Explicitly pass group generator to mul_double_nonct() from EC_POINT_mul().

EC_POINT_mul() has a complex multi-use interface - there are effectively
three different ways it will behave, depending on which arguments are NULL.
In the case where we compute g_scalar * generator + p_scalar * point, the
mul_double_nonct() function pointer is called, however only g_scalar,
p_scalar and point are passed - it is expected that the lower level
implementation (in this case ec_wnaf_mul()) will use the generator from
the group.

Change mul_double_nonct(), ec_mul_double_nonct() and ec_wnaf_mul() so that
they take scalar1, point1, scalar2 and point2. This removes all knowledge
of g_scalar and the generator from the multiplication code, keeping it
limited to EC_POINT_mul(). While here also consistently pass scalar then
point, rather than a mix of scalar/point and point/scalar.

ok tb@

1 files changed, 5 insertions, 5 deletions

diff --git a/src/lib/libcrypto/ec/ec_lib.c b/src/lib/libcrypto/ec/ec_lib.c
index 598038de1d..7982d23f06 100644
--- a/src/lib/libcrypto/ec/ec_lib.c
+++ b/src/lib/libcrypto/ec/ec_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_lib.c,v 1.122 2025/03/24 12:49:13 jsing Exp $ */
+/* $OpenBSD: ec_lib.c,v 1.123 2025/03/24 13:07:04 jsing Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -1333,8 +1333,8 @@ EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
                  * secret. This is why we ignore if BN_FLG_CONSTTIME is actually
                  * set and we always call the constant time version.
                  */
-                ret = group->meth->mul_single_ct(group, r, g_scalar,
-                    group->generator, ctx);
+                ret = group->meth->mul_single_ct(group, r,
+                    g_scalar, group->generator, ctx);
         } else if (g_scalar == NULL && point != NULL && p_scalar != NULL) {
                 /*
                  * In this case we want to compute p_scalar * GenericPoint:
@@ -1352,8 +1352,8 @@ EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
                  * this codepath is reached most prominently by ECDSA signature
                  * verification. So we call the non-ct version.
                  */
-                ret = group->meth->mul_double_nonct(group, r, g_scalar,
-                    p_scalar, point, ctx);
+                ret = group->meth->mul_double_nonct(group, r,
+                    g_scalar, group->generator, p_scalar, point, ctx);
         } else {
                 /* Anything else is an error. */
                 ECerror(ERR_R_EC_LIB);