//

// ec_mul.c   Generic multiplication algorithms for elliptic curves

//

// Copyright (c) Microsoft Corporation. Licensed under the MIT license.

//

//

#include "precomp.h"

//

// Most of the following algorithms were presented in the paper

// "Selecting Elliptic Curves for Cryptography: An Efficiency and

//  Security Analysis" by Bos, Costello, Longa, and Naehrig

//

//

// The following is an adaptation of algorithm 4: "Precomputation

// scheme for Weierstrass curves"

//

// Input:   Point P and number of precomputed points nPoints (=2^(w-2))

//

// Output:  P[i] = (2*i+1)P for 0<=i<2^(w-2)

//

// Remarks:

//          1. We store each point in an array of 4*2^(w-2) = 2^w modelements where

//             each point is represented with X,Y,Z Jacobian coordinates and the W=-Y

//             negated Y coordinate (so that we can get the negative of a point easily)

//          2. The source point P is already in the 0'th position of the array.

//

VOID

SYMCRYPT_CALL

SymCryptPrecomputation(

    _In_    PCSYMCRYPT_ECURVE       pCurve,

            UINT32                  nPoints,

    _In_reads_( SYMCRYPT_ECURVE_SW_MAX_NPRECOMP_POINTS )

            PSYMCRYPT_ECPOINT *     poPIs,

    _Out_   PSYMCRYPT_ECPOINT       poQ,

    _Out_writes_bytes_( cbScratch )

            PBYTE               pbScratch,

            SIZE_T              cbScratch )

{

    SYMCRYPT_ASSERT( SymCryptEcurveIsSame(pCurve, poQ->pCurve) );

    // Calculation for Q = 2*P

    SymCryptEcpointDouble( pCurve, poPIs[0], poQ, 0, pbScratch, cbScratch );

    for (UINT32 i=1; i<nPoints; i++)

    {

        // Calculation for (2i+1)*P = i*Q + P

        SymCryptEcpointAddDiffNonZero( pCurve, poQ, poPIs[i-1], poPIs[i], pbScratch, cbScratch );

    }

}

VOID

SYMCRYPT_CALL

SymCryptOfflinePrecomputation(

    _In_    PSYMCRYPT_ECURVE pCurve,

    _Out_writes_bytes_( cbScratch )

            PBYTE         pbScratch,

            SIZE_T        cbScratch )

{

    PSYMCRYPT_ECPOINT poQ = NULL;

    UINT32 cbEcpoint = SymCryptSizeofEcpointFromCurve( pCurve );

    SYMCRYPT_ASSERT( cbScratch >= cbEcpoint + SYMCRYPT_SCRATCH_BYTES_FOR_COMMON_MOD_OPERATIONS( pCurve->FModDigits ) );

    poQ = SymCryptEcpointCreate( pbScratch, cbEcpoint, pCurve );

    SYMCRYPT_ASSERT( poQ != NULL );

    pbScratch += cbEcpoint;

    cbScratch -= cbEcpoint;

    SymCryptPrecomputation(

                pCurve,

                pCurve->info.sw.nPrecompPoints,

                pCurve->info.sw.poPrecompPoints,

                poQ,

                pbScratch,

                cbScratch );

}

// Mask which is 0xffffffff only when _index == _target

#define DELTA_MASK( _index, _target)    SYMCRYPT_MASK32_ZERO( (_index) ^ (_target) )

//

// The following is an adaptation of algorithm 1: "Variable-base scalar multiplication

// using the fixed-window method"

//

SYMCRYPT_ERROR

SYMCRYPT_CALL

SymCryptEcpointScalarMulFixedWindow(

    _In_    PCSYMCRYPT_ECURVE       pCurve,

    _In_    PCSYMCRYPT_INT          piScalar,

    _In_opt_

            PCSYMCRYPT_ECPOINT      poSrc,

            UINT32                  flags,

    _Out_   PSYMCRYPT_ECPOINT       poDst,

    _Out_writes_bytes_( cbScratch )

            PBYTE               pbScratch,

            SIZE_T              cbScratch )

{

    SYMCRYPT_ERROR  scError = SYMCRYPT_MEMORY_ALLOCATION_FAILURE;

    PCSYMCRYPT_MODULUS FMod = pCurve->FMod;

    UINT32  i, j;

    UINT32  w = pCurve->info.sw.window;

    UINT32  nPrecompPoints = pCurve->info.sw.nPrecompPoints;

  // dcl - assuming that nRecodedDigits has some reasonably small range - please document

  // so that we can know usage of this variable will not cause problems

  // Also, documentation of inputs, notes, etc at the function definition would be quite helpful

    UINT32  nRecodedDigits = ((pCurve->GOrdBitsize + w - 2) / (w-1)) + 1;

    // Masks

    UINT32  fZero = 0;

    UINT32  fEven = 0;

    UINT32  indexMask = 0;

    BOOLEAN bPrecompOffline = FALSE;

    // ====================================================

    // Temporaries

    PSYMCRYPT_MODELEMENT    peT = NULL;

    PSYMCRYPT_ECPOINT       poPIs[SYMCRYPT_ECURVE_SW_MAX_NPRECOMP_POINTS] = { 0 };

    PSYMCRYPT_ECPOINT       poQ = NULL;

    PSYMCRYPT_ECPOINT       poTmp = NULL;

    PSYMCRYPT_INT           piRem = NULL;

    PSYMCRYPT_INT           piTmp = NULL;

    PUINT32                 absofKIs = NULL;

    PUINT32                 sigofKIs = NULL;

    // ===================================================

    PSYMCRYPT_MODELEMENT    peQX = NULL;

    PSYMCRYPT_MODELEMENT    peQY = NULL;

    PSYMCRYPT_MODELEMENT    peQZ = NULL;

    SIZE_T cbEcpoint = SymCryptSizeofEcpointFromCurve( pCurve );

    SIZE_T cbScalar = SymCryptSizeofIntFromDigits( pCurve->GOrdDigits );

    // Make sure we only specify the correct flags

    if ((flags & ~SYMCRYPT_FLAG_ECC_LL_COFACTOR_MUL) != 0)

    {

        scError = SYMCRYPT_INVALID_ARGUMENT;

        goto exit;

    }

    // Check if poSrc is NULL and if yes set it to G

    if (poSrc == NULL)

    {

        poSrc = pCurve->G;

        bPrecompOffline = TRUE;

    }

    SYMCRYPT_ASSERT( SYMCRYPT_CURVE_IS_SHORT_WEIERSTRASS_TYPE(pCurve) ||

                     SYMCRYPT_CURVE_IS_TWISTED_EDWARDS_TYPE(pCurve) );

    SYMCRYPT_ASSERT( SymCryptEcurveIsSame(pCurve, poSrc->pCurve) && SymCryptEcurveIsSame(pCurve, poDst->pCurve) );

    SYMCRYPT_ASSERT( cbScratch >= SYMCRYPT_INTERNAL_SCRATCH_BYTES_FOR_SCALAR_ECURVE_OPERATIONS(pCurve, 1) );

    SYMCRYPT_ASSERT( cbScratch >=

                        pCurve->cbModElement +

                        (nPrecompPoints+2)*cbEcpoint +

                        2*cbScalar +

                        ((2*nRecodedDigits*sizeof(UINT32) + SYMCRYPT_ASYM_ALIGN_VALUE - 1)/SYMCRYPT_ASYM_ALIGN_VALUE )*SYMCRYPT_ASYM_ALIGN_VALUE +

                        SYMCRYPT_SCRATCH_BYTES_FOR_COMMON_ECURVE_OPERATIONS( pCurve ) );

    // Creating temporary modelement

    peT = SymCryptModElementCreate( pbScratch, pCurve->cbModElement, FMod );

    SYMCRYPT_ASSERT( peT != NULL );

    pbScratch += pCurve->cbModElement;

    // Creating temporary precomputed points (if needed)

    SYMCRYPT_ASSERT( nPrecompPoints <= SYMCRYPT_ECURVE_SW_MAX_NPRECOMP_POINTS );

    for (i=0; i<nPrecompPoints; i++)

    {

        if (bPrecompOffline)

        {

            poPIs[i] = pCurve->info.sw.poPrecompPoints[i];

        }

        else

        {

            poPIs[i] = SymCryptEcpointCreate( pbScratch, cbEcpoint, pCurve );

            SYMCRYPT_ASSERT( poPIs[i] != NULL );

            pbScratch += cbEcpoint;

        }

    }

    // Creating temporary points

    poQ = SymCryptEcpointCreate( pbScratch, cbEcpoint, pCurve );

    SYMCRYPT_ASSERT( poQ != NULL );

    pbScratch += cbEcpoint;

    poTmp = SymCryptEcpointCreate( pbScratch, cbEcpoint, pCurve );

    SYMCRYPT_ASSERT( poTmp != NULL );

    pbScratch += cbEcpoint;

    // Creating temporary scalar for the remainder

    piRem = SymCryptIntCreate( pbScratch, cbScalar, pCurve->GOrdDigits );

    SYMCRYPT_ASSERT( piRem != NULL);

    pbScratch += cbScalar;

    piTmp = SymCryptIntCreate( pbScratch, cbScalar, pCurve->GOrdDigits );

    SYMCRYPT_ASSERT( piTmp != NULL);

    pbScratch += cbScalar;

    // Fixing pointers to recoded digits (be careful that the remaining space is SYMCRYPT_ASYM_ALIGNed)

    absofKIs = (PUINT32) pbScratch;

    pbScratch += nRecodedDigits * sizeof(UINT32);

    sigofKIs = (PUINT32) pbScratch;

    pbScratch += nRecodedDigits * sizeof(UINT32);

    pbScratch = (PBYTE) ( ((ULONG_PTR)pbScratch + SYMCRYPT_ASYM_ALIGN_VALUE - 1) & ~(SYMCRYPT_ASYM_ALIGN_VALUE - 1) );

    // Fixing remaining scratch space size

    cbScratch -= ( pCurve->cbModElement + (nPrecompPoints+2)*cbEcpoint + 2*cbScalar );

    cbScratch -= (((2*nRecodedDigits*sizeof(UINT32) + SYMCRYPT_ASYM_ALIGN_VALUE - 1)/SYMCRYPT_ASYM_ALIGN_VALUE )*SYMCRYPT_ASYM_ALIGN_VALUE);

    //

    // Main algorithm

    //

    // It is the caller's responsibility to ensure that the provided piScalar <= GOrd, double check this in debug mode

    SYMCRYPT_ASSERT( !SymCryptIntIsLessThan( SymCryptIntFromModulus( pCurve->GOrd ), piScalar ) );

    // Store k into an int

    SymCryptIntCopy( piScalar, piRem );

    // Check if k is 0

    fZero = SymCryptIntIsEqualUint32( piRem, 0 );

    // Or if the src point is zero

    fZero |= SymCryptEcpointIsZero( pCurve, poSrc, pbScratch, cbScratch );

    // Check if k is even and convert it to r-k if true

    fEven = SYMCRYPT_MASK32_ZERO(SymCryptIntGetBit( piRem, 0 ));

    SymCryptIntSubSameSize( SymCryptIntFromModulus(pCurve->GOrd), piRem, piTmp);

    SymCryptIntMaskedCopy( piTmp, piRem, fEven );

    // Recoding stage

    SymCryptFixedWindowRecoding( w, piRem, piTmp, absofKIs, sigofKIs, nRecodedDigits );

    // Precomputation stage

    if (!bPrecompOffline)

    {

        // Copy the first point in the start of the poPIs array

        SymCryptEcpointCopy( pCurve, poSrc, poPIs[0] );

        SymCryptPrecomputation( pCurve, nPrecompPoints, poPIs, poQ, pbScratch, cbScratch );

    }

    // Get the pointers to Q

    peQX = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 0, pCurve, poQ );

    peQY = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 1, pCurve, poQ );

    peQZ = SYMCRYPT_INTERNAL_ECPOINT_COORDINATE( 2, pCurve, poQ );

    // Q = P[ (|k_t|-1)/2 ] in memory access side-channel safe way

    // That is, we touch all the precomputed points. The access pattern of KIs is fixed.

    for (j=0; j<nPrecompPoints; j++)

    {

        indexMask = DELTA_MASK( j, absofKIs[nRecodedDigits-1] );

        SymCryptEcpointMaskedCopy( pCurve, poPIs[j], poQ, indexMask);

    }

    for (i=nRecodedDigits - 2; i>0; i--)

    {

        // Q = 2^(w-1) * Q

        for (j=0; j<w-1; j++)

        {

            SymCryptEcpointDouble( pCurve, poQ, poQ, 0, pbScratch, cbScratch );

        }

        // Copy the required precomputed point into poTmp (touch all points)

        for (j=0; j<nPrecompPoints; j++)

        {

            indexMask = DELTA_MASK( j, absofKIs[i] );

            SymCryptEcpointMaskedCopy( pCurve, poPIs[j], poTmp, indexMask);

        }

        // Negate if needed

        SymCryptEcpointNegate( pCurve, poTmp, sigofKIs[i], pbScratch, cbScratch );

        // Do the addition Q + s_i P[k_i]

        SymCryptEcpointAddDiffNonZero( pCurve, poQ, poTmp, poQ, pbScratch, cbScratch );

    }

    // Q = 2^(w-1) * Q

    for (j=0; j<w-1; j++)

    {

        SymCryptEcpointDouble( pCurve, poQ, poQ, 0, pbScratch, cbScratch );

    }

    // Copy the point s_0 P[k_0] into poTmp

    for (j=0; j<nPrecompPoints; j++)

    {

        indexMask = DELTA_MASK( j, absofKIs[0] );

        SymCryptEcpointMaskedCopy( pCurve, poPIs[j], poTmp, indexMask);

    }

    // Negate if needed

    SymCryptEcpointNegate( pCurve, poTmp, sigofKIs[0], pbScratch, cbScratch );

    // Complete addition routine

    SymCryptEcpointAdd( pCurve, poQ, poTmp, poQ, 0, pbScratch, cbScratch );

    // If even invert

    SymCryptEcpointNegate( pCurve, poQ, fEven, pbScratch, cbScratch );

    // Multiply by the cofactor (if needed) by continuing the doubling

    if ((pCurve->coFactorPower!=0) && ((flags & SYMCRYPT_FLAG_ECC_LL_COFACTOR_MUL) != 0))

    {

        for (j=0; j<pCurve->coFactorPower; j++)

        {

            SymCryptEcpointDouble( pCurve, poQ, poQ, 0, pbScratch, cbScratch );

        }

    }

    // If the resultant point is zero, ensure it will be set to the canonical zero point

    fZero |= SymCryptEcpointIsZero( pCurve, poQ, pbScratch, cbScratch );

    // Set the zero point

    SymCryptEcpointSetZero( pCurve, poTmp, pbScratch, cbScratch );

    SymCryptEcpointMaskedCopy( pCurve, poTmp, poQ, fZero );

    // Output the result (normalized flag == FALSE)

    SymCryptEcpointCopy( pCurve, poQ, poDst );

    scError = SYMCRYPT_NO_ERROR;

exit:

    return scError;

}

//

// The following is an adaptation of algorithm 9: "Double-scalar multiplication using the

// width-w NAF with interleaving"

//

SYMCRYPT_ERROR

SYMCRYPT_CALL

SymCryptEcpointMultiScalarMulWnafWithInterleaving(

    _In_                            PCSYMCRYPT_ECURVE       pCurve,

    _In_reads_( nPoints )           PCSYMCRYPT_INT *        piSrcScalarArray,

    _In_reads_( nPoints )           PCSYMCRYPT_ECPOINT *    poSrcEcpointArray,

    _In_                            UINT32                  nPoints,

    _In_                            UINT32                  flags,

    _Out_                           PSYMCRYPT_ECPOINT       poDst,

    _Out_writes_bytes_( cbScratch ) PBYTE                   pbScratch,

                                    SIZE_T                  cbScratch )

{

    SYMCRYPT_ERROR  scError = SYMCRYPT_MEMORY_ALLOCATION_FAILURE;

    UINT32  i, j;

    UINT32  w = pCurve->info.sw.window;

    UINT32  nPrecompPoints = pCurve->info.sw.nPrecompPoints;            // One table for each base

    UINT32  nRecodedDigits = pCurve->GOrdBitsize + 1;                   // Notice the difference with the fixed window

    // Masks

    UINT32  fZero[SYMCRYPT_ECURVE_MULTI_SCALAR_MUL_MAX_NPOINTS] = { 0 };

    UINT32  fZeroTot = 0xffffffff;

    BOOLEAN bPrecompOffline = FALSE;

    // ====================================================

    // Temporaries

    PSYMCRYPT_ECPOINT       poPIs[SYMCRYPT_ECURVE_SW_MAX_NPRECOMP_POINTS] = { 0 };

    PSYMCRYPT_ECPOINT       poQ = NULL;

    PSYMCRYPT_ECPOINT       poTmp = NULL;

    PSYMCRYPT_INT           piRem = NULL;

    PSYMCRYPT_INT           piTmp = NULL;

    PUINT32                 absofKIs = NULL;

    PUINT32                 sigofKIs = NULL;

    // ===================================================

    SIZE_T cbEcpoint = SymCryptSizeofEcpointFromCurve( pCurve );

    SIZE_T cbScalar = SymCryptSizeofIntFromDigits( pCurve->GOrdDigits );

    PBYTE pbScratchEnd = pbScratch + cbScratch;

    UNREFERENCED_PARAMETER( pbScratchEnd ); // Used in asserts

    // Make sure we only specify the correct flags

    if ((flags & ~(SYMCRYPT_FLAG_DATA_PUBLIC | SYMCRYPT_FLAG_ECC_LL_COFACTOR_MUL)) != 0)

    {

        scError = SYMCRYPT_INVALID_ARGUMENT;

        goto exit;

    }

    // Check the maximum number of points

    if (nPoints > SYMCRYPT_ECURVE_MULTI_SCALAR_MUL_MAX_NPOINTS)

    {

        scError = SYMCRYPT_NOT_IMPLEMENTED;

        goto exit;

    }

    // Check if the first point is NULL

    if (poSrcEcpointArray[0] == NULL)

    {

        poSrcEcpointArray[0] = pCurve->G;

        bPrecompOffline = TRUE;

    }

    // Make sure that the non side-channel flag is specified

    if ((flags & SYMCRYPT_FLAG_DATA_PUBLIC) == 0 )

    {

        scError = SYMCRYPT_NOT_IMPLEMENTED;

        goto exit;

    }

    SYMCRYPT_ASSERT( SYMCRYPT_CURVE_IS_SHORT_WEIERSTRASS_TYPE(pCurve) ||

                     SYMCRYPT_CURVE_IS_TWISTED_EDWARDS_TYPE(pCurve) );

    SYMCRYPT_ASSERT( SymCryptEcurveIsSame(pCurve, poDst->pCurve) );

    SYMCRYPT_ASSERT( cbScratch >= SYMCRYPT_INTERNAL_SCRATCH_BYTES_FOR_SCALAR_ECURVE_OPERATIONS(pCurve, nPoints) );

    // Creating temporary precomputed points (if needed for the first point)

    for (i=0; i<nPoints*nPrecompPoints; i++)

    {

        if ((i<nPrecompPoints) && bPrecompOffline)

        {

            poPIs[i] = pCurve->info.sw.poPrecompPoints[i];

        }

        else

        {

            SYMCRYPT_ASSERT( pbScratch + cbEcpoint <= pbScratchEnd );

            poPIs[i] = SymCryptEcpointCreate( pbScratch, cbEcpoint, pCurve );

            SYMCRYPT_ASSERT( poPIs[i] != NULL );

            pbScratch += cbEcpoint;

        }

    }

    SYMCRYPT_ASSERT( pbScratch + 2*cbEcpoint + 2*cbScalar + 2*nPoints*nRecodedDigits*sizeof(UINT32) <= pbScratchEnd );

    // Creating temporary points

    poQ = SymCryptEcpointCreate( pbScratch, cbEcpoint, pCurve );

    SYMCRYPT_ASSERT( poQ != NULL );

    pbScratch += cbEcpoint;

    poTmp = SymCryptEcpointCreate( pbScratch, cbEcpoint, pCurve );

    SYMCRYPT_ASSERT( poTmp != NULL );

    pbScratch += cbEcpoint;

    // Creating temporary scalar for the remainder

    piRem = SymCryptIntCreate( pbScratch, cbScalar, pCurve->GOrdDigits );

    SYMCRYPT_ASSERT( piRem != NULL);

    pbScratch += cbScalar;

    piTmp = SymCryptIntCreate( pbScratch, cbScalar, pCurve->GOrdDigits );

    SYMCRYPT_ASSERT( piTmp != NULL);

    pbScratch += cbScalar;

    // Fixing pointers to recoded digits (be careful that the remaining space is SYMCRYPT_ASYM_ALIGNed)

    absofKIs = (PUINT32) pbScratch;

    pbScratch += nPoints * nRecodedDigits * sizeof(UINT32);

    sigofKIs = (PUINT32) pbScratch;

    pbScratch += nPoints * nRecodedDigits * sizeof(UINT32);

    pbScratch = (PBYTE) ( ((ULONG_PTR)pbScratch + SYMCRYPT_ASYM_ALIGN_VALUE - 1) & ~(SYMCRYPT_ASYM_ALIGN_VALUE - 1) );

    // Fixing remaining scratch space size

  // dcl - my guess is that the values here are small enough that there should not be a problem, but

  // would be better if that were documented.

    cbScratch -= ( (nPoints*nPrecompPoints+2)*cbEcpoint + 2*cbScalar );

    cbScratch -= (((2*nPoints*nRecodedDigits*sizeof(UINT32) + SYMCRYPT_ASYM_ALIGN_VALUE - 1)/SYMCRYPT_ASYM_ALIGN_VALUE )*SYMCRYPT_ASYM_ALIGN_VALUE);

    //

    // Main algorithm

    //

    for (j = 0; j<nPoints; j++)

    {

        SYMCRYPT_ASSERT( SymCryptEcurveIsSame(pCurve, poSrcEcpointArray[j]->pCurve) );

        // Check if k is 0 or if the src point is zero

        fZero[j] = ( SymCryptIntIsEqualUint32( piSrcScalarArray[j], 0 ) | SymCryptEcpointIsZero( pCurve, poSrcEcpointArray[j], pbScratch, cbScratch ) );

        fZeroTot &= fZero[j];

        // Skip the recoding stage (and all remaining steps) if this point will give result zero

        if (!fZero[j])

        {

            SymCryptIntCopy( piSrcScalarArray[j], piRem );

            // Recoding stage

            SymCryptWidthNafRecoding( w, piRem, &absofKIs[j*nRecodedDigits], &sigofKIs[j*nRecodedDigits], nRecodedDigits );

            // Precomputation stage

            if ((j>0) || !bPrecompOffline)

            {

                // Copy the first point in the start of the poPIs array

                SymCryptEcpointCopy( pCurve, poSrcEcpointArray[j], poPIs[j*nPrecompPoints] );

                SymCryptPrecomputation( pCurve, nPrecompPoints, &poPIs[j*nPrecompPoints], poQ, pbScratch, cbScratch );

            }

        }

    }

    // Set poQ to zero point

    SymCryptEcpointSetZero( pCurve, poQ, pbScratch, cbScratch );

    if (!fZeroTot)

    {

        // Main loop

        for (INT32 i = nRecodedDigits-1; i>-1; i--)

        {

            SymCryptEcpointDouble( pCurve, poQ, poQ, 0, pbScratch, cbScratch );

            for (j = 0; j<nPoints; j++)

            {

                if (!fZero[j] && sigofKIs[j*nRecodedDigits + i] != 0)

                {

                    SymCryptEcpointCopy( pCurve, poPIs[j*nPrecompPoints + absofKIs[j*nRecodedDigits + i]/2], poTmp );

                    if (sigofKIs[j*nRecodedDigits + i] == 0xffffffff)

                    {

                        SymCryptEcpointNegate( pCurve, poTmp, 0xffffffff, pbScratch, cbScratch );

                    }

                    SymCryptEcpointAdd( pCurve, poQ, poTmp, poQ, SYMCRYPT_FLAG_DATA_PUBLIC, pbScratch, cbScratch );

                }

            }

        }

    }

    // Multiply by the cofactor (if needed) by continuing the doubling

    if ((pCurve->coFactorPower!=0) && ((flags & SYMCRYPT_FLAG_ECC_LL_COFACTOR_MUL) != 0))

    {

        for (j=0; j<pCurve->coFactorPower; j++)

        {

            SymCryptEcpointDouble( pCurve, poQ, poQ, 0, pbScratch, cbScratch );

        }

    }

    // If the resultant point is zero, ensure it will be set to the canonical zero point

    if ( SymCryptEcpointIsZero( pCurve, poQ, pbScratch, cbScratch ) )

    {

        // Set poQ to zero point

        SymCryptEcpointSetZero( pCurve, poQ, pbScratch, cbScratch );

    }

    // Copy the result to the destination (normalized flag == FALSE)

    SymCryptEcpointCopy( pCurve, poQ, poDst );

    scError = SYMCRYPT_NO_ERROR;

exit:

    return scError;

}

VOID

SYMCRYPT_CALL

SymCryptEcpointGenericSetRandom(

    _In_    PCSYMCRYPT_ECURVE       pCurve,

    _Out_   PSYMCRYPT_INT           piScalar,

    _Out_   PSYMCRYPT_ECPOINT       poDst,

    _Out_writes_bytes_( cbScratch )

            PBYTE                   pbScratch,

            SIZE_T                  cbScratch )

{

    PSYMCRYPT_MODELEMENT peScalar = NULL;

    SYMCRYPT_ASSERT( SymCryptEcurveIsSame(pCurve, poDst->pCurve) );

    SYMCRYPT_ASSERT( cbScratch >= SYMCRYPT_INTERNAL_SCRATCH_BYTES_FOR_SCALAR_ECURVE_OPERATIONS(pCurve, 1) );

    SYMCRYPT_ASSERT( cbScratch >= pCurve->cbModElement );

    peScalar = SymCryptModElementCreate( pbScratch, pCurve->cbModElement, pCurve->GOrd );

    SYMCRYPT_ASSERT( peScalar != NULL );

    // Setting a random mod element in the [1, SubgroupOrder-1] set

    SymCryptModSetRandom( pCurve->GOrd, peScalar, (SYMCRYPT_FLAG_MODRANDOM_ALLOW_ONE|SYMCRYPT_FLAG_MODRANDOM_ALLOW_MINUSONE), pbScratch + pCurve->cbModElement, cbScratch - pCurve->cbModElement );

    // Setting the integer

    SymCryptModElementToInt( pCurve->GOrd, peScalar, piScalar, pbScratch + pCurve->cbModElement, cbScratch - pCurve->cbModElement );

    // Do the multiplication (pass over the entire scratch space as it is not needed anymore)

    // !! Explicitly not checking the error return here as the only error is from specifying invalid flags !!

    SymCryptEcpointScalarMul( pCurve, piScalar, NULL, 0, poDst, pbScratch, cbScratch );

}