t1, ctx)
+ /* r := 2p */
+ || !group->meth->field_sqr(group, t2, p->X, ctx)
+ || !group->meth->field_sqr(group, t3, p->Z, ctx)
+ || !group->meth->field_mul(group, t4, t3, group->a, ctx)
+ || !BN_mod_sub_quick(t5, t2, t4, group->field)
+ || !BN_mod_add_quick(t2, t2, t4, group->field)
+ || !group->meth->field_sqr(group, t5, t5, ctx)
+ || !group->meth->field_mul(group, t6, t3, group->b, ctx)
+ || !group->meth->field_mul(group, t1, p->X, p->Z, ctx)
+ || !group->meth->field_mul(group, t4, t1, t6, ctx)
+ || !BN_mod_lshift_quick(t4, t4, 3, group->field)
+ /* r->X coord output */
+ || !BN_mod_sub_quick(r->X, t5, t4, group->field)
+ || !group->meth->field_mul(group, t1, t1, t2, ctx)
+ || !group->meth->field_mul(group, t2, t3, t6, ctx)
+ || !BN_mod_add_quick(t1, t1, t2, group->field)
+ /* r->Z coord output */
+ || !BN_mod_lshift_quick(r->Z, t1, 2, group->field)
+ || !EC_POINT_copy(s, p))
+ return 0;
+
+ r->Z_is_one = 0;
+ s->Z_is_one = 0;
+ p->Z_is_one = 0;
+
+ return 1;
+}
+
+/*-
+ * Differential addition-and-doubling using Eq. (9) and (10) from Izu-Takagi
+ * "A fast parallel elliptic curve multiplication resistant against side channel
+ * attacks", as described at
+ * https://hyperelliptic.org/EFD/g1p/auto-shortw-xz.html#ladder-ladd-2002-it-4
+ */
+int ec_GFp_simple_ladder_step(const EC_GROUP *group,
+ EC_POINT *r, EC_POINT *s,
+ EC_POINT *p, BN_CTX *ctx)
+{
+ int ret = 0;
+ BIGNUM *t0, *t1, *t2, *t3, *t4, *t5, *t6, *t7 = NULL;
+
+ BN_CTX_start(ctx);
+ t0 = BN_CTX_get(ctx);
+ t1 = BN_CTX_get(ctx);
+ t2 = BN_CTX_get(ctx);
+ t3 = BN_CTX_get(ctx);
+ t4 = BN_CTX_get(ctx);
+ t5 = BN_CTX_get(ctx);
+ t6 = BN_CTX_get(ctx);
+ t7 = BN_CTX_get(ctx);
+
+ if (t7 == NULL
+ || !group->meth->field_mul(group, t0, r->X, s->X, ctx)
+ || !group->meth->field_mul(group, t1, r->Z, s->Z, ctx)
+ || !group->meth->field_mul(group, t2, r->X, s->Z, ctx)
+ || !group->meth->field_mul(group, t3, r->Z, s->X, ctx)
+ || !group->meth->field_mul(group, t4, group->a, t1, ctx)
+ || !BN_mod_add_quick(t0, t0, t4, group->field)
+ || !BN_mod_add_quick(t4, t3, t2, group->field)
+ || !group->meth->field_mul(group, t0, t4, t0, ctx)
+ || !group->meth->field_sqr(group, t1, t1, ctx)
+ || !BN_mod_lshift_quick(t7, group->b, 2, group->field)
+ || !group->meth->field_mul(group, t1, t7, t1, ctx)
+ || !BN_mod_lshift1_quick(t0, t0, group->field)
+ || !BN_mod_add_quick(t0, t1, t0, group->field)
+ || !BN_mod_sub_quick(t1, t2, t3, group->field)
+ || !group->meth->field_sqr(group, t1, t1, ctx)
+ || !group->meth->field_mul(group, t3, t1, p->X, ctx)
+ || !group->meth->field_mul(group, t0, p->Z, t0, ctx)
+ /* s->X coord output */
+ || !BN_mod_sub_quick(s->X, t0, t3, group->field)
+ /* s->Z coord output */
+ || !group->meth->field_mul(group, s->Z, p->Z, t1, ctx)
+ || !group->meth->field_sqr(group, t3, r->X, ctx)
+ || !group->meth->field_sqr(group, t2, r->Z, ctx)
+ || !group->meth->field_mul(group, t4, t2, group->a, ctx)
+ || !BN_mod_add_quick(t5, r->X, r->Z, group->field)
+ || !group->meth->field_sqr(group, t5, t5, ctx)
+ || !BN_mod_sub_quick(t5, t5, t3, group->field)
+ || !BN_mod_sub_quick(t5, t5, t2, group->field)
+ || !BN_mod_sub_quick(t6, t3, t4, group->field)
+ || !group->meth->field_sqr(group, t6, t6, ctx)
+ || !group->meth->field_mul(group, t0, t2, t5, ctx)
+ || !group->meth->field_mul(group, t0, t7, t0, ctx)
+ /* r->X coord output */
+ || !BN_mod_sub_quick(r->X, t6, t0, group->field)
+ || !BN_mod_add_quick(t6, t3, t4, group->field)
+ || !group->meth->field_sqr(group, t3, t2, ctx)
+ || !group->meth->field_mul(group, t7, t3, t7, ctx)
+ || !group->meth->field_mul(group, t5, t5, t6, ctx)
+ || !BN_mod_lshift1_quick(t5, t5, group->field)
+ /* r->Z coord output */
+ || !BN_mod_add_quick(r->Z, t7, t5, group->field))
+ goto err;
+
+ ret = 1;
+
+ err:
+ BN_CTX_end(ctx);
+ return ret;
+}
+
+/*-
+ * Recovers the y-coordinate of r using Eq. (8) from Brier-Joye, "Weierstrass
+ * Elliptic Curves and Side-Channel Attacks", modified to work in projective
+ * coordinates and return r in Jacobian projective coordinates.
+ *
+ * X4 = two*Y1*X2*Z3*Z2*Z1;
+ * Y4 = two*b*Z3*SQR(Z2*Z1) + Z3*(a*Z2*Z1+X1*X2)*(X1*Z2+X2*Z1) - X3*SQR(X1*Z2-X2*Z1);
+ * Z4 = two*Y1*Z3*SQR(Z2)*Z1;
+ *
+ * Z4 != 0 because:
+ * - Z1==0 implies p is at infinity, which would have caused an early exit in
+ * the caller;
+ * - Z2==0 implies r is at infinity (handled by the BN_is_zero(r->Z) branch);
+ * - Z3==0 implies s is at infinity (handled by the BN_is_zero(s->Z) branch);
+ * - Y1==0 implies p has order 2, so either r or s are infinity and handled by
+ * one of the BN_is_zero(...) branches.
+ */
+int ec_GFp_simple_ladder_post(const EC_GROUP *group,
+ EC_POINT *r, EC_POINT *s,
+ EC_POINT *p, BN_CTX *ctx)
+{
+ int ret = 0;
+ BIGNUM *t0, *t1, *t2, *t3, *t4, *t5, *t6 = NULL;
+
+ if (BN_is_zero(r->Z))
+ return EC_POINT_set_to_infinity(group, r);
+
+ if (BN_is_zero(s->Z)) {
+ /* (X,Y,Z) -> (XZ,YZ**2,Z) */
+ if (!group->meth->field_mul(group, r->X, p->X, p->Z, ctx)
+ || !group->meth->field_sqr(group, r->Z, p->Z, ctx)
+ || !group->meth->field_mul(group, r->Y, p->Y, r->Z, ctx)
+ || !BN_copy(r->Z, p->Z)
+ || !EC_POINT_invert(group, r, ctx))
+ return 0;
+ return 1;
+ }
+
+ BN_CTX_start(ctx);
+ t0 = BN_CTX_get(ctx);
+ t1 = BN_CTX_get(ctx);
+ t2 = BN_CTX_get(ctx);
+ t3 = BN_CTX_get(ctx);
+ t4 = BN_CTX_get(ctx);
+ t5 = BN_CTX_get(ctx);
+ t6 = BN_CTX_get(ctx);
+
+ if (t6 == NULL
+ || !BN_mod_lshift1_quick(t0, p->Y, group->field)
+ || !group->meth->field_mul(group, t1, r->X, p->Z, ctx)
+ || !group->meth->field_mul(group, t2, r->Z, s->Z, ctx)
+ || !group->meth->field_mul(group, t2, t1, t2, ctx)
+ || !group->meth->field_mul(group, t3, t2, t0, ctx)
+ || !group->meth->field_mul(group, t2, r->Z, p->Z, ctx)
+ || !group->meth->field_sqr(group, t4, t2, ctx)
+ || !BN_mod_lshift1_quick(t5, group->b, group->field)
+ || !group->meth->field_mul(group, t4, t4, t5, ctx)
+ || !group->meth->field_mul(group, t6, t2, group->a, ctx)
+ || !group->meth->field_mul(group, t5, r->X, p->X, ctx)
+ || !BN_mod_add_quick(t5, t6, t5, group->field)
+ || !group->meth->field_mul(group, t6, r->Z, p->X, ctx)
+ || !BN_mod_add_quick(t2, t6, t1, group->field)
+ || !group->meth->field_mul(group, t5, t5, t2, ctx)
+ || !BN_mod_sub_quick(t6, t6, t1, group->field)
+ || !group->meth->field_sqr(group, t6, t6, ctx)
+ || !group->meth->field_mul(group, t6, t6, s->X, ctx)
+ || !BN_mod_add_quick(t4, t5, t4, group->field)
+ || !group->meth->field_mul(group, t4, t4, s->Z, ctx)
+ || !BN_mod_sub_quick(t4, t4, t6, group->field)
+ || !group->meth->field_sqr(group, t5, r->Z, ctx)
+ || !group->meth->field_mul(group, r->Z, p->Z, s->Z, ctx)
+ || !group->meth->field_mul(group, r->Z, t5, r->Z, ctx)
+ || !group->meth->field_mul(group, r->Z, r->Z, t0, ctx)
+ /* t3 := X, t4 := Y */
+ /* (X,Y,Z) -> (XZ,YZ**2,Z) */
+ || !group->meth->field_mul(group, r->X, t3, r->Z, ctx)
+ || !group->meth->field_sqr(group, t3, r->Z, ctx)
+ || !group->meth->field_mul(group, r->Y, t4, t3, ctx))
+ goto err;
+
+ ret = 1;
+