Coverage Report

Created: 2023-06-08 06:41

/src/openssl111/crypto/ec/ecp_oct.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 2011-2018 The OpenSSL Project Authors. All Rights Reserved.
3
 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4
 *
5
 * Licensed under the OpenSSL license (the "License").  You may not use
6
 * this file except in compliance with the License.  You can obtain a copy
7
 * in the file LICENSE in the source distribution or at
8
 * https://www.openssl.org/source/license.html
9
 */
10
11
#include <openssl/err.h>
12
#include <openssl/symhacks.h>
13
14
#include "ec_local.h"
15
16
int ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *group,
17
                                             EC_POINT *point,
18
                                             const BIGNUM *x_, int y_bit,
19
                                             BN_CTX *ctx)
20
510
{
21
510
    BN_CTX *new_ctx = NULL;
22
510
    BIGNUM *tmp1, *tmp2, *x, *y;
23
510
    int ret = 0;
24
25
    /* clear error queue */
26
510
    ERR_clear_error();
27
28
510
    if (ctx == NULL) {
29
0
        ctx = new_ctx = BN_CTX_new();
30
0
        if (ctx == NULL)
31
0
            return 0;
32
0
    }
33
34
510
    y_bit = (y_bit != 0);
35
36
510
    BN_CTX_start(ctx);
37
510
    tmp1 = BN_CTX_get(ctx);
38
510
    tmp2 = BN_CTX_get(ctx);
39
510
    x = BN_CTX_get(ctx);
40
510
    y = BN_CTX_get(ctx);
41
510
    if (y == NULL)
42
0
        goto err;
43
44
    /*-
45
     * Recover y.  We have a Weierstrass equation
46
     *     y^2 = x^3 + a*x + b,
47
     * so  y  is one of the square roots of  x^3 + a*x + b.
48
     */
49
50
    /* tmp1 := x^3 */
51
510
    if (!BN_nnmod(x, x_, group->field, ctx))
52
0
        goto err;
53
510
    if (group->meth->field_decode == 0) {
54
        /* field_{sqr,mul} work on standard representation */
55
94
        if (!group->meth->field_sqr(group, tmp2, x_, ctx))
56
0
            goto err;
57
94
        if (!group->meth->field_mul(group, tmp1, tmp2, x_, ctx))
58
0
            goto err;
59
416
    } else {
60
416
        if (!BN_mod_sqr(tmp2, x_, group->field, ctx))
61
0
            goto err;
62
416
        if (!BN_mod_mul(tmp1, tmp2, x_, group->field, ctx))
63
0
            goto err;
64
416
    }
65
66
    /* tmp1 := tmp1 + a*x */
67
510
    if (group->a_is_minus3) {
68
510
        if (!BN_mod_lshift1_quick(tmp2, x, group->field))
69
0
            goto err;
70
510
        if (!BN_mod_add_quick(tmp2, tmp2, x, group->field))
71
0
            goto err;
72
510
        if (!BN_mod_sub_quick(tmp1, tmp1, tmp2, group->field))
73
0
            goto err;
74
510
    } else {
75
0
        if (group->meth->field_decode) {
76
0
            if (!group->meth->field_decode(group, tmp2, group->a, ctx))
77
0
                goto err;
78
0
            if (!BN_mod_mul(tmp2, tmp2, x, group->field, ctx))
79
0
                goto err;
80
0
        } else {
81
            /* field_mul works on standard representation */
82
0
            if (!group->meth->field_mul(group, tmp2, group->a, x, ctx))
83
0
                goto err;
84
0
        }
85
86
0
        if (!BN_mod_add_quick(tmp1, tmp1, tmp2, group->field))
87
0
            goto err;
88
0
    }
89
90
    /* tmp1 := tmp1 + b */
91
510
    if (group->meth->field_decode) {
92
416
        if (!group->meth->field_decode(group, tmp2, group->b, ctx))
93
0
            goto err;
94
416
        if (!BN_mod_add_quick(tmp1, tmp1, tmp2, group->field))
95
0
            goto err;
96
416
    } else {
97
94
        if (!BN_mod_add_quick(tmp1, tmp1, group->b, group->field))
98
0
            goto err;
99
94
    }
100
101
510
    if (!BN_mod_sqrt(y, tmp1, group->field, ctx)) {
102
133
        unsigned long err = ERR_peek_last_error();
103
104
133
        if (ERR_GET_LIB(err) == ERR_LIB_BN
105
133
            && ERR_GET_REASON(err) == BN_R_NOT_A_SQUARE) {
106
133
            ERR_clear_error();
107
133
            ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
108
133
                  EC_R_INVALID_COMPRESSED_POINT);
109
133
        } else
110
133
            ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
111
133
                  ERR_R_BN_LIB);
112
133
        goto err;
113
133
    }
114
115
377
    if (y_bit != BN_is_odd(y)) {
116
203
        if (BN_is_zero(y)) {
117
0
            int kron;
118
119
0
            kron = BN_kronecker(x, group->field, ctx);
120
0
            if (kron == -2)
121
0
                goto err;
122
123
0
            if (kron == 1)
124
0
                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
125
0
                      EC_R_INVALID_COMPRESSION_BIT);
126
0
            else
127
                /*
128
                 * BN_mod_sqrt() should have caught this error (not a square)
129
                 */
130
0
                ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
131
0
                      EC_R_INVALID_COMPRESSED_POINT);
132
0
            goto err;
133
0
        }
134
203
        if (!BN_usub(y, group->field, y))
135
0
            goto err;
136
203
    }
137
377
    if (y_bit != BN_is_odd(y)) {
138
0
        ECerr(EC_F_EC_GFP_SIMPLE_SET_COMPRESSED_COORDINATES,
139
0
              ERR_R_INTERNAL_ERROR);
140
0
        goto err;
141
0
    }
142
143
377
    if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
144
0
        goto err;
145
146
377
    ret = 1;
147
148
510
 err:
149
510
    BN_CTX_end(ctx);
150
510
    BN_CTX_free(new_ctx);
151
510
    return ret;
152
377
}
153
154
size_t ec_GFp_simple_point2oct(const EC_GROUP *group, const EC_POINT *point,
155
                               point_conversion_form_t form,
156
                               unsigned char *buf, size_t len, BN_CTX *ctx)
157
1.55k
{
158
1.55k
    size_t ret;
159
1.55k
    BN_CTX *new_ctx = NULL;
160
1.55k
    int used_ctx = 0;
161
1.55k
    BIGNUM *x, *y;
162
1.55k
    size_t field_len, i, skip;
163
164
1.55k
    if ((form != POINT_CONVERSION_COMPRESSED)
165
1.55k
        && (form != POINT_CONVERSION_UNCOMPRESSED)
166
1.55k
        && (form != POINT_CONVERSION_HYBRID)) {
167
0
        ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, EC_R_INVALID_FORM);
168
0
        goto err;
169
0
    }
170
171
1.55k
    if (EC_POINT_is_at_infinity(group, point)) {
172
        /* encodes to a single 0 octet */
173
0
        if (buf != NULL) {
174
0
            if (len < 1) {
175
0
                ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
176
0
                return 0;
177
0
            }
178
0
            buf[0] = 0;
179
0
        }
180
0
        return 1;
181
0
    }
182
183
    /* ret := required output buffer length */
184
1.55k
    field_len = BN_num_bytes(group->field);
185
1.55k
    ret =
186
1.55k
        (form ==
187
1.55k
         POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;
188
189
    /* if 'buf' is NULL, just return required length */
190
1.55k
    if (buf != NULL) {
191
778
        if (len < ret) {
192
0
            ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);
193
0
            goto err;
194
0
        }
195
196
778
        if (ctx == NULL) {
197
778
            ctx = new_ctx = BN_CTX_new();
198
778
            if (ctx == NULL)
199
0
                return 0;
200
778
        }
201
202
778
        BN_CTX_start(ctx);
203
778
        used_ctx = 1;
204
778
        x = BN_CTX_get(ctx);
205
778
        y = BN_CTX_get(ctx);
206
778
        if (y == NULL)
207
0
            goto err;
208
209
778
        if (!EC_POINT_get_affine_coordinates(group, point, x, y, ctx))
210
0
            goto err;
211
212
778
        if ((form == POINT_CONVERSION_COMPRESSED
213
778
             || form == POINT_CONVERSION_HYBRID) && BN_is_odd(y))
214
0
            buf[0] = form + 1;
215
778
        else
216
778
            buf[0] = form;
217
218
778
        i = 1;
219
220
778
        skip = field_len - BN_num_bytes(x);
221
778
        if (skip > field_len) {
222
0
            ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
223
0
            goto err;
224
0
        }
225
905
        while (skip > 0) {
226
127
            buf[i++] = 0;
227
127
            skip--;
228
127
        }
229
778
        skip = BN_bn2bin(x, buf + i);
230
778
        i += skip;
231
778
        if (i != 1 + field_len) {
232
0
            ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
233
0
            goto err;
234
0
        }
235
236
778
        if (form == POINT_CONVERSION_UNCOMPRESSED
237
778
            || form == POINT_CONVERSION_HYBRID) {
238
778
            skip = field_len - BN_num_bytes(y);
239
778
            if (skip > field_len) {
240
0
                ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
241
0
                goto err;
242
0
            }
243
905
            while (skip > 0) {
244
127
                buf[i++] = 0;
245
127
                skip--;
246
127
            }
247
778
            skip = BN_bn2bin(y, buf + i);
248
778
            i += skip;
249
778
        }
250
251
778
        if (i != ret) {
252
0
            ECerr(EC_F_EC_GFP_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);
253
0
            goto err;
254
0
        }
255
778
    }
256
257
1.55k
    if (used_ctx)
258
778
        BN_CTX_end(ctx);
259
1.55k
    BN_CTX_free(new_ctx);
260
1.55k
    return ret;
261
262
0
 err:
263
0
    if (used_ctx)
264
0
        BN_CTX_end(ctx);
265
0
    BN_CTX_free(new_ctx);
266
0
    return 0;
267
1.55k
}
268
269
int ec_GFp_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
270
                            const unsigned char *buf, size_t len, BN_CTX *ctx)
271
13.1k
{
272
13.1k
    point_conversion_form_t form;
273
13.1k
    int y_bit;
274
13.1k
    BN_CTX *new_ctx = NULL;
275
13.1k
    BIGNUM *x, *y;
276
13.1k
    size_t field_len, enc_len;
277
13.1k
    int ret = 0;
278
279
13.1k
    if (len == 0) {
280
5
        ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_BUFFER_TOO_SMALL);
281
5
        return 0;
282
5
    }
283
13.1k
    form = buf[0];
284
13.1k
    y_bit = form & 1;
285
13.1k
    form = form & ~1U;
286
13.1k
    if ((form != 0) && (form != POINT_CONVERSION_COMPRESSED)
287
13.1k
        && (form != POINT_CONVERSION_UNCOMPRESSED)
288
13.1k
        && (form != POINT_CONVERSION_HYBRID)) {
289
8
        ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
290
8
        return 0;
291
8
    }
292
13.1k
    if ((form == 0 || form == POINT_CONVERSION_UNCOMPRESSED) && y_bit) {
293
1
        ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
294
1
        return 0;
295
1
    }
296
297
13.1k
    if (form == 0) {
298
18
        if (len != 1) {
299
3
            ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
300
3
            return 0;
301
3
        }
302
303
15
        return EC_POINT_set_to_infinity(group, point);
304
18
    }
305
306
13.1k
    field_len = BN_num_bytes(group->field);
307
13.1k
    enc_len =
308
13.1k
        (form ==
309
13.1k
         POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;
310
311
13.1k
    if (len != enc_len) {
312
5
        ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
313
5
        return 0;
314
5
    }
315
316
13.1k
    if (ctx == NULL) {
317
13.1k
        ctx = new_ctx = BN_CTX_new();
318
13.1k
        if (ctx == NULL)
319
0
            return 0;
320
13.1k
    }
321
322
13.1k
    BN_CTX_start(ctx);
323
13.1k
    x = BN_CTX_get(ctx);
324
13.1k
    y = BN_CTX_get(ctx);
325
13.1k
    if (y == NULL)
326
0
        goto err;
327
328
13.1k
    if (!BN_bin2bn(buf + 1, field_len, x))
329
0
        goto err;
330
13.1k
    if (BN_ucmp(x, group->field) >= 0) {
331
3
        ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
332
3
        goto err;
333
3
    }
334
335
13.1k
    if (form == POINT_CONVERSION_COMPRESSED) {
336
510
        if (!EC_POINT_set_compressed_coordinates(group, point, x, y_bit, ctx))
337
133
            goto err;
338
12.6k
    } else {
339
12.6k
        if (!BN_bin2bn(buf + 1 + field_len, field_len, y))
340
0
            goto err;
341
12.6k
        if (BN_ucmp(y, group->field) >= 0) {
342
2
            ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
343
2
            goto err;
344
2
        }
345
12.6k
        if (form == POINT_CONVERSION_HYBRID) {
346
9
            if (y_bit != BN_is_odd(y)) {
347
1
                ECerr(EC_F_EC_GFP_SIMPLE_OCT2POINT, EC_R_INVALID_ENCODING);
348
1
                goto err;
349
1
            }
350
9
        }
351
352
        /*
353
         * EC_POINT_set_affine_coordinates is responsible for checking that
354
         * the point is on the curve.
355
         */
356
12.6k
        if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
357
84
            goto err;
358
12.6k
    }
359
360
12.9k
    ret = 1;
361
362
13.1k
 err:
363
13.1k
    BN_CTX_end(ctx);
364
13.1k
    BN_CTX_free(new_ctx);
365
13.1k
    return ret;
366
12.9k
}