/*

 * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.

 *

 * Licensed under the Apache License 2.0 (the "License").  You may not use

 * this file except in compliance with the License.  You can obtain a copy

 * in the file LICENSE in the source distribution or at

 * https://www.openssl.org/source/license.html

 */

/*

 * ECDH/ECDSA low level APIs are deprecated for public use, but still ok for

 * internal use.

 */

#include "internal/deprecated.h"

#include <string.h>

#include <openssl/core_dispatch.h>

#include <openssl/core_names.h>

#include <openssl/bn.h>

#include <openssl/err.h>

#include <openssl/objects.h>

#include <openssl/proverr.h>

#include <openssl/self_test.h>

#include "crypto/bn.h"

#include "crypto/ec.h"

#include "crypto/ec_params.h"

#include "prov/implementations.h"

#include "prov/providercommon.h"

#include "prov/provider_ctx.h"

#include "prov/securitycheck.h"

#include "internal/fips.h"

#include "internal/param_build_set.h"

#ifndef FIPS_MODULE

#ifndef OPENSSL_NO_SM2

#include "crypto/sm2.h"

#endif

#endif

static OSSL_FUNC_keymgmt_new_fn ec_newdata;

static OSSL_FUNC_keymgmt_new_ex_fn ec_newdata_ex;

static OSSL_FUNC_keymgmt_gen_init_fn ec_gen_init;

static OSSL_FUNC_keymgmt_gen_set_template_fn ec_gen_set_template;

static OSSL_FUNC_keymgmt_gen_set_params_fn ec_gen_set_params;

static OSSL_FUNC_keymgmt_gen_settable_params_fn ec_gen_settable_params;

static OSSL_FUNC_keymgmt_gen_get_params_fn ec_gen_get_params;

static OSSL_FUNC_keymgmt_gen_gettable_params_fn ec_gen_gettable_params;

static OSSL_FUNC_keymgmt_gen_fn ec_gen;

static OSSL_FUNC_keymgmt_gen_cleanup_fn ec_gen_cleanup;

static OSSL_FUNC_keymgmt_load_fn ec_load;

static OSSL_FUNC_keymgmt_free_fn ec_freedata;

static OSSL_FUNC_keymgmt_get_params_fn ec_get_params;

static OSSL_FUNC_keymgmt_gettable_params_fn ec_gettable_params;

static OSSL_FUNC_keymgmt_set_params_fn ec_set_params;

static OSSL_FUNC_keymgmt_settable_params_fn ec_settable_params;

static OSSL_FUNC_keymgmt_has_fn ec_has;

static OSSL_FUNC_keymgmt_match_fn ec_match;

static OSSL_FUNC_keymgmt_validate_fn ec_validate;

static OSSL_FUNC_keymgmt_import_fn ec_import;

static OSSL_FUNC_keymgmt_import_types_fn ec_import_types;

static OSSL_FUNC_keymgmt_export_fn ec_export;

static OSSL_FUNC_keymgmt_export_types_fn ec_export_types;

static OSSL_FUNC_keymgmt_query_operation_name_fn ec_query_operation_name;

static OSSL_FUNC_keymgmt_dup_fn ec_dup;

#ifndef FIPS_MODULE

#ifndef OPENSSL_NO_SM2

static OSSL_FUNC_keymgmt_new_fn sm2_newdata;

static OSSL_FUNC_keymgmt_gen_init_fn sm2_gen_init;

static OSSL_FUNC_keymgmt_gen_set_params_fn sm2_gen_set_params;

static OSSL_FUNC_keymgmt_gen_settable_params_fn sm2_gen_settable_params;

static OSSL_FUNC_keymgmt_gen_fn sm2_gen;

static OSSL_FUNC_keymgmt_get_params_fn sm2_get_params;

static OSSL_FUNC_keymgmt_gettable_params_fn sm2_gettable_params;

static OSSL_FUNC_keymgmt_settable_params_fn sm2_settable_params;

static OSSL_FUNC_keymgmt_set_params_fn sm2_set_params;

static OSSL_FUNC_keymgmt_import_fn sm2_import;

static OSSL_FUNC_keymgmt_import_types_fn sm2_import_types;

static OSSL_FUNC_keymgmt_export_types_fn sm2_export_types;

static OSSL_FUNC_keymgmt_query_operation_name_fn sm2_query_operation_name;

static OSSL_FUNC_keymgmt_query_operation_name_fn curve_sm2_query_operation_name;

static OSSL_FUNC_keymgmt_validate_fn sm2_validate;

#endif

#endif

#define EC_DEFAULT_MD "SHA256"

#define EC_POSSIBLE_SELECTIONS \

    (OSSL_KEYMGMT_SELECT_KEYPAIR | OSSL_KEYMGMT_SELECT_ALL_PARAMETERS)

#define SM2_DEFAULT_MD "SM3"

static const char *ec_query_operation_name(int operation_id)

{

    switch (operation_id) {

    case OSSL_OP_KEYEXCH:

        return "ECDH";

    case OSSL_OP_SIGNATURE:

        return "ECDSA";

    }

    return NULL;

}

#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_SM2)

static const char *sm2_query_operation_name(int operation_id)

{

    switch (operation_id) {

    case OSSL_OP_SIGNATURE:

        return "SM2";

    }

    return NULL;

}

static const char *curve_sm2_query_operation_name(int operation_id)

{

    switch (operation_id) {

    case OSSL_OP_KEYEXCH:

        return "ECDH";

    }

    return NULL;

}

#endif

/*

 * Callers of key_to_params MUST make sure that domparams_to_params is also

 * called!

 *

 * This function only exports the bare keypair, domain parameters and other

 * parameters are exported separately.

 */

static ossl_inline int key_to_params(const EC_KEY *eckey, OSSL_PARAM_BLD *tmpl,

    const EC_PARAMS *params, int include_private,

    unsigned char **pub_key)

{

    BIGNUM *x = NULL, *y = NULL;

    const BIGNUM *priv_key = NULL;

    const EC_POINT *pub_point = NULL;

    const EC_GROUP *ecg = NULL;

    size_t pub_key_len = 0;

    int ret = 0;

    BN_CTX *bnctx = NULL;

    if (eckey == NULL

        || (ecg = EC_KEY_get0_group(eckey)) == NULL)

        return 0;

    priv_key = EC_KEY_get0_private_key(eckey);

    pub_point = EC_KEY_get0_public_key(eckey);

    if (pub_point != NULL) {

        OSSL_PARAM *p = NULL, *px = NULL, *py = NULL;

        /*

         * EC_POINT_point2buf() can generate random numbers in some

         * implementations so we need to ensure we use the correct libctx.

         */

        bnctx = BN_CTX_new_ex(ossl_ec_key_get_libctx(eckey));

        if (bnctx == NULL)

            goto err;

        /* If we are doing a get then check first before decoding the point */

        if (tmpl == NULL && params != NULL) {

            p = params->pub;

            px = params->pub_x;

            py = params->pub_y;

        }

        if (p != NULL || tmpl != NULL) {

            /* convert pub_point to a octet string according to the SECG standard */

            point_conversion_form_t format = EC_KEY_get_conv_form(eckey);

            if ((pub_key_len = EC_POINT_point2buf(ecg, pub_point,

                     format,

                     pub_key, bnctx))

                    == 0

                || !ossl_param_build_set_octet_string(tmpl, p,

                    OSSL_PKEY_PARAM_PUB_KEY,

                    *pub_key, pub_key_len))

                goto err;

        }

        if (px != NULL || py != NULL) {

            if (px != NULL) {

                x = BN_CTX_get(bnctx);

                if (x == NULL)

                    goto err;

            }

            if (py != NULL) {

                y = BN_CTX_get(bnctx);

                if (y == NULL)

                    goto err;

            }

            if (!EC_POINT_get_affine_coordinates(ecg, pub_point, x, y, bnctx))

                goto err;

            if (px != NULL

                && !ossl_param_build_set_bn(tmpl, px,

                    OSSL_PKEY_PARAM_EC_PUB_X, x))

                goto err;

            if (py != NULL

                && !ossl_param_build_set_bn(tmpl, py,

                    OSSL_PKEY_PARAM_EC_PUB_Y, y))

                goto err;

        }

    }

    if (priv_key != NULL && include_private) {

        size_t sz;

        int ecbits;

        /*

         * Key import/export should never leak the bit length of the secret

         * scalar in the key.

         *

         * For this reason, on export we use padded BIGNUMs with fixed length.

         *

         * When importing we also should make sure that, even if short lived,

         * the newly created BIGNUM is marked with the BN_FLG_CONSTTIME flag as

         * soon as possible, so that any processing of this BIGNUM might opt for

         * constant time implementations in the backend.

         *

         * Setting the BN_FLG_CONSTTIME flag alone is never enough, we also have

         * to preallocate the BIGNUM internal buffer to a fixed public size big

         * enough that operations performed during the processing never trigger

         * a realloc which would leak the size of the scalar through memory

         * accesses.

         *

         * Fixed Length

         * ------------

         *

         * The order of the large prime subgroup of the curve is our choice for

         * a fixed public size, as that is generally the upper bound for

         * generating a private key in EC cryptosystems and should fit all valid

         * secret scalars.

         *

         * For padding on export we just use the bit length of the order

         * converted to bytes (rounding up).

         *

         * For preallocating the BIGNUM storage we look at the number of "words"

         * required for the internal representation of the order, and we

         * preallocate 2 extra "words" in case any of the subsequent processing

         * might temporarily overflow the order length.

         */

        ecbits = EC_GROUP_order_bits(ecg);

        if (ecbits <= 0)

            goto err;

        sz = (ecbits + 7) / 8;

        if (!ossl_param_build_set_bn_pad(tmpl,

                params == NULL ? NULL : params->priv,

                OSSL_PKEY_PARAM_PRIV_KEY,

                priv_key, sz))

            goto err;

    }

    ret = 1;

err:

    BN_CTX_free(bnctx);

    return ret;

}

static ossl_inline int otherparams_to_params(const EC_KEY *ec, OSSL_PARAM_BLD *tmpl,

    const EC_PARAMS *params)

{

    int ecdh_cofactor_mode = 0, group_check = 0;

    const char *name = NULL;

    if (ec == NULL)

        return 0;

    group_check = EC_KEY_get_flags(ec) & EC_FLAG_CHECK_NAMED_GROUP_MASK;

    name = ossl_ec_check_group_type_id2name(group_check);

    if (name != NULL

        && !ossl_param_build_set_utf8_string(tmpl,

            params == NULL ? NULL : params->group_check,

            OSSL_PKEY_PARAM_EC_GROUP_CHECK_TYPE,

            name))

        return 0;

    if ((EC_KEY_get_enc_flags(ec) & EC_PKEY_NO_PUBKEY) != 0

        && !ossl_param_build_set_int(tmpl,

            params == NULL ? NULL : params->include_public,

            OSSL_PKEY_PARAM_EC_INCLUDE_PUBLIC, 0))

        return 0;

    ecdh_cofactor_mode = (EC_KEY_get_flags(ec) & EC_FLAG_COFACTOR_ECDH) ? 1 : 0;

    return ossl_param_build_set_int(tmpl,

        params == NULL ? NULL : params->use_cofactor,

        OSSL_PKEY_PARAM_USE_COFACTOR_ECDH,

        ecdh_cofactor_mode);

}

static void *ec_newdata_ex(void *provctx, const OSSL_PARAM params[])

{

    EC_KEY *eckey = NULL;

    OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(provctx);

    if (!ossl_prov_is_running())

        return NULL;

#ifndef FIPS_MODULE

    const OSSL_PARAM *p = NULL;

    if (params != NULL)

        p = OSSL_PARAM_locate_const(params, "legacy-object");

    /*

     * This only works because we are in the default provider. We are not

     * normally allowed to pass complex objects across the provider boundary

     * like this.

     */

    if (p != NULL && OSSL_PARAM_get_octet_ptr(p, (const void **)&eckey, NULL) && eckey != NULL) {

#ifdef OPENSSL_NO_EC_EXPLICIT_CURVES

        if (EC_GROUP_check_named_curve(EC_KEY_get0_group(eckey), 0, NULL) == NID_undef)

            return NULL;

#endif

        if (ossl_lib_ctx_get_concrete(ossl_ec_key_get_libctx(eckey)) != ossl_lib_ctx_get_concrete(libctx))

            eckey = NULL;

        else if (!EC_KEY_up_ref(eckey))

            return NULL;

    }

#endif

    if (eckey == NULL)

        eckey = EC_KEY_new_ex(libctx, NULL);

    return eckey;

}

static void *ec_newdata(void *provctx)

{

    return ec_newdata_ex(provctx, NULL);

}

#ifndef FIPS_MODULE

#ifndef OPENSSL_NO_SM2

static void *sm2_newdata(void *provctx)

{

    if (!ossl_prov_is_running())

        return NULL;

    return EC_KEY_new_by_curve_name_ex(PROV_LIBCTX_OF(provctx), NULL, NID_sm2);

}

#endif

#endif

static void ec_freedata(void *keydata)

{

    EC_KEY_free(keydata);

}

static int ec_has(const void *keydata, int selection)

{

    const EC_KEY *ec = keydata;

    int ok = 1;

    if (!ossl_prov_is_running() || ec == NULL)

        return 0;

    if ((selection & EC_POSSIBLE_SELECTIONS) == 0)

        return 1; /* the selection is not missing */

    if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0)

        ok = ok && (EC_KEY_get0_public_key(ec) != NULL);

    if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)

        ok = ok && (EC_KEY_get0_private_key(ec) != NULL);

    if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0)

        ok = ok && (EC_KEY_get0_group(ec) != NULL);

    /*

     * We consider OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS to always be

     * available, so no extra check is needed other than the previous one

     * against EC_POSSIBLE_SELECTIONS.

     */

    return ok;

}

static int ec_match(const void *keydata1, const void *keydata2, int selection)

{

    const EC_KEY *ec1 = keydata1;

    const EC_KEY *ec2 = keydata2;

    const EC_GROUP *group_a = EC_KEY_get0_group(ec1);

    const EC_GROUP *group_b = EC_KEY_get0_group(ec2);

    BN_CTX *ctx = NULL;

    int ok = 1;

    if (!ossl_prov_is_running())

        return 0;

    ctx = BN_CTX_new_ex(ossl_ec_key_get_libctx(ec1));

    if (ctx == NULL)

        return 0;

    if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0)

        ok = ok && group_a != NULL && group_b != NULL

            && EC_GROUP_cmp(group_a, group_b, ctx) == 0;

    if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0) {

        int key_checked = 0;

        if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) {

            const EC_POINT *pa = EC_KEY_get0_public_key(ec1);

            const EC_POINT *pb = EC_KEY_get0_public_key(ec2);

            if (pa != NULL && pb != NULL) {

                ok = ok && EC_POINT_cmp(group_b, pa, pb, ctx) == 0;

                key_checked = 1;

            }

        }

        if (!key_checked

            && (selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0) {

            const BIGNUM *pa = EC_KEY_get0_private_key(ec1);

            const BIGNUM *pb = EC_KEY_get0_private_key(ec2);

            if (pa != NULL && pb != NULL) {

                ok = ok && BN_cmp(pa, pb) == 0;

                key_checked = 1;

            }

        }

        ok = ok && key_checked;

    }

    BN_CTX_free(ctx);

    return ok;

}

static int common_check_sm2(const EC_KEY *ec, int sm2_wanted)

{

    const EC_GROUP *ecg = NULL;

    /*

     * sm2_wanted: import the keys or domparams only on SM2 Curve

     * !sm2_wanted: import the keys or domparams only not on SM2 Curve

     */

    if ((ecg = EC_KEY_get0_group(ec)) == NULL

        || (sm2_wanted ^ (EC_GROUP_get_curve_name(ecg) == NID_sm2)))

        return 0;

    return 1;

}

typedef int (*ec_import_decoder_fn)(const OSSL_PARAM *, EC_PARAMS *);

static const ec_import_decoder_fn ec_import_decoders[] = {

    NULL,

    ec_imexport_types_1_decoder,

    ec_imexport_types_2_decoder,

    ec_imexport_types_3_decoder,

    ec_imexport_types_4_decoder,

    ec_imexport_types_5_decoder,

    ec_imexport_types_6_decoder,

    ec_imexport_types_7_decoder,

    ec_imexport_types_8_decoder,

    ec_imexport_types_9_decoder,

    ec_imexport_types_10_decoder,

    ec_imexport_types_11_decoder,

    ec_imexport_types_12_decoder,

    ec_imexport_types_13_decoder,

    ec_imexport_types_14_decoder,

    ec_imexport_types_15_decoder,

};

static int ec_imexport_type_select(int selection)

{

    int type_select = 0;

    if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)

        type_select += 1;

    if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0)

        type_select += 2;

    if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0)

        type_select += 4;

    if ((selection & OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS) != 0)

        type_select += 8;

    return type_select;

}

static int common_import(void *keydata, int selection, const OSSL_PARAM params[],

    const ec_import_decoder_fn decoders[], int sm2_wanted)

{

    EC_KEY *ec = keydata;

    EC_PARAMS p;

    int ok = 1;

    if (!ossl_prov_is_running() || ec == NULL)

        return 0;

    /*

     * In this implementation, we can export/import only keydata in the

     * following combinations:

     *   - domain parameters (+optional other params)

     *   - public key with associated domain parameters (+optional other params)

     *   - private key with associated domain parameters and optional public key

     *         (+optional other params)

     *

     * This means:

     *   - domain parameters must always be requested

     *   - private key must be requested alongside public key

     *   - other parameters are always optional

     */

    if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) == 0)

        return 0;

    if (!decoders[ec_imexport_type_select(selection)](params, &p))

        return 0;

    ok = ok && ossl_ec_group_fromdata_parsed(ec, &p);

    if (!common_check_sm2(ec, sm2_wanted))

        return 0;

    if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0) {

        int include_private = selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY ? 1 : 0;

        ok = ok && ossl_ec_key_fromdata_parsed(ec, &p, include_private);

    }

    if ((selection & OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS) != 0)

        ok = ok && ossl_ec_key_otherparams_fromdata_parsed(ec, &p);

    return ok;

}

static int ec_import(void *keydata, int selection, const OSSL_PARAM params[])

{

    return common_import(keydata, selection, params, ec_import_decoders, 0);

}

#ifndef FIPS_MODULE

#ifndef OPENSSL_NO_SM2

static int sm2_import(void *keydata, int selection, const OSSL_PARAM params[])

{

    return common_import(keydata, selection, params, ec_import_decoders, 1);

}

#endif

#endif

static int ec_export(void *keydata, int selection, OSSL_CALLBACK *param_cb,

    void *cbarg)

{

    EC_KEY *ec = keydata;

    OSSL_PARAM_BLD *tmpl = NULL;

    OSSL_PARAM *params = NULL;

    unsigned char *pub_key = NULL, *genbuf = NULL;

    BN_CTX *bnctx = NULL;

    int ok = 1;

    if (!ossl_prov_is_running() || ec == NULL)

        return 0;

    /*

     * In this implementation, we can export/import only keydata in the

     * following combinations:

     *   - domain parameters (+optional other params)

     *   - public key with associated domain parameters (+optional other params)

     *   - private key with associated public key and domain parameters

     *         (+optional other params)

     *

     * This means:

     *   - domain parameters must always be requested

     *   - private key must be requested alongside public key

     *   - other parameters are always optional

     */

    if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) == 0)

        return 0;

    if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0

        && (selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) == 0)

        return 0;

    if ((bnctx = BN_CTX_new_ex(ossl_ec_key_get_libctx(ec))) == NULL)

        return 0;

    BN_CTX_start(bnctx);

    if ((tmpl = OSSL_PARAM_BLD_new()) == NULL) {

        ok = 0;

        goto end;

    }

    /*

     * OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT is added based on the group's

     * asn1_form by the call below.

     */

    ok = ossl_ec_group_todata(EC_KEY_get0_group(ec), tmpl, NULL,

        ossl_ec_key_get_libctx(ec), ossl_ec_key_get0_propq(ec),

        bnctx, &genbuf);

    if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) != 0) {

        int include_private = selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY ? 1 : 0;

        ok = ok && key_to_params(ec, tmpl, NULL, include_private, &pub_key);

    }

    if ((selection & OSSL_KEYMGMT_SELECT_OTHER_PARAMETERS) != 0)

        ok = ok && otherparams_to_params(ec, tmpl, NULL);

    if (!ok || (params = OSSL_PARAM_BLD_to_param(tmpl)) == NULL) {

        ok = 0;

        goto end;

    }

    ok = param_cb(params, cbarg);

    OSSL_PARAM_clear_free(params);

end:

    OSSL_PARAM_BLD_free(tmpl);

    OPENSSL_free(pub_key);

    OPENSSL_free(genbuf);

    BN_CTX_end(bnctx);

    BN_CTX_free(bnctx);

    return ok;

}

/* IMEXPORT = IMPORT + EXPORT */

static const OSSL_PARAM *const ec_types[] = {

    NULL,

    ec_imexport_types_1_list,

    ec_imexport_types_2_list,

    ec_imexport_types_3_list,

    ec_imexport_types_4_list,

    ec_imexport_types_5_list,

    ec_imexport_types_6_list,

    ec_imexport_types_7_list,

    ec_imexport_types_8_list,

    ec_imexport_types_9_list,

    ec_imexport_types_10_list,

    ec_imexport_types_11_list,

    ec_imexport_types_12_list,

    ec_imexport_types_13_list,

    ec_imexport_types_14_list,

    ec_imexport_types_15_list,

};

static const OSSL_PARAM *ec_import_types(int selection)

{

    return ec_types[ec_imexport_type_select(selection)];

}

static const OSSL_PARAM *ec_export_types(int selection)

{

    return ec_types[ec_imexport_type_select(selection)];

}

#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_SM2)

static const OSSL_PARAM *sm2_import_types(int selection)

{

    return ec_types[ec_imexport_type_select(selection)];

}

static const OSSL_PARAM *sm2_export_types(int selection)

{

    return ec_types[ec_imexport_type_select(selection)];

}

#endif

static int ec_get_ecm_params(const EC_GROUP *group, const EC_PARAMS *params)

{

#ifdef OPENSSL_NO_EC2M

    return 1;

#else

    int ret = 0, m;

    unsigned int k1 = 0, k2 = 0, k3 = 0;

    int basis_nid;

    const char *basis_name = NULL;

    int fid = EC_GROUP_get_field_type(group);

    if (fid != NID_X9_62_characteristic_two_field)

        return 1;

    basis_nid = EC_GROUP_get_basis_type(group);

    if (basis_nid == NID_X9_62_tpBasis)

        basis_name = SN_X9_62_tpBasis;

    else if (basis_nid == NID_X9_62_ppBasis)

        basis_name = SN_X9_62_ppBasis;

    else

        goto err;

    m = EC_GROUP_get_degree(group);

    if (!ossl_param_build_set_int(NULL, params->char2_m,

            OSSL_PKEY_PARAM_EC_CHAR2_M, m)

        || !ossl_param_build_set_utf8_string(NULL, params->char2_type,

            OSSL_PKEY_PARAM_EC_CHAR2_TYPE,

            basis_name))

        goto err;

    if (basis_nid == NID_X9_62_tpBasis) {

        if (!EC_GROUP_get_trinomial_basis(group, &k1)

            || !ossl_param_build_set_int(NULL, params->char2_tp,

                OSSL_PKEY_PARAM_EC_CHAR2_TP_BASIS,

                (int)k1))

            goto err;

    } else {

        if (!EC_GROUP_get_pentanomial_basis(group, &k1, &k2, &k3)

            || !ossl_param_build_set_int(NULL, params->char2_k1,

                OSSL_PKEY_PARAM_EC_CHAR2_PP_K1, (int)k1)

            || !ossl_param_build_set_int(NULL, params->char2_k2,

                OSSL_PKEY_PARAM_EC_CHAR2_PP_K2, (int)k2)

            || !ossl_param_build_set_int(NULL, params->char2_k3,

                OSSL_PKEY_PARAM_EC_CHAR2_PP_K3, (int)k3))

            goto err;

    }

    ret = 1;

err:

    return ret;

#endif /* OPENSSL_NO_EC2M */

}

static int common_get_params(void *key, OSSL_PARAM params[], int sm2)

{

    int ret = 0;

    EC_KEY *eck = key;

    EC_PARAMS p;

    const EC_GROUP *ecg = NULL;

    unsigned char *pub_key = NULL, *genbuf = NULL;

    OSSL_LIB_CTX *libctx;

    const char *propq;

    BN_CTX *bnctx = NULL;

    ecg = EC_KEY_get0_group(eck);

    if (ecg == NULL) {

        ERR_raise(ERR_LIB_PROV, PROV_R_NO_PARAMETERS_SET);

        return 0;

    }

    if (!(sm2 ? sm2_get_params_decoder(params, &p)

              : ec_get_params_decoder(params, &p)))

        return 0;

    libctx = ossl_ec_key_get_libctx(eck);

    propq = ossl_ec_key_get0_propq(eck);

    bnctx = BN_CTX_new_ex(libctx);

    if (bnctx == NULL)

        return 0;

    BN_CTX_start(bnctx);

    if (p.maxsize != NULL && !OSSL_PARAM_set_int(p.maxsize, ECDSA_size(eck)))

        goto err;

    if (p.bits != NULL && !OSSL_PARAM_set_int(p.bits, EC_GROUP_order_bits(ecg)))

        goto err;

    if (p.field_degree != NULL

        && !OSSL_PARAM_set_int(p.field_degree, EC_GROUP_get_degree(ecg)))

        goto err;

    if (p.secbits != NULL

        && !OSSL_PARAM_set_int(p.secbits, EC_GROUP_security_bits(ecg)))

        goto err;

    if (p.seccat != NULL)

        if (!OSSL_PARAM_set_int(p.seccat, 0))

            goto err;

    if (p.decoded != NULL) {

        int explicitparams = EC_KEY_decoded_from_explicit_params(eck);

        if (explicitparams < 0 || !OSSL_PARAM_set_int(p.decoded, explicitparams))

            goto err;

    }

    if (!sm2) {

        if (p.default_digest != NULL

            && !OSSL_PARAM_set_utf8_string(p.default_digest, EC_DEFAULT_MD))

            goto err;

    } else {

        if (p.default_digest != NULL

            && !OSSL_PARAM_set_utf8_string(p.default_digest, SM2_DEFAULT_MD))

            goto err;

    }

    /* SM2 doesn't support this PARAM */

    if (!sm2 && p.use_cofactor != NULL) {

        int ecdh_cofactor_mode = 0;

        ecdh_cofactor_mode = (EC_KEY_get_flags(eck) & EC_FLAG_COFACTOR_ECDH) ? 1 : 0;

        if (!OSSL_PARAM_set_int(p.use_cofactor, ecdh_cofactor_mode))

            goto err;

    }

    if (p.encoded_pub != NULL) {

        const EC_POINT *ecp = EC_KEY_get0_public_key(key);

        if (ecp == NULL) {

            ERR_raise(ERR_LIB_PROV, PROV_R_NOT_A_PUBLIC_KEY);

            goto err;

        }

        p.encoded_pub->return_size = EC_POINT_point2oct(ecg, ecp,

            POINT_CONVERSION_UNCOMPRESSED,

            p.encoded_pub->data, p.encoded_pub->data_size, bnctx);

        if (p.encoded_pub->return_size == 0)

            goto err;

    }

    /*

     * OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT is added based on the group's

     * asn1_form by ossl_ec_group_todata() below.

     */

    ret = ec_get_ecm_params(ecg, &p)

        && ossl_ec_group_todata_parsed(ecg, NULL, &p, libctx, propq, bnctx,

            &genbuf)

        && key_to_params(eck, NULL, &p, 1, &pub_key)

        && otherparams_to_params(eck, NULL, &p);

err:

    OPENSSL_free(genbuf);

    OPENSSL_free(pub_key);

    BN_CTX_end(bnctx);

    BN_CTX_free(bnctx);

    return ret;

}

static int ec_get_params(void *key, OSSL_PARAM params[])

{

    return common_get_params(key, params, 0);

}

static const OSSL_PARAM *ec_gettable_params(void *provctx)

{

    return ec_get_params_list;

}

static const OSSL_PARAM *ec_settable_params(void *provctx)

{

    return ec_set_params_list;

}

static int common_set_params(void *key, const EC_PARAMS *params)

{

    EC_KEY *eck = key;

    if (key == NULL)

        return 0;

    if (!ossl_ec_group_set_params_parsed(

            (EC_GROUP *)EC_KEY_get0_group(key), params))

        return 0;

    if (params->encoded_pub != NULL) {

        BN_CTX *ctx = BN_CTX_new_ex(ossl_ec_key_get_libctx(key));

        int ret = 1;

        if (ctx == NULL

            || params->encoded_pub->data_type != OSSL_PARAM_OCTET_STRING

            || !EC_KEY_oct2key(key, params->encoded_pub->data,

                params->encoded_pub->data_size, ctx))

            ret = 0;

        BN_CTX_free(ctx);

        if (!ret)

            return 0;

    }

    return ossl_ec_key_otherparams_fromdata_parsed(eck, params);

}

static int ec_set_params(void *key, const OSSL_PARAM params[])

{

    EC_PARAMS p;

    if (key == NULL)

        return 0;

    if (ossl_param_is_empty(params))

        return 1;

    if (!ec_set_params_decoder(params, &p))

        return 0;

    return common_set_params(key, &p);

}

#ifndef FIPS_MODULE

#ifndef OPENSSL_NO_SM2

static int sm2_get_params(void *key, OSSL_PARAM params[])

{

    return common_get_params(key, params, 1);

}

static const OSSL_PARAM *sm2_gettable_params(ossl_unused void *provctx)

{

    return sm2_get_params_list;

}

static const OSSL_PARAM *sm2_settable_params(ossl_unused void *provctx)

{

    return sm2_set_params_list;

}

static int sm2_set_params(void *key, const OSSL_PARAM params[])

{

    EC_PARAMS p;

    if (key == NULL)

        return 0;

    if (ossl_param_is_empty(params))

        return 1;

    if (!sm2_set_params_decoder(params, &p))

        return 0;

    return common_set_params(key, &p);

}

static int sm2_validate(const void *keydata, int selection, int checktype)

{

    const EC_KEY *eck = keydata;

    int ok = 1;

    BN_CTX *ctx = NULL;

    if (!ossl_prov_is_running())

        return 0;

    if ((selection & EC_POSSIBLE_SELECTIONS) == 0)

        return 1; /* nothing to validate */

    ctx = BN_CTX_new_ex(ossl_ec_key_get_libctx(eck));

    if (ctx == NULL)

        return 0;

    if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0)

        ok = ok && EC_GROUP_check(EC_KEY_get0_group(eck), ctx);

    if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) {

        if (checktype == OSSL_KEYMGMT_VALIDATE_QUICK_CHECK)

            ok = ok && ossl_ec_key_public_check_quick(eck, ctx);

        else

            ok = ok && ossl_ec_key_public_check(eck, ctx);

    }

    if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)

        ok = ok && ossl_sm2_key_private_check(eck);

    if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == OSSL_KEYMGMT_SELECT_KEYPAIR)

        ok = ok && ossl_ec_key_pairwise_check(eck, ctx);

    BN_CTX_free(ctx);

    return ok;

}

#endif

#endif

static int ec_validate(const void *keydata, int selection, int checktype)

{

    const EC_KEY *eck = keydata;

    int ok = 1;

    BN_CTX *ctx = NULL;

    if (!ossl_prov_is_running())

        return 0;

    if ((selection & EC_POSSIBLE_SELECTIONS) == 0)

        return 1; /* nothing to validate */

    ctx = BN_CTX_new_ex(ossl_ec_key_get_libctx(eck));

    if (ctx == NULL)

        return 0;

    if ((selection & OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS) != 0) {

        int flags = EC_KEY_get_flags(eck);

        if ((flags & EC_FLAG_CHECK_NAMED_GROUP) != 0)

            ok = ok && EC_GROUP_check_named_curve(EC_KEY_get0_group(eck), (flags & EC_FLAG_CHECK_NAMED_GROUP_NIST) != 0, ctx) > 0;

        else

            ok = ok && EC_GROUP_check(EC_KEY_get0_group(eck), ctx);

    }

    if ((selection & OSSL_KEYMGMT_SELECT_PUBLIC_KEY) != 0) {

        if (checktype == OSSL_KEYMGMT_VALIDATE_QUICK_CHECK)

            ok = ok && ossl_ec_key_public_check_quick(eck, ctx);

        else

            ok = ok && ossl_ec_key_public_check(eck, ctx);

    }

    if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)

        ok = ok && ossl_ec_key_private_check(eck);

    if ((selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == OSSL_KEYMGMT_SELECT_KEYPAIR)

        ok = ok && ossl_ec_key_pairwise_check(eck, ctx);

    BN_CTX_free(ctx);

    return ok;

}

struct ec_gen_ctx {

    OSSL_LIB_CTX *libctx;

    char *group_name;

    char *encoding;

    char *pt_format;

    char *group_check;

    char *field_type;

    BIGNUM *p, *a, *b, *order, *cofactor;

    unsigned char *gen, *seed;

    size_t gen_len, seed_len;

    int selection;

    int ecdh_mode;

    EC_GROUP *gen_group;

    unsigned char *dhkem_ikm;

    size_t dhkem_ikmlen;

    OSSL_FIPS_IND_DECLARE

};

static void *ec_gen_init(void *provctx, int selection,

    const OSSL_PARAM params[])

{

    OSSL_LIB_CTX *libctx = PROV_LIBCTX_OF(provctx);

    struct ec_gen_ctx *gctx = NULL;

    if (!ossl_prov_is_running() || (selection & (EC_POSSIBLE_SELECTIONS)) == 0)

        return NULL;

    if ((gctx = OPENSSL_zalloc(sizeof(*gctx))) != NULL) {

        gctx->libctx = libctx;

        gctx->selection = selection;

        gctx->ecdh_mode = 0;

        OSSL_FIPS_IND_INIT(gctx)

        if (!ec_gen_set_params(gctx, params)) {

            ec_gen_cleanup(gctx);

            gctx = NULL;

        }

    }

    return gctx;

}

#ifndef FIPS_MODULE

#ifndef OPENSSL_NO_SM2

static void *sm2_gen_init(void *provctx, int selection,

    const OSSL_PARAM params[])

{

    struct ec_gen_ctx *gctx = ec_gen_init(provctx, selection, NULL);

    if (gctx != NULL) {

        if (!sm2_gen_set_params(gctx, params))

            goto err;