/src/openssl/crypto/ec/ecp_oct.c

Source (jump to first uncovered line)
/* crypto/ec/ecp_oct.c */
/*
 * Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
 * for the OpenSSL project. Includes code written by Bodo Moeller for the
 * OpenSSL project.
 */
/* ====================================================================
 * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    openssl-core@openssl.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */
/* ====================================================================
 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 * Portions of this software developed by SUN MICROSYSTEMS, INC.,
 * and contributed to the OpenSSL project.
 */

#include <openssl/err.h>
#include <openssl/symhacks.h>

#include "ec_lcl.h"

int ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *group,
                                             EC_POINT *point,
                                             const BIGNUM *x_, int y_bit,
                                             BN_CTX *ctx)
{
    BN_CTX *new_ctx = NULL;
    BIGNUM *tmp1, *tmp2, *x, *y;
    int ret = 0;

    /* clear error queue */
    ERR_clear_error();

    if (ctx == NULL) {
        ctx = new_ctx = BN_CTX_new();
        if (ctx == NULL)
            return 0;
    }

    y_bit = (y_bit != 0);

    BN_CTX_start(ctx);
    tmp1 = BN_CTX_get(ctx);
    tmp2 = BN_CTX_get(ctx);
    x = BN_CTX_get(ctx);
    y = BN_CTX_get(ctx);
    if (y == NULL)
        goto err;

    /*-
     * Recover y.  We have a Weierstrass equation
     *     y^2 = x^3 + a*x + b,
     * so  y  is one of the square roots of  x^3 + a*x + b.
     */

    /* tmp1 := x^3 */
    if (!BN_nnmod(x, x_, &group->field, ctx))
        goto err;
    if (group->meth->field_decode == 0) {
        /* field_{sqr,mul} work on standard representation */
        if (!group->meth->field_sqr(group, tmp2, x_, ctx))
            goto err;
        if (!group->meth->field_mul(group, tmp1, tmp2, x_, ctx))
            goto err;
    } else {
        if (!BN_mod_sqr(tmp2, x_, &group->field, ctx))
            goto err;
        if (!BN_mod_mul(tmp1, tmp2, x_, &group->field, ctx))
            goto err;
    }

    /* tmp1 := tmp1 + a*x */
    if (group->a_is_minus3) {
        if (!BN_mod_lshift1_quick(tmp2, x, &group->field))
            goto err;
        if (!BN_mod_add_quick(tmp2, tmp2, x, &group->field))
            goto err;
        if (!BN_mod_sub_quick(tmp1, tmp1, tmp2, &group->field))
            goto err;
    } else {
        if (group->meth->field_decode) {
            if (!group->meth->field_decode(group, tmp2, &group->a, ctx))
                goto err;
            if (!BN_mod_mul(tmp2, tmp2, x, &group->field, ctx))
                goto err;
        } else {
            /* field_mul works on standard representation */
            if (!group->meth->field_mul(group, tmp2, &group->a, x, ctx))
                goto err;
        }

        if (!BN_mod_add_quick(tmp1, tmp1, tmp2, &group->field))
            goto err;
    }

    /* tmp1 := tmp1 + b */
    if (group->meth->field_decode) {
        if (!group->meth->field_decode(group, tmp2, &group->b, ctx))
            goto err;
        if (!BN_mod_add_quick(tmp1, tmp1, tmp2, &group->field))
            goto err;
    } else {
        if (!BN_mod_add_quick(tmp1, tmp1, &group->b, &group->field))
            goto err;
    }

    if (!BN_mod_sqrt(y, tmp1, &group->field, ctx)) {
        unsigned long err = ERR_peek_last_error();

        if (ERR_GET_LIB(err) == ERR_LIB_BN
            && ERR_GET_REASON(err) == BN_R_NOT_A_SQUARE) {
            ERR_clear_error();
            ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
                  EC_R_INVALID_COMPRESSED_POINT);
        } else
            ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
                  ERR_R_BN_LIB);
        goto err;
    }

    if (y_bit != BN_is_odd(y)) {
        if (BN_is_zero(y)) {
            int kron;

            kron = BN_kronecker(x, &group->field, ctx);
            if (kron == -2)
                goto err;

            if (kron == 1)
                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
                      EC_R_INVALID_COMPRESSION_BIT);
            else
                /*
                 * BN_mod_sqrt() should have cought this error (not a square)
                 */
                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
                      EC_R_INVALID_COMPRESSED_POINT);
            goto err;
        }
        if (!BN_usub(y, &group->field, y))
            goto err;
    }
    if (y_bit != BN_is_odd(y)) {
        ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
              ERR_R_INTERNAL_ERROR);
        goto err;
    }

    if (!EC_POINT_set_affine_coordinates_GFp(group, point, x, y, ctx))
        goto err;

    ret = 1;

 err:
    BN_CTX_end(ctx);
    if (new_ctx != NULL)
        BN_CTX_free(new_ctx);
    return ret;
}

size_t ec_GFp_simple_point2oct(const EC_GROUP *group, const EC_POINT *point,
                               point_conversion_form_t form,
                               unsigned char *buf, size_t len, BN_CTX *ctx)
{
    size_t ret;
    BN_CTX *new_ctx = NULL;
    int used_ctx = 0;
    BIGNUM *x, *y;
    size_t field_len, i, skip;

    if ((form != POINT_CONVERSION_COMPRESSED)
        && (form != POINT_CONVERSION_UNCOMPRESSED)
        && (form != POINT_CONVERSION_HYBRID)) {
        ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, EC_R_INVALID_FORM);
        goto err;
    }

    if (EC_POINT_is_at_infinity(group, point)) {
        /* encodes to a single 0 octet */
        if (buf != NULL) {
            if (len < 1) {
                ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
                return 0;
            }
            buf[0] = 0;
        }
        return 1;
    }

    /* ret := required output buffer length */
    field_len = BN_num_bytes(&group->field);
    ret =
        (form ==
         POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;

    /* if 'buf' is NULL, just return required length */
    if (buf != NULL) {
        if (len < ret) {
            ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
            goto err;
        }

        if (ctx == NULL) {
            ctx = new_ctx = BN_CTX_new();
            if (ctx == NULL)
                return 0;
        }

        BN_CTX_start(ctx);
        used_ctx = 1;
        x = BN_CTX_get(ctx);
        y = BN_CTX_get(ctx);
        if (y == NULL)
            goto err;

        if (!EC_POINT_get_affine_coordinates_GFp(group, point, x, y, ctx))
            goto err;

        if ((form == POINT_CONVERSION_COMPRESSED
             || form == POINT_CONVERSION_HYBRID) && BN_is_odd(y))
            buf[0] = form + 1;
        else
            buf[0] = form;

        i = 1;

        skip = field_len - BN_num_bytes(x);
        if (skip > field_len) {
            ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
            goto err;
        }
        while (skip > 0) {
            buf[i++] = 0;
            skip--;
        }
        skip = BN_bn2bin(x, buf + i);
        i += skip;
        if (i != 1 + field_len) {
            ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
            goto err;
        }

        if (form == POINT_CONVERSION_UNCOMPRESSED
            || form == POINT_CONVERSION_HYBRID) {
            skip = field_len - BN_num_bytes(y);
            if (skip > field_len) {
                ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
                goto err;
            }
            while (skip > 0) {
                buf[i++] = 0;
                skip--;
            }
            skip = BN_bn2bin(y, buf + i);
            i += skip;
        }

        if (i != ret) {
            ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
            goto err;
        }
    }

    if (used_ctx)
        BN_CTX_end(ctx);
    if (new_ctx != NULL)
        BN_CTX_free(new_ctx);
    return ret;

 err:
    if (used_ctx)
        BN_CTX_end(ctx);
    if (new_ctx != NULL)
        BN_CTX_free(new_ctx);
    return 0;
}

int ec_GFp_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
                            const unsigned char *buf, size_t len, BN_CTX *ctx)
{
    point_conversion_form_t form;
    int y_bit;
    BN_CTX *new_ctx = NULL;
    BIGNUM *x, *y;
    size_t field_len, enc_len;
    int ret = 0;

    if (len == 0) {
        ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_BUFFER_TOO_SMALL);
        return 0;
    }
    form = buf[0];
    y_bit = form & 1;
    form = form & ~1U;
    if ((form != 0) && (form != POINT_CONVERSION_COMPRESSED)
        && (form != POINT_CONVERSION_UNCOMPRESSED)
        && (form != POINT_CONVERSION_HYBRID)) {
        ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
        return 0;
    }
    if ((form == 0 || form == POINT_CONVERSION_UNCOMPRESSED) && y_bit) {
        ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
        return 0;
    }

    if (form == 0) {
        if (len != 1) {
            ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
            return 0;
        }

        return EC_POINT_set_to_infinity(group, point);
    }

    field_len = BN_num_bytes(&group->field);
    enc_len =
        (form ==
         POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;

    if (len != enc_len) {
        ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
        return 0;
    }

    if (ctx == NULL) {
        ctx = new_ctx = BN_CTX_new();
        if (ctx == NULL)
            return 0;
    }

    BN_CTX_start(ctx);
    x = BN_CTX_get(ctx);
    y = BN_CTX_get(ctx);
    if (y == NULL)
        goto err;

    if (!BN_bin2bn(buf + 1, field_len, x))
        goto err;
    if (BN_ucmp(x, &group->field) >= 0) {
        ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
        goto err;
    }

    if (form == POINT_CONVERSION_COMPRESSED) {
        if (!EC_POINT_set_compressed_coordinates_GFp
            (group, point, x, y_bit, ctx))
            goto err;
    } else {
        if (!BN_bin2bn(buf + 1 + field_len, field_len, y))
            goto err;
        if (BN_ucmp(y, &group->field) >= 0) {
            ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
            goto err;
        }
        if (form == POINT_CONVERSION_HYBRID) {
            if (y_bit != BN_is_odd(y)) {
                ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
                goto err;
            }
        }

        if (!EC_POINT_set_affine_coordinates_GFp(group, point, x, y, ctx))
            goto err;
    }

    /* test required by X9.62 */
    if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
        ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
        goto err;
    }

    ret = 1;

 err:
    BN_CTX_end(ctx);
    if (new_ctx != NULL)
        BN_CTX_free(new_ctx);
    return ret;
}

Coverage Report

Created: 2022-11-30 06:20

Line	Count	Source (jump to first uncovered line)
1		/* crypto/ec/ecp_oct.c */
2		/*
3		* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
4		* for the OpenSSL project. Includes code written by Bodo Moeller for the
5		* OpenSSL project.
6		*/
7		/* ====================================================================
8		* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
9		*
10		* Redistribution and use in source and binary forms, with or without
11		* modification, are permitted provided that the following conditions
12		* are met:
13		*
14		* 1. Redistributions of source code must retain the above copyright
15		* notice, this list of conditions and the following disclaimer.
16		*
17		* 2. Redistributions in binary form must reproduce the above copyright
18		* notice, this list of conditions and the following disclaimer in
19		* the documentation and/or other materials provided with the
20		* distribution.
21		*
22		* 3. All advertising materials mentioning features or use of this
23		* software must display the following acknowledgment:
24		* "This product includes software developed by the OpenSSL Project
25		* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
26		*
27		* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
28		* endorse or promote products derived from this software without
29		* prior written permission. For written permission, please contact
30		* openssl-core@openssl.org.
31		*
32		* 5. Products derived from this software may not be called "OpenSSL"
33		* nor may "OpenSSL" appear in their names without prior written
34		* permission of the OpenSSL Project.
35		*
36		* 6. Redistributions of any form whatsoever must retain the following
37		* acknowledgment:
38		* "This product includes software developed by the OpenSSL Project
39		* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
40		*
41		* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
42		* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
44		* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
45		* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
46		* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
47		* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
48		* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
49		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
50		* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
51		* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
52		* OF THE POSSIBILITY OF SUCH DAMAGE.
53		* ====================================================================
54		*
55		* This product includes cryptographic software written by Eric Young
56		* (eay@cryptsoft.com). This product includes software written by Tim
57		* Hudson (tjh@cryptsoft.com).
58		*
59		*/
60		/* ====================================================================
61		* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
62		* Portions of this software developed by SUN MICROSYSTEMS, INC.,
63		* and contributed to the OpenSSL project.
64		*/
65
66		#include <openssl/err.h>
67		#include <openssl/symhacks.h>
68
69		#include "ec_lcl.h"
70
71		int ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *group,
72		EC_POINT *point,
73		const BIGNUM *x_, int y_bit,
74		BN_CTX *ctx)
75	0	{
76	0	BN_CTX *new_ctx = NULL;
77	0	BIGNUM tmp1, tmp2, x, y;
78	0	int ret = 0;
79
80		/* clear error queue */
81	0	ERR_clear_error();
82
83	0	if (ctx == NULL) {
84	0	ctx = new_ctx = BN_CTX_new();
85	0	if (ctx == NULL)
86	0	return 0;
87	0	}
88
89	0	y_bit = (y_bit != 0);
90
91	0	BN_CTX_start(ctx);
92	0	tmp1 = BN_CTX_get(ctx);
93	0	tmp2 = BN_CTX_get(ctx);
94	0	x = BN_CTX_get(ctx);
95	0	y = BN_CTX_get(ctx);
96	0	if (y == NULL)
97	0	goto err;
98
99		/*-
100		* Recover y. We have a Weierstrass equation
101		* y^2 = x^3 + a*x + b,
102		* so y is one of the square roots of x^3 + a*x + b.
103		*/
104
105		/* tmp1 := x^3 */
106	0	if (!BN_nnmod(x, x_, &group->field, ctx))
107	0	goto err;
108	0	if (group->meth->field_decode == 0) {
109		/* field_{sqr,mul} work on standard representation */
110	0	if (!group->meth->field_sqr(group, tmp2, x_, ctx))
111	0	goto err;
112	0	if (!group->meth->field_mul(group, tmp1, tmp2, x_, ctx))
113	0	goto err;
114	0	} else {
115	0	if (!BN_mod_sqr(tmp2, x_, &group->field, ctx))
116	0	goto err;
117	0	if (!BN_mod_mul(tmp1, tmp2, x_, &group->field, ctx))
118	0	goto err;
119	0	}
120
121		/* tmp1 := tmp1 + ax /
122	0	if (group->a_is_minus3) {
123	0	if (!BN_mod_lshift1_quick(tmp2, x, &group->field))
124	0	goto err;
125	0	if (!BN_mod_add_quick(tmp2, tmp2, x, &group->field))
126	0	goto err;
127	0	if (!BN_mod_sub_quick(tmp1, tmp1, tmp2, &group->field))
128	0	goto err;
129	0	} else {
130	0	if (group->meth->field_decode) {
131	0	if (!group->meth->field_decode(group, tmp2, &group->a, ctx))
132	0	goto err;
133	0	if (!BN_mod_mul(tmp2, tmp2, x, &group->field, ctx))
134	0	goto err;
135	0	} else {
136		/* field_mul works on standard representation */
137	0	if (!group->meth->field_mul(group, tmp2, &group->a, x, ctx))
138	0	goto err;
139	0	}
140
141	0	if (!BN_mod_add_quick(tmp1, tmp1, tmp2, &group->field))
142	0	goto err;
143	0	}
144
145		/* tmp1 := tmp1 + b */
146	0	if (group->meth->field_decode) {
147	0	if (!group->meth->field_decode(group, tmp2, &group->b, ctx))
148	0	goto err;
149	0	if (!BN_mod_add_quick(tmp1, tmp1, tmp2, &group->field))
150	0	goto err;
151	0	} else {
152	0	if (!BN_mod_add_quick(tmp1, tmp1, &group->b, &group->field))
153	0	goto err;
154	0	}
155
156	0	if (!BN_mod_sqrt(y, tmp1, &group->field, ctx)) {
157	0	unsigned long err = ERR_peek_last_error();
158
159	0	if (ERR_GET_LIB(err) == ERR_LIB_BN
160	0	&& ERR_GET_REASON(err) == BN_R_NOT_A_SQUARE) {
161	0	ERR_clear_error();
162	0	ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
163	0	EC_R_INVALID_COMPRESSED_POINT);
164	0	} else
165	0	ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
166	0	ERR_R_BN_LIB);
167	0	goto err;
168	0	}
169
170	0	if (y_bit != BN_is_odd(y)) {
171	0	if (BN_is_zero(y)) {
172	0	int kron;
173
174	0	kron = BN_kronecker(x, &group->field, ctx);
175	0	if (kron == -2)
176	0	goto err;
177
178	0	if (kron == 1)
179	0	ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
180	0	EC_R_INVALID_COMPRESSION_BIT);
181	0	else
182		/*
183		* BN_mod_sqrt() should have cought this error (not a square)
184		*/
185	0	ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
186	0	EC_R_INVALID_COMPRESSED_POINT);
187	0	goto err;
188	0	}
189	0	if (!BN_usub(y, &group->field, y))
190	0	goto err;
191	0	}
192	0	if (y_bit != BN_is_odd(y)) {
193	0	ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
194	0	ERR_R_INTERNAL_ERROR);
195	0	goto err;
196	0	}
197
198	0	if (!EC_POINT_set_affine_coordinates_GFp(group, point, x, y, ctx))
199	0	goto err;
200
201	0	ret = 1;
202
203	0	err:
204	0	BN_CTX_end(ctx);
205	0	if (new_ctx != NULL)
206	0	BN_CTX_free(new_ctx);
207	0	return ret;
208	0	}
209
210		size_t ec_GFp_simple_point2oct(const EC_GROUP group, const EC_POINT point,
211		point_conversion_form_t form,
212		unsigned char buf, size_t len, BN_CTX ctx)
213	0	{
214	0	size_t ret;
215	0	BN_CTX *new_ctx = NULL;
216	0	int used_ctx = 0;
217	0	BIGNUM x, y;
218	0	size_t field_len, i, skip;
219
220	0	if ((form != POINT_CONVERSION_COMPRESSED)
221	0	&& (form != POINT_CONVERSION_UNCOMPRESSED)
222	0	&& (form != POINT_CONVERSION_HYBRID)) {
223	0	ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, EC_R_INVALID_FORM);
224	0	goto err;
225	0	}
226
227	0	if (EC_POINT_is_at_infinity(group, point)) {
228		/* encodes to a single 0 octet */
229	0	if (buf != NULL) {
230	0	if (len < 1) {
231	0	ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
232	0	return 0;
233	0	}
234	0	buf[0] = 0;
235	0	}
236	0	return 1;
237	0	}
238
239		/* ret := required output buffer length */
240	0	field_len = BN_num_bytes(&group->field);
241	0	ret =
242	0	(form ==
243	0	POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;
244
245		/* if 'buf' is NULL, just return required length */
246	0	if (buf != NULL) {
247	0	if (len < ret) {
248	0	ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
249	0	goto err;
250	0	}
251
252	0	if (ctx == NULL) {
253	0	ctx = new_ctx = BN_CTX_new();
254	0	if (ctx == NULL)
255	0	return 0;
256	0	}
257
258	0	BN_CTX_start(ctx);
259	0	used_ctx = 1;
260	0	x = BN_CTX_get(ctx);
261	0	y = BN_CTX_get(ctx);
262	0	if (y == NULL)
263	0	goto err;
264
265	0	if (!EC_POINT_get_affine_coordinates_GFp(group, point, x, y, ctx))
266	0	goto err;
267
268	0	if ((form == POINT_CONVERSION_COMPRESSED
269	0	\|\| form == POINT_CONVERSION_HYBRID) && BN_is_odd(y))
270	0	buf[0] = form + 1;
271	0	else
272	0	buf[0] = form;
273
274	0	i = 1;
275
276	0	skip = field_len - BN_num_bytes(x);
277	0	if (skip > field_len) {
278	0	ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
279	0	goto err;
280	0	}
281	0	while (skip > 0) {
282	0	buf[i++] = 0;
283	0	skip--;
284	0	}
285	0	skip = BN_bn2bin(x, buf + i);
286	0	i += skip;
287	0	if (i != 1 + field_len) {
288	0	ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
289	0	goto err;
290	0	}
291
292	0	if (form == POINT_CONVERSION_UNCOMPRESSED
293	0	\|\| form == POINT_CONVERSION_HYBRID) {
294	0	skip = field_len - BN_num_bytes(y);
295	0	if (skip > field_len) {
296	0	ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
297	0	goto err;
298	0	}
299	0	while (skip > 0) {
300	0	buf[i++] = 0;
301	0	skip--;
302	0	}
303	0	skip = BN_bn2bin(y, buf + i);
304	0	i += skip;
305	0	}
306
307	0	if (i != ret) {
308	0	ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
309	0	goto err;
310	0	}
311	0	}
312
313	0	if (used_ctx)
314	0	BN_CTX_end(ctx);
315	0	if (new_ctx != NULL)
316	0	BN_CTX_free(new_ctx);
317	0	return ret;
318
319	0	err:
320	0	if (used_ctx)
321	0	BN_CTX_end(ctx);
322	0	if (new_ctx != NULL)
323	0	BN_CTX_free(new_ctx);
324	0	return 0;
325	0	}
326
327		int ec_GFp_simple_oct2point(const EC_GROUP group, EC_POINT point,
328		const unsigned char buf, size_t len, BN_CTX ctx)
329	0	{
330	0	point_conversion_form_t form;
331	0	int y_bit;
332	0	BN_CTX *new_ctx = NULL;
333	0	BIGNUM x, y;
334	0	size_t field_len, enc_len;
335	0	int ret = 0;
336
337	0	if (len == 0) {
338	0	ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_BUFFER_TOO_SMALL);
339	0	return 0;
340	0	}
341	0	form = buf[0];
342	0	y_bit = form & 1;
343	0	form = form & ~1U;
344	0	if ((form != 0) && (form != POINT_CONVERSION_COMPRESSED)
345	0	&& (form != POINT_CONVERSION_UNCOMPRESSED)
346	0	&& (form != POINT_CONVERSION_HYBRID)) {
347	0	ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
348	0	return 0;
349	0	}
350	0	if ((form == 0 \|\| form == POINT_CONVERSION_UNCOMPRESSED) && y_bit) {
351	0	ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
352	0	return 0;
353	0	}
354
355	0	if (form == 0) {
356	0	if (len != 1) {
357	0	ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
358	0	return 0;
359	0	}
360
361	0	return EC_POINT_set_to_infinity(group, point);
362	0	}
363
364	0	field_len = BN_num_bytes(&group->field);
365	0	enc_len =
366	0	(form ==
367	0	POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;
368
369	0	if (len != enc_len) {
370	0	ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
371	0	return 0;
372	0	}
373
374	0	if (ctx == NULL) {
375	0	ctx = new_ctx = BN_CTX_new();
376	0	if (ctx == NULL)
377	0	return 0;
378	0	}
379
380	0	BN_CTX_start(ctx);
381	0	x = BN_CTX_get(ctx);
382	0	y = BN_CTX_get(ctx);
383	0	if (y == NULL)
384	0	goto err;
385
386	0	if (!BN_bin2bn(buf + 1, field_len, x))
387	0	goto err;
388	0	if (BN_ucmp(x, &group->field) >= 0) {
389	0	ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
390	0	goto err;
391	0	}
392
393	0	if (form == POINT_CONVERSION_COMPRESSED) {
394	0	if (!EC_POINT_set_compressed_coordinates_GFp
395	0	(group, point, x, y_bit, ctx))
396	0	goto err;
397	0	} else {
398	0	if (!BN_bin2bn(buf + 1 + field_len, field_len, y))
399	0	goto err;
400	0	if (BN_ucmp(y, &group->field) >= 0) {
401	0	ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
402	0	goto err;
403	0	}
404	0	if (form == POINT_CONVERSION_HYBRID) {
405	0	if (y_bit != BN_is_odd(y)) {
406	0	ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
407	0	goto err;
408	0	}
409	0	}
410
411	0	if (!EC_POINT_set_affine_coordinates_GFp(group, point, x, y, ctx))
412	0	goto err;
413	0	}
414
415		/* test required by X9.62 */
416	0	if (EC_POINT_is_on_curve(group, point, ctx) <= 0) {
417	0	ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_POINT_IS_NOT_ON_CURVE);
418	0	goto err;
419	0	}
420
421	0	ret = 1;
422
423	0	err:
424	0	BN_CTX_end(ctx);
425	0	if (new_ctx != NULL)
426	0	BN_CTX_free(new_ctx);
427	0	return ret;
428	0	}