annotate src/jdk.crypto.ec/share/native/libsunec/impl/ecp.h @ 17280:f09a6beb1e23

8175110: Higher quality ECDSA operations Reviewed-by: jnimeh, valeriep, vinnie, xuelei
author apetcher
date Fri, 12 May 2017 17:30:47 +0100
parents f08705540498
children
rev   line source
vinnie@4273 1 /*
apetcher@17280 2 * Copyright (c) 2007, 2017, Oracle and/or its affiliates. All rights reserved.
vinnie@4273 3 * Use is subject to license terms.
vinnie@4273 4 *
vinnie@4273 5 * This library is free software; you can redistribute it and/or
vinnie@4273 6 * modify it under the terms of the GNU Lesser General Public
vinnie@4273 7 * License as published by the Free Software Foundation; either
vinnie@4273 8 * version 2.1 of the License, or (at your option) any later version.
vinnie@4273 9 *
vinnie@4273 10 * This library is distributed in the hope that it will be useful,
vinnie@4273 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
vinnie@4273 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
vinnie@4273 13 * Lesser General Public License for more details.
vinnie@4273 14 *
vinnie@4273 15 * You should have received a copy of the GNU Lesser General Public License
vinnie@4273 16 * along with this library; if not, write to the Free Software Foundation,
vinnie@4273 17 * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
vinnie@4273 18 *
vinnie@4273 19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
vinnie@4273 20 * or visit www.oracle.com if you need additional information or have any
vinnie@4273 21 * questions.
vinnie@4273 22 */
vinnie@4273 23
vinnie@1674 24 /* *********************************************************************
vinnie@1674 25 *
vinnie@1674 26 * The Original Code is the elliptic curve math library for prime field curves.
vinnie@1674 27 *
vinnie@1674 28 * The Initial Developer of the Original Code is
vinnie@1674 29 * Sun Microsystems, Inc.
vinnie@1674 30 * Portions created by the Initial Developer are Copyright (C) 2003
vinnie@1674 31 * the Initial Developer. All Rights Reserved.
vinnie@1674 32 *
vinnie@1674 33 * Contributor(s):
vinnie@1674 34 * Douglas Stebila <douglas@stebila.ca>, Sun Microsystems Laboratories
vinnie@1674 35 *
apetcher@17280 36 * Last Modified Date from the Original Code: May 2017
vinnie@1674 37 *********************************************************************** */
vinnie@1674 38
vinnie@1674 39 #ifndef _ECP_H
vinnie@1674 40 #define _ECP_H
vinnie@1674 41
vinnie@1674 42 #include "ecl-priv.h"
vinnie@1674 43
vinnie@1674 44 /* Checks if point P(px, py) is at infinity. Uses affine coordinates. */
vinnie@1674 45 mp_err ec_GFp_pt_is_inf_aff(const mp_int *px, const mp_int *py);
vinnie@1674 46
vinnie@1674 47 /* Sets P(px, py) to be the point at infinity. Uses affine coordinates. */
vinnie@1674 48 mp_err ec_GFp_pt_set_inf_aff(mp_int *px, mp_int *py);
vinnie@1674 49
vinnie@1674 50 /* Computes R = P + Q where R is (rx, ry), P is (px, py) and Q is (qx,
vinnie@1674 51 * qy). Uses affine coordinates. */
vinnie@1674 52 mp_err ec_GFp_pt_add_aff(const mp_int *px, const mp_int *py,
vinnie@1674 53 const mp_int *qx, const mp_int *qy, mp_int *rx,
vinnie@1674 54 mp_int *ry, const ECGroup *group);
vinnie@1674 55
vinnie@1674 56 /* Computes R = P - Q. Uses affine coordinates. */
vinnie@1674 57 mp_err ec_GFp_pt_sub_aff(const mp_int *px, const mp_int *py,
vinnie@1674 58 const mp_int *qx, const mp_int *qy, mp_int *rx,
vinnie@1674 59 mp_int *ry, const ECGroup *group);
vinnie@1674 60
vinnie@1674 61 /* Computes R = 2P. Uses affine coordinates. */
vinnie@1674 62 mp_err ec_GFp_pt_dbl_aff(const mp_int *px, const mp_int *py, mp_int *rx,
vinnie@1674 63 mp_int *ry, const ECGroup *group);
vinnie@1674 64
vinnie@1674 65 /* Validates a point on a GFp curve. */
vinnie@1674 66 mp_err ec_GFp_validate_point(const mp_int *px, const mp_int *py, const ECGroup *group);
vinnie@1674 67
vinnie@1674 68 #ifdef ECL_ENABLE_GFP_PT_MUL_AFF
vinnie@1674 69 /* Computes R = nP where R is (rx, ry) and P is (px, py). The parameters
vinnie@1674 70 * a, b and p are the elliptic curve coefficients and the prime that
vinnie@1674 71 * determines the field GFp. Uses affine coordinates. */
vinnie@1674 72 mp_err ec_GFp_pt_mul_aff(const mp_int *n, const mp_int *px,
vinnie@1674 73 const mp_int *py, mp_int *rx, mp_int *ry,
vinnie@1674 74 const ECGroup *group);
vinnie@1674 75 #endif
vinnie@1674 76
vinnie@1674 77 /* Converts a point P(px, py) from affine coordinates to Jacobian
vinnie@1674 78 * projective coordinates R(rx, ry, rz). */
vinnie@1674 79 mp_err ec_GFp_pt_aff2jac(const mp_int *px, const mp_int *py, mp_int *rx,
vinnie@1674 80 mp_int *ry, mp_int *rz, const ECGroup *group);
vinnie@1674 81
vinnie@1674 82 /* Converts a point P(px, py, pz) from Jacobian projective coordinates to
vinnie@1674 83 * affine coordinates R(rx, ry). */
vinnie@1674 84 mp_err ec_GFp_pt_jac2aff(const mp_int *px, const mp_int *py,
vinnie@1674 85 const mp_int *pz, mp_int *rx, mp_int *ry,
vinnie@1674 86 const ECGroup *group);
vinnie@1674 87
vinnie@1674 88 /* Checks if point P(px, py, pz) is at infinity. Uses Jacobian
vinnie@1674 89 * coordinates. */
vinnie@1674 90 mp_err ec_GFp_pt_is_inf_jac(const mp_int *px, const mp_int *py,
vinnie@1674 91 const mp_int *pz);
vinnie@1674 92
vinnie@1674 93 /* Sets P(px, py, pz) to be the point at infinity. Uses Jacobian
vinnie@1674 94 * coordinates. */
vinnie@1674 95 mp_err ec_GFp_pt_set_inf_jac(mp_int *px, mp_int *py, mp_int *pz);
vinnie@1674 96
vinnie@1674 97 /* Computes R = P + Q where R is (rx, ry, rz), P is (px, py, pz) and Q is
vinnie@1674 98 * (qx, qy, qz). Uses Jacobian coordinates. */
vinnie@1674 99 mp_err ec_GFp_pt_add_jac_aff(const mp_int *px, const mp_int *py,
vinnie@1674 100 const mp_int *pz, const mp_int *qx,
vinnie@1674 101 const mp_int *qy, mp_int *rx, mp_int *ry,
vinnie@1674 102 mp_int *rz, const ECGroup *group);
vinnie@1674 103
vinnie@1674 104 /* Computes R = 2P. Uses Jacobian coordinates. */
vinnie@1674 105 mp_err ec_GFp_pt_dbl_jac(const mp_int *px, const mp_int *py,
vinnie@1674 106 const mp_int *pz, mp_int *rx, mp_int *ry,
vinnie@1674 107 mp_int *rz, const ECGroup *group);
vinnie@1674 108
vinnie@1674 109 #ifdef ECL_ENABLE_GFP_PT_MUL_JAC
vinnie@1674 110 /* Computes R = nP where R is (rx, ry) and P is (px, py). The parameters
vinnie@1674 111 * a, b and p are the elliptic curve coefficients and the prime that
vinnie@1674 112 * determines the field GFp. Uses Jacobian coordinates. */
vinnie@1674 113 mp_err ec_GFp_pt_mul_jac(const mp_int *n, const mp_int *px,
vinnie@1674 114 const mp_int *py, mp_int *rx, mp_int *ry,
vinnie@1674 115 const ECGroup *group);
vinnie@1674 116 #endif
vinnie@1674 117
vinnie@1674 118 /* Computes R(x, y) = k1 * G + k2 * P(x, y), where G is the generator
vinnie@1674 119 * (base point) of the group of points on the elliptic curve. Allows k1 =
vinnie@1674 120 * NULL or { k2, P } = NULL. Implemented using mixed Jacobian-affine
vinnie@1674 121 * coordinates. Input and output values are assumed to be NOT
vinnie@1674 122 * field-encoded and are in affine form. */
vinnie@1674 123 mp_err
vinnie@1674 124 ec_GFp_pts_mul_jac(const mp_int *k1, const mp_int *k2, const mp_int *px,
vinnie@1674 125 const mp_int *py, mp_int *rx, mp_int *ry,
apetcher@17280 126 const ECGroup *group, int timing);
vinnie@1674 127
vinnie@1674 128 /* Computes R = nP where R is (rx, ry) and P is the base point. Elliptic
vinnie@1674 129 * curve points P and R can be identical. Uses mixed Modified-Jacobian
vinnie@1674 130 * co-ordinates for doubling and Chudnovsky Jacobian coordinates for
vinnie@1674 131 * additions. Assumes input is already field-encoded using field_enc, and
vinnie@1674 132 * returns output that is still field-encoded. Uses 5-bit window NAF
vinnie@1674 133 * method (algorithm 11) for scalar-point multiplication from Brown,
vinnie@1674 134 * Hankerson, Lopez, Menezes. Software Implementation of the NIST Elliptic
apetcher@17280 135 * Curves Over Prime Fields. The implementation includes a countermeasure
apetcher@17280 136 * that attempts to hide the size of n from timing channels. This counter-
apetcher@17280 137 * measure is enabled using the timing argument. The high-rder bits of timing
apetcher@17280 138 * must be uniformly random in order for this countermeasure to work. */
vinnie@1674 139 mp_err
vinnie@1674 140 ec_GFp_pt_mul_jm_wNAF(const mp_int *n, const mp_int *px, const mp_int *py,
apetcher@17280 141 mp_int *rx, mp_int *ry, const ECGroup *group,
apetcher@17280 142 int timing);
vinnie@1674 143
vinnie@1674 144 #endif /* _ECP_H */