Coverage Report

Created: 2023-06-08 06:41

/src/openssl30/crypto/ec/ecp_mont.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved.
3
 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4
 *
5
 * Licensed under the Apache License 2.0 (the "License").  You may not use
6
 * this file except in compliance with the License.  You can obtain a copy
7
 * in the file LICENSE in the source distribution or at
8
 * https://www.openssl.org/source/license.html
9
 */
10
11
/*
12
 * ECDSA low level APIs are deprecated for public use, but still ok for
13
 * internal use.
14
 */
15
#include "internal/deprecated.h"
16
17
#include <openssl/err.h>
18
19
#include "ec_local.h"
20
21
const EC_METHOD *EC_GFp_mont_method(void)
22
242
{
23
242
    static const EC_METHOD ret = {
24
242
        EC_FLAGS_DEFAULT_OCT,
25
242
        NID_X9_62_prime_field,
26
242
        ossl_ec_GFp_mont_group_init,
27
242
        ossl_ec_GFp_mont_group_finish,
28
242
        ossl_ec_GFp_mont_group_clear_finish,
29
242
        ossl_ec_GFp_mont_group_copy,
30
242
        ossl_ec_GFp_mont_group_set_curve,
31
242
        ossl_ec_GFp_simple_group_get_curve,
32
242
        ossl_ec_GFp_simple_group_get_degree,
33
242
        ossl_ec_group_simple_order_bits,
34
242
        ossl_ec_GFp_simple_group_check_discriminant,
35
242
        ossl_ec_GFp_simple_point_init,
36
242
        ossl_ec_GFp_simple_point_finish,
37
242
        ossl_ec_GFp_simple_point_clear_finish,
38
242
        ossl_ec_GFp_simple_point_copy,
39
242
        ossl_ec_GFp_simple_point_set_to_infinity,
40
242
        ossl_ec_GFp_simple_point_set_affine_coordinates,
41
242
        ossl_ec_GFp_simple_point_get_affine_coordinates,
42
242
        0, 0, 0,
43
242
        ossl_ec_GFp_simple_add,
44
242
        ossl_ec_GFp_simple_dbl,
45
242
        ossl_ec_GFp_simple_invert,
46
242
        ossl_ec_GFp_simple_is_at_infinity,
47
242
        ossl_ec_GFp_simple_is_on_curve,
48
242
        ossl_ec_GFp_simple_cmp,
49
242
        ossl_ec_GFp_simple_make_affine,
50
242
        ossl_ec_GFp_simple_points_make_affine,
51
242
        0 /* mul */ ,
52
242
        0 /* precompute_mult */ ,
53
242
        0 /* have_precompute_mult */ ,
54
242
        ossl_ec_GFp_mont_field_mul,
55
242
        ossl_ec_GFp_mont_field_sqr,
56
242
        0 /* field_div */ ,
57
242
        ossl_ec_GFp_mont_field_inv,
58
242
        ossl_ec_GFp_mont_field_encode,
59
242
        ossl_ec_GFp_mont_field_decode,
60
242
        ossl_ec_GFp_mont_field_set_to_one,
61
242
        ossl_ec_key_simple_priv2oct,
62
242
        ossl_ec_key_simple_oct2priv,
63
242
        0, /* set private */
64
242
        ossl_ec_key_simple_generate_key,
65
242
        ossl_ec_key_simple_check_key,
66
242
        ossl_ec_key_simple_generate_public_key,
67
242
        0, /* keycopy */
68
242
        0, /* keyfinish */
69
242
        ossl_ecdh_simple_compute_key,
70
242
        ossl_ecdsa_simple_sign_setup,
71
242
        ossl_ecdsa_simple_sign_sig,
72
242
        ossl_ecdsa_simple_verify_sig,
73
242
        0, /* field_inverse_mod_ord */
74
242
        ossl_ec_GFp_simple_blind_coordinates,
75
242
        ossl_ec_GFp_simple_ladder_pre,
76
242
        ossl_ec_GFp_simple_ladder_step,
77
242
        ossl_ec_GFp_simple_ladder_post
78
242
    };
79
80
242
    return &ret;
81
242
}
82
83
int ossl_ec_GFp_mont_group_init(EC_GROUP *group)
84
1.36k
{
85
1.36k
    int ok;
86
87
1.36k
    ok = ossl_ec_GFp_simple_group_init(group);
88
1.36k
    group->field_data1 = NULL;
89
1.36k
    group->field_data2 = NULL;
90
1.36k
    return ok;
91
1.36k
}
92
93
void ossl_ec_GFp_mont_group_finish(EC_GROUP *group)
94
1.36k
{
95
1.36k
    BN_MONT_CTX_free(group->field_data1);
96
1.36k
    group->field_data1 = NULL;
97
1.36k
    BN_free(group->field_data2);
98
1.36k
    group->field_data2 = NULL;
99
1.36k
    ossl_ec_GFp_simple_group_finish(group);
100
1.36k
}
101
102
void ossl_ec_GFp_mont_group_clear_finish(EC_GROUP *group)
103
0
{
104
0
    BN_MONT_CTX_free(group->field_data1);
105
0
    group->field_data1 = NULL;
106
0
    BN_clear_free(group->field_data2);
107
0
    group->field_data2 = NULL;
108
0
    ossl_ec_GFp_simple_group_clear_finish(group);
109
0
}
110
111
int ossl_ec_GFp_mont_group_copy(EC_GROUP *dest, const EC_GROUP *src)
112
696
{
113
696
    BN_MONT_CTX_free(dest->field_data1);
114
696
    dest->field_data1 = NULL;
115
696
    BN_clear_free(dest->field_data2);
116
696
    dest->field_data2 = NULL;
117
118
696
    if (!ossl_ec_GFp_simple_group_copy(dest, src))
119
0
        return 0;
120
121
696
    if (src->field_data1 != NULL) {
122
696
        dest->field_data1 = BN_MONT_CTX_new();
123
696
        if (dest->field_data1 == NULL)
124
0
            return 0;
125
696
        if (!BN_MONT_CTX_copy(dest->field_data1, src->field_data1))
126
0
            goto err;
127
696
    }
128
696
    if (src->field_data2 != NULL) {
129
696
        dest->field_data2 = BN_dup(src->field_data2);
130
696
        if (dest->field_data2 == NULL)
131
0
            goto err;
132
696
    }
133
134
696
    return 1;
135
136
0
 err:
137
0
    BN_MONT_CTX_free(dest->field_data1);
138
0
    dest->field_data1 = NULL;
139
0
    return 0;
140
696
}
141
142
int ossl_ec_GFp_mont_group_set_curve(EC_GROUP *group, const BIGNUM *p,
143
                                     const BIGNUM *a, const BIGNUM *b,
144
                                     BN_CTX *ctx)
145
670
{
146
670
    BN_CTX *new_ctx = NULL;
147
670
    BN_MONT_CTX *mont = NULL;
148
670
    BIGNUM *one = NULL;
149
670
    int ret = 0;
150
151
670
    BN_MONT_CTX_free(group->field_data1);
152
670
    group->field_data1 = NULL;
153
670
    BN_free(group->field_data2);
154
670
    group->field_data2 = NULL;
155
156
670
    if (ctx == NULL) {
157
0
        ctx = new_ctx = BN_CTX_new_ex(group->libctx);
158
0
        if (ctx == NULL)
159
0
            return 0;
160
0
    }
161
162
670
    mont = BN_MONT_CTX_new();
163
670
    if (mont == NULL)
164
0
        goto err;
165
670
    if (!BN_MONT_CTX_set(mont, p, ctx)) {
166
0
        ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
167
0
        goto err;
168
0
    }
169
670
    one = BN_new();
170
670
    if (one == NULL)
171
0
        goto err;
172
670
    if (!BN_to_montgomery(one, BN_value_one(), mont, ctx))
173
0
        goto err;
174
175
670
    group->field_data1 = mont;
176
670
    mont = NULL;
177
670
    group->field_data2 = one;
178
670
    one = NULL;
179
180
670
    ret = ossl_ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
181
182
670
    if (!ret) {
183
0
        BN_MONT_CTX_free(group->field_data1);
184
0
        group->field_data1 = NULL;
185
0
        BN_free(group->field_data2);
186
0
        group->field_data2 = NULL;
187
0
    }
188
189
670
 err:
190
670
    BN_free(one);
191
670
    BN_CTX_free(new_ctx);
192
670
    BN_MONT_CTX_free(mont);
193
670
    return ret;
194
670
}
195
196
int ossl_ec_GFp_mont_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
197
                               const BIGNUM *b, BN_CTX *ctx)
198
291k
{
199
291k
    if (group->field_data1 == NULL) {
200
0
        ERR_raise(ERR_LIB_EC, EC_R_NOT_INITIALIZED);
201
0
        return 0;
202
0
    }
203
204
291k
    return BN_mod_mul_montgomery(r, a, b, group->field_data1, ctx);
205
291k
}
206
207
int ossl_ec_GFp_mont_field_sqr(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
208
                               BN_CTX *ctx)
209
203k
{
210
203k
    if (group->field_data1 == NULL) {
211
0
        ERR_raise(ERR_LIB_EC, EC_R_NOT_INITIALIZED);
212
0
        return 0;
213
0
    }
214
215
203k
    return BN_mod_mul_montgomery(r, a, a, group->field_data1, ctx);
216
203k
}
217
218
/*-
219
 * Computes the multiplicative inverse of a in GF(p), storing the result in r.
220
 * If a is zero (or equivalent), you'll get a EC_R_CANNOT_INVERT error.
221
 * We have a Mont structure, so SCA hardening is FLT inversion.
222
 */
223
int ossl_ec_GFp_mont_field_inv(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
224
                               BN_CTX *ctx)
225
223
{
226
223
    BIGNUM *e = NULL;
227
223
    BN_CTX *new_ctx = NULL;
228
223
    int ret = 0;
229
230
223
    if (group->field_data1 == NULL)
231
0
        return 0;
232
233
223
    if (ctx == NULL
234
223
            && (ctx = new_ctx = BN_CTX_secure_new_ex(group->libctx)) == NULL)
235
0
        return 0;
236
237
223
    BN_CTX_start(ctx);
238
223
    if ((e = BN_CTX_get(ctx)) == NULL)
239
0
        goto err;
240
241
    /* Inverse in constant time with Fermats Little Theorem */
242
223
    if (!BN_set_word(e, 2))
243
0
        goto err;
244
223
    if (!BN_sub(e, group->field, e))
245
0
        goto err;
246
    /*-
247
     * Exponent e is public.
248
     * No need for scatter-gather or BN_FLG_CONSTTIME.
249
     */
250
223
    if (!BN_mod_exp_mont(r, a, e, group->field, ctx, group->field_data1))
251
0
        goto err;
252
253
    /* throw an error on zero */
254
223
    if (BN_is_zero(r)) {
255
0
        ERR_raise(ERR_LIB_EC, EC_R_CANNOT_INVERT);
256
0
        goto err;
257
0
    }
258
259
223
    ret = 1;
260
261
223
  err:
262
223
    BN_CTX_end(ctx);
263
223
    BN_CTX_free(new_ctx);
264
223
    return ret;
265
223
}
266
267
int ossl_ec_GFp_mont_field_encode(const EC_GROUP *group, BIGNUM *r,
268
                                  const BIGNUM *a, BN_CTX *ctx)
269
3.96k
{
270
3.96k
    if (group->field_data1 == NULL) {
271
0
        ERR_raise(ERR_LIB_EC, EC_R_NOT_INITIALIZED);
272
0
        return 0;
273
0
    }
274
275
3.96k
    return BN_to_montgomery(r, a, (BN_MONT_CTX *)group->field_data1, ctx);
276
3.96k
}
277
278
int ossl_ec_GFp_mont_field_decode(const EC_GROUP *group, BIGNUM *r,
279
                                  const BIGNUM *a, BN_CTX *ctx)
280
395
{
281
395
    if (group->field_data1 == NULL) {
282
0
        ERR_raise(ERR_LIB_EC, EC_R_NOT_INITIALIZED);
283
0
        return 0;
284
0
    }
285
286
395
    return BN_from_montgomery(r, a, group->field_data1, ctx);
287
395
}
288
289
int ossl_ec_GFp_mont_field_set_to_one(const EC_GROUP *group, BIGNUM *r,
290
                                      BN_CTX *ctx)
291
2.33k
{
292
2.33k
    if (group->field_data2 == NULL) {
293
0
        ERR_raise(ERR_LIB_EC, EC_R_NOT_INITIALIZED);
294
0
        return 0;
295
0
    }
296
297
2.33k
    if (!BN_copy(r, group->field_data2))
298
0
        return 0;
299
2.33k
    return 1;
300
2.33k
}