From 793c33000da18d1042676e579534a57987870576 Mon Sep 17 00:00:00 2001
From: tb <>
Date: Sat, 11 Jan 2025 14:53:46 +0000
Subject: Rework ec_point_set_compressed_coordinates()

While this is nicely done, it is a bit too clever. We can do the
calculation in the normal domain rather than the Montgomery domain
and this way the method becomes method agnostic. This will be a bit
slower but since a couple of field operations are nothing compared
to the cost of BN_mod_sqrt() this isn't a concern.

ok jsing
---
 src/lib/libcrypto/ec/ecp_methods.c | 32 ++++++++++++++------------------
 1 file changed, 14 insertions(+), 18 deletions(-)

(limited to 'src')

diff --git a/src/lib/libcrypto/ec/ecp_methods.c b/src/lib/libcrypto/ec/ecp_methods.c
index 9ee5da43e1..57efce0366 100644
--- a/src/lib/libcrypto/ec/ecp_methods.c
+++ b/src/lib/libcrypto/ec/ecp_methods.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ecp_methods.c,v 1.29 2025/01/11 14:48:20 tb Exp $ */
+/* $OpenBSD: ecp_methods.c,v 1.30 2025/01/11 14:53:46 tb Exp $ */
 /* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
  * for the OpenSSL project.
  * Includes code written by Bodo Moeller for the OpenSSL project.
@@ -279,14 +279,19 @@ static int
 ec_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
     const BIGNUM *in_x, int y_bit, BN_CTX *ctx)
 {
-	const BIGNUM *p = group->p, *a = group->a, *b = group->b;
-	BIGNUM *w, *x, *y;
+	BIGNUM *p, *a, *b, *w, *x, *y;
 	int ret = 0;
 
 	y_bit = (y_bit != 0);
 
 	BN_CTX_start(ctx);
 
+	if ((p = BN_CTX_get(ctx)) == NULL)
+		goto err;
+	if ((a = BN_CTX_get(ctx)) == NULL)
+		goto err;
+	if ((b = BN_CTX_get(ctx)) == NULL)
+		goto err;
 	if ((w = BN_CTX_get(ctx)) == NULL)
 		goto err;
 	if ((x = BN_CTX_get(ctx)) == NULL)
@@ -299,19 +304,17 @@ ec_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
 	 * square roots of x^3 + ax + b. The y-bit indicates which one.
 	 */
 
+	if (!EC_GROUP_get_curve(group, p, a, b, ctx))
+		goto err;
+
 	/* XXX - should we not insist on 0 <= x < p instead? */
 	if (!BN_nnmod(x, in_x, p, ctx))
 		goto err;
 
-	if (group->meth->field_encode != NULL) {
-		if (!group->meth->field_encode(group, x, x, ctx))
-			goto err;
-	}
-
 	/* y = x^3 */
-	if (!group->meth->field_sqr(group, y, x, ctx))
+	if (!BN_mod_sqr(y, x, p, ctx))
 		goto err;
-	if (!group->meth->field_mul(group, y, y, x, ctx))
+	if (!BN_mod_mul(y, y, x, p, ctx))
 		goto err;
 
 	/* y += ax */
@@ -323,7 +326,7 @@ ec_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
 		if (!BN_mod_sub_quick(y, y, w, p))
 			goto err;
 	} else {
-		if (!group->meth->field_mul(group, w, a, x, ctx))
+		if (!BN_mod_mul(w, a, x, p, ctx))
 			goto err;
 		if (!BN_mod_add_quick(y, y, w, p))
 			goto err;
@@ -333,13 +336,6 @@ ec_set_compressed_coordinates(const EC_GROUP *group, EC_POINT *point,
 	if (!BN_mod_add_quick(y, y, b, p))
 		goto err;
 
-	if (group->meth->field_decode != NULL) {
-		if (!group->meth->field_decode(group, x, x, ctx))
-			goto err;
-		if (!group->meth->field_decode(group, y, y, ctx))
-			goto err;
-	}
-
 	if (!BN_mod_sqrt(y, y, p, ctx)) {
 		ECerror(EC_R_INVALID_COMPRESSED_POINT);
 		goto err;
-- 
cgit v1.2.3-55-g6feb