diff options
author | Matt Caswell <matt@openssl.org> | 2014-10-28 22:58:56 +0000 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2014-12-08 21:40:47 +0000 |
commit | 5784a52145d0062d42724d4d0fab3b4c82de35ee (patch) | |
tree | e53baaad68ca5ee32a9afca8c7feaae34abbfef8 /crypto/ec | |
parent | c0d439019460def565bb115ecef749833eb4c299 (diff) |
Implement internally opaque bn access from ec
Reviewed-by: Tim Hudson <tjh@openssl.org>
Diffstat (limited to 'crypto/ec')
-rw-r--r-- | crypto/ec/Makefile | 11 | ||||
-rw-r--r-- | crypto/ec/ec2_mult.c | 43 | ||||
-rw-r--r-- | crypto/ec/ec2_oct.c | 10 | ||||
-rw-r--r-- | crypto/ec/ec2_smpl.c | 160 | ||||
-rw-r--r-- | crypto/ec/ec_key.c | 6 | ||||
-rw-r--r-- | crypto/ec/ec_lcl.h | 12 | ||||
-rw-r--r-- | crypto/ec/ec_lib.c | 46 | ||||
-rw-r--r-- | crypto/ec/ec_mult.c | 145 | ||||
-rw-r--r-- | crypto/ec/ec_pmeth.c | 2 | ||||
-rw-r--r-- | crypto/ec/ecp_nist.c | 4 | ||||
-rw-r--r-- | crypto/ec/ecp_nistz256.c | 105 | ||||
-rw-r--r-- | crypto/ec/ecp_oct.c | 40 | ||||
-rw-r--r-- | crypto/ec/ecp_smpl.c | 324 | ||||
-rw-r--r-- | crypto/ec/ectest.c | 11 |
14 files changed, 410 insertions, 509 deletions
diff --git a/crypto/ec/Makefile b/crypto/ec/Makefile index 0d9f3ab256..852183af59 100644 --- a/crypto/ec/Makefile +++ b/crypto/ec/Makefile @@ -5,7 +5,7 @@ DIR= ec TOP= ../.. CC= cc -INCLUDES= -I.. -I$(TOP) -I../../include +INCLUDES= -I.. -I$(TOP) -I../include -I../../include CFLAG=-g MAKEFILE= Makefile AR= ar r @@ -98,7 +98,8 @@ ec2_mult.o: ../../include/openssl/err.h ../../include/openssl/lhash.h ec2_mult.o: ../../include/openssl/obj_mac.h ../../include/openssl/opensslconf.h ec2_mult.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h ec2_mult.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h -ec2_mult.o: ../../include/openssl/symhacks.h ec2_mult.c ec_lcl.h +ec2_mult.o: ../../include/openssl/symhacks.h ../include/internal/bn_int.h +ec2_mult.o: ec2_mult.c ec_lcl.h ec2_oct.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h ec2_oct.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h ec2_oct.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h @@ -114,7 +115,8 @@ ec2_smpl.o: ../../include/openssl/err.h ../../include/openssl/lhash.h ec2_smpl.o: ../../include/openssl/obj_mac.h ../../include/openssl/opensslconf.h ec2_smpl.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h ec2_smpl.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h -ec2_smpl.o: ../../include/openssl/symhacks.h ec2_smpl.c ec_lcl.h +ec2_smpl.o: ../../include/openssl/symhacks.h ../include/internal/bn_int.h +ec2_smpl.o: ec2_smpl.c ec_lcl.h ec_ameth.o: ../../e_os.h ../../include/openssl/asn1.h ec_ameth.o: ../../include/openssl/asn1t.h ../../include/openssl/bio.h ec_ameth.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h @@ -193,7 +195,8 @@ ec_mult.o: ../../include/openssl/err.h ../../include/openssl/lhash.h ec_mult.o: ../../include/openssl/obj_mac.h ../../include/openssl/opensslconf.h ec_mult.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h ec_mult.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h -ec_mult.o: ../../include/openssl/symhacks.h ec_lcl.h ec_mult.c +ec_mult.o: ../../include/openssl/symhacks.h ../include/internal/bn_int.h +ec_mult.o: ec_lcl.h ec_mult.c ec_oct.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h ec_oct.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h ec_oct.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h diff --git a/crypto/ec/ec2_mult.c b/crypto/ec/ec2_mult.c index ed46d58fdd..cc3ec83932 100644 --- a/crypto/ec/ec2_mult.c +++ b/crypto/ec/ec2_mult.c @@ -71,6 +71,7 @@ #include <openssl/err.h> +#include "internal/bn_int.h" #include "ec_lcl.h" #ifndef OPENSSL_NO_EC2M @@ -98,7 +99,7 @@ static int gf2m_Mdouble(const EC_GROUP *group, BIGNUM *x, BIGNUM *z, BN_CTX *ctx if (!group->meth->field_mul(group, z, x, t1, ctx)) goto err; if (!group->meth->field_sqr(group, x, x, ctx)) goto err; if (!group->meth->field_sqr(group, t1, t1, ctx)) goto err; - if (!group->meth->field_mul(group, t1, &group->b, t1, ctx)) goto err; + if (!group->meth->field_mul(group, t1, group->b, t1, ctx)) goto err; if (!BN_GF2m_add(x, x, t1)) goto err; ret = 1; @@ -249,24 +250,24 @@ static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r, z1 = BN_CTX_get(ctx); if (z1 == NULL) goto err; - x2 = &r->X; - z2 = &r->Y; + x2 = r->X; + z2 = r->Y; - bn_wexpand(x1, group->field.top); - bn_wexpand(z1, group->field.top); - bn_wexpand(x2, group->field.top); - bn_wexpand(z2, group->field.top); + bn_wexpand(x1, bn_get_top(group->field)); + bn_wexpand(z1, bn_get_top(group->field)); + bn_wexpand(x2, bn_get_top(group->field)); + bn_wexpand(z2, bn_get_top(group->field)); - if (!BN_GF2m_mod_arr(x1, &point->X, group->poly)) goto err; /* x1 = x */ + if (!BN_GF2m_mod_arr(x1, point->X, group->poly)) goto err; /* x1 = x */ if (!BN_one(z1)) goto err; /* z1 = 1 */ if (!group->meth->field_sqr(group, z2, x1, ctx)) goto err; /* z2 = x1^2 = x^2 */ if (!group->meth->field_sqr(group, x2, z2, ctx)) goto err; - if (!BN_GF2m_add(x2, x2, &group->b)) goto err; /* x2 = x^4 + b */ + if (!BN_GF2m_add(x2, x2, group->b)) goto err; /* x2 = x^4 + b */ /* find top most bit and go one past it */ - i = scalar->top - 1; + i = bn_get_top(scalar) - 1; mask = BN_TBIT; - word = scalar->d[i]; + word = bn_get_words(scalar)[i]; while (!(word & mask)) mask >>= 1; mask >>= 1; /* if top most bit was at word break, go to next word */ @@ -278,22 +279,22 @@ static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r, for (; i >= 0; i--) { - word = scalar->d[i]; + word = bn_get_words(scalar)[i]; while (mask) { - BN_consttime_swap(word & mask, x1, x2, group->field.top); - BN_consttime_swap(word & mask, z1, z2, group->field.top); - if (!gf2m_Madd(group, &point->X, x2, z2, x1, z1, ctx)) goto err; + BN_consttime_swap(word & mask, x1, x2, bn_get_top(group->field)); + BN_consttime_swap(word & mask, z1, z2, bn_get_top(group->field)); + if (!gf2m_Madd(group, point->X, x2, z2, x1, z1, ctx)) goto err; if (!gf2m_Mdouble(group, x1, z1, ctx)) goto err; - BN_consttime_swap(word & mask, x1, x2, group->field.top); - BN_consttime_swap(word & mask, z1, z2, group->field.top); + BN_consttime_swap(word & mask, x1, x2, bn_get_top(group->field)); + BN_consttime_swap(word & mask, z1, z2, bn_get_top(group->field)); mask >>= 1; } mask = BN_TBIT; } /* convert out of "projective" coordinates */ - i = gf2m_Mxy(group, &point->X, &point->Y, x1, z1, x2, z2, ctx); + i = gf2m_Mxy(group, point->X, point->Y, x1, z1, x2, z2, ctx); if (i == 0) goto err; else if (i == 1) { @@ -301,13 +302,13 @@ static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r, } else { - if (!BN_one(&r->Z)) goto err; + if (!BN_one(r->Z)) goto err; r->Z_is_one = 1; } /* GF(2^m) field elements should always have BIGNUM::neg = 0 */ - BN_set_negative(&r->X, 0); - BN_set_negative(&r->Y, 0); + BN_set_negative(r->X, 0); + BN_set_negative(r->Y, 0); ret = 1; diff --git a/crypto/ec/ec2_oct.c b/crypto/ec/ec2_oct.c index f1d75e5ddf..0b1fbea144 100644 --- a/crypto/ec/ec2_oct.c +++ b/crypto/ec/ec2_oct.c @@ -117,13 +117,13 @@ int ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *p if (!BN_GF2m_mod_arr(x, x_, group->poly)) goto err; if (BN_is_zero(x)) { - if (!BN_GF2m_mod_sqrt_arr(y, &group->b, group->poly, ctx)) goto err; + if (!BN_GF2m_mod_sqrt_arr(y, group->b, group->poly, ctx)) goto err; } else { if (!group->meth->field_sqr(group, tmp, x, ctx)) goto err; - if (!group->meth->field_div(group, tmp, &group->b, tmp, ctx)) goto err; - if (!BN_GF2m_add(tmp, &group->a, tmp)) goto err; + if (!group->meth->field_div(group, tmp, group->b, tmp, ctx)) goto err; + if (!BN_GF2m_add(tmp, group->a, tmp)) goto err; if (!BN_GF2m_add(tmp, x, tmp)) goto err; if (!BN_GF2m_mod_solve_quad_arr(z, tmp, group->poly, ctx)) { @@ -359,7 +359,7 @@ int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point, if (yxi == NULL) goto err; if (!BN_bin2bn(buf + 1, field_len, x)) goto err; - if (BN_ucmp(x, &group->field) >= 0) + if (BN_ucmp(x, group->field) >= 0) { ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING); goto err; @@ -372,7 +372,7 @@ int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point, else { if (!BN_bin2bn(buf + 1 + field_len, field_len, y)) goto err; - if (BN_ucmp(y, &group->field) >= 0) + if (BN_ucmp(y, group->field) >= 0) { ECerr(EC_F_EC_GF2M_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING); goto err; diff --git a/crypto/ec/ec2_smpl.c b/crypto/ec/ec2_smpl.c index 6c81df0d44..0bf87e6af9 100644 --- a/crypto/ec/ec2_smpl.c +++ b/crypto/ec/ec2_smpl.c @@ -71,6 +71,7 @@ #include <openssl/err.h> +#include "internal/bn_int.h" #include "ec_lcl.h" #ifndef OPENSSL_NO_EC2M @@ -129,9 +130,17 @@ const EC_METHOD *EC_GF2m_simple_method(void) */ int ec_GF2m_simple_group_init(EC_GROUP *group) { - BN_init(&group->field); - BN_init(&group->a); - BN_init(&group->b); + group->field = BN_new(); + group->a = BN_new(); + group->b = BN_new(); + + if(!group->field || !group->a || !group->b) + { + if(group->field) BN_free(group->field); + if(group->a) BN_free(group->a); + if(group->b) BN_free(group->b); + return 0; + } return 1; } @@ -141,9 +150,9 @@ int ec_GF2m_simple_group_init(EC_GROUP *group) */ void ec_GF2m_simple_group_finish(EC_GROUP *group) { - BN_free(&group->field); - BN_free(&group->a); - BN_free(&group->b); + BN_free(group->field); + BN_free(group->a); + BN_free(group->b); } @@ -152,9 +161,9 @@ void ec_GF2m_simple_group_finish(EC_GROUP *group) */ void ec_GF2m_simple_group_clear_finish(EC_GROUP *group) { - BN_clear_free(&group->field); - BN_clear_free(&group->a); - BN_clear_free(&group->b); + BN_clear_free(group->field); + BN_clear_free(group->a); + BN_clear_free(group->b); group->poly[0] = 0; group->poly[1] = 0; group->poly[2] = 0; @@ -169,20 +178,19 @@ void ec_GF2m_simple_group_clear_finish(EC_GROUP *group) */ int ec_GF2m_simple_group_copy(EC_GROUP *dest, const EC_GROUP *src) { - int i; - if (!BN_copy(&dest->field, &src->field)) return 0; - if (!BN_copy(&dest->a, &src->a)) return 0; - if (!BN_copy(&dest->b, &src->b)) return 0; + if (!BN_copy(dest->field, src->field)) return 0; + if (!BN_copy(dest->a, src->a)) return 0; + if (!BN_copy(dest->b, src->b)) return 0; dest->poly[0] = src->poly[0]; dest->poly[1] = src->poly[1]; dest->poly[2] = src->poly[2]; dest->poly[3] = src->poly[3]; dest->poly[4] = src->poly[4]; dest->poly[5] = src->poly[5]; - if (bn_wexpand(&dest->a, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL) return 0; - if (bn_wexpand(&dest->b, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL) return 0; - for (i = dest->a.top; i < dest->a.dmax; i++) dest->a.d[i] = 0; - for (i = dest->b.top; i < dest->b.dmax; i++) dest->b.d[i] = 0; + if (bn_wexpand(dest->a, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL) return 0; + if (bn_wexpand(dest->b, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL) return 0; + bn_set_all_zero(dest->a); + bn_set_all_zero(dest->b); return 1; } @@ -194,8 +202,8 @@ int ec_GF2m_simple_group_set_curve(EC_GROUP *group, int ret = 0, i; /* group->field */ - if (!BN_copy(&group->field, p)) goto err; - i = BN_GF2m_poly2arr(&group->field, group->poly, 6) - 1; + if (!BN_copy(group->field, p)) goto err; + i = BN_GF2m_poly2arr(group->field, group->poly, 6) - 1; if ((i != 5) && (i != 3)) { ECerr(EC_F_EC_GF2M_SIMPLE_GROUP_SET_CURVE, EC_R_UNSUPPORTED_FIELD); @@ -203,14 +211,14 @@ int ec_GF2m_simple_group_set_curve(EC_GROUP *group, } /* group->a */ - if (!BN_GF2m_mod_arr(&group->a, a, group->poly)) goto err; - if(bn_wexpand(&group->a, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL) goto err; - for (i = group->a.top; i < group->a.dmax; i++) group->a.d[i] = 0; + if (!BN_GF2m_mod_arr(group->a, a, group->poly)) goto err; + if(bn_wexpand(group->a, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL) goto err; + bn_set_all_zero(group->a); /* group->b */ - if (!BN_GF2m_mod_arr(&group->b, b, group->poly)) goto err; - if(bn_wexpand(&group->b, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL) goto err; - for (i = group->b.top; i < group->b.dmax; i++) group->b.d[i] = 0; + if (!BN_GF2m_mod_arr(group->b, b, group->poly)) goto err; + if(bn_wexpand(group->b, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL) goto err; + bn_set_all_zero(group->b); ret = 1; err: @@ -227,17 +235,17 @@ int ec_GF2m_simple_group_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, if (p != NULL) { - if (!BN_copy(p, &group->field)) return 0; + if (!BN_copy(p, group->field)) return 0; } if (a != NULL) { - if (!BN_copy(a, &group->a)) goto err; + if (!BN_copy(a, group->a)) goto err; } if (b != NULL) { - if (!BN_copy(b, &group->b)) goto err; + if (!BN_copy(b, group->b)) goto err; } ret = 1; @@ -250,7 +258,7 @@ int ec_GF2m_simple_group_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, /* Gets the degree of the field. For a curve over GF(2^m) this is the value m. */ int ec_GF2m_simple_group_get_degree(const EC_GROUP *group) { - return BN_num_bits(&group->field)-1; + return BN_num_bits(group->field)-1; } @@ -276,7 +284,7 @@ int ec_GF2m_simple_group_check_discriminant(const EC_GROUP *group, BN_CTX *ctx) b = BN_CTX_get(ctx); if (b == NULL) goto err; - if (!BN_GF2m_mod_arr(b, &group->b, group->poly)) goto err; + if (!BN_GF2m_mod_arr(b, group->b, group->poly)) goto err; /* check the discriminant: * y^2 + x*y = x^3 + a*x^2 + b is an elliptic curve <=> b != 0 (mod p) @@ -297,9 +305,17 @@ err: /* Initializes an EC_POINT. */ int ec_GF2m_simple_point_init(EC_POINT *point) { - BN_init(&point->X); - BN_init(&point->Y); - BN_init(&point->Z); + point->X = BN_new(); + point->Y = BN_new(); + point->Z = BN_new(); + + if(!point->X || !point->Y || !point->Z) + { + if(point->X) BN_free(point->X); + if(point->Y) BN_free(point->Y); + if(point->Z) BN_free(point->Z); + return 0; + } return 1; } @@ -307,18 +323,18 @@ int ec_GF2m_simple_point_init(EC_POINT *point) /* Frees an EC_POINT. */ void ec_GF2m_simple_point_finish(EC_POINT *point) { - BN_free(&point->X); - BN_free(&point->Y); - BN_free(&point->Z); + BN_free(point->X); + BN_free(point->Y); + BN_free(point->Z); } /* Clears and frees an EC_POINT. */ void ec_GF2m_simple_point_clear_finish(EC_POINT *point) { - BN_clear_free(&point->X); - BN_clear_free(&point->Y); - BN_clear_free(&point->Z); + BN_clear_free(point->X); + BN_clear_free(point->Y); + BN_clear_free(point->Z); point->Z_is_one = 0; } @@ -326,9 +342,9 @@ void ec_GF2m_simple_point_clear_finish(EC_POINT *point) /* Copy the contents of one EC_POINT into another. Assumes dest is initialized. */ int ec_GF2m_simple_point_copy(EC_POINT *dest, const EC_POINT *src) { - if (!BN_copy(&dest->X, &src->X)) return 0; - if (!BN_copy(&dest->Y, &src->Y)) return 0; - if (!BN_copy(&dest->Z, &src->Z)) return 0; + if (!BN_copy(dest->X, src->X)) return 0; + if (!BN_copy(dest->Y, src->Y)) return 0; + if (!BN_copy(dest->Z, src->Z)) return 0; dest->Z_is_one = src->Z_is_one; return 1; @@ -341,7 +357,7 @@ int ec_GF2m_simple_point_copy(EC_POINT *dest, const EC_POINT *src) int ec_GF2m_simple_point_set_to_infinity(const EC_GROUP *group, EC_POINT *point) { point->Z_is_one = 0; - BN_zero(&point->Z); + BN_zero(point->Z); return 1; } @@ -359,12 +375,12 @@ int ec_GF2m_simple_point_set_affine_coordinates(const EC_GROUP *group, EC_POINT return 0; } - if (!BN_copy(&point->X, x)) goto err; - BN_set_negative(&point->X, 0); - if (!BN_copy(&point->Y, y)) goto err; - BN_set_negative(&point->Y, 0); - if (!BN_copy(&point->Z, BN_value_one())) goto err; - BN_set_negative(&point->Z, 0); + if (!BN_copy(point->X, x)) goto err; + BN_set_negative(point->X, 0); + if (!BN_copy(point->Y, y)) goto err; + BN_set_negative(point->Y, 0); + if (!BN_copy(point->Z, BN_value_one())) goto err; + BN_set_negative(point->Z, 0); point->Z_is_one = 1; ret = 1; @@ -387,19 +403,19 @@ int ec_GF2m_simple_point_get_affine_coordinates(const EC_GROUP *group, const EC_ return 0; } - if (BN_cmp(&point->Z, BN_value_one())) + if (BN_cmp(point->Z, BN_value_one())) { ECerr(EC_F_EC_GF2M_SIMPLE_POINT_GET_AFFINE_COORDINATES, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); return 0; } if (x != NULL) { - if (!BN_copy(x, &point->X)) goto err; + if (!BN_copy(x, point->X)) goto err; BN_set_negative(x, 0); } if (y != NULL) { - if (!BN_copy(y, &point->Y)) goto err; + if (!BN_copy(y, point->Y)) goto err; BN_set_negative(y, 0); } ret = 1; @@ -449,8 +465,8 @@ int ec_GF2m_simple_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, co if (a->Z_is_one) { - if (!BN_copy(x0, &a->X)) goto err; - if (!BN_copy(y0, &a->Y)) goto err; + if (!BN_copy(x0, a->X)) goto err; + if (!BN_copy(y0, a->Y)) goto err; } else { @@ -458,8 +474,8 @@ int ec_GF2m_simple_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, co } if (b->Z_is_one) { - if (!BN_copy(x1, &b->X)) goto err; - if (!BN_copy(y1, &b->Y)) goto err; + if (!BN_copy(x1, b->X)) goto err; + if (!BN_copy(y1, b->Y)) goto err; } else { @@ -473,7 +489,7 @@ int ec_GF2m_simple_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, co if (!BN_GF2m_add(s, y0, y1)) goto err; if (!group->meth->field_div(group, s, s, t, ctx)) goto err; if (!group->meth->field_sqr(group, x2, s, ctx)) goto err; - if (!BN_GF2m_add(x2, x2, &group->a)) goto err; + if (!BN_GF2m_add(x2, x2, group->a)) goto err; if (!BN_GF2m_add(x2, x2, s)) goto err; if (!BN_GF2m_add(x2, x2, t)) goto err; } @@ -490,7 +506,7 @@ int ec_GF2m_simple_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, co if (!group->meth->field_sqr(group, x2, s, ctx)) goto err; if (!BN_GF2m_add(x2, x2, s)) goto err; - if (!BN_GF2m_add(x2, x2, &group->a)) goto err; + if (!BN_GF2m_add(x2, x2, group->a)) goto err; } if (!BN_GF2m_add(y2, x1, x2)) goto err; @@ -521,19 +537,19 @@ int ec_GF2m_simple_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, BN int ec_GF2m_simple_invert(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx) { - if (EC_POINT_is_at_infinity(group, point) || BN_is_zero(&point->Y)) + if (EC_POINT_is_at_infinity(group, point) || BN_is_zero(point->Y)) /* point is its own inverse */ return 1; if (!EC_POINT_make_affine(group, point, ctx)) return 0; - return BN_GF2m_add(&point->Y, &point->X, &point->Y); + return BN_GF2m_add(point->Y, point->X, point->Y); } /* Indicates whether the given point is the point at infinity. */ int ec_GF2m_simple_is_at_infinity(const EC_GROUP *group, const EC_POINT *point) { - return BN_is_zero(&point->Z); + return BN_is_zero(point->Z); } @@ -575,12 +591,12 @@ int ec_GF2m_simple_is_on_curve(const EC_GROUP *group, const EC_POINT *point, BN_ * <=> x^3 + a*x^2 + x*y + b + y^2 = 0 * <=> ((x + a) * x + y ) * x + b + y^2 = 0 */ - if (!BN_GF2m_add(lh, &point->X, &group->a)) goto err; - if (!field_mul(group, lh, lh, &point->X, ctx)) goto err; - if (!BN_GF2m_add(lh, lh, &point->Y)) goto err; - if (!field_mul(group, lh, lh, &point->X, ctx)) goto err; - if (!BN_GF2m_add(lh, lh, &group->b)) goto err; - if (!field_sqr(group, y2, &point->Y, ctx)) goto err; + if (!BN_GF2m_add(lh, point->X, group->a)) goto err; + if (!field_mul(group, lh, lh, point->X, ctx)) goto err; + if (!BN_GF2m_add(lh, lh, point->Y)) goto err; + if (!field_mul(group, lh, lh, point->X, ctx)) goto err; + if (!BN_GF2m_add(lh, lh, group->b)) goto err; + if (!field_sqr(group, y2, point->Y, ctx)) goto err; if (!BN_GF2m_add(lh, lh, y2)) goto err; ret = BN_is_zero(lh); err: @@ -612,7 +628,7 @@ int ec_GF2m_simple_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT if (a->Z_is_one && b->Z_is_one) { - return ((BN_cmp(&a->X, &b->X) == 0) && BN_cmp(&a->Y, &b->Y) == 0) ? 0 : 1; + return ((BN_cmp(a->X, b->X) == 0) && BN_cmp(a->Y, b->Y) == 0) ? 0 : 1; } if (ctx == NULL) @@ -663,9 +679,9 @@ int ec_GF2m_simple_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *c if (y == NULL) goto err; if (!EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx)) goto err; - if (!BN_copy(&point->X, x)) goto err; - if (!BN_copy(&point->Y, y)) goto err; - if (!BN_one(&point->Z)) goto err; + if (!BN_copy(point->X, x)) goto err; + if (!BN_copy(point->Y, y)) goto err; + if (!BN_one(point->Z)) goto err; ret = 1; @@ -707,7 +723,7 @@ int ec_GF2m_simple_field_sqr(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, /* Wrapper to simple binary polynomial field division implementation. */ int ec_GF2m_simple_field_div(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) { - return BN_GF2m_mod_div(r, a, b, &group->field, ctx); + return BN_GF2m_mod_div(r, a, b, group->field, ctx); } #endif diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c index 9be2f32703..9ce17ae966 100644 --- a/crypto/ec/ec_key.c +++ b/crypto/ec/ec_key.c @@ -326,7 +326,7 @@ int EC_KEY_check_key(const EC_KEY *eckey) goto err; } /* testing whether pub_key * order is the point at infinity */ - order = &eckey->group->order; + order = eckey->group->order; if (BN_is_zero(order)) { ECerr(EC_F_EC_KEY_CHECK_KEY, EC_R_INVALID_GROUP_ORDER); @@ -427,8 +427,8 @@ int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, BIGNUM *x, BIGNUM *y) * field order: if not values are out of range. */ if (BN_cmp(x, tx) || BN_cmp(y, ty) - || (BN_cmp(x, &key->group->field) >= 0) - || (BN_cmp(y, &key->group->field) >= 0)) + || (BN_cmp(x, key->group->field) >= 0) + || (BN_cmp(y, key->group->field) >= 0)) { ECerr(EC_F_EC_KEY_SET_PUBLIC_KEY_AFFINE_COORDINATES, EC_R_COORDINATES_OUT_OF_RANGE); diff --git a/crypto/ec/ec_lcl.h b/crypto/ec/ec_lcl.h index 22b53d28a9..abd73eeee8 100644 --- a/crypto/ec/ec_lcl.h +++ b/crypto/ec/ec_lcl.h @@ -190,7 +190,7 @@ struct ec_group_st { const EC_METHOD *meth; EC_POINT *generator; /* optional */ - BIGNUM order, cofactor; + BIGNUM *order, *cofactor; int curve_name;/* optional NID for named curve */ int asn1_flag; /* flag to control the asn1 encoding */ @@ -204,7 +204,7 @@ struct ec_group_st { /* The following members are handled by the method functions, * even if they appear generic */ - BIGNUM field; /* Field specification. + BIGNUM *field; /* Field specification. * For curves over GF(p), this is the modulus; * for curves over GF(2^m), this is the * irreducible polynomial defining the field. @@ -219,7 +219,7 @@ struct ec_group_st { * non-zero terms. */ - BIGNUM a, b; /* Curve coefficients. + BIGNUM *a, *b; /* Curve coefficients. * (Here the assumption is that BIGNUMs can be used * or abused for all kinds of fields, not just GF(p).) * For characteristic > 3, the curve is defined @@ -280,9 +280,9 @@ struct ec_point_st { /* All members except 'meth' are handled by the method functions, * even if they appear generic */ - BIGNUM X; - BIGNUM Y; - BIGNUM Z; /* Jacobian projective coordinates: + BIGNUM *X; + BIGNUM *Y; + BIGNUM *Z; /* Jacobian projective coordinates: * (X, Y, Z) represents (X/Z^2, Y/Z^3) if Z != 0 */ int Z_is_one; /* enable optimized point arithmetics for special case */ } /* EC_POINT */; diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c index ec5892f7c7..8fb8b089ef 100644 --- a/crypto/ec/ec_lib.c +++ b/crypto/ec/ec_lib.c @@ -103,8 +103,11 @@ EC_GROUP *EC_GROUP_new(const EC_METHOD *meth) ret->mont_data = NULL; ret->generator = NULL; - BN_init(&ret->order); - BN_init(&ret->cofactor); + ret->order = BN_new(); + ret->cofactor = NULL; + if(!ret->order) goto err; + ret->cofactor = BN_new(); + if(!ret->cofactor) goto err; ret->curve_name = 0; ret->asn1_flag = 0; @@ -113,13 +116,14 @@ EC_GROUP *EC_GROUP_new(const EC_METHOD *meth) ret->seed = NULL; ret->seed_len = 0; - if (!meth->group_init(ret)) - { - OPENSSL_free(ret); - return NULL; - } + if (!meth->group_init(ret)) goto err; return ret; +err: + if(ret->order) BN_free(ret->order); + if(ret->cofactor) BN_free(ret->cofactor); + OPENSSL_free(ret); + return NULL; } @@ -137,8 +141,8 @@ void EC_GROUP_free(EC_GROUP *group) if (group->generator != NULL) EC_POINT_free(group->generator); - BN_free(&group->order); - BN_free(&group->cofactor); + BN_free(group->order); + BN_free(group->cofactor); if (group->seed) OPENSSL_free(group->seed); @@ -163,8 +167,8 @@ void EC_GROUP_clear_free(EC_GROUP *group) if (group->generator != NULL) EC_POINT_clear_free(group->generator); - BN_clear_free(&group->order); - BN_clear_free(&group->cofactor); + BN_clear_free(group->order); + BN_clear_free(group->cofactor); if (group->seed) { @@ -244,8 +248,8 @@ int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src) } } - if (!BN_copy(&dest->order, &src->order)) return 0; - if (!BN_copy(&dest->cofactor, &src->cofactor)) return 0; + if (!BN_copy(dest->order, src->order)) return 0; + if (!BN_copy(dest->cofactor, src->cofactor)) return 0; dest->curve_name = src->curve_name; dest->asn1_flag = src->asn1_flag; @@ -325,14 +329,14 @@ int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator, const BIG if (!EC_POINT_copy(group->generator, generator)) return 0; if (order != NULL) - { if (!BN_copy(&group->order, order)) return 0; } + { if (!BN_copy(group->order, order)) return 0; } else - BN_zero(&group->order); + BN_zero(group->order); if (cofactor != NULL) - { if (!BN_copy(&group->cofactor, cofactor)) return 0; } + { if (!BN_copy(group->cofactor, cofactor)) return 0; } else - BN_zero(&group->cofactor); + BN_zero(group->cofactor); /* We ignore the return value because some groups have an order with * factors of two, which makes the Montgomery setup fail. @@ -355,7 +359,7 @@ BN_MONT_CTX *EC_GROUP_get_mont_data(const EC_GROUP *group) int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx) { - if (!BN_copy(order, &group->order)) + if (!BN_copy(order, group->order)) return 0; return !BN_is_zero(order); @@ -364,10 +368,10 @@ int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx) int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor, BN_CTX *ctx) { - if (!BN_copy(cofactor, &group->cofactor)) + if (!BN_copy(cofactor, group->cofactor)) return 0; - return !BN_is_zero(&group->cofactor); + return !BN_is_zero(group->cofactor); } @@ -1152,7 +1156,7 @@ int ec_precompute_mont_data(EC_GROUP *group) if (!group->mont_data) goto err; - if (!BN_MONT_CTX_set(group->mont_data, &group->order, ctx)) + if (!BN_MONT_CTX_set(group->mont_data, group->order, ctx)) { BN_MONT_CTX_free(group->mont_data); group->mont_data = NULL; diff --git a/crypto/ec/ec_mult.c b/crypto/ec/ec_mult.c index b12930d866..3b5be30ff4 100644 --- a/crypto/ec/ec_mult.c +++ b/crypto/ec/ec_mult.c @@ -64,9 +64,9 @@ #include <string.h> - #include <openssl/err.h> +#include "internal/bn_int.h" #include "ec_lcl.h" @@ -184,146 +184,7 @@ static void ec_pre_comp_clear_free(void *pre_) -/* Determine the modified width-(w+1) Non-Adjacent Form (wNAF) of 'scalar'. - * This is an array r[] of values that are either zero or odd with an - * absolute value less than 2^w satisfying - * scalar = \sum_j r[j]*2^j - * where at most one of any w+1 consecutive digits is non-zero - * with the exception that the most significant digit may be only - * w-1 zeros away from that next non-zero digit. - */ -static signed char *compute_wNAF(const BIGNUM *scalar, int w, size_t *ret_len) - { - int window_val; - int ok = 0; - signed char *r = NULL; - int sign = 1; - int bit, next_bit, mask; - size_t len = 0, j; - - if (BN_is_zero(scalar)) - { - r = OPENSSL_malloc(1); - if (!r) - { - ECerr(EC_F_COMPUTE_WNAF, ERR_R_MALLOC_FAILURE); - goto err; - } - r[0] = 0; - *ret_len = 1; - return r; - } - - if (w <= 0 || w > 7) /* 'signed char' can represent integers with absolute values less than 2^7 */ - { - ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR); - goto err; - } - bit = 1 << w; /* at most 128 */ - next_bit = bit << 1; /* at most 256 */ - mask = next_bit - 1; /* at most 255 */ - - if (BN_is_negative(scalar)) - { - sign = -1; - } - - if (scalar->d == NULL || scalar->top == 0) - { - ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR); - goto err; - } - - len = BN_num_bits(scalar); - r = OPENSSL_malloc(len + 1); /* modified wNAF may be one digit longer than binary representation - * (*ret_len will be set to the actual length, i.e. at most - * BN_num_bits(scalar) + 1) */ - if (r == NULL) - { - ECerr(EC_F_COMPUTE_WNAF, ERR_R_MALLOC_FAILURE); - goto err; - } - window_val = scalar->d[0] & mask; - j = 0; - while ((window_val != 0) || (j + w + 1 < len)) /* if j+w+1 >= len, window_val will not increase */ - { - int digit = 0; - - /* 0 <= window_val <= 2^(w+1) */ - - if (window_val & 1) - { - /* 0 < window_val < 2^(w+1) */ - - if (window_val & bit) - { - digit = window_val - next_bit; /* -2^w < digit < 0 */ - -#if 1 /* modified wNAF */ - if (j + w + 1 >= len) - { - /* special case for generating modified wNAFs: - * no new bits will be added into window_val, - * so using a positive digit here will decrease - * the total length of the representation */ - - digit = window_val & (mask >> 1); /* 0 < digit < 2^w */ - } -#endif - } - else - { - digit = window_val; /* 0 < digit < 2^w */ - } - - if (digit <= -bit || digit >= bit || !(digit & 1)) - { - ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR); - goto err; - } - - window_val -= digit; - - /* now window_val is 0 or 2^(w+1) in standard wNAF generation; - * for modified window NAFs, it may also be 2^w - */ - if (window_val != 0 && window_val != next_bit && window_val != bit) - { - ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR); - goto err; - } - } - - r[j++] = sign * digit; - - window_val >>= 1; - window_val += bit * BN_is_bit_set(scalar, j + w); - - if (window_val > next_bit) - { - ECerr(EC_F_COMPUTE_WNAF, ERR_R_INTERNAL_ERROR); - goto err; - } |