5 files changed, 132 insertions, 25 deletions

diff --git a/src/lib/libcrypto/ec/ec_field.c b/src/lib/libcrypto/ec/ec_field.c
index ec1c7d11e0..6576526e77 100644
--- a/src/lib/libcrypto/ec/ec_field.c
+++ b/src/lib/libcrypto/ec/ec_field.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ec_field.c,v 1.1 2025/05/25 05:12:05 jsing Exp $      */
+/*      $OpenBSD: ec_field.c,v 1.3 2025/08/02 16:20:00 jsing Exp $      */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -131,6 +131,19 @@ ec_field_element_copy(EC_FIELD_ELEMENT *dst, const EC_FIELD_ELEMENT *src)
         memcpy(dst, src, sizeof(EC_FIELD_ELEMENT));
 }
 
+void
+ec_field_element_select(const EC_FIELD_MODULUS *fm, EC_FIELD_ELEMENT *r,
+    const EC_FIELD_ELEMENT *a, const EC_FIELD_ELEMENT *b, int conditional)
+{
+        BN_ULONG mask;
+        int i;
+
+        mask = bn_ct_eq_zero_mask(conditional);
+
+        for (i = 0; i < fm->n; i++)
+                r->w[i] = (a->w[i] & mask) | (b->w[i] & ~mask);
+}
+
 int
 ec_field_element_equal(const EC_FIELD_MODULUS *fm, const EC_FIELD_ELEMENT *a,
     const EC_FIELD_ELEMENT *b)
@@ -185,5 +198,5 @@ ec_field_element_sqr(const EC_FIELD_MODULUS *m, EC_FIELD_ELEMENT *r,
 {
         BN_ULONG t[EC_FIELD_ELEMENT_MAX_WORDS * 2 + 2];
 
-        bn_mod_mul_words(r->w, a->w, a->w, m->m.w, t, m->minv0, m->n);
+        bn_mod_sqr_words(r->w, a->w, m->m.w, t, m->minv0, m->n);
 }
diff --git a/src/lib/libcrypto/ec/ec_internal.h b/src/lib/libcrypto/ec/ec_internal.h
index 29b447e8c9..327d9ea94d 100644
--- a/src/lib/libcrypto/ec/ec_internal.h
+++ b/src/lib/libcrypto/ec/ec_internal.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ec_internal.h,v 1.1 2025/05/25 05:12:05 jsing Exp $   */
+/*      $OpenBSD: ec_internal.h,v 1.2 2025/08/02 15:44:09 jsing Exp $   */
 /*
  * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
  *
@@ -46,6 +46,8 @@ int ec_field_element_to_bn(const EC_FIELD_MODULUS *fm, const EC_FIELD_ELEMENT *f
     BIGNUM *bn, BN_CTX *ctx);
 
 void ec_field_element_copy(EC_FIELD_ELEMENT *dst, const EC_FIELD_ELEMENT *src);
+void ec_field_element_select(const EC_FIELD_MODULUS *fm, EC_FIELD_ELEMENT *r,
+    const EC_FIELD_ELEMENT *a, const EC_FIELD_ELEMENT *b, int conditional);
 
 int ec_field_element_equal(const EC_FIELD_MODULUS *fm, const EC_FIELD_ELEMENT *a,
     const EC_FIELD_ELEMENT *b);
diff --git a/src/lib/libcrypto/ec/ec_lib.c b/src/lib/libcrypto/ec/ec_lib.c
index 7cc7efe73f..36f42ecc05 100644
--- a/src/lib/libcrypto/ec/ec_lib.c
+++ b/src/lib/libcrypto/ec/ec_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_lib.c,v 1.125 2025/05/24 08:25:58 jsing Exp $ */
+/* $OpenBSD: ec_lib.c,v 1.126 2025/08/02 15:47:27 jsing Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -165,6 +165,10 @@ EC_GROUP_copy(EC_GROUP *dst, const EC_GROUP *src)
 
         dst->a_is_minus3 = src->a_is_minus3;
 
+        memcpy(&dst->fm, &src->fm, sizeof(src->fm));
+        memcpy(&dst->fe_a, &src->fe_a, sizeof(src->fe_a));
+        memcpy(&dst->fe_b, &src->fe_b, sizeof(src->fe_b));
+
         BN_MONT_CTX_free(dst->mont_ctx);
         dst->mont_ctx = NULL;
         if (src->mont_ctx != NULL) {
@@ -860,6 +864,10 @@ EC_POINT_copy(EC_POINT *dst, const EC_POINT *src)
                 return 0;
         dst->Z_is_one = src->Z_is_one;
 
+        memcpy(&dst->fe_x, &src->fe_x, sizeof(dst->fe_x));
+        memcpy(&dst->fe_y, &src->fe_y, sizeof(dst->fe_y));
+        memcpy(&dst->fe_z, &src->fe_z, sizeof(dst->fe_z));
+
         return 1;
 }
 LCRYPTO_ALIAS(EC_POINT_copy);
diff --git a/src/lib/libcrypto/ec/ec_local.h b/src/lib/libcrypto/ec/ec_local.h
index 75a3e25247..eac9e6d26c 100644
--- a/src/lib/libcrypto/ec/ec_local.h
+++ b/src/lib/libcrypto/ec/ec_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_local.h,v 1.69 2025/05/25 05:19:26 jsing Exp $ */
+/* $OpenBSD: ec_local.h,v 1.70 2025/08/03 15:07:57 jsing Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -184,6 +184,7 @@ struct ec_point_st {
 
 const EC_METHOD *EC_GFp_simple_method(void);
 const EC_METHOD *EC_GFp_mont_method(void);
+const EC_METHOD *EC_GFp_homogeneous_projective_method(void);
 
 /* Compute r = scalar1 * point1 + scalar2 * point2 in non-constant time. */
 int ec_wnaf_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar1,
diff --git a/src/lib/libcrypto/ec/ecp_hp_methods.c b/src/lib/libcrypto/ec/ecp_hp_methods.c
index c62334e7c8..0b34a55b9d 100644
--- a/src/lib/libcrypto/ec/ecp_hp_methods.c
+++ b/src/lib/libcrypto/ec/ecp_hp_methods.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ecp_hp_methods.c,v 1.3 2025/06/01 03:23:33 tb Exp $   */
+/*      $OpenBSD: ecp_hp_methods.c,v 1.5 2025/08/03 15:44:00 jsing Exp $        */
 /*
  * Copyright (c) 2024-2025 Joel Sing <jsing@openbsd.org>
  *
@@ -22,15 +22,11 @@
 #include <openssl/err.h>
 
 #include "bn_internal.h"
+#include "crypto_internal.h"
 #include "ec_local.h"
 #include "ec_internal.h"
 #include "err_local.h"
 
-/*
- * TODO:
- *  - Constant time and blinding for scalar multiplication
- */
-
 static int
 ec_group_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
     const BIGNUM *b, BN_CTX *ctx)
@@ -439,10 +435,6 @@ ec_point_dbl_a1(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a, BN_CTX *c
         ec_field_element_add(&group->fm, &b3, &gb, &gb);
         ec_field_element_add(&group->fm, &b3, &b3, &gb);
 
-        /* b3 := 3 * b ; */
-        ec_field_element_add(&group->fm, &b3, &gb, &gb);
-        ec_field_element_add(&group->fm, &b3, &b3, &gb);
-
         /* t0 := X^2; t1 := Y^2; t2 := Z^2 ; */
         ec_field_element_sqr(&group->fm, &t0, &X1);
         ec_field_element_sqr(&group->fm, &t1, &Y1);
@@ -785,38 +777,129 @@ ec_points_make_affine(const EC_GROUP *group, size_t num, EC_POINT *points[],
 }
 #endif
 
+static void
+ec_point_select(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
+    const EC_POINT *b, int conditional)
+{
+        ec_field_element_select(&group->fm, &r->fe_x, &a->fe_x, &b->fe_x, conditional);
+        ec_field_element_select(&group->fm, &r->fe_y, &a->fe_y, &b->fe_y, conditional);
+        ec_field_element_select(&group->fm, &r->fe_z, &a->fe_z, &b->fe_z, conditional);
+}
+
 static int
 ec_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, const EC_POINT *point,
     BN_CTX *ctx)
 {
-        EC_POINT *rr;
-        int bits, i;
+        BIGNUM *cardinality;
+        EC_POINT *multiples[15];
+        EC_POINT *rr = NULL, *t = NULL;
+        uint8_t *scalar_bytes = NULL;
+        int scalar_len = 0;
+        uint8_t j, wv;
+        int conditional, i;
         int ret = 0;
 
-        /* XXX - need constant time and blinding. */
+        memset(multiples, 0, sizeof(multiples));
+
+        BN_CTX_start(ctx);
+
+        /* XXX - consider blinding. */
+
+        if ((cardinality = BN_CTX_get(ctx)) == NULL)
+                goto err;
+        if (!BN_mul(cardinality, group->order, group->cofactor, ctx))
+                goto err;
+
+        /* XXX - handle scalar > cardinality and/or negative. */
+
+        /* Convert scalar into big endian bytes. */
+        scalar_len = BN_num_bytes(cardinality);
+        if ((scalar_bytes = calloc(1, scalar_len)) == NULL)
+                goto err;
+        if (!BN_bn2binpad(scalar, scalar_bytes, scalar_len))
+                goto err;
+
+        /* Compute multiples of point. */
+        if ((multiples[0] = EC_POINT_dup(point, group)) == NULL)
+                goto err;
+        for (i = 1; i < 15; i += 2) {
+                if ((multiples[i] = EC_POINT_new(group)) == NULL)
+                        goto err;
+                if (!EC_POINT_dbl(group, multiples[i], multiples[i / 2], ctx))
+                        goto err;
+                if ((multiples[i + 1] = EC_POINT_new(group)) == NULL)
+                        goto err;
+                if (!EC_POINT_add(group, multiples[i + 1], multiples[i], point, ctx))
+                        goto err;
+        }
 
         if ((rr = EC_POINT_new(group)) == NULL)
                 goto err;
+        if ((t = EC_POINT_new(group)) == NULL)
+                goto err;
 
-        bits = BN_num_bits(scalar);
+        if (!EC_POINT_set_to_infinity(group, rr))
+                goto err;
+
+        for (i = 0; i < scalar_len; i++) {
+                if (i != 0) {
+                        if (!EC_POINT_dbl(group, rr, rr, ctx))
+                                goto err;
+                        if (!EC_POINT_dbl(group, rr, rr, ctx))
+                                goto err;
+                        if (!EC_POINT_dbl(group, rr, rr, ctx))
+                                goto err;
+                        if (!EC_POINT_dbl(group, rr, rr, ctx))
+                                goto err;
+                }
 
-        EC_POINT_copy(rr, point);
+                if (!EC_POINT_set_to_infinity(group, t))
+                        goto err;
+
+                wv = scalar_bytes[i] >> 4;
+                for (j = 1; j < 16; j++) {
+                        conditional = crypto_ct_eq_u8(j, wv);
+                        ec_point_select(group, t, t, multiples[j - 1], conditional);
+                }
+                if (!EC_POINT_add(group, rr, rr, t, ctx))
+                        goto err;
 
-        for (i = bits - 2; i >= 0; i--) {
                 if (!EC_POINT_dbl(group, rr, rr, ctx))
                         goto err;
-                if (BN_is_bit_set(scalar, i)) {
-                        if (!EC_POINT_add(group, rr, rr, point, ctx))
-                                goto err;
+                if (!EC_POINT_dbl(group, rr, rr, ctx))
+                        goto err;
+                if (!EC_POINT_dbl(group, rr, rr, ctx))
+                        goto err;
+                if (!EC_POINT_dbl(group, rr, rr, ctx))
+                        goto err;
+
+                if (!EC_POINT_set_to_infinity(group, t))
+                        goto err;
+
+                wv = scalar_bytes[i] & 0xf;
+                for (j = 1; j < 16; j++) {
+                        conditional = crypto_ct_eq_u8(j, wv);
+                        ec_point_select(group, t, t, multiples[j - 1], conditional);
                 }
+                if (!EC_POINT_add(group, rr, rr, t, ctx))
+                        goto err;
         }
 
-        EC_POINT_copy(r, rr);
+        if (!EC_POINT_copy(r, rr))
+                goto err;
 
         ret = 1;
 
  err:
+        for (i = 0; i < 15; i++)
+                EC_POINT_free(multiples[i]);
+
         EC_POINT_free(rr);
+        EC_POINT_free(t);
+
+        freezero(scalar_bytes, scalar_len);
+
+        BN_CTX_end(ctx);
 
         return ret;
 }