summaryrefslogtreecommitdiff
path: root/src/lib
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib')
-rw-r--r--src/lib/libcrypto/ec/ecp_mont.c32
-rw-r--r--src/lib/libcrypto/ec/ecp_nist.c20
-rw-r--r--src/lib/libcrypto/ec/ecp_nistp224.c72
-rw-r--r--src/lib/libcrypto/ec/ecp_nistp256.c110
-rw-r--r--src/lib/libcrypto/ec/ecp_nistp521.c84
-rw-r--r--src/lib/libcrypto/ec/ecp_smpl.c66
6 files changed, 192 insertions, 192 deletions
diff --git a/src/lib/libcrypto/ec/ecp_mont.c b/src/lib/libcrypto/ec/ecp_mont.c
index 7160692e9e..f371e3ec8f 100644
--- a/src/lib/libcrypto/ec/ecp_mont.c
+++ b/src/lib/libcrypto/ec/ecp_mont.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_mont.c,v 1.18 2021/04/20 17:28:18 tb Exp $ */ 1/* $OpenBSD: ecp_mont.c,v 1.19 2021/04/20 17:38:02 tb Exp $ */
2/* 2/*
3 * Originally written by Bodo Moeller for the OpenSSL project. 3 * Originally written by Bodo Moeller for the OpenSSL project.
4 */ 4 */
@@ -80,20 +80,20 @@ EC_GFp_mont_method(void)
80 .group_get_curve = ec_GFp_simple_group_get_curve, 80 .group_get_curve = ec_GFp_simple_group_get_curve,
81 .group_get_degree = ec_GFp_simple_group_get_degree, 81 .group_get_degree = ec_GFp_simple_group_get_degree,
82 .group_check_discriminant = 82 .group_check_discriminant =
83 ec_GFp_simple_group_check_discriminant, 83 ec_GFp_simple_group_check_discriminant,
84 .point_init = ec_GFp_simple_point_init, 84 .point_init = ec_GFp_simple_point_init,
85 .point_finish = ec_GFp_simple_point_finish, 85 .point_finish = ec_GFp_simple_point_finish,
86 .point_clear_finish = ec_GFp_simple_point_clear_finish, 86 .point_clear_finish = ec_GFp_simple_point_clear_finish,
87 .point_copy = ec_GFp_simple_point_copy, 87 .point_copy = ec_GFp_simple_point_copy,
88 .point_set_to_infinity = ec_GFp_simple_point_set_to_infinity, 88 .point_set_to_infinity = ec_GFp_simple_point_set_to_infinity,
89 .point_set_Jprojective_coordinates = 89 .point_set_Jprojective_coordinates =
90 ec_GFp_simple_set_Jprojective_coordinates, 90 ec_GFp_simple_set_Jprojective_coordinates,
91 .point_get_Jprojective_coordinates = 91 .point_get_Jprojective_coordinates =
92 ec_GFp_simple_get_Jprojective_coordinates, 92 ec_GFp_simple_get_Jprojective_coordinates,
93 .point_set_affine_coordinates = 93 .point_set_affine_coordinates =
94 ec_GFp_simple_point_set_affine_coordinates, 94 ec_GFp_simple_point_set_affine_coordinates,
95 .point_get_affine_coordinates = 95 .point_get_affine_coordinates =
96 ec_GFp_simple_point_get_affine_coordinates, 96 ec_GFp_simple_point_get_affine_coordinates,
97 .add = ec_GFp_simple_add, 97 .add = ec_GFp_simple_add,
98 .dbl = ec_GFp_simple_dbl, 98 .dbl = ec_GFp_simple_dbl,
99 .invert = ec_GFp_simple_invert, 99 .invert = ec_GFp_simple_invert,
@@ -117,7 +117,7 @@ EC_GFp_mont_method(void)
117} 117}
118 118
119 119
120int 120int
121ec_GFp_mont_group_init(EC_GROUP * group) 121ec_GFp_mont_group_init(EC_GROUP * group)
122{ 122{
123 int ok; 123 int ok;
@@ -129,7 +129,7 @@ ec_GFp_mont_group_init(EC_GROUP * group)
129} 129}
130 130
131 131
132void 132void
133ec_GFp_mont_group_finish(EC_GROUP * group) 133ec_GFp_mont_group_finish(EC_GROUP * group)
134{ 134{
135 BN_MONT_CTX_free(group->field_data1); 135 BN_MONT_CTX_free(group->field_data1);
@@ -140,7 +140,7 @@ ec_GFp_mont_group_finish(EC_GROUP * group)
140} 140}
141 141
142 142
143void 143void
144ec_GFp_mont_group_clear_finish(EC_GROUP * group) 144ec_GFp_mont_group_clear_finish(EC_GROUP * group)
145{ 145{
146 BN_MONT_CTX_free(group->field_data1); 146 BN_MONT_CTX_free(group->field_data1);
@@ -151,7 +151,7 @@ ec_GFp_mont_group_clear_finish(EC_GROUP * group)
151} 151}
152 152
153 153
154int 154int
155ec_GFp_mont_group_copy(EC_GROUP * dest, const EC_GROUP * src) 155ec_GFp_mont_group_copy(EC_GROUP * dest, const EC_GROUP * src)
156{ 156{
157 BN_MONT_CTX_free(dest->field_data1); 157 BN_MONT_CTX_free(dest->field_data1);
@@ -185,7 +185,7 @@ ec_GFp_mont_group_copy(EC_GROUP * dest, const EC_GROUP * src)
185} 185}
186 186
187 187
188int 188int
189ec_GFp_mont_group_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a, 189ec_GFp_mont_group_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
190 const BIGNUM *b, BN_CTX *ctx) 190 const BIGNUM *b, BN_CTX *ctx)
191{ 191{
@@ -237,7 +237,7 @@ ec_GFp_mont_group_set_curve(EC_GROUP *group, const BIGNUM *p, const BIGNUM *a,
237} 237}
238 238
239 239
240int 240int
241ec_GFp_mont_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, 241ec_GFp_mont_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
242 const BIGNUM *b, BN_CTX *ctx) 242 const BIGNUM *b, BN_CTX *ctx)
243{ 243{
@@ -249,7 +249,7 @@ ec_GFp_mont_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
249} 249}
250 250
251 251
252int 252int
253ec_GFp_mont_field_sqr(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, 253ec_GFp_mont_field_sqr(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
254 BN_CTX *ctx) 254 BN_CTX *ctx)
255{ 255{
@@ -261,7 +261,7 @@ ec_GFp_mont_field_sqr(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
261} 261}
262 262
263 263
264int 264int
265ec_GFp_mont_field_encode(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, 265ec_GFp_mont_field_encode(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
266 BN_CTX *ctx) 266 BN_CTX *ctx)
267{ 267{
@@ -273,7 +273,7 @@ ec_GFp_mont_field_encode(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
273} 273}
274 274
275 275
276int 276int
277ec_GFp_mont_field_decode(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, 277ec_GFp_mont_field_decode(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
278 BN_CTX *ctx) 278 BN_CTX *ctx)
279{ 279{
@@ -285,7 +285,7 @@ ec_GFp_mont_field_decode(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
285} 285}
286 286
287 287
288int 288int
289ec_GFp_mont_field_set_to_one(const EC_GROUP *group, BIGNUM *r, BN_CTX *ctx) 289ec_GFp_mont_field_set_to_one(const EC_GROUP *group, BIGNUM *r, BN_CTX *ctx)
290{ 290{
291 if (group->field_data2 == NULL) { 291 if (group->field_data2 == NULL) {
diff --git a/src/lib/libcrypto/ec/ecp_nist.c b/src/lib/libcrypto/ec/ecp_nist.c
index c34c708025..14ebe7d126 100644
--- a/src/lib/libcrypto/ec/ecp_nist.c
+++ b/src/lib/libcrypto/ec/ecp_nist.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_nist.c,v 1.16 2021/04/20 17:28:18 tb Exp $ */ 1/* $OpenBSD: ecp_nist.c,v 1.17 2021/04/20 17:38:02 tb Exp $ */
2/* 2/*
3 * Written by Nils Larsch for the OpenSSL project. 3 * Written by Nils Larsch for the OpenSSL project.
4 */ 4 */
@@ -81,20 +81,20 @@ EC_GFp_nist_method(void)
81 .group_get_curve = ec_GFp_simple_group_get_curve, 81 .group_get_curve = ec_GFp_simple_group_get_curve,
82 .group_get_degree = ec_GFp_simple_group_get_degree, 82 .group_get_degree = ec_GFp_simple_group_get_degree,
83 .group_check_discriminant = 83 .group_check_discriminant =
84 ec_GFp_simple_group_check_discriminant, 84 ec_GFp_simple_group_check_discriminant,
85 .point_init = ec_GFp_simple_point_init, 85 .point_init = ec_GFp_simple_point_init,
86 .point_finish = ec_GFp_simple_point_finish, 86 .point_finish = ec_GFp_simple_point_finish,
87 .point_clear_finish = ec_GFp_simple_point_clear_finish, 87 .point_clear_finish = ec_GFp_simple_point_clear_finish,
88 .point_copy = ec_GFp_simple_point_copy, 88 .point_copy = ec_GFp_simple_point_copy,
89 .point_set_to_infinity = ec_GFp_simple_point_set_to_infinity, 89 .point_set_to_infinity = ec_GFp_simple_point_set_to_infinity,
90 .point_set_Jprojective_coordinates = 90 .point_set_Jprojective_coordinates =
91 ec_GFp_simple_set_Jprojective_coordinates, 91 ec_GFp_simple_set_Jprojective_coordinates,
92 .point_get_Jprojective_coordinates = 92 .point_get_Jprojective_coordinates =
93 ec_GFp_simple_get_Jprojective_coordinates, 93 ec_GFp_simple_get_Jprojective_coordinates,
94 .point_set_affine_coordinates = 94 .point_set_affine_coordinates =
95 ec_GFp_simple_point_set_affine_coordinates, 95 ec_GFp_simple_point_set_affine_coordinates,
96 .point_get_affine_coordinates = 96 .point_get_affine_coordinates =
97 ec_GFp_simple_point_get_affine_coordinates, 97 ec_GFp_simple_point_get_affine_coordinates,
98 .add = ec_GFp_simple_add, 98 .add = ec_GFp_simple_add,
99 .dbl = ec_GFp_simple_dbl, 99 .dbl = ec_GFp_simple_dbl,
100 .invert = ec_GFp_simple_invert, 100 .invert = ec_GFp_simple_invert,
@@ -114,7 +114,7 @@ EC_GFp_nist_method(void)
114 return &ret; 114 return &ret;
115} 115}
116 116
117int 117int
118ec_GFp_nist_group_copy(EC_GROUP * dest, const EC_GROUP * src) 118ec_GFp_nist_group_copy(EC_GROUP * dest, const EC_GROUP * src)
119{ 119{
120 dest->field_mod_func = src->field_mod_func; 120 dest->field_mod_func = src->field_mod_func;
@@ -122,7 +122,7 @@ ec_GFp_nist_group_copy(EC_GROUP * dest, const EC_GROUP * src)
122 return ec_GFp_simple_group_copy(dest, src); 122 return ec_GFp_simple_group_copy(dest, src);
123} 123}
124 124
125int 125int
126ec_GFp_nist_group_set_curve(EC_GROUP *group, const BIGNUM *p, 126ec_GFp_nist_group_set_curve(EC_GROUP *group, const BIGNUM *p,
127 const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) 127 const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
128{ 128{
@@ -162,7 +162,7 @@ ec_GFp_nist_group_set_curve(EC_GROUP *group, const BIGNUM *p,
162} 162}
163 163
164 164
165int 165int
166ec_GFp_nist_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a, 166ec_GFp_nist_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
167 const BIGNUM *b, BN_CTX *ctx) 167 const BIGNUM *b, BN_CTX *ctx)
168{ 168{
@@ -189,7 +189,7 @@ ec_GFp_nist_field_mul(const EC_GROUP *group, BIGNUM *r, const BIGNUM *a,
189} 189}
190 190
191 191
192int 192int
193ec_GFp_nist_field_sqr(const EC_GROUP * group, BIGNUM * r, const BIGNUM * a, 193ec_GFp_nist_field_sqr(const EC_GROUP * group, BIGNUM * r, const BIGNUM * a,
194 BN_CTX * ctx) 194 BN_CTX * ctx)
195{ 195{
diff --git a/src/lib/libcrypto/ec/ecp_nistp224.c b/src/lib/libcrypto/ec/ecp_nistp224.c
index 10ade9dbb5..4ed45df896 100644
--- a/src/lib/libcrypto/ec/ecp_nistp224.c
+++ b/src/lib/libcrypto/ec/ecp_nistp224.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_nistp224.c,v 1.25 2021/04/20 17:28:18 tb Exp $ */ 1/* $OpenBSD: ecp_nistp224.c,v 1.26 2021/04/20 17:38:02 tb Exp $ */
2/* 2/*
3 * Written by Emilia Kasper (Google) for the OpenSSL project. 3 * Written by Emilia Kasper (Google) for the OpenSSL project.
4 */ 4 */
@@ -278,7 +278,7 @@ EC_GFp_nistp224_method(void)
278} 278}
279 279
280/* Helper functions to convert field elements to/from internal representation */ 280/* Helper functions to convert field elements to/from internal representation */
281static void 281static void
282bin28_to_felem(felem out, const u8 in[28]) 282bin28_to_felem(felem out, const u8 in[28])
283{ 283{
284 out[0] = *((const uint64_t *) (in)) & 0x00ffffffffffffff; 284 out[0] = *((const uint64_t *) (in)) & 0x00ffffffffffffff;
@@ -287,7 +287,7 @@ bin28_to_felem(felem out, const u8 in[28])
287 out[3] = (*((const uint64_t *) (in + 21))) & 0x00ffffffffffffff; 287 out[3] = (*((const uint64_t *) (in + 21))) & 0x00ffffffffffffff;
288} 288}
289 289
290static void 290static void
291felem_to_bin28(u8 out[28], const felem in) 291felem_to_bin28(u8 out[28], const felem in)
292{ 292{
293 unsigned i; 293 unsigned i;
@@ -300,7 +300,7 @@ felem_to_bin28(u8 out[28], const felem in)
300} 300}
301 301
302/* To preserve endianness when using BN_bn2bin and BN_bin2bn */ 302/* To preserve endianness when using BN_bn2bin and BN_bin2bn */
303static void 303static void
304flip_endian(u8 * out, const u8 * in, unsigned len) 304flip_endian(u8 * out, const u8 * in, unsigned len)
305{ 305{
306 unsigned i; 306 unsigned i;
@@ -309,7 +309,7 @@ flip_endian(u8 * out, const u8 * in, unsigned len)
309} 309}
310 310
311/* From OpenSSL BIGNUM to internal representation */ 311/* From OpenSSL BIGNUM to internal representation */
312static int 312static int
313BN_to_felem(felem out, const BIGNUM * bn) 313BN_to_felem(felem out, const BIGNUM * bn)
314{ 314{
315 felem_bytearray b_in; 315 felem_bytearray b_in;
@@ -353,7 +353,7 @@ felem_to_BN(BIGNUM * out, const felem in)
353 * 353 *
354 */ 354 */
355 355
356static void 356static void
357felem_one(felem out) 357felem_one(felem out)
358{ 358{
359 out[0] = 1; 359 out[0] = 1;
@@ -362,7 +362,7 @@ felem_one(felem out)
362 out[3] = 0; 362 out[3] = 0;
363} 363}
364 364
365static void 365static void
366felem_assign(felem out, const felem in) 366felem_assign(felem out, const felem in)
367{ 367{
368 out[0] = in[0]; 368 out[0] = in[0];
@@ -372,7 +372,7 @@ felem_assign(felem out, const felem in)
372} 372}
373 373
374/* Sum two field elements: out += in */ 374/* Sum two field elements: out += in */
375static void 375static void
376felem_sum(felem out, const felem in) 376felem_sum(felem out, const felem in)
377{ 377{
378 out[0] += in[0]; 378 out[0] += in[0];
@@ -383,7 +383,7 @@ felem_sum(felem out, const felem in)
383 383
384/* Get negative value: out = -in */ 384/* Get negative value: out = -in */
385/* Assumes in[i] < 2^57 */ 385/* Assumes in[i] < 2^57 */
386static void 386static void
387felem_neg(felem out, const felem in) 387felem_neg(felem out, const felem in)
388{ 388{
389 static const limb two58p2 = (((limb) 1) << 58) + (((limb) 1) << 2); 389 static const limb two58p2 = (((limb) 1) << 58) + (((limb) 1) << 2);
@@ -400,7 +400,7 @@ felem_neg(felem out, const felem in)
400 400
401/* Subtract field elements: out -= in */ 401/* Subtract field elements: out -= in */
402/* Assumes in[i] < 2^57 */ 402/* Assumes in[i] < 2^57 */
403static void 403static void
404felem_diff(felem out, const felem in) 404felem_diff(felem out, const felem in)
405{ 405{
406 static const limb two58p2 = (((limb) 1) << 58) + (((limb) 1) << 2); 406 static const limb two58p2 = (((limb) 1) << 58) + (((limb) 1) << 2);
@@ -422,7 +422,7 @@ felem_diff(felem out, const felem in)
422 422
423/* Subtract in unreduced 128-bit mode: out -= in */ 423/* Subtract in unreduced 128-bit mode: out -= in */
424/* Assumes in[i] < 2^119 */ 424/* Assumes in[i] < 2^119 */
425static void 425static void
426widefelem_diff(widefelem out, const widefelem in) 426widefelem_diff(widefelem out, const widefelem in)
427{ 427{
428 static const widelimb two120 = ((widelimb) 1) << 120; 428 static const widelimb two120 = ((widelimb) 1) << 120;
@@ -451,7 +451,7 @@ widefelem_diff(widefelem out, const widefelem in)
451 451
452/* Subtract in mixed mode: out128 -= in64 */ 452/* Subtract in mixed mode: out128 -= in64 */
453/* in[i] < 2^63 */ 453/* in[i] < 2^63 */
454static void 454static void
455felem_diff_128_64(widefelem out, const felem in) 455felem_diff_128_64(widefelem out, const felem in)
456{ 456{
457 static const widelimb two64p8 = (((widelimb) 1) << 64) + 457 static const widelimb two64p8 = (((widelimb) 1) << 64) +
@@ -475,7 +475,7 @@ felem_diff_128_64(widefelem out, const felem in)
475 475
476/* Multiply a field element by a scalar: out = out * scalar 476/* Multiply a field element by a scalar: out = out * scalar
477 * The scalars we actually use are small, so results fit without overflow */ 477 * The scalars we actually use are small, so results fit without overflow */
478static void 478static void
479felem_scalar(felem out, const limb scalar) 479felem_scalar(felem out, const limb scalar)
480{ 480{
481 out[0] *= scalar; 481 out[0] *= scalar;
@@ -486,7 +486,7 @@ felem_scalar(felem out, const limb scalar)
486 486
487/* Multiply an unreduced field element by a scalar: out = out * scalar 487/* Multiply an unreduced field element by a scalar: out = out * scalar
488 * The scalars we actually use are small, so results fit without overflow */ 488 * The scalars we actually use are small, so results fit without overflow */
489static void 489static void
490widefelem_scalar(widefelem out, const widelimb scalar) 490widefelem_scalar(widefelem out, const widelimb scalar)
491{ 491{
492 out[0] *= scalar; 492 out[0] *= scalar;
@@ -499,7 +499,7 @@ widefelem_scalar(widefelem out, const widelimb scalar)
499} 499}
500 500
501/* Square a field element: out = in^2 */ 501/* Square a field element: out = in^2 */
502static void 502static void
503felem_square(widefelem out, const felem in) 503felem_square(widefelem out, const felem in)
504{ 504{
505 limb tmp0, tmp1, tmp2; 505 limb tmp0, tmp1, tmp2;
@@ -517,7 +517,7 @@ felem_square(widefelem out, const felem in)
517} 517}
518 518
519/* Multiply two field elements: out = in1 * in2 */ 519/* Multiply two field elements: out = in1 * in2 */
520static void 520static void
521felem_mul(widefelem out, const felem in1, const felem in2) 521felem_mul(widefelem out, const felem in1, const felem in2)
522{ 522{
523 out[0] = ((widelimb) in1[0]) * in2[0]; 523 out[0] = ((widelimb) in1[0]) * in2[0];
@@ -535,7 +535,7 @@ felem_mul(widefelem out, const felem in1, const felem in2)
535/* Reduce seven 128-bit coefficients to four 64-bit coefficients. 535/* Reduce seven 128-bit coefficients to four 64-bit coefficients.
536 * Requires in[i] < 2^126, 536 * Requires in[i] < 2^126,
537 * ensures out[0] < 2^56, out[1] < 2^56, out[2] < 2^56, out[3] <= 2^56 + 2^16 */ 537 * ensures out[0] < 2^56, out[1] < 2^56, out[2] < 2^56, out[3] <= 2^56 + 2^16 */
538static void 538static void
539felem_reduce(felem out, const widefelem in) 539felem_reduce(felem out, const widefelem in)
540{ 540{
541 static const widelimb two127p15 = (((widelimb) 1) << 127) + 541 static const widelimb two127p15 = (((widelimb) 1) << 127) +
@@ -599,7 +599,7 @@ felem_reduce(felem out, const widefelem in)
599 out[3] = output[3]; 599 out[3] = output[3];
600} 600}
601 601
602static void 602static void
603felem_square_reduce(felem out, const felem in) 603felem_square_reduce(felem out, const felem in)
604{ 604{
605 widefelem tmp; 605 widefelem tmp;
@@ -607,7 +607,7 @@ felem_square_reduce(felem out, const felem in)
607 felem_reduce(out, tmp); 607 felem_reduce(out, tmp);
608} 608}
609 609
610static void 610static void
611felem_mul_reduce(felem out, const felem in1, const felem in2) 611felem_mul_reduce(felem out, const felem in1, const felem in2)
612{ 612{
613 widefelem tmp; 613 widefelem tmp;
@@ -617,7 +617,7 @@ felem_mul_reduce(felem out, const felem in1, const felem in2)
617 617
618/* Reduce to unique minimal representation. 618/* Reduce to unique minimal representation.
619 * Requires 0 <= in < 2*p (always call felem_reduce first) */ 619 * Requires 0 <= in < 2*p (always call felem_reduce first) */
620static void 620static void
621felem_contract(felem out, const felem in) 621felem_contract(felem out, const felem in)
622{ 622{
623 static const int64_t two56 = ((limb) 1) << 56; 623 static const int64_t two56 = ((limb) 1) << 56;
@@ -674,7 +674,7 @@ felem_contract(felem out, const felem in)
674 * We know that field elements are reduced to in < 2^225, 674 * We know that field elements are reduced to in < 2^225,
675 * so we only need to check three cases: 0, 2^224 - 2^96 + 1, 675 * so we only need to check three cases: 0, 2^224 - 2^96 + 1,
676 * and 2^225 - 2^97 + 2 */ 676 * and 2^225 - 2^97 + 2 */
677static limb 677static limb
678felem_is_zero(const felem in) 678felem_is_zero(const felem in)
679{ 679{
680 limb zero, two224m96p1, two225m97p2; 680 limb zero, two224m96p1, two225m97p2;
@@ -690,7 +690,7 @@ felem_is_zero(const felem in)
690 return (zero | two224m96p1 | two225m97p2); 690 return (zero | two224m96p1 | two225m97p2);
691} 691}
692 692
693static limb 693static limb
694felem_is_zero_int(const felem in) 694felem_is_zero_int(const felem in)
695{ 695{
696 return (int) (felem_is_zero(in) & ((limb) 1)); 696 return (int) (felem_is_zero(in) & ((limb) 1));
@@ -698,7 +698,7 @@ felem_is_zero_int(const felem in)
698 698
699/* Invert a field element */ 699/* Invert a field element */
700/* Computation chain copied from djb's code */ 700/* Computation chain copied from djb's code */
701static void 701static void
702felem_inv(felem out, const felem in) 702felem_inv(felem out, const felem in)
703{ 703{
704 felem ftmp, ftmp2, ftmp3, ftmp4; 704 felem ftmp, ftmp2, ftmp3, ftmp4;
@@ -897,7 +897,7 @@ point_double(felem x_out, felem y_out, felem z_out,
897 * (while not equal to the point at infinity). 897 * (while not equal to the point at infinity).
898 * This case never happens during single point multiplication, 898 * This case never happens during single point multiplication,
899 * so there is no timing leak for ECDH or ECDSA signing. */ 899 * so there is no timing leak for ECDH or ECDSA signing. */
900static void 900static void
901point_add(felem x3, felem y3, felem z3, 901point_add(felem x3, felem y3, felem z3,
902 const felem x1, const felem y1, const felem z1, 902 const felem x1, const felem y1, const felem z1,
903 const int mixed, const felem x2, const felem y2, const felem z2) 903 const int mixed, const felem x2, const felem y2, const felem z2)
@@ -1057,7 +1057,7 @@ point_add(felem x3, felem y3, felem z3,
1057 1057
1058/* select_point selects the |idx|th point from a precomputation table and 1058/* select_point selects the |idx|th point from a precomputation table and
1059 * copies it to out. */ 1059 * copies it to out. */
1060static void 1060static void
1061select_point(const u64 idx, unsigned int size, const felem pre_comp[ /* size */ ][3], felem out[3]) 1061select_point(const u64 idx, unsigned int size, const felem pre_comp[ /* size */ ][3], felem out[3])
1062{ 1062{
1063 unsigned i, j; 1063 unsigned i, j;
@@ -1078,7 +1078,7 @@ select_point(const u64 idx, unsigned int size, const felem pre_comp[ /* size */
1078} 1078}
1079 1079
1080/* get_bit returns the |i|th bit in |in| */ 1080/* get_bit returns the |i|th bit in |in| */
1081static char 1081static char
1082get_bit(const felem_bytearray in, unsigned i) 1082get_bit(const felem_bytearray in, unsigned i)
1083{ 1083{
1084 if (i >= 224) 1084 if (i >= 224)
@@ -1091,7 +1091,7 @@ get_bit(const felem_bytearray in, unsigned i)
1091 * the scalars in scalars[]. If g_scalar is non-NULL, we also add this multiple 1091 * the scalars in scalars[]. If g_scalar is non-NULL, we also add this multiple
1092 * of the generator, using certain (large) precomputed multiples in g_pre_comp. 1092 * of the generator, using certain (large) precomputed multiples in g_pre_comp.
1093 * Output point (X, Y, Z) is stored in x_out, y_out, z_out */ 1093 * Output point (X, Y, Z) is stored in x_out, y_out, z_out */
1094static void 1094static void
1095batch_mul(felem x_out, felem y_out, felem z_out, 1095batch_mul(felem x_out, felem y_out, felem z_out,
1096 const felem_bytearray scalars[], const unsigned num_points, const u8 * g_scalar, 1096 const felem_bytearray scalars[], const unsigned num_points, const u8 * g_scalar,
1097 const int mixed, const felem pre_comp[][17][3], const felem g_pre_comp[2][16][3]) 1097 const int mixed, const felem pre_comp[][17][3], const felem g_pre_comp[2][16][3])
@@ -1211,7 +1211,7 @@ nistp224_pre_comp_dup(void *src_)
1211 return src_; 1211 return src_;
1212} 1212}
1213 1213
1214static void 1214static void
1215nistp224_pre_comp_free(void *pre_) 1215nistp224_pre_comp_free(void *pre_)
1216{ 1216{
1217 int i; 1217 int i;
@@ -1227,7 +1227,7 @@ nistp224_pre_comp_free(void *pre_)
1227 free(pre); 1227 free(pre);
1228} 1228}
1229 1229
1230static void 1230static void
1231nistp224_pre_comp_clear_free(void *pre_) 1231nistp224_pre_comp_clear_free(void *pre_)
1232{ 1232{
1233 int i; 1233 int i;
@@ -1247,7 +1247,7 @@ nistp224_pre_comp_clear_free(void *pre_)
1247/* OPENSSL EC_METHOD FUNCTIONS 1247/* OPENSSL EC_METHOD FUNCTIONS
1248 */ 1248 */
1249 1249
1250int 1250int
1251ec_GFp_nistp224_group_init(EC_GROUP * group) 1251ec_GFp_nistp224_group_init(EC_GROUP * group)
1252{ 1252{
1253 int ret; 1253 int ret;
@@ -1256,7 +1256,7 @@ ec_GFp_nistp224_group_init(EC_GROUP * group)
1256 return ret; 1256 return ret;
1257} 1257}
1258 1258
1259int 1259int
1260ec_GFp_nistp224_group_set_curve(EC_GROUP * group, const BIGNUM * p, 1260ec_GFp_nistp224_group_set_curve(EC_GROUP * group, const BIGNUM * p,
1261 const BIGNUM * a, const BIGNUM * b, BN_CTX * ctx) 1261 const BIGNUM * a, const BIGNUM * b, BN_CTX * ctx)
1262{ 1262{
@@ -1290,7 +1290,7 @@ ec_GFp_nistp224_group_set_curve(EC_GROUP * group, const BIGNUM * p,
1290 1290
1291/* Takes the Jacobian coordinates (X, Y, Z) of a point and returns 1291/* Takes the Jacobian coordinates (X, Y, Z) of a point and returns
1292 * (X', Y') = (X/Z^2, Y/Z^3) */ 1292 * (X', Y') = (X/Z^2, Y/Z^3) */
1293int 1293int
1294ec_GFp_nistp224_point_get_affine_coordinates(const EC_GROUP * group, 1294ec_GFp_nistp224_point_get_affine_coordinates(const EC_GROUP * group,
1295 const EC_POINT * point, BIGNUM * x, BIGNUM * y, BN_CTX * ctx) 1295 const EC_POINT * point, BIGNUM * x, BIGNUM * y, BN_CTX * ctx)
1296{ 1296{
@@ -1330,7 +1330,7 @@ ec_GFp_nistp224_point_get_affine_coordinates(const EC_GROUP * group,
1330 return 1; 1330 return 1;
1331} 1331}
1332 1332
1333static void 1333static void
1334make_points_affine(size_t num, felem points[ /* num */ ][3], felem tmp_felems[ /* num+1 */ ]) 1334make_points_affine(size_t num, felem points[ /* num */ ][3], felem tmp_felems[ /* num+1 */ ])
1335{ 1335{
1336 /* 1336 /*
@@ -1353,7 +1353,7 @@ make_points_affine(size_t num, felem points[ /* num */ ][3], felem tmp_felems[ /
1353 1353
1354/* Computes scalar*generator + \sum scalars[i]*points[i], ignoring NULL values 1354/* Computes scalar*generator + \sum scalars[i]*points[i], ignoring NULL values
1355 * Result is stored in r (r can equal one of the inputs). */ 1355 * Result is stored in r (r can equal one of the inputs). */
1356int 1356int
1357ec_GFp_nistp224_points_mul(const EC_GROUP * group, EC_POINT * r, 1357ec_GFp_nistp224_points_mul(const EC_GROUP * group, EC_POINT * r,
1358 const BIGNUM * scalar, size_t num, const EC_POINT * points[], 1358 const BIGNUM * scalar, size_t num, const EC_POINT * points[],
1359 const BIGNUM * scalars[], BN_CTX * ctx) 1359 const BIGNUM * scalars[], BN_CTX * ctx)
@@ -1548,7 +1548,7 @@ ec_GFp_nistp224_points_mul(const EC_GROUP * group, EC_POINT * r,
1548 return ret; 1548 return ret;
1549} 1549}
1550 1550
1551int 1551int
1552ec_GFp_nistp224_precompute_mult(EC_GROUP * group, BN_CTX * ctx) 1552ec_GFp_nistp224_precompute_mult(EC_GROUP * group, BN_CTX * ctx)
1553{ 1553{
1554 int ret = 0; 1554 int ret = 0;
@@ -1675,7 +1675,7 @@ ec_GFp_nistp224_precompute_mult(EC_GROUP * group, BN_CTX * ctx)
1675 return ret; 1675 return ret;
1676} 1676}
1677 1677
1678int 1678int
1679ec_GFp_nistp224_have_precompute_mult(const EC_GROUP * group) 1679ec_GFp_nistp224_have_precompute_mult(const EC_GROUP * group)
1680{ 1680{
1681 if (EC_EX_DATA_get_data(group->extra_data, nistp224_pre_comp_dup, 1681 if (EC_EX_DATA_get_data(group->extra_data, nistp224_pre_comp_dup,
diff --git a/src/lib/libcrypto/ec/ecp_nistp256.c b/src/lib/libcrypto/ec/ecp_nistp256.c
index 674143cc3e..57b003aefa 100644
--- a/src/lib/libcrypto/ec/ecp_nistp256.c
+++ b/src/lib/libcrypto/ec/ecp_nistp256.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_nistp256.c,v 1.24 2021/04/20 17:28:18 tb Exp $ */ 1/* $OpenBSD: ecp_nistp256.c,v 1.25 2021/04/20 17:38:02 tb Exp $ */
2/* 2/*
3 * Written by Adam Langley (Google) for the OpenSSL project 3 * Written by Adam Langley (Google) for the OpenSSL project
4 */ 4 */
@@ -115,7 +115,7 @@ static const u64 bottom63bits = 0x7ffffffffffffffful;
115 115
116/* bin32_to_felem takes a little-endian byte array and converts it into felem 116/* bin32_to_felem takes a little-endian byte array and converts it into felem
117 * form. This assumes that the CPU is little-endian. */ 117 * form. This assumes that the CPU is little-endian. */
118static void 118static void
119bin32_to_felem(felem out, const u8 in[32]) 119bin32_to_felem(felem out, const u8 in[32])
120{ 120{
121 out[0] = *((u64 *) & in[0]); 121 out[0] = *((u64 *) & in[0]);
@@ -126,7 +126,7 @@ bin32_to_felem(felem out, const u8 in[32])
126 126
127/* smallfelem_to_bin32 takes a smallfelem and serialises into a little endian, 127/* smallfelem_to_bin32 takes a smallfelem and serialises into a little endian,
128 * 32 byte array. This assumes that the CPU is little-endian. */ 128 * 32 byte array. This assumes that the CPU is little-endian. */
129static void 129static void
130smallfelem_to_bin32(u8 out[32], const smallfelem in) 130smallfelem_to_bin32(u8 out[32], const smallfelem in)
131{ 131{
132 *((u64 *) & out[0]) = in[0]; 132 *((u64 *) & out[0]) = in[0];
@@ -136,7 +136,7 @@ smallfelem_to_bin32(u8 out[32], const smallfelem in)
136} 136}
137 137
138/* To preserve endianness when using BN_bn2bin and BN_bin2bn */ 138/* To preserve endianness when using BN_bn2bin and BN_bin2bn */
139static void 139static void
140flip_endian(u8 * out, const u8 * in, unsigned len) 140flip_endian(u8 * out, const u8 * in, unsigned len)
141{ 141{
142 unsigned i; 142 unsigned i;
@@ -145,7 +145,7 @@ flip_endian(u8 * out, const u8 * in, unsigned len)
145} 145}
146 146
147/* BN_to_felem converts an OpenSSL BIGNUM into an felem */ 147/* BN_to_felem converts an OpenSSL BIGNUM into an felem */
148static int 148static int
149BN_to_felem(felem out, const BIGNUM * bn) 149BN_to_felem(felem out, const BIGNUM * bn)
150{ 150{
151 felem_bytearray b_in; 151 felem_bytearray b_in;
@@ -183,7 +183,7 @@ smallfelem_to_BN(BIGNUM * out, const smallfelem in)
183/* Field operations 183/* Field operations
184 * ---------------- */ 184 * ---------------- */
185 185
186static void 186static void
187smallfelem_one(smallfelem out) 187smallfelem_one(smallfelem out)
188{ 188{
189 out[0] = 1; 189 out[0] = 1;
@@ -192,7 +192,7 @@ smallfelem_one(smallfelem out)
192 out[3] = 0; 192 out[3] = 0;
193} 193}
194 194
195static void 195static void
196smallfelem_assign(smallfelem out, const smallfelem in) 196smallfelem_assign(smallfelem out, const smallfelem in)
197{ 197{
198 out[0] = in[0]; 198 out[0] = in[0];
@@ -201,7 +201,7 @@ smallfelem_assign(smallfelem out, const smallfelem in)
201 out[3] = in[3]; 201 out[3] = in[3];
202} 202}
203 203
204static void 204static void
205felem_assign(felem out, const felem in) 205felem_assign(felem out, const felem in)
206{ 206{
207 out[0] = in[0]; 207 out[0] = in[0];
@@ -211,7 +211,7 @@ felem_assign(felem out, const felem in)
211} 211}
212 212
213/* felem_sum sets out = out + in. */ 213/* felem_sum sets out = out + in. */
214static void 214static void
215felem_sum(felem out, const felem in) 215felem_sum(felem out, const felem in)
216{ 216{
217 out[0] += in[0]; 217 out[0] += in[0];
@@ -221,7 +221,7 @@ felem_sum(felem out, const felem in)
221} 221}
222 222
223/* felem_small_sum sets out = out + in. */ 223/* felem_small_sum sets out = out + in. */
224static void 224static void
225felem_small_sum(felem out, const smallfelem in) 225felem_small_sum(felem out, const smallfelem in)
226{ 226{
227 out[0] += in[0]; 227 out[0] += in[0];
@@ -231,7 +231,7 @@ felem_small_sum(felem out, const smallfelem in)
231} 231}
232 232
233/* felem_scalar sets out = out * scalar */ 233/* felem_scalar sets out = out * scalar */
234static void 234static void
235felem_scalar(felem out, const u64 scalar) 235felem_scalar(felem out, const u64 scalar)
236{ 236{
237 out[0] *= scalar; 237 out[0] *= scalar;
@@ -241,7 +241,7 @@ felem_scalar(felem out, const u64 scalar)
241} 241}
242 242
243/* longfelem_scalar sets out = out * scalar */ 243/* longfelem_scalar sets out = out * scalar */
244static void 244static void
245longfelem_scalar(longfelem out, const u64 scalar) 245longfelem_scalar(longfelem out, const u64 scalar)
246{ 246{
247 out[0] *= scalar; 247 out[0] *= scalar;
@@ -265,7 +265,7 @@ static const felem zero105 = {two105m41m9, two105, two105m41p9, two105m41p9};
265 * On exit: 265 * On exit:
266 * out[i] < out[i] + 2^105 266 * out[i] < out[i] + 2^105
267 */ 267 */
268static void 268static void
269smallfelem_neg(felem out, const smallfelem small) 269smallfelem_neg(felem out, const smallfelem small)
270{ 270{
271 /* In order to prevent underflow, we subtract from 0 mod p. */ 271 /* In order to prevent underflow, we subtract from 0 mod p. */
@@ -281,7 +281,7 @@ smallfelem_neg(felem out, const smallfelem small)
281 * On exit: 281 * On exit:
282 * out[i] < out[i] + 2^105 282 * out[i] < out[i] + 2^105
283 */ 283 */
284static void 284static void
285felem_diff(felem out, const felem in) 285felem_diff(felem out, const felem in)
286{ 286{
287 /* In order to prevent underflow, we add 0 mod p before subtracting. */ 287 /* In order to prevent underflow, we add 0 mod p before subtracting. */
@@ -310,7 +310,7 @@ static const felem zero107 = {two107m43m11, two107, two107m43p11, two107m43p11};
310 * On exit: 310 * On exit:
311 * out[i] < out[i] + 2^107 311 * out[i] < out[i] + 2^107
312 */ 312 */
313static void 313static void
314felem_diff_zero107(felem out, const felem in) 314felem_diff_zero107(felem out, const felem in)
315{ 315{
316 /* In order to prevent underflow, we add 0 mod p before subtracting. */ 316 /* In order to prevent underflow, we add 0 mod p before subtracting. */
@@ -331,7 +331,7 @@ felem_diff_zero107(felem out, const felem in)
331 * On exit: 331 * On exit:
332 * out[i] < out[i] + 2^70 + 2^40 332 * out[i] < out[i] + 2^70 + 2^40
333 */ 333 */
334static void 334static void
335longfelem_diff(longfelem out, const longfelem in) 335longfelem_diff(longfelem out, const longfelem in)
336{ 336{
337 static const limb two70m8p6 = (((limb) 1) << 70) - (((limb) 1) << 8) + (((limb) 1) << 6); 337 static const limb two70m8p6 = (((limb) 1) << 70) - (((limb) 1) << 8) + (((limb) 1) << 6);
@@ -377,7 +377,7 @@ static const felem zero110 = {two64m0, two110p32m0, two64m46, two64m32};
377 * On exit: 377 * On exit:
378 * out[i] < 2^64 378 * out[i] < 2^64
379 */ 379 */
380static void 380static void
381felem_shrink(smallfelem out, const felem in) 381felem_shrink(smallfelem out, const felem in)
382{ 382{
383 felem tmp; 383 felem tmp;
@@ -468,7 +468,7 @@ felem_shrink(smallfelem out, const felem in)
468} 468}
469 469
470/* smallfelem_expand converts a smallfelem to an felem */ 470/* smallfelem_expand converts a smallfelem to an felem */
471static void 471static void
472smallfelem_expand(felem out, const smallfelem in) 472smallfelem_expand(felem out, const smallfelem in)
473{ 473{
474 out[0] = in[0]; 474 out[0] = in[0];
@@ -483,7 +483,7 @@ smallfelem_expand(felem out, const smallfelem in)
483 * On exit: 483 * On exit:
484 * out[i] < 7 * 2^64 < 2^67 484 * out[i] < 7 * 2^64 < 2^67
485 */ 485 */
486static void 486static void
487smallfelem_square(longfelem out, const smallfelem small) 487smallfelem_square(longfelem out, const smallfelem small)
488{ 488{
489 limb a; 489 limb a;
@@ -562,7 +562,7 @@ smallfelem_square(longfelem out, const smallfelem small)
562 * On exit: 562 * On exit:
563 * out[i] < 7 * 2^64 < 2^67 563 * out[i] < 7 * 2^64 < 2^67
564 */ 564 */
565static void 565static void
566felem_square(longfelem out, const felem in) 566felem_square(longfelem out, const felem in)
567{ 567{
568 u64 small[4]; 568 u64 small[4];
@@ -577,7 +577,7 @@ felem_square(longfelem out, const felem in)
577 * On exit: 577 * On exit:
578 * out[i] < 7 * 2^64 < 2^67 578 * out[i] < 7 * 2^64 < 2^67
579 */ 579 */
580static void 580static void
581smallfelem_mul(longfelem out, const smallfelem small1, const smallfelem small2) 581smallfelem_mul(longfelem out, const smallfelem small1, const smallfelem small2)
582{ 582{
583 limb a; 583 limb a;
@@ -693,7 +693,7 @@ smallfelem_mul(longfelem out, const smallfelem small1, const smallfelem small2)
693 * On exit: 693 * On exit:
694 * out[i] < 7 * 2^64 < 2^67 694 * out[i] < 7 * 2^64 < 2^67
695 */ 695 */
696static void 696static void
697felem_mul(longfelem out, const felem in1, const felem in2) 697felem_mul(longfelem out, const felem in1, const felem in2)
698{ 698{
699 smallfelem small1, small2; 699 smallfelem small1, small2;
@@ -709,7 +709,7 @@ felem_mul(longfelem out, const felem in1, const felem in2)
709 * On exit: 709 * On exit:
710 * out[i] < 7 * 2^64 < 2^67 710 * out[i] < 7 * 2^64 < 2^67
711 */ 711 */
712static void 712static void
713felem_small_mul(longfelem out, const smallfelem small1, const felem in2) 713felem_small_mul(longfelem out, const smallfelem small1, const felem in2)
714{ 714{
715 smallfelem small2; 715 smallfelem small2;
@@ -736,7 +736,7 @@ static const felem zero100 = {two100m36m4, two100, two100m36p4, two100m36p4};
736 * out[2] <= out[2] + in[7] + 2*in[6] + 2^33*in[7] 736 * out[2] <= out[2] + in[7] + 2*in[6] + 2^33*in[7]
737 * out[3] <= out[3] + 2^32*in[4] + 3*in[7] 737 * out[3] <= out[3] + 2^32*in[4] + 3*in[7]
738 */ 738 */
739static void 739static void
740felem_reduce_(felem out, const longfelem in) 740felem_reduce_(felem out, const longfelem in)
741{ 741{
742 int128_t c; 742 int128_t c;
@@ -779,7 +779,7 @@ felem_reduce_(felem out, const longfelem in)
779 * On exit: 779 * On exit:
780 * out[i] < 2^101 780 * out[i] < 2^101
781 */ 781 */
782static void 782static void
783felem_reduce(felem out, const longfelem in) 783felem_reduce(felem out, const longfelem in)
784{ 784{
785 out[0] = zero100[0] + in[0]; 785 out[0] = zero100[0] + in[0];
@@ -794,7 +794,7 @@ felem_reduce(felem out, const longfelem in)
794 * out[1] > 2^100 - 2^64 - 7*2^96 > 0 out[2] > 2^100 - 2^36 + 2^4 - 794 * out[1] > 2^100 - 2^64 - 7*2^96 > 0 out[2] > 2^100 - 2^36 + 2^4 -
795 * 5*2^64 - 5*2^96 > 0 out[3] > 2^100 - 2^36 + 2^4 - 7*2^64 - 5*2^96 795 * 5*2^64 - 5*2^96 > 0 out[3] > 2^100 - 2^36 + 2^4 - 7*2^64 - 5*2^96
796 * - 3*2^96 > 0 796 * - 3*2^96 > 0
797 * 797 *
798 * out[0] < 2^100 + 2^64 + 7*2^64 + 5*2^96 < 2^101 out[1] < 2^100 + 798 * out[0] < 2^100 + 2^64 + 7*2^64 + 5*2^96 < 2^101 out[1] < 2^100 +
799 * 3*2^64 + 5*2^64 + 3*2^97 < 2^101 out[2] < 2^100 + 5*2^64 + 2^64 + 799 * 3*2^64 + 5*2^64 + 3*2^97 < 2^101 out[2] < 2^100 + 5*2^64 + 2^64 +
800 * 3*2^65 + 2^97 < 2^101 out[3] < 2^100 + 7*2^64 + 7*2^96 + 3*2^64 < 800 * 3*2^65 + 2^97 < 2^101 out[3] < 2^100 + 7*2^64 + 7*2^96 + 3*2^64 <
@@ -808,7 +808,7 @@ felem_reduce(felem out, const longfelem in)
808 * On exit: 808 * On exit:
809 * out[i] < 2^106 809 * out[i] < 2^106
810 */ 810 */
811static void 811static void
812felem_reduce_zero105(felem out, const longfelem in) 812felem_reduce_zero105(felem out, const longfelem in)
813{ 813{
814 out[0] = zero105[0] + in[0]; 814 out[0] = zero105[0] + in[0];
@@ -823,7 +823,7 @@ felem_reduce_zero105(felem out, const longfelem in)
823 * out[1] > 2^105 - 2^71 - 2^103 > 0 out[2] > 2^105 - 2^41 + 2^9 - 823 * out[1] > 2^105 - 2^71 - 2^103 > 0 out[2] > 2^105 - 2^41 + 2^9 -
824 * 2^71 - 2^103 > 0 out[3] > 2^105 - 2^41 + 2^9 - 2^71 - 2^103 - 824 * 2^71 - 2^103 > 0 out[3] > 2^105 - 2^41 + 2^9 - 2^71 - 2^103 -
825 * 2^103 > 0 825 * 2^103 > 0
826 * 826 *
827 * out[0] < 2^105 + 2^71 + 2^71 + 2^103 < 2^106 out[1] < 2^105 + 2^71 + 827 * out[0] < 2^105 + 2^71 + 2^71 + 2^103 < 2^106 out[1] < 2^105 + 2^71 +
828 * 2^71 + 2^103 < 2^106 out[2] < 2^105 + 2^71 + 2^71 + 2^71 + 2^103 < 828 * 2^71 + 2^103 < 2^106 out[2] < 2^105 + 2^71 + 2^71 + 2^71 + 2^103 <
829 * 2^106 out[3] < 2^105 + 2^71 + 2^103 + 2^71 < 2^106 829 * 2^106 out[3] < 2^105 + 2^71 + 2^103 + 2^71 < 2^106
@@ -832,7 +832,7 @@ felem_reduce_zero105(felem out, const longfelem in)
832 832
833/* subtract_u64 sets *result = *result - v and *carry to one if the subtraction 833/* subtract_u64 sets *result = *result - v and *carry to one if the subtraction
834 * underflowed. */ 834 * underflowed. */
835static void 835static void
836subtract_u64(u64 * result, u64 * carry, u64 v) 836subtract_u64(u64 * result, u64 * carry, u64 v)
837{ 837{
838 uint128_t r = *result; 838 uint128_t r = *result;
@@ -845,7 +845,7 @@ subtract_u64(u64 * result, u64 * carry, u64 v)
845 * On entry: 845 * On entry:
846 * in[i] < 2^109 846 * in[i] < 2^109
847 */ 847 */
848static void 848static void
849felem_contract(smallfelem out, const felem in) 849felem_contract(smallfelem out, const felem in)
850{ 850{
851 unsigned i; 851 unsigned i;
@@ -909,7 +909,7 @@ felem_contract(smallfelem out, const felem in)
909 subtract_u64(&out[3], &carry, result & kPrime[3]); 909 subtract_u64(&out[3], &carry, result & kPrime[3]);
910} 910}
911 911
912static void 912static void
913smallfelem_square_contract(smallfelem out, const smallfelem in) 913smallfelem_square_contract(smallfelem out, const smallfelem in)
914{ 914{
915 longfelem longtmp; 915 longfelem longtmp;
@@ -920,7 +920,7 @@ smallfelem_square_contract(smallfelem out, const smallfelem in)
920 felem_contract(out, tmp); 920 felem_contract(out, tmp);
921} 921}
922 922
923static void 923static void
924smallfelem_mul_contract(smallfelem out, const smallfelem in1, const smallfelem in2) 924smallfelem_mul_contract(smallfelem out, const smallfelem in1, const smallfelem in2)
925{ 925{
926 longfelem longtmp; 926 longfelem longtmp;
@@ -936,7 +936,7 @@ smallfelem_mul_contract(smallfelem out, const smallfelem in1, const smallfelem i
936 * On entry: 936 * On entry:
937 * small[i] < 2^64 937 * small[i] < 2^64
938 */ 938 */
939static limb 939static limb
940smallfelem_is_zero(const smallfelem small) 940smallfelem_is_zero(const smallfelem small)
941{ 941{
942 limb result; 942 limb result;
@@ -972,7 +972,7 @@ smallfelem_is_zero(const smallfelem small)
972 return result; 972 return result;
973} 973}
974 974
975static int 975static int
976smallfelem_is_zero_int(const smallfelem small) 976smallfelem_is_zero_int(const smallfelem small)
977{ 977{
978 return (int) (smallfelem_is_zero(small) & ((limb) 1)); 978 return (int) (smallfelem_is_zero(small) & ((limb) 1));
@@ -985,7 +985,7 @@ smallfelem_is_zero_int(const smallfelem small)
985 * a^{p-1} = 1 (mod p) 985 * a^{p-1} = 1 (mod p)
986 * a^{p-2} = a^{-1} (mod p) 986 * a^{p-2} = a^{-1} (mod p)
987 */ 987 */
988static void 988static void
989felem_inv(felem out, const felem in) 989felem_inv(felem out, const felem in)
990{ 990{
991 felem ftmp, ftmp2; 991 felem ftmp, ftmp2;
@@ -1080,7 +1080,7 @@ felem_inv(felem out, const felem in)
1080 felem_reduce(out, tmp); /* 2^256 - 2^224 + 2^192 + 2^96 - 3 */ 1080 felem_reduce(out, tmp); /* 2^256 - 2^224 + 2^192 + 2^96 - 3 */
1081} 1081}
1082 1082
1083static void 1083static void
1084smallfelem_inv_contract(smallfelem out, const smallfelem in) 1084smallfelem_inv_contract(smallfelem out, const smallfelem in)
1085{ 1085{
1086 felem tmp; 1086 felem tmp;
@@ -1233,7 +1233,7 @@ copy_small_conditional(felem out, const smallfelem in, limb mask)
1233 * are equal, (while not equal to the point at infinity). This case never 1233 * are equal, (while not equal to the point at infinity). This case never
1234 * happens during single point multiplication, so there is no timing leak for 1234 * happens during single point multiplication, so there is no timing leak for
1235 * ECDH or ECDSA signing. */ 1235 * ECDH or ECDSA signing. */
1236static void 1236static void
1237point_add(felem x3, felem y3, felem z3, 1237point_add(felem x3, felem y3, felem z3,
1238 const felem x1, const felem y1, const felem z1, 1238 const felem x1, const felem y1, const felem z1,
1239 const int mixed, const smallfelem x2, const smallfelem y2, const smallfelem z2) 1239 const int mixed, const smallfelem x2, const smallfelem y2, const smallfelem z2)
@@ -1393,7 +1393,7 @@ point_add(felem x3, felem y3, felem z3,
1393 1393
1394/* point_add_small is the same as point_add, except that it operates on 1394/* point_add_small is the same as point_add, except that it operates on
1395 * smallfelems */ 1395 * smallfelems */
1396static void 1396static void
1397point_add_small(smallfelem x3, smallfelem y3, smallfelem z3, 1397point_add_small(smallfelem x3, smallfelem y3, smallfelem z3,
1398 smallfelem x1, smallfelem y1, smallfelem z1, 1398 smallfelem x1, smallfelem y1, smallfelem z1,
1399 smallfelem x2, smallfelem y2, smallfelem z2) 1399 smallfelem x2, smallfelem y2, smallfelem z2)
@@ -1545,7 +1545,7 @@ static const smallfelem gmul[2][16][3] =
1545 1545
1546/* select_point selects the |idx|th point from a precomputation table and 1546/* select_point selects the |idx|th point from a precomputation table and
1547 * copies it to out. */ 1547 * copies it to out. */
1548static void 1548static void
1549select_point(const u64 idx, unsigned int size, const smallfelem pre_comp[16][3], smallfelem out[3]) 1549select_point(const u64 idx, unsigned int size, const smallfelem pre_comp[16][3], smallfelem out[3])
1550{ 1550{
1551 unsigned i, j; 1551 unsigned i, j;
@@ -1566,7 +1566,7 @@ select_point(const u64 idx, unsigned int size, const smallfelem pre_comp[16][3],
1566} 1566}
1567 1567
1568/* get_bit returns the |i|th bit in |in| */ 1568/* get_bit returns the |i|th bit in |in| */
1569static char 1569static char
1570get_bit(const felem_bytearray in, int i) 1570get_bit(const felem_bytearray in, int i)
1571{ 1571{
1572 if ((i < 0) || (i >= 256)) 1572 if ((i < 0) || (i >= 256))
@@ -1579,7 +1579,7 @@ get_bit(const felem_bytearray in, int i)
1579 * the scalars in scalars[]. If g_scalar is non-NULL, we also add this multiple 1579 * the scalars in scalars[]. If g_scalar is non-NULL, we also add this multiple
1580 * of the generator, using certain (large) precomputed multiples in g_pre_comp. 1580 * of the generator, using certain (large) precomputed multiples in g_pre_comp.
1581 * Output point (X, Y, Z) is stored in x_out, y_out, z_out */ 1581 * Output point (X, Y, Z) is stored in x_out, y_out, z_out */
1582static void 1582static void
1583batch_mul(felem x_out, felem y_out, felem z_out, 1583batch_mul(felem x_out, felem y_out, felem z_out,
1584 const felem_bytearray scalars[], const unsigned num_points, const u8 * g_scalar, 1584 const felem_bytearray scalars[], const unsigned num_points, const u8 * g_scalar,
1585 const int mixed, const smallfelem pre_comp[][17][3], const smallfelem g_pre_comp[2][16][3]) 1585 const int mixed, const smallfelem pre_comp[][17][3], const smallfelem g_pre_comp[2][16][3])
@@ -1698,20 +1698,20 @@ EC_GFp_nistp256_method(void)
1698 .group_get_curve = ec_GFp_simple_group_get_curve, 1698 .group_get_curve = ec_GFp_simple_group_get_curve,
1699 .group_get_degree = ec_GFp_simple_group_get_degree, 1699 .group_get_degree = ec_GFp_simple_group_get_degree,
1700 .group_check_discriminant = 1700 .group_check_discriminant =
1701 ec_GFp_simple_group_check_discriminant, 1701 ec_GFp_simple_group_check_discriminant,
1702 .point_init = ec_GFp_simple_point_init, 1702 .point_init = ec_GFp_simple_point_init,
1703 .point_finish = ec_GFp_simple_point_finish, 1703 .point_finish = ec_GFp_simple_point_finish,
1704 .point_clear_finish = ec_GFp_simple_point_clear_finish, 1704 .point_clear_finish = ec_GFp_simple_point_clear_finish,
1705 .point_copy = ec_GFp_simple_point_copy, 1705 .point_copy = ec_GFp_simple_point_copy,
1706 .point_set_to_infinity = ec_GFp_simple_point_set_to_infinity, 1706 .point_set_to_infinity = ec_GFp_simple_point_set_to_infinity,
1707 .point_set_Jprojective_coordinates = 1707 .point_set_Jprojective_coordinates =
1708 ec_GFp_simple_set_Jprojective_coordinates, 1708 ec_GFp_simple_set_Jprojective_coordinates,
1709 .point_get_Jprojective_coordinates = 1709 .point_get_Jprojective_coordinates =
1710 ec_GFp_simple_get_Jprojective_coordinates, 1710 ec_GFp_simple_get_Jprojective_coordinates,
1711 .point_set_affine_coordinates = 1711 .point_set_affine_coordinates =
1712 ec_GFp_simple_point_set_affine_coordinates, 1712 ec_GFp_simple_point_set_affine_coordinates,
1713 .point_get_affine_coordinates = 1713 .point_get_affine_coordinates =
1714 ec_GFp_nistp256_point_get_affine_coordinates, 1714 ec_GFp_nistp256_point_get_affine_coordinates,
1715 .add = ec_GFp_simple_add, 1715 .add = ec_GFp_simple_add,
1716 .dbl = ec_GFp_simple_dbl, 1716 .dbl = ec_GFp_simple_dbl,
1717 .invert = ec_GFp_simple_invert, 1717 .invert = ec_GFp_simple_invert,
@@ -1760,7 +1760,7 @@ nistp256_pre_comp_dup(void *src_)
1760 return src_; 1760 return src_;
1761} 1761}
1762 1762
1763static void 1763static void
1764nistp256_pre_comp_free(void *pre_) 1764nistp256_pre_comp_free(void *pre_)
1765{ 1765{
1766 int i; 1766 int i;
@@ -1776,7 +1776,7 @@ nistp256_pre_comp_free(void *pre_)
1776 free(pre); 1776 free(pre);
1777} 1777}
1778 1778
1779static void 1779static void
1780nistp256_pre_comp_clear_free(void *pre_) 1780nistp256_pre_comp_clear_free(void *pre_)
1781{ 1781{
1782 int i; 1782 int i;
@@ -1796,7 +1796,7 @@ nistp256_pre_comp_clear_free(void *pre_)
1796/* OPENSSL EC_METHOD FUNCTIONS 1796/* OPENSSL EC_METHOD FUNCTIONS
1797 */ 1797 */
1798 1798
1799int 1799int
1800ec_GFp_nistp256_group_init(EC_GROUP * group) 1800ec_GFp_nistp256_group_init(EC_GROUP * group)
1801{ 1801{
1802 int ret; 1802 int ret;
@@ -1805,7 +1805,7 @@ ec_GFp_nistp256_group_init(EC_GROUP * group)
1805 return ret; 1805 return ret;
1806} 1806}
1807 1807
1808int 1808int
1809ec_GFp_nistp256_group_set_curve(EC_GROUP * group, const BIGNUM * p, 1809ec_GFp_nistp256_group_set_curve(EC_GROUP * group, const BIGNUM * p,
1810 const BIGNUM * a, const BIGNUM * b, BN_CTX * ctx) 1810 const BIGNUM * a, const BIGNUM * b, BN_CTX * ctx)
1811{ 1811{
@@ -1839,7 +1839,7 @@ ec_GFp_nistp256_group_set_curve(EC_GROUP * group, const BIGNUM * p,
1839 1839
1840/* Takes the Jacobian coordinates (X, Y, Z) of a point and returns 1840/* Takes the Jacobian coordinates (X, Y, Z) of a point and returns
1841 * (X', Y') = (X/Z^2, Y/Z^3) */ 1841 * (X', Y') = (X/Z^2, Y/Z^3) */
1842int 1842int
1843ec_GFp_nistp256_point_get_affine_coordinates(const EC_GROUP * group, 1843ec_GFp_nistp256_point_get_affine_coordinates(const EC_GROUP * group,
1844 const EC_POINT * point, BIGNUM * x, BIGNUM * y, BN_CTX * ctx) 1844 const EC_POINT * point, BIGNUM * x, BIGNUM * y, BN_CTX * ctx)
1845{ 1845{
@@ -1880,7 +1880,7 @@ ec_GFp_nistp256_point_get_affine_coordinates(const EC_GROUP * group,
1880 return 1; 1880 return 1;
1881} 1881}
1882 1882
1883static void 1883static void
1884make_points_affine(size_t num, smallfelem points[ /* num */ ][3], smallfelem tmp_smallfelems[ /* num+1 */ ]) 1884make_points_affine(size_t num, smallfelem points[ /* num */ ][3], smallfelem tmp_smallfelems[ /* num+1 */ ])
1885{ 1885{
1886 /* 1886 /*
@@ -1903,7 +1903,7 @@ make_points_affine(size_t num, smallfelem points[ /* num */ ][3], smallfelem tmp
1903 1903
1904/* Computes scalar*generator + \sum scalars[i]*points[i], ignoring NULL values 1904/* Computes scalar*generator + \sum scalars[i]*points[i], ignoring NULL values
1905 * Result is stored in r (r can equal one of the inputs). */ 1905 * Result is stored in r (r can equal one of the inputs). */
1906int 1906int
1907ec_GFp_nistp256_points_mul(const EC_GROUP * group, EC_POINT * r, 1907ec_GFp_nistp256_points_mul(const EC_GROUP * group, EC_POINT * r,
1908 const BIGNUM * scalar, size_t num, const EC_POINT * points[], 1908 const BIGNUM * scalar, size_t num, const EC_POINT * points[],
1909 const BIGNUM * scalars[], BN_CTX * ctx) 1909 const BIGNUM * scalars[], BN_CTX * ctx)
@@ -2101,7 +2101,7 @@ ec_GFp_nistp256_points_mul(const EC_GROUP * group, EC_POINT * r,
2101 return ret; 2101 return ret;
2102} 2102}
2103 2103
2104int 2104int
2105ec_GFp_nistp256_precompute_mult(EC_GROUP * group, BN_CTX * ctx) 2105ec_GFp_nistp256_precompute_mult(EC_GROUP * group, BN_CTX * ctx)
2106{ 2106{
2107 int ret = 0; 2107 int ret = 0;
@@ -2222,7 +2222,7 @@ ec_GFp_nistp256_precompute_mult(EC_GROUP * group, BN_CTX * ctx)
2222 return ret; 2222 return ret;
2223} 2223}
2224 2224
2225int 2225int
2226ec_GFp_nistp256_have_precompute_mult(const EC_GROUP * group) 2226ec_GFp_nistp256_have_precompute_mult(const EC_GROUP * group)
2227{ 2227{
2228 if (EC_EX_DATA_get_data(group->extra_data, nistp256_pre_comp_dup, 2228 if (EC_EX_DATA_get_data(group->extra_data, nistp256_pre_comp_dup,
diff --git a/src/lib/libcrypto/ec/ecp_nistp521.c b/src/lib/libcrypto/ec/ecp_nistp521.c
index 3d38c72396..db2060668c 100644
--- a/src/lib/libcrypto/ec/ecp_nistp521.c
+++ b/src/lib/libcrypto/ec/ecp_nistp521.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_nistp521.c,v 1.25 2021/04/20 17:28:18 tb Exp $ */ 1/* $OpenBSD: ecp_nistp521.c,v 1.26 2021/04/20 17:38:02 tb Exp $ */
2/* 2/*
3 * Written by Adam Langley (Google) for the OpenSSL project 3 * Written by Adam Langley (Google) for the OpenSSL project
4 */ 4 */
@@ -130,7 +130,7 @@ static const limb bottom58bits = 0x3ffffffffffffff;
130 130
131/* bin66_to_felem takes a little-endian byte array and converts it into felem 131/* bin66_to_felem takes a little-endian byte array and converts it into felem
132 * form. This assumes that the CPU is little-endian. */ 132 * form. This assumes that the CPU is little-endian. */
133static void 133static void
134bin66_to_felem(felem out, const u8 in[66]) 134bin66_to_felem(felem out, const u8 in[66])
135{ 135{
136 out[0] = (*((limb *) & in[0])) & bottom58bits; 136 out[0] = (*((limb *) & in[0])) & bottom58bits;
@@ -146,7 +146,7 @@ bin66_to_felem(felem out, const u8 in[66])
146 146
147/* felem_to_bin66 takes an felem and serialises into a little endian, 66 byte 147/* felem_to_bin66 takes an felem and serialises into a little endian, 66 byte
148 * array. This assumes that the CPU is little-endian. */ 148 * array. This assumes that the CPU is little-endian. */
149static void 149static void
150felem_to_bin66(u8 out[66], const felem in) 150felem_to_bin66(u8 out[66], const felem in)
151{ 151{
152 memset(out, 0, 66); 152 memset(out, 0, 66);
@@ -162,7 +162,7 @@ felem_to_bin66(u8 out[66], const felem in)
162} 162}
163 163
164/* To preserve endianness when using BN_bn2bin and BN_bin2bn */ 164/* To preserve endianness when using BN_bn2bin and BN_bin2bn */
165static void 165static void
166flip_endian(u8 * out, const u8 * in, unsigned len) 166flip_endian(u8 * out, const u8 * in, unsigned len)
167{ 167{
168 unsigned i; 168 unsigned i;
@@ -171,7 +171,7 @@ flip_endian(u8 * out, const u8 * in, unsigned len)
171} 171}
172 172
173/* BN_to_felem converts an OpenSSL BIGNUM into an felem */ 173/* BN_to_felem converts an OpenSSL BIGNUM into an felem */
174static int 174static int
175BN_to_felem(felem out, const BIGNUM * bn) 175BN_to_felem(felem out, const BIGNUM * bn)
176{ 176{
177 felem_bytearray b_in; 177 felem_bytearray b_in;
@@ -209,7 +209,7 @@ felem_to_BN(BIGNUM * out, const felem in)
209/* Field operations 209/* Field operations
210 * ---------------- */ 210 * ---------------- */
211 211
212static void 212static void
213felem_one(felem out) 213felem_one(felem out)
214{ 214{
215 out[0] = 1; 215 out[0] = 1;
@@ -223,7 +223,7 @@ felem_one(felem out)
223 out[8] = 0; 223 out[8] = 0;
224} 224}
225 225
226static void 226static void
227felem_assign(felem out, const felem in) 227felem_assign(felem out, const felem in)
228{ 228{
229 out[0] = in[0]; 229 out[0] = in[0];
@@ -238,7 +238,7 @@ felem_assign(felem out, const felem in)
238} 238}
239 239
240/* felem_sum64 sets out = out + in. */ 240/* felem_sum64 sets out = out + in. */
241static void 241static void
242felem_sum64(felem out, const felem in) 242felem_sum64(felem out, const felem in)
243{ 243{
244 out[0] += in[0]; 244 out[0] += in[0];
@@ -253,7 +253,7 @@ felem_sum64(felem out, const felem in)
253} 253}
254 254
255/* felem_scalar sets out = in * scalar */ 255/* felem_scalar sets out = in * scalar */
256static void 256static void
257felem_scalar(felem out, const felem in, limb scalar) 257felem_scalar(felem out, const felem in, limb scalar)
258{ 258{
259 out[0] = in[0] * scalar; 259 out[0] = in[0] * scalar;
@@ -268,7 +268,7 @@ felem_scalar(felem out, const felem in, limb scalar)
268} 268}
269 269
270/* felem_scalar64 sets out = out * scalar */ 270/* felem_scalar64 sets out = out * scalar */
271static void 271static void
272felem_scalar64(felem out, limb scalar) 272felem_scalar64(felem out, limb scalar)
273{ 273{
274 out[0] *= scalar; 274 out[0] *= scalar;
@@ -283,7 +283,7 @@ felem_scalar64(felem out, limb scalar)
283} 283}
284 284
285/* felem_scalar128 sets out = out * scalar */ 285/* felem_scalar128 sets out = out * scalar */
286static void 286static void
287felem_scalar128(largefelem out, limb scalar) 287felem_scalar128(largefelem out, limb scalar)
288{ 288{
289 out[0] *= scalar; 289 out[0] *= scalar;
@@ -303,7 +303,7 @@ felem_scalar128(largefelem out, limb scalar)
303 * On exit: 303 * On exit:
304 * out[i] < 2^62 304 * out[i] < 2^62
305 */ 305 */
306static void 306static void
307felem_neg(felem out, const felem in) 307felem_neg(felem out, const felem in)
308{ 308{
309 /* In order to prevent underflow, we subtract from 0 mod p. */ 309 /* In order to prevent underflow, we subtract from 0 mod p. */
@@ -327,7 +327,7 @@ felem_neg(felem out, const felem in)
327 * On exit: 327 * On exit:
328 * out[i] < out[i] + 2^62 328 * out[i] < out[i] + 2^62
329 */ 329 */
330static void 330static void
331felem_diff64(felem out, const felem in) 331felem_diff64(felem out, const felem in)
332{ 332{
333 /* In order to prevent underflow, we add 0 mod p before subtracting. */ 333 /* In order to prevent underflow, we add 0 mod p before subtracting. */
@@ -351,7 +351,7 @@ felem_diff64(felem out, const felem in)
351 * On exit: 351 * On exit:
352 * out[i] < out[i] + 2^63 352 * out[i] < out[i] + 2^63
353 */ 353 */
354static void 354static void
355felem_diff_128_64(largefelem out, const felem in) 355felem_diff_128_64(largefelem out, const felem in)
356{ 356{
357 /* In order to prevent underflow, we add 0 mod p before subtracting. */ 357 /* In order to prevent underflow, we add 0 mod p before subtracting. */
@@ -375,7 +375,7 @@ felem_diff_128_64(largefelem out, const felem in)
375 * On exit: 375 * On exit:
376 * out[i] < out[i] + 2^127 - 2^69 376 * out[i] < out[i] + 2^127 - 2^69
377 */ 377 */
378static void 378static void
379felem_diff128(largefelem out, const largefelem in) 379felem_diff128(largefelem out, const largefelem in)
380{ 380{
381 /* In order to prevent underflow, we add 0 mod p before subtracting. */ 381 /* In order to prevent underflow, we add 0 mod p before subtracting. */
@@ -399,7 +399,7 @@ felem_diff128(largefelem out, const largefelem in)
399 * On exit: 399 * On exit:
400 * out[i] < 17 * max(in[i]) * max(in[i]) 400 * out[i] < 17 * max(in[i]) * max(in[i])
401 */ 401 */
402static void 402static void
403felem_square(largefelem out, const felem in) 403felem_square(largefelem out, const felem in)
404{ 404{
405 felem inx2, inx4; 405 felem inx2, inx4;
@@ -493,7 +493,7 @@ felem_square(largefelem out, const felem in)
493 * On exit: 493 * On exit:
494 * out[i] < 17 * max(in1[i]) * max(in2[i]) 494 * out[i] < 17 * max(in1[i]) * max(in2[i])
495 */ 495 */
496static void 496static void
497felem_mul(largefelem out, const felem in1, const felem in2) 497felem_mul(largefelem out, const felem in1, const felem in2)
498{ 498{
499 felem in2x2; 499 felem in2x2;
@@ -608,7 +608,7 @@ static const limb bottom52bits = 0xfffffffffffff;
608 * On exit: 608 * On exit:
609 * out[i] < 2^59 + 2^14 609 * out[i] < 2^59 + 2^14
610 */ 610 */
611static void 611static void
612felem_reduce(felem out, const largefelem in) 612felem_reduce(felem out, const largefelem in)
613{ 613{
614 u64 overflow1, overflow2; 614 u64 overflow1, overflow2;
@@ -680,7 +680,7 @@ felem_reduce(felem out, const largefelem in)
680 */ 680 */
681} 681}
682 682
683static void 683static void
684felem_square_reduce(felem out, const felem in) 684felem_square_reduce(felem out, const felem in)
685{ 685{
686 largefelem tmp; 686 largefelem tmp;
@@ -688,7 +688,7 @@ felem_square_reduce(felem out, const felem in)
688 felem_reduce(out, tmp); 688 felem_reduce(out, tmp);
689} 689}
690 690
691static void 691static void
692felem_mul_reduce(felem out, const felem in1, const felem in2) 692felem_mul_reduce(felem out, const felem in1, const felem in2)
693{ 693{
694 largefelem tmp; 694 largefelem tmp;
@@ -703,7 +703,7 @@ felem_mul_reduce(felem out, const felem in1, const felem in2)
703 * a^{p-1} = 1 (mod p) 703 * a^{p-1} = 1 (mod p)
704 * a^{p-2} = a^{-1} (mod p) 704 * a^{p-2} = a^{-1} (mod p)
705 */ 705 */
706static void 706static void
707felem_inv(felem out, const felem in) 707felem_inv(felem out, const felem in)
708{ 708{
709 felem ftmp, ftmp2, ftmp3, ftmp4; 709 felem ftmp, ftmp2, ftmp3, ftmp4;
@@ -817,7 +817,7 @@ static const felem kPrime =
817 * On entry: 817 * On entry:
818 * in[i] < 2^59 + 2^14 818 * in[i] < 2^59 + 2^14
819 */ 819 */
820static limb 820static limb
821felem_is_zero(const felem in) 821felem_is_zero(const felem in)
822{ 822{
823 felem ftmp; 823 felem ftmp;
@@ -886,7 +886,7 @@ felem_is_zero(const felem in)
886 return is_zero; 886 return is_zero;
887} 887}
888 888
889static int 889static int
890felem_is_zero_int(const felem in) 890felem_is_zero_int(const felem in)
891{ 891{
892 return (int) (felem_is_zero(in) & ((limb) 1)); 892 return (int) (felem_is_zero(in) & ((limb) 1));
@@ -896,7 +896,7 @@ felem_is_zero_int(const felem in)
896 * On entry: 896 * On entry:
897 * in[i] < 2^59 + 2^14 897 * in[i] < 2^59 + 2^14
898 */ 898 */
899static void 899static void
900felem_contract(felem out, const felem in) 900felem_contract(felem out, const felem in)
901{ 901{
902 limb is_p, is_greater, sign; 902 limb is_p, is_greater, sign;
@@ -1153,7 +1153,7 @@ copy_conditional(felem out, const felem in, limb mask)
1153 * are equal (while not equal to the point at infinity). This case never 1153 * are equal (while not equal to the point at infinity). This case never
1154 * happens during single point multiplication, so there is no timing leak for 1154 * happens during single point multiplication, so there is no timing leak for
1155 * ECDH or ECDSA signing. */ 1155 * ECDH or ECDSA signing. */
1156static void 1156static void
1157point_add(felem x3, felem y3, felem z3, 1157point_add(felem x3, felem y3, felem z3,
1158 const felem x1, const felem y1, const felem z1, 1158 const felem x1, const felem y1, const felem z1,
1159 const int mixed, const felem x2, const felem y2, const felem z2) 1159 const int mixed, const felem x2, const felem y2, const felem z2)
@@ -1450,7 +1450,7 @@ static const felem gmul[16][3] =
1450 1450
1451/* select_point selects the |idx|th point from a precomputation table and 1451/* select_point selects the |idx|th point from a precomputation table and
1452 * copies it to out. */ 1452 * copies it to out. */
1453static void 1453static void
1454select_point(const limb idx, unsigned int size, const felem pre_comp[ /* size */ ][3], 1454select_point(const limb idx, unsigned int size, const felem pre_comp[ /* size */ ][3],
1455 felem out[3]) 1455 felem out[3])
1456{ 1456{
@@ -1472,7 +1472,7 @@ select_point(const limb idx, unsigned int size, const felem pre_comp[ /* size */
1472} 1472}
1473 1473
1474/* get_bit returns the |i|th bit in |in| */ 1474/* get_bit returns the |i|th bit in |in| */
1475static char 1475static char
1476get_bit(const felem_bytearray in, int i) 1476get_bit(const felem_bytearray in, int i)
1477{ 1477{
1478 if (i < 0) 1478 if (i < 0)
@@ -1485,7 +1485,7 @@ get_bit(const felem_bytearray in, int i)
1485 * the scalars in scalars[]. If g_scalar is non-NULL, we also add this multiple 1485 * the scalars in scalars[]. If g_scalar is non-NULL, we also add this multiple
1486 * of the generator, using certain (large) precomputed multiples in g_pre_comp. 1486 * of the generator, using certain (large) precomputed multiples in g_pre_comp.
1487 * Output point (X, Y, Z) is stored in x_out, y_out, z_out */ 1487 * Output point (X, Y, Z) is stored in x_out, y_out, z_out */
1488static void 1488static void
1489batch_mul(felem x_out, felem y_out, felem z_out, 1489batch_mul(felem x_out, felem y_out, felem z_out,
1490 const felem_bytearray scalars[], const unsigned num_points, const u8 * g_scalar, 1490 const felem_bytearray scalars[], const unsigned num_points, const u8 * g_scalar,
1491 const int mixed, const felem pre_comp[][17][3], const felem g_pre_comp[16][3]) 1491 const int mixed, const felem pre_comp[][17][3], const felem g_pre_comp[16][3])
@@ -1588,20 +1588,20 @@ EC_GFp_nistp521_method(void)
1588 .group_get_curve = ec_GFp_simple_group_get_curve, 1588 .group_get_curve = ec_GFp_simple_group_get_curve,
1589 .group_get_degree = ec_GFp_simple_group_get_degree, 1589 .group_get_degree = ec_GFp_simple_group_get_degree,
1590 .group_check_discriminant = 1590 .group_check_discriminant =
1591 ec_GFp_simple_group_check_discriminant, 1591 ec_GFp_simple_group_check_discriminant,
1592 .point_init = ec_GFp_simple_point_init, 1592 .point_init = ec_GFp_simple_point_init,
1593 .point_finish = ec_GFp_simple_point_finish, 1593 .point_finish = ec_GFp_simple_point_finish,
1594 .point_clear_finish = ec_GFp_simple_point_clear_finish, 1594 .point_clear_finish = ec_GFp_simple_point_clear_finish,
1595 .point_copy = ec_GFp_simple_point_copy, 1595 .point_copy = ec_GFp_simple_point_copy,
1596 .point_set_to_infinity = ec_GFp_simple_point_set_to_infinity, 1596 .point_set_to_infinity = ec_GFp_simple_point_set_to_infinity,
1597 .point_set_Jprojective_coordinates = 1597 .point_set_Jprojective_coordinates =
1598 ec_GFp_simple_set_Jprojective_coordinates, 1598 ec_GFp_simple_set_Jprojective_coordinates,
1599 .point_get_Jprojective_coordinates = 1599 .point_get_Jprojective_coordinates =
1600 ec_GFp_simple_get_Jprojective_coordinates, 1600 ec_GFp_simple_get_Jprojective_coordinates,
1601 .point_set_affine_coordinates = 1601 .point_set_affine_coordinates =
1602 ec_GFp_simple_point_set_affine_coordinates, 1602 ec_GFp_simple_point_set_affine_coordinates,
1603 .point_get_affine_coordinates = 1603 .point_get_affine_coordinates =
1604 ec_GFp_nistp521_point_get_affine_coordinates, 1604 ec_GFp_nistp521_point_get_affine_coordinates,
1605 .add = ec_GFp_simple_add, 1605 .add = ec_GFp_simple_add,
1606 .dbl = ec_GFp_simple_dbl, 1606 .dbl = ec_GFp_simple_dbl,
1607 .invert = ec_GFp_simple_invert, 1607 .invert = ec_GFp_simple_invert,
@@ -1651,7 +1651,7 @@ nistp521_pre_comp_dup(void *src_)
1651 return src_; 1651 return src_;
1652} 1652}
1653 1653
1654static void 1654static void
1655nistp521_pre_comp_free(void *pre_) 1655nistp521_pre_comp_free(void *pre_)
1656{ 1656{
1657 int i; 1657 int i;
@@ -1667,7 +1667,7 @@ nistp521_pre_comp_free(void *pre_)
1667 free(pre); 1667 free(pre);
1668} 1668}
1669 1669
1670static void 1670static void
1671nistp521_pre_comp_clear_free(void *pre_) 1671nistp521_pre_comp_clear_free(void *pre_)
1672{ 1672{
1673 int i; 1673 int i;
@@ -1687,7 +1687,7 @@ nistp521_pre_comp_clear_free(void *pre_)
1687/* OPENSSL EC_METHOD FUNCTIONS 1687/* OPENSSL EC_METHOD FUNCTIONS
1688 */ 1688 */
1689 1689
1690int 1690int
1691ec_GFp_nistp521_group_init(EC_GROUP * group) 1691ec_GFp_nistp521_group_init(EC_GROUP * group)
1692{ 1692{
1693 int ret; 1693 int ret;
@@ -1696,7 +1696,7 @@ ec_GFp_nistp521_group_init(EC_GROUP * group)
1696 return ret; 1696 return ret;
1697} 1697}
1698 1698
1699int 1699int
1700ec_GFp_nistp521_group_set_curve(EC_GROUP * group, const BIGNUM * p, 1700ec_GFp_nistp521_group_set_curve(EC_GROUP * group, const BIGNUM * p,
1701 const BIGNUM * a, const BIGNUM * b, BN_CTX * ctx) 1701 const BIGNUM * a, const BIGNUM * b, BN_CTX * ctx)
1702{ 1702{
@@ -1730,7 +1730,7 @@ ec_GFp_nistp521_group_set_curve(EC_GROUP * group, const BIGNUM * p,
1730 1730
1731/* Takes the Jacobian coordinates (X, Y, Z) of a point and returns 1731/* Takes the Jacobian coordinates (X, Y, Z) of a point and returns
1732 * (X', Y') = (X/Z^2, Y/Z^3) */ 1732 * (X', Y') = (X/Z^2, Y/Z^3) */
1733int 1733int
1734ec_GFp_nistp521_point_get_affine_coordinates(const EC_GROUP * group, 1734ec_GFp_nistp521_point_get_affine_coordinates(const EC_GROUP * group,
1735 const EC_POINT * point, BIGNUM * x, BIGNUM * y, BN_CTX * ctx) 1735 const EC_POINT * point, BIGNUM * x, BIGNUM * y, BN_CTX * ctx)
1736{ 1736{
@@ -1770,7 +1770,7 @@ ec_GFp_nistp521_point_get_affine_coordinates(const EC_GROUP * group,
1770 return 1; 1770 return 1;
1771} 1771}
1772 1772
1773static void 1773static void
1774make_points_affine(size_t num, felem points[ /* num */ ][3], felem tmp_felems[ /* num+1 */ ]) 1774make_points_affine(size_t num, felem points[ /* num */ ][3], felem tmp_felems[ /* num+1 */ ])
1775{ 1775{
1776 /* 1776 /*
@@ -1793,7 +1793,7 @@ make_points_affine(size_t num, felem points[ /* num */ ][3], felem tmp_felems[ /
1793 1793
1794/* Computes scalar*generator + \sum scalars[i]*points[i], ignoring NULL values 1794/* Computes scalar*generator + \sum scalars[i]*points[i], ignoring NULL values
1795 * Result is stored in r (r can equal one of the inputs). */ 1795 * Result is stored in r (r can equal one of the inputs). */
1796int 1796int
1797ec_GFp_nistp521_points_mul(const EC_GROUP * group, EC_POINT * r, 1797ec_GFp_nistp521_points_mul(const EC_GROUP * group, EC_POINT * r,
1798 const BIGNUM * scalar, size_t num, const EC_POINT * points[], 1798 const BIGNUM * scalar, size_t num, const EC_POINT * points[],
1799 const BIGNUM * scalars[], BN_CTX * ctx) 1799 const BIGNUM * scalars[], BN_CTX * ctx)
@@ -1990,7 +1990,7 @@ ec_GFp_nistp521_points_mul(const EC_GROUP * group, EC_POINT * r,
1990 return ret; 1990 return ret;
1991} 1991}
1992 1992
1993int 1993int
1994ec_GFp_nistp521_precompute_mult(EC_GROUP * group, BN_CTX * ctx) 1994ec_GFp_nistp521_precompute_mult(EC_GROUP * group, BN_CTX * ctx)
1995{ 1995{
1996 int ret = 0; 1996 int ret = 0;
@@ -2097,7 +2097,7 @@ ec_GFp_nistp521_precompute_mult(EC_GROUP * group, BN_CTX * ctx)
2097 return ret; 2097 return ret;
2098} 2098}
2099 2099
2100int 2100int
2101ec_GFp_nistp521_have_precompute_mult(const EC_GROUP * group) 2101ec_GFp_nistp521_have_precompute_mult(const EC_GROUP * group)
2102{ 2102{
2103 if (EC_EX_DATA_get_data(group->extra_data, nistp521_pre_comp_dup, 2103 if (EC_EX_DATA_get_data(group->extra_data, nistp521_pre_comp_dup,
diff --git a/src/lib/libcrypto/ec/ecp_smpl.c b/src/lib/libcrypto/ec/ecp_smpl.c
index 9223427459..96ab5bd44e 100644
--- a/src/lib/libcrypto/ec/ecp_smpl.c
+++ b/src/lib/libcrypto/ec/ecp_smpl.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ecp_smpl.c,v 1.31 2021/04/20 17:28:18 tb Exp $ */ 1/* $OpenBSD: ecp_smpl.c,v 1.32 2021/04/20 17:38:02 tb Exp $ */
2/* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de> 2/* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
3 * for the OpenSSL project. 3 * for the OpenSSL project.
4 * Includes code written by Bodo Moeller for the OpenSSL project. 4 * Includes code written by Bodo Moeller for the OpenSSL project.
@@ -81,20 +81,20 @@ EC_GFp_simple_method(void)
81 .group_get_curve = ec_GFp_simple_group_get_curve, 81 .group_get_curve = ec_GFp_simple_group_get_curve,
82 .group_get_degree = ec_GFp_simple_group_get_degree, 82 .group_get_degree = ec_GFp_simple_group_get_degree,
83 .group_check_discriminant = 83 .group_check_discriminant =
84 ec_GFp_simple_group_check_discriminant, 84 ec_GFp_simple_group_check_discriminant,
85 .point_init = ec_GFp_simple_point_init, 85 .point_init = ec_GFp_simple_point_init,
86 .point_finish = ec_GFp_simple_point_finish, 86 .point_finish = ec_GFp_simple_point_finish,
87 .point_clear_finish = ec_GFp_simple_point_clear_finish, 87 .point_clear_finish = ec_GFp_simple_point_clear_finish,
88 .point_copy = ec_GFp_simple_point_copy, 88 .point_copy = ec_GFp_simple_point_copy,
89 .point_set_to_infinity = ec_GFp_simple_point_set_to_infinity, 89 .point_set_to_infinity = ec_GFp_simple_point_set_to_infinity,
90 .point_set_Jprojective_coordinates = 90 .point_set_Jprojective_coordinates =
91 ec_GFp_simple_set_Jprojective_coordinates, 91 ec_GFp_simple_set_Jprojective_coordinates,
92 .point_get_Jprojective_coordinates = 92 .point_get_Jprojective_coordinates =
93 ec_GFp_simple_get_Jprojective_coordinates, 93 ec_GFp_simple_get_Jprojective_coordinates,
94 .point_set_affine_coordinates = 94 .point_set_affine_coordinates =
95 ec_GFp_simple_point_set_affine_coordinates, 95 ec_GFp_simple_point_set_affine_coordinates,
96 .point_get_affine_coordinates = 96 .point_get_affine_coordinates =
97 ec_GFp_simple_point_get_affine_coordinates, 97 ec_GFp_simple_point_get_affine_coordinates,
98 .add = ec_GFp_simple_add, 98 .add = ec_GFp_simple_add,
99 .dbl = ec_GFp_simple_dbl, 99 .dbl = ec_GFp_simple_dbl,
100 .invert = ec_GFp_simple_invert, 100 .invert = ec_GFp_simple_invert,
@@ -129,7 +129,7 @@ EC_GFp_simple_method(void)
129 */ 129 */
130 130
131 131
132int 132int
133ec_GFp_simple_group_init(EC_GROUP * group) 133ec_GFp_simple_group_init(EC_GROUP * group)
134{ 134{
135 BN_init(&group->field); 135 BN_init(&group->field);
@@ -140,7 +140,7 @@ ec_GFp_simple_group_init(EC_GROUP * group)
140} 140}
141 141
142 142
143void 143void
144ec_GFp_simple_group_finish(EC_GROUP * group) 144ec_GFp_simple_group_finish(EC_GROUP * group)
145{ 145{
146 BN_free(&group->field); 146 BN_free(&group->field);
@@ -149,7 +149,7 @@ ec_GFp_simple_group_finish(EC_GROUP * group)
149} 149}
150 150
151 151
152void 152void
153ec_GFp_simple_group_clear_finish(EC_GROUP * group) 153ec_GFp_simple_group_clear_finish(EC_GROUP * group)
154{ 154{
155 BN_clear_free(&group->field); 155 BN_clear_free(&group->field);
@@ -158,7 +158,7 @@ ec_GFp_simple_group_clear_finish(EC_GROUP * group)
158} 158}
159 159
160 160
161int 161int
162ec_GFp_simple_group_copy(EC_GROUP * dest, const EC_GROUP * src) 162ec_GFp_simple_group_copy(EC_GROUP * dest, const EC_GROUP * src)
163{ 163{
164 if (!BN_copy(&dest->field, &src->field)) 164 if (!BN_copy(&dest->field, &src->field))
@@ -174,7 +174,7 @@ ec_GFp_simple_group_copy(EC_GROUP * dest, const EC_GROUP * src)
174} 174}
175 175
176 176
177int 177int
178ec_GFp_simple_group_set_curve(EC_GROUP * group, 178ec_GFp_simple_group_set_curve(EC_GROUP * group,
179 const BIGNUM * p, const BIGNUM * a, const BIGNUM * b, BN_CTX * ctx) 179 const BIGNUM * p, const BIGNUM * a, const BIGNUM * b, BN_CTX * ctx)
180{ 180{
@@ -231,7 +231,7 @@ ec_GFp_simple_group_set_curve(EC_GROUP * group,
231} 231}
232 232
233 233
234int 234int
235ec_GFp_simple_group_get_curve(const EC_GROUP * group, BIGNUM * p, BIGNUM * a, BIGNUM * b, BN_CTX * ctx) 235ec_GFp_simple_group_get_curve(const EC_GROUP * group, BIGNUM * p, BIGNUM * a, BIGNUM * b, BN_CTX * ctx)
236{ 236{
237 int ret = 0; 237 int ret = 0;
@@ -275,14 +275,14 @@ ec_GFp_simple_group_get_curve(const EC_GROUP * group, BIGNUM * p, BIGNUM * a, BI
275} 275}
276 276
277 277
278int 278int
279ec_GFp_simple_group_get_degree(const EC_GROUP * group) 279ec_GFp_simple_group_get_degree(const EC_GROUP * group)
280{ 280{
281 return BN_num_bits(&group->field); 281 return BN_num_bits(&group->field);
282} 282}
283 283
284 284
285int 285int
286ec_GFp_simple_group_check_discriminant(const EC_GROUP * group, BN_CTX * ctx) 286ec_GFp_simple_group_check_discriminant(const EC_GROUP * group, BN_CTX * ctx)
287{ 287{
288 int ret = 0; 288 int ret = 0;
@@ -358,7 +358,7 @@ ec_GFp_simple_group_check_discriminant(const EC_GROUP * group, BN_CTX * ctx)
358} 358}
359 359
360 360
361int 361int
362ec_GFp_simple_point_init(EC_POINT * point) 362ec_GFp_simple_point_init(EC_POINT * point)
363{ 363{
364 BN_init(&point->X); 364 BN_init(&point->X);
@@ -370,7 +370,7 @@ ec_GFp_simple_point_init(EC_POINT * point)
370} 370}
371 371
372 372
373void 373void
374ec_GFp_simple_point_finish(EC_POINT * point) 374ec_GFp_simple_point_finish(EC_POINT * point)
375{ 375{
376 BN_free(&point->X); 376 BN_free(&point->X);
@@ -379,7 +379,7 @@ ec_GFp_simple_point_finish(EC_POINT * point)
379} 379}
380 380
381 381
382void 382void
383ec_GFp_simple_point_clear_finish(EC_POINT * point) 383ec_GFp_simple_point_clear_finish(EC_POINT * point)
384{ 384{
385 BN_clear_free(&point->X); 385 BN_clear_free(&point->X);
@@ -389,7 +389,7 @@ ec_GFp_simple_point_clear_finish(EC_POINT * point)
389} 389}
390 390
391 391
392int 392int
393ec_GFp_simple_point_copy(EC_POINT * dest, const EC_POINT * src) 393ec_GFp_simple_point_copy(EC_POINT * dest, const EC_POINT * src)
394{ 394{
395 if (!BN_copy(&dest->X, &src->X)) 395 if (!BN_copy(&dest->X, &src->X))
@@ -404,7 +404,7 @@ ec_GFp_simple_point_copy(EC_POINT * dest, const EC_POINT * src)
404} 404}
405 405
406 406
407int 407int
408ec_GFp_simple_point_set_to_infinity(const EC_GROUP * group, EC_POINT * point) 408ec_GFp_simple_point_set_to_infinity(const EC_GROUP * group, EC_POINT * point)
409{ 409{
410 point->Z_is_one = 0; 410 point->Z_is_one = 0;
@@ -633,7 +633,7 @@ ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP * group, const EC_POIN
633 return ret; 633 return ret;
634} 634}
635 635
636int 636int
637ec_GFp_simple_add(const EC_GROUP * group, EC_POINT * r, const EC_POINT * a, const EC_POINT * b, BN_CTX * ctx) 637ec_GFp_simple_add(const EC_GROUP * group, EC_POINT * r, const EC_POINT * a, const EC_POINT * b, BN_CTX * ctx)
638{ 638{
639 int (*field_mul) (const EC_GROUP *, BIGNUM *, const BIGNUM *, const BIGNUM *, BN_CTX *); 639 int (*field_mul) (const EC_GROUP *, BIGNUM *, const BIGNUM *, const BIGNUM *, BN_CTX *);
@@ -822,7 +822,7 @@ ec_GFp_simple_add(const EC_GROUP * group, EC_POINT * r, const EC_POINT * a, cons
822} 822}
823 823
824 824
825int 825int
826ec_GFp_simple_dbl(const EC_GROUP * group, EC_POINT * r, const EC_POINT * a, BN_CTX * ctx) 826ec_GFp_simple_dbl(const EC_GROUP * group, EC_POINT * r, const EC_POINT * a, BN_CTX * ctx)
827{ 827{
828 int (*field_mul) (const EC_GROUP *, BIGNUM *, const BIGNUM *, const BIGNUM *, BN_CTX *); 828 int (*field_mul) (const EC_GROUP *, BIGNUM *, const BIGNUM *, const BIGNUM *, BN_CTX *);
@@ -964,7 +964,7 @@ ec_GFp_simple_dbl(const EC_GROUP * group, EC_POINT * r, const EC_POINT * a, BN_C
964} 964}
965 965
966 966
967int 967int
968ec_GFp_simple_invert(const EC_GROUP * group, EC_POINT * point, BN_CTX * ctx) 968ec_GFp_simple_invert(const EC_GROUP * group, EC_POINT * point, BN_CTX * ctx)
969{ 969{
970 if (EC_POINT_is_at_infinity(group, point) > 0 || BN_is_zero(&point->Y)) 970 if (EC_POINT_is_at_infinity(group, point) > 0 || BN_is_zero(&point->Y))
@@ -975,14 +975,14 @@ ec_GFp_simple_invert(const EC_GROUP * group, EC_POINT * point, BN_CTX * ctx)
975} 975}
976 976
977 977
978int 978int
979ec_GFp_simple_is_at_infinity(const EC_GROUP * group, const EC_POINT * point) 979ec_GFp_simple_is_at_infinity(const EC_GROUP * group, const EC_POINT * point)
980{ 980{
981 return BN_is_zero(&point->Z); 981 return BN_is_zero(&point->Z);
982} 982}
983 983
984 984
985int 985int
986ec_GFp_simple_is_on_curve(const EC_GROUP * group, const EC_POINT * point, BN_CTX * ctx) 986ec_GFp_simple_is_on_curve(const EC_GROUP * group, const EC_POINT * point, BN_CTX * ctx)
987{ 987{
988 int (*field_mul) (const EC_GROUP *, BIGNUM *, const BIGNUM *, const BIGNUM *, BN_CTX *); 988 int (*field_mul) (const EC_GROUP *, BIGNUM *, const BIGNUM *, const BIGNUM *, BN_CTX *);
@@ -1085,7 +1085,7 @@ ec_GFp_simple_is_on_curve(const EC_GROUP * group, const EC_POINT * point, BN_CTX
1085} 1085}
1086 1086
1087 1087
1088int 1088int
1089ec_GFp_simple_cmp(const EC_GROUP * group, const EC_POINT * a, const EC_POINT * b, BN_CTX * ctx) 1089ec_GFp_simple_cmp(const EC_GROUP * group, const EC_POINT * a, const EC_POINT * b, BN_CTX * ctx)
1090{ 1090{
1091 /* 1091 /*
@@ -1187,7 +1187,7 @@ ec_GFp_simple_cmp(const EC_GROUP * group, const EC_POINT * a, const EC_POINT * b
1187} 1187}
1188 1188
1189 1189
1190int 1190int
1191ec_GFp_simple_make_affine(const EC_GROUP * group, EC_POINT * point, BN_CTX * ctx) 1191ec_GFp_simple_make_affine(const EC_GROUP * group, EC_POINT * point, BN_CTX * ctx)
1192{ 1192{
1193 BN_CTX *new_ctx = NULL; 1193 BN_CTX *new_ctx = NULL;
@@ -1225,7 +1225,7 @@ ec_GFp_simple_make_affine(const EC_GROUP * group, EC_POINT * point, BN_CTX * ctx
1225} 1225}
1226 1226
1227 1227
1228int 1228int
1229ec_GFp_simple_points_make_affine(const EC_GROUP * group, size_t num, EC_POINT * points[], BN_CTX * ctx) 1229ec_GFp_simple_points_make_affine(const EC_GROUP * group, size_t num, EC_POINT * points[], BN_CTX * ctx)
1230{ 1230{
1231 BN_CTX *new_ctx = NULL; 1231 BN_CTX *new_ctx = NULL;
@@ -1271,11 +1271,11 @@ ec_GFp_simple_points_make_affine(const EC_GROUP * group, size_t num, EC_POINT *
1271 1271
1272 /* 1272 /*
1273 * The array is used as a binary tree, exactly as in heapsort: 1273 * The array is used as a binary tree, exactly as in heapsort:
1274 * 1274 *
1275 * heap[1] heap[2] heap[3] heap[4] heap[5] 1275 * heap[1] heap[2] heap[3] heap[4] heap[5]
1276 * heap[6] heap[7] heap[8]heap[9] heap[10]heap[11] 1276 * heap[6] heap[7] heap[8]heap[9] heap[10]heap[11]
1277 * heap[12]heap[13] heap[14] heap[15] 1277 * heap[12]heap[13] heap[14] heap[15]
1278 * 1278 *
1279 * We put the Z's in the last line; then we set each other node to the 1279 * We put the Z's in the last line; then we set each other node to the
1280 * product of its two child-nodes (where empty or 0 entries are 1280 * product of its two child-nodes (where empty or 0 entries are
1281 * treated as ones); then we invert heap[1]; then we invert each 1281 * treated as ones); then we invert heap[1]; then we invert each
@@ -1400,13 +1400,13 @@ ec_GFp_simple_points_make_affine(const EC_GROUP * group, size_t num, EC_POINT *
1400} 1400}
1401 1401
1402 1402
1403int 1403int
1404ec_GFp_simple_field_mul(const EC_GROUP * group, BIGNUM * r, const BIGNUM * a, const BIGNUM * b, BN_CTX * ctx) 1404ec_GFp_simple_field_mul(const EC_GROUP * group, BIGNUM * r, const BIGNUM * a, const BIGNUM * b, BN_CTX * ctx)
1405{ 1405{
1406 return BN_mod_mul(r, a, b, &group->field, ctx); 1406 return BN_mod_mul(r, a, b, &group->field, ctx);
1407} 1407}
1408 1408
1409int 1409int
1410ec_GFp_simple_field_sqr(const EC_GROUP * group, BIGNUM * r, const BIGNUM * a, BN_CTX * ctx) 1410ec_GFp_simple_field_sqr(const EC_GROUP * group, BIGNUM * r, const BIGNUM * a, BN_CTX * ctx)
1411{ 1411{
1412 return BN_mod_sqr(r, a, &group->field, ctx); 1412 return BN_mod_sqr(r, a, &group->field, ctx);
@@ -1416,7 +1416,7 @@ ec_GFp_simple_field_sqr(const EC_GROUP * group, BIGNUM * r, const BIGNUM * a, BN
1416 * Apply randomization of EC point projective coordinates: 1416 * Apply randomization of EC point projective coordinates:
1417 * 1417 *
1418 * (X, Y, Z) = (lambda^2 * X, lambda^3 * Y, lambda * Z) 1418 * (X, Y, Z) = (lambda^2 * X, lambda^3 * Y, lambda * Z)
1419 * 1419 *
1420 * where lambda is in the interval [1, group->field). 1420 * where lambda is in the interval [1, group->field).
1421 */ 1421 */
1422int 1422int
@@ -1686,7 +1686,7 @@ ec_GFp_simple_mul_ct(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
1686 } 1686 }
1687 /* one final cswap to move the right value into r */ 1687 /* one final cswap to move the right value into r */
1688 EC_POINT_CSWAP(pbit, r, s, group_top, Z_is_one); 1688 EC_POINT_CSWAP(pbit, r, s, group_top, Z_is_one);
1689 1689
1690 ret = 1; 1690 ret = 1;
1691 1691
1692 err: 1692 err:
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-22 23:33:59 +0000