abc/GmSSL
1
0
Fork 0
mirror of https://github.com/guanzhi/GmSSL.git synced 2026-05-13 03:46:26 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
b101236292985f9b65cc6aea47e4a4f1b6667a4d
GmSSL/crypto/ec/ecp_sm2p256.c
Zhi Guan 4bab277911 Update sm2 and zuc
2019-01-12 11:56:06 +08:00

2508 lines
77 KiB
C
Raw Blame History

/* ====================================================================
* Copyright (c) 2014 - 2018 The GmSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the GmSSL Project.
* (http://gmssl.org/)"
*
* 4. The name "GmSSL Project" must not be used to endorse or promote
* products derived from this software without prior written
* permission. For written permission, please contact
* guanzhi1980@gmail.com.
*
* 5. Products derived from this software may not be called "GmSSL"
* nor may "GmSSL" appear in their names without prior written
* permission of the GmSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the GmSSL Project
* (http://gmssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE GmSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE GmSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*/
/*
* Copyright 2011-2016 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the OpenSSL license (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
/* Copyright 2011 Google Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
*
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/*
* A 64-bit implementation of the NIST P-256 elliptic curve point multiplication
*
* OpenSSL integration was taken from Emilia Kasper's work in ecp_nistp224.c.
* Otherwise based on Emilia's P224 work, which was inspired by my curve25519
* work which got its smarts from Daniel J. Bernstein's work on the same.
*/
#include <openssl/opensslconf.h>
#ifdef OPENSSL_NO_EC_NISTP_64_GCC_128
NON_EMPTY_TRANSLATION_UNIT
#else
# include <stdint.h>
# include <string.h>
# include <openssl/err.h>
# include "ec_lcl.h"
# if defined(__GNUC__) && (__GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 1))
/* even with gcc, the typedef won't work for 32-bit platforms */
typedef __uint128_t uint128_t; /* nonstandard; implemented by gcc on 64-bit
* platforms */
typedef __int128_t int128_t;
# else
# error "Need GCC 3.1 or later to define type uint128_t"
# endif
typedef uint8_t u8;
typedef uint32_t u32;
typedef uint64_t u64;
typedef int64_t s64;
/*
* The underlying field. SM2-P256 operates over GF(2^256-2^224-2^96+2^64-1).
* We can serialise an element of this field into 32 bytes. We call this an
* felem_bytearray.
*/
typedef u8 felem_bytearray[32];
/*
* These are the parameters of SM2, taken from GM/T 0003.5-2012. These
* values are big-endian.
*/
static const felem_bytearray sm2p256v1_curve_params[5] = {
{0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, /* p */
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF},
{0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, /* a = -3 */
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC},
{0x28, 0xE9, 0xFA, 0x9E, 0x9D, 0x9F, 0x5E, 0x34, /* b */
0x4D, 0x5A, 0x9E, 0x4B, 0xCF, 0x65, 0x09, 0xA7,
0xF3, 0x97, 0x89, 0xF5, 0x15, 0xAB, 0x8F, 0x92,
0xDD, 0xBC, 0xBD, 0x41, 0x4D, 0x94, 0x0E, 0x93},
{0x32, 0xC4, 0xAE, 0x2C, 0x1F, 0x19, 0x81, 0x19, /* x */
0x5F, 0x99, 0x04, 0x46, 0x6A, 0x39, 0xC9, 0x94,
0x8F, 0xE3, 0x0B, 0xBF, 0xF2, 0x66, 0x0B, 0xE1,
0x71, 0x5A, 0x45, 0x89, 0x33, 0x4C, 0x74, 0xC7},
{0xBC, 0x37, 0x36, 0xA2, 0xF4, 0xF6, 0x77, 0x9C, /* y */
0x59, 0xBD, 0xCE, 0xE3, 0x6B, 0x69, 0x21, 0x53,
0xD0, 0xA9, 0x87, 0x7C, 0xC6, 0x2A, 0x47, 0x40,
0x02, 0xDF, 0x32, 0xE5, 0x21, 0x39, 0xF0, 0xA0}
};
/*-
* The representation of field elements.
* ------------------------------------
*
* We represent field elements with either four 128-bit values, eight 128-bit
* values, or four 64-bit values. The field element represented is:
* v[0]*2^0 + v[1]*2^64 + v[2]*2^128 + v[3]*2^192 (mod p)
* or:
* v[0]*2^0 + v[1]*2^64 + v[2]*2^128 + ... + v[8]*2^512 (mod p)
*
* 128-bit values are called 'limbs'. Since the limbs are spaced only 64 bits
* apart, but are 128-bits wide, the most significant bits of each limb overlap
* with the least significant bits of the next.
*
* A field element with four limbs is an 'felem'. One with eight limbs is a
* 'longfelem'
*
* A field element with four, 64-bit values is called a 'smallfelem'. Small
* values are used as intermediate values before multiplication.
*/
# define NLIMBS 4
typedef uint128_t limb;
typedef limb felem[NLIMBS];
typedef limb longfelem[NLIMBS * 2];
typedef u64 smallfelem[NLIMBS];
/* This is the value of the prime as four 64-bit words, little-endian. */
static const u64 kPrime[4] = {
0xfffffffffffffffful, 0xffffffff00000000ul,
0xfffffffffffffffful, 0xfffffffefffffffful};
static const u64 bottom63bits = 0x7ffffffffffffffful;
/*
* bin32_to_felem takes a little-endian byte array and converts it into felem
* form. This assumes that the CPU is little-endian.
*/
static void bin32_to_felem(felem out, const u8 in[32])
{
out[0] = *((u64 *)&in[0]);
out[1] = *((u64 *)&in[8]);
out[2] = *((u64 *)&in[16]);
out[3] = *((u64 *)&in[24]);
}
/*
* smallfelem_to_bin32 takes a smallfelem and serialises into a little
* endian, 32 byte array. This assumes that the CPU is little-endian.
*/
static void smallfelem_to_bin32(u8 out[32], const smallfelem in)
{
*((u64 *)&out[0]) = in[0];
*((u64 *)&out[8]) = in[1];
*((u64 *)&out[16]) = in[2];
*((u64 *)&out[24]) = in[3];
}
/* To preserve endianness when using BN_bn2bin and BN_bin2bn */
static void flip_endian(u8 *out, const u8 *in, unsigned len)
{
unsigned i;
for (i = 0; i < len; ++i)
out[i] = in[len - 1 - i];
}
/* BN_to_felem converts an OpenSSL BIGNUM into an felem */
static int BN_to_felem(felem out, const BIGNUM *bn)
{
felem_bytearray b_in;
felem_bytearray b_out;
unsigned num_bytes;
/* BN_bn2bin eats leading zeroes */
memset(b_out, 0, sizeof(b_out));
num_bytes = BN_num_bytes(bn);
if (num_bytes > sizeof b_out) {
ECerr(EC_F_BN_TO_FELEM, EC_R_BIGNUM_OUT_OF_RANGE);
return 0;
}
if (BN_is_negative(bn)) {
ECerr(EC_F_BN_TO_FELEM, EC_R_BIGNUM_OUT_OF_RANGE);
return 0;
}
num_bytes = BN_bn2bin(bn, b_in);
flip_endian(b_out, b_in, num_bytes);
bin32_to_felem(out, b_out);
return 1;
}
/* felem_to_BN converts an felem into an OpenSSL BIGNUM */
static BIGNUM *smallfelem_to_BN(BIGNUM *out, const smallfelem in)
{
felem_bytearray b_in, b_out;
smallfelem_to_bin32(b_in, in);
flip_endian(b_out, b_in, sizeof b_out);
return BN_bin2bn(b_out, sizeof b_out, out);
}
/*-
* Field operations
* ----------------
*/
static void smallfelem_one(smallfelem out)
{
out[0] = 1;
out[1] = 0;
out[2] = 0;
out[3] = 0;
}
static void smallfelem_assign(smallfelem out, const smallfelem in)
{
out[0] = in[0];
out[1] = in[1];
out[2] = in[2];
out[3] = in[3];
}
static void felem_assign(felem out, const felem in)
{
out[0] = in[0];
out[1] = in[1];
out[2] = in[2];
out[3] = in[3];
}
/* felem_sum sets out = out + in. */
static void felem_sum(felem out, const felem in)
{
out[0] += in[0];
out[1] += in[1];
out[2] += in[2];
out[3] += in[3];
}
/* felem_small_sum sets out = out + in. */
static void felem_small_sum(felem out, const smallfelem in)
{
out[0] += in[0];
out[1] += in[1];
out[2] += in[2];
out[3] += in[3];
}
/* felem_scalar sets out = out * scalar */
static void felem_scalar(felem out, const u64 scalar)
{
out[0] *= scalar;
out[1] *= scalar;
out[2] *= scalar;
out[3] *= scalar;
}
/* longfelem_scalar sets out = out * scalar */
static void longfelem_scalar(longfelem out, const u64 scalar)
{
out[0] *= scalar;
out[1] *= scalar;
out[2] *= scalar;
out[3] *= scalar;
out[4] *= scalar;
out[5] *= scalar;
out[6] *= scalar;
out[7] *= scalar;
}
# define two105m73m41 (((limb)1) << 105) - (((limb)1) << 73) - (((limb)1) << 41)
# define two105m41 (((limb)1) << 105) - (((limb)1) << 41)
# define two105m73 (((limb)1) << 105) - (((limb)1) << 73)
/* zero105 is 0 mod p */
static const felem zero105 =
{ two105m41, two105m73, two105m41, two105m73m41 };
/*-
* smallfelem_neg sets |out| to |-small|
* On exit:
* out[i] < out[i] + 2^105
*/
static void smallfelem_neg(felem out, const smallfelem small)
{
/* In order to prevent underflow, we subtract from 0 mod p. */
out[0] = zero105[0] - small[0];
out[1] = zero105[1] - small[1];
out[2] = zero105[2] - small[2];
out[3] = zero105[3] - small[3];
}
/*-
* felem_diff subtracts |in| from |out|
* On entry:
* in[i] < 2^104
* On exit:
* out[i] < out[i] + 2^105
*/
static void felem_diff(felem out, const felem in)
{
/*
* In order to prevent underflow, we add 0 mod p before subtracting.
*/
out[0] += zero105[0];
out[1] += zero105[1];
out[2] += zero105[2];
out[3] += zero105[3];
out[0] -= in[0];
out[1] -= in[1];
out[2] -= in[2];
out[3] -= in[3];
}
# define two107m75m43 (((limb)1) << 107) - (((limb)1) << 75) - (((limb)1) << 43)
# define two107m43 (((limb)1) << 107) - (((limb)1) << 43)
# define two107m75 (((limb)1) << 107) - (((limb)1) << 75)
/* zero107 is 0 mod p */
static const felem zero107 =
{ two107m43, two107m75, two107m43, two107m75m43 };
/*-
* An alternative felem_diff for larger inputs |in|
* felem_diff_zero107 subtracts |in| from |out|
* On entry:
* in[i] < 2^106
* On exit:
* out[i] < out[i] + 2^107
*/
static void felem_diff_zero107(felem out, const felem in)
{
/*
* In order to prevent underflow, we add 0 mod p before subtracting.
*/
out[0] += zero107[0];
out[1] += zero107[1];
out[2] += zero107[2];
out[3] += zero107[3];
out[0] -= in[0];
out[1] -= in[1];
out[2] -= in[2];
out[3] -= in[3];
}
/*-
* longfelem_diff subtracts |in| from |out|
* On entry:
* in[i] < 7*2^67
* On exit:
* out[i] < out[i] + 2^70 + 2^40
*/
static void longfelem_diff(longfelem out, const longfelem in)
{
static const limb two70m39m7m6 =
(((limb) 1) << 70) - (((limb) 1) << 39)- (((limb) 1) << 7) -
(((limb) 1) << 6);
static const limb two70m40p38 =
(((limb) 1) << 70) - (((limb) 1) << 40) + (((limb) 1) << 38);
static const limb two70m38m7 =
(((limb) 1) << 70) - (((limb) 1) << 38) - (((limb) 1) << 7);
static const limb two70m40m7m6 =
(((limb) 1) << 70) - (((limb) 1) << 40) - (((limb) 1) << 7) -
(((limb) 1) << 6);
static const limb two70m6 = (((limb) 1) << 70) - (((limb) 1) << 6);
/* add 0 mod p to avoid underflow */
out[0] += two70m39m7m6;
out[1] += two70m40p38;
out[2] += two70m38m7;
out[3] += two70m40m7m6;
out[4] += two70m6;
out[5] += two70m6;
out[6] += two70m6;
out[7] += two70m6;
out[0] -= in[0];
out[1] -= in[1];
out[2] -= in[2];
out[3] -= in[3];
out[4] -= in[4];
out[5] -= in[5];
out[6] -= in[6];
out[7] -= in[7];
}
# define two64m32m0 (((limb)1) << 64) - (((limb)1) << 32) - 1
# define two64m0 (((limb)1) << 64) - 1
# define two64m32 (((limb)1) << 64) - (((limb)1) << 32)
/* zero64 == p */
static const felem zero64 = { two64m0, two64m32, two64m0, two64m32m0 };
/*-
* felem_shrink converts an felem into a smallfelem. The result isn't quite
* minimal as the value may be greater than p.
*
* On entry:
* in[i] < 2^109
* On exit:
* out[i] < 2^64
*/
static void felem_shrink(smallfelem out, const felem in)
{
felem tmp;
u64 a, b, mask;
s64 high, low;
static const u64 kPrime3Test = 0x7ffffffefffffffful;
/* Carry 2->3 */
tmp[3] = zero64[3] + in[3] + ((u64)(in[2] >> 64));
/* tmp[3] < 2^110 */
tmp[2] = zero64[2] + (u64)in[2];
tmp[1] = zero64[1] + in[1];
tmp[0] = zero64[0] + in[0];
/* tmp[0] < 2**110, tmp[1] < 2^111, tmp[2] < 2**65 */
/*
* We perform two partial reductions where we eliminate the high-word of
* tmp[3]. We don't update the other words till the end.
*/
a = tmp[3] >> 64; /* a < 2^46 */
tmp[3] = (u64)tmp[3];
tmp[3] += ((limb) a) << 32;
/* tmp[3] < 2^79 */
b = a;
a = tmp[3] >> 64; /* a < 2^15 */
b += a; /* b < 2^46 + 2^15 < 2^47 */
tmp[3] = (u64)tmp[3];
tmp[3] += ((limb) a) << 32;
/* tmp[3] < 2^64 + 2^47 */
/*
* This adjusts the other two words to complete the two partial
* reductions.
*/
tmp[1] += (((limb) b) << 32);
tmp[1] -= b;
tmp[0] += b;
/*
* In order to make space in tmp[3] for the carry from 2 -> 3, we
* conditionally subtract kPrime if tmp[3] is large enough.
*/
high = tmp[3] >> 64;
/* As tmp[3] < 2^65, high is either 1 or 0 */
high <<= 63;
high >>= 63;
/*-
* high is:
* all ones if the high word of tmp[3] is 1
* all zeros if the high word of tmp[3] if 0 */
low = tmp[3];
mask = low >> 63;
/*-
* mask is:
* all ones if the MSB of low is 1
* all zeros if the MSB of low if 0 */
low &= bottom63bits;
low -= kPrime3Test;
/* if low was greater than kPrime3Test then the MSB is zero */
low = ~low;
low >>= 63;
/*-
* low is:
* all ones if low was > kPrime3Test
* all zeros if low was <= kPrime3Test */
mask = (mask & low) | high;
tmp[0] -= mask & kPrime[0];
tmp[1] -= mask & kPrime[1];
tmp[2] -= mask & kPrime[2];
tmp[3] -= mask & kPrime[3];
/* tmp[3] < 2**64 - 2**32 + 1 */
tmp[1] += ((u64)(tmp[0] >> 64));
tmp[0] = (u64)tmp[0];
tmp[2] += ((u64)(tmp[1] >> 64));
tmp[1] = (u64)tmp[1];
tmp[3] += ((u64)(tmp[2] >> 64));
tmp[2] = (u64)tmp[2];
/* tmp[i] < 2^64 */
out[0] = tmp[0];
out[1] = tmp[1];
out[2] = tmp[2];
out[3] = tmp[3];
}
/* smallfelem_expand converts a smallfelem to an felem */
static void smallfelem_expand(felem out, const smallfelem in)
{
out[0] = in[0];
out[1] = in[1];
out[2] = in[2];
out[3] = in[3];
}
/*-
* smallfelem_square sets |out| = |small|^2
* On entry:
* small[i] < 2^64
* On exit:
* out[i] < 7 * 2^64 < 2^67
*/
static void smallfelem_square(longfelem out, const smallfelem small)
{
limb a;
u64 high, low;
a = ((uint128_t) small[0]) * small[0];
low = a;
high = a >> 64;
out[0] = low;
out[1] = high;
a = ((uint128_t) small[0]) * small[1];
low = a;
high = a >> 64;
out[1] += low;
out[1] += low;
out[2] = high;
a = ((uint128_t) small[0]) * small[2];
low = a;
high = a >> 64;
out[2] += low;
out[2] *= 2;
out[3] = high;
a = ((uint128_t) small[0]) * small[3];
low = a;
high = a >> 64;
out[3] += low;
out[4] = high;
a = ((uint128_t) small[1]) * small[2];
low = a;
high = a >> 64;
out[3] += low;
out[3] *= 2;
out[4] += high;
a = ((uint128_t) small[1]) * small[1];
low = a;
high = a >> 64;
out[2] += low;
out[3] += high;
a = ((uint128_t) small[1]) * small[3];
low = a;
high = a >> 64;
out[4] += low;
out[4] *= 2;
out[5] = high;
a = ((uint128_t) small[2]) * small[3];
low = a;
high = a >> 64;
out[5] += low;
out[5] *= 2;
out[6] = high;
out[6] += high;
a = ((uint128_t) small[2]) * small[2];
low = a;
high = a >> 64;
out[4] += low;
out[5] += high;
a = ((uint128_t) small[3]) * small[3];
low = a;
high = a >> 64;
out[6] += low;
out[7] = high;
}
/*-
* felem_square sets |out| = |in|^2
* On entry:
* in[i] < 2^109
* On exit:
* out[i] < 7 * 2^64 < 2^67
*/
static void felem_square(longfelem out, const felem in)
{
u64 small[4];
felem_shrink(small, in);
smallfelem_square(out, small);
}
/*-
* smallfelem_mul sets |out| = |small1| * |small2|
* On entry:
* small1[i] < 2^64
* small2[i] < 2^64
* On exit:
* out[i] < 7 * 2^64 < 2^67
*/
static void smallfelem_mul(longfelem out, const smallfelem small1,
const smallfelem small2)
{
limb a;
u64 high, low;
a = ((uint128_t) small1[0]) * small2[0];
low = a;
high = a >> 64;
out[0] = low;
out[1] = high;
a = ((uint128_t) small1[0]) * small2[1];
low = a;
high = a >> 64;
out[1] += low;
out[2] = high;
a = ((uint128_t) small1[1]) * small2[0];
low = a;
high = a >> 64;
out[1] += low;
out[2] += high;
a = ((uint128_t) small1[0]) * small2[2];
low = a;
high = a >> 64;
out[2] += low;
out[3] = high;
a = ((uint128_t) small1[1]) * small2[1];
low = a;
high = a >> 64;
out[2] += low;
out[3] += high;
a = ((uint128_t) small1[2]) * small2[0];
low = a;
high = a >> 64;
out[2] += low;
out[3] += high;
a = ((uint128_t) small1[0]) * small2[3];
low = a;
high = a >> 64;
out[3] += low;
out[4] = high;
a = ((uint128_t) small1[1]) * small2[2];
low = a;
high = a >> 64;
out[3] += low;
out[4] += high;
a = ((uint128_t) small1[2]) * small2[1];
low = a;
high = a >> 64;
out[3] += low;
out[4] += high;
a = ((uint128_t) small1[3]) * small2[0];
low = a;
high = a >> 64;
out[3] += low;
out[4] += high;
a = ((uint128_t) small1[1]) * small2[3];
low = a;
high = a >> 64;
out[4] += low;
out[5] = high;
a = ((uint128_t) small1[2]) * small2[2];
low = a;
high = a >> 64;
out[4] += low;
out[5] += high;
a = ((uint128_t) small1[3]) * small2[1];
low = a;
high = a >> 64;
out[4] += low;
out[5] += high;
a = ((uint128_t) small1[2]) * small2[3];
low = a;
high = a >> 64;
out[5] += low;
out[6] = high;
a = ((uint128_t) small1[3]) * small2[2];
low = a;
high = a >> 64;
out[5] += low;
out[6] += high;
a = ((uint128_t) small1[3]) * small2[3];
low = a;
high = a >> 64;
out[6] += low;
out[7] = high;
}
/*-
* felem_mul sets |out| = |in1| * |in2|
* On entry:
* in1[i] < 2^109
* in2[i] < 2^109
* On exit:
* out[i] < 7 * 2^64 < 2^67
*/
static void felem_mul(longfelem out, const felem in1, const felem in2)
{
smallfelem small1, small2;
felem_shrink(small1, in1);
felem_shrink(small2, in2);
smallfelem_mul(out, small1, small2);
}
/*-
* felem_small_mul sets |out| = |small1| * |in2|
* On entry:
* small1[i] < 2^64
* in2[i] < 2^109
* On exit:
* out[i] < 7 * 2^64 < 2^67
*/
static void felem_small_mul(longfelem out, const smallfelem small1,
const felem in2)
{
smallfelem small2;
felem_shrink(small2, in2);
smallfelem_mul(out, small1, small2);
}
/*-
* Internal function for the different flavours of felem_reduce.
* felem_reduce_ reduces the higher coefficients in[4]-in[7].
* On entry:
* out[0] >= in[6] + 2^32*in[6] + in[7] + 2^32*in[7]
* out[1] >= in[7] + 2^32*in[4]
* out[2] >= in[5] + 2^32*in[5]
* out[3] >= in[4] + 2^32*in[5] + 2^32*in[6]
* On exit:
* out[0] <= out[0] + in[4] + 2^32*in[5]
* out[1] <= out[1] + in[5] + 2^33*in[6]
* out[2] <= out[2] + in[7] + 2*in[6] + 2^33*in[7]
* out[3] <= out[3] + 2^32*in[4] + 3*in[7]
*/
static void felem_reduce(felem out, const longfelem in)
{
uint128_t a, b, c, d;
a = in[6] + in[7];
b = in[5] + in[7];
c = in[4] + in[7];
d = a + b;
out[3] = in[3] + ((in[4] + in[5] + a * 2) << 32) + in[7];
out[2] = in[2] + (b << 32) + a + in[7];
out[1] = in[1] + ((c + in[6]) << 32) - c;
out[0] = in[0] + (d << 32) + d + in[4];
}
/*
* subtract_u64 sets *result = *result - v and *carry to one if the
* subtraction underflowed.
*/
static void subtract_u64(u64 *result, u64 *carry, u64 v)
{
uint128_t r = *result;
r -= v;
*carry = (r >> 64) & 1;
*result = (u64)r;
}
/*
* felem_contract converts |in| to its unique, minimal representation. On
* entry: in[i] < 2^109
*/
static void felem_contract(smallfelem out, const felem in)
{
unsigned i;
u64 all_equal_so_far = 0, result = 0, carry;
felem_shrink(out, in);
/* small is minimal except that the value might be > p */
all_equal_so_far--;
/*
* We are doing a constant time test if out >= kPrime. We need to compare
* each u64, from most-significant to least significant. For each one, if
* all words so far have been equal (m is all ones) then a non-equal
* result is the answer. Otherwise we continue.
*/
for (i = 3; i < 4; i--) {
u64 equal;
uint128_t a = ((uint128_t) kPrime[i]) - out[i];
/*
* if out[i] > kPrime[i] then a will underflow and the high 64-bits
* will all be set.
*/
result |= all_equal_so_far & ((u64)(a >> 64));
/*
* if kPrime[i] == out[i] then |equal| will be all zeros and the
* decrement will make it all ones.
*/
equal = kPrime[i] ^ out[i];
equal--;
equal &= equal << 32;
equal &= equal << 16;
equal &= equal << 8;
equal &= equal << 4;
equal &= equal << 2;
equal &= equal << 1;
equal = ((s64) equal) >> 63;
all_equal_so_far &= equal;
}
/*
* if all_equal_so_far is still all ones then the two values are equal
* and so out >= kPrime is true.
*/
result |= all_equal_so_far;
/* if out >= kPrime then we subtract kPrime. */
subtract_u64(&out[0], &carry, result & kPrime[0]);
subtract_u64(&out[1], &carry, carry);
subtract_u64(&out[2], &carry, carry);
subtract_u64(&out[3], &carry, carry);
subtract_u64(&out[1], &carry, result & kPrime[1]);
subtract_u64(&out[2], &carry, carry);
subtract_u64(&out[3], &carry, carry);
subtract_u64(&out[2], &carry, result & kPrime[2]);
subtract_u64(&out[3], &carry, carry);
subtract_u64(&out[3], &carry, result & kPrime[3]);
}
static void smallfelem_square_contract(smallfelem out, const smallfelem in)
{
longfelem longtmp;
felem tmp;
smallfelem_square(longtmp, in);
felem_reduce(tmp, longtmp);
felem_contract(out, tmp);
}
static void smallfelem_mul_contract(smallfelem out, const smallfelem in1,
const smallfelem in2)
{
longfelem longtmp;
felem tmp;
smallfelem_mul(longtmp, in1, in2);
felem_reduce(tmp, longtmp);
felem_contract(out, tmp);
}
/*-
* felem_is_zero returns a limb with all bits set if |in| == 0 (mod p) and 0
* otherwise.
* On entry:
* small[i] < 2^64
*/
static limb smallfelem_is_zero(const smallfelem small)
{
limb result;
u64 is_p;
u64 is_zero = small[0] | small[1] | small[2] | small[3];
is_zero--;
is_zero &= is_zero << 32;
is_zero &= is_zero << 16;
is_zero &= is_zero << 8;
is_zero &= is_zero << 4;
is_zero &= is_zero << 2;
is_zero &= is_zero << 1;
is_zero = ((s64) is_zero) >> 63;
is_p = (small[0] ^ kPrime[0]) |
(small[1] ^ kPrime[1]) |
(small[2] ^ kPrime[2]) | (small[3] ^ kPrime[3]);
is_p--;
is_p &= is_p << 32;
is_p &= is_p << 16;
is_p &= is_p << 8;
is_p &= is_p << 4;
is_p &= is_p << 2;
is_p &= is_p << 1;
is_p = ((s64) is_p) >> 63;
is_zero |= is_p;
result = is_zero;
result |= ((limb) is_zero) << 64;
return result;
}
static int smallfelem_is_zero_int(const smallfelem small)
{
return (int)(smallfelem_is_zero(small) & ((limb) 1));
}
/*-
* felem_inv calculates |out| = |in|^{-1}
*/
static void felem_inv(felem out, const felem in)
{
felem ftmp;
felem a1, a2, a3, a4, a5;
longfelem tmp;
unsigned i;
felem_square(tmp, in);
felem_reduce(a1, tmp);
felem_mul(tmp, a1, in);
felem_reduce(a2, tmp);
felem_square(tmp, a2);
felem_reduce(ftmp, tmp);
felem_square(tmp, ftmp);
felem_reduce(ftmp, tmp);
felem_mul(tmp, ftmp, a2);
felem_reduce(a3, tmp);
felem_square(tmp, a3);
felem_reduce(ftmp, tmp);
felem_square(tmp, ftmp);
felem_reduce(ftmp, tmp);
felem_square(tmp, ftmp);
felem_reduce(ftmp, tmp);
felem_square(tmp, ftmp);
felem_reduce(ftmp, tmp);
felem_mul(tmp, ftmp, a3);
felem_reduce(a4, tmp);
felem_square(tmp, a4);
felem_reduce(a5, tmp);
for (i = 1; i < 8; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a4);
felem_reduce(a5, tmp);
for (i = 0; i < 8; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a4);
felem_reduce(a5, tmp);
for (i = 0; i < 4; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a3);
felem_reduce(a5, tmp);
felem_square(tmp, a5);
felem_reduce(a5, tmp);
felem_square(tmp, a5);
felem_reduce(a5, tmp);
felem_mul(tmp, a5, a2);
felem_reduce(a5, tmp);
felem_square(tmp, a5);
felem_reduce(ftmp, tmp);
felem_mul(tmp, ftmp, in);
felem_reduce(a5, tmp);
felem_square(tmp, a5);
felem_reduce(a4, tmp);
felem_mul(tmp, a4, a1);
felem_reduce(a3, tmp);
felem_square(tmp, a4);
felem_reduce(a5, tmp);
for (i = 0; i < 30; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a4);
felem_reduce(a4, tmp);
felem_square(tmp, a4);
felem_reduce(a4, tmp);
felem_mul(tmp, a4, in);
felem_reduce(a4, tmp);
felem_mul(tmp, a4, a2);
felem_reduce(a3, tmp);
for (i = 0; i < 33; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a3);
felem_reduce(a2, tmp);
felem_mul(tmp, a2, a3);
felem_reduce(a3, tmp);
for (i = 0; i < 32; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a3);
felem_reduce(a2, tmp);
felem_mul(tmp, a2, a3);
felem_reduce(a3, tmp);
felem_mul(tmp, a2, a4);
felem_reduce(a4, tmp);
for (i = 0; i < 32; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a3);
felem_reduce(a2, tmp);
felem_mul(tmp, a2, a3);
felem_reduce(a3, tmp);
felem_mul(tmp, a2, a4);
felem_reduce(a4, tmp);
for (i = 0; i < 32; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a3);
felem_reduce(a2, tmp);
felem_mul(tmp, a2, a3);
felem_reduce(a3, tmp);
felem_mul(tmp, a2, a4);
felem_reduce(a4, tmp);
for (i = 0; i < 32; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a3);
felem_reduce(a2, tmp);
felem_mul(tmp, a2, a3);
felem_reduce(a3, tmp);
felem_mul(tmp, a2, a4);
felem_reduce(a4, tmp);
for (i = 0; i < 32; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a4, a5);
felem_reduce(out, tmp);
}
#ifdef SM2_USE_INV_SQR
static void felem_inv_sqr(felem out, const felem in)
{
felem ftmp;
felem a1, a2, a3, a4, a5;
longfelem tmp;
unsigned i;
felem_square(tmp, in);
felem_reduce(a1, tmp);
felem_mul(tmp, a1, in);
felem_reduce(a2, tmp);
felem_square(tmp, a2);
felem_reduce(ftmp, tmp);
felem_square(tmp, ftmp);
felem_reduce(ftmp, tmp);
felem_mul(tmp, ftmp, a2);
felem_reduce(a3, tmp);
felem_square(tmp, a3);
felem_reduce(ftmp, tmp);
felem_square(tmp, ftmp);
felem_reduce(ftmp, tmp);
felem_square(tmp, ftmp);
felem_reduce(ftmp, tmp);
felem_square(tmp, ftmp);
felem_reduce(ftmp, tmp);
felem_mul(tmp, ftmp, a3);
felem_reduce(a4, tmp);
felem_square(tmp, a4);
felem_reduce(a5, tmp);
for (i = 1; i < 8; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a4);
felem_reduce(a5, tmp);
for (i = 0; i < 8; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a4);
felem_reduce(a5, tmp);
for (i = 0; i < 4; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a3);
felem_reduce(a5, tmp);
felem_square(tmp, a5);
felem_reduce(a5, tmp);
felem_square(tmp, a5);
felem_reduce(a5, tmp);
felem_mul(tmp, a5, a2);
felem_reduce(a5, tmp);
felem_square(tmp, a5);
felem_reduce(ftmp, tmp);
felem_mul(tmp, ftmp, in);
felem_reduce(a2, tmp);
felem_mul(tmp, a2, in);
felem_reduce(a4, tmp);
felem_square(tmp, a2);
felem_reduce(a5, tmp);
for (i = 0; i < 30; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a2);
felem_reduce(a3, tmp);
felem_mul(tmp, a3, in);
felem_reduce(a4, tmp);
felem_square(tmp, a4);
felem_reduce(a4, tmp);
for (i = 0; i < 32; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a4);
felem_reduce(a4, tmp);
for (i = 0; i < 32; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a4);
felem_reduce(a2, tmp);
felem_mul(tmp, a3, a2);
felem_reduce(a3, tmp);
felem_mul(tmp, a2, a4);
felem_reduce(a4, tmp);
for (i = 0; i < 32; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a4);
felem_reduce(a2, tmp);
felem_mul(tmp, a3, a2);
felem_reduce(a3, tmp);
felem_mul(tmp, a2, a4);
felem_reduce(a4, tmp);
for (i = 0; i < 32; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a4);
felem_reduce(a2, tmp);
felem_mul(tmp, a3, a2);
felem_reduce(a3, tmp);
felem_mul(tmp, a2, a4);
felem_reduce(a4, tmp);
for (i = 0; i < 32; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a4);
felem_reduce(a2, tmp);
felem_mul(tmp, a3, a2);
felem_reduce(a3, tmp);
felem_mul(tmp, a2, a4);
felem_reduce(a4, tmp);
for (i = 0; i < 32; i++) {
felem_square(tmp, a5);
felem_reduce(a5, tmp);
}
felem_mul(tmp, a5, a3);
felem_reduce(a3, tmp);
felem_square(tmp, a3);
felem_reduce(a3, tmp);
felem_square(tmp, a3);
felem_reduce(out, tmp);
}
#endif
static void smallfelem_inv_contract(smallfelem out, const smallfelem in)
{
felem tmp;
smallfelem_expand(tmp, in);
felem_inv(tmp, tmp);
felem_contract(out, tmp);
}
/*-
* Group operations
* ----------------
*
* Building on top of the field operations we have the operations on the
* elliptic curve group itself. Points on the curve are represented in Jacobian
* coordinates
*/
/*-
* point_double calculates 2*(x_in, y_in, z_in)
*
* The method is taken from:
* http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b
*
* Outputs can equal corresponding inputs, i.e., x_out == x_in is allowed.
* while x_out == y_in is not (maybe this works, but it's not tested).
*/
static void
point_double(felem x_out, felem y_out, felem z_out,
const felem x_in, const felem y_in, const felem z_in)
{
longfelem tmp, tmp2;
felem delta, gamma, beta, alpha, ftmp, ftmp2;
smallfelem small1, small2;
felem_assign(ftmp, x_in);
/* ftmp[i] < 2^106 */
felem_assign(ftmp2, x_in);
/* ftmp2[i] < 2^106 */
/* delta = z^2 */
felem_square(tmp, z_in);
felem_reduce(delta, tmp);
/* delta[i] < 2^101 */
/* gamma = y^2 */
felem_square(tmp, y_in);
felem_reduce(gamma, tmp);
/* gamma[i] < 2^101 */
felem_shrink(small1, gamma);
/* beta = x*gamma */
felem_small_mul(tmp, small1, x_in);
felem_reduce(beta, tmp);
/* beta[i] < 2^101 */
/* alpha = 3*(x-delta)*(x+delta) */
felem_diff(ftmp, delta);
/* ftmp[i] < 2^105 + 2^106 < 2^107 */
felem_sum(ftmp2, delta);
/* ftmp2[i] < 2^105 + 2^106 < 2^107 */
felem_scalar(ftmp2, 3);
/* ftmp2[i] < 3 * 2^107 < 2^109 */
felem_mul(tmp, ftmp, ftmp2);
felem_reduce(alpha, tmp);
felem_shrink(small2, alpha);
/* alpha[i] < 2^101 */
/* x' = alpha^2 - 8*beta */
smallfelem_square(tmp, small2);
felem_reduce(x_out, tmp);
felem_assign(ftmp, beta);
felem_scalar(ftmp, 8);
/* ftmp[i] < 8 * 2^101 = 2^104 */
felem_diff(x_out, ftmp);
/* x_out[i] < 2^105 + 2^101 < 2^106 */
/* z' = (y + z)^2 - gamma - delta */
felem_sum(delta, gamma);
/* delta[i] < 2^101 + 2^101 = 2^102 */
felem_assign(ftmp, y_in);
felem_sum(ftmp, z_in);
/* ftmp[i] < 2^106 + 2^106 = 2^107 */
felem_square(tmp, ftmp);
felem_reduce(z_out, tmp);
felem_diff(z_out, delta);
/* z_out[i] < 2^105 + 2^101 < 2^106 */
/* y' = alpha*(4*beta - x') - 8*gamma^2 */
felem_scalar(beta, 4);
/* beta[i] < 4 * 2^101 = 2^103 */
felem_diff_zero107(beta, x_out);
/* beta[i] < 2^107 + 2^103 < 2^108 */
felem_small_mul(tmp, small2, beta);
/* tmp[i] < 7 * 2^64 < 2^67 */
smallfelem_square(tmp2, small1);
/* tmp2[i] < 7 * 2^64 */
longfelem_scalar(tmp2, 8);
/* tmp2[i] < 8 * 7 * 2^64 = 7 * 2^67 */
longfelem_diff(tmp, tmp2);
/* tmp[i] < 2^67 + 2^70 + 2^40 < 2^71 */
felem_reduce(y_out, tmp);
/* y_out[i] < 2^106 */
}
/*
* point_double_small is the same as point_double, except that it operates on
* smallfelems
*/
static void
point_double_small(smallfelem x_out, smallfelem y_out, smallfelem z_out,
const smallfelem x_in, const smallfelem y_in,
const smallfelem z_in)
{
felem felem_x_out, felem_y_out, felem_z_out;
felem felem_x_in, felem_y_in, felem_z_in;
smallfelem_expand(felem_x_in, x_in);
smallfelem_expand(felem_y_in, y_in);
smallfelem_expand(felem_z_in, z_in);
point_double(felem_x_out, felem_y_out, felem_z_out,
felem_x_in, felem_y_in, felem_z_in);
felem_shrink(x_out, felem_x_out);
felem_shrink(y_out, felem_y_out);
felem_shrink(z_out, felem_z_out);
}
/* copy_conditional copies in to out iff mask is all ones. */
static void copy_conditional(felem out, const felem in, limb mask)
{
unsigned i;
for (i = 0; i < NLIMBS; ++i) {
const limb tmp = mask & (in[i] ^ out[i]);
out[i] ^= tmp;
}
}
/* copy_small_conditional copies in to out iff mask is all ones. */
static void copy_small_conditional(felem out, const smallfelem in, limb mask)
{
unsigned i;
const u64 mask64 = mask;
for (i = 0; i < NLIMBS; ++i) {
out[i] = ((limb) (in[i] & mask64)) | (out[i] & ~mask);
}
}
/*-
* point_add calculates (x1, y1, z1) + (x2, y2, z2)
*
* The method is taken from:
* http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-2007-bl,
* adapted for mixed addition (z2 = 1, or z2 = 0 for the point at infinity).
*
* This function includes a branch for checking whether the two input points
* are equal, (while not equal to the point at infinity). This case never
* happens during single point multiplication, so there is no timing leak for
* ECDH or ECDSA signing.
*/
static void point_add(felem x3, felem y3, felem z3,
const felem x1, const felem y1, const felem z1,
const int mixed, const smallfelem x2,
const smallfelem y2, const smallfelem z2)
{
felem ftmp, ftmp2, ftmp3, ftmp4, ftmp5, ftmp6, x_out, y_out, z_out;
longfelem tmp, tmp2;
smallfelem small1, small2, small3, small4, small5;
limb x_equal, y_equal, z1_is_zero, z2_is_zero;
felem_shrink(small3, z1);
z1_is_zero = smallfelem_is_zero(small3);
z2_is_zero = smallfelem_is_zero(z2);
/* ftmp = z1z1 = z1**2 */
smallfelem_square(tmp, small3);
felem_reduce(ftmp, tmp);
/* ftmp[i] < 2^101 */
felem_shrink(small1, ftmp);
if (!mixed) {
/* ftmp2 = z2z2 = z2**2 */
smallfelem_square(tmp, z2);
felem_reduce(ftmp2, tmp);
/* ftmp2[i] < 2^101 */
felem_shrink(small2, ftmp2);
felem_shrink(small5, x1);
/* u1 = ftmp3 = x1*z2z2 */
smallfelem_mul(tmp, small5, small2);
felem_reduce(ftmp3, tmp);
/* ftmp3[i] < 2^101 */
/* ftmp5 = z1 + z2 */
felem_assign(ftmp5, z1);
felem_small_sum(ftmp5, z2);
/* ftmp5[i] < 2^107 */
/* ftmp5 = (z1 + z2)**2 - (z1z1 + z2z2) = 2z1z2 */
felem_square(tmp, ftmp5);
felem_reduce(ftmp5, tmp);
/* ftmp2 = z2z2 + z1z1 */
felem_sum(ftmp2, ftmp);
/* ftmp2[i] < 2^101 + 2^101 = 2^102 */
felem_diff(ftmp5, ftmp2);
/* ftmp5[i] < 2^105 + 2^101 < 2^106 */
/* ftmp2 = z2 * z2z2 */
smallfelem_mul(tmp, small2, z2);
felem_reduce(ftmp2, tmp);
/* s1 = ftmp2 = y1 * z2**3 */
felem_mul(tmp, y1, ftmp2);
felem_reduce(ftmp6, tmp);
/* ftmp6[i] < 2^101 */
} else {
/*
* We'll assume z2 = 1 (special case z2 = 0 is handled later)
*/
/* u1 = ftmp3 = x1*z2z2 */
felem_assign(ftmp3, x1);
/* ftmp3[i] < 2^106 */
/* ftmp5 = 2z1z2 */
felem_assign(ftmp5, z1);
felem_scalar(ftmp5, 2);
/* ftmp5[i] < 2*2^106 = 2^107 */
/* s1 = ftmp2 = y1 * z2**3 */
felem_assign(ftmp6, y1);
/* ftmp6[i] < 2^106 */
}
/* u2 = x2*z1z1 */
smallfelem_mul(tmp, x2, small1);
felem_reduce(ftmp4, tmp);
/* h = ftmp4 = u2 - u1 */
felem_diff_zero107(ftmp4, ftmp3);
/* ftmp4[i] < 2^107 + 2^101 < 2^108 */
felem_shrink(small4, ftmp4);
x_equal = smallfelem_is_zero(small4);
/* z_out = ftmp5 * h */
felem_small_mul(tmp, small4, ftmp5);
felem_reduce(z_out, tmp);
/* z_out[i] < 2^101 */
/* ftmp = z1 * z1z1 */
smallfelem_mul(tmp, small1, small3);
felem_reduce(ftmp, tmp);
/* s2 = tmp = y2 * z1**3 */
felem_small_mul(tmp, y2, ftmp);
felem_reduce(ftmp5, tmp);
/* r = ftmp5 = (s2 - s1)*2 */
felem_diff_zero107(ftmp5, ftmp6);
/* ftmp5[i] < 2^107 + 2^107 = 2^108 */
felem_scalar(ftmp5, 2);
/* ftmp5[i] < 2^109 */
felem_shrink(small1, ftmp5);
y_equal = smallfelem_is_zero(small1);
if (x_equal && y_equal && !z1_is_zero && !z2_is_zero) {
point_double(x3, y3, z3, x1, y1, z1);
return;
}
/* I = ftmp = (2h)**2 */
felem_assign(ftmp, ftmp4);
felem_scalar(ftmp, 2);
/* ftmp[i] < 2*2^108 = 2^109 */
felem_square(tmp, ftmp);
felem_reduce(ftmp, tmp);
/* J = ftmp2 = h * I */
felem_mul(tmp, ftmp4, ftmp);
felem_reduce(ftmp2, tmp);
/* V = ftmp4 = U1 * I */
felem_mul(tmp, ftmp3, ftmp);
felem_reduce(ftmp4, tmp);
/* x_out = r**2 - J - 2V */
smallfelem_square(tmp, small1);
felem_reduce(x_out, tmp);
felem_assign(ftmp3, ftmp4);
felem_scalar(ftmp4, 2);
felem_sum(ftmp4, ftmp2);
/* ftmp4[i] < 2*2^101 + 2^101 < 2^103 */
felem_diff(x_out, ftmp4);
/* x_out[i] < 2^105 + 2^101 */
/* y_out = r(V-x_out) - 2 * s1 * J */
felem_diff_zero107(ftmp3, x_out);
/* ftmp3[i] < 2^107 + 2^101 < 2^108 */
felem_small_mul(tmp, small1, ftmp3);
felem_mul(tmp2, ftmp6, ftmp2);
longfelem_scalar(tmp2, 2);
/* tmp2[i] < 2*2^67 = 2^68 */
longfelem_diff(tmp, tmp2);
/* tmp[i] < 2^67 + 2^70 + 2^40 < 2^71 */
felem_reduce(y_out, tmp);
/* y_out[i] < 2^106 */
copy_small_conditional(x_out, x2, z1_is_zero);
copy_conditional(x_out, x1, z2_is_zero);
copy_small_conditional(y_out, y2, z1_is_zero);
copy_conditional(y_out, y1, z2_is_zero);
copy_small_conditional(z_out, z2, z1_is_zero);
copy_conditional(z_out, z1, z2_is_zero);
felem_assign(x3, x_out);
felem_assign(y3, y_out);
felem_assign(z3, z_out);
}
/*
* point_add_small is the same as point_add, except that it operates on
* smallfelems
*/
static void point_add_small(smallfelem x3, smallfelem y3, smallfelem z3,
smallfelem x1, smallfelem y1, smallfelem z1,
smallfelem x2, smallfelem y2, smallfelem z2)
{
felem felem_x3, felem_y3, felem_z3;
felem felem_x1, felem_y1, felem_z1;
smallfelem_expand(felem_x1, x1);
smallfelem_expand(felem_y1, y1);
smallfelem_expand(felem_z1, z1);
point_add(felem_x3, felem_y3, felem_z3, felem_x1, felem_y1, felem_z1, 0,
x2, y2, z2);
felem_shrink(x3, felem_x3);
felem_shrink(y3, felem_y3);
felem_shrink(z3, felem_z3);
}
/*-
* Base point pre computation
* --------------------------
*
* Two different sorts of precomputed tables are used in the following code.
* Each contain various points on the curve, where each point is three field
* elements (x, y, z).
*
* For the base point table, z is usually 1 (0 for the point at infinity).
* This table has 2 * 16 elements, starting with the following:
* index | bits | point
* ------+---------+------------------------------
* 0 | 0 0 0 0 | 0G
* 1 | 0 0 0 1 | 1G
* 2 | 0 0 1 0 | 2^64G
* 3 | 0 0 1 1 | (2^64 + 1)G
* 4 | 0 1 0 0 | 2^128G
* 5 | 0 1 0 1 | (2^128 + 1)G
* 6 | 0 1 1 0 | (2^128 + 2^64)G
* 7 | 0 1 1 1 | (2^128 + 2^64 + 1)G
* 8 | 1 0 0 0 | 2^192G
* 9 | 1 0 0 1 | (2^192 + 1)G
* 10 | 1 0 1 0 | (2^192 + 2^64)G
* 11 | 1 0 1 1 | (2^192 + 2^64 + 1)G
* 12 | 1 1 0 0 | (2^192 + 2^128)G
* 13 | 1 1 0 1 | (2^192 + 2^128 + 1)G
* 14 | 1 1 1 0 | (2^192 + 2^128 + 2^64)G
* 15 | 1 1 1 1 | (2^192 + 2^128 + 2^64 + 1)G
* followed by a copy of this with each element multiplied by 2^32.
*
* The reason for this is so that we can clock bits into four different
* locations when doing simple scalar multiplies against the base point,
* and then another four locations using the second 16 elements.
*
* Tables for other points have table[i] = iG for i in 0 .. 16. */
/* gmul is the table of precomputed base points */
static const smallfelem gmul[2][16][3] = {
{{{0, 0, 0, 0},
{0, 0, 0, 0},
{0, 0, 0, 0}},
{{0x715a4589334c74c7, 0x8fe30bbff2660be1, 0x5f9904466a39c994,
0x32c4ae2c1f198119},
{0x2df32e52139f0a0, 0xd0a9877cc62a4740, 0x59bdcee36b692153,
0xbc3736a2f4f6779c},
{1, 0, 0, 0}},
{{0xe18bd546b5824517, 0x673891d791caa486, 0xba220b99df9f9a14,
0x95afbd1155c1da54},
{0x8e4450eb334acdcb, 0xc3c7d1898a53f20d, 0x2eee750f4053017c,
0xe8a6d82c517388c2},
{1, 0, 0, 0}},
{{0xf81c8da9b99fba55, 0x137f6c6149feef6e, 0xcb129aa494da9ad4,
0x82a0f5407d123db6},
{0xfdeca00772c4dbc9, 0xa961b58f0cf58373, 0xecacab94e973f9c3,
0xf12fa4696a22ca3f},
{1, 0, 0, 0}},
{{0xeae3d9a9d13a42ed, 0x2b2308f6484e1b38, 0x3db7b24888c21f3a,
0xb692e5b574d55da9},
{0xd186469de295e5ab, 0xdb61ac1773438e6d, 0x5a924f85544926f9,
0xa175051b0f3fb613},
{1, 0, 0, 0}},
{{0xa72d084f62c8d58b, 0xe3d6467deaf48fd7, 0x8fe75e5a128a56a7,
0xc0023fe7ff2b68bd},
{0x64f67782316815f9, 0xb52b6d9b19a69cd2, 0x5d1ed6fa89cbbade,
0x796c910ee7f4ccdb},
{1, 0, 0, 0}},
{{0x1b2150c1c5f13015, 0xdaaba91b5d952c9b, 0xe8cc24c3f546142,
0x75a34b243705f260},
{0x77d195421cef1339, 0x636644aa0c3a0623, 0x4683df176eeb2444,
0x642ce3bd3535e74d},
{1, 0, 0, 0}},
{{0x4a59ac2c6e7ecc08, 0xaf2b71164f191d63, 0x3622a87fb284554f,
0xd9eb397b441e9cd0},
{0xa66b8a4893b6a54d, 0x26fb89a40b4a663a, 0xafa87501eedfc9f4,
0xf3f000bc66f98108},
{1, 0, 0, 0}},
{{0xad8bc68ce031d616, 0x16888d8ee4003187, 0x44c0757f3bb8b600,
0x793fae7af0164245},
{0x210cd042973f333b, 0x8666ff52dbd25f9, 0x65c5b129f5f7ad5d,
0xe03d7a8d19b3219a},
{1, 0, 0, 0}},
{{0xd68bfbace0e00392, 0x261014f7d3445dc7, 0xd9f46b2714a071ee,
0x1b200af30810b682},
{0xd91d8b12ae69bcd, 0x74a08f17bf8cd981, 0xd822913cf0d2b82d,
0x248b7af0b05bfad2},
{1, 0, 0, 0}},
{{0xba119a049e62f2e2, 0xf278e8a34df05ae5, 0xd269f3564eb5d180,
0x8e74ad0f4f957cb1},
{0x112ff4dabd76e2dd, 0x91373f20630fdb7f, 0xf43eab474992904c,
0x55a5ccc7af3b6db4},
{1, 0, 0, 0}},
{{0x5ad104a8bdd23de9, 0xf5a9e515eb71c2c1, 0x390542a0ba95c174,
0x4c55fb20426491bf},
{0x91525735ef626289, 0xd2ed977f88f09635, 0xfd48731b7a8a8521,
0x8f89a03b8fdebea},
{1, 0, 0, 0}},
{{0x7e8e61ea35eb8e2e, 0x1bb2700db98a762c, 0xd81ea23b7738c17c,
0xf9def2a46dba26a3},
{0x183a7912d05e329f, 0x34664a0896ccde0e, 0x56c22652614283bb,
0x91692899d5ff0513},
{1, 0, 0, 0}},
{{0x449d48d8f3bdbe19, 0xab95de03cc8510cb, 0xaef159463f8bfb25,
0xda72c379dae3ca8b},
{0xcba9315ce82cc3ea, 0x4e524bac38a58020, 0x36ba2752538e348c,
0xb170d0da75ed450f},
{1, 0, 0, 0}},
{{0x947af0f52b4f8da6, 0x7eda17d917827976, 0x5ba79a0c705853a0,
0xa5d9873b3fb2ddc7},
{0xc2a48162a5fd9ce9, 0x80ee8ae526f25f02, 0xf60c8ef6633be6a9,
0xe2e23f0229a84a35},
{1, 0, 0, 0}},
{{0xbc4945bd86bb6afb, 0x237eb711eba46fee, 0x7c1db58b7b86eb33,
0xd94eb728273b3ac7},
{0xbe1717e59568d0a4, 0x4a6067cc45f70212, 0x19b32eb5afc2fb17,
0xbe3c1e7ac3ac9d3c},
{1, 0, 0, 0}}},
{{{0, 0, 0, 0},
{0, 0, 0, 0},
{0, 0, 0, 0}},
{{0x68a88405ae53c1e9, 0x51e46707fd558656, 0x71e834cf86896c10,
0x3d251b54e10d581f},
{0x1884d5b0eeb19032, 0xeeaf729853e526fe, 0x5931f6831a8d8c11,
0x87891d33fb98b4d8},
{1, 0, 0, 0}},
{{0x9047673fcac14893, 0xf5df5d83bfb58659, 0xa6230c81642e71a,
0xef14b33800777791},
{0xcf1e99afa3386fca, 0x7ace937791313d53, 0x36fe159b6dcd01bb,
0xc9bc50d02e2b960a},
{1, 0, 0, 0}},
{{0x716e5a7ee12e162d, 0xbbf9bb2c62dd5a00, 0xca235ccb4144dd05,
0xbcb7de0f8f70520e},
{0x981e8964947cb8eb, 0x53c7102ea04de08d, 0xe9076332afc6a10d,
0x93d90f776b58c35d},
{1, 0, 0, 0}},
{{0x834dbff6678337ee, 0xc607e811fef0785a, 0xaaefc62be30a298b,
0xeb5ca335326afad3},
{0x9774fe1384af54a8, 0xca4b6ef5785388b4, 0x1346c82d66f6c642,
0xedcc0c2aaa2d53ce},
{1, 0, 0, 0}},
{{0xb896b3f764b9e6f4, 0x47e4018c736fb3d0, 0xfc2fc86707413920,
0x1a8526428e1aeae7},
{0x1386802650e2ae60, 0x7474dedc995384d0, 0x2c4cc396dd43b011,
0x63b0e9c7141de1b0},
{1, 0, 0, 0}},
{{0xeb5fb3b369d17771, 0x1fe07b18933ed257, 0xdfc4c81ce3673912,
0x913614c66a91a647},
{0x18aee853c0ba877f, 0x3109c2deceff091, 0x8532307e7e4ee08c,
0xcef0791a6e6ce0bb},
{1, 0, 0, 0}},
{{0xf0e9f5d8057a4a0f, 0xbbf7f8b49f125aa9, 0x51e8fdd6283187c2,
0xe0997d4759d36298},
{0x67ec3c5c6f4221c3, 0x3ea275dbc860722f, 0x152d01e23859f5e2,
0xfb57404312680f44},
{1, 0, 0, 0}},
{{0x21ac3df849be2a1f, 0x11006e9fc51d112f, 0x9151aa584775c857,
0x5159d218ba04a8d9},
{0x98b7d1a925fd1866, 0x8f4753cafc2ad9d8, 0x8eb91ec1569c05a9,
0x4abbd1ae27e13f11},
{1, 0, 0, 0}},
{{0x616f6644b2c11f4c, 0x251cd7140e540758, 0xf927a40110f02017,
0x92ff3cc3c1c941b6},
{0x3249906213f565fe, 0x4633e3ddeb9dbd4e, 0xea9a9d1ec402e6c2,
0xdc84ce34b14bb7cf},
{1, 0, 0, 0}},
{{0xa93e23e5436ff69a, 0x52dcb0a79b63efce, 0x34f6538a9e90cb41,
0x9cac08f200234bc0},
{0x6661825b5174a02d, 0x7d4d06de036be57, 0x589d74610ae6bd27,
0xa296f5577fc91a93},
{1, 0, 0, 0}},
{{0x10acefa9d29721d0, 0x8b0f6b8bb5bcd340, 0x921d318c3d86785c,
0xd6916f3bc16aa378},
{0x2a0d646a7ad84a0e, 0x7b93256c2fe7e97a, 0x5765e27626479e41,
0xae9da2272daaced3},
{1, 0, 0, 0}},
{{0x56fdc215f7f34ac5, 0xebcb4ff2da3877d3, 0x1eb96792aba6b832,
0x807ce6bea24741aa},
{0xff1c10109c721fb4, 0xd187d4bc796353a7, 0x7639ae749af2d303,
0xaff6d783d56c9286},
{1, 0, 0, 0}},
{{0x6002d51b6290dd01, 0xcba3ab0099a836a5, 0x71776611e00d2528,
0xfaf2cb8c87fce119},
{0xd445228bdf6882ae, 0xcbbfade17cbce919, 0x837b6335a2eb2453,
0x11ad7c4b8597f6b6},
{1, 0, 0, 0}},
{{0x48de8f368cf2e399, 0x7ae3d25630a74277, 0xdef1a9a6c505323f,
0xe55f203b4b8d9672},
{0xc58d8f0d9a1e6e97, 0xe160e6d4b2737a76, 0xd60bd087d47cbdd8,
0x687d41364d5fef53},
{1, 0, 0, 0}},
{{0x83f21bbe056bbf9b, 0x4c2a9d120b4ba5ab, 0xff383d1845b64e4f,
0x8f13cc8d06dd7867},
{0xf3a292d8424f0995, 0xfd2546eae7cbe44b, 0x67d14dee6c1e75a3,
0x53b49e6cc93fb5a8},
{1, 0, 0, 0}}}
};
/*
* select_point selects the |idx|th point from a precomputation table and
* copies it to out.
*/
static void select_point(const u64 idx, unsigned int size,
const smallfelem pre_comp[16][3], smallfelem out[3])
{
unsigned j;
u64 *outlimbs = &out[0][0];
#ifdef SM2_NO_CONST_TIME
const u64 *inlimbs = (u64 *)&pre_comp[idx][0][0];
for (j = 0; j < NLIMBS * 3; j++) {
outlimbs[j] = inlimbs[j];
}
#else
int i;
memset(out, 0, sizeof(*out) * 3);
for (i = 0; i < size; i++) {
const u64 *inlimbs = (u64 *)&pre_comp[i][0][0];
u64 mask = i ^ idx;
mask |= mask >> 4;
mask |= mask >> 2;
mask |= mask >> 1;
mask &= 1;
mask--;
for (j = 0; j < NLIMBS * 3; j++)
outlimbs[j] |= inlimbs[j] & mask;
}
#endif
}
/* get_bit returns the |i|th bit in |in| */
static char get_bit(const felem_bytearray in, int i)
{
if ((i < 0) || (i >= 256))
return 0;
return (in[i >> 3] >> (i & 7)) & 1;
}
/*
* Interleaved point multiplication using precomputed point multiples: The
* small point multiples 0*P, 1*P, ..., 17*P are in pre_comp[], the scalars
* in scalars[]. If g_scalar is non-NULL, we also add this multiple of the
* generator, using certain (large) precomputed multiples in g_pre_comp.
* Output point (X, Y, Z) is stored in x_out, y_out, z_out
*/
static void batch_mul(felem x_out, felem y_out, felem z_out,
const felem_bytearray scalars[],
const unsigned num_points, const u8 *g_scalar,
const int mixed, const smallfelem pre_comp[][17][3],
const smallfelem g_pre_comp[2][16][3])
{
int i, skip;
unsigned num, gen_mul = (g_scalar != NULL);
felem nq[3], ftmp;
smallfelem tmp[3];
u64 bits;
u8 sign, digit;
/* set nq to the point at infinity */
memset(nq, 0, sizeof(nq));
/*
* Loop over all scalars msb-to-lsb, interleaving additions of multiples
* of the generator (two in each of the last 32 rounds) and additions of
* other points multiples (every 5th round).
*/
skip = 1; /* save two point operations in the first
* round */
for (i = (num_points ? 255 : 31); i >= 0; --i) {
/* double */
if (!skip)
point_double(nq[0], nq[1], nq[2], nq[0], nq[1], nq[2]);
/* add multiples of the generator */
if (gen_mul && (i <= 31)) {
/* first, look 32 bits upwards */
bits = get_bit(g_scalar, i + 224) << 3;
bits |= get_bit(g_scalar, i + 160) << 2;
bits |= get_bit(g_scalar, i + 96) << 1;
bits |= get_bit(g_scalar, i + 32);
/* select the point to add, in constant time */
select_point(bits, 16, g_pre_comp[1], tmp);
if (!skip) {
/* Arg 1 below is for "mixed" */
point_add(nq[0], nq[1], nq[2],
nq[0], nq[1], nq[2], 1, tmp[0], tmp[1], tmp[2]);
} else {
smallfelem_expand(nq[0], tmp[0]);
smallfelem_expand(nq[1], tmp[1]);
smallfelem_expand(nq[2], tmp[2]);
skip = 0;
}
/* second, look at the current position */
bits = get_bit(g_scalar, i + 192) << 3;
bits |= get_bit(g_scalar, i + 128) << 2;
bits |= get_bit(g_scalar, i + 64) << 1;
bits |= get_bit(g_scalar, i);
/* select the point to add, in constant time */
select_point(bits, 16, g_pre_comp[0], tmp);
/* Arg 1 below is for "mixed" */
point_add(nq[0], nq[1], nq[2],
nq[0], nq[1], nq[2], 1, tmp[0], tmp[1], tmp[2]);
}
/* do other additions every 5 doublings */
if (num_points && (i % 5 == 0)) {
/* loop over all scalars */
for (num = 0; num < num_points; ++num) {
bits = get_bit(scalars[num], i + 4) << 5;
bits |= get_bit(scalars[num], i + 3) << 4;
bits |= get_bit(scalars[num], i + 2) << 3;
bits |= get_bit(scalars[num], i + 1) << 2;
bits |= get_bit(scalars[num], i) << 1;
bits |= get_bit(scalars[num], i - 1);
ec_GFp_nistp_recode_scalar_bits(&sign, &digit, bits);
/*
* select the point to add or subtract, in constant time
*/
select_point(digit, 17, pre_comp[num], tmp);
smallfelem_neg(ftmp, tmp[1]); /* (X, -Y, Z) is the negative
* point */
copy_small_conditional(ftmp, tmp[1], (((limb) sign) - 1));
felem_contract(tmp[1], ftmp);
if (!skip) {
point_add(nq[0], nq[1], nq[2],
nq[0], nq[1], nq[2],
mixed, tmp[0], tmp[1], tmp[2]);
} else {
smallfelem_expand(nq[0], tmp[0]);
smallfelem_expand(nq[1], tmp[1]);
smallfelem_expand(nq[2], tmp[2]);
skip = 0;
}
}
}
}
felem_assign(x_out, nq[0]);
felem_assign(y_out, nq[1]);
felem_assign(z_out, nq[2]);
}
/* Precomputation for the group generator. */
struct sm2p256_pre_comp_st {
smallfelem g_pre_comp[2][16][3];
int references;
CRYPTO_RWLOCK *lock;
};
const EC_METHOD *EC_GFp_sm2p256_method(void)
{
static const EC_METHOD ret = {
EC_FLAGS_DEFAULT_OCT,
NID_X9_62_prime_field,
ec_GFp_sm2p256_group_init,
ec_GFp_simple_group_finish,
ec_GFp_simple_group_clear_finish,
ec_GFp_nist_group_copy,
ec_GFp_sm2p256_group_set_curve,
ec_GFp_simple_group_get_curve,
ec_GFp_simple_group_get_degree,
ec_group_simple_order_bits,
ec_GFp_simple_group_check_discriminant,
ec_GFp_simple_point_init,
ec_GFp_simple_point_finish,
ec_GFp_simple_point_clear_finish,
ec_GFp_simple_point_copy,
ec_GFp_simple_point_set_to_infinity,
ec_GFp_simple_set_Jprojective_coordinates_GFp,
ec_GFp_simple_get_Jprojective_coordinates_GFp,
ec_GFp_simple_point_set_affine_coordinates,
ec_GFp_sm2p256_point_get_affine_coordinates,
0 /* point_set_compressed_coordinates */ ,
0 /* point2oct */ ,
0 /* oct2point */ ,
ec_GFp_simple_add,
ec_GFp_simple_dbl,
ec_GFp_simple_invert,
ec_GFp_simple_is_at_infinity,
ec_GFp_simple_is_on_curve,
ec_GFp_simple_cmp,
ec_GFp_simple_make_affine,
ec_GFp_simple_points_make_affine,
ec_GFp_sm2p256_points_mul,
ec_GFp_sm2p256_precompute_mult,
ec_GFp_sm2p256_have_precompute_mult,
ec_GFp_nist_field_mul,
ec_GFp_nist_field_sqr,
0 /* field_div */ ,
0 /* field_encode */ ,
0 /* field_decode */ ,
0, /* field_set_to_one */
ec_key_simple_priv2oct,
ec_key_simple_oct2priv,
0, /* set private */
ec_key_simple_generate_key,
ec_key_simple_check_key,
ec_key_simple_generate_public_key,
0, /* keycopy */
0, /* keyfinish */
ecdh_simple_compute_key
};
return &ret;
}
/******************************************************************************/
/*
* FUNCTIONS TO MANAGE PRECOMPUTATION
*/
static SM2P256_PRE_COMP *sm2p256_pre_comp_new()
{
SM2P256_PRE_COMP *ret = OPENSSL_zalloc(sizeof(*ret));
if (ret == NULL) {
ECerr(EC_F_SM2P256_PRE_COMP_NEW, ERR_R_MALLOC_FAILURE);
return ret;
}
ret->references = 1;
ret->lock = CRYPTO_THREAD_lock_new();
if (ret->lock == NULL) {
ECerr(EC_F_SM2P256_PRE_COMP_NEW, ERR_R_MALLOC_FAILURE);
OPENSSL_free(ret);
return NULL;
}
return ret;
}
SM2P256_PRE_COMP *EC_sm2p256_pre_comp_dup(SM2P256_PRE_COMP *p)
{
int i;
if (p != NULL)
CRYPTO_atomic_add(&p->references, 1, &i, p->lock);
return p;
}
void EC_sm2p256_pre_comp_free(SM2P256_PRE_COMP *pre)
{
int i;
if (pre == NULL)
return;
CRYPTO_atomic_add(&pre->references, -1, &i, pre->lock);
REF_PRINT_COUNT("EC_sm2p256", x);
if (i > 0)
return;
REF_ASSERT_ISNT(i < 0);
CRYPTO_THREAD_lock_free(pre->lock);
OPENSSL_free(pre);
}
/******************************************************************************/
/*
* OPENSSL EC_METHOD FUNCTIONS
*/
int ec_GFp_sm2p256_group_init(EC_GROUP *group)
{
int ret;
ret = ec_GFp_simple_group_init(group);
group->a_is_minus3 = 1;
return ret;
}
int ec_GFp_sm2p256_group_set_curve(EC_GROUP *group, const BIGNUM *p,
const BIGNUM *a, const BIGNUM *b,
BN_CTX *ctx)
{
int ret = 0;
BN_CTX *new_ctx = NULL;
BIGNUM *curve_p, *curve_a, *curve_b;
if (ctx == NULL)
if ((ctx = new_ctx = BN_CTX_new()) == NULL)
return 0;
BN_CTX_start(ctx);
if (((curve_p = BN_CTX_get(ctx)) == NULL) ||
((curve_a = BN_CTX_get(ctx)) == NULL) ||
((curve_b = BN_CTX_get(ctx)) == NULL))
goto err;
BN_bin2bn(sm2p256v1_curve_params[0], sizeof(felem_bytearray), curve_p);
BN_bin2bn(sm2p256v1_curve_params[1], sizeof(felem_bytearray), curve_a);
BN_bin2bn(sm2p256v1_curve_params[2], sizeof(felem_bytearray), curve_b);
if ((BN_cmp(curve_p, p)) || (BN_cmp(curve_a, a)) || (BN_cmp(curve_b, b))) {
ECerr(EC_F_EC_GFP_SM2P256_GROUP_SET_CURVE,
EC_R_WRONG_CURVE_PARAMETERS);
goto err;
}
group->field_mod_func = BN_sm2_mod_256;
ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
err:
BN_CTX_end(ctx);
BN_CTX_free(new_ctx);
return ret;
}
/*
* Takes the Jacobian coordinates (X, Y, Z) of a point and returns (X', Y') =
* (X/Z^2, Y/Z^3)
*/
int ec_GFp_sm2p256_point_get_affine_coordinates(const EC_GROUP *group,
const EC_POINT *point,
BIGNUM *x, BIGNUM *y,
BN_CTX *ctx)
{
felem z1, z2, x_in, y_in;
smallfelem x_out, y_out;
longfelem tmp;
if (EC_POINT_is_at_infinity(group, point)) {
ECerr(EC_F_EC_GFP_SM2P256_POINT_GET_AFFINE_COORDINATES,
EC_R_POINT_AT_INFINITY);
return 0;
}
if ((!BN_to_felem(x_in, point->X)) || (!BN_to_felem(y_in, point->Y)) ||
(!BN_to_felem(z1, point->Z)))
return 0;
#ifdef SM2_USE_INV_SQR
/* z2 = z^-2 */
felem_inv_sqr(z2, z1);
felem_mul(tmp, x_in, z2);
#else
felem_inv(z2, z1);
felem_square(tmp, z2);
felem_reduce(z1, tmp);
felem_mul(tmp, x_in, z1);
#endif
felem_reduce(x_in, tmp);
felem_contract(x_out, x_in);
if (x != NULL) {
if (!smallfelem_to_BN(x, x_out)) {
ECerr(EC_F_EC_GFP_SM2P256_POINT_GET_AFFINE_COORDINATES,
ERR_R_BN_LIB);
return 0;
}
}
if (y != NULL) {
#ifdef SM2_USE_INV_SQR
felem_square(tmp, z2);
felem_reduce(z2, tmp);
felem_mul(tmp, z1, z2);
#else
felem_mul(tmp, z1, z2);
#endif
felem_reduce(z1, tmp);
felem_mul(tmp, y_in, z1);
felem_reduce(y_in, tmp);
felem_contract(y_out, y_in);
if (!smallfelem_to_BN(y, y_out)) {
ECerr(EC_F_EC_GFP_SM2P256_POINT_GET_AFFINE_COORDINATES,
ERR_R_BN_LIB);
return 0;
}
}
return 1;
}
/* points below is of size |num|, and tmp_smallfelems is of size |num+1| */
static void make_points_affine(size_t num, smallfelem points[][3],
smallfelem tmp_smallfelems[])
{
/*
* Runs in constant time, unless an input is the point at infinity (which
* normally shouldn't happen).
*/
ec_GFp_nistp_points_make_affine_internal(num,
points,
sizeof(smallfelem),
tmp_smallfelems,
(void (*)(void *))smallfelem_one,
(int (*)(const void *))
smallfelem_is_zero_int,
(void (*)(void *, const void *))
smallfelem_assign,
(void (*)(void *, const void *))
smallfelem_square_contract,
(void (*)
(void *, const void *,
const void *))
smallfelem_mul_contract,
(void (*)(void *, const void *))
smallfelem_inv_contract,
/* nothing to contract */
(void (*)(void *, const void *))
smallfelem_assign);
}
/*
* Computes scalar*generator + \sum scalars[i]*points[i], ignoring NULL
* values Result is stored in r (r can equal one of the inputs).
*/
int ec_GFp_sm2p256_points_mul(const EC_GROUP *group, EC_POINT *r,
const BIGNUM *scalar, size_t num,
const EC_POINT *points[],
const BIGNUM *scalars[], BN_CTX *ctx)
{
int ret = 0;
int j;
int mixed = 0;
BN_CTX *new_ctx = NULL;
BIGNUM *x, *y, *z, *tmp_scalar;
felem_bytearray g_secret;
felem_bytearray *secrets = NULL;
smallfelem (*pre_comp)[17][3] = NULL;
smallfelem *tmp_smallfelems = NULL;
felem_bytearray tmp;
unsigned i, num_bytes;
int have_pre_comp = 0;
size_t num_points = num;
smallfelem x_in, y_in, z_in;
felem x_out, y_out, z_out;
SM2P256_PRE_COMP *pre = NULL;
const smallfelem(*g_pre_comp)[16][3] = NULL;
EC_POINT *generator = NULL;
const EC_POINT *p = NULL;
const BIGNUM *p_scalar = NULL;
if (ctx == NULL)
if ((ctx = new_ctx = BN_CTX_new()) == NULL)
return 0;
BN_CTX_start(ctx);
if (((x = BN_CTX_get(ctx)) == NULL) ||
((y = BN_CTX_get(ctx)) == NULL) ||
((z = BN_CTX_get(ctx)) == NULL) ||
((tmp_scalar = BN_CTX_get(ctx)) == NULL))
goto err;
if (scalar != NULL) {
pre = group->pre_comp.sm2p256;
if (pre)
/* we have precomputation, try to use it */
g_pre_comp = (const smallfelem(*)[16][3])pre->g_pre_comp;
else {
/* try to use the standard precomputation */
g_pre_comp = &gmul[0];
}
generator = EC_POINT_new(group);
if (generator == NULL)
goto err;
/* get the generator from precomputation */
if (!smallfelem_to_BN(x, g_pre_comp[0][1][0]) ||
!smallfelem_to_BN(y, g_pre_comp[0][1][1]) ||
!smallfelem_to_BN(z, g_pre_comp[0][1][2])) {
ECerr(EC_F_EC_GFP_SM2P256_POINTS_MUL, ERR_R_BN_LIB);
goto err;
}
if (!EC_POINT_set_Jprojective_coordinates_GFp(group,
generator, x, y, z,
ctx))
goto err;
if (0 == EC_POINT_cmp(group, generator, group->generator, ctx))
/* precomputation matches generator */
have_pre_comp = 1;
else
/*
* we don't have valid precomputation: treat the generator as a
* random point
*/
num_points++;
}
if (num_points > 0) {
if (num_points >= 3) {
/*
* unless we precompute multiples for just one or two points,
* converting those into affine form is time well spent
*/
mixed = 1;
}
secrets = OPENSSL_malloc(sizeof(*secrets) * num_points);
pre_comp = OPENSSL_malloc(sizeof(*pre_comp) * num_points);
if (mixed)
tmp_smallfelems =
OPENSSL_malloc(sizeof(*tmp_smallfelems) * (num_points * 17 + 1));
if ((secrets == NULL) || (pre_comp == NULL)
|| (mixed && (tmp_smallfelems == NULL))) {
ECerr(EC_F_EC_GFP_SM2P256_POINTS_MUL, ERR_R_MALLOC_FAILURE);
goto err;
}
/*
* we treat NULL scalars as 0, and NULL points as points at infinity,
* i.e., they contribute nothing to the linear combination
*/
memset(secrets, 0, sizeof(*secrets) * num_points);
memset(pre_comp, 0, sizeof(*pre_comp) * num_points);
for (i = 0; i < num_points; ++i) {
if (i == num)
/*
* we didn't have a valid precomputation, so we pick the
* generator
*/
{
p = EC_GROUP_get0_generator(group);
p_scalar = scalar;
} else
/* the i^th point */
{
p = points[i];
p_scalar = scalars[i];
}
if ((p_scalar != NULL) && (p != NULL)) {
/* reduce scalar to 0 <= scalar < 2^256 */
if ((BN_num_bits(p_scalar) > 256)
|| (BN_is_negative(p_scalar))) {
/*
* this is an unusual input, and we don't guarantee
* constant-timeness
*/
if (!BN_nnmod(tmp_scalar, p_scalar, group->order, ctx)) {
ECerr(EC_F_EC_GFP_SM2P256_POINTS_MUL, ERR_R_BN_LIB);
goto err;
}
num_bytes = BN_bn2bin(tmp_scalar, tmp);
} else
num_bytes = BN_bn2bin(p_scalar, tmp);
flip_endian(secrets[i], tmp, num_bytes);
/* precompute multiples */
if ((!BN_to_felem(x_out, p->X)) ||
(!BN_to_felem(y_out, p->Y)) ||
(!BN_to_felem(z_out, p->Z)))
goto err;
felem_shrink(pre_comp[i][1][0], x_out);
felem_shrink(pre_comp[i][1][1], y_out);
felem_shrink(pre_comp[i][1][2], z_out);
for (j = 2; j <= 16; ++j) {
if (j & 1) {
point_add_small(pre_comp[i][j][0], pre_comp[i][j][1],
pre_comp[i][j][2], pre_comp[i][1][0],
pre_comp[i][1][1], pre_comp[i][1][2],
pre_comp[i][j - 1][0],
pre_comp[i][j - 1][1],
pre_comp[i][j - 1][2]);
} else {
point_double_small(pre_comp[i][j][0],
pre_comp[i][j][1],
pre_comp[i][j][2],
pre_comp[i][j / 2][0],
pre_comp[i][j / 2][1],
pre_comp[i][j / 2][2]);
}
}
}
}
if (mixed)
make_points_affine(num_points * 17, pre_comp[0], tmp_smallfelems);
}
/* the scalar for the generator */
if ((scalar != NULL) && (have_pre_comp)) {
memset(g_secret, 0, sizeof(g_secret));
/* reduce scalar to 0 <= scalar < 2^256 */
if ((BN_num_bits(scalar) > 256) || (BN_is_negative(scalar))) {
/*
* this is an unusual input, and we don't guarantee
* constant-timeness
*/
if (!BN_nnmod(tmp_scalar, scalar, group->order, ctx)) {
ECerr(EC_F_EC_GFP_SM2P256_POINTS_MUL, ERR_R_BN_LIB);
goto err;
}
num_bytes = BN_bn2bin(tmp_scalar, tmp);
} else
num_bytes = BN_bn2bin(scalar, tmp);
flip_endian(g_secret, tmp, num_bytes);
/* do the multiplication with generator precomputation */
batch_mul(x_out, y_out, z_out,
(const felem_bytearray(*))secrets, num_points,
g_secret,
mixed, (const smallfelem(*)[17][3])pre_comp, g_pre_comp);
} else
/* do the multiplication without generator precomputation */
batch_mul(x_out, y_out, z_out,
(const felem_bytearray(*))secrets, num_points,
NULL, mixed, (const smallfelem(*)[17][3])pre_comp, NULL);
/* reduce the output to its unique minimal representation */
felem_contract(x_in, x_out);
felem_contract(y_in, y_out);
felem_contract(z_in, z_out);
if ((!smallfelem_to_BN(x, x_in)) || (!smallfelem_to_BN(y, y_in)) ||
(!smallfelem_to_BN(z, z_in))) {
ECerr(EC_F_EC_GFP_SM2P256_POINTS_MUL, ERR_R_BN_LIB);
goto err;
}
ret = EC_POINT_set_Jprojective_coordinates_GFp(group, r, x, y, z, ctx);
err:
BN_CTX_end(ctx);
EC_POINT_free(generator);
BN_CTX_free(new_ctx);
OPENSSL_free(secrets);
OPENSSL_free(pre_comp);
OPENSSL_free(tmp_smallfelems);
return ret;
}
int ec_GFp_sm2p256_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
{
int ret = 0;
SM2P256_PRE_COMP *pre = NULL;
int i, j;
BN_CTX *new_ctx = NULL;
BIGNUM *x, *y;
EC_POINT *generator = NULL;
smallfelem tmp_smallfelems[32];
felem x_tmp, y_tmp, z_tmp;
/* throw away old precomputation */
EC_pre_comp_free(group);
if (ctx == NULL)
if ((ctx = new_ctx = BN_CTX_new()) == NULL)
return 0;
BN_CTX_start(ctx);
if (((x = BN_CTX_get(ctx)) == NULL) || ((y = BN_CTX_get(ctx)) == NULL))
goto err;
/* get the generator */
if (group->generator == NULL)
goto err;
generator = EC_POINT_new(group);
if (generator == NULL)
goto err;
BN_bin2bn(sm2p256v1_curve_params[3], sizeof(felem_bytearray), x);
BN_bin2bn(sm2p256v1_curve_params[4], sizeof(felem_bytearray), y);
if (!EC_POINT_set_affine_coordinates_GFp(group, generator, x, y, ctx))
goto err;
if ((pre = sm2p256_pre_comp_new()) == NULL)
goto err;
/*
* if the generator is the standard one, use built-in precomputation
*/
if (0 == EC_POINT_cmp(group, generator, group->generator, ctx)) {
memcpy(pre->g_pre_comp, gmul, sizeof(pre->g_pre_comp));
goto done;
}
if ((!BN_to_felem(x_tmp, group->generator->X)) ||
(!BN_to_felem(y_tmp, group->generator->Y)) ||
(!BN_to_felem(z_tmp, group->generator->Z)))
goto err;
felem_shrink(pre->g_pre_comp[0][1][0], x_tmp);
felem_shrink(pre->g_pre_comp[0][1][1], y_tmp);
felem_shrink(pre->g_pre_comp[0][1][2], z_tmp);
/*
* compute 2^64*G, 2^128*G, 2^192*G for the first table, 2^32*G, 2^96*G,
* 2^160*G, 2^224*G for the second one
*/
for (i = 1; i <= 8; i <<= 1) {
point_double_small(pre->g_pre_comp[1][i][0], pre->g_pre_comp[1][i][1],
pre->g_pre_comp[1][i][2], pre->g_pre_comp[0][i][0],
pre->g_pre_comp[0][i][1],
pre->g_pre_comp[0][i][2]);
for (j = 0; j < 31; ++j) {
point_double_small(pre->g_pre_comp[1][i][0],
pre->g_pre_comp[1][i][1],
pre->g_pre_comp[1][i][2],
pre->g_pre_comp[1][i][0],
pre->g_pre_comp[1][i][1],
pre->g_pre_comp[1][i][2]);
}
if (i == 8)
break;
point_double_small(pre->g_pre_comp[0][2 * i][0],
pre->g_pre_comp[0][2 * i][1],
pre->g_pre_comp[0][2 * i][2],
pre->g_pre_comp[1][i][0], pre->g_pre_comp[1][i][1],
pre->g_pre_comp[1][i][2]);
for (j = 0; j < 31; ++j) {
point_double_small(pre->g_pre_comp[0][2 * i][0],
pre->g_pre_comp[0][2 * i][1],
pre->g_pre_comp[0][2 * i][2],
pre->g_pre_comp[0][2 * i][0],
pre->g_pre_comp[0][2 * i][1],
pre->g_pre_comp[0][2 * i][2]);
}
}
for (i = 0; i < 2; i++) {
/* g_pre_comp[i][0] is the point at infinity */
memset(pre->g_pre_comp[i][0], 0, sizeof(pre->g_pre_comp[i][0]));
/* the remaining multiples */
/* 2^64*G + 2^128*G resp. 2^96*G + 2^160*G */
point_add_small(pre->g_pre_comp[i][6][0], pre->g_pre_comp[i][6][1],
pre->g_pre_comp[i][6][2], pre->g_pre_comp[i][4][0],
pre->g_pre_comp[i][4][1], pre->g_pre_comp[i][4][2],
pre->g_pre_comp[i][2][0], pre->g_pre_comp[i][2][1],
pre->g_pre_comp[i][2][2]);
/* 2^64*G + 2^192*G resp. 2^96*G + 2^224*G */
point_add_small(pre->g_pre_comp[i][10][0], pre->g_pre_comp[i][10][1],
pre->g_pre_comp[i][10][2], pre->g_pre_comp[i][8][0],
pre->g_pre_comp[i][8][1], pre->g_pre_comp[i][8][2],
pre->g_pre_comp[i][2][0], pre->g_pre_comp[i][2][1],
pre->g_pre_comp[i][2][2]);
/* 2^128*G + 2^192*G resp. 2^160*G + 2^224*G */
point_add_small(pre->g_pre_comp[i][12][0], pre->g_pre_comp[i][12][1],
pre->g_pre_comp[i][12][2], pre->g_pre_comp[i][8][0],
pre->g_pre_comp[i][8][1], pre->g_pre_comp[i][8][2],
pre->g_pre_comp[i][4][0], pre->g_pre_comp[i][4][1],
pre->g_pre_comp[i][4][2]);
/*
* 2^64*G + 2^128*G + 2^192*G resp. 2^96*G + 2^160*G + 2^224*G
*/
point_add_small(pre->g_pre_comp[i][14][0], pre->g_pre_comp[i][14][1],
pre->g_pre_comp[i][14][2], pre->g_pre_comp[i][12][0],
pre->g_pre_comp[i][12][1], pre->g_pre_comp[i][12][2],
pre->g_pre_comp[i][2][0], pre->g_pre_comp[i][2][1],
pre->g_pre_comp[i][2][2]);
for (j = 1; j < 8; ++j) {
/* odd multiples: add G resp. 2^32*G */
point_add_small(pre->g_pre_comp[i][2 * j + 1][0],
pre->g_pre_comp[i][2 * j + 1][1],
pre->g_pre_comp[i][2 * j + 1][2],
pre->g_pre_comp[i][2 * j][0],
pre->g_pre_comp[i][2 * j][1],
pre->g_pre_comp[i][2 * j][2],
pre->g_pre_comp[i][1][0],
pre->g_pre_comp[i][1][1],
pre->g_pre_comp[i][1][2]);
}
}
make_points_affine(31, &(pre->g_pre_comp[0][1]), tmp_smallfelems);
done:
SETPRECOMP(group, sm2p256, pre);
pre = NULL;
ret = 1;
err:
BN_CTX_end(ctx);
EC_POINT_free(generator);
BN_CTX_free(new_ctx);
EC_sm2p256_pre_comp_free(pre);
return ret;
}
int ec_GFp_sm2p256_have_precompute_mult(const EC_GROUP *group)
{
return HAVEPRECOMP(group, sm2p256);
}
#endif
Reference in New Issue View Git Blame Copy Permalink