Coverage Report

Created: 2024-11-21 07:03

/src/openssl/crypto/ec/ec_lib.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved.
3
 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4
 *
5
 * Licensed under the Apache License 2.0 (the "License").  You may not use
6
 * this file except in compliance with the License.  You can obtain a copy
7
 * in the file LICENSE in the source distribution or at
8
 * https://www.openssl.org/source/license.html
9
 */
10
11
/*
12
 * EC_GROUP low level APIs are deprecated for public use, but still ok for
13
 * internal use.
14
 */
15
#include "internal/deprecated.h"
16
17
#include <string.h>
18
#include <openssl/params.h>
19
#include <openssl/core_names.h>
20
#include <openssl/err.h>
21
#include <openssl/opensslv.h>
22
#include <openssl/param_build.h>
23
#include "crypto/ec.h"
24
#include "internal/nelem.h"
25
#include "ec_local.h"
26
27
/* functions for EC_GROUP objects */
28
29
EC_GROUP *ossl_ec_group_new_ex(OSSL_LIB_CTX *libctx, const char *propq,
30
                               const EC_METHOD *meth)
31
5.20k
{
32
5.20k
    EC_GROUP *ret;
33
34
5.20k
    if (meth == NULL) {
35
0
        ERR_raise(ERR_LIB_EC, EC_R_SLOT_FULL);
36
0
        return NULL;
37
0
    }
38
5.20k
    if (meth->group_init == 0) {
39
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
40
0
        return NULL;
41
0
    }
42
43
5.20k
    ret = OPENSSL_zalloc(sizeof(*ret));
44
5.20k
    if (ret == NULL)
45
0
        return NULL;
46
47
5.20k
    ret->libctx = libctx;
48
5.20k
    if (propq != NULL) {
49
0
        ret->propq = OPENSSL_strdup(propq);
50
0
        if (ret->propq == NULL)
51
0
            goto err;
52
0
    }
53
5.20k
    ret->meth = meth;
54
5.20k
    if ((ret->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {
55
5.20k
        ret->order = BN_new();
56
5.20k
        if (ret->order == NULL)
57
0
            goto err;
58
5.20k
        ret->cofactor = BN_new();
59
5.20k
        if (ret->cofactor == NULL)
60
0
            goto err;
61
5.20k
    }
62
5.20k
    ret->asn1_flag = OPENSSL_EC_EXPLICIT_CURVE;
63
5.20k
    ret->asn1_form = POINT_CONVERSION_UNCOMPRESSED;
64
5.20k
    if (!meth->group_init(ret))
65
0
        goto err;
66
5.20k
    return ret;
67
68
0
 err:
69
0
    BN_free(ret->order);
70
0
    BN_free(ret->cofactor);
71
0
    OPENSSL_free(ret->propq);
72
0
    OPENSSL_free(ret);
73
0
    return NULL;
74
5.20k
}
75
76
#ifndef OPENSSL_NO_DEPRECATED_3_0
77
# ifndef FIPS_MODULE
78
EC_GROUP *EC_GROUP_new(const EC_METHOD *meth)
79
0
{
80
0
    return ossl_ec_group_new_ex(NULL, NULL, meth);
81
0
}
82
# endif
83
#endif
84
85
void EC_pre_comp_free(EC_GROUP *group)
86
5.25k
{
87
5.25k
    switch (group->pre_comp_type) {
88
5.20k
    case PCT_none:
89
5.20k
        break;
90
0
    case PCT_nistz256:
91
#ifdef ECP_NISTZ256_ASM
92
        EC_nistz256_pre_comp_free(group->pre_comp.nistz256);
93
#endif
94
0
        break;
95
#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
96
    case PCT_nistp224:
97
        EC_nistp224_pre_comp_free(group->pre_comp.nistp224);
98
        break;
99
    case PCT_nistp256:
100
        EC_nistp256_pre_comp_free(group->pre_comp.nistp256);
101
        break;
102
    case PCT_nistp384:
103
        ossl_ec_nistp384_pre_comp_free(group->pre_comp.nistp384);
104
        break;
105
    case PCT_nistp521:
106
        EC_nistp521_pre_comp_free(group->pre_comp.nistp521);
107
        break;
108
#else
109
0
    case PCT_nistp224:
110
0
    case PCT_nistp256:
111
0
    case PCT_nistp384:
112
0
    case PCT_nistp521:
113
0
        break;
114
0
#endif
115
50
    case PCT_ec:
116
50
        EC_ec_pre_comp_free(group->pre_comp.ec);
117
50
        break;
118
5.25k
    }
119
5.25k
    group->pre_comp.ec = NULL;
120
5.25k
}
121
122
void EC_GROUP_free(EC_GROUP *group)
123
9.02k
{
124
9.02k
    if (!group)
125
3.82k
        return;
126
127
5.20k
    if (group->meth->group_finish != 0)
128
5.20k
        group->meth->group_finish(group);
129
130
5.20k
    EC_pre_comp_free(group);
131
5.20k
    BN_MONT_CTX_free(group->mont_data);
132
5.20k
    EC_POINT_free(group->generator);
133
5.20k
    BN_free(group->order);
134
5.20k
    BN_free(group->cofactor);
135
5.20k
    OPENSSL_free(group->seed);
136
5.20k
    OPENSSL_free(group->propq);
137
5.20k
    OPENSSL_free(group);
138
5.20k
}
139
140
#ifndef OPENSSL_NO_DEPRECATED_3_0
141
void EC_GROUP_clear_free(EC_GROUP *group)
142
0
{
143
0
    if (!group)
144
0
        return;
145
146
0
    if (group->meth->group_clear_finish != 0)
147
0
        group->meth->group_clear_finish(group);
148
0
    else if (group->meth->group_finish != 0)
149
0
        group->meth->group_finish(group);
150
151
0
    EC_pre_comp_free(group);
152
0
    BN_MONT_CTX_free(group->mont_data);
153
0
    EC_POINT_clear_free(group->generator);
154
0
    BN_clear_free(group->order);
155
0
    BN_clear_free(group->cofactor);
156
0
    OPENSSL_clear_free(group->seed, group->seed_len);
157
0
    OPENSSL_clear_free(group, sizeof(*group));
158
0
}
159
#endif
160
161
int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
162
2.54k
{
163
2.54k
    if (dest->meth->group_copy == 0) {
164
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
165
0
        return 0;
166
0
    }
167
2.54k
    if (dest->meth != src->meth) {
168
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
169
0
        return 0;
170
0
    }
171
2.54k
    if (dest == src)
172
0
        return 1;
173
174
2.54k
    dest->libctx = src->libctx;
175
2.54k
    dest->curve_name = src->curve_name;
176
177
    /* Copy precomputed */
178
2.54k
    dest->pre_comp_type = src->pre_comp_type;
179
2.54k
    switch (src->pre_comp_type) {
180
2.54k
    case PCT_none:
181
2.54k
        dest->pre_comp.ec = NULL;
182
2.54k
        break;
183
0
    case PCT_nistz256:
184
#ifdef ECP_NISTZ256_ASM
185
        dest->pre_comp.nistz256 = EC_nistz256_pre_comp_dup(src->pre_comp.nistz256);
186
#endif
187
0
        break;
188
#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
189
    case PCT_nistp224:
190
        dest->pre_comp.nistp224 = EC_nistp224_pre_comp_dup(src->pre_comp.nistp224);
191
        break;
192
    case PCT_nistp256:
193
        dest->pre_comp.nistp256 = EC_nistp256_pre_comp_dup(src->pre_comp.nistp256);
194
        break;
195
    case PCT_nistp384:
196
        dest->pre_comp.nistp384 = ossl_ec_nistp384_pre_comp_dup(src->pre_comp.nistp384);
197
        break;
198
    case PCT_nistp521:
199
        dest->pre_comp.nistp521 = EC_nistp521_pre_comp_dup(src->pre_comp.nistp521);
200
        break;
201
#else
202
0
    case PCT_nistp224:
203
0
    case PCT_nistp256:
204
0
    case PCT_nistp384:
205
0
    case PCT_nistp521:
206
0
        break;
207
0
#endif
208
0
    case PCT_ec:
209
0
        dest->pre_comp.ec = EC_ec_pre_comp_dup(src->pre_comp.ec);
210
0
        break;
211
2.54k
    }
212
213
2.54k
    if (src->mont_data != NULL) {
214
2.54k
        if (dest->mont_data == NULL) {
215
2.54k
            dest->mont_data = BN_MONT_CTX_new();
216
2.54k
            if (dest->mont_data == NULL)
217
0
                return 0;
218
2.54k
        }
219
2.54k
        if (!BN_MONT_CTX_copy(dest->mont_data, src->mont_data))
220
0
            return 0;
221
2.54k
    } else {
222
        /* src->generator == NULL */
223
0
        BN_MONT_CTX_free(dest->mont_data);
224
0
        dest->mont_data = NULL;
225
0
    }
226
227
2.54k
    if (src->generator != NULL) {
228
2.54k
        if (dest->generator == NULL) {
229
2.54k
            dest->generator = EC_POINT_new(dest);
230
2.54k
            if (dest->generator == NULL)
231
0
                return 0;
232
2.54k
        }
233
2.54k
        if (!EC_POINT_copy(dest->generator, src->generator))
234
0
            return 0;
235
2.54k
    } else {
236
        /* src->generator == NULL */
237
0
        EC_POINT_clear_free(dest->generator);
238
0
        dest->generator = NULL;
239
0
    }
240
241
2.54k
    if ((src->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {
242
2.54k
        if (!BN_copy(dest->order, src->order))
243
0
            return 0;
244
2.54k
        if (!BN_copy(dest->cofactor, src->cofactor))
245
0
            return 0;
246
2.54k
    }
247
248
2.54k
    dest->asn1_flag = src->asn1_flag;
249
2.54k
    dest->asn1_form = src->asn1_form;
250
2.54k
    dest->decoded_from_explicit_params = src->decoded_from_explicit_params;
251
252
2.54k
    if (src->seed) {
253
1.90k
        OPENSSL_free(dest->seed);
254
1.90k
        if ((dest->seed = OPENSSL_malloc(src->seed_len)) == NULL)
255
0
            return 0;
256
1.90k
        if (!memcpy(dest->seed, src->seed, src->seed_len))
257
0
            return 0;
258
1.90k
        dest->seed_len = src->seed_len;
259
1.90k
    } else {
260
643
        OPENSSL_free(dest->seed);
261
643
        dest->seed = NULL;
262
643
        dest->seed_len = 0;
263
643
    }
264
265
2.54k
    return dest->meth->group_copy(dest, src);
266
2.54k
}
267
268
EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
269
1.34k
{
270
1.34k
    EC_GROUP *t = NULL;
271
1.34k
    int ok = 0;
272
273
1.34k
    if (a == NULL)
274
0
        return NULL;
275
276
1.34k
    if ((t = ossl_ec_group_new_ex(a->libctx, a->propq, a->meth)) == NULL)
277
0
        return NULL;
278
1.34k
    if (!EC_GROUP_copy(t, a))
279
0
        goto err;
280
281
1.34k
    ok = 1;
282
283
1.34k
 err:
284
1.34k
    if (!ok) {
285
0
        EC_GROUP_free(t);
286
0
        return NULL;
287
0
    }
288
1.34k
        return t;
289
1.34k
}
290
291
#ifndef OPENSSL_NO_DEPRECATED_3_0
292
const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *group)
293
0
{
294
0
    return group->meth;
295
0
}
296
297
int EC_METHOD_get_field_type(const EC_METHOD *meth)
298
0
{
299
0
    return meth->field_type;
300
0
}
301
#endif
302
303
static int ec_precompute_mont_data(EC_GROUP *);
304
305
/*-
306
 * Try computing cofactor from the generator order (n) and field cardinality (q).
307
 * This works for all curves of cryptographic interest.
308
 *
309
 * Hasse thm: q + 1 - 2*sqrt(q) <= n*h <= q + 1 + 2*sqrt(q)
310
 * h_min = (q + 1 - 2*sqrt(q))/n
311
 * h_max = (q + 1 + 2*sqrt(q))/n
312
 * h_max - h_min = 4*sqrt(q)/n
313
 * So if n > 4*sqrt(q) holds, there is only one possible value for h:
314
 * h = \lfloor (h_min + h_max)/2 \rceil = \lfloor (q + 1)/n \rceil
315
 *
316
 * Otherwise, zero cofactor and return success.
317
 */
318
0
static int ec_guess_cofactor(EC_GROUP *group) {
319
0
    int ret = 0;
320
0
    BN_CTX *ctx = NULL;
321
0
    BIGNUM *q = NULL;
322
323
    /*-
324
     * If the cofactor is too large, we cannot guess it.
325
     * The RHS of below is a strict overestimate of lg(4 * sqrt(q))
326
     */
327
0
    if (BN_num_bits(group->order) <= (BN_num_bits(group->field) + 1) / 2 + 3) {
328
        /* default to 0 */
329
0
        BN_zero(group->cofactor);
330
        /* return success */
331
0
        return 1;
332
0
    }
333
334
0
    if ((ctx = BN_CTX_new_ex(group->libctx)) == NULL)
335
0
        return 0;
336
337
0
    BN_CTX_start(ctx);
338
0
    if ((q = BN_CTX_get(ctx)) == NULL)
339
0
        goto err;
340
341
    /* set q = 2**m for binary fields; q = p otherwise */
342
0
    if (group->meth->field_type == NID_X9_62_characteristic_two_field) {
343
0
        BN_zero(q);
344
0
        if (!BN_set_bit(q, BN_num_bits(group->field) - 1))
345
0
            goto err;
346
0
    } else {
347
0
        if (!BN_copy(q, group->field))
348
0
            goto err;
349
0
    }
350
351
    /* compute h = \lfloor (q + 1)/n \rceil = \lfloor (q + 1 + n/2)/n \rfloor */
352
0
    if (!BN_rshift1(group->cofactor, group->order) /* n/2 */
353
0
        || !BN_add(group->cofactor, group->cofactor, q) /* q + n/2 */
354
        /* q + 1 + n/2 */
355
0
        || !BN_add(group->cofactor, group->cofactor, BN_value_one())
356
        /* (q + 1 + n/2)/n */
357
0
        || !BN_div(group->cofactor, NULL, group->cofactor, group->order, ctx))
358
0
        goto err;
359
0
    ret = 1;
360
0
 err:
361
0
    BN_CTX_end(ctx);
362
0
    BN_CTX_free(ctx);
363
0
    return ret;
364
0
}
365
366
int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
367
                           const BIGNUM *order, const BIGNUM *cofactor)
368
2.29k
{
369
2.29k
    if (generator == NULL) {
370
0
        ERR_raise(ERR_LIB_EC, ERR_R_PASSED_NULL_PARAMETER);
371
0
        return 0;
372
0
    }
373
374
    /* require group->field >= 1 */
375
2.29k
    if (group->field == NULL || BN_is_zero(group->field)
376
2.29k
        || BN_is_negative(group->field)) {
377
0
        ERR_raise(ERR_LIB_EC, EC_R_INVALID_FIELD);
378
0
        return 0;
379
0
    }
380
381
    /*-
382
     * - require order >= 1
383
     * - enforce upper bound due to Hasse thm: order can be no more than one bit
384
     *   longer than field cardinality
385
     */
386
2.29k
    if (order == NULL || BN_is_zero(order) || BN_is_negative(order)
387
2.29k
        || BN_num_bits(order) > BN_num_bits(group->field) + 1) {
388
0
        ERR_raise(ERR_LIB_EC, EC_R_INVALID_GROUP_ORDER);
389
0
        return 0;
390
0
    }
391
392
    /*-
393
     * Unfortunately the cofactor is an optional field in many standards.
394
     * Internally, the lib uses 0 cofactor as a marker for "unknown cofactor".
395
     * So accept cofactor == NULL or cofactor >= 0.
396
     */
397
2.29k
    if (cofactor != NULL && BN_is_negative(cofactor)) {
398
0
        ERR_raise(ERR_LIB_EC, EC_R_UNKNOWN_COFACTOR);
399
0
        return 0;
400
0
    }
401
402
2.29k
    if (group->generator == NULL) {
403
2.29k
        group->generator = EC_POINT_new(group);
404
2.29k
        if (group->generator == NULL)
405
0
            return 0;
406
2.29k
    }
407
2.29k
    if (!EC_POINT_copy(group->generator, generator))
408
0
        return 0;
409
410
2.29k
    if (!BN_copy(group->order, order))
411
0
        return 0;
412
413
    /* Either take the provided positive cofactor, or try to compute it */
414
2.29k
    if (cofactor != NULL && !BN_is_zero(cofactor)) {
415
2.29k
        if (!BN_copy(group->cofactor, cofactor))
416
0
            return 0;
417
2.29k
    } else if (!ec_guess_cofactor(group)) {
418
0
        BN_zero(group->cofactor);
419
0
        return 0;
420
0
    }
421
422
    /*
423
     * Some groups have an order with
424
     * factors of two, which makes the Montgomery setup fail.
425
     * |group->mont_data| will be NULL in this case.
426
     */
427
2.29k
    if (BN_is_odd(group->order)) {
428
2.29k
        return ec_precompute_mont_data(group);
429
2.29k
    }
430
431
0
    BN_MONT_CTX_free(group->mont_data);
432
0
    group->mont_data = NULL;
433
0
    return 1;
434
2.29k
}
435
436
const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group)
437
510
{
438
510
    return group->generator;
439
510
}
440
441
BN_MONT_CTX *EC_GROUP_get_mont_data(const EC_GROUP *group)
442
0
{
443
0
    return group->mont_data;
444
0
}
445
446
int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx)
447
0
{
448
0
    if (group->order == NULL)
449
0
        return 0;
450
0
    if (!BN_copy(order, group->order))
451
0
        return 0;
452
453
0
    return !BN_is_zero(order);
454
0
}
455
456
const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group)
457
1.71k
{
458
1.71k
    return group->order;
459
1.71k
}
460
461
int EC_GROUP_order_bits(const EC_GROUP *group)
462
50
{
463
50
    return group->meth->group_order_bits(group);
464
50
}
465
466
int EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor,
467
                          BN_CTX *ctx)
468
0
{
469
470
0
    if (group->cofactor == NULL)
471
0
        return 0;
472
0
    if (!BN_copy(cofactor, group->cofactor))
473
0
        return 0;
474
475
0
    return !BN_is_zero(group->cofactor);
476
0
}
477
478
const BIGNUM *EC_GROUP_get0_cofactor(const EC_GROUP *group)
479
6
{
480
6
    return group->cofactor;
481
6
}
482
483
void EC_GROUP_set_curve_name(EC_GROUP *group, int nid)
484
2.65k
{
485
2.65k
    group->curve_name = nid;
486
2.65k
    group->asn1_flag =
487
2.65k
        (nid != NID_undef)
488
2.65k
        ? OPENSSL_EC_NAMED_CURVE
489
2.65k
        : OPENSSL_EC_EXPLICIT_CURVE;
490
2.65k
}
491
492
int EC_GROUP_get_curve_name(const EC_GROUP *group)
493
1.34k
{
494
1.34k
    return group->curve_name;
495
1.34k
}
496
497
const BIGNUM *EC_GROUP_get0_field(const EC_GROUP *group)
498
0
{
499
0
    return group->field;
500
0
}
501
502
int EC_GROUP_get_field_type(const EC_GROUP *group)
503
6
{
504
6
    return group->meth->field_type;
505
6
}
506
507
void EC_GROUP_set_asn1_flag(EC_GROUP *group, int flag)
508
0
{
509
0
    group->asn1_flag = flag;
510
0
}
511
512
int EC_GROUP_get_asn1_flag(const EC_GROUP *group)
513
2.29k
{
514
2.29k
    return group->asn1_flag;
515
2.29k
}
516
517
void EC_GROUP_set_point_conversion_form(EC_GROUP *group,
518
                                        point_conversion_form_t form)
519
0
{
520
0
    group->asn1_form = form;
521
0
}
522
523
point_conversion_form_t EC_GROUP_get_point_conversion_form(const EC_GROUP
524
                                                           *group)
525
0
{
526
0
    return group->asn1_form;
527
0
}
528
529
size_t EC_GROUP_set_seed(EC_GROUP *group, const unsigned char *p, size_t len)
530
1.71k
{
531
1.71k
    OPENSSL_free(group->seed);
532
1.71k
    group->seed = NULL;
533
1.71k
    group->seed_len = 0;
534
535
1.71k
    if (!len || !p)
536
0
        return 1;
537
538
1.71k
    if ((group->seed = OPENSSL_malloc(len)) == NULL)
539
0
        return 0;
540
1.71k
    memcpy(group->seed, p, len);
541
1.71k
    group->seed_len = len;
542
543
1.71k
    return len;
544
1.71k
}
545
546
unsigned char *EC_GROUP_get0_seed(const EC_GROUP *group)
547
0
{
548
0
    return group->seed;
549
0
}
550
551
size_t EC_GROUP_get_seed_len(const EC_GROUP *group)
552
0
{
553
0
    return group->seed_len;
554
0
}
555
556
int EC_GROUP_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
557
                       const BIGNUM *b, BN_CTX *ctx)
558
2.29k
{
559
2.29k
    if (group->meth->group_set_curve == 0) {
560
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
561
0
        return 0;
562
0
    }
563
2.29k
    return group->meth->group_set_curve(group, p, a, b, ctx);
564
2.29k
}
565
566
int EC_GROUP_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b,
567
                       BN_CTX *ctx)
568
0
{
569
0
    if (group->meth->group_get_curve == NULL) {
570
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
571
0
        return 0;
572
0
    }
573
0
    return group->meth->group_get_curve(group, p, a, b, ctx);
574
0
}
575
576
#ifndef OPENSSL_NO_DEPRECATED_3_0
577
int EC_GROUP_set_curve_GFp(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
578
                           const BIGNUM *b, BN_CTX *ctx)
579
0
{
580
0
    return EC_GROUP_set_curve(group, p, a, b, ctx);
581
0
}
582
583
int EC_GROUP_get_curve_GFp(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
584
                           BIGNUM *b, BN_CTX *ctx)
585
0
{
586
0
    return EC_GROUP_get_curve(group, p, a, b, ctx);
587
0
}
588
589
# ifndef OPENSSL_NO_EC2M
590
int EC_GROUP_set_curve_GF2m(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
591
                            const BIGNUM *b, BN_CTX *ctx)
592
0
{
593
0
    return EC_GROUP_set_curve(group, p, a, b, ctx);
594
0
}
595
596
int EC_GROUP_get_curve_GF2m(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
597
                            BIGNUM *b, BN_CTX *ctx)
598
0
{
599
0
    return EC_GROUP_get_curve(group, p, a, b, ctx);
600
0
}
601
# endif
602
#endif
603
604
int EC_GROUP_get_degree(const EC_GROUP *group)
605
16
{
606
16
    if (group->meth->group_get_degree == 0) {
607
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
608
0
        return 0;
609
0
    }
610
16
    return group->meth->group_get_degree(group);
611
16
}
612
613
int EC_GROUP_check_discriminant(const EC_GROUP *group, BN_CTX *ctx)
614
0
{
615
0
    if (group->meth->group_check_discriminant == 0) {
616
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
617
0
        return 0;
618
0
    }
619
0
    return group->meth->group_check_discriminant(group, ctx);
620
0
}
621
622
int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ctx)
623
0
{
624
0
    int r = 0;
625
0
    BIGNUM *a1, *a2, *a3, *b1, *b2, *b3;
626
0
#ifndef FIPS_MODULE
627
0
    BN_CTX *ctx_new = NULL;
628
0
#endif
629
630
    /* compare the field types */
631
0
    if (EC_GROUP_get_field_type(a) != EC_GROUP_get_field_type(b))
632
0
        return 1;
633
    /* compare the curve name (if present in both) */
634
0
    if (EC_GROUP_get_curve_name(a) && EC_GROUP_get_curve_name(b) &&
635
0
        EC_GROUP_get_curve_name(a) != EC_GROUP_get_curve_name(b))
636
0
        return 1;
637
0
    if (a->meth->flags & EC_FLAGS_CUSTOM_CURVE)
638
0
        return 0;
639
640
0
#ifndef FIPS_MODULE
641
0
    if (ctx == NULL)
642
0
        ctx_new = ctx = BN_CTX_new();
643
0
#endif
644
0
    if (ctx == NULL)
645
0
        return -1;
646
647
0
    BN_CTX_start(ctx);
648
0
    a1 = BN_CTX_get(ctx);
649
0
    a2 = BN_CTX_get(ctx);
650
0
    a3 = BN_CTX_get(ctx);
651
0
    b1 = BN_CTX_get(ctx);
652
0
    b2 = BN_CTX_get(ctx);
653
0
    b3 = BN_CTX_get(ctx);
654
0
    if (b3 == NULL) {
655
0
        BN_CTX_end(ctx);
656
0
#ifndef FIPS_MODULE
657
0
        BN_CTX_free(ctx_new);
658
0
#endif
659
0
        return -1;
660
0
    }
661
662
    /*
663
     * XXX This approach assumes that the external representation of curves
664
     * over the same field type is the same.
665
     */
666
0
    if (!a->meth->group_get_curve(a, a1, a2, a3, ctx) ||
667
0
        !b->meth->group_get_curve(b, b1, b2, b3, ctx))
668
0
        r = 1;
669
670
    /* return 1 if the curve parameters are different */
671
0
    if (r || BN_cmp(a1, b1) != 0 || BN_cmp(a2, b2) != 0 || BN_cmp(a3, b3) != 0)
672
0
        r = 1;
673
674
    /* XXX EC_POINT_cmp() assumes that the methods are equal */
675
    /* return 1 if the generators are different */
676
0
    if (r || EC_POINT_cmp(a, EC_GROUP_get0_generator(a),
677
0
                          EC_GROUP_get0_generator(b), ctx) != 0)
678
0
        r = 1;
679
680
0
    if (!r) {
681
0
        const BIGNUM *ao, *bo, *ac, *bc;
682
        /* compare the orders */
683
0
        ao = EC_GROUP_get0_order(a);
684
0
        bo = EC_GROUP_get0_order(b);
685
0
        if (ao == NULL || bo == NULL) {
686
            /* return an error if either order is NULL */
687
0
            r = -1;
688
0
            goto end;
689
0
        }
690
0
        if (BN_cmp(ao, bo) != 0) {
691
            /* return 1 if orders are different */
692
0
            r = 1;
693
0
            goto end;
694
0
        }
695
        /*
696
         * It gets here if the curve parameters and generator matched.
697
         * Now check the optional cofactors (if both are present).
698
         */
699
0
        ac = EC_GROUP_get0_cofactor(a);
700
0
        bc = EC_GROUP_get0_cofactor(b);
701
        /* Returns 1 (mismatch) if both cofactors are specified and different */
702
0
        if (!BN_is_zero(ac) && !BN_is_zero(bc) && BN_cmp(ac, bc) != 0)
703
0
            r = 1;
704
        /* Returns 0 if the parameters matched */
705
0
    }
706
0
end:
707
0
    BN_CTX_end(ctx);
708
0
#ifndef FIPS_MODULE
709
0
    BN_CTX_free(ctx_new);
710
0
#endif
711
0
    return r;
712
0
}
713
714
/* functions for EC_POINT objects */
715
716
EC_POINT *EC_POINT_new(const EC_GROUP *group)
717
36.2k
{
718
36.2k
    EC_POINT *ret;
719
720
36.2k
    if (group == NULL) {
721
0
        ERR_raise(ERR_LIB_EC, ERR_R_PASSED_NULL_PARAMETER);
722
0
        return NULL;
723
0
    }
724
36.2k
    if (group->meth->point_init == NULL) {
725
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
726
0
        return NULL;
727
0
    }
728
729
36.2k
    ret = OPENSSL_zalloc(sizeof(*ret));
730
36.2k
    if (ret == NULL)
731
0
        return NULL;
732
733
36.2k
    ret->meth = group->meth;
734
36.2k
    ret->curve_name = group->curve_name;
735
736
36.2k
    if (!ret->meth->point_init(ret)) {
737
0
        OPENSSL_free(ret);
738
0
        return NULL;
739
0
    }
740
741
36.2k
    return ret;
742
36.2k
}
743
744
void EC_POINT_free(EC_POINT *point)
745
37.4k
{
746
37.4k
    if (point == NULL)
747
4.07k
        return;
748
749
#ifdef FIPS_MODULE
750
    EC_POINT_clear_free(point);
751
#else
752
33.3k
    if (point->meth->point_finish != 0)
753
33.3k
        point->meth->point_finish(point);
754
33.3k
    OPENSSL_free(point);
755
33.3k
#endif
756
33.3k
}
757
758
void EC_POINT_clear_free(EC_POINT *point)
759
2.96k
{
760
2.96k
    if (point == NULL)
761
0
        return;
762
763
2.96k
    if (point->meth->point_clear_finish != 0)
764
2.96k
        point->meth->point_clear_finish(point);
765
0
    else if (point->meth->point_finish != 0)
766
0
        point->meth->point_finish(point);
767
2.96k
    OPENSSL_clear_free(point, sizeof(*point));
768
2.96k
}
769
770
int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src)
771
13.5k
{
772
13.5k
    if (dest->meth->point_copy == 0) {
773
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
774
0
        return 0;
775
0
    }
776
13.5k
    if (dest->meth != src->meth
777
13.5k
            || (dest->curve_name != src->curve_name
778
13.5k
                 && dest->curve_name != 0
779
13.5k
                 && src->curve_name != 0)) {
780
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
781
0
        return 0;
782
0
    }
783
13.5k
    if (dest == src)
784
0
        return 1;
785
13.5k
    return dest->meth->point_copy(dest, src);
786
13.5k
}
787
788
EC_POINT *EC_POINT_dup(const EC_POINT *a, const EC_GROUP *group)
789
421
{
790
421
    EC_POINT *t;
791
421
    int r;
792
793
421
    if (a == NULL)
794
0
        return NULL;
795
796
421
    t = EC_POINT_new(group);
797
421
    if (t == NULL)
798
0
        return NULL;
799
421
    r = EC_POINT_copy(t, a);
800
421
    if (!r) {
801
0
        EC_POINT_free(t);
802
0
        return NULL;
803
0
    }
804
421
    return t;
805
421
}
806
807
#ifndef OPENSSL_NO_DEPRECATED_3_0
808
const EC_METHOD *EC_POINT_method_of(const EC_POINT *point)
809
0
{
810
0
    return point->meth;
811
0
}
812
#endif
813
814
int EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point)
815
17
{
816
17
    if (group->meth->point_set_to_infinity == 0) {
817
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
818
0
        return 0;
819
0
    }
820
17
    if (group->meth != point->meth) {
821
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
822
0
        return 0;
823
0
    }
824
17
    return group->meth->point_set_to_infinity(group, point);
825
17
}
826
827
#ifndef OPENSSL_NO_DEPRECATED_3_0
828
int EC_POINT_set_Jprojective_coordinates_GFp(const EC_GROUP *group,
829
                                             EC_POINT *point, const BIGNUM *x,
830
                                             const BIGNUM *y, const BIGNUM *z,
831
                                             BN_CTX *ctx)
832
3.90k
{
833
3.90k
    if (group->meth->field_type != NID_X9_62_prime_field) {
834
28
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
835
28
        return 0;
836
28
    }
837
3.87k
    if (!ec_point_is_compat(point, group)) {
838
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
839
0
        return 0;
840
0
    }
841
3.87k
    return ossl_ec_GFp_simple_set_Jprojective_coordinates_GFp(group, point,
842
3.87k
                                                              x, y, z, ctx);
843
3.87k
}
844
845
int EC_POINT_get_Jprojective_coordinates_GFp(const EC_GROUP *group,
846
                                             const EC_POINT *point, BIGNUM *x,
847
                                             BIGNUM *y, BIGNUM *z,
848
                                             BN_CTX *ctx)
849
0
{
850
0
    if (group->meth->field_type != NID_X9_62_prime_field) {
851
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
852
0
        return 0;
853
0
    }
854
0
    if (!ec_point_is_compat(point, group)) {
855
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
856
0
        return 0;
857
0
    }
858
0
    return ossl_ec_GFp_simple_get_Jprojective_coordinates_GFp(group, point,
859
0
                                                              x, y, z, ctx);
860
0
}
861
#endif
862
863
int EC_POINT_set_affine_coordinates(const EC_GROUP *group, EC_POINT *point,
864
                                    const BIGNUM *x, const BIGNUM *y,
865
                                    BN_CTX *ctx)
866
3.82k
{
867
3.82k
    if (group->meth->point_set_affine_coordinates == NULL) {
868
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
869
0
        return 0;
870
0
    }
871
3.82k
    if (!ec_point_is_compat(point, group)) {
872
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
873
0
        return 0;
874
0
    }
875
3.82k
    if (!group->meth->point_set_affine_coordinates(group, point, x, y, ctx))
876
0
        return 0;
877
878
3.82k
    if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
879
464
        ERR_raise(ERR_LIB_EC, EC_R_POINT_IS_NOT_ON_CURVE);
880
464
        return 0;
881
464
    }
882
3.35k
    return 1;
883
3.82k
}
884
885
#ifndef OPENSSL_NO_DEPRECATED_3_0
886
int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group,
887
                                        EC_POINT *point, const BIGNUM *x,
888
                                        const BIGNUM *y, BN_CTX *ctx)
889
0
{
890
0
    return EC_POINT_set_affine_coordinates(group, point, x, y, ctx);
891
0
}
892
893
# ifndef OPENSSL_NO_EC2M
894
int EC_POINT_set_affine_coordinates_GF2m(const EC_GROUP *group,
895
                                         EC_POINT *point, const BIGNUM *x,
896
                                         const BIGNUM *y, BN_CTX *ctx)
897
0
{
898
0
    return EC_POINT_set_affine_coordinates(group, point, x, y, ctx);
899
0
}
900
# endif
901
#endif
902
903
int EC_POINT_get_affine_coordinates(const EC_GROUP *group,
904
                                    const EC_POINT *point, BIGNUM *x, BIGNUM *y,
905
                                    BN_CTX *ctx)
906
1.59k
{
907
1.59k
    if (group->meth->point_get_affine_coordinates == NULL) {
908
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
909
0
        return 0;
910
0
    }
911
1.59k
    if (!ec_point_is_compat(point, group)) {
912
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
913
0
        return 0;
914
0
    }
915
1.59k
    if (EC_POINT_is_at_infinity(group, point)) {
916
18
        ERR_raise(ERR_LIB_EC, EC_R_POINT_AT_INFINITY);
917
18
        return 0;
918
18
    }
919
1.58k
    return group->meth->point_get_affine_coordinates(group, point, x, y, ctx);
920
1.59k
}
921
922
#ifndef OPENSSL_NO_DEPRECATED_3_0
923
int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group,
924
                                        const EC_POINT *point, BIGNUM *x,
925
                                        BIGNUM *y, BN_CTX *ctx)
926
{
927
    return EC_POINT_get_affine_coordinates(group, point, x, y, ctx);
928
}
929
930
# ifndef OPENSSL_NO_EC2M
931
int EC_POINT_get_affine_coordinates_GF2m(const EC_GROUP *group,
932
                                         const EC_POINT *point, BIGNUM *x,
933
                                         BIGNUM *y, BN_CTX *ctx)
934
0
{
935
0
    return EC_POINT_get_affine_coordinates(group, point, x, y, ctx);
936
0
}
937
# endif
938
#endif
939
940
int EC_POINT_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
941
                 const EC_POINT *b, BN_CTX *ctx)
942
30.4k
{
943
30.4k
    if (group->meth->add == 0) {
944
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
945
0
        return 0;
946
0
    }
947
30.4k
    if (!ec_point_is_compat(r, group) || !ec_point_is_compat(a, group)
948
30.4k
        || !ec_point_is_compat(b, group)) {
949
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
950
0
        return 0;
951
0
    }
952
30.4k
    return group->meth->add(group, r, a, b, ctx);
953
30.4k
}
954
955
int EC_POINT_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
956
                 BN_CTX *ctx)
957
59.4k
{
958
59.4k
    if (group->meth->dbl == 0) {
959
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
960
0
        return 0;
961
0
    }
962
59.4k
    if (!ec_point_is_compat(r, group) || !ec_point_is_compat(a, group)) {
963
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
964
0
        return 0;
965
0
    }
966
59.4k
    return group->meth->dbl(group, r, a, ctx);
967
59.4k
}
968
969
int EC_POINT_invert(const EC_GROUP *group, EC_POINT *a, BN_CTX *ctx)
970
7.59k
{
971
7.59k
    if (group->meth->invert == 0) {
972
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
973
0
        return 0;
974
0
    }
975
7.59k
    if (!ec_point_is_compat(a, group)) {
976
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
977
0
        return 0;
978
0
    }
979
7.59k
    return group->meth->invert(group, a, ctx);
980
7.59k
}
981
982
int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point)
983
135k
{
984
135k
    if (group->meth->is_at_infinity == 0) {
985
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
986
0
        return 0;
987
0
    }
988
135k
    if (!ec_point_is_compat(point, group)) {
989
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
990
0
        return 0;
991
0
    }
992
135k
    return group->meth->is_at_infinity(group, point);
993
135k
}
994
995
/*
996
 * Check whether an EC_POINT is on the curve or not. Note that the return
997
 * value for this function should NOT be treated as a boolean. Return values:
998
 *  1: The point is on the curve
999
 *  0: The point is not on the curve
1000
 * -1: An error occurred
1001
 */
1002
int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
1003
                         BN_CTX *ctx)
1004
4.54k
{
1005
4.54k
    if (group->meth->is_on_curve == 0) {
1006
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1007
0
        return 0;
1008
0
    }
1009
4.54k
    if (!ec_point_is_compat(point, group)) {
1010
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
1011
0
        return 0;
1012
0
    }
1013
4.54k
    return group->meth->is_on_curve(group, point, ctx);
1014
4.54k
}
1015
1016
int EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b,
1017
                 BN_CTX *ctx)
1018
12
{
1019
12
    if (group->meth->point_cmp == 0) {
1020
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1021
0
        return -1;
1022
0
    }
1023
12
    if (!ec_point_is_compat(a, group) || !ec_point_is_compat(b, group)) {
1024
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
1025
0
        return -1;
1026
0
    }
1027
12
    return group->meth->point_cmp(group, a, b, ctx);
1028
12
}
1029
1030
#ifndef OPENSSL_NO_DEPRECATED_3_0
1031
int EC_POINT_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx)
1032
0
{
1033
0
    if (group->meth->make_affine == 0) {
1034
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1035
0
        return 0;
1036
0
    }
1037
0
    if (!ec_point_is_compat(point, group)) {
1038
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
1039
0
        return 0;
1040
0
    }
1041
0
    return group->meth->make_affine(group, point, ctx);
1042
0
}
1043
1044
int EC_POINTs_make_affine(const EC_GROUP *group, size_t num,
1045
                          EC_POINT *points[], BN_CTX *ctx)
1046
0
{
1047
0
    size_t i;
1048
1049
0
    if (group->meth->points_make_affine == 0) {
1050
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1051
0
        return 0;
1052
0
    }
1053
0
    for (i = 0; i < num; i++) {
1054
0
        if (!ec_point_is_compat(points[i], group)) {
1055
0
            ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
1056
0
            return 0;
1057
0
        }
1058
0
    }
1059
0
    return group->meth->points_make_affine(group, num, points, ctx);
1060
0
}
1061
#endif
1062
1063
/*
1064
 * Functions for point multiplication. If group->meth->mul is 0, we use the
1065
 * wNAF-based implementations in ec_mult.c; otherwise we dispatch through
1066
 * methods.
1067
 */
1068
1069
#ifndef OPENSSL_NO_DEPRECATED_3_0
1070
int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
1071
                  size_t num, const EC_POINT *points[],
1072
                  const BIGNUM *scalars[], BN_CTX *ctx)
1073
0
{
1074
0
    int ret = 0;
1075
0
    size_t i = 0;
1076
0
#ifndef FIPS_MODULE
1077
0
    BN_CTX *new_ctx = NULL;
1078
0
#endif
1079
1080
0
    if (!ec_point_is_compat(r, group)) {
1081
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
1082
0
        return 0;
1083
0
    }
1084
1085
0
    if (scalar == NULL && num == 0)
1086
0
        return EC_POINT_set_to_infinity(group, r);
1087
1088
0
    for (i = 0; i < num; i++) {
1089
0
        if (!ec_point_is_compat(points[i], group)) {
1090
0
            ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
1091
0
            return 0;
1092
0
        }
1093
0
    }
1094
1095
0
#ifndef FIPS_MODULE
1096
0
    if (ctx == NULL)
1097
0
        ctx = new_ctx = BN_CTX_secure_new();
1098
0
#endif
1099
0
    if (ctx == NULL) {
1100
0
        ERR_raise(ERR_LIB_EC, ERR_R_INTERNAL_ERROR);
1101
0
        return 0;
1102
0
    }
1103
1104
0
    if (group->meth->mul != NULL)
1105
0
        ret = group->meth->mul(group, r, scalar, num, points, scalars, ctx);
1106
0
    else
1107
        /* use default */
1108
0
        ret = ossl_ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
1109
1110
0
#ifndef FIPS_MODULE
1111
0
    BN_CTX_free(new_ctx);
1112
0
#endif
1113
0
    return ret;
1114
0
}
1115
#endif
1116
1117
int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
1118
                 const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
1119
1.76k
{
1120
1.76k
    int ret = 0;
1121
1.76k
    size_t num;
1122
1.76k
#ifndef FIPS_MODULE
1123
1.76k
    BN_CTX *new_ctx = NULL;
1124
1.76k
#endif
1125
1126
1.76k
    if (!ec_point_is_compat(r, group)
1127
1.76k
        || (point != NULL && !ec_point_is_compat(point, group))) {
1128
0
        ERR_raise(ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS);
1129
0
        return 0;
1130
0
    }
1131
1132
1.76k
    if (g_scalar == NULL && p_scalar == NULL)
1133
0
        return EC_POINT_set_to_infinity(group, r);
1134
1135
1.76k
#ifndef FIPS_MODULE
1136
1.76k
    if (ctx == NULL)
1137
1.07k
        ctx = new_ctx = BN_CTX_secure_new();
1138
1.76k
#endif
1139
1.76k
    if (ctx == NULL) {
1140
0
        ERR_raise(ERR_LIB_EC, ERR_R_INTERNAL_ERROR);
1141
0
        return 0;
1142
0
    }
1143
1144
1.76k
    num = (point != NULL && p_scalar != NULL) ? 1 : 0;
1145
1.76k
    if (group->meth->mul != NULL)
1146
530
        ret = group->meth->mul(group, r, g_scalar, num, &point, &p_scalar, ctx);
1147
1.23k
    else
1148
        /* use default */
1149
1.23k
        ret = ossl_ec_wNAF_mul(group, r, g_scalar, num, &point, &p_scalar, ctx);
1150
1151
1.76k
#ifndef FIPS_MODULE
1152
1.76k
    BN_CTX_free(new_ctx);
1153
1.76k
#endif
1154
1.76k
    return ret;
1155
1.76k
}
1156
1157
#ifndef OPENSSL_NO_DEPRECATED_3_0
1158
int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
1159
57
{
1160
57
    if (group->meth->mul == 0)
1161
        /* use default */
1162
50
        return ossl_ec_wNAF_precompute_mult(group, ctx);
1163
1164
7
    if (group->meth->precompute_mult != 0)
1165
3
        return group->meth->precompute_mult(group, ctx);
1166
4
    else
1167
4
        return 1;               /* nothing to do, so report success */
1168
7
}
1169
1170
int EC_GROUP_have_precompute_mult(const EC_GROUP *group)
1171
0
{
1172
0
    if (group->meth->mul == 0)
1173
        /* use default */
1174
0
        return ossl_ec_wNAF_have_precompute_mult(group);
1175
1176
0
    if (group->meth->have_precompute_mult != 0)
1177
0
        return group->meth->have_precompute_mult(group);
1178
0
    else
1179
0
        return 0;               /* cannot tell whether precomputation has
1180
                                 * been performed */
1181
0
}
1182
#endif
1183
1184
/*
1185
 * ec_precompute_mont_data sets |group->mont_data| from |group->order| and
1186
 * returns one on success. On error it returns zero.
1187
 */
1188
static int ec_precompute_mont_data(EC_GROUP *group)
1189
2.29k
{
1190
2.29k
    BN_CTX *ctx = BN_CTX_new_ex(group->libctx);
1191
2.29k
    int ret = 0;
1192
1193
2.29k
    BN_MONT_CTX_free(group->mont_data);
1194
2.29k
    group->mont_data = NULL;
1195
1196
2.29k
    if (ctx == NULL)
1197
0
        goto err;
1198
1199
2.29k
    group->mont_data = BN_MONT_CTX_new();
1200
2.29k
    if (group->mont_data == NULL)
1201
0
        goto err;
1202
1203
2.29k
    if (!BN_MONT_CTX_set(group->mont_data, group->order, ctx)) {
1204
0
        BN_MONT_CTX_free(group->mont_data);
1205
0
        group->mont_data = NULL;
1206
0
        goto err;
1207
0
    }
1208
1209
2.29k
    ret = 1;
1210
1211
2.29k
 err:
1212
1213
2.29k
    BN_CTX_free(ctx);
1214
2.29k
    return ret;
1215
2.29k
}
1216
1217
#ifndef FIPS_MODULE
1218
int EC_KEY_set_ex_data(EC_KEY *key, int idx, void *arg)
1219
0
{
1220
0
    return CRYPTO_set_ex_data(&key->ex_data, idx, arg);
1221
0
}
1222
1223
void *EC_KEY_get_ex_data(const EC_KEY *key, int idx)
1224
0
{
1225
0
    return CRYPTO_get_ex_data(&key->ex_data, idx);
1226
0
}
1227
#endif
1228
1229
int ossl_ec_group_simple_order_bits(const EC_GROUP *group)
1230
0
{
1231
0
    if (group->order == NULL)
1232
0
        return 0;
1233
0
    return BN_num_bits(group->order);
1234
0
}
1235
1236
static int ec_field_inverse_mod_ord(const EC_GROUP *group, BIGNUM *r,
1237
                                    const BIGNUM *x, BN_CTX *ctx)
1238
253
{
1239
253
    BIGNUM *e = NULL;
1240
253
    int ret = 0;
1241
253
#ifndef FIPS_MODULE
1242
253
    BN_CTX *new_ctx = NULL;
1243
253
#endif
1244
1245
253
    if (group->mont_data == NULL)
1246
0
        return 0;
1247
1248
253
#ifndef FIPS_MODULE
1249
253
    if (ctx == NULL)
1250
0
        ctx = new_ctx = BN_CTX_secure_new();
1251
253
#endif
1252
253
    if (ctx == NULL)
1253
0
        return 0;
1254
1255
253
    BN_CTX_start(ctx);
1256
253
    if ((e = BN_CTX_get(ctx)) == NULL)
1257
0
        goto err;
1258
1259
    /*-
1260
     * We want inverse in constant time, therefore we utilize the fact
1261
     * order must be prime and use Fermats Little Theorem instead.
1262
     */
1263
253
    if (!BN_set_word(e, 2))
1264
0
        goto err;
1265
253
    if (!BN_sub(e, group->order, e))
1266
0
        goto err;
1267
    /*-
1268
     * Exponent e is public.
1269
     * No need for scatter-gather or BN_FLG_CONSTTIME.
1270
     */
1271
253
    if (!BN_mod_exp_mont(r, x, e, group->order, ctx, group->mont_data))
1272
0
        goto err;
1273
1274
253
    ret = 1;
1275
1276
253
 err:
1277
253
    BN_CTX_end(ctx);
1278
253
#ifndef FIPS_MODULE
1279
253
    BN_CTX_free(new_ctx);
1280
253
#endif
1281
253
    return ret;
1282
253
}
1283
1284
/*-
1285
 * Default behavior, if group->meth->field_inverse_mod_ord is NULL:
1286
 * - When group->order is even, this function returns an error.
1287
 * - When group->order is otherwise composite, the correctness
1288
 *   of the output is not guaranteed.
1289
 * - When x is outside the range [1, group->order), the correctness
1290
 *   of the output is not guaranteed.
1291
 * - Otherwise, this function returns the multiplicative inverse in the
1292
 *   range [1, group->order).
1293
 *
1294
 * EC_METHODs must implement their own field_inverse_mod_ord for
1295
 * other functionality.
1296
 */
1297
int ossl_ec_group_do_inverse_ord(const EC_GROUP *group, BIGNUM *res,
1298
                                 const BIGNUM *x, BN_CTX *ctx)
1299
445
{
1300
445
    if (group->meth->field_inverse_mod_ord != NULL)
1301
192
        return group->meth->field_inverse_mod_ord(group, res, x, ctx);
1302
253
    else
1303
253
        return ec_field_inverse_mod_ord(group, res, x, ctx);
1304
445
}
1305
1306
/*-
1307
 * Coordinate blinding for EC_POINT.
1308
 *
1309
 * The underlying EC_METHOD can optionally implement this function:
1310
 * underlying implementations should return 0 on errors, or 1 on
1311
 * success.
1312
 *
1313
 * This wrapper returns 1 in case the underlying EC_METHOD does not
1314
 * support coordinate blinding.
1315
 */
1316
int ossl_ec_point_blind_coordinates(const EC_GROUP *group, EC_POINT *p,
1317
                                    BN_CTX *ctx)
1318
136
{
1319
136
    if (group->meth->blind_coordinates == NULL)
1320
0
        return 1; /* ignore if not implemented */
1321
1322
136
    return group->meth->blind_coordinates(group, p, ctx);
1323
136
}
1324
1325
int EC_GROUP_get_basis_type(const EC_GROUP *group)
1326
0
{
1327
0
    int i;
1328
1329
0
    if (EC_GROUP_get_field_type(group) != NID_X9_62_characteristic_two_field)
1330
        /* everything else is currently not supported */
1331
0
        return 0;
1332
1333
    /* Find the last non-zero element of group->poly[] */
1334
0
    for (i = 0;
1335
0
         i < (int)OSSL_NELEM(group->poly) && group->poly[i] != 0;
1336
0
         i++)
1337
0
        continue;
1338
1339
0
    if (i == 4)
1340
0
        return NID_X9_62_ppBasis;
1341
0
    else if (i == 2)
1342
0
        return NID_X9_62_tpBasis;
1343
0
    else
1344
        /* everything else is currently not supported */
1345
0
        return 0;
1346
0
}
1347
1348
#ifndef OPENSSL_NO_EC2M
1349
int EC_GROUP_get_trinomial_basis(const EC_GROUP *group, unsigned int *k)
1350
0
{
1351
0
    if (group == NULL)
1352
0
        return 0;
1353
1354
0
    if (EC_GROUP_get_field_type(group) != NID_X9_62_characteristic_two_field
1355
0
        || !((group->poly[0] != 0) && (group->poly[1] != 0)
1356
0
             && (group->poly[2] == 0))) {
1357
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1358
0
        return 0;
1359
0
    }
1360
1361
0
    if (k)
1362
0
        *k = group->poly[1];
1363
1364
0
    return 1;
1365
0
}
1366
1367
int EC_GROUP_get_pentanomial_basis(const EC_GROUP *group, unsigned int *k1,
1368
                                   unsigned int *k2, unsigned int *k3)
1369
0
{
1370
0
    if (group == NULL)
1371
0
        return 0;
1372
1373
0
    if (EC_GROUP_get_field_type(group) != NID_X9_62_characteristic_two_field
1374
0
        || !((group->poly[0] != 0) && (group->poly[1] != 0)
1375
0
             && (group->poly[2] != 0) && (group->poly[3] != 0)
1376
0
             && (group->poly[4] == 0))) {
1377
0
        ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1378
0
        return 0;
1379
0
    }
1380
1381
0
    if (k1)
1382
0
        *k1 = group->poly[3];
1383
0
    if (k2)
1384
0
        *k2 = group->poly[2];
1385
0
    if (k3)
1386
0
        *k3 = group->poly[1];
1387
1388
0
    return 1;
1389
0
}
1390
#endif
1391
1392
#ifndef FIPS_MODULE
1393
/*
1394
 * Check if the explicit parameters group matches any built-in curves.
1395
 *
1396
 * We create a copy of the group just built, so that we can remove optional
1397
 * fields for the lookup: we do this to avoid the possibility that one of
1398
 * the optional parameters is used to force the library into using a less
1399
 * performant and less secure EC_METHOD instead of the specialized one.
1400
 * In any case, `seed` is not really used in any computation, while a
1401
 * cofactor different from the one in the built-in table is just
1402
 * mathematically wrong anyway and should not be used.
1403
 */
1404
static EC_GROUP *ec_group_explicit_to_named(const EC_GROUP *group,
1405
                                            OSSL_LIB_CTX *libctx,
1406
                                            const char *propq,
1407
                                            BN_CTX *ctx)
1408
0
{
1409
0
    EC_GROUP *ret_group = NULL, *dup = NULL;
1410
0
    int curve_name_nid;
1411
1412
0
    const EC_POINT *point = EC_GROUP_get0_generator(group);
1413
0
    const BIGNUM *order = EC_GROUP_get0_order(group);
1414
0
    int no_seed = (EC_GROUP_get0_seed(group) == NULL);
1415
1416
0
    if ((dup = EC_GROUP_dup(group)) == NULL
1417
0
            || EC_GROUP_set_seed(dup, NULL, 0) != 1
1418
0
            || !EC_GROUP_set_generator(dup, point, order, NULL))
1419
0
        goto err;
1420
0
    if ((curve_name_nid = ossl_ec_curve_nid_from_params(dup, ctx)) != NID_undef) {
1421
        /*
1422
         * The input explicit parameters successfully matched one of the
1423
         * built-in curves: often for built-in curves we have specialized
1424
         * methods with better performance and hardening.
1425
         *
1426
         * In this case we replace the `EC_GROUP` created through explicit
1427
         * parameters with one created from a named group.
1428
         */
1429
1430
# ifndef OPENSSL_NO_EC_NISTP_64_GCC_128
1431
        /*
1432
         * NID_wap_wsg_idm_ecid_wtls12 and NID_secp224r1 are both aliases for
1433
         * the same curve, we prefer the SECP nid when matching explicit
1434
         * parameters as that is associated with a specialized EC_METHOD.
1435
         */
1436
        if (curve_name_nid == NID_wap_wsg_idm_ecid_wtls12)
1437
            curve_name_nid = NID_secp224r1;
1438
# endif /* !def(OPENSSL_NO_EC_NISTP_64_GCC_128) */
1439
1440
0
        ret_group = EC_GROUP_new_by_curve_name_ex(libctx, propq, curve_name_nid);
1441
0
        if (ret_group == NULL)
1442
0
            goto err;
1443
1444
        /*
1445
         * Set the flag so that EC_GROUPs created from explicit parameters are
1446
         * serialized using explicit parameters by default.
1447
         */
1448
0
        EC_GROUP_set_asn1_flag(ret_group, OPENSSL_EC_EXPLICIT_CURVE);
1449
1450
        /*
1451
         * If the input params do not contain the optional seed field we make
1452
         * sure it is not added to the returned group.
1453
         *
1454
         * The seed field is not really used inside libcrypto anyway, and
1455
         * adding it to parsed explicit parameter keys would alter their DER
1456
         * encoding output (because of the extra field) which could impact
1457
         * applications fingerprinting keys by their DER encoding.
1458
         */
1459
0
        if (no_seed) {
1460
0
            if (EC_GROUP_set_seed(ret_group, NULL, 0) != 1)
1461
0
                goto err;
1462
0
        }
1463
0
    } else {
1464
0
        ret_group = (EC_GROUP *)group;
1465
0
    }
1466
0
    EC_GROUP_free(dup);
1467
0
    return ret_group;
1468
0
err:
1469
0
    EC_GROUP_free(dup);
1470
0
    EC_GROUP_free(ret_group);
1471
0
    return NULL;
1472
0
}
1473
#endif /* FIPS_MODULE */
1474
1475
static EC_GROUP *group_new_from_name(const OSSL_PARAM *p,
1476
                                     OSSL_LIB_CTX *libctx, const char *propq)
1477
0
{
1478
0
    int ok = 0, nid;
1479
0
    const char *curve_name = NULL;
1480
1481
0
    switch (p->data_type) {
1482
0
    case OSSL_PARAM_UTF8_STRING:
1483
        /* The OSSL_PARAM functions have no support for this */
1484
0
        curve_name = p->data;
1485
0
        ok = (curve_name != NULL);
1486
0
        break;
1487
0
    case OSSL_PARAM_UTF8_PTR:
1488
0
        ok = OSSL_PARAM_get_utf8_ptr(p, &curve_name);
1489
0
        break;
1490
0
    }
1491
1492
0
    if (ok) {
1493
0
        nid = ossl_ec_curve_name2nid(curve_name);
1494
0
        if (nid == NID_undef) {
1495
0
            ERR_raise(ERR_LIB_EC, EC_R_INVALID_CURVE);
1496
0
            return NULL;
1497
0
        } else {
1498
0
            return EC_GROUP_new_by_curve_name_ex(libctx, propq, nid);
1499
0
        }
1500
0
    }
1501
0
    return NULL;
1502
0
}
1503
1504
/* These parameters can be set directly into an EC_GROUP */
1505
int ossl_ec_group_set_params(EC_GROUP *group, const OSSL_PARAM params[])
1506
0
{
1507
0
    int encoding_flag = -1, format = -1;
1508
0
    const OSSL_PARAM *p;
1509
1510
0
    p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT);
1511
0
    if (p != NULL) {
1512
0
        if (!ossl_ec_pt_format_param2id(p, &format)) {
1513
0
            ERR_raise(ERR_LIB_EC, EC_R_INVALID_FORM);
1514
0
            return 0;
1515
0
        }
1516
0
        EC_GROUP_set_point_conversion_form(group, format);
1517
0
    }
1518
1519
0
    p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_ENCODING);
1520
0
    if (p != NULL) {
1521
0
        if (!ossl_ec_encoding_param2id(p, &encoding_flag)) {
1522
0
            ERR_raise(ERR_LIB_EC, EC_R_INVALID_FORM);
1523
0
            return 0;
1524
0
        }
1525
0
        EC_GROUP_set_asn1_flag(group, encoding_flag);
1526
0
    }
1527
    /* Optional seed */
1528
0
    p = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_SEED);
1529
0
    if (p != NULL) {
1530
        /* The seed is allowed to be NULL */
1531
0
        if (p->data_type != OSSL_PARAM_OCTET_STRING
1532
0
            || !EC_GROUP_set_seed(group, p->data, p->data_size)) {
1533
0
            ERR_raise(ERR_LIB_EC, EC_R_INVALID_SEED);
1534
0
            return 0;
1535
0
        }
1536
0
    }
1537
0
    return 1;
1538
0
}
1539
1540
EC_GROUP *EC_GROUP_new_from_params(const OSSL_PARAM params[],
1541
                                   OSSL_LIB_CTX *libctx, const char *propq)
1542
0
{
1543
0
    const OSSL_PARAM *ptmp;
1544
0
    EC_GROUP *group = NULL;
1545
1546
0
#ifndef FIPS_MODULE
1547
0
    const OSSL_PARAM *pa, *pb;
1548
0
    int ok = 0;
1549
0
    EC_GROUP *named_group = NULL;
1550
0
    BIGNUM *p = NULL, *a = NULL, *b = NULL, *order = NULL, *cofactor = NULL;
1551
0
    EC_POINT *point = NULL;
1552
0
    int field_bits = 0;
1553
0
    int is_prime_field = 1;
1554
0
    BN_CTX *bnctx = NULL;
1555
0
    const unsigned char *buf = NULL;
1556
0
    int encoding_flag = -1;
1557
0
#endif
1558
1559
    /* This is the simple named group case */
1560
0
    ptmp = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_GROUP_NAME);
1561
0
    if (ptmp != NULL) {
1562
0
        int decoded = 0;
1563
1564
0
        if ((group = group_new_from_name(ptmp, libctx, propq)) == NULL)
1565
0
            return NULL;
1566
0
        if (!ossl_ec_group_set_params(group, params)) {
1567
0
            EC_GROUP_free(group);
1568
0
            return NULL;
1569
0
        }
1570
1571
0
        ptmp = OSSL_PARAM_locate_const(params,
1572
0
                                       OSSL_PKEY_PARAM_EC_DECODED_FROM_EXPLICIT_PARAMS);
1573
0
        if (ptmp != NULL && !OSSL_PARAM_get_int(ptmp, &decoded)) {
1574
0
            ERR_raise(ERR_LIB_EC, EC_R_WRONG_CURVE_PARAMETERS);
1575
0
            EC_GROUP_free(group);
1576
0
            return NULL;
1577
0
        }
1578
0
        group->decoded_from_explicit_params = decoded > 0;
1579
0
        return group;
1580
0
    }
1581
#ifdef FIPS_MODULE
1582
    ERR_raise(ERR_LIB_EC, EC_R_EXPLICIT_PARAMS_NOT_SUPPORTED);
1583
    return NULL;
1584
#else
1585
    /* If it gets here then we are trying explicit parameters */
1586
0
    bnctx = BN_CTX_new_ex(libctx);
1587
0
    if (bnctx == NULL) {
1588
0
        ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
1589
0
        return 0;
1590
0
    }
1591
0
    BN_CTX_start(bnctx);
1592
1593
0
    p = BN_CTX_get(bnctx);
1594
0
    a = BN_CTX_get(bnctx);
1595
0
    b = BN_CTX_get(bnctx);
1596
0
    order = BN_CTX_get(bnctx);
1597
0
    if (order == NULL) {
1598
0
        ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
1599
0
        goto err;
1600
0
    }
1601
1602
0
    ptmp = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_FIELD_TYPE);
1603
0
    if (ptmp == NULL || ptmp->data_type != OSSL_PARAM_UTF8_STRING) {
1604
0
        ERR_raise(ERR_LIB_EC, EC_R_INVALID_FIELD);
1605
0
        goto err;
1606
0
    }
1607
0
    if (OPENSSL_strcasecmp(ptmp->data, SN_X9_62_prime_field) == 0) {
1608
0
        is_prime_field = 1;
1609
0
    } else if (OPENSSL_strcasecmp(ptmp->data,
1610
0
                                  SN_X9_62_characteristic_two_field) == 0) {
1611
0
        is_prime_field = 0;
1612
0
    } else {
1613
        /* Invalid field */
1614
0
        ERR_raise(ERR_LIB_EC, EC_R_UNSUPPORTED_FIELD);
1615
0
        goto err;
1616
0
    }
1617
1618
0
    pa = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_A);
1619
0
    if (!OSSL_PARAM_get_BN(pa, &a)) {
1620
0
        ERR_raise(ERR_LIB_EC, EC_R_INVALID_A);
1621
0
        goto err;
1622
0
    }
1623
0
    pb = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_B);
1624
0
    if (!OSSL_PARAM_get_BN(pb, &b)) {
1625
0
        ERR_raise(ERR_LIB_EC, EC_R_INVALID_B);
1626
0
        goto err;
1627
0
    }
1628
1629
    /* extract the prime number or irreducible polynomial */
1630
0
    ptmp = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_P);
1631
0
    if (!OSSL_PARAM_get_BN(ptmp, &p)) {
1632
0
        ERR_raise(ERR_LIB_EC, EC_R_INVALID_P);
1633
0
        goto err;
1634
0
    }
1635
1636
0
    if (is_prime_field) {
1637
0
        if (BN_is_negative(p) || BN_is_zero(p)) {
1638
0
            ERR_raise(ERR_LIB_EC, EC_R_INVALID_P);
1639
0
            goto err;
1640
0
        }
1641
0
        field_bits = BN_num_bits(p);
1642
0
        if (field_bits > OPENSSL_ECC_MAX_FIELD_BITS) {
1643
0
            ERR_raise(ERR_LIB_EC, EC_R_FIELD_TOO_LARGE);
1644
0
            goto err;
1645
0
        }
1646
1647
        /* create the EC_GROUP structure */
1648
0
        group = EC_GROUP_new_curve_GFp(p, a, b, bnctx);
1649
0
    } else {
1650
# ifdef OPENSSL_NO_EC2M
1651
        ERR_raise(ERR_LIB_EC, EC_R_GF2M_NOT_SUPPORTED);
1652
        goto err;
1653
# else
1654
        /* create the EC_GROUP structure */
1655
0
        group = EC_GROUP_new_curve_GF2m(p, a, b, NULL);
1656
0
        if (group != NULL) {
1657
0
            field_bits = EC_GROUP_get_degree(group);
1658
0
            if (field_bits > OPENSSL_ECC_MAX_FIELD_BITS) {
1659
0
                ERR_raise(ERR_LIB_EC, EC_R_FIELD_TOO_LARGE);
1660
0
                goto err;
1661
0
            }
1662
0
        }
1663
0
# endif /* OPENSSL_NO_EC2M */
1664
0
    }
1665
1666
0
    if (group == NULL) {
1667
0
        ERR_raise(ERR_LIB_EC, ERR_R_EC_LIB);
1668
0
        goto err;
1669
0
    }
1670
1671
    /* Optional seed */
1672
0
    ptmp = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_SEED);
1673
0
    if (ptmp != NULL) {
1674
0
        if (ptmp->data_type != OSSL_PARAM_OCTET_STRING) {
1675
0
            ERR_raise(ERR_LIB_EC, EC_R_INVALID_SEED);
1676
0
            goto err;
1677
0
        }
1678
0
        if (!EC_GROUP_set_seed(group, ptmp->data, ptmp->data_size))
1679
0
            goto err;
1680
0
    }
1681
1682
    /* generator base point */
1683
0
    ptmp = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_GENERATOR);
1684
0
    if (ptmp == NULL
1685
0
        || ptmp->data_type != OSSL_PARAM_OCTET_STRING) {
1686
0
        ERR_raise(ERR_LIB_EC, EC_R_INVALID_GENERATOR);
1687
0
        goto err;
1688
0
    }
1689
0
    buf = (const unsigned char *)(ptmp->data);
1690
0
    if ((point = EC_POINT_new(group)) == NULL)
1691
0
        goto err;
1692
0
    EC_GROUP_set_point_conversion_form(group,
1693
0
                                       (point_conversion_form_t)buf[0] & ~0x01);
1694
0
    if (!EC_POINT_oct2point(group, point, buf, ptmp->data_size, bnctx)) {
1695
0
        ERR_raise(ERR_LIB_EC, EC_R_INVALID_GENERATOR);
1696
0
        goto err;
1697
0
    }
1698
1699
    /* order */
1700
0
    ptmp = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_ORDER);
1701
0
    if (!OSSL_PARAM_get_BN(ptmp, &order)
1702
0
        || (BN_is_negative(order) || BN_is_zero(order))
1703
0
        || (BN_num_bits(order) > (int)field_bits + 1)) { /* Hasse bound */
1704
0
        ERR_raise(ERR_LIB_EC, EC_R_INVALID_GROUP_ORDER);
1705
0
        goto err;
1706
0
    }
1707
1708
    /* Optional cofactor */
1709
0
    ptmp = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_COFACTOR);
1710
0
    if (ptmp != NULL) {
1711
0
        cofactor = BN_CTX_get(bnctx);
1712
0
        if (cofactor == NULL || !OSSL_PARAM_get_BN(ptmp, &cofactor)) {
1713
0
            ERR_raise(ERR_LIB_EC, EC_R_INVALID_COFACTOR);
1714
0
            goto err;
1715
0
        }
1716
0
    }
1717
1718
    /* set the generator, order and cofactor (if present) */
1719
0
    if (!EC_GROUP_set_generator(group, point, order, cofactor)) {
1720
0
        ERR_raise(ERR_LIB_EC, EC_R_INVALID_GENERATOR);
1721
0
        goto err;
1722
0
    }
1723
1724
0
    named_group = ec_group_explicit_to_named(group, libctx, propq, bnctx);
1725
0
    if (named_group == NULL) {
1726
0
        ERR_raise(ERR_LIB_EC, EC_R_INVALID_NAMED_GROUP_CONVERSION);
1727
0
        goto err;
1728
0
    }
1729
0
    if (named_group == group) {
1730
        /*
1731
         * If we did not find a named group then the encoding should be explicit
1732
         * if it was specified
1733
         */
1734
0
        ptmp = OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_EC_ENCODING);
1735
0
        if (ptmp != NULL
1736
0
            && !ossl_ec_encoding_param2id(ptmp, &encoding_flag)) {
1737
0
            ERR_raise(ERR_LIB_EC, EC_R_INVALID_ENCODING);
1738
0
            goto err;
1739
0
        }
1740
0
        if (encoding_flag == OPENSSL_EC_NAMED_CURVE) {
1741
0
            ERR_raise(ERR_LIB_EC, EC_R_INVALID_ENCODING);
1742
0
            goto err;
1743
0
        }
1744
0
        EC_GROUP_set_asn1_flag(group, OPENSSL_EC_EXPLICIT_CURVE);
1745
0
    } else {
1746
0
        EC_GROUP_free(group);
1747
0
        group = named_group;
1748
0
    }
1749
    /* We've imported the group from explicit parameters, set it so. */
1750
0
    group->decoded_from_explicit_params = 1;
1751
0
    ok = 1;
1752
0
 err:
1753
0
    if (!ok) {
1754
0
        EC_GROUP_free(group);
1755
0
        group = NULL;
1756
0
    }
1757
0
    EC_POINT_free(point);
1758
0
    BN_CTX_end(bnctx);
1759
0
    BN_CTX_free(bnctx);
1760
1761
0
    return group;
1762
0
#endif /* FIPS_MODULE */
1763
0
}
1764
1765
OSSL_PARAM *EC_GROUP_to_params(const EC_GROUP *group, OSSL_LIB_CTX *libctx,
1766
                               const char *propq, BN_CTX *bnctx)
1767
0
{
1768
0
    OSSL_PARAM_BLD *tmpl = NULL;
1769
0
    BN_CTX *new_bnctx = NULL;
1770
0
    unsigned char *gen_buf = NULL;
1771
0
    OSSL_PARAM *params = NULL;
1772
1773
0
    if (group == NULL)
1774
0
        goto err;
1775
1776
0
    tmpl = OSSL_PARAM_BLD_new();
1777
0
    if (tmpl == NULL)
1778
0
        goto err;
1779
1780
0
    if (bnctx == NULL)
1781
0
        bnctx = new_bnctx = BN_CTX_new_ex(libctx);
1782
0
    if (bnctx == NULL)
1783
0
        goto err;
1784
0
    BN_CTX_start(bnctx);
1785
1786
0
    if (!ossl_ec_group_todata(
1787
0
            group, tmpl, NULL, libctx, propq, bnctx, &gen_buf))
1788
0
        goto err;
1789
1790
0
    params = OSSL_PARAM_BLD_to_param(tmpl);
1791
1792
0
 err:
1793
0
    OSSL_PARAM_BLD_free(tmpl);
1794
0
    OPENSSL_free(gen_buf);
1795
0
    BN_CTX_end(bnctx);
1796
0
    BN_CTX_free(new_bnctx);
1797
0
    return params;
1798
0
}