3 files changed, 83 insertions, 108 deletions

diff --git a/src/lib/libcrypto/ec/ec_lib.c b/src/lib/libcrypto/ec/ec_lib.c
index ed51582146..a8b74ce89d 100644
--- a/src/lib/libcrypto/ec/ec_lib.c
+++ b/src/lib/libcrypto/ec/ec_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_lib.c,v 1.109 2025/01/11 14:38:57 tb Exp $ */
+/* $OpenBSD: ec_lib.c,v 1.110 2025/01/11 15:02:42 tb Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -1026,8 +1026,9 @@ LCRYPTO_ALIAS(EC_POINT_get_affine_coordinates_GFp);
 
 int
 EC_POINT_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
-    const BIGNUM *x, int y_bit, BN_CTX *ctx_in)
+    const BIGNUM *in_x, int y_bit, BN_CTX *ctx_in)
 {
+        BIGNUM *p, *a, *b, *w, *x, *y;
         BN_CTX *ctx;
         int ret = 0;
 
@@ -1036,18 +1037,90 @@ EC_POINT_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
         if (ctx == NULL)
                 goto err;
 
-        if (group->meth->point_set_compressed_coordinates == NULL) {
-                ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+        y_bit = (y_bit != 0);
+
+        BN_CTX_start(ctx);
+
+        if ((p = BN_CTX_get(ctx)) == NULL)
+                goto err;
+        if ((a = BN_CTX_get(ctx)) == NULL)
+                goto err;
+        if ((b = BN_CTX_get(ctx)) == NULL)
+                goto err;
+        if ((w = BN_CTX_get(ctx)) == NULL)
+                goto err;
+        if ((x = BN_CTX_get(ctx)) == NULL)
+                goto err;
+        if ((y = BN_CTX_get(ctx)) == NULL)
+                goto err;
+
+        /*
+         * Weierstrass equation: y^2 = x^3 + ax + b, so y is one of the
+         * square roots of x^3 + ax + b. The y-bit indicates which one.
+         */
+
+        if (!EC_GROUP_get_curve(group, p, a, b, ctx))
+                goto err;
+
+        /* XXX - should we not insist on 0 <= x < p instead? */
+        if (!BN_nnmod(x, in_x, p, ctx))
+                goto err;
+
+        /* y = x^3 */
+        if (!BN_mod_sqr(y, x, p, ctx))
+                goto err;
+        if (!BN_mod_mul(y, y, x, p, ctx))
+                goto err;
+
+        /* y += ax */
+        if (group->a_is_minus3) {
+                if (!BN_mod_lshift1_quick(w, x, p))
+                        goto err;
+                if (!BN_mod_add_quick(w, w, x, p))
+                        goto err;
+                if (!BN_mod_sub_quick(y, y, w, p))
+                        goto err;
+        } else {
+                if (!BN_mod_mul(w, a, x, p, ctx))
+                        goto err;
+                if (!BN_mod_add_quick(y, y, w, p))
+                        goto err;
+        }
+
+        /* y += b */
+        if (!BN_mod_add_quick(y, y, b, p))
+                goto err;
+
+        if (!BN_mod_sqrt(y, y, p, ctx)) {
+                ECerror(EC_R_INVALID_COMPRESSED_POINT);
                 goto err;
         }
-        if (group->meth != point->meth) {
-                ECerror(EC_R_INCOMPATIBLE_OBJECTS);
+
+        if (y_bit == BN_is_odd(y))
+                goto done;
+
+        if (BN_is_zero(y)) {
+                ECerror(EC_R_INVALID_COMPRESSION_BIT);
                 goto err;
         }
-        ret = group->meth->point_set_compressed_coordinates(group, point,
-            x, y_bit, ctx);
+        if (!BN_usub(y, p, y))
+                goto err;
+
+        if (y_bit != BN_is_odd(y)) {
+                /* Can only happen if p is even and should not be reachable. */
+                ECerror(ERR_R_INTERNAL_ERROR);
+                goto err;
+        }
+
+ done:
+        if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
+                goto err;
+
+        ret = 1;
 
  err:
+        BN_CTX_end(ctx);
+
         if (ctx != ctx_in)
                 BN_CTX_free(ctx);
 
diff --git a/src/lib/libcrypto/ec/ec_local.h b/src/lib/libcrypto/ec/ec_local.h
index 0e81ab2b12..674023050c 100644
--- a/src/lib/libcrypto/ec/ec_local.h
+++ b/src/lib/libcrypto/ec/ec_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_local.h,v 1.56 2025/01/11 13:58:31 tb Exp $ */
+/* $OpenBSD: ec_local.h,v 1.57 2025/01/11 15:02:42 tb Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -91,8 +91,6 @@ struct ec_method_st {
             const BIGNUM *x, const BIGNUM *y, BN_CTX *);
         int (*point_get_affine_coordinates)(const EC_GROUP *, const EC_POINT *,
             BIGNUM *x, BIGNUM *y, BN_CTX *);
-        int (*point_set_compressed_coordinates)(const EC_GROUP *, EC_POINT *,
-            const BIGNUM *x, int y_bit, BN_CTX *);
 
         /* Only used by the wNAF code. */
         int (*points_make_affine)(const EC_GROUP *, size_t num, EC_POINT **,
diff --git a/src/lib/libcrypto/ec/ecp_methods.c b/src/lib/libcrypto/ec/ecp_methods.c
index 57efce0366..66bde292a8 100644
--- a/src/lib/libcrypto/ec/ecp_methods.c
+++ b/src/lib/libcrypto/ec/ecp_methods.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ecp_methods.c,v 1.30 2025/01/11 14:53:46 tb Exp $ */
+/* $OpenBSD: ecp_methods.c,v 1.31 2025/01/11 15:02:42 tb Exp $ */
 /* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
  * for the OpenSSL project.
  * Includes code written by Bodo Moeller for the OpenSSL project.
@@ -276,100 +276,6 @@ ec_point_get_affine_coordinates(const EC_GROUP *group, const EC_POINT *point,
 }
 
 static int
-ec_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
-    const BIGNUM *in_x, int y_bit, BN_CTX *ctx)
-{
-        BIGNUM *p, *a, *b, *w, *x, *y;
-        int ret = 0;
-
-        y_bit = (y_bit != 0);
-
-        BN_CTX_start(ctx);
-
-        if ((p = BN_CTX_get(ctx)) == NULL)
-                goto err;
-        if ((a = BN_CTX_get(ctx)) == NULL)
-                goto err;
-        if ((b = BN_CTX_get(ctx)) == NULL)
-                goto err;
-        if ((w = BN_CTX_get(ctx)) == NULL)
-                goto err;
-        if ((x = BN_CTX_get(ctx)) == NULL)
-                goto err;
-        if ((y = BN_CTX_get(ctx)) == NULL)
-                goto err;
-
-        /*
-         * Weierstrass equation: y^2 = x^3 + ax + b, so y is one of the
-         * square roots of x^3 + ax + b. The y-bit indicates which one.
-         */
-
-        if (!EC_GROUP_get_curve(group, p, a, b, ctx))
-                goto err;
-
-        /* XXX - should we not insist on 0 <= x < p instead? */
-        if (!BN_nnmod(x, in_x, p, ctx))
-                goto err;
-
-        /* y = x^3 */
-        if (!BN_mod_sqr(y, x, p, ctx))
-                goto err;
-        if (!BN_mod_mul(y, y, x, p, ctx))
-                goto err;
-
-        /* y += ax */
-        if (group->a_is_minus3) {
-                if (!BN_mod_lshift1_quick(w, x, p))
-                        goto err;
-                if (!BN_mod_add_quick(w, w, x, p))
-                        goto err;
-                if (!BN_mod_sub_quick(y, y, w, p))
-                        goto err;
-        } else {
-                if (!BN_mod_mul(w, a, x, p, ctx))
-                        goto err;
-                if (!BN_mod_add_quick(y, y, w, p))
-                        goto err;
-        }
-
-        /* y += b */
-        if (!BN_mod_add_quick(y, y, b, p))
-                goto err;
-
-        if (!BN_mod_sqrt(y, y, p, ctx)) {
-                ECerror(EC_R_INVALID_COMPRESSED_POINT);
-                goto err;
-        }
-
-        if (y_bit == BN_is_odd(y))
-                goto done;
-
-        if (BN_is_zero(y)) {
-                ECerror(EC_R_INVALID_COMPRESSION_BIT);
-                goto err;
-        }
-        if (!BN_usub(y, p, y))
-                goto err;
-
-        if (y_bit != BN_is_odd(y)) {
-                /* Can only happen if p is even and should not be reachable. */
-                ECerror(ERR_R_INTERNAL_ERROR);
-                goto err;
-        }
-
- done:
-        if (!EC_POINT_set_affine_coordinates(group, point, x, y, ctx))
-                goto err;
-
-        ret = 1;
-
- err:
-        BN_CTX_end(ctx);
-
-        return ret;
-}
-
-static int
 ec_points_make_affine(const EC_GROUP *group, size_t num, EC_POINT **points,
     BN_CTX *ctx)
 {
@@ -1420,7 +1326,6 @@ static const EC_METHOD ec_GFp_simple_method = {
         .group_get_curve = ec_group_get_curve,
         .point_set_affine_coordinates = ec_point_set_affine_coordinates,
         .point_get_affine_coordinates = ec_point_get_affine_coordinates,
-        .point_set_compressed_coordinates = ec_set_compressed_coordinates,
         .points_make_affine = ec_points_make_affine,
         .add = ec_add,
         .dbl = ec_dbl,
@@ -1447,7 +1352,6 @@ static const EC_METHOD ec_GFp_mont_method = {
         .group_get_curve = ec_group_get_curve,
         .point_set_affine_coordinates = ec_point_set_affine_coordinates,
         .point_get_affine_coordinates = ec_point_get_affine_coordinates,
-        .point_set_compressed_coordinates = ec_set_compressed_coordinates,
         .points_make_affine = ec_points_make_affine,
         .add = ec_add,
         .dbl = ec_dbl,