/src/libressl/crypto/ec/ec2_oct.c

Source (jump to first uncovered line)
/* $OpenBSD: ec2_oct.c,v 1.16 2021/05/03 14:42:45 tb Exp $ */
/* ====================================================================
 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 *
 * The Elliptic Curve Public-Key Crypto Library (ECC Code) included
 * herein is developed by SUN MICROSYSTEMS, INC., and is contributed
 * to the OpenSSL project.
 *
 * The ECC Code is licensed pursuant to the OpenSSL open source
 * license provided below.
 *
 * The software is originally written by Sheueling Chang Shantz and
 * Douglas Stebila of Sun Microsystems Laboratories.
 *
 */
/* ====================================================================
 * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    openssl-core@openssl.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

#include <openssl/opensslconf.h>

#include <openssl/err.h>

#include "ec_lcl.h"

#ifndef OPENSSL_NO_EC2M

/* Calculates and sets the affine coordinates of an EC_POINT from the given
 * compressed coordinates.  Uses algorithm 2.3.4 of SEC 1.
 * Note that the simple implementation only uses affine coordinates.
 *
 * The method is from the following publication:
 *
 *     Harper, Menezes, Vanstone:
 *     "Public-Key Cryptosystems with Very Small Key Lengths",
 *     EUROCRYPT '92, Springer-Verlag LNCS 658,
 *     published February 1993
 *
 * US Patents 6,141,420 and 6,618,483 (Vanstone, Mullin, Agnew) describe
 * the same method, but claim no priority date earlier than July 29, 1994
 * (and additionally fail to cite the EUROCRYPT '92 publication as prior art).
 */
int 
ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
    const BIGNUM *x_, int y_bit, BN_CTX *ctx)
{
  BN_CTX *new_ctx = NULL;
  BIGNUM *tmp, *x, *y, *z;
  int ret = 0, z0;

  /* clear error queue */
  ERR_clear_error();

  if (ctx == NULL) {
    ctx = new_ctx = BN_CTX_new();
    if (ctx == NULL)
      return 0;
  }
  y_bit = (y_bit != 0) ? 1 : 0;

  BN_CTX_start(ctx);
  if ((tmp = BN_CTX_get(ctx)) == NULL)
    goto err;
  if ((x = BN_CTX_get(ctx)) == NULL)
    goto err;
  if ((y = BN_CTX_get(ctx)) == NULL)
    goto err;
  if ((z = BN_CTX_get(ctx)) == NULL)
    goto err;

  if (!BN_GF2m_mod_arr(x, x_, group->poly))
    goto err;
  if (BN_is_zero(x)) {
    if (y_bit != 0) {
      ECerror(EC_R_INVALID_COMPRESSED_POINT);
      goto err;
    }
    if (!BN_GF2m_mod_sqrt_arr(y, &group->b, group->poly, ctx))
      goto err;
  } else {
    if (!group->meth->field_sqr(group, tmp, x, ctx))
      goto err;
    if (!group->meth->field_div(group, tmp, &group->b, tmp, ctx))
      goto err;
    if (!BN_GF2m_add(tmp, &group->a, tmp))
      goto err;
    if (!BN_GF2m_add(tmp, x, tmp))
      goto err;
    if (!BN_GF2m_mod_solve_quad_arr(z, tmp, group->poly, ctx)) {
      unsigned long err = ERR_peek_last_error();

      if (ERR_GET_LIB(err) == ERR_LIB_BN &&
          ERR_GET_REASON(err) == BN_R_NO_SOLUTION) {
        ERR_clear_error();
        ECerror(EC_R_INVALID_COMPRESSED_POINT);
      } else
        ECerror(ERR_R_BN_LIB);
      goto err;
    }
    z0 = (BN_is_odd(z)) ? 1 : 0;
    if (!group->meth->field_mul(group, y, x, z, ctx))
      goto err;
    if (z0 != y_bit) {
      if (!BN_GF2m_add(y, y, x))
        goto err;
    }
  }

  if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
    goto err;

  ret = 1;

 err:
  BN_CTX_end(ctx);
  BN_CTX_free(new_ctx);
  return ret;
}


/* Converts an EC_POINT to an octet string.
 * If buf is NULL, the encoded length will be returned.
 * If the length len of buf is smaller than required an error will be returned.
 */
size_t 
ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point,
    point_conversion_form_t form,
    unsigned char *buf, size_t len, BN_CTX * ctx)
{
  size_t ret;
  BN_CTX *new_ctx = NULL;
  int used_ctx = 0;
  BIGNUM *x, *y, *yxi;
  size_t field_len, i, skip;

  if ((form != POINT_CONVERSION_COMPRESSED)
      && (form != POINT_CONVERSION_UNCOMPRESSED)
      && (form != POINT_CONVERSION_HYBRID)) {
    ECerror(EC_R_INVALID_FORM);
    goto err;
  }
  if (EC_POINT_is_at_infinity(group, point) > 0) {
    /* encodes to a single 0 octet */
    if (buf != NULL) {
      if (len < 1) {
        ECerror(EC_R_BUFFER_TOO_SMALL);
        return 0;
      }
      buf[0] = 0;
    }
    return 1;
  }
  /* ret := required output buffer length */
  field_len = (EC_GROUP_get_degree(group) + 7) / 8;
  ret = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len :
      1 + 2 * field_len;

  /* if 'buf' is NULL, just return required length */
  if (buf != NULL) {
    if (len < ret) {
      ECerror(EC_R_BUFFER_TOO_SMALL);
      goto err;
    }
    if (ctx == NULL) {
      ctx = new_ctx = BN_CTX_new();
      if (ctx == NULL)
        return 0;
    }
    BN_CTX_start(ctx);
    used_ctx = 1;
    if ((x = BN_CTX_get(ctx)) == NULL)
      goto err;
    if ((y = BN_CTX_get(ctx)) == NULL)
      goto err;
    if ((yxi = BN_CTX_get(ctx)) == NULL)
      goto err;

    if (!EC_POINT_get_affine_coordinates(group, point, x, y, ctx))
      goto err;

    buf[0] = form;
    if ((form != POINT_CONVERSION_UNCOMPRESSED) && !BN_is_zero(x)) {
      if (!group->meth->field_div(group, yxi, y, x, ctx))
        goto err;
      if (BN_is_odd(yxi))
        buf[0]++;
    }
    i = 1;

    skip = field_len - BN_num_bytes(x);
    if (skip > field_len) {
      ECerror(ERR_R_INTERNAL_ERROR);
      goto err;
    }
    while (skip > 0) {
      buf[i++] = 0;
      skip--;
    }
    skip = BN_bn2bin(x, buf + i);
    i += skip;
    if (i != 1 + field_len) {
      ECerror(ERR_R_INTERNAL_ERROR);
      goto err;
    }
    if (form == POINT_CONVERSION_UNCOMPRESSED ||
        form == POINT_CONVERSION_HYBRID) {
      skip = field_len - BN_num_bytes(y);
      if (skip > field_len) {
        ECerror(ERR_R_INTERNAL_ERROR);
        goto err;
      }
      while (skip > 0) {
        buf[i++] = 0;
        skip--;
      }
      skip = BN_bn2bin(y, buf + i);
      i += skip;
    }
    if (i != ret) {
      ECerror(ERR_R_INTERNAL_ERROR);
      goto err;
    }
  }
  if (used_ctx)
    BN_CTX_end(ctx);
  BN_CTX_free(new_ctx);
  return ret;

 err:
  if (used_ctx)
    BN_CTX_end(ctx);
  BN_CTX_free(new_ctx);
  return 0;
}


/*
 * Converts an octet string representation to an EC_POINT.
 * Note that the simple implementation only uses affine coordinates.
 */
int
ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
    const unsigned char *buf, size_t len, BN_CTX *ctx)
{
  point_conversion_form_t form;
  int y_bit;
  BN_CTX *new_ctx = NULL;
  BIGNUM *x, *y, *yxi;
  size_t field_len, enc_len;
  int ret = 0;

  if (len == 0) {
    ECerror(EC_R_BUFFER_TOO_SMALL);
    return 0;
  }

  /*
   * The first octet is the point conversion octet PC, see X9.62, page 4
   * and section 4.4.2.  It must be:
   *  0x00    for the point at infinity
   *  0x02 or 0x03  for compressed form
   *  0x04    for uncompressed form
   *  0x06 or 0x07  for hybrid form.
   * For compressed or hybrid forms, we store the last bit of buf[0] as
   * y_bit and clear it from buf[0] so as to obtain a POINT_CONVERSION_*.
   * We error if buf[0] contains any but the above values.
   */
  y_bit = buf[0] & 1;
  form = buf[0] & ~1U;

  if (form != 0 && form != POINT_CONVERSION_COMPRESSED &&
      form != POINT_CONVERSION_UNCOMPRESSED &&
      form != POINT_CONVERSION_HYBRID) {
    ECerror(EC_R_INVALID_ENCODING);
    return 0;
  }
  if (form == 0 || form == POINT_CONVERSION_UNCOMPRESSED) {
    if (y_bit != 0) {
      ECerror(EC_R_INVALID_ENCODING);
      return 0;
    }
  }

  /* The point at infinity is represented by a single zero octet. */
  if (form == 0) {
    if (len != 1) {
      ECerror(EC_R_INVALID_ENCODING);
      return 0;
    }
    return EC_POINT_set_to_infinity(group, point);
  }

  field_len = (EC_GROUP_get_degree(group) + 7) / 8;
  enc_len = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len :
      1 + 2 * field_len;

  if (len != enc_len) {
    ECerror(EC_R_INVALID_ENCODING);
    return 0;
  }

  if (ctx == NULL) {
    ctx = new_ctx = BN_CTX_new();
    if (ctx == NULL)
      return 0;
  }
  BN_CTX_start(ctx);
  if ((x = BN_CTX_get(ctx)) == NULL)
    goto err;
  if ((y = BN_CTX_get(ctx)) == NULL)
    goto err;
  if ((yxi = BN_CTX_get(ctx)) == NULL)
    goto err;

  if (!BN_bin2bn(buf + 1, field_len, x))
    goto err;
  if (BN_ucmp(x, &group->field) >= 0) {
    ECerror(EC_R_INVALID_ENCODING);
    goto err;
  }
  if (form == POINT_CONVERSION_COMPRESSED) {
    /*
     * EC_POINT_set_compressed_coordinates checks that the
     * point is on the curve as required by X9.62.
     */
    if (!EC_POINT_set_compressed_coordinates(group, point, x, y_bit, ctx))
      goto err;
  } else {
    if (!BN_bin2bn(buf + 1 + field_len, field_len, y))
      goto err;
    if (BN_ucmp(y, &group->field) >= 0) {
      ECerror(EC_R_INVALID_ENCODING);
      goto err;
    }
    if (form == POINT_CONVERSION_HYBRID) {
      /*
       * Check that the form in the encoding was set
       * correctly according to X9.62 4.4.2.a, 4(c),
       * see also first paragraph of X9.62 4.4.1.b.
       */
      if (BN_is_zero(x)) {
        if (y_bit != 0) {
          ECerror(EC_R_INVALID_ENCODING);
          goto err;
        }
      } else {
        if (!group->meth->field_div(group, yxi, y, x,
            ctx))
          goto err;
        if (y_bit != BN_is_odd(yxi)) {
          ECerror(EC_R_INVALID_ENCODING);
          goto err;
        }
      }
    }
    /*
     * EC_POINT_set_affine_coordinates checks that the
     * point is on the curve as required by X9.62.
     */
    if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
      goto err;
  }

  ret = 1;

 err:
  BN_CTX_end(ctx);
  BN_CTX_free(new_ctx);
  return ret;
}
#endif

Coverage Report

Created: 2022-08-24 06:31

Line	Count	Source (jump to first uncovered line)
1		/* $OpenBSD: ec2_oct.c,v 1.16 2021/05/03 14:42:45 tb Exp $ */
2		/* ====================================================================
3		* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
4		*
5		* The Elliptic Curve Public-Key Crypto Library (ECC Code) included
6		* herein is developed by SUN MICROSYSTEMS, INC., and is contributed
7		* to the OpenSSL project.
8		*
9		* The ECC Code is licensed pursuant to the OpenSSL open source
10		* license provided below.
11		*
12		* The software is originally written by Sheueling Chang Shantz and
13		* Douglas Stebila of Sun Microsystems Laboratories.
14		*
15		*/
16		/* ====================================================================
17		* Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved.
18		*
19		* Redistribution and use in source and binary forms, with or without
20		* modification, are permitted provided that the following conditions
21		* are met:
22		*
23		* 1. Redistributions of source code must retain the above copyright
24		* notice, this list of conditions and the following disclaimer.
25		*
26		* 2. Redistributions in binary form must reproduce the above copyright
27		* notice, this list of conditions and the following disclaimer in
28		* the documentation and/or other materials provided with the
29		* distribution.
30		*
31		* 3. All advertising materials mentioning features or use of this
32		* software must display the following acknowledgment:
33		* "This product includes software developed by the OpenSSL Project
34		* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
35		*
36		* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
37		* endorse or promote products derived from this software without
38		* prior written permission. For written permission, please contact
39		* openssl-core@openssl.org.
40		*
41		* 5. Products derived from this software may not be called "OpenSSL"
42		* nor may "OpenSSL" appear in their names without prior written
43		* permission of the OpenSSL Project.
44		*
45		* 6. Redistributions of any form whatsoever must retain the following
46		* acknowledgment:
47		* "This product includes software developed by the OpenSSL Project
48		* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
49		*
50		* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
51		* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
52		* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
53		* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
54		* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
55		* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
56		* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
57		* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
58		* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
59		* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
60		* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
61		* OF THE POSSIBILITY OF SUCH DAMAGE.
62		* ====================================================================
63		*
64		* This product includes cryptographic software written by Eric Young
65		* (eay@cryptsoft.com). This product includes software written by Tim
66		* Hudson (tjh@cryptsoft.com).
67		*
68		*/
69
70		#include <openssl/opensslconf.h>
71
72		#include <openssl/err.h>
73
74		#include "ec_lcl.h"
75
76		#ifndef OPENSSL_NO_EC2M
77
78		/* Calculates and sets the affine coordinates of an EC_POINT from the given
79		* compressed coordinates. Uses algorithm 2.3.4 of SEC 1.
80		* Note that the simple implementation only uses affine coordinates.
81		*
82		* The method is from the following publication:
83		*
84		* Harper, Menezes, Vanstone:
85		* "Public-Key Cryptosystems with Very Small Key Lengths",
86		* EUROCRYPT '92, Springer-Verlag LNCS 658,
87		* published February 1993
88		*
89		* US Patents 6,141,420 and 6,618,483 (Vanstone, Mullin, Agnew) describe
90		* the same method, but claim no priority date earlier than July 29, 1994
91		* (and additionally fail to cite the EUROCRYPT '92 publication as prior art).
92		*/
93		int
94		ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP group, EC_POINT point,
95		const BIGNUM x_, int y_bit, BN_CTX ctx)
96	535	{
97	535	BN_CTX *new_ctx = NULL;
98	535	BIGNUM tmp, x, y, z;
99	535	int ret = 0, z0;
100
101		/* clear error queue */
102	535	ERR_clear_error();
103
104	535	if (ctx == NULL) {
105	0	ctx = new_ctx = BN_CTX_new();
106	0	if (ctx == NULL)
107	0	return 0;
108	0	}
109	535	y_bit = (y_bit != 0) ? 1 : 0;
110
111	535	BN_CTX_start(ctx);
112	535	if ((tmp = BN_CTX_get(ctx)) == NULL)
113	0	goto err;
114	535	if ((x = BN_CTX_get(ctx)) == NULL)
115	0	goto err;
116	535	if ((y = BN_CTX_get(ctx)) == NULL)
117	0	goto err;
118	535	if ((z = BN_CTX_get(ctx)) == NULL)
119	0	goto err;
120
121	535	if (!BN_GF2m_mod_arr(x, x_, group->poly))
122	0	goto err;
123	535	if (BN_is_zero(x)) {
124	11	if (y_bit != 0) {
125	2	ECerror(EC_R_INVALID_COMPRESSED_POINT);
126	2	goto err;
127	2	}
128	9	if (!BN_GF2m_mod_sqrt_arr(y, &group->b, group->poly, ctx))
129	0	goto err;
130	524	} else {
131	524	if (!group->meth->field_sqr(group, tmp, x, ctx))
132	0	goto err;
133	524	if (!group->meth->field_div(group, tmp, &group->b, tmp, ctx))
134	0	goto err;
135	524	if (!BN_GF2m_add(tmp, &group->a, tmp))
136	0	goto err;
137	524	if (!BN_GF2m_add(tmp, x, tmp))
138	0	goto err;
139	524	if (!BN_GF2m_mod_solve_quad_arr(z, tmp, group->poly, ctx)) {
140	109	unsigned long err = ERR_peek_last_error();
141
142	109	if (ERR_GET_LIB(err) == ERR_LIB_BN &&
143	109	ERR_GET_REASON(err) == BN_R_NO_SOLUTION) {
144	109	ERR_clear_error();
145	109	ECerror(EC_R_INVALID_COMPRESSED_POINT);
146	109	} else
147	109	ECerror(ERR_R_BN_LIB);
148	109	goto err;
149	109	}
150	415	z0 = (BN_is_odd(z)) ? 1 : 0;
151	415	if (!group->meth->field_mul(group, y, x, z, ctx))
152	0	goto err;
153	415	if (z0 != y_bit) {
154	179	if (!BN_GF2m_add(y, y, x))
155	0	goto err;
156	179	}
157	415	}
158
159	424	if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
160	0	goto err;
161
162	424	ret = 1;
163
164	535	err:
165	535	BN_CTX_end(ctx);
166	535	BN_CTX_free(new_ctx);
167	535	return ret;
168	424	}
169
170
171		/* Converts an EC_POINT to an octet string.
172		* If buf is NULL, the encoded length will be returned.
173		* If the length len of buf is smaller than required an error will be returned.
174		*/
175		size_t
176		ec_GF2m_simple_point2oct(const EC_GROUP group, const EC_POINT point,
177		point_conversion_form_t form,
178		unsigned char buf, size_t len, BN_CTX ctx)
179	1.74k	{
180	1.74k	size_t ret;
181	1.74k	BN_CTX *new_ctx = NULL;
182	1.74k	int used_ctx = 0;
183	1.74k	BIGNUM x, y, *yxi;
184	1.74k	size_t field_len, i, skip;
185
186	1.74k	if ((form != POINT_CONVERSION_COMPRESSED)
187	1.74k	&& (form != POINT_CONVERSION_UNCOMPRESSED)
188	1.74k	&& (form != POINT_CONVERSION_HYBRID)) {
189	28	ECerror(EC_R_INVALID_FORM);
190	28	goto err;
191	28	}
192	1.72k	if (EC_POINT_is_at_infinity(group, point) > 0) {
193		/* encodes to a single 0 octet */
194	44	if (buf != NULL) {
195	22	if (len < 1) {
196	0	ECerror(EC_R_BUFFER_TOO_SMALL);
197	0	return 0;
198	0	}
199	22	buf[0] = 0;
200	22	}
201	44	return 1;
202	44	}
203		/* ret := required output buffer length */
204	1.67k	field_len = (EC_GROUP_get_degree(group) + 7) / 8;
205	1.67k	ret = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len :
206	1.67k	1 + 2 * field_len;
207
208		/* if 'buf' is NULL, just return required length */
209	1.67k	if (buf != NULL) {
210	838	if (len < ret) {
211	0	ECerror(EC_R_BUFFER_TOO_SMALL);
212	0	goto err;
213	0	}
214	838	if (ctx == NULL) {
215	0	ctx = new_ctx = BN_CTX_new();
216	0	if (ctx == NULL)
217	0	return 0;
218	0	}
219	838	BN_CTX_start(ctx);
220	838	used_ctx = 1;
221	838	if ((x = BN_CTX_get(ctx)) == NULL)
222	0	goto err;
223	838	if ((y = BN_CTX_get(ctx)) == NULL)
224	0	goto err;
225	838	if ((yxi = BN_CTX_get(ctx)) == NULL)
226	0	goto err;
227
228	838	if (!EC_POINT_get_affine_coordinates(group, point, x, y, ctx))
229	0	goto err;
230
231	838	buf[0] = form;
232	838	if ((form != POINT_CONVERSION_UNCOMPRESSED) && !BN_is_zero(x)) {
233	416	if (!group->meth->field_div(group, yxi, y, x, ctx))
234	0	goto err;
235	416	if (BN_is_odd(yxi))
236	106	buf[0]++;
237	416	}
238	838	i = 1;
239
240	838	skip = field_len - BN_num_bytes(x);
241	838	if (skip > field_len) {
242	0	ECerror(ERR_R_INTERNAL_ERROR);
243	0	goto err;
244	0	}
245	3.98k	while (skip > 0) {
246	3.14k	buf[i++] = 0;
247	3.14k	skip--;
248	3.14k	}
249	838	skip = BN_bn2bin(x, buf + i);
250	838	i += skip;
251	838	if (i != 1 + field_len) {
252	0	ECerror(ERR_R_INTERNAL_ERROR);
253	0	goto err;
254	0	}
255	838	if (form == POINT_CONVERSION_UNCOMPRESSED \|\|
256	838	form == POINT_CONVERSION_HYBRID) {
257	414	skip = field_len - BN_num_bytes(y);
258	414	if (skip > field_len) {
259	0	ECerror(ERR_R_INTERNAL_ERROR);
260	0	goto err;
261	0	}
262	653	while (skip > 0) {
263	239	buf[i++] = 0;
264	239	skip--;
265	239	}
266	414	skip = BN_bn2bin(y, buf + i);
267	414	i += skip;
268	414	}
269	838	if (i != ret) {
270	0	ECerror(ERR_R_INTERNAL_ERROR);
271	0	goto err;
272	0	}
273	838	}
274	1.67k	if (used_ctx)
275	838	BN_CTX_end(ctx);
276	1.67k	BN_CTX_free(new_ctx);
277	1.67k	return ret;
278
279	28	err:
280	28	if (used_ctx)
281	0	BN_CTX_end(ctx);
282	28	BN_CTX_free(new_ctx);
283	28	return 0;
284	1.67k	}
285
286
287		/*
288		* Converts an octet string representation to an EC_POINT.
289		* Note that the simple implementation only uses affine coordinates.
290		*/
291		int
292		ec_GF2m_simple_oct2point(const EC_GROUP group, EC_POINT point,
293		const unsigned char buf, size_t len, BN_CTX ctx)
294	763	{
295	763	point_conversion_form_t form;
296	763	int y_bit;
297	763	BN_CTX *new_ctx = NULL;
298	763	BIGNUM x, y, *yxi;
299	763	size_t field_len, enc_len;
300	763	int ret = 0;
301
302	763	if (len == 0) {
303	17	ECerror(EC_R_BUFFER_TOO_SMALL);
304	17	return 0;
305	17	}
306
307		/*
308		* The first octet is the point conversion octet PC, see X9.62, page 4
309		* and section 4.4.2. It must be:
310		* 0x00 for the point at infinity
311		* 0x02 or 0x03 for compressed form
312		* 0x04 for uncompressed form
313		* 0x06 or 0x07 for hybrid form.
314		* For compressed or hybrid forms, we store the last bit of buf[0] as
315		* y_bit and clear it from buf[0] so as to obtain a POINT_CONVERSION_*.
316		* We error if buf[0] contains any but the above values.
317		*/
318	746	y_bit = buf[0] & 1;
319	746	form = buf[0] & ~1U;
320
321	746	if (form != 0 && form != POINT_CONVERSION_COMPRESSED &&
322	746	form != POINT_CONVERSION_UNCOMPRESSED &&
323	746	form != POINT_CONVERSION_HYBRID) {
324	39	ECerror(EC_R_INVALID_ENCODING);
325	39	return 0;
326	39	}
327	707	if (form == 0 \|\| form == POINT_CONVERSION_UNCOMPRESSED) {
328	90	if (y_bit != 0) {
329	12	ECerror(EC_R_INVALID_ENCODING);
330	12	return 0;
331	12	}
332	90	}
333
334		/* The point at infinity is represented by a single zero octet. */
335	695	if (form == 0) {
336	28	if (len != 1) {
337	14	ECerror(EC_R_INVALID_ENCODING);
338	14	return 0;
339	14	}
340	14	return EC_POINT_set_to_infinity(group, point);
341	28	}
342
343	667	field_len = (EC_GROUP_get_degree(group) + 7) / 8;
344	667	enc_len = (form == POINT_CONVERSION_COMPRESSED) ? 1 + field_len :
345	667	1 + 2 * field_len;
346
347	667	if (len != enc_len) {
348	96	ECerror(EC_R_INVALID_ENCODING);
349	96	return 0;
350	96	}
351
352	571	if (ctx == NULL) {
353	571	ctx = new_ctx = BN_CTX_new();
354	571	if (ctx == NULL)
355	0	return 0;
356	571	}
357	571	BN_CTX_start(ctx);
358	571	if ((x = BN_CTX_get(ctx)) == NULL)
359	0	goto err;
360	571	if ((y = BN_CTX_get(ctx)) == NULL)
361	0	goto err;
362	571	if ((yxi = BN_CTX_get(ctx)) == NULL)
363	0	goto err;
364
365	571	if (!BN_bin2bn(buf + 1, field_len, x))
366	0	goto err;
367	571	if (BN_ucmp(x, &group->field) >= 0) {
368	11	ECerror(EC_R_INVALID_ENCODING);
369	11	goto err;
370	11	}
371	560	if (form == POINT_CONVERSION_COMPRESSED) {
372		/*
373		* EC_POINT_set_compressed_coordinates checks that the
374		* point is on the curve as required by X9.62.
375		*/
376	535	if (!EC_POINT_set_compressed_coordinates(group, point, x, y_bit, ctx))
377	111	goto err;
378	535	} else {
379	25	if (!BN_bin2bn(buf + 1 + field_len, field_len, y))
380	0	goto err;
381	25	if (BN_ucmp(y, &group->field) >= 0) {
382	2	ECerror(EC_R_INVALID_ENCODING);
383	2	goto err;
384	2	}
385	23	if (form == POINT_CONVERSION_HYBRID) {
386		/*
387		* Check that the form in the encoding was set
388		* correctly according to X9.62 4.4.2.a, 4(c),
389		* see also first paragraph of X9.62 4.4.1.b.
390		*/
391	11	if (BN_is_zero(x)) {
392	3	if (y_bit != 0) {
393	1	ECerror(EC_R_INVALID_ENCODING);
394	1	goto err;
395	1	}
396	8	} else {
397	8	if (!group->meth->field_div(group, yxi, y, x,
398	8	ctx))
399	0	goto err;
400	8	if (y_bit != BN_is_odd(yxi)) {
401	1	ECerror(EC_R_INVALID_ENCODING);
402	1	goto err;
403	1	}
404	8	}
405	11	}
406		/*
407		* EC_POINT_set_affine_coordinates checks that the
408		* point is on the curve as required by X9.62.
409		*/
410	21	if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
411	18	goto err;
412	21	}
413
414	427	ret = 1;
415
416	571	err:
417	571	BN_CTX_end(ctx);
418	571	BN_CTX_free(new_ctx);
419	571	return ret;
420	427	}
421		#endif