Rename group->field to group->p

Now that we only do curves over GF(p) fields, there's no need to use a
weird, confusing name for what we usually call p. Adjust some comments
in the vicinity as well.

4 files changed, 46 insertions, 52 deletions

diff --git a/src/lib/libcrypto/ec/ec_convert.c b/src/lib/libcrypto/ec/ec_convert.c
index a4237cda95..f2410c163c 100644
--- a/src/lib/libcrypto/ec/ec_convert.c
+++ b/src/lib/libcrypto/ec/ec_convert.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_convert.c,v 1.11 2024/11/08 02:24:37 tb Exp $ */
+/* $OpenBSD: ec_convert.c,v 1.12 2024/12/12 10:00:15 tb Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -157,11 +157,11 @@ ec_encoded_length(const EC_GROUP *group, uint8_t form, size_t *out_len)
                 *out_len = 1;
                 return 1;
         case EC_POINT_COMPRESSED:
-                *out_len = 1 + BN_num_bytes(&group->field);
+                *out_len = 1 + BN_num_bytes(&group->p);
                 return 1;
         case EC_POINT_UNCOMPRESSED:
         case EC_POINT_HYBRID:
-                *out_len = 1 + 2 * BN_num_bytes(&group->field);
+                *out_len = 1 + 2 * BN_num_bytes(&group->p);
                 return 1;
         default:
                 return 0;
@@ -171,15 +171,15 @@ ec_encoded_length(const EC_GROUP *group, uint8_t form, size_t *out_len)
 static int
 ec_field_element_is_valid(const EC_GROUP *group, const BIGNUM *bn)
 {
-        /* Ensure bn is in the range [0, field). */
-        return !BN_is_negative(bn) && BN_cmp(&group->field, bn) > 0;
+        /* Ensure bn is in the range [0, p). */
+        return !BN_is_negative(bn) && BN_cmp(&group->p, bn) > 0;
 }
 
 static int
 ec_add_field_element_cbb(CBB *cbb, const EC_GROUP *group, const BIGNUM *bn)
 {
         uint8_t *buf = NULL;
-        int buf_len = BN_num_bytes(&group->field);
+        int buf_len = BN_num_bytes(&group->p);
 
         if (!ec_field_element_is_valid(group, bn)) {
                 ECerror(EC_R_BIGNUM_OUT_OF_RANGE);
@@ -202,7 +202,7 @@ ec_get_field_element_cbs(CBS *cbs, const EC_GROUP *group, BIGNUM *bn)
 {
         CBS field_element;
 
-        if (!CBS_get_bytes(cbs, &field_element, BN_num_bytes(&group->field))) {
+        if (!CBS_get_bytes(cbs, &field_element, BN_num_bytes(&group->p))) {
                 ECerror(EC_R_INVALID_ENCODING);
                 return 0;
         }
diff --git a/src/lib/libcrypto/ec/ec_lib.c b/src/lib/libcrypto/ec/ec_lib.c
index a1c80c328b..9f1a742d38 100644
--- a/src/lib/libcrypto/ec/ec_lib.c
+++ b/src/lib/libcrypto/ec/ec_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_lib.c,v 1.89 2024/11/30 21:09:59 tb Exp $ */
+/* $OpenBSD: ec_lib.c,v 1.90 2024/12/12 10:00:15 tb Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -275,8 +275,7 @@ ec_set_cofactor(EC_GROUP *group, const BIGNUM *in_cofactor)
          * If the cofactor is too large, we cannot guess it and default to zero.
          * The RHS of below is a strict overestimate of log(4 * sqrt(q)).
          */
-        if (BN_num_bits(&group->order) <=
-            (BN_num_bits(&group->field) + 1) / 2 + 3)
+        if (BN_num_bits(&group->order) <= (BN_num_bits(&group->p) + 1) / 2 + 3)
                 goto done;
 
         /*
@@ -291,7 +290,7 @@ ec_set_cofactor(EC_GROUP *group, const BIGNUM *in_cofactor)
         if (!BN_add_word(cofactor, 1))
                 goto err;
         /* h = q + 1 + n/2 */
-        if (!BN_add(cofactor, cofactor, &group->field))
+        if (!BN_add(cofactor, cofactor, &group->p))
                 goto err;
         /* h = (q + 1 + n/2) / n */
         if (!BN_div_ct(cofactor, NULL, cofactor, &group->order, ctx))
@@ -299,7 +298,7 @@ ec_set_cofactor(EC_GROUP *group, const BIGNUM *in_cofactor)
 
  done:
         /* Use Hasse's theorem to bound the cofactor. */
-        if (BN_num_bits(cofactor) > BN_num_bits(&group->field) + 1) {
+        if (BN_num_bits(cofactor) > BN_num_bits(&group->p) + 1) {
                 ECerror(EC_R_INVALID_GROUP_ORDER);
                 goto err;
         }
@@ -325,8 +324,8 @@ EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
                 return 0;
         }
 
-        /* Require group->field >= 1. */
-        if (BN_is_zero(&group->field) || BN_is_negative(&group->field)) {
+        /* Require p >= 1. */
+        if (BN_is_zero(&group->p) || BN_is_negative(&group->p)) {
                 ECerror(EC_R_INVALID_FIELD);
                 return 0;
         }
@@ -336,7 +335,7 @@ EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
          * than the field cardinality due to Hasse's theorem.
          */
         if (order == NULL || BN_cmp(order, BN_value_one()) <= 0 ||
-            BN_num_bits(order) > BN_num_bits(&group->field) + 1) {
+            BN_num_bits(order) > BN_num_bits(&group->p) + 1) {
                 ECerror(EC_R_INVALID_GROUP_ORDER);
                 return 0;
         }
diff --git a/src/lib/libcrypto/ec/ec_local.h b/src/lib/libcrypto/ec/ec_local.h
index da706d5324..ea1cd7adad 100644
--- a/src/lib/libcrypto/ec/ec_local.h
+++ b/src/lib/libcrypto/ec/ec_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_local.h,v 1.42 2024/12/06 15:49:37 tb Exp $ */
+/* $OpenBSD: ec_local.h,v 1.43 2024/12/12 10:00:15 tb Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -181,16 +181,11 @@ struct ec_group_st {
          */
 
         /*
-         * Field specification. For GF(p) this is the modulus; for GF(2^m),
-         * this is the irreducible polynomial defining the field.
+         * Coefficients of the Weierstrass equation y^2 = x^3 + a*x + b (mod p).
          */
-        BIGNUM field;
-
-        /*
-         * Curve coefficients. In characteristic > 3, the curve is defined by a
-         * Weierstrass equation of the form y^2 = x^3 + a*x + b.
-         */
-        BIGNUM a, b;
+        BIGNUM p;
+        BIGNUM a;
+        BIGNUM b;
 
         /* Enables optimized point arithmetics for special case. */
         int a_is_minus3;
diff --git a/src/lib/libcrypto/ec/ecp_methods.c b/src/lib/libcrypto/ec/ecp_methods.c
index 50607ea216..8f04a24e28 100644
--- a/src/lib/libcrypto/ec/ecp_methods.c
+++ b/src/lib/libcrypto/ec/ecp_methods.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ecp_methods.c,v 1.13 2024/12/06 15:49:37 tb Exp $ */
+/* $OpenBSD: ecp_methods.c,v 1.14 2024/12/12 10:00:15 tb Exp $ */
 /* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
  * for the OpenSSL project.
  * Includes code written by Bodo Moeller for the OpenSSL project.
@@ -87,7 +87,7 @@
 static int
 ec_group_init(EC_GROUP *group)
 {
-        BN_init(&group->field);
+        BN_init(&group->p);
         BN_init(&group->a);
         BN_init(&group->b);
         group->a_is_minus3 = 0;
@@ -97,7 +97,7 @@ ec_group_init(EC_GROUP *group)
 static void
 ec_group_finish(EC_GROUP *group)
 {
-        BN_free(&group->field);
+        BN_free(&group->p);
         BN_free(&group->a);
         BN_free(&group->b);
 }
@@ -105,7 +105,7 @@ ec_group_finish(EC_GROUP *group)
 static int
 ec_group_copy(EC_GROUP *dest, const EC_GROUP *src)
 {
-        if (!bn_copy(&dest->field, &src->field))
+        if (!bn_copy(&dest->p, &src->p))
                 return 0;
         if (!bn_copy(&dest->a, &src->a))
                 return 0;
@@ -132,7 +132,7 @@ ec_decode_scalar(const EC_GROUP *group, BIGNUM *bn, const BIGNUM *x, BN_CTX *ctx
 static int
 ec_encode_scalar(const EC_GROUP *group, BIGNUM *bn, const BIGNUM *x, BN_CTX *ctx)
 {
-        if (!BN_nnmod(bn, x, &group->field, ctx))
+        if (!BN_nnmod(bn, x, &group->p, ctx))
                 return 0;
 
         if (group->meth->field_encode != NULL)
@@ -145,7 +145,7 @@ static int
 ec_encode_z_coordinate(const EC_GROUP *group, BIGNUM *bn, int *is_one,
     const BIGNUM *z, BN_CTX *ctx)
 {
-        if (!BN_nnmod(bn, z, &group->field, ctx))
+        if (!BN_nnmod(bn, z, &group->p, ctx))
                 return 0;
 
         *is_one = BN_is_one(bn);
@@ -176,9 +176,9 @@ ec_group_set_curve(EC_GROUP *group,
         if ((a_plus_3 = BN_CTX_get(ctx)) == NULL)
                 goto err;
 
-        if (!bn_copy(&group->field, p))
+        if (!bn_copy(&group->p, p))
                 goto err;
-        BN_set_negative(&group->field, 0);
+        BN_set_negative(&group->p, 0);
 
         if (!ec_encode_scalar(group, &group->a, a, ctx))
                 goto err;
@@ -187,7 +187,7 @@ ec_group_set_curve(EC_GROUP *group,
 
         if (!BN_set_word(a_plus_3, 3))
                 goto err;
-        if (!BN_mod_add(a_plus_3, a_plus_3, a, &group->field, ctx))
+        if (!BN_mod_add(a_plus_3, a_plus_3, a, &group->p, ctx))
                 goto err;
 
         group->a_is_minus3 = BN_is_zero(a_plus_3);
@@ -205,7 +205,7 @@ ec_group_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b,
     BN_CTX *ctx)
 {
         if (p != NULL) {
-                if (!bn_copy(p, &group->field))
+                if (!bn_copy(p, &group->p))
                         return 0;
         }
         if (!ec_decode_scalar(group, a, &group->a, ctx))
@@ -219,7 +219,7 @@ ec_group_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, BIGNUM *b,
 static int
 ec_group_get_degree(const EC_GROUP *group)
 {
-        return BN_num_bits(&group->field);
+        return BN_num_bits(&group->p);
 }
 
 static int
@@ -375,7 +375,7 @@ ec_point_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *point,
                 goto done;
         }
 
-        if (BN_mod_inverse_ct(Z_1, z, &group->field, ctx) == NULL) {
+        if (BN_mod_inverse_ct(Z_1, z, &group->p, ctx) == NULL) {
                 ECerror(ERR_R_BN_LIB);
                 goto err;
         }
@@ -384,7 +384,7 @@ ec_point_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *point,
                 if (!group->meth->field_sqr(group, Z_2, Z_1, ctx))
                         goto err;
         } else {
-                if (!BN_mod_sqr(Z_2, Z_1, &group->field, ctx))
+                if (!BN_mod_sqr(Z_2, Z_1, &group->p, ctx))
                         goto err;
         }
 
@@ -402,7 +402,7 @@ ec_point_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *point,
                         if (!group->meth->field_mul(group, Z_3, Z_2, Z_1, ctx))
                                 goto err;
                 } else {
-                        if (!BN_mod_mul(Z_3, Z_2, Z_1, &group->field, ctx))
+                        if (!BN_mod_mul(Z_3, Z_2, Z_1, &group->p, ctx))
                                 goto err;
                 }
 
@@ -427,7 +427,7 @@ static int
 ec_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
     const BIGNUM *in_x, int y_bit, BN_CTX *ctx)
 {
-        const BIGNUM *p = &group->field, *a = &group->a, *b = &group->b;
+        const BIGNUM *p = &group->p, *a = &group->a, *b = &group->b;
         BIGNUM *w, *x, *y;
         int ret = 0;
 
@@ -500,7 +500,7 @@ ec_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
                 ECerror(EC_R_INVALID_COMPRESSION_BIT);
                 goto err;
         }
-        if (!BN_usub(y, &group->field, y))
+        if (!BN_usub(y, &group->p, y))
                 goto err;
 
         if (y_bit != BN_is_odd(y)) {
@@ -540,7 +540,7 @@ ec_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, const EC_POINT *b,
 
         field_mul = group->meth->field_mul;
         field_sqr = group->meth->field_sqr;
-        p = &group->field;
+        p = &group->p;
 
         BN_CTX_start(ctx);
 
@@ -718,7 +718,7 @@ ec_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, BN_CTX *ctx)
 
         field_mul = group->meth->field_mul;
         field_sqr = group->meth->field_sqr;
-        p = &group->field;
+        p = &group->p;
 
         BN_CTX_start(ctx);
 
@@ -845,7 +845,7 @@ ec_invert(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx)
                 /* point is its own inverse */
                 return 1;
 
-        return BN_usub(&point->Y, &group->field, &point->Y);
+        return BN_usub(&point->Y, &group->p, &point->Y);
 }
 
 static int
@@ -862,7 +862,7 @@ ec_is_on_curve(const EC_GROUP *group, const EC_POINT *point, BN_CTX *ctx)
 
         field_mul = group->meth->field_mul;
         field_sqr = group->meth->field_sqr;
-        p = &group->field;
+        p = &group->p;
 
         BN_CTX_start(ctx);
 
@@ -1130,7 +1130,7 @@ ec_points_make_affine(const EC_GROUP *group, size_t num, EC_POINT *points[],
          * Now use a single explicit inversion to replace every non-zero
          * points[i]->Z by its inverse.
          */
-        if (!BN_mod_inverse_nonct(tmp, prod_Z[num - 1], &group->field, ctx)) {
+        if (!BN_mod_inverse_nonct(tmp, prod_Z[num - 1], &group->p, ctx)) {
                 ECerror(ERR_R_BN_LIB);
                 goto err;
         }
@@ -1214,13 +1214,13 @@ static int
 ec_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
     BN_CTX *ctx)
 {
-        return BN_mod_mul(r, a, b, &group->field, ctx);
+        return BN_mod_mul(r, a, b, &group->p, ctx);
 }
 
 static int
 ec_field_sqr(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
 {
-        return BN_mod_sqr(r, a, &group->field, ctx);
+        return BN_mod_sqr(r, a, &group->p, ctx);
 }
 
 /*
@@ -1228,7 +1228,7 @@ ec_field_sqr(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
  *
  *      (X, Y, Z) = (lambda^2 * X, lambda^3 * Y, lambda * Z)
  *
- * where lambda is in the interval [1, group->field).
+ * where lambda is in the interval [1, p).
  */
 static int
 ec_blind_coordinates(const EC_GROUP *group, EC_POINT *p, BN_CTX *ctx)
@@ -1243,8 +1243,8 @@ ec_blind_coordinates(const EC_GROUP *group, EC_POINT *p, BN_CTX *ctx)
         if ((tmp = BN_CTX_get(ctx)) == NULL)
                 goto err;
 
-        /* Generate lambda in [1, group->field). */
-        if (!bn_rand_interval(lambda, 1, &group->field))
+        /* Generate lambda in [1, p). */
+        if (!bn_rand_interval(lambda, 1, &group->p))
                 goto err;
 
         if (group->meth->field_encode != NULL &&
@@ -1392,7 +1392,7 @@ ec_mul_ct(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
         if (!BN_swap_ct(kbit, k, lambda, group_top + 2))
                 goto err;
 
-        group_top = group->field.top;
+        group_top = group->p.top;
         if (!bn_wexpand(&s->X, group_top) ||
             !bn_wexpand(&s->Y, group_top) ||
             !bn_wexpand(&s->Z, group_top) ||