ecp_curves.c 59 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479
  1. /*
  2. * Elliptic curves over GF(p): curve-specific data and functions
  3. *
  4. * Copyright The Mbed TLS Contributors
  5. * SPDX-License-Identifier: Apache-2.0
  6. *
  7. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  8. * not use this file except in compliance with the License.
  9. * You may obtain a copy of the License at
  10. *
  11. * http://www.apache.org/licenses/LICENSE-2.0
  12. *
  13. * Unless required by applicable law or agreed to in writing, software
  14. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  15. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16. * See the License for the specific language governing permissions and
  17. * limitations under the License.
  18. */
  19. #include "common.h"
  20. #if defined(MBEDTLS_ECP_C)
  21. #include "mbedtls/ecp.h"
  22. #include "mbedtls/platform_util.h"
  23. #include "mbedtls/error.h"
  24. #include "mbedtls/bn_mul.h"
  25. #include "ecp_invasive.h"
  26. #include <string.h>
  27. #if !defined(MBEDTLS_ECP_ALT)
  28. /* Parameter validation macros based on platform_util.h */
  29. #define ECP_VALIDATE_RET( cond ) \
  30. MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_ECP_BAD_INPUT_DATA )
  31. #define ECP_VALIDATE( cond ) \
  32. MBEDTLS_INTERNAL_VALIDATE( cond )
  33. #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
  34. !defined(inline) && !defined(__cplusplus)
  35. #define inline __inline
  36. #endif
  37. #define ECP_MPI_INIT(s, n, p) {s, (n), (mbedtls_mpi_uint *)(p)}
  38. #define ECP_MPI_INIT_ARRAY(x) \
  39. ECP_MPI_INIT(1, sizeof(x) / sizeof(mbedtls_mpi_uint), x)
  40. /*
  41. * Note: the constants are in little-endian order
  42. * to be directly usable in MPIs
  43. */
  44. /*
  45. * Domain parameters for secp192r1
  46. */
  47. #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
  48. static const mbedtls_mpi_uint secp192r1_p[] = {
  49. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  50. MBEDTLS_BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  51. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  52. };
  53. static const mbedtls_mpi_uint secp192r1_b[] = {
  54. MBEDTLS_BYTES_TO_T_UINT_8( 0xB1, 0xB9, 0x46, 0xC1, 0xEC, 0xDE, 0xB8, 0xFE ),
  55. MBEDTLS_BYTES_TO_T_UINT_8( 0x49, 0x30, 0x24, 0x72, 0xAB, 0xE9, 0xA7, 0x0F ),
  56. MBEDTLS_BYTES_TO_T_UINT_8( 0xE7, 0x80, 0x9C, 0xE5, 0x19, 0x05, 0x21, 0x64 ),
  57. };
  58. static const mbedtls_mpi_uint secp192r1_gx[] = {
  59. MBEDTLS_BYTES_TO_T_UINT_8( 0x12, 0x10, 0xFF, 0x82, 0xFD, 0x0A, 0xFF, 0xF4 ),
  60. MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x88, 0xA1, 0x43, 0xEB, 0x20, 0xBF, 0x7C ),
  61. MBEDTLS_BYTES_TO_T_UINT_8( 0xF6, 0x90, 0x30, 0xB0, 0x0E, 0xA8, 0x8D, 0x18 ),
  62. };
  63. static const mbedtls_mpi_uint secp192r1_gy[] = {
  64. MBEDTLS_BYTES_TO_T_UINT_8( 0x11, 0x48, 0x79, 0x1E, 0xA1, 0x77, 0xF9, 0x73 ),
  65. MBEDTLS_BYTES_TO_T_UINT_8( 0xD5, 0xCD, 0x24, 0x6B, 0xED, 0x11, 0x10, 0x63 ),
  66. MBEDTLS_BYTES_TO_T_UINT_8( 0x78, 0xDA, 0xC8, 0xFF, 0x95, 0x2B, 0x19, 0x07 ),
  67. };
  68. static const mbedtls_mpi_uint secp192r1_n[] = {
  69. MBEDTLS_BYTES_TO_T_UINT_8( 0x31, 0x28, 0xD2, 0xB4, 0xB1, 0xC9, 0x6B, 0x14 ),
  70. MBEDTLS_BYTES_TO_T_UINT_8( 0x36, 0xF8, 0xDE, 0x99, 0xFF, 0xFF, 0xFF, 0xFF ),
  71. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  72. };
  73. #endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
  74. /*
  75. * Domain parameters for secp224r1
  76. */
  77. #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
  78. static const mbedtls_mpi_uint secp224r1_p[] = {
  79. MBEDTLS_BYTES_TO_T_UINT_8( 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
  80. MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
  81. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  82. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
  83. };
  84. static const mbedtls_mpi_uint secp224r1_b[] = {
  85. MBEDTLS_BYTES_TO_T_UINT_8( 0xB4, 0xFF, 0x55, 0x23, 0x43, 0x39, 0x0B, 0x27 ),
  86. MBEDTLS_BYTES_TO_T_UINT_8( 0xBA, 0xD8, 0xBF, 0xD7, 0xB7, 0xB0, 0x44, 0x50 ),
  87. MBEDTLS_BYTES_TO_T_UINT_8( 0x56, 0x32, 0x41, 0xF5, 0xAB, 0xB3, 0x04, 0x0C ),
  88. MBEDTLS_BYTES_TO_T_UINT_4( 0x85, 0x0A, 0x05, 0xB4 ),
  89. };
  90. static const mbedtls_mpi_uint secp224r1_gx[] = {
  91. MBEDTLS_BYTES_TO_T_UINT_8( 0x21, 0x1D, 0x5C, 0x11, 0xD6, 0x80, 0x32, 0x34 ),
  92. MBEDTLS_BYTES_TO_T_UINT_8( 0x22, 0x11, 0xC2, 0x56, 0xD3, 0xC1, 0x03, 0x4A ),
  93. MBEDTLS_BYTES_TO_T_UINT_8( 0xB9, 0x90, 0x13, 0x32, 0x7F, 0xBF, 0xB4, 0x6B ),
  94. MBEDTLS_BYTES_TO_T_UINT_4( 0xBD, 0x0C, 0x0E, 0xB7 ),
  95. };
  96. static const mbedtls_mpi_uint secp224r1_gy[] = {
  97. MBEDTLS_BYTES_TO_T_UINT_8( 0x34, 0x7E, 0x00, 0x85, 0x99, 0x81, 0xD5, 0x44 ),
  98. MBEDTLS_BYTES_TO_T_UINT_8( 0x64, 0x47, 0x07, 0x5A, 0xA0, 0x75, 0x43, 0xCD ),
  99. MBEDTLS_BYTES_TO_T_UINT_8( 0xE6, 0xDF, 0x22, 0x4C, 0xFB, 0x23, 0xF7, 0xB5 ),
  100. MBEDTLS_BYTES_TO_T_UINT_4( 0x88, 0x63, 0x37, 0xBD ),
  101. };
  102. static const mbedtls_mpi_uint secp224r1_n[] = {
  103. MBEDTLS_BYTES_TO_T_UINT_8( 0x3D, 0x2A, 0x5C, 0x5C, 0x45, 0x29, 0xDD, 0x13 ),
  104. MBEDTLS_BYTES_TO_T_UINT_8( 0x3E, 0xF0, 0xB8, 0xE0, 0xA2, 0x16, 0xFF, 0xFF ),
  105. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  106. MBEDTLS_BYTES_TO_T_UINT_4( 0xFF, 0xFF, 0xFF, 0xFF ),
  107. };
  108. #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
  109. /*
  110. * Domain parameters for secp256r1
  111. */
  112. #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
  113. static const mbedtls_mpi_uint secp256r1_p[] = {
  114. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  115. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
  116. MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
  117. MBEDTLS_BYTES_TO_T_UINT_8( 0x01, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
  118. };
  119. static const mbedtls_mpi_uint secp256r1_b[] = {
  120. MBEDTLS_BYTES_TO_T_UINT_8( 0x4B, 0x60, 0xD2, 0x27, 0x3E, 0x3C, 0xCE, 0x3B ),
  121. MBEDTLS_BYTES_TO_T_UINT_8( 0xF6, 0xB0, 0x53, 0xCC, 0xB0, 0x06, 0x1D, 0x65 ),
  122. MBEDTLS_BYTES_TO_T_UINT_8( 0xBC, 0x86, 0x98, 0x76, 0x55, 0xBD, 0xEB, 0xB3 ),
  123. MBEDTLS_BYTES_TO_T_UINT_8( 0xE7, 0x93, 0x3A, 0xAA, 0xD8, 0x35, 0xC6, 0x5A ),
  124. };
  125. static const mbedtls_mpi_uint secp256r1_gx[] = {
  126. MBEDTLS_BYTES_TO_T_UINT_8( 0x96, 0xC2, 0x98, 0xD8, 0x45, 0x39, 0xA1, 0xF4 ),
  127. MBEDTLS_BYTES_TO_T_UINT_8( 0xA0, 0x33, 0xEB, 0x2D, 0x81, 0x7D, 0x03, 0x77 ),
  128. MBEDTLS_BYTES_TO_T_UINT_8( 0xF2, 0x40, 0xA4, 0x63, 0xE5, 0xE6, 0xBC, 0xF8 ),
  129. MBEDTLS_BYTES_TO_T_UINT_8( 0x47, 0x42, 0x2C, 0xE1, 0xF2, 0xD1, 0x17, 0x6B ),
  130. };
  131. static const mbedtls_mpi_uint secp256r1_gy[] = {
  132. MBEDTLS_BYTES_TO_T_UINT_8( 0xF5, 0x51, 0xBF, 0x37, 0x68, 0x40, 0xB6, 0xCB ),
  133. MBEDTLS_BYTES_TO_T_UINT_8( 0xCE, 0x5E, 0x31, 0x6B, 0x57, 0x33, 0xCE, 0x2B ),
  134. MBEDTLS_BYTES_TO_T_UINT_8( 0x16, 0x9E, 0x0F, 0x7C, 0x4A, 0xEB, 0xE7, 0x8E ),
  135. MBEDTLS_BYTES_TO_T_UINT_8( 0x9B, 0x7F, 0x1A, 0xFE, 0xE2, 0x42, 0xE3, 0x4F ),
  136. };
  137. static const mbedtls_mpi_uint secp256r1_n[] = {
  138. MBEDTLS_BYTES_TO_T_UINT_8( 0x51, 0x25, 0x63, 0xFC, 0xC2, 0xCA, 0xB9, 0xF3 ),
  139. MBEDTLS_BYTES_TO_T_UINT_8( 0x84, 0x9E, 0x17, 0xA7, 0xAD, 0xFA, 0xE6, 0xBC ),
  140. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  141. MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
  142. };
  143. #endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
  144. /*
  145. * Domain parameters for secp384r1
  146. */
  147. #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
  148. static const mbedtls_mpi_uint secp384r1_p[] = {
  149. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00 ),
  150. MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF ),
  151. MBEDTLS_BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  152. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  153. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  154. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  155. };
  156. static const mbedtls_mpi_uint secp384r1_b[] = {
  157. MBEDTLS_BYTES_TO_T_UINT_8( 0xEF, 0x2A, 0xEC, 0xD3, 0xED, 0xC8, 0x85, 0x2A ),
  158. MBEDTLS_BYTES_TO_T_UINT_8( 0x9D, 0xD1, 0x2E, 0x8A, 0x8D, 0x39, 0x56, 0xC6 ),
  159. MBEDTLS_BYTES_TO_T_UINT_8( 0x5A, 0x87, 0x13, 0x50, 0x8F, 0x08, 0x14, 0x03 ),
  160. MBEDTLS_BYTES_TO_T_UINT_8( 0x12, 0x41, 0x81, 0xFE, 0x6E, 0x9C, 0x1D, 0x18 ),
  161. MBEDTLS_BYTES_TO_T_UINT_8( 0x19, 0x2D, 0xF8, 0xE3, 0x6B, 0x05, 0x8E, 0x98 ),
  162. MBEDTLS_BYTES_TO_T_UINT_8( 0xE4, 0xE7, 0x3E, 0xE2, 0xA7, 0x2F, 0x31, 0xB3 ),
  163. };
  164. static const mbedtls_mpi_uint secp384r1_gx[] = {
  165. MBEDTLS_BYTES_TO_T_UINT_8( 0xB7, 0x0A, 0x76, 0x72, 0x38, 0x5E, 0x54, 0x3A ),
  166. MBEDTLS_BYTES_TO_T_UINT_8( 0x6C, 0x29, 0x55, 0xBF, 0x5D, 0xF2, 0x02, 0x55 ),
  167. MBEDTLS_BYTES_TO_T_UINT_8( 0x38, 0x2A, 0x54, 0x82, 0xE0, 0x41, 0xF7, 0x59 ),
  168. MBEDTLS_BYTES_TO_T_UINT_8( 0x98, 0x9B, 0xA7, 0x8B, 0x62, 0x3B, 0x1D, 0x6E ),
  169. MBEDTLS_BYTES_TO_T_UINT_8( 0x74, 0xAD, 0x20, 0xF3, 0x1E, 0xC7, 0xB1, 0x8E ),
  170. MBEDTLS_BYTES_TO_T_UINT_8( 0x37, 0x05, 0x8B, 0xBE, 0x22, 0xCA, 0x87, 0xAA ),
  171. };
  172. static const mbedtls_mpi_uint secp384r1_gy[] = {
  173. MBEDTLS_BYTES_TO_T_UINT_8( 0x5F, 0x0E, 0xEA, 0x90, 0x7C, 0x1D, 0x43, 0x7A ),
  174. MBEDTLS_BYTES_TO_T_UINT_8( 0x9D, 0x81, 0x7E, 0x1D, 0xCE, 0xB1, 0x60, 0x0A ),
  175. MBEDTLS_BYTES_TO_T_UINT_8( 0xC0, 0xB8, 0xF0, 0xB5, 0x13, 0x31, 0xDA, 0xE9 ),
  176. MBEDTLS_BYTES_TO_T_UINT_8( 0x7C, 0x14, 0x9A, 0x28, 0xBD, 0x1D, 0xF4, 0xF8 ),
  177. MBEDTLS_BYTES_TO_T_UINT_8( 0x29, 0xDC, 0x92, 0x92, 0xBF, 0x98, 0x9E, 0x5D ),
  178. MBEDTLS_BYTES_TO_T_UINT_8( 0x6F, 0x2C, 0x26, 0x96, 0x4A, 0xDE, 0x17, 0x36 ),
  179. };
  180. static const mbedtls_mpi_uint secp384r1_n[] = {
  181. MBEDTLS_BYTES_TO_T_UINT_8( 0x73, 0x29, 0xC5, 0xCC, 0x6A, 0x19, 0xEC, 0xEC ),
  182. MBEDTLS_BYTES_TO_T_UINT_8( 0x7A, 0xA7, 0xB0, 0x48, 0xB2, 0x0D, 0x1A, 0x58 ),
  183. MBEDTLS_BYTES_TO_T_UINT_8( 0xDF, 0x2D, 0x37, 0xF4, 0x81, 0x4D, 0x63, 0xC7 ),
  184. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  185. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  186. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  187. };
  188. #endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
  189. /*
  190. * Domain parameters for secp521r1
  191. */
  192. #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
  193. static const mbedtls_mpi_uint secp521r1_p[] = {
  194. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  195. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  196. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  197. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  198. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  199. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  200. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  201. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  202. MBEDTLS_BYTES_TO_T_UINT_2( 0xFF, 0x01 ),
  203. };
  204. static const mbedtls_mpi_uint secp521r1_b[] = {
  205. MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x3F, 0x50, 0x6B, 0xD4, 0x1F, 0x45, 0xEF ),
  206. MBEDTLS_BYTES_TO_T_UINT_8( 0xF1, 0x34, 0x2C, 0x3D, 0x88, 0xDF, 0x73, 0x35 ),
  207. MBEDTLS_BYTES_TO_T_UINT_8( 0x07, 0xBF, 0xB1, 0x3B, 0xBD, 0xC0, 0x52, 0x16 ),
  208. MBEDTLS_BYTES_TO_T_UINT_8( 0x7B, 0x93, 0x7E, 0xEC, 0x51, 0x39, 0x19, 0x56 ),
  209. MBEDTLS_BYTES_TO_T_UINT_8( 0xE1, 0x09, 0xF1, 0x8E, 0x91, 0x89, 0xB4, 0xB8 ),
  210. MBEDTLS_BYTES_TO_T_UINT_8( 0xF3, 0x15, 0xB3, 0x99, 0x5B, 0x72, 0xDA, 0xA2 ),
  211. MBEDTLS_BYTES_TO_T_UINT_8( 0xEE, 0x40, 0x85, 0xB6, 0xA0, 0x21, 0x9A, 0x92 ),
  212. MBEDTLS_BYTES_TO_T_UINT_8( 0x1F, 0x9A, 0x1C, 0x8E, 0x61, 0xB9, 0x3E, 0x95 ),
  213. MBEDTLS_BYTES_TO_T_UINT_2( 0x51, 0x00 ),
  214. };
  215. static const mbedtls_mpi_uint secp521r1_gx[] = {
  216. MBEDTLS_BYTES_TO_T_UINT_8( 0x66, 0xBD, 0xE5, 0xC2, 0x31, 0x7E, 0x7E, 0xF9 ),
  217. MBEDTLS_BYTES_TO_T_UINT_8( 0x9B, 0x42, 0x6A, 0x85, 0xC1, 0xB3, 0x48, 0x33 ),
  218. MBEDTLS_BYTES_TO_T_UINT_8( 0xDE, 0xA8, 0xFF, 0xA2, 0x27, 0xC1, 0x1D, 0xFE ),
  219. MBEDTLS_BYTES_TO_T_UINT_8( 0x28, 0x59, 0xE7, 0xEF, 0x77, 0x5E, 0x4B, 0xA1 ),
  220. MBEDTLS_BYTES_TO_T_UINT_8( 0xBA, 0x3D, 0x4D, 0x6B, 0x60, 0xAF, 0x28, 0xF8 ),
  221. MBEDTLS_BYTES_TO_T_UINT_8( 0x21, 0xB5, 0x3F, 0x05, 0x39, 0x81, 0x64, 0x9C ),
  222. MBEDTLS_BYTES_TO_T_UINT_8( 0x42, 0xB4, 0x95, 0x23, 0x66, 0xCB, 0x3E, 0x9E ),
  223. MBEDTLS_BYTES_TO_T_UINT_8( 0xCD, 0xE9, 0x04, 0x04, 0xB7, 0x06, 0x8E, 0x85 ),
  224. MBEDTLS_BYTES_TO_T_UINT_2( 0xC6, 0x00 ),
  225. };
  226. static const mbedtls_mpi_uint secp521r1_gy[] = {
  227. MBEDTLS_BYTES_TO_T_UINT_8( 0x50, 0x66, 0xD1, 0x9F, 0x76, 0x94, 0xBE, 0x88 ),
  228. MBEDTLS_BYTES_TO_T_UINT_8( 0x40, 0xC2, 0x72, 0xA2, 0x86, 0x70, 0x3C, 0x35 ),
  229. MBEDTLS_BYTES_TO_T_UINT_8( 0x61, 0x07, 0xAD, 0x3F, 0x01, 0xB9, 0x50, 0xC5 ),
  230. MBEDTLS_BYTES_TO_T_UINT_8( 0x40, 0x26, 0xF4, 0x5E, 0x99, 0x72, 0xEE, 0x97 ),
  231. MBEDTLS_BYTES_TO_T_UINT_8( 0x2C, 0x66, 0x3E, 0x27, 0x17, 0xBD, 0xAF, 0x17 ),
  232. MBEDTLS_BYTES_TO_T_UINT_8( 0x68, 0x44, 0x9B, 0x57, 0x49, 0x44, 0xF5, 0x98 ),
  233. MBEDTLS_BYTES_TO_T_UINT_8( 0xD9, 0x1B, 0x7D, 0x2C, 0xB4, 0x5F, 0x8A, 0x5C ),
  234. MBEDTLS_BYTES_TO_T_UINT_8( 0x04, 0xC0, 0x3B, 0x9A, 0x78, 0x6A, 0x29, 0x39 ),
  235. MBEDTLS_BYTES_TO_T_UINT_2( 0x18, 0x01 ),
  236. };
  237. static const mbedtls_mpi_uint secp521r1_n[] = {
  238. MBEDTLS_BYTES_TO_T_UINT_8( 0x09, 0x64, 0x38, 0x91, 0x1E, 0xB7, 0x6F, 0xBB ),
  239. MBEDTLS_BYTES_TO_T_UINT_8( 0xAE, 0x47, 0x9C, 0x89, 0xB8, 0xC9, 0xB5, 0x3B ),
  240. MBEDTLS_BYTES_TO_T_UINT_8( 0xD0, 0xA5, 0x09, 0xF7, 0x48, 0x01, 0xCC, 0x7F ),
  241. MBEDTLS_BYTES_TO_T_UINT_8( 0x6B, 0x96, 0x2F, 0xBF, 0x83, 0x87, 0x86, 0x51 ),
  242. MBEDTLS_BYTES_TO_T_UINT_8( 0xFA, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  243. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  244. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  245. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  246. MBEDTLS_BYTES_TO_T_UINT_2( 0xFF, 0x01 ),
  247. };
  248. #endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
  249. #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
  250. static const mbedtls_mpi_uint secp192k1_p[] = {
  251. MBEDTLS_BYTES_TO_T_UINT_8( 0x37, 0xEE, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
  252. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  253. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  254. };
  255. static const mbedtls_mpi_uint secp192k1_a[] = {
  256. MBEDTLS_BYTES_TO_T_UINT_2( 0x00, 0x00 ),
  257. };
  258. static const mbedtls_mpi_uint secp192k1_b[] = {
  259. MBEDTLS_BYTES_TO_T_UINT_2( 0x03, 0x00 ),
  260. };
  261. static const mbedtls_mpi_uint secp192k1_gx[] = {
  262. MBEDTLS_BYTES_TO_T_UINT_8( 0x7D, 0x6C, 0xE0, 0xEA, 0xB1, 0xD1, 0xA5, 0x1D ),
  263. MBEDTLS_BYTES_TO_T_UINT_8( 0x34, 0xF4, 0xB7, 0x80, 0x02, 0x7D, 0xB0, 0x26 ),
  264. MBEDTLS_BYTES_TO_T_UINT_8( 0xAE, 0xE9, 0x57, 0xC0, 0x0E, 0xF1, 0x4F, 0xDB ),
  265. };
  266. static const mbedtls_mpi_uint secp192k1_gy[] = {
  267. MBEDTLS_BYTES_TO_T_UINT_8( 0x9D, 0x2F, 0x5E, 0xD9, 0x88, 0xAA, 0x82, 0x40 ),
  268. MBEDTLS_BYTES_TO_T_UINT_8( 0x34, 0x86, 0xBE, 0x15, 0xD0, 0x63, 0x41, 0x84 ),
  269. MBEDTLS_BYTES_TO_T_UINT_8( 0xA7, 0x28, 0x56, 0x9C, 0x6D, 0x2F, 0x2F, 0x9B ),
  270. };
  271. static const mbedtls_mpi_uint secp192k1_n[] = {
  272. MBEDTLS_BYTES_TO_T_UINT_8( 0x8D, 0xFD, 0xDE, 0x74, 0x6A, 0x46, 0x69, 0x0F ),
  273. MBEDTLS_BYTES_TO_T_UINT_8( 0x17, 0xFC, 0xF2, 0x26, 0xFE, 0xFF, 0xFF, 0xFF ),
  274. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  275. };
  276. #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
  277. #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
  278. static const mbedtls_mpi_uint secp224k1_p[] = {
  279. MBEDTLS_BYTES_TO_T_UINT_8( 0x6D, 0xE5, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
  280. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  281. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  282. MBEDTLS_BYTES_TO_T_UINT_4( 0xFF, 0xFF, 0xFF, 0xFF ),
  283. };
  284. static const mbedtls_mpi_uint secp224k1_a[] = {
  285. MBEDTLS_BYTES_TO_T_UINT_2( 0x00, 0x00 ),
  286. };
  287. static const mbedtls_mpi_uint secp224k1_b[] = {
  288. MBEDTLS_BYTES_TO_T_UINT_2( 0x05, 0x00 ),
  289. };
  290. static const mbedtls_mpi_uint secp224k1_gx[] = {
  291. MBEDTLS_BYTES_TO_T_UINT_8( 0x5C, 0xA4, 0xB7, 0xB6, 0x0E, 0x65, 0x7E, 0x0F ),
  292. MBEDTLS_BYTES_TO_T_UINT_8( 0xA9, 0x75, 0x70, 0xE4, 0xE9, 0x67, 0xA4, 0x69 ),
  293. MBEDTLS_BYTES_TO_T_UINT_8( 0xA1, 0x28, 0xFC, 0x30, 0xDF, 0x99, 0xF0, 0x4D ),
  294. MBEDTLS_BYTES_TO_T_UINT_4( 0x33, 0x5B, 0x45, 0xA1 ),
  295. };
  296. static const mbedtls_mpi_uint secp224k1_gy[] = {
  297. MBEDTLS_BYTES_TO_T_UINT_8( 0xA5, 0x61, 0x6D, 0x55, 0xDB, 0x4B, 0xCA, 0xE2 ),
  298. MBEDTLS_BYTES_TO_T_UINT_8( 0x59, 0xBD, 0xB0, 0xC0, 0xF7, 0x19, 0xE3, 0xF7 ),
  299. MBEDTLS_BYTES_TO_T_UINT_8( 0xD6, 0xFB, 0xCA, 0x82, 0x42, 0x34, 0xBA, 0x7F ),
  300. MBEDTLS_BYTES_TO_T_UINT_4( 0xED, 0x9F, 0x08, 0x7E ),
  301. };
  302. static const mbedtls_mpi_uint secp224k1_n[] = {
  303. MBEDTLS_BYTES_TO_T_UINT_8( 0xF7, 0xB1, 0x9F, 0x76, 0x71, 0xA9, 0xF0, 0xCA ),
  304. MBEDTLS_BYTES_TO_T_UINT_8( 0x84, 0x61, 0xEC, 0xD2, 0xE8, 0xDC, 0x01, 0x00 ),
  305. MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 ),
  306. MBEDTLS_BYTES_TO_T_UINT_8( 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00 ),
  307. };
  308. #endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
  309. #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
  310. static const mbedtls_mpi_uint secp256k1_p[] = {
  311. MBEDTLS_BYTES_TO_T_UINT_8( 0x2F, 0xFC, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF ),
  312. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  313. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  314. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  315. };
  316. static const mbedtls_mpi_uint secp256k1_a[] = {
  317. MBEDTLS_BYTES_TO_T_UINT_2( 0x00, 0x00 ),
  318. };
  319. static const mbedtls_mpi_uint secp256k1_b[] = {
  320. MBEDTLS_BYTES_TO_T_UINT_2( 0x07, 0x00 ),
  321. };
  322. static const mbedtls_mpi_uint secp256k1_gx[] = {
  323. MBEDTLS_BYTES_TO_T_UINT_8( 0x98, 0x17, 0xF8, 0x16, 0x5B, 0x81, 0xF2, 0x59 ),
  324. MBEDTLS_BYTES_TO_T_UINT_8( 0xD9, 0x28, 0xCE, 0x2D, 0xDB, 0xFC, 0x9B, 0x02 ),
  325. MBEDTLS_BYTES_TO_T_UINT_8( 0x07, 0x0B, 0x87, 0xCE, 0x95, 0x62, 0xA0, 0x55 ),
  326. MBEDTLS_BYTES_TO_T_UINT_8( 0xAC, 0xBB, 0xDC, 0xF9, 0x7E, 0x66, 0xBE, 0x79 ),
  327. };
  328. static const mbedtls_mpi_uint secp256k1_gy[] = {
  329. MBEDTLS_BYTES_TO_T_UINT_8( 0xB8, 0xD4, 0x10, 0xFB, 0x8F, 0xD0, 0x47, 0x9C ),
  330. MBEDTLS_BYTES_TO_T_UINT_8( 0x19, 0x54, 0x85, 0xA6, 0x48, 0xB4, 0x17, 0xFD ),
  331. MBEDTLS_BYTES_TO_T_UINT_8( 0xA8, 0x08, 0x11, 0x0E, 0xFC, 0xFB, 0xA4, 0x5D ),
  332. MBEDTLS_BYTES_TO_T_UINT_8( 0x65, 0xC4, 0xA3, 0x26, 0x77, 0xDA, 0x3A, 0x48 ),
  333. };
  334. static const mbedtls_mpi_uint secp256k1_n[] = {
  335. MBEDTLS_BYTES_TO_T_UINT_8( 0x41, 0x41, 0x36, 0xD0, 0x8C, 0x5E, 0xD2, 0xBF ),
  336. MBEDTLS_BYTES_TO_T_UINT_8( 0x3B, 0xA0, 0x48, 0xAF, 0xE6, 0xDC, 0xAE, 0xBA ),
  337. MBEDTLS_BYTES_TO_T_UINT_8( 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  338. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF ),
  339. };
  340. #endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
  341. /*
  342. * Domain parameters for brainpoolP256r1 (RFC 5639 3.4)
  343. */
  344. #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
  345. static const mbedtls_mpi_uint brainpoolP256r1_p[] = {
  346. MBEDTLS_BYTES_TO_T_UINT_8( 0x77, 0x53, 0x6E, 0x1F, 0x1D, 0x48, 0x13, 0x20 ),
  347. MBEDTLS_BYTES_TO_T_UINT_8( 0x28, 0x20, 0x26, 0xD5, 0x23, 0xF6, 0x3B, 0x6E ),
  348. MBEDTLS_BYTES_TO_T_UINT_8( 0x72, 0x8D, 0x83, 0x9D, 0x90, 0x0A, 0x66, 0x3E ),
  349. MBEDTLS_BYTES_TO_T_UINT_8( 0xBC, 0xA9, 0xEE, 0xA1, 0xDB, 0x57, 0xFB, 0xA9 ),
  350. };
  351. static const mbedtls_mpi_uint brainpoolP256r1_a[] = {
  352. MBEDTLS_BYTES_TO_T_UINT_8( 0xD9, 0xB5, 0x30, 0xF3, 0x44, 0x4B, 0x4A, 0xE9 ),
  353. MBEDTLS_BYTES_TO_T_UINT_8( 0x6C, 0x5C, 0xDC, 0x26, 0xC1, 0x55, 0x80, 0xFB ),
  354. MBEDTLS_BYTES_TO_T_UINT_8( 0xE7, 0xFF, 0x7A, 0x41, 0x30, 0x75, 0xF6, 0xEE ),
  355. MBEDTLS_BYTES_TO_T_UINT_8( 0x57, 0x30, 0x2C, 0xFC, 0x75, 0x09, 0x5A, 0x7D ),
  356. };
  357. static const mbedtls_mpi_uint brainpoolP256r1_b[] = {
  358. MBEDTLS_BYTES_TO_T_UINT_8( 0xB6, 0x07, 0x8C, 0xFF, 0x18, 0xDC, 0xCC, 0x6B ),
  359. MBEDTLS_BYTES_TO_T_UINT_8( 0xCE, 0xE1, 0xF7, 0x5C, 0x29, 0x16, 0x84, 0x95 ),
  360. MBEDTLS_BYTES_TO_T_UINT_8( 0xBF, 0x7C, 0xD7, 0xBB, 0xD9, 0xB5, 0x30, 0xF3 ),
  361. MBEDTLS_BYTES_TO_T_UINT_8( 0x44, 0x4B, 0x4A, 0xE9, 0x6C, 0x5C, 0xDC, 0x26 ),
  362. };
  363. static const mbedtls_mpi_uint brainpoolP256r1_gx[] = {
  364. MBEDTLS_BYTES_TO_T_UINT_8( 0x62, 0x32, 0xCE, 0x9A, 0xBD, 0x53, 0x44, 0x3A ),
  365. MBEDTLS_BYTES_TO_T_UINT_8( 0xC2, 0x23, 0xBD, 0xE3, 0xE1, 0x27, 0xDE, 0xB9 ),
  366. MBEDTLS_BYTES_TO_T_UINT_8( 0xAF, 0xB7, 0x81, 0xFC, 0x2F, 0x48, 0x4B, 0x2C ),
  367. MBEDTLS_BYTES_TO_T_UINT_8( 0xCB, 0x57, 0x7E, 0xCB, 0xB9, 0xAE, 0xD2, 0x8B ),
  368. };
  369. static const mbedtls_mpi_uint brainpoolP256r1_gy[] = {
  370. MBEDTLS_BYTES_TO_T_UINT_8( 0x97, 0x69, 0x04, 0x2F, 0xC7, 0x54, 0x1D, 0x5C ),
  371. MBEDTLS_BYTES_TO_T_UINT_8( 0x54, 0x8E, 0xED, 0x2D, 0x13, 0x45, 0x77, 0xC2 ),
  372. MBEDTLS_BYTES_TO_T_UINT_8( 0xC9, 0x1D, 0x61, 0x14, 0x1A, 0x46, 0xF8, 0x97 ),
  373. MBEDTLS_BYTES_TO_T_UINT_8( 0xFD, 0xC4, 0xDA, 0xC3, 0x35, 0xF8, 0x7E, 0x54 ),
  374. };
  375. static const mbedtls_mpi_uint brainpoolP256r1_n[] = {
  376. MBEDTLS_BYTES_TO_T_UINT_8( 0xA7, 0x56, 0x48, 0x97, 0x82, 0x0E, 0x1E, 0x90 ),
  377. MBEDTLS_BYTES_TO_T_UINT_8( 0xF7, 0xA6, 0x61, 0xB5, 0xA3, 0x7A, 0x39, 0x8C ),
  378. MBEDTLS_BYTES_TO_T_UINT_8( 0x71, 0x8D, 0x83, 0x9D, 0x90, 0x0A, 0x66, 0x3E ),
  379. MBEDTLS_BYTES_TO_T_UINT_8( 0xBC, 0xA9, 0xEE, 0xA1, 0xDB, 0x57, 0xFB, 0xA9 ),
  380. };
  381. #endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */
  382. /*
  383. * Domain parameters for brainpoolP384r1 (RFC 5639 3.6)
  384. */
  385. #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
  386. static const mbedtls_mpi_uint brainpoolP384r1_p[] = {
  387. MBEDTLS_BYTES_TO_T_UINT_8( 0x53, 0xEC, 0x07, 0x31, 0x13, 0x00, 0x47, 0x87 ),
  388. MBEDTLS_BYTES_TO_T_UINT_8( 0x71, 0x1A, 0x1D, 0x90, 0x29, 0xA7, 0xD3, 0xAC ),
  389. MBEDTLS_BYTES_TO_T_UINT_8( 0x23, 0x11, 0xB7, 0x7F, 0x19, 0xDA, 0xB1, 0x12 ),
  390. MBEDTLS_BYTES_TO_T_UINT_8( 0xB4, 0x56, 0x54, 0xED, 0x09, 0x71, 0x2F, 0x15 ),
  391. MBEDTLS_BYTES_TO_T_UINT_8( 0xDF, 0x41, 0xE6, 0x50, 0x7E, 0x6F, 0x5D, 0x0F ),
  392. MBEDTLS_BYTES_TO_T_UINT_8( 0x28, 0x6D, 0x38, 0xA3, 0x82, 0x1E, 0xB9, 0x8C ),
  393. };
  394. static const mbedtls_mpi_uint brainpoolP384r1_a[] = {
  395. MBEDTLS_BYTES_TO_T_UINT_8( 0x26, 0x28, 0xCE, 0x22, 0xDD, 0xC7, 0xA8, 0x04 ),
  396. MBEDTLS_BYTES_TO_T_UINT_8( 0xEB, 0xD4, 0x3A, 0x50, 0x4A, 0x81, 0xA5, 0x8A ),
  397. MBEDTLS_BYTES_TO_T_UINT_8( 0x0F, 0xF9, 0x91, 0xBA, 0xEF, 0x65, 0x91, 0x13 ),
  398. MBEDTLS_BYTES_TO_T_UINT_8( 0x87, 0x27, 0xB2, 0x4F, 0x8E, 0xA2, 0xBE, 0xC2 ),
  399. MBEDTLS_BYTES_TO_T_UINT_8( 0xA0, 0xAF, 0x05, 0xCE, 0x0A, 0x08, 0x72, 0x3C ),
  400. MBEDTLS_BYTES_TO_T_UINT_8( 0x0C, 0x15, 0x8C, 0x3D, 0xC6, 0x82, 0xC3, 0x7B ),
  401. };
  402. static const mbedtls_mpi_uint brainpoolP384r1_b[] = {
  403. MBEDTLS_BYTES_TO_T_UINT_8( 0x11, 0x4C, 0x50, 0xFA, 0x96, 0x86, 0xB7, 0x3A ),
  404. MBEDTLS_BYTES_TO_T_UINT_8( 0x94, 0xC9, 0xDB, 0x95, 0x02, 0x39, 0xB4, 0x7C ),
  405. MBEDTLS_BYTES_TO_T_UINT_8( 0xD5, 0x62, 0xEB, 0x3E, 0xA5, 0x0E, 0x88, 0x2E ),
  406. MBEDTLS_BYTES_TO_T_UINT_8( 0xA6, 0xD2, 0xDC, 0x07, 0xE1, 0x7D, 0xB7, 0x2F ),
  407. MBEDTLS_BYTES_TO_T_UINT_8( 0x7C, 0x44, 0xF0, 0x16, 0x54, 0xB5, 0x39, 0x8B ),
  408. MBEDTLS_BYTES_TO_T_UINT_8( 0x26, 0x28, 0xCE, 0x22, 0xDD, 0xC7, 0xA8, 0x04 ),
  409. };
  410. static const mbedtls_mpi_uint brainpoolP384r1_gx[] = {
  411. MBEDTLS_BYTES_TO_T_UINT_8( 0x1E, 0xAF, 0xD4, 0x47, 0xE2, 0xB2, 0x87, 0xEF ),
  412. MBEDTLS_BYTES_TO_T_UINT_8( 0xAA, 0x46, 0xD6, 0x36, 0x34, 0xE0, 0x26, 0xE8 ),
  413. MBEDTLS_BYTES_TO_T_UINT_8( 0xE8, 0x10, 0xBD, 0x0C, 0xFE, 0xCA, 0x7F, 0xDB ),
  414. MBEDTLS_BYTES_TO_T_UINT_8( 0xE3, 0x4F, 0xF1, 0x7E, 0xE7, 0xA3, 0x47, 0x88 ),
  415. MBEDTLS_BYTES_TO_T_UINT_8( 0x6B, 0x3F, 0xC1, 0xB7, 0x81, 0x3A, 0xA6, 0xA2 ),
  416. MBEDTLS_BYTES_TO_T_UINT_8( 0xFF, 0x45, 0xCF, 0x68, 0xF0, 0x64, 0x1C, 0x1D ),
  417. };
  418. static const mbedtls_mpi_uint brainpoolP384r1_gy[] = {
  419. MBEDTLS_BYTES_TO_T_UINT_8( 0x15, 0x53, 0x3C, 0x26, 0x41, 0x03, 0x82, 0x42 ),
  420. MBEDTLS_BYTES_TO_T_UINT_8( 0x11, 0x81, 0x91, 0x77, 0x21, 0x46, 0x46, 0x0E ),
  421. MBEDTLS_BYTES_TO_T_UINT_8( 0x28, 0x29, 0x91, 0xF9, 0x4F, 0x05, 0x9C, 0xE1 ),
  422. MBEDTLS_BYTES_TO_T_UINT_8( 0x64, 0x58, 0xEC, 0xFE, 0x29, 0x0B, 0xB7, 0x62 ),
  423. MBEDTLS_BYTES_TO_T_UINT_8( 0x52, 0xD5, 0xCF, 0x95, 0x8E, 0xEB, 0xB1, 0x5C ),
  424. MBEDTLS_BYTES_TO_T_UINT_8( 0xA4, 0xC2, 0xF9, 0x20, 0x75, 0x1D, 0xBE, 0x8A ),
  425. };
  426. static const mbedtls_mpi_uint brainpoolP384r1_n[] = {
  427. MBEDTLS_BYTES_TO_T_UINT_8( 0x65, 0x65, 0x04, 0xE9, 0x02, 0x32, 0x88, 0x3B ),
  428. MBEDTLS_BYTES_TO_T_UINT_8( 0x10, 0xC3, 0x7F, 0x6B, 0xAF, 0xB6, 0x3A, 0xCF ),
  429. MBEDTLS_BYTES_TO_T_UINT_8( 0xA7, 0x25, 0x04, 0xAC, 0x6C, 0x6E, 0x16, 0x1F ),
  430. MBEDTLS_BYTES_TO_T_UINT_8( 0xB3, 0x56, 0x54, 0xED, 0x09, 0x71, 0x2F, 0x15 ),
  431. MBEDTLS_BYTES_TO_T_UINT_8( 0xDF, 0x41, 0xE6, 0x50, 0x7E, 0x6F, 0x5D, 0x0F ),
  432. MBEDTLS_BYTES_TO_T_UINT_8( 0x28, 0x6D, 0x38, 0xA3, 0x82, 0x1E, 0xB9, 0x8C ),
  433. };
  434. #endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */
  435. /*
  436. * Domain parameters for brainpoolP512r1 (RFC 5639 3.7)
  437. */
  438. #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
  439. static const mbedtls_mpi_uint brainpoolP512r1_p[] = {
  440. MBEDTLS_BYTES_TO_T_UINT_8( 0xF3, 0x48, 0x3A, 0x58, 0x56, 0x60, 0xAA, 0x28 ),
  441. MBEDTLS_BYTES_TO_T_UINT_8( 0x85, 0xC6, 0x82, 0x2D, 0x2F, 0xFF, 0x81, 0x28 ),
  442. MBEDTLS_BYTES_TO_T_UINT_8( 0xE6, 0x80, 0xA3, 0xE6, 0x2A, 0xA1, 0xCD, 0xAE ),
  443. MBEDTLS_BYTES_TO_T_UINT_8( 0x42, 0x68, 0xC6, 0x9B, 0x00, 0x9B, 0x4D, 0x7D ),
  444. MBEDTLS_BYTES_TO_T_UINT_8( 0x71, 0x08, 0x33, 0x70, 0xCA, 0x9C, 0x63, 0xD6 ),
  445. MBEDTLS_BYTES_TO_T_UINT_8( 0x0E, 0xD2, 0xC9, 0xB3, 0xB3, 0x8D, 0x30, 0xCB ),
  446. MBEDTLS_BYTES_TO_T_UINT_8( 0x07, 0xFC, 0xC9, 0x33, 0xAE, 0xE6, 0xD4, 0x3F ),
  447. MBEDTLS_BYTES_TO_T_UINT_8( 0x8B, 0xC4, 0xE9, 0xDB, 0xB8, 0x9D, 0xDD, 0xAA ),
  448. };
  449. static const mbedtls_mpi_uint brainpoolP512r1_a[] = {
  450. MBEDTLS_BYTES_TO_T_UINT_8( 0xCA, 0x94, 0xFC, 0x77, 0x4D, 0xAC, 0xC1, 0xE7 ),
  451. MBEDTLS_BYTES_TO_T_UINT_8( 0xB9, 0xC7, 0xF2, 0x2B, 0xA7, 0x17, 0x11, 0x7F ),
  452. MBEDTLS_BYTES_TO_T_UINT_8( 0xB5, 0xC8, 0x9A, 0x8B, 0xC9, 0xF1, 0x2E, 0x0A ),
  453. MBEDTLS_BYTES_TO_T_UINT_8( 0xA1, 0x3A, 0x25, 0xA8, 0x5A, 0x5D, 0xED, 0x2D ),
  454. MBEDTLS_BYTES_TO_T_UINT_8( 0xBC, 0x63, 0x98, 0xEA, 0xCA, 0x41, 0x34, 0xA8 ),
  455. MBEDTLS_BYTES_TO_T_UINT_8( 0x10, 0x16, 0xF9, 0x3D, 0x8D, 0xDD, 0xCB, 0x94 ),
  456. MBEDTLS_BYTES_TO_T_UINT_8( 0xC5, 0x4C, 0x23, 0xAC, 0x45, 0x71, 0x32, 0xE2 ),
  457. MBEDTLS_BYTES_TO_T_UINT_8( 0x89, 0x3B, 0x60, 0x8B, 0x31, 0xA3, 0x30, 0x78 ),
  458. };
  459. static const mbedtls_mpi_uint brainpoolP512r1_b[] = {
  460. MBEDTLS_BYTES_TO_T_UINT_8( 0x23, 0xF7, 0x16, 0x80, 0x63, 0xBD, 0x09, 0x28 ),
  461. MBEDTLS_BYTES_TO_T_UINT_8( 0xDD, 0xE5, 0xBA, 0x5E, 0xB7, 0x50, 0x40, 0x98 ),
  462. MBEDTLS_BYTES_TO_T_UINT_8( 0x67, 0x3E, 0x08, 0xDC, 0xCA, 0x94, 0xFC, 0x77 ),
  463. MBEDTLS_BYTES_TO_T_UINT_8( 0x4D, 0xAC, 0xC1, 0xE7, 0xB9, 0xC7, 0xF2, 0x2B ),
  464. MBEDTLS_BYTES_TO_T_UINT_8( 0xA7, 0x17, 0x11, 0x7F, 0xB5, 0xC8, 0x9A, 0x8B ),
  465. MBEDTLS_BYTES_TO_T_UINT_8( 0xC9, 0xF1, 0x2E, 0x0A, 0xA1, 0x3A, 0x25, 0xA8 ),
  466. MBEDTLS_BYTES_TO_T_UINT_8( 0x5A, 0x5D, 0xED, 0x2D, 0xBC, 0x63, 0x98, 0xEA ),
  467. MBEDTLS_BYTES_TO_T_UINT_8( 0xCA, 0x41, 0x34, 0xA8, 0x10, 0x16, 0xF9, 0x3D ),
  468. };
  469. static const mbedtls_mpi_uint brainpoolP512r1_gx[] = {
  470. MBEDTLS_BYTES_TO_T_UINT_8( 0x22, 0xF8, 0xB9, 0xBC, 0x09, 0x22, 0x35, 0x8B ),
  471. MBEDTLS_BYTES_TO_T_UINT_8( 0x68, 0x5E, 0x6A, 0x40, 0x47, 0x50, 0x6D, 0x7C ),
  472. MBEDTLS_BYTES_TO_T_UINT_8( 0x5F, 0x7D, 0xB9, 0x93, 0x7B, 0x68, 0xD1, 0x50 ),
  473. MBEDTLS_BYTES_TO_T_UINT_8( 0x8D, 0xD4, 0xD0, 0xE2, 0x78, 0x1F, 0x3B, 0xFF ),
  474. MBEDTLS_BYTES_TO_T_UINT_8( 0x8E, 0x09, 0xD0, 0xF4, 0xEE, 0x62, 0x3B, 0xB4 ),
  475. MBEDTLS_BYTES_TO_T_UINT_8( 0xC1, 0x16, 0xD9, 0xB5, 0x70, 0x9F, 0xED, 0x85 ),
  476. MBEDTLS_BYTES_TO_T_UINT_8( 0x93, 0x6A, 0x4C, 0x9C, 0x2E, 0x32, 0x21, 0x5A ),
  477. MBEDTLS_BYTES_TO_T_UINT_8( 0x64, 0xD9, 0x2E, 0xD8, 0xBD, 0xE4, 0xAE, 0x81 ),
  478. };
  479. static const mbedtls_mpi_uint brainpoolP512r1_gy[] = {
  480. MBEDTLS_BYTES_TO_T_UINT_8( 0x92, 0x08, 0xD8, 0x3A, 0x0F, 0x1E, 0xCD, 0x78 ),
  481. MBEDTLS_BYTES_TO_T_UINT_8( 0x06, 0x54, 0xF0, 0xA8, 0x2F, 0x2B, 0xCA, 0xD1 ),
  482. MBEDTLS_BYTES_TO_T_UINT_8( 0xAE, 0x63, 0x27, 0x8A, 0xD8, 0x4B, 0xCA, 0x5B ),
  483. MBEDTLS_BYTES_TO_T_UINT_8( 0x5E, 0x48, 0x5F, 0x4A, 0x49, 0xDE, 0xDC, 0xB2 ),
  484. MBEDTLS_BYTES_TO_T_UINT_8( 0x11, 0x81, 0x1F, 0x88, 0x5B, 0xC5, 0x00, 0xA0 ),
  485. MBEDTLS_BYTES_TO_T_UINT_8( 0x1A, 0x7B, 0xA5, 0x24, 0x00, 0xF7, 0x09, 0xF2 ),
  486. MBEDTLS_BYTES_TO_T_UINT_8( 0xFD, 0x22, 0x78, 0xCF, 0xA9, 0xBF, 0xEA, 0xC0 ),
  487. MBEDTLS_BYTES_TO_T_UINT_8( 0xEC, 0x32, 0x63, 0x56, 0x5D, 0x38, 0xDE, 0x7D ),
  488. };
  489. static const mbedtls_mpi_uint brainpoolP512r1_n[] = {
  490. MBEDTLS_BYTES_TO_T_UINT_8( 0x69, 0x00, 0xA9, 0x9C, 0x82, 0x96, 0x87, 0xB5 ),
  491. MBEDTLS_BYTES_TO_T_UINT_8( 0xDD, 0xDA, 0x5D, 0x08, 0x81, 0xD3, 0xB1, 0x1D ),
  492. MBEDTLS_BYTES_TO_T_UINT_8( 0x47, 0x10, 0xAC, 0x7F, 0x19, 0x61, 0x86, 0x41 ),
  493. MBEDTLS_BYTES_TO_T_UINT_8( 0x19, 0x26, 0xA9, 0x4C, 0x41, 0x5C, 0x3E, 0x55 ),
  494. MBEDTLS_BYTES_TO_T_UINT_8( 0x70, 0x08, 0x33, 0x70, 0xCA, 0x9C, 0x63, 0xD6 ),
  495. MBEDTLS_BYTES_TO_T_UINT_8( 0x0E, 0xD2, 0xC9, 0xB3, 0xB3, 0x8D, 0x30, 0xCB ),
  496. MBEDTLS_BYTES_TO_T_UINT_8( 0x07, 0xFC, 0xC9, 0x33, 0xAE, 0xE6, 0xD4, 0x3F ),
  497. MBEDTLS_BYTES_TO_T_UINT_8( 0x8B, 0xC4, 0xE9, 0xDB, 0xB8, 0x9D, 0xDD, 0xAA ),
  498. };
  499. #endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */
  500. #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) || \
  501. defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \
  502. defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
  503. defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \
  504. defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || \
  505. defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || \
  506. defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || \
  507. defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) || \
  508. defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || \
  509. defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || \
  510. defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
  511. /* For these curves, we build the group parameters dynamically. */
  512. #define ECP_LOAD_GROUP
  513. #endif
  514. #if defined(ECP_LOAD_GROUP)
  515. /*
  516. * Create an MPI from embedded constants
  517. * (assumes len is an exact multiple of sizeof mbedtls_mpi_uint)
  518. */
  519. static inline void ecp_mpi_load( mbedtls_mpi *X, const mbedtls_mpi_uint *p, size_t len )
  520. {
  521. X->s = 1;
  522. X->n = len / sizeof( mbedtls_mpi_uint );
  523. X->p = (mbedtls_mpi_uint *) p;
  524. }
  525. /*
  526. * Set an MPI to static value 1
  527. */
  528. static inline void ecp_mpi_set1( mbedtls_mpi *X )
  529. {
  530. static mbedtls_mpi_uint one[] = { 1 };
  531. X->s = 1;
  532. X->n = 1;
  533. X->p = one;
  534. }
  535. /*
  536. * Make group available from embedded constants
  537. */
  538. static int ecp_group_load( mbedtls_ecp_group *grp,
  539. const mbedtls_mpi_uint *p, size_t plen,
  540. const mbedtls_mpi_uint *a, size_t alen,
  541. const mbedtls_mpi_uint *b, size_t blen,
  542. const mbedtls_mpi_uint *gx, size_t gxlen,
  543. const mbedtls_mpi_uint *gy, size_t gylen,
  544. const mbedtls_mpi_uint *n, size_t nlen)
  545. {
  546. ecp_mpi_load( &grp->P, p, plen );
  547. if( a != NULL )
  548. ecp_mpi_load( &grp->A, a, alen );
  549. ecp_mpi_load( &grp->B, b, blen );
  550. ecp_mpi_load( &grp->N, n, nlen );
  551. ecp_mpi_load( &grp->G.X, gx, gxlen );
  552. ecp_mpi_load( &grp->G.Y, gy, gylen );
  553. ecp_mpi_set1( &grp->G.Z );
  554. grp->pbits = mbedtls_mpi_bitlen( &grp->P );
  555. grp->nbits = mbedtls_mpi_bitlen( &grp->N );
  556. grp->h = 1;
  557. return( 0 );
  558. }
  559. #endif /* ECP_LOAD_GROUP */
  560. #if defined(MBEDTLS_ECP_NIST_OPTIM)
  561. /* Forward declarations */
  562. #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
  563. static int ecp_mod_p192( mbedtls_mpi * );
  564. #endif
  565. #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
  566. static int ecp_mod_p224( mbedtls_mpi * );
  567. #endif
  568. #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
  569. static int ecp_mod_p256( mbedtls_mpi * );
  570. #endif
  571. #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
  572. static int ecp_mod_p384( mbedtls_mpi * );
  573. #endif
  574. #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
  575. static int ecp_mod_p521( mbedtls_mpi * );
  576. #endif
  577. #define NIST_MODP( P ) grp->modp = ecp_mod_ ## P;
  578. #else
  579. #define NIST_MODP( P )
  580. #endif /* MBEDTLS_ECP_NIST_OPTIM */
  581. /* Additional forward declarations */
  582. #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
  583. static int ecp_mod_p255( mbedtls_mpi * );
  584. #endif
  585. #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
  586. static int ecp_mod_p448( mbedtls_mpi * );
  587. #endif
  588. #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
  589. static int ecp_mod_p192k1( mbedtls_mpi * );
  590. #endif
  591. #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
  592. static int ecp_mod_p224k1( mbedtls_mpi * );
  593. #endif
  594. #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
  595. static int ecp_mod_p256k1( mbedtls_mpi * );
  596. #endif
  597. #if defined(ECP_LOAD_GROUP)
  598. #define LOAD_GROUP_A( G ) ecp_group_load( grp, \
  599. G ## _p, sizeof( G ## _p ), \
  600. G ## _a, sizeof( G ## _a ), \
  601. G ## _b, sizeof( G ## _b ), \
  602. G ## _gx, sizeof( G ## _gx ), \
  603. G ## _gy, sizeof( G ## _gy ), \
  604. G ## _n, sizeof( G ## _n ) )
  605. #define LOAD_GROUP( G ) ecp_group_load( grp, \
  606. G ## _p, sizeof( G ## _p ), \
  607. NULL, 0, \
  608. G ## _b, sizeof( G ## _b ), \
  609. G ## _gx, sizeof( G ## _gx ), \
  610. G ## _gy, sizeof( G ## _gy ), \
  611. G ## _n, sizeof( G ## _n ) )
  612. #endif /* ECP_LOAD_GROUP */
  613. #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
  614. /* Constants used by ecp_use_curve25519() */
  615. static const mbedtls_mpi_sint curve25519_a24 = 0x01DB42;
  616. static const unsigned char curve25519_part_of_n[] = {
  617. 0x14, 0xDE, 0xF9, 0xDE, 0xA2, 0xF7, 0x9C, 0xD6,
  618. 0x58, 0x12, 0x63, 0x1A, 0x5C, 0xF5, 0xD3, 0xED,
  619. };
  620. /*
  621. * Specialized function for creating the Curve25519 group
  622. */
  623. static int ecp_use_curve25519( mbedtls_ecp_group *grp )
  624. {
  625. int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
  626. /* Actually ( A + 2 ) / 4 */
  627. MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->A, curve25519_a24 ) );
  628. /* P = 2^255 - 19 */
  629. MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->P, 1 ) );
  630. MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &grp->P, 255 ) );
  631. MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &grp->P, &grp->P, 19 ) );
  632. grp->pbits = mbedtls_mpi_bitlen( &grp->P );
  633. /* N = 2^252 + 27742317777372353535851937790883648493 */
  634. MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &grp->N,
  635. curve25519_part_of_n, sizeof( curve25519_part_of_n ) ) );
  636. MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &grp->N, 252, 1 ) );
  637. /* Y intentionally not set, since we use x/z coordinates.
  638. * This is used as a marker to identify Montgomery curves! */
  639. MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->G.X, 9 ) );
  640. MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->G.Z, 1 ) );
  641. mbedtls_mpi_free( &grp->G.Y );
  642. /* Actually, the required msb for private keys */
  643. grp->nbits = 254;
  644. cleanup:
  645. if( ret != 0 )
  646. mbedtls_ecp_group_free( grp );
  647. return( ret );
  648. }
  649. #endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
  650. #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
  651. /* Constants used by ecp_use_curve448() */
  652. static const mbedtls_mpi_sint curve448_a24 = 0x98AA;
  653. static const unsigned char curve448_part_of_n[] = {
  654. 0x83, 0x35, 0xDC, 0x16, 0x3B, 0xB1, 0x24,
  655. 0xB6, 0x51, 0x29, 0xC9, 0x6F, 0xDE, 0x93,
  656. 0x3D, 0x8D, 0x72, 0x3A, 0x70, 0xAA, 0xDC,
  657. 0x87, 0x3D, 0x6D, 0x54, 0xA7, 0xBB, 0x0D,
  658. };
  659. /*
  660. * Specialized function for creating the Curve448 group
  661. */
  662. static int ecp_use_curve448( mbedtls_ecp_group *grp )
  663. {
  664. mbedtls_mpi Ns;
  665. int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
  666. mbedtls_mpi_init( &Ns );
  667. /* Actually ( A + 2 ) / 4 */
  668. MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->A, curve448_a24 ) );
  669. /* P = 2^448 - 2^224 - 1 */
  670. MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->P, 1 ) );
  671. MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &grp->P, 224 ) );
  672. MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &grp->P, &grp->P, 1 ) );
  673. MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &grp->P, 224 ) );
  674. MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &grp->P, &grp->P, 1 ) );
  675. grp->pbits = mbedtls_mpi_bitlen( &grp->P );
  676. /* Y intentionally not set, since we use x/z coordinates.
  677. * This is used as a marker to identify Montgomery curves! */
  678. MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->G.X, 5 ) );
  679. MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &grp->G.Z, 1 ) );
  680. mbedtls_mpi_free( &grp->G.Y );
  681. /* N = 2^446 - 13818066809895115352007386748515426880336692474882178609894547503885 */
  682. MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( &grp->N, 446, 1 ) );
  683. MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &Ns,
  684. curve448_part_of_n, sizeof( curve448_part_of_n ) ) );
  685. MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &grp->N, &grp->N, &Ns ) );
  686. /* Actually, the required msb for private keys */
  687. grp->nbits = 447;
  688. cleanup:
  689. mbedtls_mpi_free( &Ns );
  690. if( ret != 0 )
  691. mbedtls_ecp_group_free( grp );
  692. return( ret );
  693. }
  694. #endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
  695. /*
  696. * Set a group using well-known domain parameters
  697. */
  698. int mbedtls_ecp_group_load( mbedtls_ecp_group *grp, mbedtls_ecp_group_id id )
  699. {
  700. ECP_VALIDATE_RET( grp != NULL );
  701. mbedtls_ecp_group_free( grp );
  702. grp->id = id;
  703. switch( id )
  704. {
  705. #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
  706. case MBEDTLS_ECP_DP_SECP192R1:
  707. NIST_MODP( p192 );
  708. return( LOAD_GROUP( secp192r1 ) );
  709. #endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
  710. #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
  711. case MBEDTLS_ECP_DP_SECP224R1:
  712. NIST_MODP( p224 );
  713. return( LOAD_GROUP( secp224r1 ) );
  714. #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
  715. #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
  716. case MBEDTLS_ECP_DP_SECP256R1:
  717. NIST_MODP( p256 );
  718. return( LOAD_GROUP( secp256r1 ) );
  719. #endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
  720. #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
  721. case MBEDTLS_ECP_DP_SECP384R1:
  722. NIST_MODP( p384 );
  723. return( LOAD_GROUP( secp384r1 ) );
  724. #endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
  725. #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
  726. case MBEDTLS_ECP_DP_SECP521R1:
  727. NIST_MODP( p521 );
  728. return( LOAD_GROUP( secp521r1 ) );
  729. #endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
  730. #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
  731. case MBEDTLS_ECP_DP_SECP192K1:
  732. grp->modp = ecp_mod_p192k1;
  733. return( LOAD_GROUP_A( secp192k1 ) );
  734. #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
  735. #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
  736. case MBEDTLS_ECP_DP_SECP224K1:
  737. grp->modp = ecp_mod_p224k1;
  738. return( LOAD_GROUP_A( secp224k1 ) );
  739. #endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
  740. #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
  741. case MBEDTLS_ECP_DP_SECP256K1:
  742. grp->modp = ecp_mod_p256k1;
  743. return( LOAD_GROUP_A( secp256k1 ) );
  744. #endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
  745. #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
  746. case MBEDTLS_ECP_DP_BP256R1:
  747. return( LOAD_GROUP_A( brainpoolP256r1 ) );
  748. #endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */
  749. #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
  750. case MBEDTLS_ECP_DP_BP384R1:
  751. return( LOAD_GROUP_A( brainpoolP384r1 ) );
  752. #endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */
  753. #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
  754. case MBEDTLS_ECP_DP_BP512R1:
  755. return( LOAD_GROUP_A( brainpoolP512r1 ) );
  756. #endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */
  757. #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
  758. case MBEDTLS_ECP_DP_CURVE25519:
  759. grp->modp = ecp_mod_p255;
  760. return( ecp_use_curve25519( grp ) );
  761. #endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
  762. #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
  763. case MBEDTLS_ECP_DP_CURVE448:
  764. grp->modp = ecp_mod_p448;
  765. return( ecp_use_curve448( grp ) );
  766. #endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
  767. default:
  768. grp->id = MBEDTLS_ECP_DP_NONE;
  769. return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
  770. }
  771. }
  772. #if defined(MBEDTLS_ECP_NIST_OPTIM)
  773. /*
  774. * Fast reduction modulo the primes used by the NIST curves.
  775. *
  776. * These functions are critical for speed, but not needed for correct
  777. * operations. So, we make the choice to heavily rely on the internals of our
  778. * bignum library, which creates a tight coupling between these functions and
  779. * our MPI implementation. However, the coupling between the ECP module and
  780. * MPI remains loose, since these functions can be deactivated at will.
  781. */
  782. #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
  783. /*
  784. * Compared to the way things are presented in FIPS 186-3 D.2,
  785. * we proceed in columns, from right (least significant chunk) to left,
  786. * adding chunks to N in place, and keeping a carry for the next chunk.
  787. * This avoids moving things around in memory, and uselessly adding zeros,
  788. * compared to the more straightforward, line-oriented approach.
  789. *
  790. * For this prime we need to handle data in chunks of 64 bits.
  791. * Since this is always a multiple of our basic mbedtls_mpi_uint, we can
  792. * use a mbedtls_mpi_uint * to designate such a chunk, and small loops to handle it.
  793. */
  794. /* Add 64-bit chunks (dst += src) and update carry */
  795. static inline void add64( mbedtls_mpi_uint *dst, mbedtls_mpi_uint *src, mbedtls_mpi_uint *carry )
  796. {
  797. unsigned char i;
  798. mbedtls_mpi_uint c = 0;
  799. for( i = 0; i < 8 / sizeof( mbedtls_mpi_uint ); i++, dst++, src++ )
  800. {
  801. *dst += c; c = ( *dst < c );
  802. *dst += *src; c += ( *dst < *src );
  803. }
  804. *carry += c;
  805. }
  806. /* Add carry to a 64-bit chunk and update carry */
  807. static inline void carry64( mbedtls_mpi_uint *dst, mbedtls_mpi_uint *carry )
  808. {
  809. unsigned char i;
  810. for( i = 0; i < 8 / sizeof( mbedtls_mpi_uint ); i++, dst++ )
  811. {
  812. *dst += *carry;
  813. *carry = ( *dst < *carry );
  814. }
  815. }
  816. #define WIDTH 8 / sizeof( mbedtls_mpi_uint )
  817. #define A( i ) N->p + (i) * WIDTH
  818. #define ADD( i ) add64( p, A( i ), &c )
  819. #define NEXT p += WIDTH; carry64( p, &c )
  820. #define LAST p += WIDTH; *p = c; while( ++p < end ) *p = 0
  821. /*
  822. * Fast quasi-reduction modulo p192 (FIPS 186-3 D.2.1)
  823. */
  824. static int ecp_mod_p192( mbedtls_mpi *N )
  825. {
  826. int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
  827. mbedtls_mpi_uint c = 0;
  828. mbedtls_mpi_uint *p, *end;
  829. /* Make sure we have enough blocks so that A(5) is legal */
  830. MBEDTLS_MPI_CHK( mbedtls_mpi_grow( N, 6 * WIDTH ) );
  831. p = N->p;
  832. end = p + N->n;
  833. ADD( 3 ); ADD( 5 ); NEXT; // A0 += A3 + A5
  834. ADD( 3 ); ADD( 4 ); ADD( 5 ); NEXT; // A1 += A3 + A4 + A5
  835. ADD( 4 ); ADD( 5 ); LAST; // A2 += A4 + A5
  836. cleanup:
  837. return( ret );
  838. }
  839. #undef WIDTH
  840. #undef A
  841. #undef ADD
  842. #undef NEXT
  843. #undef LAST
  844. #endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
  845. #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \
  846. defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
  847. defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
  848. /*
  849. * The reader is advised to first understand ecp_mod_p192() since the same
  850. * general structure is used here, but with additional complications:
  851. * (1) chunks of 32 bits, and (2) subtractions.
  852. */
  853. /*
  854. * For these primes, we need to handle data in chunks of 32 bits.
  855. * This makes it more complicated if we use 64 bits limbs in MPI,
  856. * which prevents us from using a uniform access method as for p192.
  857. *
  858. * So, we define a mini abstraction layer to access 32 bit chunks,
  859. * load them in 'cur' for work, and store them back from 'cur' when done.
  860. *
  861. * While at it, also define the size of N in terms of 32-bit chunks.
  862. */
  863. #define LOAD32 cur = A( i );
  864. #if defined(MBEDTLS_HAVE_INT32) /* 32 bit */
  865. #define MAX32 N->n
  866. #define A( j ) N->p[j]
  867. #define STORE32 N->p[i] = cur;
  868. #else /* 64-bit */
  869. #define MAX32 N->n * 2
  870. #define A( j ) (j) % 2 ? (uint32_t)( N->p[(j)/2] >> 32 ) : \
  871. (uint32_t)( N->p[(j)/2] )
  872. #define STORE32 \
  873. if( i % 2 ) { \
  874. N->p[i/2] &= 0x00000000FFFFFFFF; \
  875. N->p[i/2] |= ((mbedtls_mpi_uint) cur) << 32; \
  876. } else { \
  877. N->p[i/2] &= 0xFFFFFFFF00000000; \
  878. N->p[i/2] |= (mbedtls_mpi_uint) cur; \
  879. }
  880. #endif /* sizeof( mbedtls_mpi_uint ) */
  881. /*
  882. * Helpers for addition and subtraction of chunks, with signed carry.
  883. */
  884. static inline void add32( uint32_t *dst, uint32_t src, signed char *carry )
  885. {
  886. *dst += src;
  887. *carry += ( *dst < src );
  888. }
  889. static inline void sub32( uint32_t *dst, uint32_t src, signed char *carry )
  890. {
  891. *carry -= ( *dst < src );
  892. *dst -= src;
  893. }
  894. #define ADD( j ) add32( &cur, A( j ), &c );
  895. #define SUB( j ) sub32( &cur, A( j ), &c );
  896. #define ciL (sizeof(mbedtls_mpi_uint)) /* chars in limb */
  897. #define biL (ciL << 3) /* bits in limb */
  898. /*
  899. * Helpers for the main 'loop'
  900. */
  901. #define INIT( b ) \
  902. int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; \
  903. signed char c = 0, cc; \
  904. uint32_t cur; \
  905. size_t i = 0, bits = (b); \
  906. /* N is the size of the product of two b-bit numbers, plus one */ \
  907. /* limb for fix_negative */ \
  908. MBEDTLS_MPI_CHK( mbedtls_mpi_grow( N, ( b ) * 2 / biL + 1 ) ); \
  909. LOAD32;
  910. #define NEXT \
  911. STORE32; i++; LOAD32; \
  912. cc = c; c = 0; \
  913. if( cc < 0 ) \
  914. sub32( &cur, -cc, &c ); \
  915. else \
  916. add32( &cur, cc, &c ); \
  917. #define LAST \
  918. STORE32; i++; \
  919. cur = c > 0 ? c : 0; STORE32; \
  920. cur = 0; while( ++i < MAX32 ) { STORE32; } \
  921. if( c < 0 ) mbedtls_ecp_fix_negative( N, c, bits );
  922. /*
  923. * If the result is negative, we get it in the form
  924. * c * 2^bits + N, with c negative and N positive shorter than 'bits'
  925. */
  926. MBEDTLS_STATIC_TESTABLE
  927. void mbedtls_ecp_fix_negative( mbedtls_mpi *N, signed char c, size_t bits )
  928. {
  929. size_t i;
  930. /* Set N := 2^bits - 1 - N. We know that 0 <= N < 2^bits, so
  931. * set the absolute value to 0xfff...fff - N. There is no carry
  932. * since we're subtracting from all-bits-one. */
  933. for( i = 0; i <= bits / 8 / sizeof( mbedtls_mpi_uint ); i++ )
  934. {
  935. N->p[i] = ~(mbedtls_mpi_uint)0 - N->p[i];
  936. }
  937. /* Add 1, taking care of the carry. */
  938. i = 0;
  939. do
  940. ++N->p[i];
  941. while( N->p[i++] == 0 && i <= bits / 8 / sizeof( mbedtls_mpi_uint ) );
  942. /* Invert the sign.
  943. * Now N = N0 - 2^bits where N0 is the initial value of N. */
  944. N->s = -1;
  945. /* Add |c| * 2^bits to the absolute value. Since c and N are
  946. * negative, this adds c * 2^bits. */
  947. mbedtls_mpi_uint msw = (mbedtls_mpi_uint) -c;
  948. #if defined(MBEDTLS_HAVE_INT64)
  949. if( bits == 224 )
  950. msw <<= 32;
  951. #endif
  952. N->p[bits / 8 / sizeof( mbedtls_mpi_uint)] += msw;
  953. }
  954. #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
  955. /*
  956. * Fast quasi-reduction modulo p224 (FIPS 186-3 D.2.2)
  957. */
  958. static int ecp_mod_p224( mbedtls_mpi *N )
  959. {
  960. INIT( 224 );
  961. SUB( 7 ); SUB( 11 ); NEXT; // A0 += -A7 - A11
  962. SUB( 8 ); SUB( 12 ); NEXT; // A1 += -A8 - A12
  963. SUB( 9 ); SUB( 13 ); NEXT; // A2 += -A9 - A13
  964. SUB( 10 ); ADD( 7 ); ADD( 11 ); NEXT; // A3 += -A10 + A7 + A11
  965. SUB( 11 ); ADD( 8 ); ADD( 12 ); NEXT; // A4 += -A11 + A8 + A12
  966. SUB( 12 ); ADD( 9 ); ADD( 13 ); NEXT; // A5 += -A12 + A9 + A13
  967. SUB( 13 ); ADD( 10 ); LAST; // A6 += -A13 + A10
  968. cleanup:
  969. return( ret );
  970. }
  971. #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
  972. #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
  973. /*
  974. * Fast quasi-reduction modulo p256 (FIPS 186-3 D.2.3)
  975. */
  976. static int ecp_mod_p256( mbedtls_mpi *N )
  977. {
  978. INIT( 256 );
  979. ADD( 8 ); ADD( 9 );
  980. SUB( 11 ); SUB( 12 ); SUB( 13 ); SUB( 14 ); NEXT; // A0
  981. ADD( 9 ); ADD( 10 );
  982. SUB( 12 ); SUB( 13 ); SUB( 14 ); SUB( 15 ); NEXT; // A1
  983. ADD( 10 ); ADD( 11 );
  984. SUB( 13 ); SUB( 14 ); SUB( 15 ); NEXT; // A2
  985. ADD( 11 ); ADD( 11 ); ADD( 12 ); ADD( 12 ); ADD( 13 );
  986. SUB( 15 ); SUB( 8 ); SUB( 9 ); NEXT; // A3
  987. ADD( 12 ); ADD( 12 ); ADD( 13 ); ADD( 13 ); ADD( 14 );
  988. SUB( 9 ); SUB( 10 ); NEXT; // A4
  989. ADD( 13 ); ADD( 13 ); ADD( 14 ); ADD( 14 ); ADD( 15 );
  990. SUB( 10 ); SUB( 11 ); NEXT; // A5
  991. ADD( 14 ); ADD( 14 ); ADD( 15 ); ADD( 15 ); ADD( 14 ); ADD( 13 );
  992. SUB( 8 ); SUB( 9 ); NEXT; // A6
  993. ADD( 15 ); ADD( 15 ); ADD( 15 ); ADD( 8 );
  994. SUB( 10 ); SUB( 11 ); SUB( 12 ); SUB( 13 ); LAST; // A7
  995. cleanup:
  996. return( ret );
  997. }
  998. #endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
  999. #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
  1000. /*
  1001. * Fast quasi-reduction modulo p384 (FIPS 186-3 D.2.4)
  1002. */
  1003. static int ecp_mod_p384( mbedtls_mpi *N )
  1004. {
  1005. INIT( 384 );
  1006. ADD( 12 ); ADD( 21 ); ADD( 20 );
  1007. SUB( 23 ); NEXT; // A0
  1008. ADD( 13 ); ADD( 22 ); ADD( 23 );
  1009. SUB( 12 ); SUB( 20 ); NEXT; // A2
  1010. ADD( 14 ); ADD( 23 );
  1011. SUB( 13 ); SUB( 21 ); NEXT; // A2
  1012. ADD( 15 ); ADD( 12 ); ADD( 20 ); ADD( 21 );
  1013. SUB( 14 ); SUB( 22 ); SUB( 23 ); NEXT; // A3
  1014. ADD( 21 ); ADD( 21 ); ADD( 16 ); ADD( 13 ); ADD( 12 ); ADD( 20 ); ADD( 22 );
  1015. SUB( 15 ); SUB( 23 ); SUB( 23 ); NEXT; // A4
  1016. ADD( 22 ); ADD( 22 ); ADD( 17 ); ADD( 14 ); ADD( 13 ); ADD( 21 ); ADD( 23 );
  1017. SUB( 16 ); NEXT; // A5
  1018. ADD( 23 ); ADD( 23 ); ADD( 18 ); ADD( 15 ); ADD( 14 ); ADD( 22 );
  1019. SUB( 17 ); NEXT; // A6
  1020. ADD( 19 ); ADD( 16 ); ADD( 15 ); ADD( 23 );
  1021. SUB( 18 ); NEXT; // A7
  1022. ADD( 20 ); ADD( 17 ); ADD( 16 );
  1023. SUB( 19 ); NEXT; // A8
  1024. ADD( 21 ); ADD( 18 ); ADD( 17 );
  1025. SUB( 20 ); NEXT; // A9
  1026. ADD( 22 ); ADD( 19 ); ADD( 18 );
  1027. SUB( 21 ); NEXT; // A10
  1028. ADD( 23 ); ADD( 20 ); ADD( 19 );
  1029. SUB( 22 ); LAST; // A11
  1030. cleanup:
  1031. return( ret );
  1032. }
  1033. #endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
  1034. #undef A
  1035. #undef LOAD32
  1036. #undef STORE32
  1037. #undef MAX32
  1038. #undef INIT
  1039. #undef NEXT
  1040. #undef LAST
  1041. #endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED ||
  1042. MBEDTLS_ECP_DP_SECP256R1_ENABLED ||
  1043. MBEDTLS_ECP_DP_SECP384R1_ENABLED */
  1044. #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
  1045. /*
  1046. * Here we have an actual Mersenne prime, so things are more straightforward.
  1047. * However, chunks are aligned on a 'weird' boundary (521 bits).
  1048. */
  1049. /* Size of p521 in terms of mbedtls_mpi_uint */
  1050. #define P521_WIDTH ( 521 / 8 / sizeof( mbedtls_mpi_uint ) + 1 )
  1051. /* Bits to keep in the most significant mbedtls_mpi_uint */
  1052. #define P521_MASK 0x01FF
  1053. /*
  1054. * Fast quasi-reduction modulo p521 (FIPS 186-3 D.2.5)
  1055. * Write N as A1 + 2^521 A0, return A0 + A1
  1056. */
  1057. static int ecp_mod_p521( mbedtls_mpi *N )
  1058. {
  1059. int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
  1060. size_t i;
  1061. mbedtls_mpi M;
  1062. mbedtls_mpi_uint Mp[P521_WIDTH + 1];
  1063. /* Worst case for the size of M is when mbedtls_mpi_uint is 16 bits:
  1064. * we need to hold bits 513 to 1056, which is 34 limbs, that is
  1065. * P521_WIDTH + 1. Otherwise P521_WIDTH is enough. */
  1066. if( N->n < P521_WIDTH )
  1067. return( 0 );
  1068. /* M = A1 */
  1069. M.s = 1;
  1070. M.n = N->n - ( P521_WIDTH - 1 );
  1071. if( M.n > P521_WIDTH + 1 )
  1072. M.n = P521_WIDTH + 1;
  1073. M.p = Mp;
  1074. memcpy( Mp, N->p + P521_WIDTH - 1, M.n * sizeof( mbedtls_mpi_uint ) );
  1075. MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, 521 % ( 8 * sizeof( mbedtls_mpi_uint ) ) ) );
  1076. /* N = A0 */
  1077. N->p[P521_WIDTH - 1] &= P521_MASK;
  1078. for( i = P521_WIDTH; i < N->n; i++ )
  1079. N->p[i] = 0;
  1080. /* N = A0 + A1 */
  1081. MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
  1082. cleanup:
  1083. return( ret );
  1084. }
  1085. #undef P521_WIDTH
  1086. #undef P521_MASK
  1087. #endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
  1088. #endif /* MBEDTLS_ECP_NIST_OPTIM */
  1089. #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
  1090. /* Size of p255 in terms of mbedtls_mpi_uint */
  1091. #define P255_WIDTH ( 255 / 8 / sizeof( mbedtls_mpi_uint ) + 1 )
  1092. /*
  1093. * Fast quasi-reduction modulo p255 = 2^255 - 19
  1094. * Write N as A0 + 2^255 A1, return A0 + 19 * A1
  1095. */
  1096. static int ecp_mod_p255( mbedtls_mpi *N )
  1097. {
  1098. int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
  1099. size_t i;
  1100. mbedtls_mpi M;
  1101. mbedtls_mpi_uint Mp[P255_WIDTH + 2];
  1102. if( N->n < P255_WIDTH )
  1103. return( 0 );
  1104. /* M = A1 */
  1105. M.s = 1;
  1106. M.n = N->n - ( P255_WIDTH - 1 );
  1107. if( M.n > P255_WIDTH + 1 )
  1108. return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
  1109. M.p = Mp;
  1110. memset( Mp, 0, sizeof Mp );
  1111. memcpy( Mp, N->p + P255_WIDTH - 1, M.n * sizeof( mbedtls_mpi_uint ) );
  1112. MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, 255 % ( 8 * sizeof( mbedtls_mpi_uint ) ) ) );
  1113. M.n++; /* Make room for multiplication by 19 */
  1114. /* N = A0 */
  1115. MBEDTLS_MPI_CHK( mbedtls_mpi_set_bit( N, 255, 0 ) );
  1116. for( i = P255_WIDTH; i < N->n; i++ )
  1117. N->p[i] = 0;
  1118. /* N = A0 + 19 * A1 */
  1119. MBEDTLS_MPI_CHK( mbedtls_mpi_mul_int( &M, &M, 19 ) );
  1120. MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
  1121. cleanup:
  1122. return( ret );
  1123. }
  1124. #endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */
  1125. #if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
  1126. /* Size of p448 in terms of mbedtls_mpi_uint */
  1127. #define P448_WIDTH ( 448 / 8 / sizeof( mbedtls_mpi_uint ) )
  1128. /* Number of limbs fully occupied by 2^224 (max), and limbs used by it (min) */
  1129. #define DIV_ROUND_UP( X, Y ) ( ( ( X ) + ( Y ) - 1 ) / ( Y ) )
  1130. #define P224_WIDTH_MIN ( 28 / sizeof( mbedtls_mpi_uint ) )
  1131. #define P224_WIDTH_MAX DIV_ROUND_UP( 28, sizeof( mbedtls_mpi_uint ) )
  1132. #define P224_UNUSED_BITS ( ( P224_WIDTH_MAX * sizeof( mbedtls_mpi_uint ) * 8 ) - 224 )
  1133. /*
  1134. * Fast quasi-reduction modulo p448 = 2^448 - 2^224 - 1
  1135. * Write N as A0 + 2^448 A1 and A1 as B0 + 2^224 B1, and return
  1136. * A0 + A1 + B1 + (B0 + B1) * 2^224. This is different to the reference
  1137. * implementation of Curve448, which uses its own special 56-bit limbs rather
  1138. * than a generic bignum library. We could squeeze some extra speed out on
  1139. * 32-bit machines by splitting N up into 32-bit limbs and doing the
  1140. * arithmetic using the limbs directly as we do for the NIST primes above,
  1141. * but for 64-bit targets it should use half the number of operations if we do
  1142. * the reduction with 224-bit limbs, since mpi_add_mpi will then use 64-bit adds.
  1143. */
  1144. static int ecp_mod_p448( mbedtls_mpi *N )
  1145. {
  1146. int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
  1147. size_t i;
  1148. mbedtls_mpi M, Q;
  1149. mbedtls_mpi_uint Mp[P448_WIDTH + 1], Qp[P448_WIDTH];
  1150. if( N->n <= P448_WIDTH )
  1151. return( 0 );
  1152. /* M = A1 */
  1153. M.s = 1;
  1154. M.n = N->n - ( P448_WIDTH );
  1155. if( M.n > P448_WIDTH )
  1156. /* Shouldn't be called with N larger than 2^896! */
  1157. return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
  1158. M.p = Mp;
  1159. memset( Mp, 0, sizeof( Mp ) );
  1160. memcpy( Mp, N->p + P448_WIDTH, M.n * sizeof( mbedtls_mpi_uint ) );
  1161. /* N = A0 */
  1162. for( i = P448_WIDTH; i < N->n; i++ )
  1163. N->p[i] = 0;
  1164. /* N += A1 */
  1165. MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &M ) );
  1166. /* Q = B1, N += B1 */
  1167. Q = M;
  1168. Q.p = Qp;
  1169. memcpy( Qp, Mp, sizeof( Qp ) );
  1170. MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &Q, 224 ) );
  1171. MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &Q ) );
  1172. /* M = (B0 + B1) * 2^224, N += M */
  1173. if( sizeof( mbedtls_mpi_uint ) > 4 )
  1174. Mp[P224_WIDTH_MIN] &= ( (mbedtls_mpi_uint)-1 ) >> ( P224_UNUSED_BITS );
  1175. for( i = P224_WIDTH_MAX; i < M.n; ++i )
  1176. Mp[i] = 0;
  1177. MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &M, &M, &Q ) );
  1178. M.n = P448_WIDTH + 1; /* Make room for shifted carry bit from the addition */
  1179. MBEDTLS_MPI_CHK( mbedtls_mpi_shift_l( &M, 224 ) );
  1180. MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( N, N, &M ) );
  1181. cleanup:
  1182. return( ret );
  1183. }
  1184. #endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
  1185. #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) || \
  1186. defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) || \
  1187. defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
  1188. /*
  1189. * Fast quasi-reduction modulo P = 2^s - R,
  1190. * with R about 33 bits, used by the Koblitz curves.
  1191. *
  1192. * Write N as A0 + 2^224 A1, return A0 + R * A1.
  1193. * Actually do two passes, since R is big.
  1194. */
  1195. #define P_KOBLITZ_MAX ( 256 / 8 / sizeof( mbedtls_mpi_uint ) ) // Max limbs in P
  1196. #define P_KOBLITZ_R ( 8 / sizeof( mbedtls_mpi_uint ) ) // Limbs in R
  1197. static inline int ecp_mod_koblitz( mbedtls_mpi *N, mbedtls_mpi_uint *Rp, size_t p_limbs,
  1198. size_t adjust, size_t shift, mbedtls_mpi_uint mask )
  1199. {
  1200. int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
  1201. size_t i;
  1202. mbedtls_mpi M, R;
  1203. mbedtls_mpi_uint Mp[P_KOBLITZ_MAX + P_KOBLITZ_R + 1];
  1204. if( N->n < p_limbs )
  1205. return( 0 );
  1206. /* Init R */
  1207. R.s = 1;
  1208. R.p = Rp;
  1209. R.n = P_KOBLITZ_R;
  1210. /* Common setup for M */
  1211. M.s = 1;
  1212. M.p = Mp;
  1213. /* M = A1 */
  1214. M.n = N->n - ( p_limbs - adjust );
  1215. if( M.n > p_limbs + adjust )
  1216. M.n = p_limbs + adjust;
  1217. memset( Mp, 0, sizeof Mp );
  1218. memcpy( Mp, N->p + p_limbs - adjust, M.n * sizeof( mbedtls_mpi_uint ) );
  1219. if( shift != 0 )
  1220. MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, shift ) );
  1221. M.n += R.n; /* Make room for multiplication by R */
  1222. /* N = A0 */
  1223. if( mask != 0 )
  1224. N->p[p_limbs - 1] &= mask;
  1225. for( i = p_limbs; i < N->n; i++ )
  1226. N->p[i] = 0;
  1227. /* N = A0 + R * A1 */
  1228. MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &M, &M, &R ) );
  1229. MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
  1230. /* Second pass */
  1231. /* M = A1 */
  1232. M.n = N->n - ( p_limbs - adjust );
  1233. if( M.n > p_limbs + adjust )
  1234. M.n = p_limbs + adjust;
  1235. memset( Mp, 0, sizeof Mp );
  1236. memcpy( Mp, N->p + p_limbs - adjust, M.n * sizeof( mbedtls_mpi_uint ) );
  1237. if( shift != 0 )
  1238. MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &M, shift ) );
  1239. M.n += R.n; /* Make room for multiplication by R */
  1240. /* N = A0 */
  1241. if( mask != 0 )
  1242. N->p[p_limbs - 1] &= mask;
  1243. for( i = p_limbs; i < N->n; i++ )
  1244. N->p[i] = 0;
  1245. /* N = A0 + R * A1 */
  1246. MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &M, &M, &R ) );
  1247. MBEDTLS_MPI_CHK( mbedtls_mpi_add_abs( N, N, &M ) );
  1248. cleanup:
  1249. return( ret );
  1250. }
  1251. #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED) ||
  1252. MBEDTLS_ECP_DP_SECP224K1_ENABLED) ||
  1253. MBEDTLS_ECP_DP_SECP256K1_ENABLED) */
  1254. #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
  1255. /*
  1256. * Fast quasi-reduction modulo p192k1 = 2^192 - R,
  1257. * with R = 2^32 + 2^12 + 2^8 + 2^7 + 2^6 + 2^3 + 1 = 0x0100001119
  1258. */
  1259. static int ecp_mod_p192k1( mbedtls_mpi *N )
  1260. {
  1261. static mbedtls_mpi_uint Rp[] = {
  1262. MBEDTLS_BYTES_TO_T_UINT_8( 0xC9, 0x11, 0x00, 0x00, 0x01, 0x00, 0x00,
  1263. 0x00 ) };
  1264. return( ecp_mod_koblitz( N, Rp, 192 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0,
  1265. 0 ) );
  1266. }
  1267. #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
  1268. #if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
  1269. /*
  1270. * Fast quasi-reduction modulo p224k1 = 2^224 - R,
  1271. * with R = 2^32 + 2^12 + 2^11 + 2^9 + 2^7 + 2^4 + 2 + 1 = 0x0100001A93
  1272. */
  1273. static int ecp_mod_p224k1( mbedtls_mpi *N )
  1274. {
  1275. static mbedtls_mpi_uint Rp[] = {
  1276. MBEDTLS_BYTES_TO_T_UINT_8( 0x93, 0x1A, 0x00, 0x00, 0x01, 0x00, 0x00,
  1277. 0x00 ) };
  1278. #if defined(MBEDTLS_HAVE_INT64)
  1279. return( ecp_mod_koblitz( N, Rp, 4, 1, 32, 0xFFFFFFFF ) );
  1280. #else
  1281. return( ecp_mod_koblitz( N, Rp, 224 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0,
  1282. 0 ) );
  1283. #endif
  1284. }
  1285. #endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
  1286. #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
  1287. /*
  1288. * Fast quasi-reduction modulo p256k1 = 2^256 - R,
  1289. * with R = 2^32 + 2^9 + 2^8 + 2^7 + 2^6 + 2^4 + 1 = 0x01000003D1
  1290. */
  1291. static int ecp_mod_p256k1( mbedtls_mpi *N )
  1292. {
  1293. static mbedtls_mpi_uint Rp[] = {
  1294. MBEDTLS_BYTES_TO_T_UINT_8( 0xD1, 0x03, 0x00, 0x00, 0x01, 0x00, 0x00,
  1295. 0x00 ) };
  1296. return( ecp_mod_koblitz( N, Rp, 256 / 8 / sizeof( mbedtls_mpi_uint ), 0, 0,
  1297. 0 ) );
  1298. }
  1299. #endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
  1300. #endif /* !MBEDTLS_ECP_ALT */
  1301. #endif /* MBEDTLS_ECP_C */