Coverage Report

Created: 2021-05-04 09:02

/src/botan/src/lib/pubkey/ec_group/curve_gfp.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
* Elliptic curves over GF(p) Montgomery Representation
3
* (C) 2014,2015,2018 Jack Lloyd
4
*     2016 Matthias Gierlings
5
*
6
* Botan is released under the Simplified BSD License (see license.txt)
7
*/
8
9
#include <botan/curve_gfp.h>
10
#include <botan/internal/curve_nistp.h>
11
#include <botan/numthry.h>
12
#include <botan/reducer.h>
13
#include <botan/internal/mp_core.h>
14
#include <botan/internal/monty.h>
15
16
namespace Botan {
17
18
namespace {
19
20
class CurveGFp_Montgomery final : public CurveGFp_Repr
21
   {
22
   public:
23
      CurveGFp_Montgomery(const BigInt& p, const BigInt& a, const BigInt& b) :
24
         m_p(p), m_a(a), m_b(b),
25
         m_p_words(m_p.sig_words()),
26
         m_p_dash(monty_inverse(m_p.word_at(0)))
27
786
         {
28
786
         Modular_Reducer mod_p(m_p);
29
30
786
         m_r.set_bit(m_p_words * BOTAN_MP_WORD_BITS);
31
786
         m_r = mod_p.reduce(m_r);
32
33
786
         m_r2  = mod_p.square(m_r);
34
786
         m_r3  = mod_p.multiply(m_r, m_r2);
35
786
         m_a_r = mod_p.multiply(m_r, m_a);
36
786
         m_b_r = mod_p.multiply(m_r, m_b);
37
38
786
         m_a_is_zero = m_a.is_zero();
39
786
         m_a_is_minus_3 = (m_a + 3 == m_p);
40
786
         }
41
42
3.97M
      bool a_is_zero() const override { return m_a_is_zero; }
43
3.80M
      bool a_is_minus_3() const override { return m_a_is_minus_3; }
44
45
7.54k
      const BigInt& get_a() const override { return m_a; }
46
47
7.54k
      const BigInt& get_b() const override { return m_b; }
48
49
7.04M
      const BigInt& get_p() const override { return m_p; }
50
51
3.77M
      const BigInt& get_a_rep() const override { return m_a_r; }
52
53
19.7k
      const BigInt& get_b_rep() const override { return m_b_r; }
54
55
47.7k
      const BigInt& get_1_rep() const override { return m_r; }
56
57
46.3k
      bool is_one(const BigInt& x) const override { return x == m_r; }
58
59
444k
      size_t get_p_words() const override { return m_p_words; }
60
61
90.1M
      size_t get_ws_size() const override { return 2*m_p_words + 4; }
62
63
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
64
65
      void to_curve_rep(BigInt& x, secure_vector<word>& ws) const override;
66
67
      void from_curve_rep(BigInt& x, secure_vector<word>& ws) const override;
68
69
      void curve_mul_words(BigInt& z,
70
                           const word x_words[],
71
                           const size_t x_size,
72
                           const BigInt& y,
73
                           secure_vector<word>& ws) const override;
74
75
      void curve_sqr_words(BigInt& z,
76
                           const word x_words[],
77
                           size_t x_size,
78
                           secure_vector<word>& ws) const override;
79
80
   private:
81
      BigInt m_p;
82
      BigInt m_a, m_b;
83
      BigInt m_a_r, m_b_r;
84
      size_t m_p_words; // cache of m_p.sig_words()
85
86
      // Montgomery parameters
87
      BigInt m_r, m_r2, m_r3;
88
      word m_p_dash;
89
90
      bool m_a_is_zero;
91
      bool m_a_is_minus_3;
92
   };
93
94
BigInt CurveGFp_Montgomery::invert_element(const BigInt& x, secure_vector<word>& ws) const
95
47.0k
   {
96
   // Should we use Montgomery inverse instead?
97
47.0k
   const BigInt inv = inverse_mod(x, m_p);
98
47.0k
   BigInt res;
99
47.0k
   curve_mul(res, inv, m_r3, ws);
100
47.0k
   return res;
101
47.0k
   }
102
103
void CurveGFp_Montgomery::to_curve_rep(BigInt& x, secure_vector<word>& ws) const
104
11.0k
   {
105
11.0k
   const BigInt tx = x;
106
11.0k
   curve_mul(x, tx, m_r2, ws);
107
11.0k
   }
108
109
void CurveGFp_Montgomery::from_curve_rep(BigInt& z, secure_vector<word>& ws) const
110
81.3k
   {
111
81.3k
   if(ws.size() < get_ws_size())
112
58
      ws.resize(get_ws_size());
113
114
81.3k
   const size_t output_size = 2*m_p_words + 2;
115
81.3k
   if(z.size() < output_size)
116
19.3k
      z.grow_to(output_size);
117
118
81.3k
   bigint_monty_redc(z.mutable_data(),
119
81.3k
                     m_p.data(), m_p_words, m_p_dash,
120
81.3k
                     ws.data(), ws.size());
121
81.3k
   }
122
123
void CurveGFp_Montgomery::curve_mul_words(BigInt& z,
124
                                          const word x_w[],
125
                                          size_t x_size,
126
                                          const BigInt& y,
127
                                          secure_vector<word>& ws) const
128
48.5M
   {
129
48.5M
   BOTAN_DEBUG_ASSERT(y.sig_words() <= m_p_words);
130
131
48.5M
   if(ws.size() < get_ws_size())
132
0
      ws.resize(get_ws_size());
133
134
48.5M
   const size_t output_size = 2*m_p_words + 2;
135
48.5M
   if(z.size() < output_size)
136
2.25M
      z.grow_to(output_size);
137
138
48.5M
   bigint_mul(z.mutable_data(), z.size(),
139
48.5M
              x_w, x_size, std::min(m_p_words, x_size),
140
48.5M
              y.data(), y.size(), std::min(m_p_words, y.size()),
141
48.5M
              ws.data(), ws.size());
142
143
48.5M
   bigint_monty_redc(z.mutable_data(),
144
48.5M
                     m_p.data(), m_p_words, m_p_dash,
145
48.5M
                     ws.data(), ws.size());
146
48.5M
   }
147
148
void CurveGFp_Montgomery::curve_sqr_words(BigInt& z,
149
                                          const word x[],
150
                                          size_t x_size,
151
                                          secure_vector<word>& ws) const
152
34.4M
   {
153
34.4M
   if(ws.size() < get_ws_size())
154
75.0k
      ws.resize(get_ws_size());
155
156
34.4M
   const size_t output_size = 2*m_p_words + 2;
157
34.4M
   if(z.size() < output_size)
158
187k
      z.grow_to(output_size);
159
160
34.4M
   bigint_sqr(z.mutable_data(), z.size(),
161
34.4M
              x, x_size, std::min(m_p_words, x_size),
162
34.4M
              ws.data(), ws.size());
163
164
34.4M
   bigint_monty_redc(z.mutable_data(),
165
34.4M
                     m_p.data(), m_p_words, m_p_dash,
166
34.4M
                     ws.data(), ws.size());
167
34.4M
   }
168
169
class CurveGFp_NIST : public CurveGFp_Repr
170
   {
171
   public:
172
      CurveGFp_NIST(size_t p_bits, const BigInt& a, const BigInt& b) :
173
         m_1(1), m_a(a), m_b(b), m_p_words((p_bits + BOTAN_MP_WORD_BITS - 1) / BOTAN_MP_WORD_BITS)
174
715
         {
175
         // All Solinas prime curves are assumed a == -3
176
715
         }
177
178
8.45M
      bool a_is_zero() const override { return false; }
179
8.45M
      bool a_is_minus_3() const override { return true; }
180
181
15.6k
      const BigInt& get_a() const override { return m_a; }
182
183
15.6k
      const BigInt& get_b() const override { return m_b; }
184
185
94.6k
      const BigInt& get_1_rep() const override { return m_1; }
186
187
1.05M
      size_t get_p_words() const override { return m_p_words; }
188
189
234M
      size_t get_ws_size() const override { return 2*m_p_words + 4; }
190
191
23.4k
      const BigInt& get_a_rep() const override { return m_a; }
192
193
29.5k
      const BigInt& get_b_rep() const override { return m_b; }
194
195
122k
      bool is_one(const BigInt& x) const override { return x == 1; }
196
197
      void to_curve_rep(BigInt& x, secure_vector<word>& ws) const override
198
16.5k
         { redc_mod_p(x, ws); }
199
200
      void from_curve_rep(BigInt& x, secure_vector<word>& ws) const override
201
175k
         { redc_mod_p(x, ws); }
202
203
      virtual void redc_mod_p(BigInt& z, secure_vector<word>& ws) const = 0;
204
205
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
206
207
      void curve_mul_words(BigInt& z,
208
                           const word x_words[],
209
                           const size_t x_size,
210
                           const BigInt& y,
211
                           secure_vector<word>& ws) const override;
212
213
      void curve_mul_tmp(BigInt& x, const BigInt& y, BigInt& tmp, secure_vector<word>& ws) const
214
1.46M
         {
215
1.46M
         curve_mul(tmp, x, y, ws);
216
1.46M
         x.swap(tmp);
217
1.46M
         }
218
219
      void curve_sqr_tmp(BigInt& x, BigInt& tmp, secure_vector<word>& ws) const
220
50.2M
         {
221
50.2M
         curve_sqr(tmp, x, ws);
222
50.2M
         x.swap(tmp);
223
50.2M
         }
224
225
      void curve_sqr_words(BigInt& z,
226
                           const word x_words[],
227
                           size_t x_size,
228
                           secure_vector<word>& ws) const override;
229
   private:
230
      // Curve parameters
231
      BigInt m_1;
232
      BigInt m_a, m_b;
233
      size_t m_p_words; // cache of m_p.sig_words()
234
   };
235
236
BigInt CurveGFp_NIST::invert_element(const BigInt& x, secure_vector<word>& ws) const
237
358
   {
238
358
   BOTAN_UNUSED(ws);
239
358
   return inverse_mod(x, get_p());
240
358
   }
241
242
void CurveGFp_NIST::curve_mul_words(BigInt& z,
243
                                    const word x_w[],
244
                                    size_t x_size,
245
                                    const BigInt& y,
246
                                    secure_vector<word>& ws) const
247
109M
   {
248
109M
   BOTAN_DEBUG_ASSERT(y.sig_words() <= m_p_words);
249
250
109M
   if(ws.size() < get_ws_size())
251
0
      ws.resize(get_ws_size());
252
253
109M
   const size_t output_size = 2*m_p_words + 2;
254
109M
   if(z.size() < output_size)
255
4.38M
      z.grow_to(output_size);
256
257
109M
   bigint_mul(z.mutable_data(), z.size(),
258
109M
              x_w, x_size, std::min(m_p_words, x_size),
259
109M
              y.data(), y.size(), std::min(m_p_words, y.size()),
260
109M
              ws.data(), ws.size());
261
262
109M
   this->redc_mod_p(z, ws);
263
109M
   }
264
265
void CurveGFp_NIST::curve_sqr_words(BigInt& z, const word x[], size_t x_size,
266
                                    secure_vector<word>& ws) const
267
109M
   {
268
109M
   if(ws.size() < get_ws_size())
269
172k
      ws.resize(get_ws_size());
270
271
109M
   const size_t output_size = 2*m_p_words + 2;
272
109M
   if(z.size() < output_size)
273
8.91M
      z.grow_to(output_size);
274
275
109M
   bigint_sqr(z.mutable_data(), output_size,
276
109M
              x, x_size, std::min(m_p_words, x_size),
277
109M
              ws.data(), ws.size());
278
279
109M
   this->redc_mod_p(z, ws);
280
109M
   }
281
282
/**
283
* The NIST P-192 curve
284
*/
285
class CurveGFp_P192 final : public CurveGFp_NIST
286
   {
287
   public:
288
18
      CurveGFp_P192(const BigInt& a, const BigInt& b) : CurveGFp_NIST(192, a, b) {}
289
16.7k
      const BigInt& get_p() const override { return prime_p192(); }
290
   private:
291
271k
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p192(x, ws); }
292
   };
293
294
/**
295
* The NIST P-224 curve
296
*/
297
class CurveGFp_P224 final : public CurveGFp_NIST
298
   {
299
   public:
300
300
      CurveGFp_P224(const BigInt& a, const BigInt& b) : CurveGFp_NIST(224, a, b) {}
301
251k
      const BigInt& get_p() const override { return prime_p224(); }
302
   private:
303
4.74M
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p224(x, ws); }
304
   };
305
306
/**
307
* The NIST P-256 curve
308
*/
309
class CurveGFp_P256 final : public CurveGFp_NIST
310
   {
311
   public:
312
25
      CurveGFp_P256(const BigInt& a, const BigInt& b) : CurveGFp_NIST(256, a, b) {}
313
2.47M
      const BigInt& get_p() const override { return prime_p256(); }
314
   private:
315
33.9M
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p256(x, ws); }
316
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
317
   };
318
319
BigInt CurveGFp_P256::invert_element(const BigInt& x, secure_vector<word>& ws) const
320
32.1k
   {
321
32.1k
   BigInt r, p2, p4, p8, p16, p32, tmp;
322
323
32.1k
   curve_sqr(r, x, ws);
324
325
32.1k
   curve_mul(p2, r, x, ws);
326
32.1k
   curve_sqr(r, p2, ws);
327
32.1k
   curve_sqr_tmp(r, tmp, ws);
328
329
32.1k
   curve_mul(p4, r, p2, ws);
330
331
32.1k
   curve_sqr(r, p4, ws);
332
128k
   for(size_t i = 0; i != 3; ++i)
333
96.4k
      curve_sqr_tmp(r, tmp, ws);
334
32.1k
   curve_mul(p8, r, p4, ws);
335
336
32.1k
   curve_sqr(r, p8, ws);
337
257k
   for(size_t i = 0; i != 7; ++i)
338
224k
      curve_sqr_tmp(r, tmp, ws);
339
32.1k
   curve_mul(p16, r, p8, ws);
340
341
32.1k
   curve_sqr(r, p16, ws);
342
514k
   for(size_t i = 0; i != 15; ++i)
343
482k
      curve_sqr_tmp(r, tmp, ws);
344
32.1k
   curve_mul(p32, r, p16, ws);
345
346
32.1k
   curve_sqr(r, p32, ws);
347
1.02M
   for(size_t i = 0; i != 31; ++i)
348
996k
      curve_sqr_tmp(r, tmp, ws);
349
32.1k
   curve_mul_tmp(r, x, tmp, ws);
350
351
4.14M
   for(size_t i = 0; i != 32*4; ++i)
352
4.11M
      curve_sqr_tmp(r, tmp, ws);
353
32.1k
   curve_mul_tmp(r, p32, tmp, ws);
354
355
1.06M
   for(size_t i = 0; i != 32; ++i)
356
1.02M
      curve_sqr_tmp(r, tmp, ws);
357
32.1k
   curve_mul_tmp(r, p32, tmp, ws);
358
359
546k
   for(size_t i = 0; i != 16; ++i)
360
514k
      curve_sqr_tmp(r, tmp, ws);
361
32.1k
   curve_mul_tmp(r, p16, tmp, ws);
362
289k
   for(size_t i = 0; i != 8; ++i)
363
257k
      curve_sqr_tmp(r, tmp, ws);
364
32.1k
   curve_mul_tmp(r, p8, tmp, ws);
365
366
160k
   for(size_t i = 0; i != 4; ++i)
367
128k
      curve_sqr_tmp(r, tmp, ws);
368
32.1k
   curve_mul_tmp(r, p4, tmp, ws);
369
370
96.4k
   for(size_t i = 0; i != 2; ++i)
371
64.2k
      curve_sqr_tmp(r, tmp, ws);
372
32.1k
   curve_mul_tmp(r, p2, tmp, ws);
373
374
96.4k
   for(size_t i = 0; i != 2; ++i)
375
64.2k
      curve_sqr_tmp(r, tmp, ws);
376
32.1k
   curve_mul_tmp(r, x, tmp, ws);
377
378
32.1k
   return r;
379
32.1k
   }
380
381
/**
382
* The NIST P-384 curve
383
*/
384
class CurveGFp_P384 final : public CurveGFp_NIST
385
   {
386
   public:
387
71
      CurveGFp_P384(const BigInt& a, const BigInt& b) : CurveGFp_NIST(384, a, b) {}
388
4.14M
      const BigInt& get_p() const override { return prime_p384(); }
389
   private:
390
56.6M
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p384(x, ws); }
391
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
392
   };
393
394
BigInt CurveGFp_P384::invert_element(const BigInt& x, secure_vector<word>& ws) const
395
35.2k
   {
396
   // From https://briansmith.org/ecc-inversion-addition-chains-01
397
398
35.2k
   BigInt r, x2, x3, x15, x30, tmp, rl;
399
400
35.2k
   r = x;
401
35.2k
   curve_sqr_tmp(r, tmp, ws);
402
35.2k
   curve_mul_tmp(r, x, tmp, ws);
403
35.2k
   x2 = r;
404
405
35.2k
   curve_sqr_tmp(r, tmp, ws);
406
35.2k
   curve_mul_tmp(r, x, tmp, ws);
407
408
35.2k
   x3 = r;
409
410
141k
   for(size_t i = 0; i != 3; ++i)
411
105k
      curve_sqr_tmp(r, tmp, ws);
412
35.2k
   curve_mul_tmp(r, x3, tmp, ws);
413
414
35.2k
   rl = r;
415
246k
   for(size_t i = 0; i != 6; ++i)
416
211k
      curve_sqr_tmp(r, tmp, ws);
417
35.2k
   curve_mul_tmp(r, rl, tmp, ws);
418
419
141k
   for(size_t i = 0; i != 3; ++i)
420
105k
      curve_sqr_tmp(r, tmp, ws);
421
35.2k
   curve_mul_tmp(r, x3, tmp, ws);
422
423
35.2k
   x15 = r;
424
564k
   for(size_t i = 0; i != 15; ++i)
425
529k
      curve_sqr_tmp(r, tmp, ws);
426
35.2k
   curve_mul_tmp(r, x15, tmp, ws);
427
428
35.2k
   x30 = r;
429
1.09M
   for(size_t i = 0; i != 30; ++i)
430
1.05M
      curve_sqr_tmp(r, tmp, ws);
431
35.2k
   curve_mul_tmp(r, x30, tmp, ws);
432
433
35.2k
   rl = r;
434
2.15M
   for(size_t i = 0; i != 60; ++i)
435
2.11M
      curve_sqr_tmp(r, tmp, ws);
436
35.2k
   curve_mul_tmp(r, rl, tmp, ws);
437
438
35.2k
   rl = r;
439
4.26M
   for(size_t i = 0; i != 120; ++i)
440
4.23M
      curve_sqr_tmp(r, tmp, ws);
441
35.2k
   curve_mul_tmp(r, rl, tmp, ws);
442
443
564k
   for(size_t i = 0; i != 15; ++i)
444
529k
      curve_sqr_tmp(r, tmp, ws);
445
35.2k
   curve_mul_tmp(r, x15, tmp, ws);
446
447
1.12M
   for(size_t i = 0; i != 31; ++i)
448
1.09M
      curve_sqr_tmp(r, tmp, ws);
449
35.2k
   curve_mul_tmp(r, x30, tmp, ws);
450
451
105k
   for(size_t i = 0; i != 2; ++i)
452
70.5k
      curve_sqr_tmp(r, tmp, ws);
453
35.2k
   curve_mul_tmp(r, x2, tmp, ws);
454
455
3.35M
   for(size_t i = 0; i != 94; ++i)
456
3.31M
      curve_sqr_tmp(r, tmp, ws);
457
35.2k
   curve_mul_tmp(r, x30, tmp, ws);
458
459
105k
   for(size_t i = 0; i != 2; ++i)
460
70.5k
      curve_sqr_tmp(r, tmp, ws);
461
462
35.2k
   curve_mul_tmp(r, x, tmp, ws);
463
464
35.2k
   return r;
465
35.2k
   }
466
467
/**
468
* The NIST P-521 curve
469
*/
470
class CurveGFp_P521 final : public CurveGFp_NIST
471
   {
472
   public:
473
301
      CurveGFp_P521(const BigInt& a, const BigInt& b) : CurveGFp_NIST(521, a, b) {}
474
8.67M
      const BigInt& get_p() const override { return prime_p521(); }
475
   private:
476
123M
      void redc_mod_p(BigInt& x, secure_vector<word>& ws) const override { redc_p521(x, ws); }
477
      BigInt invert_element(const BigInt& x, secure_vector<word>& ws) const override;
478
   };
479
480
BigInt CurveGFp_P521::invert_element(const BigInt& x, secure_vector<word>& ws) const
481
55.2k
   {
482
   // Addition chain from https://eprint.iacr.org/2014/852.pdf section
483
484
55.2k
   BigInt r;
485
55.2k
   BigInt rl;
486
55.2k
   BigInt a7;
487
55.2k
   BigInt tmp;
488
489
55.2k
   curve_sqr(r, x, ws);
490
55.2k
   curve_mul_tmp(r, x, tmp, ws);
491
492
55.2k
   curve_sqr_tmp(r, tmp, ws);
493
55.2k
   curve_mul_tmp(r, x, tmp, ws);
494
495
55.2k
   rl = r;
496
497
221k
   for(size_t i = 0; i != 3; ++i)
498
165k
      curve_sqr_tmp(r, tmp, ws);
499
55.2k
   curve_mul_tmp(r, rl, tmp, ws);
500
501
55.2k
   curve_sqr_tmp(r, tmp, ws);
502
55.2k
   curve_mul_tmp(r, x, tmp, ws);
503
55.2k
   a7 = r; // need this value later
504
505
55.2k
   curve_sqr_tmp(r, tmp, ws);
506
55.2k
   curve_mul_tmp(r, x, tmp, ws);
507
508
55.2k
   rl = r;
509
497k
   for(size_t i = 0; i != 8; ++i)
510
442k
      curve_sqr_tmp(r, tmp, ws);
511
55.2k
   curve_mul_tmp(r, rl, tmp, ws);
512
513
55.2k
   rl = r;
514
939k
   for(size_t i = 0; i != 16; ++i)
515
884k
      curve_sqr_tmp(r, tmp, ws);
516
55.2k
   curve_mul_tmp(r, rl, tmp, ws);
517
518
55.2k
    rl = r;
519
1.82M
    for(size_t i = 0; i != 32; ++i)
520
1.76M
        curve_sqr_tmp(r, tmp, ws);
521
55.2k
    curve_mul_tmp(r, rl, tmp, ws);
522
523
55.2k
    rl = r;
524
3.59M
    for(size_t i = 0; i != 64; ++i)
525
3.53M
        curve_sqr_tmp(r, tmp, ws);
526
55.2k
    curve_mul_tmp(r, rl, tmp, ws);
527
528
55.2k
    rl = r;
529
7.13M
    for(size_t i = 0; i != 128; ++i)
530
7.07M
        curve_sqr_tmp(r, tmp, ws);
531
55.2k
    curve_mul_tmp(r, rl, tmp, ws);
532
533
55.2k
    rl = r;
534
14.2M
    for(size_t i = 0; i != 256; ++i)
535
14.1M
        curve_sqr_tmp(r, tmp, ws);
536
55.2k
    curve_mul_tmp(r, rl, tmp, ws);
537
538
442k
    for(size_t i = 0; i != 7; ++i)
539
386k
        curve_sqr_tmp(r, tmp, ws);
540
55.2k
    curve_mul_tmp(r, a7, tmp, ws);
541
542
165k
    for(size_t i = 0; i != 2; ++i)
543
110k
       curve_sqr_tmp(r, tmp, ws);
544
55.2k
    curve_mul_tmp(r, x, tmp, ws);
545
546
55.2k
    return r;
547
55.2k
   }
548
549
}
550
551
std::shared_ptr<CurveGFp_Repr>
552
CurveGFp::choose_repr(const BigInt& p, const BigInt& a, const BigInt& b)
553
1.50k
   {
554
1.50k
   if(p == prime_p192())
555
18
      return std::make_shared<CurveGFp_P192>(a, b);
556
1.48k
   if(p == prime_p224())
557
300
      return std::make_shared<CurveGFp_P224>(a, b);
558
1.18k
   if(p == prime_p256())
559
25
      return std::make_shared<CurveGFp_P256>(a, b);
560
1.15k
   if(p == prime_p384())
561
71
      return std::make_shared<CurveGFp_P384>(a, b);
562
1.08k
   if(p == prime_p521())
563
301
      return std::make_shared<CurveGFp_P521>(a, b);
564
565
786
   return std::make_shared<CurveGFp_Montgomery>(p, a, b);
566
786
   }
567
568
}