Coverage Report

Created: 2023-06-08 06:41

/src/openssl30/crypto/ec/ecp_smpl.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 2001-2021 The OpenSSL Project Authors. All Rights Reserved.
3
 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4
 *
5
 * Licensed under the Apache License 2.0 (the "License").  You may not use
6
 * this file except in compliance with the License.  You can obtain a copy
7
 * in the file LICENSE in the source distribution or at
8
 * https://www.openssl.org/source/license.html
9
 */
10
11
/*
12
 * ECDSA low level APIs are deprecated for public use, but still ok for
13
 * internal use.
14
 */
15
#include "internal/deprecated.h"
16
17
#include <openssl/err.h>
18
#include <openssl/symhacks.h>
19
20
#include "ec_local.h"
21
22
const EC_METHOD *EC_GFp_simple_method(void)
23
0
{
24
0
    static const EC_METHOD ret = {
25
0
        EC_FLAGS_DEFAULT_OCT,
26
0
        NID_X9_62_prime_field,
27
0
        ossl_ec_GFp_simple_group_init,
28
0
        ossl_ec_GFp_simple_group_finish,
29
0
        ossl_ec_GFp_simple_group_clear_finish,
30
0
        ossl_ec_GFp_simple_group_copy,
31
0
        ossl_ec_GFp_simple_group_set_curve,
32
0
        ossl_ec_GFp_simple_group_get_curve,
33
0
        ossl_ec_GFp_simple_group_get_degree,
34
0
        ossl_ec_group_simple_order_bits,
35
0
        ossl_ec_GFp_simple_group_check_discriminant,
36
0
        ossl_ec_GFp_simple_point_init,
37
0
        ossl_ec_GFp_simple_point_finish,
38
0
        ossl_ec_GFp_simple_point_clear_finish,
39
0
        ossl_ec_GFp_simple_point_copy,
40
0
        ossl_ec_GFp_simple_point_set_to_infinity,
41
0
        ossl_ec_GFp_simple_point_set_affine_coordinates,
42
0
        ossl_ec_GFp_simple_point_get_affine_coordinates,
43
0
        0, 0, 0,
44
0
        ossl_ec_GFp_simple_add,
45
0
        ossl_ec_GFp_simple_dbl,
46
0
        ossl_ec_GFp_simple_invert,
47
0
        ossl_ec_GFp_simple_is_at_infinity,
48
0
        ossl_ec_GFp_simple_is_on_curve,
49
0
        ossl_ec_GFp_simple_cmp,
50
0
        ossl_ec_GFp_simple_make_affine,
51
0
        ossl_ec_GFp_simple_points_make_affine,
52
0
        0 /* mul */ ,
53
0
        0 /* precompute_mult */ ,
54
0
        0 /* have_precompute_mult */ ,
55
0
        ossl_ec_GFp_simple_field_mul,
56
0
        ossl_ec_GFp_simple_field_sqr,
57
0
        0 /* field_div */ ,
58
0
        ossl_ec_GFp_simple_field_inv,
59
0
        0 /* field_encode */ ,
60
0
        0 /* field_decode */ ,
61
0
        0,                      /* field_set_to_one */
62
0
        ossl_ec_key_simple_priv2oct,
63
0
        ossl_ec_key_simple_oct2priv,
64
0
        0, /* set private */
65
0
        ossl_ec_key_simple_generate_key,
66
0
        ossl_ec_key_simple_check_key,
67
0
        ossl_ec_key_simple_generate_public_key,
68
0
        0, /* keycopy */
69
0
        0, /* keyfinish */
70
0
        ossl_ecdh_simple_compute_key,
71
0
        ossl_ecdsa_simple_sign_setup,
72
0
        ossl_ecdsa_simple_sign_sig,
73
0
        ossl_ecdsa_simple_verify_sig,
74
0
        0, /* field_inverse_mod_ord */
75
0
        ossl_ec_GFp_simple_blind_coordinates,
76
0
        ossl_ec_GFp_simple_ladder_pre,
77
0
        ossl_ec_GFp_simple_ladder_step,
78
0
        ossl_ec_GFp_simple_ladder_post
79
0
    };
80
81
0
    return &ret;
82
0
}
83
84
/*
85
 * Most method functions in this file are designed to work with
86
 * non-trivial representations of field elements if necessary
87
 * (see ecp_mont.c): while standard modular addition and subtraction
88
 * are used, the field_mul and field_sqr methods will be used for
89
 * multiplication, and field_encode and field_decode (if defined)
90
 * will be used for converting between representations.
91
 *
92
 * Functions ec_GFp_simple_points_make_affine() and
93
 * ec_GFp_simple_point_get_affine_coordinates() specifically assume
94
 * that if a non-trivial representation is used, it is a Montgomery
95
 * representation (i.e. 'encoding' means multiplying by some factor R).
96
 */
97
98
int ossl_ec_GFp_simple_group_init(EC_GROUP *group)
99
36.7k
{
100
36.7k
    group->field = BN_new();
101
36.7k
    group->a = BN_new();
102
36.7k
    group->b = BN_new();
103
36.7k
    if (group->field == NULL || group->a == NULL || group->b == NULL) {
104
0
        BN_free(group->field);
105
0
        BN_free(group->a);
106
0
        BN_free(group->b);
107
0
        return 0;
108
0
    }
109
36.7k
    group->a_is_minus3 = 0;
110
36.7k
    return 1;
111
36.7k
}
112
113
void ossl_ec_GFp_simple_group_finish(EC_GROUP *group)
114
36.7k
{
115
36.7k
    BN_free(group->field);
116
36.7k
    BN_free(group->a);
117
36.7k
    BN_free(group->b);
118
36.7k
}
119
120
void ossl_ec_GFp_simple_group_clear_finish(EC_GROUP *group)
121
0
{
122
0
    BN_clear_free(group->field);
123
0
    BN_clear_free(group->a);
124
0
    BN_clear_free(group->b);
125
0
}
126
127
int ossl_ec_GFp_simple_group_copy(EC_GROUP *dest, const EC_GROUP *src)
128
16.1k
{
129
16.1k
    if (!BN_copy(dest->field, src->field))
130
0
        return 0;
131
16.1k
    if (!BN_copy(dest->a, src->a))
132
0
        return 0;
133
16.1k
    if (!BN_copy(dest->b, src->b))
134
0
        return 0;
135
136
16.1k
    dest->a_is_minus3 = src->a_is_minus3;
137
138
16.1k
    return 1;
139
16.1k
}
140
141
int ossl_ec_GFp_simple_group_set_curve(EC_GROUP *group,
142
                                       const BIGNUM *p, const BIGNUM *a,
143
                                       const BIGNUM *b, BN_CTX *ctx)
144
20.6k
{
145
20.6k
    int ret = 0;
146
20.6k
    BN_CTX *new_ctx = NULL;
147
20.6k
    BIGNUM *tmp_a;
148
149
    /* p must be a prime > 3 */
150
20.6k
    if (BN_num_bits(p) <= 2 || !BN_is_odd(p)) {
151
0
        ERR_raise(ERR_LIB_EC, EC_R_INVALID_FIELD);
152
0
        return 0;
153
0
    }
154
155
20.6k
    if (ctx == NULL) {
156
0
        ctx = new_ctx = BN_CTX_new_ex(group->libctx);
157
0
        if (ctx == NULL)
158
0
            return 0;
159
0
    }
160
161
20.6k
    BN_CTX_start(ctx);
162
20.6k
    tmp_a = BN_CTX_get(ctx);
163
20.6k
    if (tmp_a == NULL)
164
0
        goto err;
165
166
    /* group->field */
167
20.6k
    if (!BN_copy(group->field, p))
168
0
        goto err;
169
20.6k
    BN_set_negative(group->field, 0);
170
171
    /* group->a */
172
20.6k
    if (!BN_nnmod(tmp_a, a, p, ctx))
173
0
        goto err;
174
20.6k
    if (group->meth->field_encode) {
175
20.6k
        if (!group->meth->field_encode(group, group->a, tmp_a, ctx))
176
0
            goto err;
177
20.6k
    } else if (!BN_copy(group->a, tmp_a))
178
0
        goto err;
179
180
    /* group->b */
181
20.6k
    if (!BN_nnmod(group->b, b, p, ctx))
182
0
        goto err;
183
20.6k
    if (group->meth->field_encode)
184
20.6k
        if (!group->meth->field_encode(group, group->b, group->b, ctx))
185
0
            goto err;
186
187
    /* group->a_is_minus3 */
188
20.6k
    if (!BN_add_word(tmp_a, 3))
189
0
        goto err;
190
20.6k
    group->a_is_minus3 = (0 == BN_cmp(tmp_a, group->field));
191
192
20.6k
    ret = 1;
193
194
20.6k
 err:
195
20.6k
    BN_CTX_end(ctx);
196
20.6k
    BN_CTX_free(new_ctx);
197
20.6k
    return ret;
198
20.6k
}
199
200
int ossl_ec_GFp_simple_group_get_curve(const EC_GROUP *group, BIGNUM *p,
201
                                       BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
202
20.5k
{
203
20.5k
    int ret = 0;
204
20.5k
    BN_CTX *new_ctx = NULL;
205
206
20.5k
    if (p != NULL) {
207
20.5k
        if (!BN_copy(p, group->field))
208
0
            return 0;
209
20.5k
    }
210
211
20.5k
    if (a != NULL || b != NULL) {
212
20.5k
        if (group->meth->field_decode) {
213
20.5k
            if (ctx == NULL) {
214
0
                ctx = new_ctx = BN_CTX_new_ex(group->libctx);
215
0
                if (ctx == NULL)
216
0
                    return 0;
217
0
            }
218
20.5k
            if (a != NULL) {
219
20.5k
                if (!group->meth->field_decode(group, a, group->a, ctx))
220
0
                    goto err;
221
20.5k
            }
222
20.5k
            if (b != NULL) {
223
20.5k
                if (!group->meth->field_decode(group, b, group->b, ctx))
224
0
                    goto err;
225
20.5k
            }
226
20.5k
        } else {
227
24
            if (a != NULL) {
228
24
                if (!BN_copy(a, group->a))
229
0
                    goto err;
230
24
            }
231
24
            if (b != NULL) {
232
24
                if (!BN_copy(b, group->b))
233
0
                    goto err;
234
24
            }
235
24
        }
236
20.5k
    }
237
238
20.5k
    ret = 1;
239
240
20.5k
 err:
241
20.5k
    BN_CTX_free(new_ctx);
242
20.5k
    return ret;
243
20.5k
}
244
245
int ossl_ec_GFp_simple_group_get_degree(const EC_GROUP *group)
246
696
{
247
696
    return BN_num_bits(group->field);
248
696
}
249
250
int ossl_ec_GFp_simple_group_check_discriminant(const EC_GROUP *group,
251
                                                BN_CTX *ctx)
252
0
{
253
0
    int ret = 0;
254
0
    BIGNUM *a, *b, *order, *tmp_1, *tmp_2;
255
0
    const BIGNUM *p = group->field;
256
0
    BN_CTX *new_ctx = NULL;
257
258
0
    if (ctx == NULL) {
259
0
        ctx = new_ctx = BN_CTX_new_ex(group->libctx);
260
0
        if (ctx == NULL) {
261
0
            ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
262
0
            goto err;
263
0
        }
264
0
    }
265
0
    BN_CTX_start(ctx);
266
0
    a = BN_CTX_get(ctx);
267
0
    b = BN_CTX_get(ctx);
268
0
    tmp_1 = BN_CTX_get(ctx);
269
0
    tmp_2 = BN_CTX_get(ctx);
270
0
    order = BN_CTX_get(ctx);
271
0
    if (order == NULL)
272
0
        goto err;
273
274
0
    if (group->meth->field_decode) {
275
0
        if (!group->meth->field_decode(group, a, group->a, ctx))
276
0
            goto err;
277
0
        if (!group->meth->field_decode(group, b, group->b, ctx))
278
0
            goto err;
279
0
    } else {
280
0
        if (!BN_copy(a, group->a))
281
0
            goto err;
282
0
        if (!BN_copy(b, group->b))
283
0
            goto err;
284
0
    }
285
286
    /*-
287
     * check the discriminant:
288
     * y^2 = x^3 + a*x + b is an elliptic curve <=> 4*a^3 + 27*b^2 != 0 (mod p)
289
     * 0 =< a, b < p
290
     */
291
0
    if (BN_is_zero(a)) {
292
0
        if (BN_is_zero(b))
293
0
            goto err;
294
0
    } else if (!BN_is_zero(b)) {
295
0
        if (!BN_mod_sqr(tmp_1, a, p, ctx))
296
0
            goto err;
297
0
        if (!BN_mod_mul(tmp_2, tmp_1, a, p, ctx))
298
0
            goto err;
299
0
        if (!BN_lshift(tmp_1, tmp_2, 2))
300
0
            goto err;
301
        /* tmp_1 = 4*a^3 */
302
303
0
        if (!BN_mod_sqr(tmp_2, b, p, ctx))
304
0
            goto err;
305
0
        if (!BN_mul_word(tmp_2, 27))
306
0
            goto err;
307
        /* tmp_2 = 27*b^2 */
308
309
0
        if (!BN_mod_add(a, tmp_1, tmp_2, p, ctx))
310
0
            goto err;
311
0
        if (BN_is_zero(a))
312
0
            goto err;
313
0
    }
314
0
    ret = 1;
315
316
0
 err:
317
0
    BN_CTX_end(ctx);
318
0
    BN_CTX_free(new_ctx);
319
0
    return ret;
320
0
}
321
322
int ossl_ec_GFp_simple_point_init(EC_POINT *point)
323
90.3k
{
324
90.3k
    point->X = BN_new();
325
90.3k
    point->Y = BN_new();
326
90.3k
    point->Z = BN_new();
327
90.3k
    point->Z_is_one = 0;
328
329
90.3k
    if (point->X == NULL || point->Y == NULL || point->Z == NULL) {
330
0
        BN_free(point->X);
331
0
        BN_free(point->Y);
332
0
        BN_free(point->Z);
333
0
        return 0;
334
0
    }
335
90.3k
    return 1;
336
90.3k
}
337
338
void ossl_ec_GFp_simple_point_finish(EC_POINT *point)
339
89.8k
{
340
89.8k
    BN_free(point->X);
341
89.8k
    BN_free(point->Y);
342
89.8k
    BN_free(point->Z);
343
89.8k
}
344
345
void ossl_ec_GFp_simple_point_clear_finish(EC_POINT *point)
346
547
{
347
547
    BN_clear_free(point->X);
348
547
    BN_clear_free(point->Y);
349
547
    BN_clear_free(point->Z);
350
547
    point->Z_is_one = 0;
351
547
}
352
353
int ossl_ec_GFp_simple_point_copy(EC_POINT *dest, const EC_POINT *src)
354
46.9k
{
355
46.9k
    if (!BN_copy(dest->X, src->X))
356
0
        return 0;
357
46.9k
    if (!BN_copy(dest->Y, src->Y))
358
0
        return 0;
359
46.9k
    if (!BN_copy(dest->Z, src->Z))
360
0
        return 0;
361
46.9k
    dest->Z_is_one = src->Z_is_one;
362
46.9k
    dest->curve_name = src->curve_name;
363
364
46.9k
    return 1;
365
46.9k
}
366
367
int ossl_ec_GFp_simple_point_set_to_infinity(const EC_GROUP *group,
368
                                             EC_POINT *point)
369
2
{
370
2
    point->Z_is_one = 0;
371
2
    BN_zero(point->Z);
372
2
    return 1;
373
2
}
374
375
int ossl_ec_GFp_simple_set_Jprojective_coordinates_GFp(const EC_GROUP *group,
376
                                                       EC_POINT *point,
377
                                                       const BIGNUM *x,
378
                                                       const BIGNUM *y,
379
                                                       const BIGNUM *z,
380
                                                       BN_CTX *ctx)
381
41.2k
{
382
41.2k
    BN_CTX *new_ctx = NULL;
383
41.2k
    int ret = 0;
384
385
41.2k
    if (ctx == NULL) {
386
0
        ctx = new_ctx = BN_CTX_new_ex(group->libctx);
387
0
        if (ctx == NULL)
388
0
            return 0;
389
0
    }
390
391
41.2k
    if (x != NULL) {
392
41.2k
        if (!BN_nnmod(point->X, x, group->field, ctx))
393
0
            goto err;
394
41.2k
        if (group->meth->field_encode) {
395
40.9k
            if (!group->meth->field_encode(group, point->X, point->X, ctx))
396
0
                goto err;
397
40.9k
        }
398
41.2k
    }
399
400
41.2k
    if (y != NULL) {
401
41.2k
        if (!BN_nnmod(point->Y, y, group->field, ctx))
402
0
            goto err;
403
41.2k
        if (group->meth->field_encode) {
404
40.9k
            if (!group->meth->field_encode(group, point->Y, point->Y, ctx))
405
0
                goto err;
406
40.9k
        }
407
41.2k
    }
408
409
41.2k
    if (z != NULL) {
410
41.2k
        int Z_is_one;
411
412
41.2k
        if (!BN_nnmod(point->Z, z, group->field, ctx))
413
0
            goto err;
414
41.2k
        Z_is_one = BN_is_one(point->Z);
415
41.2k
        if (group->meth->field_encode) {
416
40.9k
            if (Z_is_one && (group->meth->field_set_to_one != 0)) {
417
40.9k
                if (!group->meth->field_set_to_one(group, point->Z, ctx))
418
0
                    goto err;
419
40.9k
            } else {
420
0
                if (!group->
421
0
                    meth->field_encode(group, point->Z, point->Z, ctx))
422
0
                    goto err;
423
0
            }
424
40.9k
        }
425
41.2k
        point->Z_is_one = Z_is_one;
426
41.2k
    }
427
428
41.2k
    ret = 1;
429
430
41.2k
 err:
431
41.2k
    BN_CTX_free(new_ctx);
432
41.2k
    return ret;
433
41.2k
}
434
435
int ossl_ec_GFp_simple_get_Jprojective_coordinates_GFp(const EC_GROUP *group,
436
                                                       const EC_POINT *point,
437
                                                       BIGNUM *x, BIGNUM *y,
438
                                                       BIGNUM *z, BN_CTX *ctx)
439
0
{
440
0
    BN_CTX *new_ctx = NULL;
441
0
    int ret = 0;
442
443
0
    if (group->meth->field_decode != 0) {
444
0
        if (ctx == NULL) {
445
0
            ctx = new_ctx = BN_CTX_new_ex(group->libctx);
446
0
            if (ctx == NULL)
447
0
                return 0;
448
0
        }
449
450
0
        if (x != NULL) {
451
0
            if (!group->meth->field_decode(group, x, point->X, ctx))
452
0
                goto err;
453
0
        }
454
0
        if (y != NULL) {
455
0
            if (!group->meth->field_decode(group, y, point->Y, ctx))
456
0
                goto err;
457
0
        }
458
0
        if (z != NULL) {
459
0
            if (!group->meth->field_decode(group, z, point->Z, ctx))
460
0
                goto err;
461
0
        }
462
0
    } else {
463
0
        if (x != NULL) {
464
0
            if (!BN_copy(x, point->X))
465
0
                goto err;
466
0
        }
467
0
        if (y != NULL) {
468
0
            if (!BN_copy(y, point->Y))
469
0
                goto err;
470
0
        }
471
0
        if (z != NULL) {
472
0
            if (!BN_copy(z, point->Z))
473
0
                goto err;
474
0
        }
475
0
    }
476
477
0
    ret = 1;
478
479
0
 err:
480
0
    BN_CTX_free(new_ctx);
481
0
    return ret;
482
0
}
483
484
int ossl_ec_GFp_simple_point_set_affine_coordinates(const EC_GROUP *group,
485
                                                    EC_POINT *point,
486
                                                    const BIGNUM *x,
487
                                                    const BIGNUM *y, BN_CTX *ctx)
488
41.0k
{
489
41.0k
    if (x == NULL || y == NULL) {
490
        /*
491
         * unlike for projective coordinates, we do not tolerate this
492
         */
493
0
        ERR_raise(ERR_LIB_EC, ERR_R_PASSED_NULL_PARAMETER);
494
0
        return 0;
495
0
    }
496
497
41.0k
    return EC_POINT_set_Jprojective_coordinates_GFp(group, point, x, y,
498
41.0k
                                                    BN_value_one(), ctx);
499
41.0k
}
500
501
int ossl_ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP *group,
502
                                                    const EC_POINT *point,
503
                                                    BIGNUM *x, BIGNUM *y,
504
                                                    BN_CTX *ctx)
505
147
{
506
147
    BN_CTX *new_ctx = NULL;
507
147
    BIGNUM *Z, *Z_1, *Z_2, *Z_3;
508
147
    const BIGNUM *Z_;
509
147
    int ret = 0;
510
511
147
    if (EC_POINT_is_at_infinity(group, point)) {
512
0
        ERR_raise(ERR_LIB_EC, EC_R_POINT_AT_INFINITY);
513
0
        return 0;
514
0
    }
515
516
147
    if (ctx == NULL) {
517
0
        ctx = new_ctx = BN_CTX_new_ex(group->libctx);
518
0
        if (ctx == NULL)
519
0
            return 0;
520
0
    }
521
522
147
    BN_CTX_start(ctx);
523
147
    Z = BN_CTX_get(ctx);
524
147
    Z_1 = BN_CTX_get(ctx);
525
147
    Z_2 = BN_CTX_get(ctx);
526
147
    Z_3 = BN_CTX_get(ctx);
527
147
    if (Z_3 == NULL)
528
0
        goto err;
529
530
    /* transform  (X, Y, Z)  into  (x, y) := (X/Z^2, Y/Z^3) */
531
532
147
    if (group->meth->field_decode) {
533
147
        if (!group->meth->field_decode(group, Z, point->Z, ctx))
534
0
            goto err;
535
147
        Z_ = Z;
536
147
    } else {
537
0
        Z_ = point->Z;
538
0
    }
539
540
147
    if (BN_is_one(Z_)) {
541
147
        if (group->meth->field_decode) {
542
147
            if (x != NULL) {
543
147
                if (!group->meth->field_decode(group, x, point->X, ctx))
544
0
                    goto err;
545
147
            }
546
147
            if (y != NULL) {
547
123
                if (!group->meth->field_decode(group, y, point->Y, ctx))
548
0
                    goto err;
549
123
            }
550
147
        } else {
551
0
            if (x != NULL) {
552
0
                if (!BN_copy(x, point->X))
553
0
                    goto err;
554
0
            }
555
0
            if (y != NULL) {
556
0
                if (!BN_copy(y, point->Y))
557
0
                    goto err;
558
0
            }
559
0
        }
560
147
    } else {
561
0
        if (!group->meth->field_inv(group, Z_1, Z_, ctx)) {
562
0
            ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
563
0
            goto err;
564
0
        }
565
566
0
        if (group->meth->field_encode == 0) {
567
            /* field_sqr works on standard representation */
568
0
            if (!group->meth->field_sqr(group, Z_2, Z_1, ctx))
569
0
                goto err;
570
0
        } else {
571
0
            if (!BN_mod_sqr(Z_2, Z_1, group->field, ctx))
572
0
                goto err;
573
0
        }
574
575
0
        if (x != NULL) {
576
            /*
577
             * in the Montgomery case, field_mul will cancel out Montgomery
578
             * factor in X:
579
             */
580
0
            if (!group->meth->field_mul(group, x, point->X, Z_2, ctx))
581
0
                goto err;
582
0
        }
583
584
0
        if (y != NULL) {
585
0
            if (group->meth->field_encode == 0) {
586
                /*
587
                 * field_mul works on standard representation
588
                 */
589
0
                if (!group->meth->field_mul(group, Z_3, Z_2, Z_1, ctx))
590
0
                    goto err;
591
0
            } else {
592
0
                if (!BN_mod_mul(Z_3, Z_2, Z_1, group->field, ctx))
593
0
                    goto err;
594
0
            }
595
596
            /*
597
             * in the Montgomery case, field_mul will cancel out Montgomery
598
             * factor in Y:
599
             */
600
0
            if (!group->meth->field_mul(group, y, point->Y, Z_3, ctx))
601
0
                goto err;
602
0
        }
603
0
    }
604
605
147
    ret = 1;
606
607
147
 err:
608
147
    BN_CTX_end(ctx);
609
147
    BN_CTX_free(new_ctx);
610
147
    return ret;
611
147
}
612
613
int ossl_ec_GFp_simple_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
614
                           const EC_POINT *b, BN_CTX *ctx)
615
984
{
616
984
    int (*field_mul) (const EC_GROUP *, BIGNUM *, const BIGNUM *,
617
984
                      const BIGNUM *, BN_CTX *);
618
984
    int (*field_sqr) (const EC_GROUP *, BIGNUM *, const BIGNUM *, BN_CTX *);
619
984
    const BIGNUM *p;
620
984
    BN_CTX *new_ctx = NULL;
621
984
    BIGNUM *n0, *n1, *n2, *n3, *n4, *n5, *n6;
622
984
    int ret = 0;
623
624
984
    if (a == b)
625
0
        return EC_POINT_dbl(group, r, a, ctx);
626
984
    if (EC_POINT_is_at_infinity(group, a))
627
0
        return EC_POINT_copy(r, b);
628
984
    if (EC_POINT_is_at_infinity(group, b))
629
0
        return EC_POINT_copy(r, a);
630
631
984
    field_mul = group->meth->field_mul;
632
984
    field_sqr = group->meth->field_sqr;
633
984
    p = group->field;
634
635
984
    if (ctx == NULL) {
636
0
        ctx = new_ctx = BN_CTX_new_ex(group->libctx);
637
0
        if (ctx == NULL)
638
0
            return 0;
639
0
    }
640
641
984
    BN_CTX_start(ctx);
642
984
    n0 = BN_CTX_get(ctx);
643
984
    n1 = BN_CTX_get(ctx);
644
984
    n2 = BN_CTX_get(ctx);
645
984
    n3 = BN_CTX_get(ctx);
646
984
    n4 = BN_CTX_get(ctx);
647
984
    n5 = BN_CTX_get(ctx);
648
984
    n6 = BN_CTX_get(ctx);
649
984
    if (n6 == NULL)
650
0
        goto end;
651
652
    /*
653
     * Note that in this function we must not read components of 'a' or 'b'
654
     * once we have written the corresponding components of 'r'. ('r' might
655
     * be one of 'a' or 'b'.)
656
     */
657
658
    /* n1, n2 */
659
984
    if (b->Z_is_one) {
660
816
        if (!BN_copy(n1, a->X))
661
0
            goto end;
662
816
        if (!BN_copy(n2, a->Y))
663
0
            goto end;
664
        /* n1 = X_a */
665
        /* n2 = Y_a */
666
816
    } else {
667
168
        if (!field_sqr(group, n0, b->Z, ctx))
668
0
            goto end;
669
168
        if (!field_mul(group, n1, a->X, n0, ctx))
670
0
            goto end;
671
        /* n1 = X_a * Z_b^2 */
672
673
168
        if (!field_mul(group, n0, n0, b->Z, ctx))
674
0
            goto end;
675
168
        if (!field_mul(group, n2, a->Y, n0, ctx))
676
0
            goto end;
677
        /* n2 = Y_a * Z_b^3 */
678
168
    }
679
680
    /* n3, n4 */
681
984
    if (a->Z_is_one) {
682
24
        if (!BN_copy(n3, b->X))
683
0
            goto end;
684
24
        if (!BN_copy(n4, b->Y))
685
0
            goto end;
686
        /* n3 = X_b */
687
        /* n4 = Y_b */
688
960
    } else {
689
960
        if (!field_sqr(group, n0, a->Z, ctx))
690
0
            goto end;
691
960
        if (!field_mul(group, n3, b->X, n0, ctx))
692
0
            goto end;
693
        /* n3 = X_b * Z_a^2 */
694
695
960
        if (!field_mul(group, n0, n0, a->Z, ctx))
696
0
            goto end;
697
960
        if (!field_mul(group, n4, b->Y, n0, ctx))
698
0
            goto end;
699
        /* n4 = Y_b * Z_a^3 */
700
960
    }
701
702
    /* n5, n6 */
703
984
    if (!BN_mod_sub_quick(n5, n1, n3, p))
704
0
        goto end;
705
984
    if (!BN_mod_sub_quick(n6, n2, n4, p))
706
0
        goto end;
707
    /* n5 = n1 - n3 */
708
    /* n6 = n2 - n4 */
709
710
984
    if (BN_is_zero(n5)) {
711
24
        if (BN_is_zero(n6)) {
712
            /* a is the same point as b */
713
0
            BN_CTX_end(ctx);
714
0
            ret = EC_POINT_dbl(group, r, a, ctx);
715
0
            ctx = NULL;
716
0
            goto end;
717
24
        } else {
718
            /* a is the inverse of b */
719
24
            BN_zero(r->Z);
720
24
            r->Z_is_one = 0;
721
24
            ret = 1;
722
24
            goto end;
723
24
        }
724
24
    }
725
726
    /* 'n7', 'n8' */
727
960
    if (!BN_mod_add_quick(n1, n1, n3, p))
728
0
        goto end;
729
960
    if (!BN_mod_add_quick(n2, n2, n4, p))
730
0
        goto end;
731
    /* 'n7' = n1 + n3 */
732
    /* 'n8' = n2 + n4 */
733
734
    /* Z_r */
735
960
    if (a->Z_is_one && b->Z_is_one) {
736
0
        if (!BN_copy(r->Z, n5))
737
0
            goto end;
738
960
    } else {
739
960
        if (a->Z_is_one) {
740
24
            if (!BN_copy(n0, b->Z))
741
0
                goto end;
742
936
        } else if (b->Z_is_one) {
743
792
            if (!BN_copy(n0, a->Z))
744
0
                goto end;
745
792
        } else {
746
144
            if (!field_mul(group, n0, a->Z, b->Z, ctx))
747
0
                goto end;
748
144
        }
749
960
        if (!field_mul(group, r->Z, n0, n5, ctx))
750
0
            goto end;
751
960
    }
752
960
    r->Z_is_one = 0;
753
    /* Z_r = Z_a * Z_b * n5 */
754
755
    /* X_r */
756
960
    if (!field_sqr(group, n0, n6, ctx))
757
0
        goto end;
758
960
    if (!field_sqr(group, n4, n5, ctx))
759
0
        goto end;
760
960
    if (!field_mul(group, n3, n1, n4, ctx))
761
0
        goto end;
762
960
    if (!BN_mod_sub_quick(r->X, n0, n3, p))
763
0
        goto end;
764
    /* X_r = n6^2 - n5^2 * 'n7' */
765
766
    /* 'n9' */
767
960
    if (!BN_mod_lshift1_quick(n0, r->X, p))
768
0
        goto end;
769
960
    if (!BN_mod_sub_quick(n0, n3, n0, p))
770
0
        goto end;
771
    /* n9 = n5^2 * 'n7' - 2 * X_r */
772
773
    /* Y_r */
774
960
    if (!field_mul(group, n0, n0, n6, ctx))
775
0
        goto end;
776
960
    if (!field_mul(group, n5, n4, n5, ctx))
777
0
        goto end;               /* now n5 is n5^3 */
778
960
    if (!field_mul(group, n1, n2, n5, ctx))
779
0
        goto end;
780
960
    if (!BN_mod_sub_quick(n0, n0, n1, p))
781
0
        goto end;
782
960
    if (BN_is_odd(n0))
783
500
        if (!BN_add(n0, n0, p))
784
0
            goto end;
785
    /* now  0 <= n0 < 2*p,  and n0 is even */
786
960
    if (!BN_rshift1(r->Y, n0))
787
0
        goto end;
788
    /* Y_r = (n6 * 'n9' - 'n8' * 'n5^3') / 2 */
789
790
960
    ret = 1;
791
792
984
 end:
793
984
    BN_CTX_end(ctx);
794
984
    BN_CTX_free(new_ctx);
795
984
    return ret;
796
960
}
797
798
int ossl_ec_GFp_simple_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
799
                           BN_CTX *ctx)
800
9.24k
{
801
9.24k
    int (*field_mul) (const EC_GROUP *, BIGNUM *, const BIGNUM *,
802
9.24k
                      const BIGNUM *, BN_CTX *);
803
9.24k
    int (*field_sqr) (const EC_GROUP *, BIGNUM *, const BIGNUM *, BN_CTX *);
804
9.24k
    const BIGNUM *p;
805
9.24k
    BN_CTX *new_ctx = NULL;
806
9.24k
    BIGNUM *n0, *n1, *n2, *n3;
807
9.24k
    int ret = 0;
808
809
9.24k
    if (EC_POINT_is_at_infinity(group, a)) {
810
0
        BN_zero(r->Z);
811
0
        r->Z_is_one = 0;
812
0
        return 1;
813
0
    }
814
815
9.24k
    field_mul = group->meth->field_mul;
816
9.24k
    field_sqr = group->meth->field_sqr;
817
9.24k
    p = group->field;
818
819
9.24k
    if (ctx == NULL) {
820
0
        ctx = new_ctx = BN_CTX_new_ex(group->libctx);
821
0
        if (ctx == NULL)
822
0
            return 0;
823
0
    }
824
825
9.24k
    BN_CTX_start(ctx);
826
9.24k
    n0 = BN_CTX_get(ctx);
827
9.24k
    n1 = BN_CTX_get(ctx);
828
9.24k
    n2 = BN_CTX_get(ctx);
829
9.24k
    n3 = BN_CTX_get(ctx);
830
9.24k
    if (n3 == NULL)
831
0
        goto err;
832
833
    /*
834
     * Note that in this function we must not read components of 'a' once we
835
     * have written the corresponding components of 'r'. ('r' might the same
836
     * as 'a'.)
837
     */
838
839
    /* n1 */
840
9.24k
    if (a->Z_is_one) {
841
24
        if (!field_sqr(group, n0, a->X, ctx))
842
0
            goto err;
843
24
        if (!BN_mod_lshift1_quick(n1, n0, p))
844
0
            goto err;
845
24
        if (!BN_mod_add_quick(n0, n0, n1, p))
846
0
            goto err;
847
24
        if (!BN_mod_add_quick(n1, n0, group->a, p))
848
0
            goto err;
849
        /* n1 = 3 * X_a^2 + a_curve */
850
9.21k
    } else if (group->a_is_minus3) {
851
9.21k
        if (!field_sqr(group, n1, a->Z, ctx))
852
0
            goto err;
853
9.21k
        if (!BN_mod_add_quick(n0, a->X, n1, p))
854
0
            goto err;
855
9.21k
        if (!BN_mod_sub_quick(n2, a->X, n1, p))
856
0
            goto err;
857
9.21k
        if (!field_mul(group, n1, n0, n2, ctx))
858
0
            goto err;
859
9.21k
        if (!BN_mod_lshift1_quick(n0, n1, p))
860
0
            goto err;
861
9.21k
        if (!BN_mod_add_quick(n1, n0, n1, p))
862
0
            goto err;
863
        /*-
864
         * n1 = 3 * (X_a + Z_a^2) * (X_a - Z_a^2)
865
         *    = 3 * X_a^2 - 3 * Z_a^4
866
         */
867
9.21k
    } else {
868
0
        if (!field_sqr(group, n0, a->X, ctx))
869
0
            goto err;
870
0
        if (!BN_mod_lshift1_quick(n1, n0, p))
871
0
            goto err;
872
0
        if (!BN_mod_add_quick(n0, n0, n1, p))
873
0
            goto err;
874
0
        if (!field_sqr(group, n1, a->Z, ctx))
875
0
            goto err;
876
0
        if (!field_sqr(group, n1, n1, ctx))
877
0
            goto err;
878
0
        if (!field_mul(group, n1, n1, group->a, ctx))
879
0
            goto err;
880
0
        if (!BN_mod_add_quick(n1, n1, n0, p))
881
0
            goto err;
882
        /* n1 = 3 * X_a^2 + a_curve * Z_a^4 */
883
0
    }
884
885
    /* Z_r */
886
9.24k
    if (a->Z_is_one) {
887
24
        if (!BN_copy(n0, a->Y))
888
0
            goto err;
889
9.21k
    } else {
890
9.21k
        if (!field_mul(group, n0, a->Y, a->Z, ctx))
891
0
            goto err;
892
9.21k
    }
893
9.24k
    if (!BN_mod_lshift1_quick(r->Z, n0, p))
894
0
        goto err;
895
9.24k
    r->Z_is_one = 0;
896
    /* Z_r = 2 * Y_a * Z_a */
897
898
    /* n2 */
899
9.24k
    if (!field_sqr(group, n3, a->Y, ctx))
900
0
        goto err;
901
9.24k
    if (!field_mul(group, n2, a->X, n3, ctx))
902
0
        goto err;
903
9.24k
    if (!BN_mod_lshift_quick(n2, n2, 2, p))
904
0
        goto err;
905
    /* n2 = 4 * X_a * Y_a^2 */
906
907
    /* X_r */
908
9.24k
    if (!BN_mod_lshift1_quick(n0, n2, p))
909
0
        goto err;
910
9.24k
    if (!field_sqr(group, r->X, n1, ctx))
911
0
        goto err;
912
9.24k
    if (!BN_mod_sub_quick(r->X, r->X, n0, p))
913
0
        goto err;
914
    /* X_r = n1^2 - 2 * n2 */
915
916
    /* n3 */
917
9.24k
    if (!field_sqr(group, n0, n3, ctx))
918
0
        goto err;
919
9.24k
    if (!BN_mod_lshift_quick(n3, n0, 3, p))
920
0
        goto err;
921
    /* n3 = 8 * Y_a^4 */
922
923
    /* Y_r */
924
9.24k
    if (!BN_mod_sub_quick(n0, n2, r->X, p))
925
0
        goto err;
926
9.24k
    if (!field_mul(group, n0, n1, n0, ctx))
927
0
        goto err;
928
9.24k
    if (!BN_mod_sub_quick(r->Y, n0, n3, p))
929
0
        goto err;
930
    /* Y_r = n1 * (n2 - X_r) - n3 */
931
932
9.24k
    ret = 1;
933
934
9.24k
 err:
935
9.24k
    BN_CTX_end(ctx);
936
9.24k
    BN_CTX_free(new_ctx);
937
9.24k
    return ret;
938
9.24k
}
939
940
int ossl_ec_GFp_simple_invert(const EC_GROUP *group, EC_POINT *point,
941
                              BN_CTX *ctx)
942
480
{
943
480
    if (EC_POINT_is_at_infinity(group, point) || BN_is_zero(point->Y))
944
        /* point is its own inverse */
945
24
        return 1;
946
947
456
    return BN_usub(point->Y, group->field, point->Y);
948
480
}
949
950
int ossl_ec_GFp_simple_is_at_infinity(const EC_GROUP *group,
951
                                      const EC_POINT *point)
952
129k
{
953
129k
    return BN_is_zero(point->Z);
954
129k
}
955
956
int ossl_ec_GFp_simple_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
957
                                   BN_CTX *ctx)
958
41.3k
{
959
41.3k
    int (*field_mul) (const EC_GROUP *, BIGNUM *, const BIGNUM *,
960
41.3k
                      const BIGNUM *, BN_CTX *);
961
41.3k
    int (*field_sqr) (const EC_GROUP *, BIGNUM *, const BIGNUM *, BN_CTX *);
962
41.3k
    const BIGNUM *p;
963
41.3k
    BN_CTX *new_ctx = NULL;
964
41.3k
    BIGNUM *rh, *tmp, *Z4, *Z6;
965
41.3k
    int ret = -1;
966
967
41.3k
    if (EC_POINT_is_at_infinity(group, point))
968
0
        return 1;
969
970
41.3k
    field_mul = group->meth->field_mul;
971
41.3k
    field_sqr = group->meth->field_sqr;
972
41.3k
    p = group->field;
973
974
41.3k
    if (ctx == NULL) {
975
0
        ctx = new_ctx = BN_CTX_new_ex(group->libctx);
976
0
        if (ctx == NULL)
977
0
            return -1;
978
0
    }
979
980
41.3k
    BN_CTX_start(ctx);
981
41.3k
    rh = BN_CTX_get(ctx);
982
41.3k
    tmp = BN_CTX_get(ctx);
983
41.3k
    Z4 = BN_CTX_get(ctx);
984
41.3k
    Z6 = BN_CTX_get(ctx);
985
41.3k
    if (Z6 == NULL)
986
0
        goto err;
987
988
    /*-
989
     * We have a curve defined by a Weierstrass equation
990
     *      y^2 = x^3 + a*x + b.
991
     * The point to consider is given in Jacobian projective coordinates
992
     * where  (X, Y, Z)  represents  (x, y) = (X/Z^2, Y/Z^3).
993
     * Substituting this and multiplying by  Z^6  transforms the above equation into
994
     *      Y^2 = X^3 + a*X*Z^4 + b*Z^6.
995
     * To test this, we add up the right-hand side in 'rh'.
996
     */
997
998
    /* rh := X^2 */
999
41.3k
    if (!field_sqr(group, rh, point->X, ctx))
1000
0
        goto err;
1001
1002
41.3k
    if (!point->Z_is_one) {
1003
0
        if (!field_sqr(group, tmp, point->Z, ctx))
1004
0
            goto err;
1005
0
        if (!field_sqr(group, Z4, tmp, ctx))
1006
0
            goto err;
1007
0
        if (!field_mul(group, Z6, Z4, tmp, ctx))
1008
0
            goto err;
1009
1010
        /* rh := (rh + a*Z^4)*X */
1011
0
        if (group->a_is_minus3) {
1012
0
            if (!BN_mod_lshift1_quick(tmp, Z4, p))
1013
0
                goto err;
1014
0
            if (!BN_mod_add_quick(tmp, tmp, Z4, p))
1015
0
                goto err;
1016
0
            if (!BN_mod_sub_quick(rh, rh, tmp, p))
1017
0
                goto err;
1018
0
            if (!field_mul(group, rh, rh, point->X, ctx))
1019
0
                goto err;
1020
0
        } else {
1021
0
            if (!field_mul(group, tmp, Z4, group->a, ctx))
1022
0
                goto err;
1023
0
            if (!BN_mod_add_quick(rh, rh, tmp, p))
1024
0
                goto err;
1025
0
            if (!field_mul(group, rh, rh, point->X, ctx))
1026
0
                goto err;
1027
0
        }
1028
1029
        /* rh := rh + b*Z^6 */
1030
0
        if (!field_mul(group, tmp, group->b, Z6, ctx))
1031
0
            goto err;
1032
0
        if (!BN_mod_add_quick(rh, rh, tmp, p))
1033
0
            goto err;
1034
41.3k
    } else {
1035
        /* point->Z_is_one */
1036
1037
        /* rh := (rh + a)*X */
1038
41.3k
        if (!BN_mod_add_quick(rh, rh, group->a, p))
1039
0
            goto err;
1040
41.3k
        if (!field_mul(group, rh, rh, point->X, ctx))
1041
0
            goto err;
1042
        /* rh := rh + b */
1043
41.3k
        if (!BN_mod_add_quick(rh, rh, group->b, p))
1044
0
            goto err;
1045
41.3k
    }
1046
1047
    /* 'lh' := Y^2 */
1048
41.3k
    if (!field_sqr(group, tmp, point->Y, ctx))
1049
0
        goto err;
1050
1051
41.3k
    ret = (0 == BN_ucmp(tmp, rh));
1052
1053
41.3k
 err:
1054
41.3k
    BN_CTX_end(ctx);
1055
41.3k
    BN_CTX_free(new_ctx);
1056
41.3k
    return ret;
1057
41.3k
}
1058
1059
int ossl_ec_GFp_simple_cmp(const EC_GROUP *group, const EC_POINT *a,
1060
                           const EC_POINT *b, BN_CTX *ctx)
1061
15.3k
{
1062
    /*-
1063
     * return values:
1064
     *  -1   error
1065
     *   0   equal (in affine coordinates)
1066
     *   1   not equal
1067
     */
1068
1069
15.3k
    int (*field_mul) (const EC_GROUP *, BIGNUM *, const BIGNUM *,
1070
15.3k
                      const BIGNUM *, BN_CTX *);
1071
15.3k
    int (*field_sqr) (const EC_GROUP *, BIGNUM *, const BIGNUM *, BN_CTX *);
1072
15.3k
    BN_CTX *new_ctx = NULL;
1073
15.3k
    BIGNUM *tmp1, *tmp2, *Za23, *Zb23;
1074
15.3k
    const BIGNUM *tmp1_, *tmp2_;
1075
15.3k
    int ret = -1;
1076
1077
15.3k
    if (EC_POINT_is_at_infinity(group, a)) {
1078
0
        return EC_POINT_is_at_infinity(group, b) ? 0 : 1;
1079
0
    }
1080
1081
15.3k
    if (EC_POINT_is_at_infinity(group, b))
1082
0
        return 1;
1083
1084
15.3k
    if (a->Z_is_one && b->Z_is_one) {
1085
15.3k
        return ((BN_cmp(a->X, b->X) == 0) && BN_cmp(a->Y, b->Y) == 0) ? 0 : 1;
1086
15.3k
    }
1087
1088
0
    field_mul = group->meth->field_mul;
1089
0
    field_sqr = group->meth->field_sqr;
1090
1091
0
    if (ctx == NULL) {
1092
0
        ctx = new_ctx = BN_CTX_new_ex(group->libctx);
1093
0
        if (ctx == NULL)
1094
0
            return -1;
1095
0
    }
1096
1097
0
    BN_CTX_start(ctx);
1098
0
    tmp1 = BN_CTX_get(ctx);
1099
0
    tmp2 = BN_CTX_get(ctx);
1100
0
    Za23 = BN_CTX_get(ctx);
1101
0
    Zb23 = BN_CTX_get(ctx);
1102
0
    if (Zb23 == NULL)
1103
0
        goto end;
1104
1105
    /*-
1106
     * We have to decide whether
1107
     *     (X_a/Z_a^2, Y_a/Z_a^3) = (X_b/Z_b^2, Y_b/Z_b^3),
1108
     * or equivalently, whether
1109
     *     (X_a*Z_b^2, Y_a*Z_b^3) = (X_b*Z_a^2, Y_b*Z_a^3).
1110
     */
1111
1112
0
    if (!b->Z_is_one) {
1113
0
        if (!field_sqr(group, Zb23, b->Z, ctx))
1114
0
            goto end;
1115
0
        if (!field_mul(group, tmp1, a->X, Zb23, ctx))
1116
0
            goto end;
1117
0
        tmp1_ = tmp1;
1118
0
    } else
1119
0
        tmp1_ = a->X;
1120
0
    if (!a->Z_is_one) {
1121
0
        if (!field_sqr(group, Za23, a->Z, ctx))
1122
0
            goto end;
1123
0
        if (!field_mul(group, tmp2, b->X, Za23, ctx))
1124
0
            goto end;
1125
0
        tmp2_ = tmp2;
1126
0
    } else
1127
0
        tmp2_ = b->X;
1128
1129
    /* compare  X_a*Z_b^2  with  X_b*Z_a^2 */
1130
0
    if (BN_cmp(tmp1_, tmp2_) != 0) {
1131
0
        ret = 1;                /* points differ */
1132
0
        goto end;
1133
0
    }
1134
1135
0
    if (!b->Z_is_one) {
1136
0
        if (!field_mul(group, Zb23, Zb23, b->Z, ctx))
1137
0
            goto end;
1138
0
        if (!field_mul(group, tmp1, a->Y, Zb23, ctx))
1139
0
            goto end;
1140
        /* tmp1_ = tmp1 */
1141
0
    } else
1142
0
        tmp1_ = a->Y;
1143
0
    if (!a->Z_is_one) {
1144
0
        if (!field_mul(group, Za23, Za23, a->Z, ctx))
1145
0
            goto end;
1146
0
        if (!field_mul(group, tmp2, b->Y, Za23, ctx))
1147
0
            goto end;
1148
        /* tmp2_ = tmp2 */
1149
0
    } else
1150
0
        tmp2_ = b->Y;
1151
1152
    /* compare  Y_a*Z_b^3  with  Y_b*Z_a^3 */
1153
0
    if (BN_cmp(tmp1_, tmp2_) != 0) {
1154
0
        ret = 1;                /* points differ */
1155
0
        goto end;
1156
0
    }
1157
1158
    /* points are equal */
1159
0
    ret = 0;
1160
1161
0
 end:
1162
0
    BN_CTX_end(ctx);
1163
0
    BN_CTX_free(new_ctx);
1164
0
    return ret;
1165
0
}
1166
1167
int ossl_ec_GFp_simple_make_affine(const EC_GROUP *group, EC_POINT *point,
1168
                                   BN_CTX *ctx)
1169
0
{
1170
0
    BN_CTX *new_ctx = NULL;
1171
0
    BIGNUM *x, *y;
1172
0
    int ret = 0;
1173
1174
0
    if (point->Z_is_one || EC_POINT_is_at_infinity(group, point))
1175
0
        return 1;
1176
1177
0
    if (ctx == NULL) {
1178
0
        ctx = new_ctx = BN_CTX_new_ex(group->libctx);
1179
0
        if (ctx == NULL)
1180
0
            return 0;
1181
0
    }
1182
1183
0
    BN_CTX_start(ctx);
1184
0
    x = BN_CTX_get(ctx);
1185
0
    y = BN_CTX_get(ctx);
1186
0
    if (y == NULL)
1187
0
        goto err;
1188
1189
0
    if (!EC_POINT_get_affine_coordinates(group, point, x, y, ctx))
1190
0
        goto err;
1191
0
    if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
1192
0
        goto err;
1193
0
    if (!point->Z_is_one) {
1194
0
        ERR_raise(ERR_LIB_EC, ERR_R_INTERNAL_ERROR);
1195
0
        goto err;
1196
0
    }
1197
1198
0
    ret = 1;
1199
1200
0
 err:
1201
0
    BN_CTX_end(ctx);
1202
0
    BN_CTX_free(new_ctx);
1203
0
    return ret;
1204
0
}
1205
1206
int ossl_ec_GFp_simple_points_make_affine(const EC_GROUP *group, size_t num,
1207
                                          EC_POINT *points[], BN_CTX *ctx)
1208
24
{
1209
24
    BN_CTX *new_ctx = NULL;
1210
24
    BIGNUM *tmp, *tmp_Z;
1211
24
    BIGNUM **prod_Z = NULL;
1212
24
    size_t i;
1213
24
    int ret = 0;
1214
1215
24
    if (num == 0)
1216
0
        return 1;
1217
1218
24
    if (ctx == NULL) {
1219
0
        ctx = new_ctx = BN_CTX_new_ex(group->libctx);
1220
0
        if (ctx == NULL)
1221
0
            return 0;
1222
0
    }
1223
1224
24
    BN_CTX_start(ctx);
1225
24
    tmp = BN_CTX_get(ctx);
1226
24
    tmp_Z = BN_CTX_get(ctx);
1227
24
    if (tmp_Z == NULL)
1228
0
        goto err;
1229
1230
24
    prod_Z = OPENSSL_malloc(num * sizeof(prod_Z[0]));
1231
24
    if (prod_Z == NULL)
1232
0
        goto err;
1233
216
    for (i = 0; i < num; i++) {
1234
192
        prod_Z[i] = BN_new();
1235
192
        if (prod_Z[i] == NULL)
1236
0
            goto err;
1237
192
    }
1238
1239
    /*
1240
     * Set each prod_Z[i] to the product of points[0]->Z .. points[i]->Z,
1241
     * skipping any zero-valued inputs (pretend that they're 1).
1242
     */
1243
1244
24
    if (!BN_is_zero(points[0]->Z)) {
1245
24
        if (!BN_copy(prod_Z[0], points[0]->Z))
1246
0
            goto err;
1247
24
    } else {
1248
0
        if (group->meth->field_set_to_one != 0) {
1249
0
            if (!group->meth->field_set_to_one(group, prod_Z[0], ctx))
1250
0
                goto err;
1251
0
        } else {
1252
0
            if (!BN_one(prod_Z[0]))
1253
0
                goto err;
1254
0
        }
1255
0
    }
1256
1257
192
    for (i = 1; i < num; i++) {
1258
168
        if (!BN_is_zero(points[i]->Z)) {
1259
168
            if (!group->
1260
168
                meth->field_mul(group, prod_Z[i], prod_Z[i - 1], points[i]->Z,
1261
168
                                ctx))
1262
0
                goto err;
1263
168
        } else {
1264
0
            if (!BN_copy(prod_Z[i], prod_Z[i - 1]))
1265
0
                goto err;
1266
0
        }
1267
168
    }
1268
1269
    /*
1270
     * Now use a single explicit inversion to replace every non-zero
1271
     * points[i]->Z by its inverse.
1272
     */
1273
1274
24
    if (!group->meth->field_inv(group, tmp, prod_Z[num - 1], ctx)) {
1275
0
        ERR_raise(ERR_LIB_EC, ERR_R_BN_LIB);
1276
0
        goto err;
1277
0
    }
1278
24
    if (group->meth->field_encode != 0) {
1279
        /*
1280
         * In the Montgomery case, we just turned R*H (representing H) into
1281
         * 1/(R*H), but we need R*(1/H) (representing 1/H); i.e. we need to
1282
         * multiply by the Montgomery factor twice.
1283
         */
1284
24
        if (!group->meth->field_encode(group, tmp, tmp, ctx))
1285
0
            goto err;
1286
24
        if (!group->meth->field_encode(group, tmp, tmp, ctx))
1287
0
            goto err;
1288
24
    }
1289
1290
192
    for (i = num - 1; i > 0; --i) {
1291
        /*
1292
         * Loop invariant: tmp is the product of the inverses of points[0]->Z
1293
         * .. points[i]->Z (zero-valued inputs skipped).
1294
         */
1295
168
        if (!BN_is_zero(points[i]->Z)) {
1296
            /*
1297
             * Set tmp_Z to the inverse of points[i]->Z (as product of Z
1298
             * inverses 0 .. i, Z values 0 .. i - 1).
1299
             */
1300
168
            if (!group->
1301
168
                meth->field_mul(group, tmp_Z, prod_Z[i - 1], tmp, ctx))
1302
0
                goto err;
1303
            /*
1304
             * Update tmp to satisfy the loop invariant for i - 1.
1305
             */
1306
168
            if (!group->meth->field_mul(group, tmp, tmp, points[i]->Z, ctx))
1307
0
                goto err;
1308
            /* Replace points[i]->Z by its inverse. */
1309
168
            if (!BN_copy(points[i]->Z, tmp_Z))
1310
0
                goto err;
1311
168
        }
1312
168
    }
1313
1314
24
    if (!BN_is_zero(points[0]->Z)) {
1315
        /* Replace points[0]->Z by its inverse. */
1316
24
        if (!BN_copy(points[0]->Z, tmp))
1317
0
            goto err;
1318
24
    }
1319
1320
    /* Finally, fix up the X and Y coordinates for all points. */
1321
1322
216
    for (i = 0; i < num; i++) {
1323
192
        EC_POINT *p = points[i];
1324
1325
192
        if (!BN_is_zero(p->Z)) {
1326
            /* turn  (X, Y, 1/Z)  into  (X/Z^2, Y/Z^3, 1) */
1327
1328
192
            if (!group->meth->field_sqr(group, tmp, p->Z, ctx))
1329
0
                goto err;
1330
192
            if (!group->meth->field_mul(group, p->X, p->X, tmp, ctx))
1331
0
                goto err;
1332
1333
192
            if (!group->meth->field_mul(group, tmp, tmp, p->Z, ctx))
1334
0
                goto err;
1335
192
            if (!group->meth->field_mul(group, p->Y, p->Y, tmp, ctx))
1336
0
                goto err;
1337
1338
192
            if (group->meth->field_set_to_one != 0) {
1339
192
                if (!group->meth->field_set_to_one(group, p->Z, ctx))
1340
0
                    goto err;
1341
192
            } else {
1342
0
                if (!BN_one(p->Z))
1343
0
                    goto err;
1344
0
            }
1345
192
            p->Z_is_one = 1;
1346
192
        }
1347
192
    }
1348
1349
24
    ret = 1;
1350
1351
24
 err:
1352
24
    BN_CTX_end(ctx);
1353
24
    BN_CTX_free(new_ctx);
1354
24
    if (prod_Z != NULL) {
1355
216
        for (i = 0; i < num; i++) {
1356
192
            if (prod_Z[i] == NULL)
1357
0
                break;
1358
192
            BN_clear_free(prod_Z[i]);
1359
192
        }
1360
24
        OPENSSL_free(prod_Z);
1361
24
    }
1362
24
    return ret;
1363
24
}
1364
1365
int ossl_ec_GFp_simple_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
1366
                                 const BIGNUM *b, BN_CTX *ctx)
1367
0
{
1368
0
    return BN_mod_mul(r, a, b, group->field, ctx);
1369
0
}
1370
1371
int ossl_ec_GFp_simple_field_sqr(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
1372
                                 BN_CTX *ctx)
1373
0
{
1374
0
    return BN_mod_sqr(r, a, group->field, ctx);
1375
0
}
1376
1377
/*-
1378
 * Computes the multiplicative inverse of a in GF(p), storing the result in r.
1379
 * If a is zero (or equivalent), you'll get a EC_R_CANNOT_INVERT error.
1380
 * Since we don't have a Mont structure here, SCA hardening is with blinding.
1381
 * NB: "a" must be in _decoded_ form. (i.e. field_decode must precede.)
1382
 */
1383
int ossl_ec_GFp_simple_field_inv(const EC_GROUP *group, BIGNUM *r,
1384
                                 const BIGNUM *a, BN_CTX *ctx)
1385
0
{
1386
0
    BIGNUM *e = NULL;
1387
0
    BN_CTX *new_ctx = NULL;
1388
0
    int ret = 0;
1389
1390
0
    if (ctx == NULL
1391
0
            && (ctx = new_ctx = BN_CTX_secure_new_ex(group->libctx)) == NULL)
1392
0
        return 0;
1393
1394
0
    BN_CTX_start(ctx);
1395
0
    if ((e = BN_CTX_get(ctx)) == NULL)
1396
0
        goto err;
1397
1398
0
    do {
1399
0
        if (!BN_priv_rand_range_ex(e, group->field, 0, ctx))
1400
0
        goto err;
1401
0
    } while (BN_is_zero(e));
1402
1403
    /* r := a * e */
1404
0
    if (!group->meth->field_mul(group, r, a, e, ctx))
1405
0
        goto err;
1406
    /* r := 1/(a * e) */
1407
0
    if (!BN_mod_inverse(r, r, group->field, ctx)) {
1408
0
        ERR_raise(ERR_LIB_EC, EC_R_CANNOT_INVERT);
1409
0
        goto err;
1410
0
    }
1411
    /* r := e/(a * e) = 1/a */
1412
0
    if (!group->meth->field_mul(group, r, r, e, ctx))
1413
0
        goto err;
1414
1415
0
    ret = 1;
1416
1417
0
 err:
1418
0
    BN_CTX_end(ctx);
1419
0
    BN_CTX_free(new_ctx);
1420
0
    return ret;
1421
0
}
1422
1423
/*-
1424
 * Apply randomization of EC point projective coordinates:
1425
 *
1426
 *   (X, Y ,Z ) = (lambda^2*X, lambda^3*Y, lambda*Z)
1427
 *   lambda = [1,group->field)
1428
 *
1429
 */
1430
int ossl_ec_GFp_simple_blind_coordinates(const EC_GROUP *group, EC_POINT *p,
1431
                                         BN_CTX *ctx)
1432
24
{
1433
24
    int ret = 0;
1434
24
    BIGNUM *lambda = NULL;
1435
24
    BIGNUM *temp = NULL;
1436
1437
24
    BN_CTX_start(ctx);
1438
24
    lambda = BN_CTX_get(ctx);
1439
24
    temp = BN_CTX_get(ctx);
1440
24
    if (temp == NULL) {
1441
0
        ERR_raise(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
1442
0
        goto end;
1443
0
    }
1444
1445
    /*-
1446
     * Make sure lambda is not zero.
1447
     * If the RNG fails, we cannot blind but nevertheless want
1448
     * code to continue smoothly and not clobber the error stack.
1449
     */
1450
24
    do {
1451
24
        ERR_set_mark();
1452
24
        ret = BN_priv_rand_range_ex(lambda, group->field, 0, ctx);
1453
24
        ERR_pop_to_mark();
1454
24
        if (ret == 0) {
1455
0
            ret = 1;
1456
0
            goto end;
1457
0
        }
1458
24
    } while (BN_is_zero(lambda));
1459
1460
    /* if field_encode defined convert between representations */
1461
24
    if ((group->meth->field_encode != NULL
1462
24
         && !group->meth->field_encode(group, lambda, lambda, ctx))
1463
24
        || !group->meth->field_mul(group, p->Z, p->Z, lambda, ctx)
1464
24
        || !group->meth->field_sqr(group, temp, lambda, ctx)
1465
24
        || !group->meth->field_mul(group, p->X, p->X, temp, ctx)
1466
24
        || !group->meth->field_mul(group, temp, temp, lambda, ctx)
1467
24
        || !group->meth->field_mul(group, p->Y, p->Y, temp, ctx))
1468
0
        goto end;
1469
1470
24
    p->Z_is_one = 0;
1471
24
    ret = 1;
1472
1473
24
 end:
1474
24
    BN_CTX_end(ctx);
1475
24
    return ret;
1476
24
}
1477
1478
/*-
1479
 * Input:
1480
 * - p: affine coordinates
1481
 *
1482
 * Output:
1483
 * - s := p, r := 2p: blinded projective (homogeneous) coordinates
1484
 *
1485
 * For doubling we use Formula 3 from Izu-Takagi "A fast parallel elliptic curve
1486
 * multiplication resistant against side channel attacks" appendix, described at
1487
 * https://hyperelliptic.org/EFD/g1p/auto-shortw-xz.html#doubling-dbl-2002-it-2
1488
 * simplified for Z1=1.
1489
 *
1490
 * Blinding uses the equivalence relation (\lambda X, \lambda Y, \lambda Z)
1491
 * for any non-zero \lambda that holds for projective (homogeneous) coords.
1492
 */
1493
int ossl_ec_GFp_simple_ladder_pre(const EC_GROUP *group,
1494
                                  EC_POINT *r, EC_POINT *s,
1495
                                  EC_POINT *p, BN_CTX *ctx)
1496
123
{
1497
123
    BIGNUM *t1, *t2, *t3, *t4, *t5 = NULL;
1498
1499
123
    t1 = s->Z;
1500
123
    t2 = r->Z;
1501
123
    t3 = s->X;
1502
123
    t4 = r->X;
1503
123
    t5 = s->Y;
1504
1505
123
    if (!p->Z_is_one /* r := 2p */
1506
123
        || !group->meth->field_sqr(group, t3, p->X, ctx)
1507
123
        || !BN_mod_sub_quick(t4, t3, group->a, group->field)
1508
123
        || !group->meth->field_sqr(group, t4, t4, ctx)
1509
123
        || !group->meth->field_mul(group, t5, p->X, group->b, ctx)
1510
123
        || !BN_mod_lshift_quick(t5, t5, 3, group->field)
1511
        /* r->X coord output */
1512
123
        || !BN_mod_sub_quick(r->X, t4, t5, group->field)
1513
123
        || !BN_mod_add_quick(t1, t3, group->a, group->field)
1514
123
        || !group->meth->field_mul(group, t2, p->X, t1, ctx)
1515
123
        || !BN_mod_add_quick(t2, group->b, t2, group->field)
1516
        /* r->Z coord output */
1517
123
        || !BN_mod_lshift_quick(r->Z, t2, 2, group->field))
1518
0
        return 0;
1519
1520
    /* make sure lambda (r->Y here for storage) is not zero */
1521
123
    do {
1522
123
        if (!BN_priv_rand_range_ex(r->Y, group->field, 0, ctx))
1523
0
            return 0;
1524
123
    } while (BN_is_zero(r->Y));
1525
1526
    /* make sure lambda (s->Z here for storage) is not zero */
1527
123
    do {
1528
123
        if (!BN_priv_rand_range_ex(s->Z, group->field, 0, ctx))
1529
0
            return 0;
1530
123
    } while (BN_is_zero(s->Z));
1531
1532
    /* if field_encode defined convert between representations */
1533
123
    if (group->meth->field_encode != NULL
1534
123
        && (!group->meth->field_encode(group, r->Y, r->Y, ctx)
1535
123
            || !group->meth->field_encode(group, s->Z, s->Z, ctx)))
1536
0
        return 0;
1537
1538
    /* blind r and s independently */
1539
123
    if (!group->meth->field_mul(group, r->Z, r->Z, r->Y, ctx)
1540
123
        || !group->meth->field_mul(group, r->X, r->X, r->Y, ctx)
1541
123
        || !group->meth->field_mul(group, s->X, p->X, s->Z, ctx)) /* s := p */
1542
0
        return 0;
1543
1544
123
    r->Z_is_one = 0;
1545
123
    s->Z_is_one = 0;
1546
1547
123
    return 1;
1548
123
}
1549
1550
/*-
1551
 * Input:
1552
 * - s, r: projective (homogeneous) coordinates
1553
 * - p: affine coordinates
1554
 *
1555
 * Output:
1556
 * - s := r + s, r := 2r: projective (homogeneous) coordinates
1557
 *
1558
 * Differential addition-and-doubling using Eq. (9) and (10) from Izu-Takagi
1559
 * "A fast parallel elliptic curve multiplication resistant against side channel
1560
 * attacks", as described at
1561
 * https://hyperelliptic.org/EFD/g1p/auto-shortw-xz.html#ladder-mladd-2002-it-4
1562
 */
1563
int ossl_ec_GFp_simple_ladder_step(const EC_GROUP *group,
1564
                                   EC_POINT *r, EC_POINT *s,
1565
                                   EC_POINT *p, BN_CTX *ctx)
1566
47.2k
{
1567
47.2k
    int ret = 0;
1568
47.2k
    BIGNUM *t0, *t1, *t2, *t3, *t4, *t5, *t6 = NULL;
1569
1570
47.2k
    BN_CTX_start(ctx);
1571
47.2k
    t0 = BN_CTX_get(ctx);
1572
47.2k
    t1 = BN_CTX_get(ctx);
1573
47.2k
    t2 = BN_CTX_get(ctx);
1574
47.2k
    t3 = BN_CTX_get(ctx);
1575
47.2k
    t4 = BN_CTX_get(ctx);
1576
47.2k
    t5 = BN_CTX_get(ctx);
1577
47.2k
    t6 = BN_CTX_get(ctx);
1578
1579
47.2k
    if (t6 == NULL
1580
47.2k
        || !group->meth->field_mul(group, t6, r->X, s->X, ctx)
1581
47.2k
        || !group->meth->field_mul(group, t0, r->Z, s->Z, ctx)
1582
47.2k
        || !group->meth->field_mul(group, t4, r->X, s->Z, ctx)
1583
47.2k
        || !group->meth->field_mul(group, t3, r->Z, s->X, ctx)
1584
47.2k
        || !group->meth->field_mul(group, t5, group->a, t0, ctx)
1585
47.2k
        || !BN_mod_add_quick(t5, t6, t5, group->field)
1586
47.2k
        || !BN_mod_add_quick(t6, t3, t4, group->field)
1587
47.2k
        || !group->meth->field_mul(group, t5, t6, t5, ctx)
1588
47.2k
        || !group->meth->field_sqr(group, t0, t0, ctx)
1589
47.2k
        || !BN_mod_lshift_quick(t2, group->b, 2, group->field)
1590
47.2k
        || !group->meth->field_mul(group, t0, t2, t0, ctx)
1591
47.2k
        || !BN_mod_lshift1_quick(t5, t5, group->field)
1592
47.2k
        || !BN_mod_sub_quick(t3, t4, t3, group->field)
1593
        /* s->Z coord output */
1594
47.2k
        || !group->meth->field_sqr(group, s->Z, t3, ctx)
1595
47.2k
        || !group->meth->field_mul(group, t4, s->Z, p->X, ctx)
1596
47.2k
        || !BN_mod_add_quick(t0, t0, t5, group->field)
1597
        /* s->X coord output */
1598
47.2k
        || !BN_mod_sub_quick(s->X, t0, t4, group->field)
1599
47.2k
        || !group->meth->field_sqr(group, t4, r->X, ctx)
1600
47.2k
        || !group->meth->field_sqr(group, t5, r->Z, ctx)
1601
47.2k
        || !group->meth->field_mul(group, t6, t5, group->a, ctx)
1602
47.2k
        || !BN_mod_add_quick(t1, r->X, r->Z, group->field)
1603
47.2k
        || !group->meth->field_sqr(group, t1, t1, ctx)
1604
47.2k
        || !BN_mod_sub_quick(t1, t1, t4, group->field)
1605
47.2k
        || !BN_mod_sub_quick(t1, t1, t5, group->field)
1606
47.2k
        || !BN_mod_sub_quick(t3, t4, t6, group->field)
1607
47.2k
        || !group->meth->field_sqr(group, t3, t3, ctx)
1608
47.2k
        || !group->meth->field_mul(group, t0, t5, t1, ctx)
1609
47.2k
        || !group->meth->field_mul(group, t0, t2, t0, ctx)
1610
        /* r->X coord output */
1611
47.2k
        || !BN_mod_sub_quick(r->X, t3, t0, group->field)
1612
47.2k
        || !BN_mod_add_quick(t3, t4, t6, group->field)
1613
47.2k
        || !group->meth->field_sqr(group, t4, t5, ctx)
1614
47.2k
        || !group->meth->field_mul(group, t4, t4, t2, ctx)
1615
47.2k
        || !group->meth->field_mul(group, t1, t1, t3, ctx)
1616
47.2k
        || !BN_mod_lshift1_quick(t1, t1, group->field)
1617
        /* r->Z coord output */
1618
47.2k
        || !BN_mod_add_quick(r->Z, t4, t1, group->field))
1619
0
        goto err;
1620
1621
47.2k
    ret = 1;
1622
1623
47.2k
 err:
1624
47.2k
    BN_CTX_end(ctx);
1625
47.2k
    return ret;
1626
47.2k
}
1627
1628
/*-
1629
 * Input:
1630
 * - s, r: projective (homogeneous) coordinates
1631
 * - p: affine coordinates
1632
 *
1633
 * Output:
1634
 * - r := (x,y): affine coordinates
1635
 *
1636
 * Recovers the y-coordinate of r using Eq. (8) from Brier-Joye, "Weierstrass
1637
 * Elliptic Curves and Side-Channel Attacks", modified to work in mixed
1638
 * projective coords, i.e. p is affine and (r,s) in projective (homogeneous)
1639
 * coords, and return r in affine coordinates.
1640
 *
1641
 * X4 = two*Y1*X2*Z3*Z2;
1642
 * Y4 = two*b*Z3*SQR(Z2) + Z3*(a*Z2+X1*X2)*(X1*Z2+X2) - X3*SQR(X1*Z2-X2);
1643
 * Z4 = two*Y1*Z3*SQR(Z2);
1644
 *
1645
 * Z4 != 0 because:
1646
 *  - Z2==0 implies r is at infinity (handled by the BN_is_zero(r->Z) branch);
1647
 *  - Z3==0 implies s is at infinity (handled by the BN_is_zero(s->Z) branch);
1648
 *  - Y1==0 implies p has order 2, so either r or s are infinity and handled by
1649
 *    one of the BN_is_zero(...) branches.
1650
 */
1651
int ossl_ec_GFp_simple_ladder_post(const EC_GROUP *group,
1652
                                   EC_POINT *r, EC_POINT *s,
1653
                                   EC_POINT *p, BN_CTX *ctx)
1654
123
{
1655
123
    int ret = 0;
1656
123
    BIGNUM *t0, *t1, *t2, *t3, *t4, *t5, *t6 = NULL;
1657
1658
123
    if (BN_is_zero(r->Z))
1659
0
        return EC_POINT_set_to_infinity(group, r);
1660
1661
123
    if (BN_is_zero(s->Z)) {
1662
0
        if (!EC_POINT_copy(r, p)
1663
0
            || !EC_POINT_invert(group, r, ctx))
1664
0
            return 0;
1665
0
        return 1;
1666
0
    }
1667
1668
123
    BN_CTX_start(ctx);
1669
123
    t0 = BN_CTX_get(ctx);
1670
123
    t1 = BN_CTX_get(ctx);
1671
123
    t2 = BN_CTX_get(ctx);
1672
123
    t3 = BN_CTX_get(ctx);
1673
123
    t4 = BN_CTX_get(ctx);
1674
123
    t5 = BN_CTX_get(ctx);
1675
123
    t6 = BN_CTX_get(ctx);
1676
1677
123
    if (t6 == NULL
1678
123
        || !BN_mod_lshift1_quick(t4, p->Y, group->field)
1679
123
        || !group->meth->field_mul(group, t6, r->X, t4, ctx)
1680
123
        || !group->meth->field_mul(group, t6, s->Z, t6, ctx)
1681
123
        || !group->meth->field_mul(group, t5, r->Z, t6, ctx)
1682
123
        || !BN_mod_lshift1_quick(t1, group->b, group->field)
1683
123
        || !group->meth->field_mul(group, t1, s->Z, t1, ctx)
1684
123
        || !group->meth->field_sqr(group, t3, r->Z, ctx)
1685
123
        || !group->meth->field_mul(group, t2, t3, t1, ctx)
1686
123
        || !group->meth->field_mul(group, t6, r->Z, group->a, ctx)
1687
123
        || !group->meth->field_mul(group, t1, p->X, r->X, ctx)
1688
123
        || !BN_mod_add_quick(t1, t1, t6, group->field)
1689
123
        || !group->meth->field_mul(group, t1, s->Z, t1, ctx)
1690
123
        || !group->meth->field_mul(group, t0, p->X, r->Z, ctx)
1691
123
        || !BN_mod_add_quick(t6, r->X, t0, group->field)
1692
123
        || !group->meth->field_mul(group, t6, t6, t1, ctx)
1693
123
        || !BN_mod_add_quick(t6, t6, t2, group->field)
1694
123
        || !BN_mod_sub_quick(t0, t0, r->X, group->field)
1695
123
        || !group->meth->field_sqr(group, t0, t0, ctx)
1696
123
        || !group->meth->field_mul(group, t0, t0, s->X, ctx)
1697
123
        || !BN_mod_sub_quick(t0, t6, t0, group->field)
1698
123
        || !group->meth->field_mul(group, t1, s->Z, t4, ctx)
1699
123
        || !group->meth->field_mul(group, t1, t3, t1, ctx)
1700
123
        || (group->meth->field_decode != NULL
1701
123
            && !group->meth->field_decode(group, t1, t1, ctx))
1702
123
        || !group->meth->field_inv(group, t1, t1, ctx)
1703
123
        || (group->meth->field_encode != NULL
1704
123
            && !group->meth->field_encode(group, t1, t1, ctx))
1705
123
        || !group->meth->field_mul(group, r->X, t5, t1, ctx)
1706
123
        || !group->meth->field_mul(group, r->Y, t0, t1, ctx))
1707
0
        goto err;
1708
1709
123
    if (group->meth->field_set_to_one != NULL) {
1710
123
        if (!group->meth->field_set_to_one(group, r->Z, ctx))
1711
0
            goto err;
1712
123
    } else {
1713
0
        if (!BN_one(r->Z))
1714
0
            goto err;
1715
0
    }
1716
1717
123
    r->Z_is_one = 1;
1718
123
    ret = 1;
1719
1720
123
 err:
1721
123
    BN_CTX_end(ctx);
1722
123
    return ret;
1723
123
}