summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorjsg <>2018-07-15 05:38:48 +0000
committerjsg <>2018-07-15 05:38:48 +0000
commit5a27d0fd33187fa17d3aa1b151b981a5434a200f (patch)
tree7b8b0c999036035f793976bbe0b018b39f74e217 /src
parent4ffff01bec4bc66afd2ef22fba624a0d3cffdc04 (diff)
downloadopenbsd-5a27d0fd33187fa17d3aa1b151b981a5434a200f.tar.gz
openbsd-5a27d0fd33187fa17d3aa1b151b981a5434a200f.tar.bz2
openbsd-5a27d0fd33187fa17d3aa1b151b981a5434a200f.zip
back out ecc constant time changes
after the constant time commits various regress tests started failing on sparc64 ssh t9, libcrypto ec ecdh ecdsa and trying to ssh out resulted in 'invalid elliptic curve value' ok tb@
Diffstat (limited to 'src')
-rw-r--r--src/lib/libcrypto/ec/ec2_mult.c12
-rw-r--r--src/lib/libcrypto/ec/ec2_oct.c8
-rw-r--r--src/lib/libcrypto/ec/ec2_smpl.c30
-rw-r--r--src/lib/libcrypto/ec/ec_ameth.c14
-rw-r--r--src/lib/libcrypto/ec/ec_asn1.c18
-rw-r--r--src/lib/libcrypto/ec/ec_check.c4
-rw-r--r--src/lib/libcrypto/ec/ec_curve.c4
-rw-r--r--src/lib/libcrypto/ec/ec_key.c8
-rw-r--r--src/lib/libcrypto/ec/ec_lcl.h17
-rw-r--r--src/lib/libcrypto/ec/ec_lib.c101
-rw-r--r--src/lib/libcrypto/ec/ec_mult.c8
-rw-r--r--src/lib/libcrypto/ec/eck_prn.c4
-rw-r--r--src/lib/libcrypto/ec/ecp_mont.c9
-rw-r--r--src/lib/libcrypto/ec/ecp_nist.c8
-rw-r--r--src/lib/libcrypto/ec/ecp_nistp224.c8
-rw-r--r--src/lib/libcrypto/ec/ecp_nistp256.c8
-rw-r--r--src/lib/libcrypto/ec/ecp_nistp521.c8
-rw-r--r--src/lib/libcrypto/ec/ecp_nistz256.c8
-rw-r--r--src/lib/libcrypto/ec/ecp_oct.c8
-rw-r--r--src/lib/libcrypto/ec/ecp_smpl.c274
-rw-r--r--src/lib/libcrypto/man/EC_POINT_add.326
21 files changed, 137 insertions, 448 deletions
diff --git a/src/lib/libcrypto/ec/ec2_mult.c b/src/lib/libcrypto/ec/ec2_mult.c
index 463802950d..10191d7916 100644
--- a/src/lib/libcrypto/ec/ec2_mult.c
+++ b/src/lib/libcrypto/ec/ec2_mult.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ec2_mult.c,v 1.10 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ec2_mult.c,v 1.11 2018/07/15 05:38:48 jsg Exp $ */
2/* ==================================================================== 2/* ====================================================================
3 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. 3 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
4 * 4 *
@@ -111,7 +111,7 @@ gf2m_Mdouble(const EC_GROUP *group, BIGNUM *x, BIGNUM *z, BN_CTX *ctx)
111 111
112 ret = 1; 112 ret = 1;
113 113
114 err: 114err:
115 BN_CTX_end(ctx); 115 BN_CTX_end(ctx);
116 return ret; 116 return ret;
117} 117}
@@ -155,7 +155,7 @@ gf2m_Madd(const EC_GROUP *group, const BIGNUM *x, BIGNUM *x1, BIGNUM *z1,
155 155
156 ret = 1; 156 ret = 1;
157 157
158 err: 158err:
159 BN_CTX_end(ctx); 159 BN_CTX_end(ctx);
160 return ret; 160 return ret;
161} 161}
@@ -243,7 +243,7 @@ gf2m_Mxy(const EC_GROUP *group, const BIGNUM *x, const BIGNUM *y, BIGNUM *x1,
243 243
244 ret = 2; 244 ret = 2;
245 245
246 err: 246err:
247 BN_CTX_end(ctx); 247 BN_CTX_end(ctx);
248 return ret; 248 return ret;
249} 249}
@@ -356,7 +356,7 @@ ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r,
356 356
357 ret = 1; 357 ret = 1;
358 358
359 err: 359err:
360 BN_CTX_end(ctx); 360 BN_CTX_end(ctx);
361 return ret; 361 return ret;
362} 362}
@@ -424,7 +424,7 @@ ec_GF2m_simple_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
424 424
425 ret = 1; 425 ret = 1;
426 426
427 err: 427err:
428 EC_POINT_free(p); 428 EC_POINT_free(p);
429 EC_POINT_free(acc); 429 EC_POINT_free(acc);
430 BN_CTX_free(new_ctx); 430 BN_CTX_free(new_ctx);
diff --git a/src/lib/libcrypto/ec/ec2_oct.c b/src/lib/libcrypto/ec/ec2_oct.c
index 1727f780a3..bb480c5016 100644
--- a/src/lib/libcrypto/ec/ec2_oct.c
+++ b/src/lib/libcrypto/ec/ec2_oct.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ec2_oct.c,v 1.9 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ec2_oct.c,v 1.10 2018/07/15 05:38:48 jsg Exp $ */
2/* ==================================================================== 2/* ====================================================================
3 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. 3 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
4 * 4 *
@@ -157,7 +157,7 @@ ec_GF2m_simple_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point
157 157
158 ret = 1; 158 ret = 1;
159 159
160 err: 160err:
161 BN_CTX_end(ctx); 161 BN_CTX_end(ctx);
162 BN_CTX_free(new_ctx); 162 BN_CTX_free(new_ctx);
163 return ret; 163 return ret;
@@ -272,7 +272,7 @@ ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point,
272 BN_CTX_free(new_ctx); 272 BN_CTX_free(new_ctx);
273 return ret; 273 return ret;
274 274
275 err: 275err:
276 if (used_ctx) 276 if (used_ctx)
277 BN_CTX_end(ctx); 277 BN_CTX_end(ctx);
278 BN_CTX_free(new_ctx); 278 BN_CTX_free(new_ctx);
@@ -374,7 +374,7 @@ ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
374 } 374 }
375 ret = 1; 375 ret = 1;
376 376
377 err: 377err:
378 BN_CTX_end(ctx); 378 BN_CTX_end(ctx);
379 BN_CTX_free(new_ctx); 379 BN_CTX_free(new_ctx);
380 return ret; 380 return ret;
diff --git a/src/lib/libcrypto/ec/ec2_smpl.c b/src/lib/libcrypto/ec/ec2_smpl.c
index f1cbd3f3c4..c3fff56c44 100644
--- a/src/lib/libcrypto/ec/ec2_smpl.c
+++ b/src/lib/libcrypto/ec/ec2_smpl.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ec2_smpl.c,v 1.17 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ec2_smpl.c,v 1.18 2018/07/15 05:38:48 jsg Exp $ */
2/* ==================================================================== 2/* ====================================================================
3 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. 3 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
4 * 4 *
@@ -107,11 +107,15 @@ EC_GF2m_simple_method(void)
107 .point_cmp = ec_GF2m_simple_cmp, 107 .point_cmp = ec_GF2m_simple_cmp,
108 .make_affine = ec_GF2m_simple_make_affine, 108 .make_affine = ec_GF2m_simple_make_affine,
109 .points_make_affine = ec_GF2m_simple_points_make_affine, 109 .points_make_affine = ec_GF2m_simple_points_make_affine,
110 .mul_generator_ct = ec_GFp_simple_mul_generator_ct, 110
111 .mul_single_ct = ec_GFp_simple_mul_single_ct, 111 /*
112 .mul_double_nonct = ec_GFp_simple_mul_double_nonct, 112 * the following three method functions are defined in
113 * ec2_mult.c
114 */
115 .mul = ec_GF2m_simple_mul,
113 .precompute_mult = ec_GF2m_precompute_mult, 116 .precompute_mult = ec_GF2m_precompute_mult,
114 .have_precompute_mult = ec_GF2m_have_precompute_mult, 117 .have_precompute_mult = ec_GF2m_have_precompute_mult,
118
115 .field_mul = ec_GF2m_simple_field_mul, 119 .field_mul = ec_GF2m_simple_field_mul,
116 .field_sqr = ec_GF2m_simple_field_sqr, 120 .field_sqr = ec_GF2m_simple_field_sqr,
117 .field_div = ec_GF2m_simple_field_div, 121 .field_div = ec_GF2m_simple_field_div,
@@ -228,7 +232,7 @@ ec_GF2m_simple_group_set_curve(EC_GROUP * group,
228 group->b.d[i] = 0; 232 group->b.d[i] = 0;
229 233
230 ret = 1; 234 ret = 1;
231 err: 235err:
232 return ret; 236 return ret;
233} 237}
234 238
@@ -256,7 +260,7 @@ ec_GF2m_simple_group_get_curve(const EC_GROUP *group,
256 } 260 }
257 ret = 1; 261 ret = 1;
258 262
259 err: 263err:
260 return ret; 264 return ret;
261} 265}
262 266
@@ -302,7 +306,7 @@ ec_GF2m_simple_group_check_discriminant(const EC_GROUP * group, BN_CTX * ctx)
302 306
303 ret = 1; 307 ret = 1;
304 308
305 err: 309err:
306 if (ctx != NULL) 310 if (ctx != NULL)
307 BN_CTX_end(ctx); 311 BN_CTX_end(ctx);
308 BN_CTX_free(new_ctx); 312 BN_CTX_free(new_ctx);
@@ -394,7 +398,7 @@ ec_GF2m_simple_point_set_affine_coordinates(const EC_GROUP * group, EC_POINT * p
394 point->Z_is_one = 1; 398 point->Z_is_one = 1;
395 ret = 1; 399 ret = 1;
396 400
397 err: 401err:
398 return ret; 402 return ret;
399} 403}
400 404
@@ -428,7 +432,7 @@ ec_GF2m_simple_point_get_affine_coordinates(const EC_GROUP *group,
428 } 432 }
429 ret = 1; 433 ret = 1;
430 434
431 err: 435err:
432 return ret; 436 return ret;
433} 437}
434 438
@@ -545,7 +549,7 @@ ec_GF2m_simple_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
545 549
546 ret = 1; 550 ret = 1;
547 551
548 err: 552err:
549 BN_CTX_end(ctx); 553 BN_CTX_end(ctx);
550 BN_CTX_free(new_ctx); 554 BN_CTX_free(new_ctx);
551 return ret; 555 return ret;
@@ -637,7 +641,7 @@ ec_GF2m_simple_is_on_curve(const EC_GROUP *group, const EC_POINT *point, BN_CTX
637 if (!BN_GF2m_add(lh, lh, y2)) 641 if (!BN_GF2m_add(lh, lh, y2))
638 goto err; 642 goto err;
639 ret = BN_is_zero(lh); 643 ret = BN_is_zero(lh);
640 err: 644err:
641 if (ctx) 645 if (ctx)
642 BN_CTX_end(ctx); 646 BN_CTX_end(ctx);
643 BN_CTX_free(new_ctx); 647 BN_CTX_free(new_ctx);
@@ -689,7 +693,7 @@ ec_GF2m_simple_cmp(const EC_GROUP *group, const EC_POINT *a,
689 goto err; 693 goto err;
690 ret = ((BN_cmp(aX, bX) == 0) && BN_cmp(aY, bY) == 0) ? 0 : 1; 694 ret = ((BN_cmp(aX, bX) == 0) && BN_cmp(aY, bY) == 0) ? 0 : 1;
691 695
692 err: 696err:
693 if (ctx) 697 if (ctx)
694 BN_CTX_end(ctx); 698 BN_CTX_end(ctx);
695 BN_CTX_free(new_ctx); 699 BN_CTX_free(new_ctx);
@@ -730,7 +734,7 @@ ec_GF2m_simple_make_affine(const EC_GROUP * group, EC_POINT * point, BN_CTX * ct
730 734
731 ret = 1; 735 ret = 1;
732 736
733 err: 737err:
734 if (ctx) 738 if (ctx)
735 BN_CTX_end(ctx); 739 BN_CTX_end(ctx);
736 BN_CTX_free(new_ctx); 740 BN_CTX_free(new_ctx);
diff --git a/src/lib/libcrypto/ec/ec_ameth.c b/src/lib/libcrypto/ec/ec_ameth.c
index 21390aabd4..30f29ef545 100644
--- a/src/lib/libcrypto/ec/ec_ameth.c
+++ b/src/lib/libcrypto/ec/ec_ameth.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ec_ameth.c,v 1.21 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ec_ameth.c,v 1.22 2018/07/15 05:38:48 jsg Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL 2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3 * project 2006. 3 * project 2006.
4 */ 4 */
@@ -126,7 +126,7 @@ eckey_pub_encode(X509_PUBKEY * pk, const EVP_PKEY * pkey)
126 if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(EVP_PKEY_EC), 126 if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(EVP_PKEY_EC),
127 ptype, pval, penc, penclen)) 127 ptype, pval, penc, penclen))
128 return 1; 128 return 1;
129 err: 129err:
130 if (ptype == V_ASN1_OBJECT) 130 if (ptype == V_ASN1_OBJECT)
131 ASN1_OBJECT_free(pval); 131 ASN1_OBJECT_free(pval);
132 else 132 else
@@ -177,7 +177,7 @@ eckey_type2param(int ptype, const void *pval)
177 177
178 return eckey; 178 return eckey;
179 179
180 ecerr: 180ecerr:
181 if (eckey) 181 if (eckey)
182 EC_KEY_free(eckey); 182 EC_KEY_free(eckey);
183 return NULL; 183 return NULL;
@@ -210,7 +210,7 @@ eckey_pub_decode(EVP_PKEY * pkey, X509_PUBKEY * pubkey)
210 EVP_PKEY_assign_EC_KEY(pkey, eckey); 210 EVP_PKEY_assign_EC_KEY(pkey, eckey);
211 return 1; 211 return 1;
212 212
213 ecerr: 213ecerr:
214 if (eckey) 214 if (eckey)
215 EC_KEY_free(eckey); 215 EC_KEY_free(eckey);
216 return 0; 216 return 0;
@@ -290,9 +290,9 @@ eckey_priv_decode(EVP_PKEY * pkey, PKCS8_PRIV_KEY_INFO * p8)
290 EVP_PKEY_assign_EC_KEY(pkey, eckey); 290 EVP_PKEY_assign_EC_KEY(pkey, eckey);
291 return 1; 291 return 1;
292 292
293 ecliberr: 293ecliberr:
294 ECerror(ERR_R_EC_LIB); 294 ECerror(ERR_R_EC_LIB);
295 ecerr: 295ecerr:
296 if (eckey) 296 if (eckey)
297 EC_KEY_free(eckey); 297 EC_KEY_free(eckey);
298 return 0; 298 return 0;
@@ -483,7 +483,7 @@ do_EC_KEY_print(BIO * bp, const EC_KEY * x, int off, int ktype)
483 if (!ECPKParameters_print(bp, group, off)) 483 if (!ECPKParameters_print(bp, group, off))
484 goto err; 484 goto err;
485 ret = 1; 485 ret = 1;
486 err: 486err:
487 if (!ret) 487 if (!ret)
488 ECerror(reason); 488 ECerror(reason);
489 BN_free(pub_key); 489 BN_free(pub_key);
diff --git a/src/lib/libcrypto/ec/ec_asn1.c b/src/lib/libcrypto/ec/ec_asn1.c
index 1fb0670efe..f5a1331ba3 100644
--- a/src/lib/libcrypto/ec/ec_asn1.c
+++ b/src/lib/libcrypto/ec/ec_asn1.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ec_asn1.c,v 1.28 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ec_asn1.c,v 1.29 2018/07/15 05:38:48 jsg Exp $ */
2/* 2/*
3 * Written by Nils Larsch for the OpenSSL project. 3 * Written by Nils Larsch for the OpenSSL project.
4 */ 4 */
@@ -793,7 +793,7 @@ ec_asn1_group2fieldid(const EC_GROUP * group, X9_62_FIELDID * field)
793 793
794 ok = 1; 794 ok = 1;
795 795
796 err: 796err:
797 BN_free(tmp); 797 BN_free(tmp);
798 return (ok); 798 return (ok);
799} 799}
@@ -896,7 +896,7 @@ ec_asn1_group2curve(const EC_GROUP * group, X9_62_CURVE * curve)
896 896
897 ok = 1; 897 ok = 1;
898 898
899 err: 899err:
900 free(buffer_1); 900 free(buffer_1);
901 free(buffer_2); 901 free(buffer_2);
902 BN_free(tmp_1); 902 BN_free(tmp_1);
@@ -988,8 +988,7 @@ ec_asn1_group2parameters(const EC_GROUP * group, ECPARAMETERS * param)
988 } 988 }
989 ok = 1; 989 ok = 1;
990 990
991 err: 991err: if (!ok) {
992 if (!ok) {
993 if (ret && !param) 992 if (ret && !param)
994 ECPARAMETERS_free(ret); 993 ECPARAMETERS_free(ret);
995 ret = NULL; 994 ret = NULL;
@@ -1245,8 +1244,7 @@ ec_asn1_parameters2group(const ECPARAMETERS * params)
1245 } 1244 }
1246 ok = 1; 1245 ok = 1;
1247 1246
1248 err: 1247err: if (!ok) {
1249 if (!ok) {
1250 EC_GROUP_clear_free(ret); 1248 EC_GROUP_clear_free(ret);
1251 ret = NULL; 1249 ret = NULL;
1252 } 1250 }
@@ -1314,7 +1312,7 @@ d2i_ECPKParameters(EC_GROUP ** a, const unsigned char **in, long len)
1314 *a = group; 1312 *a = group;
1315 } 1313 }
1316 1314
1317 err: 1315err:
1318 ECPKPARAMETERS_free(params); 1316 ECPKPARAMETERS_free(params);
1319 return (group); 1317 return (group);
1320} 1318}
@@ -1427,7 +1425,7 @@ d2i_ECPrivateKey(EC_KEY ** a, const unsigned char **in, long len)
1427 *a = ret; 1425 *a = ret;
1428 return (ret); 1426 return (ret);
1429 1427
1430 err: 1428err:
1431 if (a == NULL || *a != ret) 1429 if (a == NULL || *a != ret)
1432 EC_KEY_free(ret); 1430 EC_KEY_free(ret);
1433 if (priv_key) 1431 if (priv_key)
@@ -1512,7 +1510,7 @@ i2d_ECPrivateKey(EC_KEY * a, unsigned char **out)
1512 goto err; 1510 goto err;
1513 } 1511 }
1514 ok = 1; 1512 ok = 1;
1515 err: 1513err:
1516 free(buffer); 1514 free(buffer);
1517 if (priv_key) 1515 if (priv_key)
1518 EC_PRIVATEKEY_free(priv_key); 1516 EC_PRIVATEKEY_free(priv_key);
diff --git a/src/lib/libcrypto/ec/ec_check.c b/src/lib/libcrypto/ec/ec_check.c
index b0c63331c6..a76d21c1ff 100644
--- a/src/lib/libcrypto/ec/ec_check.c
+++ b/src/lib/libcrypto/ec/ec_check.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ec_check.c,v 1.7 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ec_check.c,v 1.8 2018/07/15 05:38:48 jsg Exp $ */
2/* ==================================================================== 2/* ====================================================================
3 * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved. 3 * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
4 * 4 *
@@ -106,7 +106,7 @@ EC_GROUP_check(const EC_GROUP * group, BN_CTX * ctx)
106 } 106 }
107 ret = 1; 107 ret = 1;
108 108
109 err: 109err:
110 if (ctx != NULL) 110 if (ctx != NULL)
111 BN_CTX_end(ctx); 111 BN_CTX_end(ctx);
112 BN_CTX_free(new_ctx); 112 BN_CTX_free(new_ctx);
diff --git a/src/lib/libcrypto/ec/ec_curve.c b/src/lib/libcrypto/ec/ec_curve.c
index 7bf85835dc..1808e7b65c 100644
--- a/src/lib/libcrypto/ec/ec_curve.c
+++ b/src/lib/libcrypto/ec/ec_curve.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ec_curve.c,v 1.17 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ec_curve.c,v 1.18 2018/07/15 05:38:48 jsg Exp $ */
2/* 2/*
3 * Written by Nils Larsch for the OpenSSL project. 3 * Written by Nils Larsch for the OpenSSL project.
4 */ 4 */
@@ -3235,7 +3235,7 @@ ec_group_new_from_data(const ec_list_element curve)
3235 } 3235 }
3236 } 3236 }
3237 ok = 1; 3237 ok = 1;
3238 err: 3238err:
3239 if (!ok) { 3239 if (!ok) {
3240 EC_GROUP_free(group); 3240 EC_GROUP_free(group);
3241 group = NULL; 3241 group = NULL;
diff --git a/src/lib/libcrypto/ec/ec_key.c b/src/lib/libcrypto/ec/ec_key.c
index 33c9acccd7..a9f03c4ac2 100644
--- a/src/lib/libcrypto/ec/ec_key.c
+++ b/src/lib/libcrypto/ec/ec_key.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ec_key.c,v 1.15 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ec_key.c,v 1.16 2018/07/15 05:38:48 jsg Exp $ */
2/* 2/*
3 * Written by Nils Larsch for the OpenSSL project. 3 * Written by Nils Larsch for the OpenSSL project.
4 */ 4 */
@@ -253,7 +253,7 @@ EC_KEY_generate_key(EC_KEY * eckey)
253 253
254 ok = 1; 254 ok = 1;
255 255
256 err: 256err:
257 BN_free(order); 257 BN_free(order);
258 if (pub_key != NULL && eckey->pub_key == NULL) 258 if (pub_key != NULL && eckey->pub_key == NULL)
259 EC_POINT_free(pub_key); 259 EC_POINT_free(pub_key);
@@ -324,7 +324,7 @@ EC_KEY_check_key(const EC_KEY * eckey)
324 } 324 }
325 } 325 }
326 ok = 1; 326 ok = 1;
327 err: 327err:
328 BN_CTX_free(ctx); 328 BN_CTX_free(ctx);
329 EC_POINT_free(point); 329 EC_POINT_free(point);
330 return (ok); 330 return (ok);
@@ -395,7 +395,7 @@ EC_KEY_set_public_key_affine_coordinates(EC_KEY * key, BIGNUM * x, BIGNUM * y)
395 395
396 ok = 1; 396 ok = 1;
397 397
398 err: 398err:
399 BN_CTX_free(ctx); 399 BN_CTX_free(ctx);
400 EC_POINT_free(point); 400 EC_POINT_free(point);
401 return ok; 401 return ok;
diff --git a/src/lib/libcrypto/ec/ec_lcl.h b/src/lib/libcrypto/ec/ec_lcl.h
index 4916d3a14a..bcfd817b70 100644
--- a/src/lib/libcrypto/ec/ec_lcl.h
+++ b/src/lib/libcrypto/ec/ec_lcl.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: ec_lcl.h,v 1.8 2018/07/10 21:55:49 tb Exp $ */ 1/* $OpenBSD: ec_lcl.h,v 1.9 2018/07/15 05:38:48 jsg Exp $ */
2/* 2/*
3 * Originally written by Bodo Moeller for the OpenSSL project. 3 * Originally written by Bodo Moeller for the OpenSSL project.
4 */ 4 */
@@ -160,12 +160,10 @@ struct ec_method_st {
160 int (*make_affine)(const EC_GROUP *, EC_POINT *, BN_CTX *); 160 int (*make_affine)(const EC_GROUP *, EC_POINT *, BN_CTX *);
161 int (*points_make_affine)(const EC_GROUP *, size_t num, EC_POINT *[], BN_CTX *); 161 int (*points_make_affine)(const EC_GROUP *, size_t num, EC_POINT *[], BN_CTX *);
162 162
163 /* used by EC_POINTs_mul, EC_POINT_mul, EC_POINT_precompute_mult, EC_POINT_have_precompute_mult */ 163 /* used by EC_POINTs_mul, EC_POINT_mul, EC_POINT_precompute_mult, EC_POINT_have_precompute_mult
164 int (*mul_generator_ct)(const EC_GROUP *, EC_POINT *r, const BIGNUM *scalar, BN_CTX *); 164 * (default implementations are used if the 'mul' pointer is 0): */
165 int (*mul_single_ct)(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, 165 int (*mul)(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
166 const EC_POINT *point, BN_CTX *); 166 size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *);
167 int (*mul_double_nonct)(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
168 const BIGNUM *p_scalar, const EC_POINT *point, BN_CTX *);
169 int (*precompute_mult)(EC_GROUP *group, BN_CTX *); 167 int (*precompute_mult)(EC_GROUP *group, BN_CTX *);
170 int (*have_precompute_mult)(const EC_GROUP *group); 168 int (*have_precompute_mult)(const EC_GROUP *group);
171 169
@@ -339,11 +337,6 @@ int ec_GFp_simple_make_affine(const EC_GROUP *, EC_POINT *, BN_CTX *);
339int ec_GFp_simple_points_make_affine(const EC_GROUP *, size_t num, EC_POINT *[], BN_CTX *); 337int ec_GFp_simple_points_make_affine(const EC_GROUP *, size_t num, EC_POINT *[], BN_CTX *);
340int ec_GFp_simple_field_mul(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *); 338int ec_GFp_simple_field_mul(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *);
341int ec_GFp_simple_field_sqr(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *); 339int ec_GFp_simple_field_sqr(const EC_GROUP *, BIGNUM *r, const BIGNUM *a, BN_CTX *);
342int ec_GFp_simple_mul_generator_ct(const EC_GROUP *, EC_POINT *r, const BIGNUM *scalar, BN_CTX *);
343int ec_GFp_simple_mul_single_ct(const EC_GROUP *, EC_POINT *r, const BIGNUM *scalar,
344 const EC_POINT *point, BN_CTX *);
345int ec_GFp_simple_mul_double_nonct(const EC_GROUP *, EC_POINT *r, const BIGNUM *g_scalar,
346 const BIGNUM *p_scalar, const EC_POINT *point, BN_CTX *);
347 340
348 341
349/* method functions in ecp_mont.c */ 342/* method functions in ecp_mont.c */
diff --git a/src/lib/libcrypto/ec/ec_lib.c b/src/lib/libcrypto/ec/ec_lib.c
index 1d1daca166..29207d6b48 100644
--- a/src/lib/libcrypto/ec/ec_lib.c
+++ b/src/lib/libcrypto/ec/ec_lib.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ec_lib.c,v 1.26 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ec_lib.c,v 1.27 2018/07/15 05:38:48 jsg Exp $ */
2/* 2/*
3 * Originally written by Bodo Moeller for the OpenSSL project. 3 * Originally written by Bodo Moeller for the OpenSSL project.
4 */ 4 */
@@ -526,7 +526,7 @@ EC_GROUP_cmp(const EC_GROUP * a, const EC_GROUP * b, BN_CTX * ctx)
526 526
527 return r; 527 return r;
528 528
529 err: 529err:
530 BN_CTX_end(ctx); 530 BN_CTX_end(ctx);
531 if (ctx_new) 531 if (ctx_new)
532 BN_CTX_free(ctx); 532 BN_CTX_free(ctx);
@@ -1026,88 +1026,47 @@ EC_POINTs_make_affine(const EC_GROUP *group, size_t num, EC_POINT *points[],
1026} 1026}
1027 1027
1028 1028
1029/* Functions for point multiplication */ 1029/* Functions for point multiplication.
1030 *
1031 * If group->meth->mul is 0, we use the wNAF-based implementations in ec_mult.c;
1032 * otherwise we dispatch through methods.
1033 */
1034
1030int 1035int
1031EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, 1036EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
1032 size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx) 1037 size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx)
1033{ 1038{
1034 /* 1039 if (group->meth->mul == 0)
1035 * The function pointers must be set, and only support num == 0 and 1040 /* use default */
1036 * num == 1. 1041 return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
1037 */ 1042
1038 if (group->meth->mul_generator_ct == NULL || 1043 return group->meth->mul(group, r, scalar, num, points, scalars, ctx);
1039 group->meth->mul_single_ct == NULL ||
1040 group->meth->mul_double_nonct == NULL ||
1041 num > 1) {
1042 ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1043 return 0;
1044 }
1045
1046 /* Either bP or aG + bP, this is sane. */
1047 if (num == 1 && points != NULL && scalars != NULL)
1048 return EC_POINT_mul(group, r, scalar, points[0], scalars[0],
1049 ctx);
1050
1051 /* aG, this is sane */
1052 if (scalar != NULL && points == NULL && scalars == NULL)
1053 return EC_POINT_mul(group, r, scalar, NULL, NULL, ctx);
1054
1055 /* anything else is an error */
1056 ECerror(ERR_R_EC_LIB);
1057 return 0;
1058} 1044}
1059 1045
1060int 1046int
1061EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar, 1047EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
1062 const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx) 1048 const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
1063{ 1049{
1064 if (group->meth->mul_generator_ct == NULL || 1050 /* just a convenient interface to EC_POINTs_mul() */
1065 group->meth->mul_single_ct == NULL || 1051
1066 group->meth->mul_double_nonct == NULL) { 1052 const EC_POINT *points[1];
1067 ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 1053 const BIGNUM *scalars[1];
1068 return 0; 1054
1069 } 1055 points[0] = point;
1070 if (g_scalar != NULL && point == NULL && p_scalar == NULL) { 1056 scalars[0] = p_scalar;
1071 /* 1057
1072 * In this case we want to compute g_scalar * GeneratorPoint: 1058 return EC_POINTs_mul(group, r, g_scalar,
1073 * this codepath is reached most prominently by (ephemeral) key 1059 (point != NULL && p_scalar != NULL),
1074 * generation of EC cryptosystems (i.e. ECDSA keygen and sign 1060 points, scalars, ctx);
1075 * setup, ECDH keygen/first half), where the scalar is always
1076 * secret. This is why we ignore if BN_FLG_CONSTTIME is actually
1077 * set and we always call the constant time version.
1078 */
1079 return group->meth->mul_generator_ct(group, r, g_scalar, ctx);
1080 }
1081 if (g_scalar == NULL && point != NULL && p_scalar != NULL) {
1082 /* In this case we want to compute p_scalar * GenericPoint:
1083 * this codepath is reached most prominently by the second half
1084 * of ECDH, where the secret scalar is multiplied by the peer's
1085 * public point. To protect the secret scalar, we ignore if
1086 * BN_FLG_CONSTTIME is actually set and we always call the
1087 * constant time version.
1088 */
1089 return group->meth->mul_single_ct(group, r, p_scalar, point,
1090 ctx);
1091 }
1092 if (g_scalar != NULL && point != NULL && p_scalar != NULL) {
1093 /*
1094 * In this case we want to compute
1095 * g_scalar * GeneratorPoint + p_scalar * GenericPoint:
1096 * this codepath is reached most prominently by ECDSA signature
1097 * verification. So we call the non-ct version.
1098 */
1099 return group->meth->mul_double_nonct(group, r, g_scalar,
1100 p_scalar, point, ctx);
1101 }
1102
1103 /* Anything else is an error. */
1104 ECerror(ERR_R_EC_LIB);
1105 return 0;
1106} 1061}
1107 1062
1108int 1063int
1109EC_GROUP_precompute_mult(EC_GROUP * group, BN_CTX * ctx) 1064EC_GROUP_precompute_mult(EC_GROUP * group, BN_CTX * ctx)
1110{ 1065{
1066 if (group->meth->mul == 0)
1067 /* use default */
1068 return ec_wNAF_precompute_mult(group, ctx);
1069
1111 if (group->meth->precompute_mult != 0) 1070 if (group->meth->precompute_mult != 0)
1112 return group->meth->precompute_mult(group, ctx); 1071 return group->meth->precompute_mult(group, ctx);
1113 else 1072 else
@@ -1117,6 +1076,10 @@ EC_GROUP_precompute_mult(EC_GROUP * group, BN_CTX * ctx)
1117int 1076int
1118EC_GROUP_have_precompute_mult(const EC_GROUP * group) 1077EC_GROUP_have_precompute_mult(const EC_GROUP * group)
1119{ 1078{
1079 if (group->meth->mul == 0)
1080 /* use default */
1081 return ec_wNAF_have_precompute_mult(group);
1082
1120 if (group->meth->have_precompute_mult != 0) 1083 if (group->meth->have_precompute_mult != 0)
1121 return group->meth->have_precompute_mult(group); 1084 return group->meth->have_precompute_mult(group);
1122 else 1085 else
diff --git a/src/lib/libcrypto/ec/ec_mult.c b/src/lib/libcrypto/ec/ec_mult.c
index 08bc8c380c..4f321d3f55 100644
--- a/src/lib/libcrypto/ec/ec_mult.c
+++ b/src/lib/libcrypto/ec/ec_mult.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ec_mult.c,v 1.22 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ec_mult.c,v 1.23 2018/07/15 05:38:48 jsg Exp $ */
2/* 2/*
3 * Originally written by Bodo Moeller and Nils Larsch for the OpenSSL project. 3 * Originally written by Bodo Moeller and Nils Larsch for the OpenSSL project.
4 */ 4 */
@@ -301,7 +301,7 @@ compute_wNAF(const BIGNUM * scalar, int w, size_t * ret_len)
301 len = j; 301 len = j;
302 ok = 1; 302 ok = 1;
303 303
304 err: 304err:
305 if (!ok) { 305 if (!ok) {
306 free(r); 306 free(r);
307 r = NULL; 307 r = NULL;
@@ -678,7 +678,7 @@ ec_wNAF_mul(const EC_GROUP * group, EC_POINT * r, const BIGNUM * scalar,
678 678
679 ret = 1; 679 ret = 1;
680 680
681 err: 681err:
682 BN_CTX_free(new_ctx); 682 BN_CTX_free(new_ctx);
683 EC_POINT_free(tmp); 683 EC_POINT_free(tmp);
684 free(wsize); 684 free(wsize);
@@ -857,7 +857,7 @@ ec_wNAF_precompute_mult(EC_GROUP * group, BN_CTX * ctx)
857 pre_comp = NULL; 857 pre_comp = NULL;
858 858
859 ret = 1; 859 ret = 1;
860 err: 860err:
861 if (ctx != NULL) 861 if (ctx != NULL)
862 BN_CTX_end(ctx); 862 BN_CTX_end(ctx);
863 BN_CTX_free(new_ctx); 863 BN_CTX_free(new_ctx);
diff --git a/src/lib/libcrypto/ec/eck_prn.c b/src/lib/libcrypto/ec/eck_prn.c
index 0291de9613..7c0db42ef4 100644
--- a/src/lib/libcrypto/ec/eck_prn.c
+++ b/src/lib/libcrypto/ec/eck_prn.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: eck_prn.c,v 1.13 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: eck_prn.c,v 1.14 2018/07/15 05:38:48 jsg Exp $ */
2/* 2/*
3 * Written by Nils Larsch for the OpenSSL project. 3 * Written by Nils Larsch for the OpenSSL project.
4 */ 4 */
@@ -321,7 +321,7 @@ ECPKParameters_print(BIO * bp, const EC_GROUP * x, int off)
321 goto err; 321 goto err;
322 } 322 }
323 ret = 1; 323 ret = 1;
324 err: 324err:
325 if (!ret) 325 if (!ret)
326 ECerror(reason); 326 ECerror(reason);
327 BN_free(p); 327 BN_free(p);
diff --git a/src/lib/libcrypto/ec/ecp_mont.c b/src/lib/libcrypto/ec/ecp_mont.c
index 302f833306..03e594d38d 100644
--- a/src/lib/libcrypto/ec/ecp_mont.c
+++ b/src/lib/libcrypto/ec/ecp_mont.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_mont.c,v 1.13 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ecp_mont.c,v 1.14 2018/07/15 05:38:48 jsg Exp $ */
2/* 2/*
3 * Originally written by Bodo Moeller for the OpenSSL project. 3 * Originally written by Bodo Moeller for the OpenSSL project.
4 */ 4 */
@@ -102,9 +102,6 @@ EC_GFp_mont_method(void)
102 .point_cmp = ec_GFp_simple_cmp, 102 .point_cmp = ec_GFp_simple_cmp,
103 .make_affine = ec_GFp_simple_make_affine, 103 .make_affine = ec_GFp_simple_make_affine,
104 .points_make_affine = ec_GFp_simple_points_make_affine, 104 .points_make_affine = ec_GFp_simple_points_make_affine,
105 .mul_generator_ct = ec_GFp_simple_mul_generator_ct,
106 .mul_single_ct = ec_GFp_simple_mul_single_ct,
107 .mul_double_nonct = ec_GFp_simple_mul_double_nonct,
108 .field_mul = ec_GFp_mont_field_mul, 105 .field_mul = ec_GFp_mont_field_mul,
109 .field_sqr = ec_GFp_mont_field_sqr, 106 .field_sqr = ec_GFp_mont_field_sqr,
110 .field_encode = ec_GFp_mont_field_encode, 107 .field_encode = ec_GFp_mont_field_encode,
@@ -175,7 +172,7 @@ ec_GFp_mont_group_copy(EC_GROUP * dest, const EC_GROUP * src)
175 } 172 }
176 return 1; 173 return 1;
177 174
178 err: 175err:
179 if (dest->field_data1 != NULL) { 176 if (dest->field_data1 != NULL) {
180 BN_MONT_CTX_free(dest->field_data1); 177 BN_MONT_CTX_free(dest->field_data1);
181 dest->field_data1 = NULL; 178 dest->field_data1 = NULL;
@@ -228,7 +225,7 @@ ec_GFp_mont_group_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
228 BN_free(group->field_data2); 225 BN_free(group->field_data2);
229 group->field_data2 = NULL; 226 group->field_data2 = NULL;
230 } 227 }
231 err: 228err:
232 BN_CTX_free(new_ctx); 229 BN_CTX_free(new_ctx);
233 BN_MONT_CTX_free(mont); 230 BN_MONT_CTX_free(mont);
234 BN_free(one); 231 BN_free(one);
diff --git a/src/lib/libcrypto/ec/ecp_nist.c b/src/lib/libcrypto/ec/ecp_nist.c
index 8aa9f49592..027a07d5c0 100644
--- a/src/lib/libcrypto/ec/ecp_nist.c
+++ b/src/lib/libcrypto/ec/ecp_nist.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_nist.c,v 1.11 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ecp_nist.c,v 1.12 2018/07/15 05:38:48 jsg Exp $ */
2/* 2/*
3 * Written by Nils Larsch for the OpenSSL project. 3 * Written by Nils Larsch for the OpenSSL project.
4 */ 4 */
@@ -151,7 +151,7 @@ ec_GFp_nist_group_set_curve(EC_GROUP *group, const BIGNUM *p,
151 151
152 ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx); 152 ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
153 153
154 err: 154err:
155 BN_CTX_end(ctx); 155 BN_CTX_end(ctx);
156 BN_CTX_free(new_ctx); 156 BN_CTX_free(new_ctx);
157 return ret; 157 return ret;
@@ -179,7 +179,7 @@ ec_GFp_nist_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
179 goto err; 179 goto err;
180 180
181 ret = 1; 181 ret = 1;
182 err: 182err:
183 BN_CTX_free(ctx_new); 183 BN_CTX_free(ctx_new);
184 return ret; 184 return ret;
185} 185}
@@ -206,7 +206,7 @@ ec_GFp_nist_field_sqr(const EC_GROUP * group, BIGNUM * r, const BIGNUM * a,
206 goto err; 206 goto err;
207 207
208 ret = 1; 208 ret = 1;
209 err: 209err:
210 BN_CTX_free(ctx_new); 210 BN_CTX_free(ctx_new);
211 return ret; 211 return ret;
212} 212}
diff --git a/src/lib/libcrypto/ec/ecp_nistp224.c b/src/lib/libcrypto/ec/ecp_nistp224.c
index 3921508094..1ba8cb09a0 100644
--- a/src/lib/libcrypto/ec/ecp_nistp224.c
+++ b/src/lib/libcrypto/ec/ecp_nistp224.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_nistp224.c,v 1.20 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ecp_nistp224.c,v 1.21 2018/07/15 05:38:48 jsg Exp $ */
2/* 2/*
3 * Written by Emilia Kasper (Google) for the OpenSSL project. 3 * Written by Emilia Kasper (Google) for the OpenSSL project.
4 */ 4 */
@@ -1281,7 +1281,7 @@ ec_GFp_nistp224_group_set_curve(EC_GROUP * group, const BIGNUM * p,
1281 } 1281 }
1282 group->field_mod_func = BN_nist_mod_224; 1282 group->field_mod_func = BN_nist_mod_224;
1283 ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx); 1283 ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
1284 err: 1284err:
1285 BN_CTX_end(ctx); 1285 BN_CTX_end(ctx);
1286 BN_CTX_free(new_ctx); 1286 BN_CTX_free(new_ctx);
1287 return ret; 1287 return ret;
@@ -1537,7 +1537,7 @@ ec_GFp_nistp224_points_mul(const EC_GROUP * group, EC_POINT * r,
1537 } 1537 }
1538 ret = EC_POINT_set_Jprojective_coordinates_GFp(group, r, x, y, z, ctx); 1538 ret = EC_POINT_set_Jprojective_coordinates_GFp(group, r, x, y, z, ctx);
1539 1539
1540 err: 1540err:
1541 BN_CTX_end(ctx); 1541 BN_CTX_end(ctx);
1542 EC_POINT_free(generator); 1542 EC_POINT_free(generator);
1543 BN_CTX_free(new_ctx); 1543 BN_CTX_free(new_ctx);
@@ -1666,7 +1666,7 @@ ec_GFp_nistp224_precompute_mult(EC_GROUP * group, BN_CTX * ctx)
1666 goto err; 1666 goto err;
1667 ret = 1; 1667 ret = 1;
1668 pre = NULL; 1668 pre = NULL;
1669 err: 1669err:
1670 BN_CTX_end(ctx); 1670 BN_CTX_end(ctx);
1671 EC_POINT_free(generator); 1671 EC_POINT_free(generator);
1672 BN_CTX_free(new_ctx); 1672 BN_CTX_free(new_ctx);
diff --git a/src/lib/libcrypto/ec/ecp_nistp256.c b/src/lib/libcrypto/ec/ecp_nistp256.c
index 7046dcebc0..3b0784f153 100644
--- a/src/lib/libcrypto/ec/ecp_nistp256.c
+++ b/src/lib/libcrypto/ec/ecp_nistp256.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_nistp256.c,v 1.19 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ecp_nistp256.c,v 1.20 2018/07/15 05:38:48 jsg Exp $ */
2/* 2/*
3 * Written by Adam Langley (Google) for the OpenSSL project 3 * Written by Adam Langley (Google) for the OpenSSL project
4 */ 4 */
@@ -1830,7 +1830,7 @@ ec_GFp_nistp256_group_set_curve(EC_GROUP * group, const BIGNUM * p,
1830 } 1830 }
1831 group->field_mod_func = BN_nist_mod_256; 1831 group->field_mod_func = BN_nist_mod_256;
1832 ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx); 1832 ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
1833 err: 1833err:
1834 BN_CTX_end(ctx); 1834 BN_CTX_end(ctx);
1835 BN_CTX_free(new_ctx); 1835 BN_CTX_free(new_ctx);
1836 return ret; 1836 return ret;
@@ -2090,7 +2090,7 @@ ec_GFp_nistp256_points_mul(const EC_GROUP * group, EC_POINT * r,
2090 } 2090 }
2091 ret = EC_POINT_set_Jprojective_coordinates_GFp(group, r, x, y, z, ctx); 2091 ret = EC_POINT_set_Jprojective_coordinates_GFp(group, r, x, y, z, ctx);
2092 2092
2093 err: 2093err:
2094 BN_CTX_end(ctx); 2094 BN_CTX_end(ctx);
2095 EC_POINT_free(generator); 2095 EC_POINT_free(generator);
2096 BN_CTX_free(new_ctx); 2096 BN_CTX_free(new_ctx);
@@ -2213,7 +2213,7 @@ ec_GFp_nistp256_precompute_mult(EC_GROUP * group, BN_CTX * ctx)
2213 goto err; 2213 goto err;
2214 ret = 1; 2214 ret = 1;
2215 pre = NULL; 2215 pre = NULL;
2216 err: 2216err:
2217 BN_CTX_end(ctx); 2217 BN_CTX_end(ctx);
2218 EC_POINT_free(generator); 2218 EC_POINT_free(generator);
2219 BN_CTX_free(new_ctx); 2219 BN_CTX_free(new_ctx);
diff --git a/src/lib/libcrypto/ec/ecp_nistp521.c b/src/lib/libcrypto/ec/ecp_nistp521.c
index 7c20daae28..823e7a0d51 100644
--- a/src/lib/libcrypto/ec/ecp_nistp521.c
+++ b/src/lib/libcrypto/ec/ecp_nistp521.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_nistp521.c,v 1.20 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ecp_nistp521.c,v 1.21 2018/07/15 05:38:48 jsg Exp $ */
2/* 2/*
3 * Written by Adam Langley (Google) for the OpenSSL project 3 * Written by Adam Langley (Google) for the OpenSSL project
4 */ 4 */
@@ -1721,7 +1721,7 @@ ec_GFp_nistp521_group_set_curve(EC_GROUP * group, const BIGNUM * p,
1721 } 1721 }
1722 group->field_mod_func = BN_nist_mod_521; 1722 group->field_mod_func = BN_nist_mod_521;
1723 ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx); 1723 ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
1724 err: 1724err:
1725 BN_CTX_end(ctx); 1725 BN_CTX_end(ctx);
1726 BN_CTX_free(new_ctx); 1726 BN_CTX_free(new_ctx);
1727 return ret; 1727 return ret;
@@ -1979,7 +1979,7 @@ ec_GFp_nistp521_points_mul(const EC_GROUP * group, EC_POINT * r,
1979 } 1979 }
1980 ret = EC_POINT_set_Jprojective_coordinates_GFp(group, r, x, y, z, ctx); 1980 ret = EC_POINT_set_Jprojective_coordinates_GFp(group, r, x, y, z, ctx);
1981 1981
1982 err: 1982err:
1983 BN_CTX_end(ctx); 1983 BN_CTX_end(ctx);
1984 EC_POINT_free(generator); 1984 EC_POINT_free(generator);
1985 BN_CTX_free(new_ctx); 1985 BN_CTX_free(new_ctx);
@@ -2088,7 +2088,7 @@ ec_GFp_nistp521_precompute_mult(EC_GROUP * group, BN_CTX * ctx)
2088 goto err; 2088 goto err;
2089 ret = 1; 2089 ret = 1;
2090 pre = NULL; 2090 pre = NULL;
2091 err: 2091err:
2092 BN_CTX_end(ctx); 2092 BN_CTX_end(ctx);
2093 EC_POINT_free(generator); 2093 EC_POINT_free(generator);
2094 BN_CTX_free(new_ctx); 2094 BN_CTX_free(new_ctx);
diff --git a/src/lib/libcrypto/ec/ecp_nistz256.c b/src/lib/libcrypto/ec/ecp_nistz256.c
index 3d52938721..71c2952d8c 100644
--- a/src/lib/libcrypto/ec/ecp_nistz256.c
+++ b/src/lib/libcrypto/ec/ecp_nistz256.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_nistz256.c,v 1.4 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ecp_nistz256.c,v 1.5 2018/07/15 05:38:48 jsg Exp $ */
2/* Copyright (c) 2014, Intel Corporation. 2/* Copyright (c) 2014, Intel Corporation.
3 * 3 *
4 * Permission to use, copy, modify, and/or distribute this software for any 4 * Permission to use, copy, modify, and/or distribute this software for any
@@ -565,7 +565,7 @@ ecp_nistz256_windowed_mul(const EC_GROUP *group, P256_POINT *r,
565 } 565 }
566 566
567 ret = 1; 567 ret = 1;
568 err: 568err:
569 free(table); 569 free(table);
570 free(p_str); 570 free(p_str);
571 free(scalars); 571 free(scalars);
@@ -712,7 +712,7 @@ ecp_nistz256_mult_precompute(EC_GROUP *group, BN_CTX *ctx)
712 ec_pre_comp = NULL; 712 ec_pre_comp = NULL;
713 ret = 1; 713 ret = 1;
714 714
715 err: 715err:
716 if (ctx != NULL) 716 if (ctx != NULL)
717 BN_CTX_end(ctx); 717 BN_CTX_end(ctx);
718 BN_CTX_free(new_ctx); 718 BN_CTX_free(new_ctx);
@@ -985,7 +985,7 @@ ecp_nistz256_points_mul(const EC_GROUP *group, EC_POINT *r,
985 985
986 ret = 1; 986 ret = 1;
987 987
988 err: 988err:
989 if (ctx) 989 if (ctx)
990 BN_CTX_end(ctx); 990 BN_CTX_end(ctx);
991 BN_CTX_free(new_ctx); 991 BN_CTX_free(new_ctx);
diff --git a/src/lib/libcrypto/ec/ecp_oct.c b/src/lib/libcrypto/ec/ecp_oct.c
index da9eccfe6a..3d50f707c0 100644
--- a/src/lib/libcrypto/ec/ecp_oct.c
+++ b/src/lib/libcrypto/ec/ecp_oct.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_oct.c,v 1.9 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ecp_oct.c,v 1.10 2018/07/15 05:38:48 jsg Exp $ */
2/* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de> 2/* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
3 * for the OpenSSL project. 3 * for the OpenSSL project.
4 * Includes code written by Bodo Moeller for the OpenSSL project. 4 * Includes code written by Bodo Moeller for the OpenSSL project.
@@ -190,7 +190,7 @@ ec_GFp_simple_set_compressed_coordinates(const EC_GROUP * group,
190 190
191 ret = 1; 191 ret = 1;
192 192
193 err: 193err:
194 BN_CTX_end(ctx); 194 BN_CTX_end(ctx);
195 BN_CTX_free(new_ctx); 195 BN_CTX_free(new_ctx);
196 return ret; 196 return ret;
@@ -294,7 +294,7 @@ ec_GFp_simple_point2oct(const EC_GROUP * group, const EC_POINT * point, point_co
294 BN_CTX_free(new_ctx); 294 BN_CTX_free(new_ctx);
295 return ret; 295 return ret;
296 296
297 err: 297err:
298 if (used_ctx) 298 if (used_ctx)
299 BN_CTX_end(ctx); 299 BN_CTX_end(ctx);
300 BN_CTX_free(new_ctx); 300 BN_CTX_free(new_ctx);
@@ -388,7 +388,7 @@ ec_GFp_simple_oct2point(const EC_GROUP * group, EC_POINT * point,
388 } 388 }
389 ret = 1; 389 ret = 1;
390 390
391 err: 391err:
392 BN_CTX_end(ctx); 392 BN_CTX_end(ctx);
393 BN_CTX_free(new_ctx); 393 BN_CTX_free(new_ctx);
394 return ret; 394 return ret;
diff --git a/src/lib/libcrypto/ec/ecp_smpl.c b/src/lib/libcrypto/ec/ecp_smpl.c
index 57e8345364..1fe55307b4 100644
--- a/src/lib/libcrypto/ec/ecp_smpl.c
+++ b/src/lib/libcrypto/ec/ecp_smpl.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_smpl.c,v 1.19 2018/07/10 22:06:14 tb Exp $ */ 1/* $OpenBSD: ecp_smpl.c,v 1.20 2018/07/15 05:38:48 jsg Exp $ */
2/* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de> 2/* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
3 * for the OpenSSL project. 3 * for the OpenSSL project.
4 * Includes code written by Bodo Moeller for the OpenSSL project. 4 * Includes code written by Bodo Moeller for the OpenSSL project.
@@ -103,9 +103,6 @@ EC_GFp_simple_method(void)
103 .point_cmp = ec_GFp_simple_cmp, 103 .point_cmp = ec_GFp_simple_cmp,
104 .make_affine = ec_GFp_simple_make_affine, 104 .make_affine = ec_GFp_simple_make_affine,
105 .points_make_affine = ec_GFp_simple_points_make_affine, 105 .points_make_affine = ec_GFp_simple_points_make_affine,
106 .mul_generator_ct = ec_GFp_simple_mul_generator_ct,
107 .mul_single_ct = ec_GFp_simple_mul_single_ct,
108 .mul_double_nonct = ec_GFp_simple_mul_double_nonct,
109 .field_mul = ec_GFp_simple_field_mul, 106 .field_mul = ec_GFp_simple_field_mul,
110 .field_sqr = ec_GFp_simple_field_sqr 107 .field_sqr = ec_GFp_simple_field_sqr
111 }; 108 };
@@ -223,7 +220,7 @@ ec_GFp_simple_group_set_curve(EC_GROUP * group,
223 220
224 ret = 1; 221 ret = 1;
225 222
226 err: 223err:
227 BN_CTX_end(ctx); 224 BN_CTX_end(ctx);
228 BN_CTX_free(new_ctx); 225 BN_CTX_free(new_ctx);
229 return ret; 226 return ret;
@@ -268,7 +265,7 @@ ec_GFp_simple_group_get_curve(const EC_GROUP * group, BIGNUM * p, BIGNUM * a, BI
268 } 265 }
269 ret = 1; 266 ret = 1;
270 267
271 err: 268err:
272 BN_CTX_free(new_ctx); 269 BN_CTX_free(new_ctx);
273 return ret; 270 return ret;
274} 271}
@@ -349,7 +346,7 @@ ec_GFp_simple_group_check_discriminant(const EC_GROUP * group, BN_CTX * ctx)
349 } 346 }
350 ret = 1; 347 ret = 1;
351 348
352 err: 349err:
353 if (ctx != NULL) 350 if (ctx != NULL)
354 BN_CTX_end(ctx); 351 BN_CTX_end(ctx);
355 BN_CTX_free(new_ctx); 352 BN_CTX_free(new_ctx);
@@ -459,7 +456,7 @@ ec_GFp_simple_set_Jprojective_coordinates_GFp(const EC_GROUP * group, EC_POINT *
459 } 456 }
460 ret = 1; 457 ret = 1;
461 458
462 err: 459err:
463 BN_CTX_free(new_ctx); 460 BN_CTX_free(new_ctx);
464 return ret; 461 return ret;
465} 462}
@@ -507,7 +504,7 @@ ec_GFp_simple_get_Jprojective_coordinates_GFp(const EC_GROUP * group, const EC_P
507 504
508 ret = 1; 505 ret = 1;
509 506
510 err: 507err:
511 BN_CTX_free(new_ctx); 508 BN_CTX_free(new_ctx);
512 return ret; 509 return ret;
513} 510}
@@ -627,7 +624,7 @@ ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP * group, const EC_POIN
627 624
628 ret = 1; 625 ret = 1;
629 626
630 err: 627err:
631 BN_CTX_end(ctx); 628 BN_CTX_end(ctx);
632 BN_CTX_free(new_ctx); 629 BN_CTX_free(new_ctx);
633 return ret; 630 return ret;
@@ -814,7 +811,7 @@ ec_GFp_simple_add(const EC_GROUP * group, EC_POINT * r, const EC_POINT * a, cons
814 811
815 ret = 1; 812 ret = 1;
816 813
817 end: 814end:
818 if (ctx) /* otherwise we already called BN_CTX_end */ 815 if (ctx) /* otherwise we already called BN_CTX_end */
819 BN_CTX_end(ctx); 816 BN_CTX_end(ctx);
820 BN_CTX_free(new_ctx); 817 BN_CTX_free(new_ctx);
@@ -957,7 +954,7 @@ ec_GFp_simple_dbl(const EC_GROUP * group, EC_POINT * r, const EC_POINT * a, BN_C
957 954
958 ret = 1; 955 ret = 1;
959 956
960 err: 957err:
961 BN_CTX_end(ctx); 958 BN_CTX_end(ctx);
962 BN_CTX_free(new_ctx); 959 BN_CTX_free(new_ctx);
963 return ret; 960 return ret;
@@ -1078,7 +1075,7 @@ ec_GFp_simple_is_on_curve(const EC_GROUP * group, const EC_POINT * point, BN_CTX
1078 1075
1079 ret = (0 == BN_ucmp(tmp, rh)); 1076 ret = (0 == BN_ucmp(tmp, rh));
1080 1077
1081 err: 1078err:
1082 BN_CTX_end(ctx); 1079 BN_CTX_end(ctx);
1083 BN_CTX_free(new_ctx); 1080 BN_CTX_free(new_ctx);
1084 return ret; 1081 return ret;
@@ -1180,7 +1177,7 @@ ec_GFp_simple_cmp(const EC_GROUP * group, const EC_POINT * a, const EC_POINT * b
1180 /* points are equal */ 1177 /* points are equal */
1181 ret = 0; 1178 ret = 0;
1182 1179
1183 end: 1180end:
1184 BN_CTX_end(ctx); 1181 BN_CTX_end(ctx);
1185 BN_CTX_free(new_ctx); 1182 BN_CTX_free(new_ctx);
1186 return ret; 1183 return ret;
@@ -1218,7 +1215,7 @@ ec_GFp_simple_make_affine(const EC_GROUP * group, EC_POINT * point, BN_CTX * ctx
1218 } 1215 }
1219 ret = 1; 1216 ret = 1;
1220 1217
1221 err: 1218err:
1222 BN_CTX_end(ctx); 1219 BN_CTX_end(ctx);
1223 BN_CTX_free(new_ctx); 1220 BN_CTX_free(new_ctx);
1224 return ret; 1221 return ret;
@@ -1383,7 +1380,7 @@ ec_GFp_simple_points_make_affine(const EC_GROUP * group, size_t num, EC_POINT *
1383 1380
1384 ret = 1; 1381 ret = 1;
1385 1382
1386 err: 1383err:
1387 BN_CTX_end(ctx); 1384 BN_CTX_end(ctx);
1388 BN_CTX_free(new_ctx); 1385 BN_CTX_free(new_ctx);
1389 if (heap != NULL) { 1386 if (heap != NULL) {
@@ -1412,248 +1409,3 @@ ec_GFp_simple_field_sqr(const EC_GROUP * group, BIGNUM * r, const BIGNUM * a, BN
1412{ 1409{
1413 return BN_mod_sqr(r, a, &group->field, ctx); 1410 return BN_mod_sqr(r, a, &group->field, ctx);
1414} 1411}
1415
1416#define EC_POINT_BN_set_flags(P, flags) do { \
1417 BN_set_flags(&(P)->X, (flags)); \
1418 BN_set_flags(&(P)->Y, (flags)); \
1419 BN_set_flags(&(P)->Z, (flags)); \
1420} while(0)
1421
1422#define EC_POINT_CSWAP(c, a, b, w, t) do { \
1423 if (!BN_swap_ct(c, &(a)->X, &(b)->X, w) || \
1424 !BN_swap_ct(c, &(a)->Y, &(b)->Y, w) || \
1425 !BN_swap_ct(c, &(a)->Z, &(b)->Z, w)) \
1426 goto err; \
1427 t = ((a)->Z_is_one ^ (b)->Z_is_one) & (c); \
1428 (a)->Z_is_one ^= (t); \
1429 (b)->Z_is_one ^= (t); \
1430} while(0)
1431
1432/*
1433 * This function computes (in constant time) a point multiplication over the
1434 * EC group.
1435 *
1436 * At a high level, it is Montgomery ladder with conditional swaps.
1437 *
1438 * It performs either a fixed point multiplication
1439 * (scalar * generator)
1440 * when point is NULL, or a variable point multiplication
1441 * (scalar * point)
1442 * when point is not NULL.
1443 *
1444 * scalar should be in the range [0,n) otherwise all constant time bets are off.
1445 *
1446 * NB: This says nothing about EC_POINT_add and EC_POINT_dbl,
1447 * which of course are not constant time themselves.
1448 *
1449 * The product is stored in r.
1450 *
1451 * Returns 1 on success, 0 otherwise.
1452 */
1453static int
1454ec_GFp_simple_mul_ct(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
1455 const EC_POINT *point, BN_CTX *ctx)
1456{
1457 int i, cardinality_bits, group_top, kbit, pbit, Z_is_one;
1458 EC_POINT *s = NULL;
1459 BIGNUM *k = NULL;
1460 BIGNUM *lambda = NULL;
1461 BIGNUM *cardinality = NULL;
1462 BN_CTX *new_ctx = NULL;
1463 int ret = 0;
1464
1465 if (ctx == NULL && (ctx = new_ctx = BN_CTX_new()) == NULL)
1466 return 0;
1467
1468 BN_CTX_start(ctx);
1469
1470 if ((s = EC_POINT_new(group)) == NULL)
1471 goto err;
1472
1473 if (point == NULL) {
1474 if (!EC_POINT_copy(s, group->generator))
1475 goto err;
1476 } else {
1477 if (!EC_POINT_copy(s, point))
1478 goto err;
1479 }
1480
1481 EC_POINT_BN_set_flags(s, BN_FLG_CONSTTIME);
1482
1483 if ((cardinality = BN_CTX_get(ctx)) == NULL)
1484 goto err;
1485 if ((lambda = BN_CTX_get(ctx)) == NULL)
1486 goto err;
1487 if ((k = BN_CTX_get(ctx)) == NULL)
1488 goto err;
1489 if (!BN_mul(cardinality, &group->order, &group->cofactor, ctx))
1490 goto err;
1491
1492 /*
1493 * Group cardinalities are often on a word boundary.
1494 * So when we pad the scalar, some timing diff might
1495 * pop if it needs to be expanded due to carries.
1496 * So expand ahead of time.
1497 */
1498 cardinality_bits = BN_num_bits(cardinality);
1499 group_top = cardinality->top;
1500 if ((bn_wexpand(k, group_top + 1) == NULL) ||
1501 (bn_wexpand(lambda, group_top + 1) == NULL))
1502 goto err;
1503
1504 if (!BN_copy(k, scalar))
1505 goto err;
1506
1507 BN_set_flags(k, BN_FLG_CONSTTIME);
1508
1509 if (BN_num_bits(k) > cardinality_bits || BN_is_negative(k)) {
1510 /*
1511 * This is an unusual input, and we don't guarantee
1512 * constant-timeness
1513 */
1514 if (!BN_nnmod(k, k, cardinality, ctx))
1515 goto err;
1516 }
1517
1518 if (!BN_add(lambda, k, cardinality))
1519 goto err;
1520 BN_set_flags(lambda, BN_FLG_CONSTTIME);
1521 if (!BN_add(k, lambda, cardinality))
1522 goto err;
1523 /*
1524 * lambda := scalar + cardinality
1525 * k := scalar + 2*cardinality
1526 */
1527 kbit = BN_is_bit_set(lambda, cardinality_bits);
1528 if (!BN_swap_ct(kbit, k, lambda, group_top + 1))
1529 goto err;
1530
1531 group_top = group->field.top;
1532 if ((bn_wexpand(&s->X, group_top) == NULL) ||
1533 (bn_wexpand(&s->Y, group_top) == NULL) ||
1534 (bn_wexpand(&s->Z, group_top) == NULL) ||
1535 (bn_wexpand(&r->X, group_top) == NULL) ||
1536 (bn_wexpand(&r->Y, group_top) == NULL) ||
1537 (bn_wexpand(&r->Z, group_top) == NULL))
1538 goto err;
1539
1540 /* top bit is a 1, in a fixed pos */
1541 if (!EC_POINT_copy(r, s))
1542 goto err;
1543
1544 EC_POINT_BN_set_flags(r, BN_FLG_CONSTTIME);
1545
1546 if (!EC_POINT_dbl(group, s, s, ctx))
1547 goto err;
1548
1549 pbit = 0;
1550
1551 /*
1552 * The ladder step, with branches, is
1553 *
1554 * k[i] == 0: S = add(R, S), R = dbl(R)
1555 * k[i] == 1: R = add(S, R), S = dbl(S)
1556 *
1557 * Swapping R, S conditionally on k[i] leaves you with state
1558 *
1559 * k[i] == 0: T, U = R, S
1560 * k[i] == 1: T, U = S, R
1561 *
1562 * Then perform the ECC ops.
1563 *
1564 * U = add(T, U)
1565 * T = dbl(T)
1566 *
1567 * Which leaves you with state
1568 *
1569 * k[i] == 0: U = add(R, S), T = dbl(R)
1570 * k[i] == 1: U = add(S, R), T = dbl(S)
1571 *
1572 * Swapping T, U conditionally on k[i] leaves you with state
1573 *
1574 * k[i] == 0: R, S = T, U
1575 * k[i] == 1: R, S = U, T
1576 *
1577 * Which leaves you with state
1578 *
1579 * k[i] == 0: S = add(R, S), R = dbl(R)
1580 * k[i] == 1: R = add(S, R), S = dbl(S)
1581 *
1582 * So we get the same logic, but instead of a branch it's a
1583 * conditional swap, followed by ECC ops, then another conditional swap.
1584 *
1585 * Optimization: The end of iteration i and start of i-1 looks like
1586 *
1587 * ...
1588 * CSWAP(k[i], R, S)
1589 * ECC
1590 * CSWAP(k[i], R, S)
1591 * (next iteration)
1592 * CSWAP(k[i-1], R, S)
1593 * ECC
1594 * CSWAP(k[i-1], R, S)
1595 * ...
1596 *
1597 * So instead of two contiguous swaps, you can merge the condition
1598 * bits and do a single swap.
1599 *
1600 * k[i] k[i-1] Outcome
1601 * 0 0 No Swap
1602 * 0 1 Swap
1603 * 1 0 Swap
1604 * 1 1 No Swap
1605 *
1606 * This is XOR. pbit tracks the previous bit of k.
1607 */
1608
1609 for (i = cardinality_bits - 1; i >= 0; i--) {
1610 kbit = BN_is_bit_set(k, i) ^ pbit;
1611 EC_POINT_CSWAP(kbit, r, s, group_top, Z_is_one);
1612 if (!EC_POINT_add(group, s, r, s, ctx))
1613 goto err;
1614 if (!EC_POINT_dbl(group, r, r, ctx))
1615 goto err;
1616 /*
1617 * pbit logic merges this cswap with that of the
1618 * next iteration
1619 */
1620 pbit ^= kbit;
1621 }
1622 /* one final cswap to move the right value into r */
1623 EC_POINT_CSWAP(pbit, r, s, group_top, Z_is_one);
1624
1625 ret = 1;
1626
1627 err:
1628 EC_POINT_free(s);
1629 if (ctx != NULL)
1630 BN_CTX_end(ctx);
1631 BN_CTX_free(new_ctx);
1632
1633 return ret;
1634}
1635
1636#undef EC_POINT_BN_set_flags
1637#undef EC_POINT_CSWAP
1638
1639int
1640ec_GFp_simple_mul_generator_ct(const EC_GROUP *group, EC_POINT *r,
1641 const BIGNUM *scalar, BN_CTX *ctx)
1642{
1643 return ec_GFp_simple_mul_ct(group, r, scalar, NULL, ctx);
1644}
1645
1646int
1647ec_GFp_simple_mul_single_ct(const EC_GROUP *group, EC_POINT *r,
1648 const BIGNUM *scalar, const EC_POINT *point, BN_CTX *ctx)
1649{
1650 return ec_GFp_simple_mul_ct(group, r, scalar, point, ctx);
1651}
1652
1653int
1654ec_GFp_simple_mul_double_nonct(const EC_GROUP *group, EC_POINT *r,
1655 const BIGNUM *g_scalar, const BIGNUM *p_scalar, const EC_POINT *point,
1656 BN_CTX *ctx)
1657{
1658 return ec_wNAF_mul(group, r, g_scalar, 1, &point, &p_scalar, ctx);
1659}
diff --git a/src/lib/libcrypto/man/EC_POINT_add.3 b/src/lib/libcrypto/man/EC_POINT_add.3
index e2a33b6a72..a9ad5563cc 100644
--- a/src/lib/libcrypto/man/EC_POINT_add.3
+++ b/src/lib/libcrypto/man/EC_POINT_add.3
@@ -1,4 +1,4 @@
1.\" $OpenBSD: EC_POINT_add.3,v 1.9 2018/07/11 08:42:38 tb Exp $ 1.\" $OpenBSD: EC_POINT_add.3,v 1.10 2018/07/15 05:38:48 jsg Exp $
2.\" OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100 2.\" OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
3.\" 3.\"
4.\" This file was written by Matt Caswell <matt@openssl.org>. 4.\" This file was written by Matt Caswell <matt@openssl.org>.
@@ -48,7 +48,7 @@
48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 48.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
49.\" OF THE POSSIBILITY OF SUCH DAMAGE. 49.\" OF THE POSSIBILITY OF SUCH DAMAGE.
50.\" 50.\"
51.Dd $Mdocdate: July 11 2018 $ 51.Dd $Mdocdate: July 15 2018 $
52.Dt EC_POINT_ADD 3 52.Dt EC_POINT_ADD 3
53.Os 53.Os
54.Sh NAME 54.Sh NAME
@@ -217,30 +217,12 @@ The value
217.Fa n 217.Fa n
218may be 218may be
219.Dv NULL , 219.Dv NULL ,
220in which case the result is just 220in which case the result is just q * m.
221.Pp 221.Pp
222.Dl q * m.
223.Pp
224.Fn EC_POINTs_mul
225only supports the values 0 and 1 for
226.Fa num .
227If it is 1, then
228.Fn EC_POINTs_mul 222.Fn EC_POINTs_mul
229calculates the value 223calculates the value
230.Pp 224.Pp
231.Dl generator * n + q[0] * m[0]. 225.Dl generator * n + q[0] * m[0] + ... + q[num-1] * m[num-1]
232.Pp
233If
234.Fa num
235is 0 then
236.Fa q
237and
238.Fa m
239must be
240.Dv NULL ,
241and the result is just
242.Pp
243.Dl generator * n .
244.Pp 226.Pp
245As for 227As for
246.Fn EC_POINT_mul , 228.Fn EC_POINT_mul ,
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-21 01:48:30 +0000