ecp_sm2p256.c@ 108358

最後變更在這個檔案從108358是 108206,由 vboxsync 提交於 6 週前
openssl-3.3.2: Exported all files to OSE and removed .scm-settings bugref:10757
屬性 svn:eol-style 設為 `native` 屬性 svn:keywords 設為 `Author Date Id Revision`
檔案大小: 23.6 KB

行
1	/*
2	* Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the Apache License 2.0 (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*
9	*/
10
11	/*
12	* SM2 low level APIs are deprecated for public use, but still ok for
13	* internal use.
14	*/
15	#include "internal/deprecated.h"
16
17	#include <string.h>
18	#include <openssl/err.h>
19	#include "crypto/bn.h"
20	#include "ec_local.h"
21	#include "internal/common.h"
22	#include "internal/constant_time.h"
23
24	#define P256_LIMBS (256 / BN_BITS2)
25
26	#if !defined(OPENSSL_NO_SM2_PRECOMP)
27	extern const BN_ULONG ecp_sm2p256_precomputed[8 * 32 * 256];
28	#endif
29
30	typedef struct {
31	BN_ULONG X[P256_LIMBS];
32	BN_ULONG Y[P256_LIMBS];
33	BN_ULONG Z[P256_LIMBS];
34	} P256_POINT;
35
36	typedef struct {
37	BN_ULONG X[P256_LIMBS];
38	BN_ULONG Y[P256_LIMBS];
39	} P256_POINT_AFFINE;
40
41	#if !defined(OPENSSL_NO_SM2_PRECOMP)
42	/* Coordinates of G, for which we have precomputed tables */
43	ALIGN32 static const BN_ULONG def_xG[P256_LIMBS] = {
44	0x715a4589334c74c7, 0x8fe30bbff2660be1,
45	0x5f9904466a39c994, 0x32c4ae2c1f198119
46	};
47
48	ALIGN32 static const BN_ULONG def_yG[P256_LIMBS] = {
49	0x02df32e52139f0a0, 0xd0a9877cc62a4740,
50	0x59bdcee36b692153, 0xbc3736a2f4f6779c,
51	};
52	#endif
53
54	/* p and order for SM2 according to GB/T 32918.5-2017 */
55	ALIGN32 static const BN_ULONG def_p[P256_LIMBS] = {
56	0xffffffffffffffff, 0xffffffff00000000,
57	0xffffffffffffffff, 0xfffffffeffffffff
58	};
59	ALIGN32 static const BN_ULONG def_ord[P256_LIMBS] = {
60	0x53bbf40939d54123, 0x7203df6b21c6052b,
61	0xffffffffffffffff, 0xfffffffeffffffff
62	};
63
64	ALIGN32 static const BN_ULONG ONE[P256_LIMBS] = {1, 0, 0, 0};
65
66	/* Functions implemented in assembly */
67	/*
68	* Most of below mentioned functions preserve the property of inputs
69	* being fully reduced, i.e. being in [0, modulus) range. Simply put if
70	* inputs are fully reduced, then output is too.
71	*/
72	/* Right shift: a >> 1 */
73	void bn_rshift1(BN_ULONG *a);
74	/* Sub: r = a - b */
75	void bn_sub(BN_ULONG r, const BN_ULONG a, const BN_ULONG *b);
76	/* Modular div by 2: r = a / 2 mod p */
77	void ecp_sm2p256_div_by_2(BN_ULONG r, const BN_ULONG a);
78	/* Modular div by 2: r = a / 2 mod n, where n = ord(p) */
79	void ecp_sm2p256_div_by_2_mod_ord(BN_ULONG r, const BN_ULONG a);
80	/* Modular add: r = a + b mod p */
81	void ecp_sm2p256_add(BN_ULONG r, const BN_ULONG a, const BN_ULONG *b);
82	/* Modular sub: r = a - b mod p */
83	void ecp_sm2p256_sub(BN_ULONG r, const BN_ULONG a, const BN_ULONG *b);
84	/* Modular sub: r = a - b mod n, where n = ord(p) */
85	void ecp_sm2p256_sub_mod_ord(BN_ULONG r, const BN_ULONG a, const BN_ULONG *b);
86	/* Modular mul by 3: out = 3 * a mod p */
87	void ecp_sm2p256_mul_by_3(BN_ULONG r, const BN_ULONG a);
88	/* Modular mul: r = a * b mod p */
89	void ecp_sm2p256_mul(BN_ULONG r, const BN_ULONG a, const BN_ULONG *b);
90	/* Modular sqr: r = a ^ 2 mod p */
91	void ecp_sm2p256_sqr(BN_ULONG r, const BN_ULONG a);
92
93	static ossl_inline BN_ULONG is_zeros(const BN_ULONG *a)
94	{
95	BN_ULONG res;
96
97	res = a[0] \| a[1] \| a[2] \| a[3];
98
99	return constant_time_is_zero_64(res);
100	}
101
102	static ossl_inline int is_equal(const BN_ULONG a, const BN_ULONG b)
103	{
104	BN_ULONG res;
105
106	res = a[0] ^ b[0];
107	res \|= a[1] ^ b[1];
108	res \|= a[2] ^ b[2];
109	res \|= a[3] ^ b[3];
110
111	return constant_time_is_zero_64(res);
112	}
113
114	static ossl_inline int is_greater(const BN_ULONG a, const BN_ULONG b)
115	{
116	int i;
117
118	for (i = P256_LIMBS - 1; i >= 0; --i) {
119	if (a[i] > b[i])
120	return 1;
121	if (a[i] < b[i])
122	return -1;
123	}
124
125	return 0;
126	}
127
128	#define is_one(a) is_equal(a, ONE)
129	#define is_even(a) !(a[0] & 1)
130	#define is_point_equal(a, b) \
131	is_equal(a->X, b->X) && \
132	is_equal(a->Y, b->Y) && \
133	is_equal(a->Z, b->Z)
134
135	/* Bignum and field elements conversion */
136	#define ecp_sm2p256_bignum_field_elem(out, in) \
137	bn_copy_words(out, in, P256_LIMBS)
138
139	/* Binary algorithm for inversion in Fp */
140	#define BN_MOD_INV(out, in, mod_div, mod_sub, mod) \
141	do { \
142	ALIGN32 BN_ULONG u[4]; \
143	ALIGN32 BN_ULONG v[4]; \
144	ALIGN32 BN_ULONG x1[4] = {1, 0, 0, 0}; \
145	ALIGN32 BN_ULONG x2[4] = {0}; \
146	\
147	if (is_zeros(in)) \
148	return; \
149	memcpy(u, in, 32); \
150	memcpy(v, mod, 32); \
151	while (!is_one(u) && !is_one(v)) { \
152	while (is_even(u)) { \
153	bn_rshift1(u); \
154	mod_div(x1, x1); \
155	} \
156	while (is_even(v)) { \
157	bn_rshift1(v); \
158	mod_div(x2, x2); \
159	} \
160	if (is_greater(u, v) == 1) { \
161	bn_sub(u, u, v); \
162	mod_sub(x1, x1, x2); \
163	} else { \
164	bn_sub(v, v, u); \
165	mod_sub(x2, x2, x1); \
166	} \
167	} \
168	if (is_one(u)) \
169	memcpy(out, x1, 32); \
170	else \
171	memcpy(out, x2, 32); \
172	} while (0)
173
174	/* Modular inverse \|out\| = \|in\|^(-1) mod \|p\|. */
175	static ossl_inline void ecp_sm2p256_mod_inverse(BN_ULONG* out,
176	const BN_ULONG* in) {
177	BN_MOD_INV(out, in, ecp_sm2p256_div_by_2, ecp_sm2p256_sub, def_p);
178	}
179
180	/* Modular inverse mod order \|out\| = \|in\|^(-1) % \|ord\|. */
181	static ossl_inline void ecp_sm2p256_mod_ord_inverse(BN_ULONG* out,
182	const BN_ULONG* in) {
183	BN_MOD_INV(out, in, ecp_sm2p256_div_by_2_mod_ord, ecp_sm2p256_sub_mod_ord,
184	def_ord);
185	}
186
187	/* Point double: R <- P + P */
188	static void ecp_sm2p256_point_double(P256_POINT R, const P256_POINT P)
189	{
190	unsigned int i;
191	ALIGN32 BN_ULONG tmp0[P256_LIMBS];
192	ALIGN32 BN_ULONG tmp1[P256_LIMBS];
193	ALIGN32 BN_ULONG tmp2[P256_LIMBS];
194
195	/* zero-check P->Z */
196	if (is_zeros(P->Z)) {
197	for (i = 0; i < P256_LIMBS; ++i)
198	R->Z[i] = 0;
199
200	return;
201	}
202
203	ecp_sm2p256_sqr(tmp0, P->Z);
204	ecp_sm2p256_sub(tmp1, P->X, tmp0);
205	ecp_sm2p256_add(tmp0, P->X, tmp0);
206	ecp_sm2p256_mul(tmp1, tmp1, tmp0);
207	ecp_sm2p256_mul_by_3(tmp1, tmp1);
208	ecp_sm2p256_add(R->Y, P->Y, P->Y);
209	ecp_sm2p256_mul(R->Z, R->Y, P->Z);
210	ecp_sm2p256_sqr(R->Y, R->Y);
211	ecp_sm2p256_mul(tmp2, R->Y, P->X);
212	ecp_sm2p256_sqr(R->Y, R->Y);
213	ecp_sm2p256_div_by_2(R->Y, R->Y);
214	ecp_sm2p256_sqr(R->X, tmp1);
215	ecp_sm2p256_add(tmp0, tmp2, tmp2);
216	ecp_sm2p256_sub(R->X, R->X, tmp0);
217	ecp_sm2p256_sub(tmp0, tmp2, R->X);
218	ecp_sm2p256_mul(tmp0, tmp0, tmp1);
219	ecp_sm2p256_sub(tmp1, tmp0, R->Y);
220	memcpy(R->Y, tmp1, 32);
221	}
222
223	/* Point add affine: R <- P + Q */
224	static void ecp_sm2p256_point_add_affine(P256_POINT R, const P256_POINT P,
225	const P256_POINT_AFFINE *Q)
226	{
227	unsigned int i;
228	ALIGN32 BN_ULONG tmp0[P256_LIMBS] = {0};
229	ALIGN32 BN_ULONG tmp1[P256_LIMBS] = {0};
230	ALIGN32 BN_ULONG tmp2[P256_LIMBS] = {0};
231	ALIGN32 BN_ULONG tmp3[P256_LIMBS] = {0};
232
233	/* zero-check P->Z */
234	if (is_zeros(P->Z)) {
235	for (i = 0; i < P256_LIMBS; ++i) {
236	R->X[i] = Q->X[i];
237	R->Y[i] = Q->Y[i];
238	R->Z[i] = 0;
239	}
240	R->Z[0] = 1;
241
242	return;
243	}
244
245	ecp_sm2p256_sqr(tmp0, P->Z);
246	ecp_sm2p256_mul(tmp1, tmp0, P->Z);
247	ecp_sm2p256_mul(tmp0, tmp0, Q->X);
248	ecp_sm2p256_mul(tmp1, tmp1, Q->Y);
249	ecp_sm2p256_sub(tmp0, tmp0, P->X);
250	ecp_sm2p256_sub(tmp1, tmp1, P->Y);
251
252	/* zero-check tmp0, tmp1 */
253	if (is_zeros(tmp0)) {
254	if (is_zeros(tmp1)) {
255	P256_POINT K;
256
257	for (i = 0; i < P256_LIMBS; ++i) {
258	K.X[i] = Q->X[i];
259	K.Y[i] = Q->Y[i];
260	K.Z[i] = 0;
261	}
262	K.Z[0] = 1;
263	ecp_sm2p256_point_double(R, &K);
264	} else {
265	for (i = 0; i < P256_LIMBS; ++i)
266	R->Z[i] = 0;
267	}
268
269	return;
270	}
271
272	ecp_sm2p256_mul(R->Z, P->Z, tmp0);
273	ecp_sm2p256_sqr(tmp2, tmp0);
274	ecp_sm2p256_mul(tmp3, tmp2, tmp0);
275	ecp_sm2p256_mul(tmp2, tmp2, P->X);
276	ecp_sm2p256_add(tmp0, tmp2, tmp2);
277	ecp_sm2p256_sqr(R->X, tmp1);
278	ecp_sm2p256_sub(R->X, R->X, tmp0);
279	ecp_sm2p256_sub(R->X, R->X, tmp3);
280	ecp_sm2p256_sub(tmp2, tmp2, R->X);
281	ecp_sm2p256_mul(tmp2, tmp2, tmp1);
282	ecp_sm2p256_mul(tmp3, tmp3, P->Y);
283	ecp_sm2p256_sub(R->Y, tmp2, tmp3);
284	}
285
286	/* Point add: R <- P + Q */
287	static void ecp_sm2p256_point_add(P256_POINT R, const P256_POINT P,
288	const P256_POINT *Q)
289	{
290	unsigned int i;
291	ALIGN32 BN_ULONG tmp0[P256_LIMBS] = {0};
292	ALIGN32 BN_ULONG tmp1[P256_LIMBS] = {0};
293	ALIGN32 BN_ULONG tmp2[P256_LIMBS] = {0};
294
295	/* zero-check P \| Q ->Z */
296	if (is_zeros(P->Z)) {
297	for (i = 0; i < P256_LIMBS; ++i) {
298	R->X[i] = Q->X[i];
299	R->Y[i] = Q->Y[i];
300	R->Z[i] = Q->Z[i];
301	}
302
303	return;
304	} else if (is_zeros(Q->Z)) {
305	for (i = 0; i < P256_LIMBS; ++i) {
306	R->X[i] = P->X[i];
307	R->Y[i] = P->Y[i];
308	R->Z[i] = P->Z[i];
309	}
310
311	return;
312	} else if (is_point_equal(P, Q)) {
313	ecp_sm2p256_point_double(R, Q);
314
315	return;
316	}
317
318	ecp_sm2p256_sqr(tmp0, P->Z);
319	ecp_sm2p256_mul(tmp1, tmp0, P->Z);
320	ecp_sm2p256_mul(tmp0, tmp0, Q->X);
321	ecp_sm2p256_mul(tmp1, tmp1, Q->Y);
322	ecp_sm2p256_mul(R->Y, P->Y, Q->Z);
323	ecp_sm2p256_mul(R->Z, Q->Z, P->Z);
324	ecp_sm2p256_sqr(tmp2, Q->Z);
325	ecp_sm2p256_mul(R->Y, tmp2, R->Y);
326	ecp_sm2p256_mul(R->X, tmp2, P->X);
327	ecp_sm2p256_sub(tmp0, tmp0, R->X);
328	ecp_sm2p256_mul(R->Z, tmp0, R->Z);
329	ecp_sm2p256_sub(tmp1, tmp1, R->Y);
330	ecp_sm2p256_sqr(tmp2, tmp0);
331	ecp_sm2p256_mul(tmp0, tmp0, tmp2);
332	ecp_sm2p256_mul(tmp2, tmp2, R->X);
333	ecp_sm2p256_sqr(R->X, tmp1);
334	ecp_sm2p256_sub(R->X, R->X, tmp2);
335	ecp_sm2p256_sub(R->X, R->X, tmp2);
336	ecp_sm2p256_sub(R->X, R->X, tmp0);
337	ecp_sm2p256_sub(tmp2, tmp2, R->X);
338	ecp_sm2p256_mul(tmp2, tmp1, tmp2);
339	ecp_sm2p256_mul(tmp0, tmp0, R->Y);
340	ecp_sm2p256_sub(R->Y, tmp2, tmp0);
341	}
342
343	#if !defined(OPENSSL_NO_SM2_PRECOMP)
344	/* Base point mul by scalar: k - scalar, G - base point */
345	static void ecp_sm2p256_point_G_mul_by_scalar(P256_POINT R, const BN_ULONG k)
346	{
347	unsigned int i, index, mask = 0xff;
348	P256_POINT_AFFINE Q;
349
350	memset(R, 0, sizeof(P256_POINT));
351
352	if (is_zeros(k))
353	return;
354
355	index = k[0] & mask;
356	if (index) {
357	index = index * 8;
358	memcpy(R->X, ecp_sm2p256_precomputed + index, 32);
359	memcpy(R->Y, ecp_sm2p256_precomputed + index + P256_LIMBS, 32);
360	R->Z[0] = 1;
361	}
362
363	for (i = 1; i < 32; ++i) {
364	index = (k[i / 8] >> (8 * (i % 8))) & mask;
365
366	if (index) {
367	index = index + i * 256;
368	index = index * 8;
369	memcpy(Q.X, ecp_sm2p256_precomputed + index, 32);
370	memcpy(Q.Y, ecp_sm2p256_precomputed + index + P256_LIMBS, 32);
371	ecp_sm2p256_point_add_affine(R, R, &Q);
372	}
373	}
374	}
375	#endif
376
377	/*
378	* Affine point mul by scalar: k - scalar, P - affine point
379	*/
380	static void ecp_sm2p256_point_P_mul_by_scalar(P256_POINT R, const BN_ULONG k,
381	P256_POINT_AFFINE P)
382	{
383	int i, init = 0;
384	unsigned int index, mask = 0x0f;
385	ALIGN64 P256_POINT precomputed[16];
386
387	memset(R, 0, sizeof(P256_POINT));
388
389	if (is_zeros(k))
390	return;
391
392	/* The first value of the precomputed table is P. */
393	memcpy(precomputed[1].X, P.X, 32);
394	memcpy(precomputed[1].Y, P.Y, 32);
395	precomputed[1].Z[0] = 1;
396	precomputed[1].Z[1] = 0;
397	precomputed[1].Z[2] = 0;
398	precomputed[1].Z[3] = 0;
399
400	/* The second value of the precomputed table is 2P. */
401	ecp_sm2p256_point_double(&precomputed[2], &precomputed[1]);
402
403	/* The subsequent elements are 3P, 4P, and so on. */
404	for (i = 3; i < 16; ++i)
405	ecp_sm2p256_point_add_affine(&precomputed[i], &precomputed[i - 1], &P);
406
407	for (i = 64 - 1; i >= 0; --i) {
408	index = (k[i / 16] >> (4 * (i % 16))) & mask;
409
410	if (init == 0) {
411	if (index) {
412	memcpy(R, &precomputed[index], sizeof(P256_POINT));
413	init = 1;
414	}
415	} else {
416	ecp_sm2p256_point_double(R, R);
417	ecp_sm2p256_point_double(R, R);
418	ecp_sm2p256_point_double(R, R);
419	ecp_sm2p256_point_double(R, R);
420	if (index)
421	ecp_sm2p256_point_add(R, R, &precomputed[index]);
422	}
423	}
424	}
425
426	/* Get affine point */
427	static void ecp_sm2p256_point_get_affine(P256_POINT_AFFINE *R,
428	const P256_POINT *P)
429	{
430	ALIGN32 BN_ULONG z_inv3[P256_LIMBS] = {0};
431	ALIGN32 BN_ULONG z_inv2[P256_LIMBS] = {0};
432
433	if (is_one(P->Z)) {
434	memcpy(R->X, P->X, 32);
435	memcpy(R->Y, P->Y, 32);
436	return;
437	}
438
439	ecp_sm2p256_mod_inverse(z_inv3, P->Z);
440	ecp_sm2p256_sqr(z_inv2, z_inv3);
441	ecp_sm2p256_mul(R->X, P->X, z_inv2);
442	ecp_sm2p256_mul(z_inv3, z_inv3, z_inv2);
443	ecp_sm2p256_mul(R->Y, P->Y, z_inv3);
444	}
445
446	#if !defined(OPENSSL_NO_SM2_PRECOMP)
447	static int ecp_sm2p256_is_affine_G(const EC_POINT *generator)
448	{
449	return (bn_get_top(generator->X) == P256_LIMBS)
450	&& (bn_get_top(generator->Y) == P256_LIMBS)
451	&& is_equal(bn_get_words(generator->X), def_xG)
452	&& is_equal(bn_get_words(generator->Y), def_yG)
453	&& (generator->Z_is_one == 1);
454	}
455	#endif
456
457	/*
458	* Convert Jacobian coordinate point into affine coordinate (x,y)
459	*/
460	static int ecp_sm2p256_get_affine(const EC_GROUP *group,
461	const EC_POINT *point,
462	BIGNUM x, BIGNUM y, BN_CTX *ctx)
463	{
464	ALIGN32 BN_ULONG z_inv2[P256_LIMBS] = {0};
465	ALIGN32 BN_ULONG z_inv3[P256_LIMBS] = {0};
466	ALIGN32 BN_ULONG x_aff[P256_LIMBS] = {0};
467	ALIGN32 BN_ULONG y_aff[P256_LIMBS] = {0};
468	ALIGN32 BN_ULONG point_x[P256_LIMBS] = {0};
469	ALIGN32 BN_ULONG point_y[P256_LIMBS] = {0};
470	ALIGN32 BN_ULONG point_z[P256_LIMBS] = {0};
471
472	if (EC_POINT_is_at_infinity(group, point)) {
473	ECerr(ERR_LIB_EC, EC_R_POINT_AT_INFINITY);
474	return 0;
475	}
476
477	if (ecp_sm2p256_bignum_field_elem(point_x, point->X) <= 0
478	\|\| ecp_sm2p256_bignum_field_elem(point_y, point->Y) <= 0
479	\|\| ecp_sm2p256_bignum_field_elem(point_z, point->Z) <= 0) {
480	ECerr(ERR_LIB_EC, EC_R_COORDINATES_OUT_OF_RANGE);
481	return 0;
482	}
483
484	ecp_sm2p256_mod_inverse(z_inv3, point_z);
485	ecp_sm2p256_sqr(z_inv2, z_inv3);
486
487	if (x != NULL) {
488	ecp_sm2p256_mul(x_aff, point_x, z_inv2);
489	if (!bn_set_words(x, x_aff, P256_LIMBS))
490	return 0;
491	}
492
493	if (y != NULL) {
494	ecp_sm2p256_mul(z_inv3, z_inv3, z_inv2);
495	ecp_sm2p256_mul(y_aff, point_y, z_inv3);
496	if (!bn_set_words(y, y_aff, P256_LIMBS))
497	return 0;
498	}
499
500	return 1;
501	}
502
503	/* r = sum(scalar[i]point[i]) /
504	static int ecp_sm2p256_windowed_mul(const EC_GROUP *group,
505	P256_POINT *r,
506	const BIGNUM **scalar,
507	const EC_POINT **point,
508	size_t num, BN_CTX *ctx)
509	{
510	unsigned int i;
511	int ret = 0;
512	const BIGNUM **scalars = NULL;
513	ALIGN32 BN_ULONG k[P256_LIMBS] = {0};
514	P256_POINT kP;
515	ALIGN32 union {
516	P256_POINT p;
517	P256_POINT_AFFINE a;
518	} t, p;
519
520	if (num > OPENSSL_MALLOC_MAX_NELEMS(P256_POINT)
521	\|\| (scalars = OPENSSL_malloc(num * sizeof(BIGNUM *))) == NULL) {
522	ECerr(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
523	goto err;
524	}
525
526	memset(r, 0, sizeof(P256_POINT));
527
528	for (i = 0; i < num; i++) {
529	if (EC_POINT_is_at_infinity(group, point[i]))
530	continue;
531
532	if ((BN_num_bits(scalar[i]) > 256) \|\| BN_is_negative(scalar[i])) {
533	BIGNUM *tmp;
534
535	if ((tmp = BN_CTX_get(ctx)) == NULL)
536	goto err;
537	if (!BN_nnmod(tmp, scalar[i], group->order, ctx)) {
538	ECerr(ERR_LIB_EC, ERR_R_BN_LIB);
539	goto err;
540	}
541	scalars[i] = tmp;
542	} else {
543	scalars[i] = scalar[i];
544	}
545
546	if (ecp_sm2p256_bignum_field_elem(k, scalars[i]) <= 0
547	\|\| ecp_sm2p256_bignum_field_elem(p.p.X, point[i]->X) <= 0
548	\|\| ecp_sm2p256_bignum_field_elem(p.p.Y, point[i]->Y) <= 0
549	\|\| ecp_sm2p256_bignum_field_elem(p.p.Z, point[i]->Z) <= 0) {
550	ECerr(ERR_LIB_EC, EC_R_COORDINATES_OUT_OF_RANGE);
551	goto err;
552	}
553
554	ecp_sm2p256_point_get_affine(&t.a, &p.p);
555	ecp_sm2p256_point_P_mul_by_scalar(&kP, k, t.a);
556	ecp_sm2p256_point_add(r, r, &kP);
557	}
558
559	ret = 1;
560	err:
561	OPENSSL_free(scalars);
562	return ret;
563	}
564
565	/* r = scalarG + sum(scalars[i]points[i]) */
566	static int ecp_sm2p256_points_mul(const EC_GROUP *group,
567	EC_POINT *r,
568	const BIGNUM *scalar,
569	size_t num,
570	const EC_POINT *points[],
571	const BIGNUM scalars[], BN_CTX ctx)
572	{
573	int ret = 0, p_is_infinity = 0;
574	const EC_POINT *generator = NULL;
575	ALIGN32 BN_ULONG k[P256_LIMBS] = {0};
576	ALIGN32 union {
577	P256_POINT p;
578	P256_POINT_AFFINE a;
579	} t, p;
580
581	if ((num + 1) == 0 \|\| (num + 1) > OPENSSL_MALLOC_MAX_NELEMS(void *)) {
582	ECerr(ERR_LIB_EC, ERR_R_MALLOC_FAILURE);
583	goto err;
584	}
585
586	BN_CTX_start(ctx);
587
588	if (scalar) {
589	generator = EC_GROUP_get0_generator(group);
590	if (generator == NULL) {
591	ECerr(ERR_LIB_EC, EC_R_UNDEFINED_GENERATOR);
592	goto err;
593	}
594
595	if (!ecp_sm2p256_bignum_field_elem(k, scalar)) {
596	ECerr(ERR_LIB_EC, EC_R_COORDINATES_OUT_OF_RANGE);
597	goto err;
598	}
599	#if !defined(OPENSSL_NO_SM2_PRECOMP)
600	if (ecp_sm2p256_is_affine_G(generator)) {
601	ecp_sm2p256_point_G_mul_by_scalar(&p.p, k);
602	} else
603	#endif
604	{
605	/* if no precomputed table */
606	const EC_POINT *new_generator[1];
607	const BIGNUM *g_scalars[1];
608
609	new_generator[0] = generator;
610	g_scalars[0] = scalar;
611
612	if (!ecp_sm2p256_windowed_mul(group, &p.p, g_scalars, new_generator,
613	(new_generator[0] != NULL
614	&& g_scalars[0] != NULL), ctx))
615	goto err;
616	}
617	} else {
618	p_is_infinity = 1;
619	}
620	if (num) {
621	P256_POINT *out = &t.p;
622
623	if (p_is_infinity)
624	out = &p.p;
625
626	if (!ecp_sm2p256_windowed_mul(group, out, scalars, points, num, ctx))
627	goto err;
628
629	if (!p_is_infinity)
630	ecp_sm2p256_point_add(&p.p, &p.p, out);
631	}
632
633	/* Not constant-time, but we're only operating on the public output. */
634	if (!bn_set_words(r->X, p.p.X, P256_LIMBS)
635	\|\| !bn_set_words(r->Y, p.p.Y, P256_LIMBS)
636	\|\| !bn_set_words(r->Z, p.p.Z, P256_LIMBS))
637	goto err;
638	r->Z_is_one = is_equal(bn_get_words(r->Z), ONE) & 1;
639
640	ret = 1;
641	err:
642	BN_CTX_end(ctx);
643	return ret;
644	}
645
646	static int ecp_sm2p256_field_mul(const EC_GROUP group, BIGNUM r,
647	const BIGNUM a, const BIGNUM b, BN_CTX *ctx)
648	{
649	ALIGN32 BN_ULONG a_fe[P256_LIMBS] = {0};
650	ALIGN32 BN_ULONG b_fe[P256_LIMBS] = {0};
651	ALIGN32 BN_ULONG r_fe[P256_LIMBS] = {0};
652
653	if (a == NULL \|\| b == NULL \|\| r == NULL)
654	return 0;
655
656	if (!ecp_sm2p256_bignum_field_elem(a_fe, a)
657	\|\| !ecp_sm2p256_bignum_field_elem(b_fe, b)) {
658	ECerr(ERR_LIB_EC, EC_R_COORDINATES_OUT_OF_RANGE);
659	return 0;
660	}
661
662	ecp_sm2p256_mul(r_fe, a_fe, b_fe);
663
664	if (!bn_set_words(r, r_fe, P256_LIMBS))
665	return 0;
666
667	return 1;
668	}
669
670	static int ecp_sm2p256_field_sqr(const EC_GROUP group, BIGNUM r,
671	const BIGNUM a, BN_CTX ctx)
672	{
673	ALIGN32 BN_ULONG a_fe[P256_LIMBS] = {0};
674	ALIGN32 BN_ULONG r_fe[P256_LIMBS] = {0};
675
676	if (a == NULL \|\| r == NULL)
677	return 0;
678
679	if (!ecp_sm2p256_bignum_field_elem(a_fe, a)) {
680	ECerr(ERR_LIB_EC, EC_R_COORDINATES_OUT_OF_RANGE);
681	return 0;
682	}
683
684	ecp_sm2p256_sqr(r_fe, a_fe);
685
686	if (!bn_set_words(r, r_fe, P256_LIMBS))
687	return 0;
688
689	return 1;
690	}
691
692	static int ecp_sm2p256_inv_mod_ord(const EC_GROUP group, BIGNUM r,
693	const BIGNUM x, BN_CTX ctx)
694	{
695	int ret = 0;
696	ALIGN32 BN_ULONG t[P256_LIMBS] = {0};
697	ALIGN32 BN_ULONG out[P256_LIMBS] = {0};
698
699	if (bn_wexpand(r, P256_LIMBS) == NULL) {
700	ECerr(ERR_LIB_EC, ERR_R_BN_LIB);
701	goto err;
702	}
703
704	if ((BN_num_bits(x) > 256) \|\| BN_is_negative(x)) {
705	BIGNUM *tmp;
706
707	if ((tmp = BN_CTX_get(ctx)) == NULL
708	\|\| !BN_nnmod(tmp, x, group->order, ctx)) {
709	ECerr(ERR_LIB_EC, ERR_R_BN_LIB);
710	goto err;
711	}
712	x = tmp;
713	}
714
715	if (!ecp_sm2p256_bignum_field_elem(t, x)) {
716	ECerr(ERR_LIB_EC, EC_R_COORDINATES_OUT_OF_RANGE);
717	goto err;
718	}
719
720	ecp_sm2p256_mod_ord_inverse(out, t);
721
722	if (!bn_set_words(r, out, P256_LIMBS))
723	goto err;
724
725	ret = 1;
726	err:
727	return ret;
728	}
729
730	const EC_METHOD *EC_GFp_sm2p256_method(void)
731	{
732	static const EC_METHOD ret = {
733	EC_FLAGS_DEFAULT_OCT,
734	NID_X9_62_prime_field,
735	ossl_ec_GFp_simple_group_init,
736	ossl_ec_GFp_simple_group_finish,
737	ossl_ec_GFp_simple_group_clear_finish,
738	ossl_ec_GFp_simple_group_copy,
739	ossl_ec_GFp_simple_group_set_curve,
740	ossl_ec_GFp_simple_group_get_curve,
741	ossl_ec_GFp_simple_group_get_degree,
742	ossl_ec_group_simple_order_bits,
743	ossl_ec_GFp_simple_group_check_discriminant,
744	ossl_ec_GFp_simple_point_init,
745	ossl_ec_GFp_simple_point_finish,
746	ossl_ec_GFp_simple_point_clear_finish,
747	ossl_ec_GFp_simple_point_copy,
748	ossl_ec_GFp_simple_point_set_to_infinity,
749	ossl_ec_GFp_simple_point_set_affine_coordinates,
750	ecp_sm2p256_get_affine,
751	0, 0, 0,
752	ossl_ec_GFp_simple_add,
753	ossl_ec_GFp_simple_dbl,
754	ossl_ec_GFp_simple_invert,
755	ossl_ec_GFp_simple_is_at_infinity,
756	ossl_ec_GFp_simple_is_on_curve,
757	ossl_ec_GFp_simple_cmp,
758	ossl_ec_GFp_simple_make_affine,
759	ossl_ec_GFp_simple_points_make_affine,
760	ecp_sm2p256_points_mul, /* mul */
761	0 /* precompute_mult */,
762	0 /* have_precompute_mult */,
763	ecp_sm2p256_field_mul,
764	ecp_sm2p256_field_sqr,
765	0 /* field_div */,
766	0 /* field_inv */,
767	0 /* field_encode */,
768	0 /* field_decode */,
769	0 /* field_set_to_one */,
770	ossl_ec_key_simple_priv2oct,
771	ossl_ec_key_simple_oct2priv,
772	0, /* set private */
773	ossl_ec_key_simple_generate_key,
774	ossl_ec_key_simple_check_key,
775	ossl_ec_key_simple_generate_public_key,
776	0, /* keycopy */
777	0, /* keyfinish */
778	ossl_ecdh_simple_compute_key,
779	ossl_ecdsa_simple_sign_setup,
780	ossl_ecdsa_simple_sign_sig,
781	ossl_ecdsa_simple_verify_sig,
782	ecp_sm2p256_inv_mod_ord,
783	0, /* blind_coordinates */
784	0, /* ladder_pre */
785	0, /* ladder_step */
786	0 /* ladder_post */
787	};
788
789	return &ret;
790	}

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/libs/openssl-3.3.2/crypto/ec/ecp_sm2p256.c@ 108358

以其他格式下載: