summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/ec/ec_lib.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Explicitly pass group generator to mul_double_nonct() from EC_POINT_mul().jsing7 days1-5/+5
| | | | | | | | | | | | | | | | | | EC_POINT_mul() has a complex multi-use interface - there are effectively three different ways it will behave, depending on which arguments are NULL. In the case where we compute g_scalar * generator + p_scalar * point, the mul_double_nonct() function pointer is called, however only g_scalar, p_scalar and point are passed - it is expected that the lower level implementation (in this case ec_wnaf_mul()) will use the generator from the group. Change mul_double_nonct(), ec_mul_double_nonct() and ec_wnaf_mul() so that they take scalar1, point1, scalar2 and point2. This removes all knowledge of g_scalar and the generator from the multiplication code, keeping it limited to EC_POINT_mul(). While here also consistently pass scalar then point, rather than a mix of scalar/point and point/scalar. ok tb@
* Check group generator in EC_POINT_mul().jsing7 days1-1/+6
| | | | | | | | | When a non-NULL generator scalar is passed to EC_POINT_mul(), the group's generator will be used in multiplication. Add a check that ensures that the group generator is non-NULL, in order to avoid needing to handle this elsewhere (currently in the lower level point multiplication code). ok tb@
* Remove EC_POINTs_* APItb2025-03-091-24/+1
| | | | | | | | | | And another one... Completely overengineered for the sake of academic credentials and only Ruby ever picked this garbage up. Fortunately, it's no longer used with LibreSSL since we defanged this in 2018. The latest version of ruby/openssl has completely removed this as part of their post 1.0.x cleanup. ok jsing
* Remove Jprojective_coordinates APItb2025-03-091-19/+1
| | | | | | | There goes another implementation detail that should never have been leaked out of the library. ok jsing
* Unexport EC_GROUP_*precompute_mult()tb2025-03-091-17/+1
| | | | | | | These have been noops for a while and as usual some Perl module was the only thing "using" it. ok jsing
* Unexport EC_GROUP_copy()tb2025-03-091-3/+2
| | | | | | Without EC_GROUP_new(), this API is useless. There's EC_GROUP_dup(). ok jsing
* Unexport EC_METHOD and all API using ittb2025-03-091-26/+1
| | | | | | | | | | | | This is an implementation detail and there is no reason to leak it from the library. This removes EC_GFp_{mont,simple}_method(), EC_GROUP_{method_of,new}(), EC_METHOD_get_field_type(), EC_POINT_method_of() from the public API. EC_GROUP_copy() is now quite useless, so it will go as well. ok jsing
* Promote a few functions from EC API to garbage bintb2025-01-251-36/+41
| | | | | | | | | | | EC_GROUP_method_of() and EC_METHOD_get_field_type() only ever used chained together as a convoluted means to retrieve the field type of a group. This is no longer useful since the answer will always be NID_X9_62_prime_field. EC_POINT_method_of(), EC_GROUP{,_have}_precompute_mult(): exposed by one of those expose-everything perl XS modules. ok jsing
* Remove now unused internal ec_group_get_field_type()tb2025-01-251-10/+1
| | | | ok jsing
* Remove calls to ec_group_get_field_type() from EC_GROUP_cmp()tb2025-01-251-3/+1
| | | | ok jsing
* Remove the mul_generator_ct function pointer from EC_METHOD.jsing2025-01-221-4/+4
| | | | | | | | | There's no need for a separate mul_generator_ct() function pointer - we really only need mul_single_ct() and mul_double_nonct(). And rather than calling ec_mul_ct() and having it figure out which point to use, explicitly pass the generator point when calling mul_single_ct(). ok tb@
* EC_GROUP_check(): use accessor rather than reaching into the grouptb2025-01-211-3/+4
| | | | The API will be removed soon. This prepares moving it to its only consumer.
* Rename the is_on_curve() method to point_is_on_curve()tb2025-01-111-3/+3
| | | | | Rename ec_is_on_curve() to ec_point_is_on_curve() and ec_cmp() to ec_point_cmp().
* Move compressed coordinate setting into public APItb2025-01-111-8/+81
| | | | | | | | Now that it is method-agnostic, we can remove the method and move the implementation to the body of the public API function. And another method goes away. We're soon down to the ones we really need. discussed with jsing
* Move the EC_POINTs API into the garbage bintb2025-01-111-20/+20
|
* Neuter the EC_POINTs_* APItb2025-01-111-61/+5
| | | | | | | | | | | | | | EC_POINTs_mul() was only ever used by Ruby and they stopped doing so for LibreSSL when we incorporated the constant time multiplication work of Brumley et al and restricted the length of the points array to 1, making this API effectively useless. The only real reason you want to have an API to calculate \sum n_i P_i is for ECDSA where you want m * G + n * P. Whether something like his needs to be in the public API is doubtful. EC_POINTs_make_affine() is an implementation detail of EC_POINTs_mul(). As such it never really belonged into the public API. ok jsing
* Remove a pointless check about Z == 1tb2025-01-111-7/+1
| | | | ok jsing
* Inline ec_point_make_affine() in the public APItb2025-01-111-7/+20
| | | | | | | | | | Whatever the EC_METHOD, this will always be equivalent to getting and setting the affine coordinates, so this needs no dedicated method. Also, this is a function that makes no real sense since a caller should never need to care about this... As always, our favorite language bindings thought they might have users who care. This time it's Ruby and Perl. ok jsing
* ec_lib.c: zap stray empty line at end of filetb2025-01-091-2/+1
|
* check_discriminant: make the assumptions on p, a, b more explicittb2025-01-091-2/+3
| | | | requested by jsing
* Check discriminant directly in EC_GROUP_set_discriminant()tb2025-01-071-5/+45
| | | | | | | | | | After possibly decoding a and b in EC_GROUP_get_curve(), this is a pure calculation in GFp and as such doesn't make use of any method-specifics. Let's perform this calculation directly in the public API implementation rather than redirecting through the methods and remove yet another method handler. ok jsing
* ec_lib: create a garbage bin at the end, throw Jprojective stuff in theretb2025-01-061-19/+24
|
* Remove get_order_bits() and get_degree() methodstb2025-01-061-13/+3
| | | | | | | The degree made some sense when EC2M was a thing in libcrypto. Fortunately that's not the case anymore. The order handler never made sense. ok jsing
* More dest -> dst renaming missed in previoustb2025-01-061-8/+8
| | | | requested by jsing
* Rename dest into dsttb2025-01-061-21/+21
| | | | requested by jsing
* Inline the copy handlers in EC_GROUP_copy()tb2025-01-061-7/+18
| | | | | | This is another bit of indirection that makes this code so hard to follow. ok jsing
* Remove indirection for coordinate blinding.jsing2025-01-061-19/+1
| | | | | | | This is usually method specific, so remove the indirection and call the appropriate blinding function directly. ok tb@
* Stop caching one in the Montgomery domaintb2025-01-061-4/+2
| | | | | | | | | | | | This is only used by ec_points_make_affine(), which is only used by the wNAF multiplication, which is only used by ECDSA. We can afford computing that one once per ECDSA verification given the cost of the rest of this. Thus, the field_set_to_one() member disappears from the EC_METHOD and the mont_one member disappears from EC_GROUP and with it all the complications when setting/copying/freeing the group. ok jsing
* Prepare removal accessors for Jprojective coordinatestb2025-01-061-71/+5
| | | | | | | | | | | | | | | | | That the BN-driven EC code uses Jacobian projective coordinates as an optimization is an implementation detail. As such this should never have leaked out of the library as part of the public API. No consumer should ever care and if they do they're doing it wrong. The only port that cares is one of those stupid little perl modules that expose all the things and transform terrible OpenSSL regress tests into similarly horrible Perl. In practice, only affine coordinates matter (perhaps in compressed form). This prunes two more function pointers from EC_GROUP and prepares the removal of the field_set_to_one() method which is now only used in ec_points_make_affine(). ok jsing sthen
* Move BIGNUMs in EC_GROUP and EC_POINT to the heaptb2025-01-051-39/+58
| | | | | | | | | | | | | | | | | | | | | The only way to get an EC_GROUP or an EC_POINT is by calling the relevant _new() function and to get rid of it, something must call _free(). Thus we can establish the invariant that every group has Weierstrass coefficients p, a, b as well as order and cofactor hanging off it. Similarly, Every point has allocated BIGNUMs for its Jacobian projective coordinates. Unfortunately, a group has the generator as an optional component in addition to seed and montgomery context/one (where optionality makes more sense). This is a mostly mechanical diff and only drops a few silly comments and a couple of unnecessary NULL checks since in our part of the wrold the word invariant has a meaning. This should also appease Coverity who likes to throw fits at calling BN_free() for BIGNUM on the stack (yes, this is actually a thing). ok jsing
* Garbage collect .group_finish()tb2025-01-011-3/+7
| | | | | | | There is only one caller, EC_GROUP_free(), so inline the relevant free calls there and dispose of a few layers of indirection. ok jsing
* Garbage collect .group_init()tb2025-01-011-11/+1
| | | | | | | | For both in-tree methods these are just complicated ways of zeroing part of the group object. The group is allocated with calloc(), so it's all entirely pointless. ok jsing
* Rewrite a comment to use p rather than qtb2024-12-121-10/+10
|
* Rename group->field to group->ptb2024-12-121-8/+7
| | | | | | Now that we only do curves over GF(p) fields, there's no need to use a weird, confusing name for what we usually call p. Adjust some comments in the vicinity as well.
* Inline trivial EC point methodstb2024-11-301-25/+21
| | | | | | | | | Like most of the "group" methods these are shared between Montgomery curves and simple curves. There's no point in five methods hanging off the EC_METHODS struct whne they can just as well be inlined in the public API. It makes all files involved shorter... ok jsing
* Rename curve_name into nidtb2024-11-221-4/+4
| | | | | | This used to be the case until they were given a 'more meaningful name' about 20 years ago. We cant fix the public API, but I'm tired of being confused by this nonsense.
* ec_lib: zap a useless commenttb2024-11-171-3/+1
|
* Rewrite EC_GROUP_cmp()tb2024-11-171-51/+75
| | | | | | | | | | Use better variable names (cf. https://jmilne.org/math/tips.html#4) and avoid the weird style of assigning to r (what does r stand for anyway?) and short circuiting subsequent tests using if (r || ...). Also, do not reuse the variables for order and cofactor that were previously used for the curve coefficients. ok jsing
* Relocate ECParameters_dup() to ec_asn1tb2024-11-081-23/+1
| | | | | | | | | jsing rightly points out that this has nothing to do with ASN.1, but ec_lib.c has no EC_KEY knowledge otherwise (it's about groups and points) and moving it to ec_key.c is also not satisfactory since the weird d2i/i2d for ECParameters don't belong there either. no objection from jsing
* Ugh. Don't return the group after freeing ittb2024-11-081-2/+2
| | | | CID 514612
* EC_GROUP_set_seed(): flip order of seed and len null checkstb2024-11-061-2/+2
| | | | requested by jsing
* Treat the curls in EC_GROUP_dup() with a flatirontb2024-11-061-9/+17
| | | | | | | This was about as unreadable as four lines of code doing a trivial thing can get... ok jsing
* Clean up EC_GROUP_copy()tb2024-11-061-27/+15
| | | | | | | | | | | | | | | | | | | Switch from artistic free reinterpretations of public API in the same file to calling the real thing if possible. This means that we need to copy the group's coefficients first instead of last, so that we can call EC_GROUP_set_generator() to set - yes - all three of generator, order, and cofactor of the group. However, we may not have a generator yet since for some reason it is an optional field and some code relies on that. In that case simply copy over order and cofactor and punt on sanity checking for now (since this API never did that anyway). Finally set the seed using EC_GROUP_set_seed() instead of using a custom reimplementation. ok jsing
* Switch EC_GROUP_new() to calloc()tb2024-11-061-21/+20
| | | | | | | | Use a single cleanup path, use calloc rather than setting several members to 0/NULL. This has the side effect that finished can be called even when init() wasn't called, but this isn't an issue with our EC_GROUP_METHODs. ok jsing
* EC_POINT_is_at_infinity() returns a booleantb2024-11-051-2/+2
| | | | | | | | | This may have been different at some point in the past, but it may also have been a confusion with EC_POINT_is_on_curve() which, like any great API with a name implying a boolean return, actually has three possible return values. ok jsing
* Rewrite EC_POINT_new() and EC_POINT_dup()tb2024-11-041-27/+34
| | | | | | | | Like most of the code in this file that hasn't been overhauled, these are just terrible. As jsing points out, we will need to ensure that finish() works on a not fully initialized point. That's currently safe. ok jsing
* Move point at infinity check to API boundarytb2024-11-031-2/+7
| | | | | | | | Since we only consider standard affine coordinates, the point at infinity must be excluded. Check at the API boundary that the point isn't the point at infinity rather than hiding this check somewhere in a method. ok jsing
* Fix includes in ec_lib and ecp_smpltb2024-11-021-1/+5
|
* Merge compressed coordinate setting back into ecp_smpl and ec_libtb2024-11-021-1/+40
| | | | The reason these were in separate files was FIPS. Not our problem.
* Minor cosmetic tweaks for EC_GROUP_set_seed()tb2024-10-251-9/+8
| | | | | No need to guard free() with a NULL check, check explicitly against 0 and rename p to seed.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-31 14:46:03 +0000