summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/ec/ec_lib.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Rename the is_on_curve() method to point_is_on_curve()tb2025-01-111-3/+3
| | | | | Rename ec_is_on_curve() to ec_point_is_on_curve() and ec_cmp() to ec_point_cmp().
* Move compressed coordinate setting into public APItb2025-01-111-8/+81
| | | | | | | | Now that it is method-agnostic, we can remove the method and move the implementation to the body of the public API function. And another method goes away. We're soon down to the ones we really need. discussed with jsing
* Move the EC_POINTs API into the garbage bintb2025-01-111-20/+20
|
* Neuter the EC_POINTs_* APItb2025-01-111-61/+5
| | | | | | | | | | | | | | EC_POINTs_mul() was only ever used by Ruby and they stopped doing so for LibreSSL when we incorporated the constant time multiplication work of Brumley et al and restricted the length of the points array to 1, making this API effectively useless. The only real reason you want to have an API to calculate \sum n_i P_i is for ECDSA where you want m * G + n * P. Whether something like his needs to be in the public API is doubtful. EC_POINTs_make_affine() is an implementation detail of EC_POINTs_mul(). As such it never really belonged into the public API. ok jsing
* Remove a pointless check about Z == 1tb2025-01-111-7/+1
| | | | ok jsing
* Inline ec_point_make_affine() in the public APItb2025-01-111-7/+20
| | | | | | | | | | Whatever the EC_METHOD, this will always be equivalent to getting and setting the affine coordinates, so this needs no dedicated method. Also, this is a function that makes no real sense since a caller should never need to care about this... As always, our favorite language bindings thought they might have users who care. This time it's Ruby and Perl. ok jsing
* ec_lib.c: zap stray empty line at end of filetb2025-01-091-2/+1
|
* check_discriminant: make the assumptions on p, a, b more explicittb2025-01-091-2/+3
| | | | requested by jsing
* Check discriminant directly in EC_GROUP_set_discriminant()tb2025-01-071-5/+45
| | | | | | | | | | After possibly decoding a and b in EC_GROUP_get_curve(), this is a pure calculation in GFp and as such doesn't make use of any method-specifics. Let's perform this calculation directly in the public API implementation rather than redirecting through the methods and remove yet another method handler. ok jsing
* ec_lib: create a garbage bin at the end, throw Jprojective stuff in theretb2025-01-061-19/+24
|
* Remove get_order_bits() and get_degree() methodstb2025-01-061-13/+3
| | | | | | | The degree made some sense when EC2M was a thing in libcrypto. Fortunately that's not the case anymore. The order handler never made sense. ok jsing
* More dest -> dst renaming missed in previoustb2025-01-061-8/+8
| | | | requested by jsing
* Rename dest into dsttb2025-01-061-21/+21
| | | | requested by jsing
* Inline the copy handlers in EC_GROUP_copy()tb2025-01-061-7/+18
| | | | | | This is another bit of indirection that makes this code so hard to follow. ok jsing
* Remove indirection for coordinate blinding.jsing2025-01-061-19/+1
| | | | | | | This is usually method specific, so remove the indirection and call the appropriate blinding function directly. ok tb@
* Stop caching one in the Montgomery domaintb2025-01-061-4/+2
| | | | | | | | | | | | This is only used by ec_points_make_affine(), which is only used by the wNAF multiplication, which is only used by ECDSA. We can afford computing that one once per ECDSA verification given the cost of the rest of this. Thus, the field_set_to_one() member disappears from the EC_METHOD and the mont_one member disappears from EC_GROUP and with it all the complications when setting/copying/freeing the group. ok jsing
* Prepare removal accessors for Jprojective coordinatestb2025-01-061-71/+5
| | | | | | | | | | | | | | | | | That the BN-driven EC code uses Jacobian projective coordinates as an optimization is an implementation detail. As such this should never have leaked out of the library as part of the public API. No consumer should ever care and if they do they're doing it wrong. The only port that cares is one of those stupid little perl modules that expose all the things and transform terrible OpenSSL regress tests into similarly horrible Perl. In practice, only affine coordinates matter (perhaps in compressed form). This prunes two more function pointers from EC_GROUP and prepares the removal of the field_set_to_one() method which is now only used in ec_points_make_affine(). ok jsing sthen
* Move BIGNUMs in EC_GROUP and EC_POINT to the heaptb2025-01-051-39/+58
| | | | | | | | | | | | | | | | | | | | | The only way to get an EC_GROUP or an EC_POINT is by calling the relevant _new() function and to get rid of it, something must call _free(). Thus we can establish the invariant that every group has Weierstrass coefficients p, a, b as well as order and cofactor hanging off it. Similarly, Every point has allocated BIGNUMs for its Jacobian projective coordinates. Unfortunately, a group has the generator as an optional component in addition to seed and montgomery context/one (where optionality makes more sense). This is a mostly mechanical diff and only drops a few silly comments and a couple of unnecessary NULL checks since in our part of the wrold the word invariant has a meaning. This should also appease Coverity who likes to throw fits at calling BN_free() for BIGNUM on the stack (yes, this is actually a thing). ok jsing
* Garbage collect .group_finish()tb2025-01-011-3/+7
| | | | | | | There is only one caller, EC_GROUP_free(), so inline the relevant free calls there and dispose of a few layers of indirection. ok jsing
* Garbage collect .group_init()tb2025-01-011-11/+1
| | | | | | | | For both in-tree methods these are just complicated ways of zeroing part of the group object. The group is allocated with calloc(), so it's all entirely pointless. ok jsing
* Rewrite a comment to use p rather than qtb2024-12-121-10/+10
|
* Rename group->field to group->ptb2024-12-121-8/+7
| | | | | | Now that we only do curves over GF(p) fields, there's no need to use a weird, confusing name for what we usually call p. Adjust some comments in the vicinity as well.
* Inline trivial EC point methodstb2024-11-301-25/+21
| | | | | | | | | Like most of the "group" methods these are shared between Montgomery curves and simple curves. There's no point in five methods hanging off the EC_METHODS struct whne they can just as well be inlined in the public API. It makes all files involved shorter... ok jsing
* Rename curve_name into nidtb2024-11-221-4/+4
| | | | | | This used to be the case until they were given a 'more meaningful name' about 20 years ago. We cant fix the public API, but I'm tired of being confused by this nonsense.
* ec_lib: zap a useless commenttb2024-11-171-3/+1
|
* Rewrite EC_GROUP_cmp()tb2024-11-171-51/+75
| | | | | | | | | | Use better variable names (cf. https://jmilne.org/math/tips.html#4) and avoid the weird style of assigning to r (what does r stand for anyway?) and short circuiting subsequent tests using if (r || ...). Also, do not reuse the variables for order and cofactor that were previously used for the curve coefficients. ok jsing
* Relocate ECParameters_dup() to ec_asn1tb2024-11-081-23/+1
| | | | | | | | | jsing rightly points out that this has nothing to do with ASN.1, but ec_lib.c has no EC_KEY knowledge otherwise (it's about groups and points) and moving it to ec_key.c is also not satisfactory since the weird d2i/i2d for ECParameters don't belong there either. no objection from jsing
* Ugh. Don't return the group after freeing ittb2024-11-081-2/+2
| | | | CID 514612
* EC_GROUP_set_seed(): flip order of seed and len null checkstb2024-11-061-2/+2
| | | | requested by jsing
* Treat the curls in EC_GROUP_dup() with a flatirontb2024-11-061-9/+17
| | | | | | | This was about as unreadable as four lines of code doing a trivial thing can get... ok jsing
* Clean up EC_GROUP_copy()tb2024-11-061-27/+15
| | | | | | | | | | | | | | | | | | | Switch from artistic free reinterpretations of public API in the same file to calling the real thing if possible. This means that we need to copy the group's coefficients first instead of last, so that we can call EC_GROUP_set_generator() to set - yes - all three of generator, order, and cofactor of the group. However, we may not have a generator yet since for some reason it is an optional field and some code relies on that. In that case simply copy over order and cofactor and punt on sanity checking for now (since this API never did that anyway). Finally set the seed using EC_GROUP_set_seed() instead of using a custom reimplementation. ok jsing
* Switch EC_GROUP_new() to calloc()tb2024-11-061-21/+20
| | | | | | | | Use a single cleanup path, use calloc rather than setting several members to 0/NULL. This has the side effect that finished can be called even when init() wasn't called, but this isn't an issue with our EC_GROUP_METHODs. ok jsing
* EC_POINT_is_at_infinity() returns a booleantb2024-11-051-2/+2
| | | | | | | | | This may have been different at some point in the past, but it may also have been a confusion with EC_POINT_is_on_curve() which, like any great API with a name implying a boolean return, actually has three possible return values. ok jsing
* Rewrite EC_POINT_new() and EC_POINT_dup()tb2024-11-041-27/+34
| | | | | | | | Like most of the code in this file that hasn't been overhauled, these are just terrible. As jsing points out, we will need to ensure that finish() works on a not fully initialized point. That's currently safe. ok jsing
* Move point at infinity check to API boundarytb2024-11-031-2/+7
| | | | | | | | Since we only consider standard affine coordinates, the point at infinity must be excluded. Check at the API boundary that the point isn't the point at infinity rather than hiding this check somewhere in a method. ok jsing
* Fix includes in ec_lib and ecp_smpltb2024-11-021-1/+5
|
* Merge compressed coordinate setting back into ecp_smpl and ec_libtb2024-11-021-1/+40
| | | | The reason these were in separate files was FIPS. Not our problem.
* Minor cosmetic tweaks for EC_GROUP_set_seed()tb2024-10-251-9/+8
| | | | | No need to guard free() with a NULL check, check explicitly against 0 and rename p to seed.
* Provide and use ec_group_get_field_type()tb2024-10-221-3/+11
| | | | | | | | | All internal uses of EC_METHOD_get_field_type() and EC_GROUP_method_of() are chained together. Implement this as a single API call that takes a group and use it throughout. Gets rid of another eyesore in this part of the tree. Not that there will be a shortage of eyesores anytime soon... ok jsing
* EC_GROUP_check(): zap useless commentstb2024-10-191-4/+3
|
* Move EC_GROUP_check() to ec_lib.ctb2024-10-191-1/+56
| | | | EC_GROUP_check() is quite simple. It doesn't need to use its own file.
* Move EC_GROUP_new_curve_GFp() into ec_lib.ctb2024-10-181-1/+22
| | | | Another single-function file goes away.
* Unindent error check in EC_GROUP_set_generator()tb2024-10-151-5/+5
|
* Provide EC_GROUP_get0_cofactor() for internal usetb2024-10-151-1/+7
| | | | | | While this is public API in OpenSSL, there are no plans to expose it. ok jsing
* One empty line is enoughtb2024-04-231-18/+1
|
* Hide deprecated functions in ec.hbeck2024-04-101-1/+9
| | | | | | use LCRYPTO_UNUSED and remove the LIBRESSL_INTERNAL guard ok tb@
* EC_POINT_is_on_curve() error is -1, not 0.tb2023-07-251-2/+2
| | | | ok miod
* Unbreak the namespace build after a broken mk.conf and tool misfire hadbeck2023-07-071-9/+1
| | | | | | | | me aliasing symbols not in the headers I was procesing. This unbreaks the namespace build so it will pass again ok tb@
* Hide symbols in hkdf, evp, err, ecdsa, and ecbeck2023-07-071-1/+55
| | | | | | (part 2 of commit) ok jsing@
* Provide internal-only EC_GROUP_get0_order()tb2023-07-031-2/+7
| | | | ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-29 12:28:12 +0000