ecp_internal.h 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293
  1. /**
  2. * \file ecp_internal.h
  3. *
  4. * \brief Function declarations for alternative implementation of elliptic curve
  5. * point arithmetic.
  6. */
  7. /*
  8. * Copyright (C) 2016, ARM Limited, All Rights Reserved
  9. * SPDX-License-Identifier: Apache-2.0
  10. *
  11. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  12. * not use this file except in compliance with the License.
  13. * You may obtain a copy of the License at
  14. *
  15. * http://www.apache.org/licenses/LICENSE-2.0
  16. *
  17. * Unless required by applicable law or agreed to in writing, software
  18. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  19. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  20. * See the License for the specific language governing permissions and
  21. * limitations under the License.
  22. *
  23. * This file is part of mbed TLS (https://tls.mbed.org)
  24. */
  25. /*
  26. * References:
  27. *
  28. * [1] BERNSTEIN, Daniel J. Curve25519: new Diffie-Hellman speed records.
  29. * <http://cr.yp.to/ecdh/curve25519-20060209.pdf>
  30. *
  31. * [2] CORON, Jean-S'ebastien. Resistance against differential power analysis
  32. * for elliptic curve cryptosystems. In : Cryptographic Hardware and
  33. * Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302.
  34. * <http://link.springer.com/chapter/10.1007/3-540-48059-5_25>
  35. *
  36. * [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to
  37. * render ECC resistant against Side Channel Attacks. IACR Cryptology
  38. * ePrint Archive, 2004, vol. 2004, p. 342.
  39. * <http://eprint.iacr.org/2004/342.pdf>
  40. *
  41. * [4] Certicom Research. SEC 2: Recommended Elliptic Curve Domain Parameters.
  42. * <http://www.secg.org/sec2-v2.pdf>
  43. *
  44. * [5] HANKERSON, Darrel, MENEZES, Alfred J., VANSTONE, Scott. Guide to Elliptic
  45. * Curve Cryptography.
  46. *
  47. * [6] Digital Signature Standard (DSS), FIPS 186-4.
  48. * <http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf>
  49. *
  50. * [7] Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer
  51. * Security (TLS), RFC 4492.
  52. * <https://tools.ietf.org/search/rfc4492>
  53. *
  54. * [8] <http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html>
  55. *
  56. * [9] COHEN, Henri. A Course in Computational Algebraic Number Theory.
  57. * Springer Science & Business Media, 1 Aug 2000
  58. */
  59. #ifndef MBEDTLS_ECP_INTERNAL_H
  60. #define MBEDTLS_ECP_INTERNAL_H
  61. #if defined(MBEDTLS_ECP_INTERNAL_ALT)
  62. /**
  63. * \brief Indicate if the Elliptic Curve Point module extension can
  64. * handle the group.
  65. *
  66. * \param grp The pointer to the elliptic curve group that will be the
  67. * basis of the cryptographic computations.
  68. *
  69. * \return Non-zero if successful.
  70. */
  71. unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp );
  72. /**
  73. * \brief Initialise the Elliptic Curve Point module extension.
  74. *
  75. * If mbedtls_internal_ecp_grp_capable returns true for a
  76. * group, this function has to be able to initialise the
  77. * module for it.
  78. *
  79. * This module can be a driver to a crypto hardware
  80. * accelerator, for which this could be an initialise function.
  81. *
  82. * \param grp The pointer to the group the module needs to be
  83. * initialised for.
  84. *
  85. * \return 0 if successful.
  86. */
  87. int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp );
  88. /**
  89. * \brief Frees and deallocates the Elliptic Curve Point module
  90. * extension.
  91. *
  92. * \param grp The pointer to the group the module was initialised for.
  93. */
  94. void mbedtls_internal_ecp_free( const mbedtls_ecp_group *grp );
  95. #if defined(ECP_SHORTWEIERSTRASS)
  96. #if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT)
  97. /**
  98. * \brief Randomize jacobian coordinates:
  99. * (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l.
  100. *
  101. * \param grp Pointer to the group representing the curve.
  102. *
  103. * \param pt The point on the curve to be randomised, given with Jacobian
  104. * coordinates.
  105. *
  106. * \param f_rng A function pointer to the random number generator.
  107. *
  108. * \param p_rng A pointer to the random number generator state.
  109. *
  110. * \return 0 if successful.
  111. */
  112. int mbedtls_internal_ecp_randomize_jac( const mbedtls_ecp_group *grp,
  113. mbedtls_ecp_point *pt, int (*f_rng)(void *, unsigned char *, size_t),
  114. void *p_rng );
  115. #endif
  116. #if defined(MBEDTLS_ECP_ADD_MIXED_ALT)
  117. /**
  118. * \brief Addition: R = P + Q, mixed affine-Jacobian coordinates.
  119. *
  120. * The coordinates of Q must be normalized (= affine),
  121. * but those of P don't need to. R is not normalized.
  122. *
  123. * This function is used only as a subrutine of
  124. * ecp_mul_comb().
  125. *
  126. * Special cases: (1) P or Q is zero, (2) R is zero,
  127. * (3) P == Q.
  128. * None of these cases can happen as intermediate step in
  129. * ecp_mul_comb():
  130. * - at each step, P, Q and R are multiples of the base
  131. * point, the factor being less than its order, so none of
  132. * them is zero;
  133. * - Q is an odd multiple of the base point, P an even
  134. * multiple, due to the choice of precomputed points in the
  135. * modified comb method.
  136. * So branches for these cases do not leak secret information.
  137. *
  138. * We accept Q->Z being unset (saving memory in tables) as
  139. * meaning 1.
  140. *
  141. * Cost in field operations if done by [5] 3.22:
  142. * 1A := 8M + 3S
  143. *
  144. * \param grp Pointer to the group representing the curve.
  145. *
  146. * \param R Pointer to a point structure to hold the result.
  147. *
  148. * \param P Pointer to the first summand, given with Jacobian
  149. * coordinates
  150. *
  151. * \param Q Pointer to the second summand, given with affine
  152. * coordinates.
  153. *
  154. * \return 0 if successful.
  155. */
  156. int mbedtls_internal_ecp_add_mixed( const mbedtls_ecp_group *grp,
  157. mbedtls_ecp_point *R, const mbedtls_ecp_point *P,
  158. const mbedtls_ecp_point *Q );
  159. #endif
  160. /**
  161. * \brief Point doubling R = 2 P, Jacobian coordinates.
  162. *
  163. * Cost: 1D := 3M + 4S (A == 0)
  164. * 4M + 4S (A == -3)
  165. * 3M + 6S + 1a otherwise
  166. * when the implementation is based on the "dbl-1998-cmo-2"
  167. * doubling formulas in [8] and standard optimizations are
  168. * applied when curve parameter A is one of { 0, -3 }.
  169. *
  170. * \param grp Pointer to the group representing the curve.
  171. *
  172. * \param R Pointer to a point structure to hold the result.
  173. *
  174. * \param P Pointer to the point that has to be doubled, given with
  175. * Jacobian coordinates.
  176. *
  177. * \return 0 if successful.
  178. */
  179. #if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT)
  180. int mbedtls_internal_ecp_double_jac( const mbedtls_ecp_group *grp,
  181. mbedtls_ecp_point *R, const mbedtls_ecp_point *P );
  182. #endif
  183. /**
  184. * \brief Normalize jacobian coordinates of an array of (pointers to)
  185. * points.
  186. *
  187. * Using Montgomery's trick to perform only one inversion mod P
  188. * the cost is:
  189. * 1N(t) := 1I + (6t - 3)M + 1S
  190. * (See for example Algorithm 10.3.4. in [9])
  191. *
  192. * This function is used only as a subrutine of
  193. * ecp_mul_comb().
  194. *
  195. * Warning: fails (returning an error) if one of the points is
  196. * zero!
  197. * This should never happen, see choice of w in ecp_mul_comb().
  198. *
  199. * \param grp Pointer to the group representing the curve.
  200. *
  201. * \param T Array of pointers to the points to normalise.
  202. *
  203. * \param t_len Number of elements in the array.
  204. *
  205. * \return 0 if successful,
  206. * an error if one of the points is zero.
  207. */
  208. #if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT)
  209. int mbedtls_internal_ecp_normalize_jac_many( const mbedtls_ecp_group *grp,
  210. mbedtls_ecp_point *T[], size_t t_len );
  211. #endif
  212. /**
  213. * \brief Normalize jacobian coordinates so that Z == 0 || Z == 1.
  214. *
  215. * Cost in field operations if done by [5] 3.2.1:
  216. * 1N := 1I + 3M + 1S
  217. *
  218. * \param grp Pointer to the group representing the curve.
  219. *
  220. * \param pt pointer to the point to be normalised. This is an
  221. * input/output parameter.
  222. *
  223. * \return 0 if successful.
  224. */
  225. #if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT)
  226. int mbedtls_internal_ecp_normalize_jac( const mbedtls_ecp_group *grp,
  227. mbedtls_ecp_point *pt );
  228. #endif
  229. #endif /* ECP_SHORTWEIERSTRASS */
  230. #if defined(ECP_MONTGOMERY)
  231. #if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT)
  232. int mbedtls_internal_ecp_double_add_mxz( const mbedtls_ecp_group *grp,
  233. mbedtls_ecp_point *R, mbedtls_ecp_point *S, const mbedtls_ecp_point *P,
  234. const mbedtls_ecp_point *Q, const mbedtls_mpi *d );
  235. #endif
  236. /**
  237. * \brief Randomize projective x/z coordinates:
  238. * (X, Z) -> (l X, l Z) for random l
  239. *
  240. * \param grp pointer to the group representing the curve
  241. *
  242. * \param P the point on the curve to be randomised given with
  243. * projective coordinates. This is an input/output parameter.
  244. *
  245. * \param f_rng a function pointer to the random number generator
  246. *
  247. * \param p_rng a pointer to the random number generator state
  248. *
  249. * \return 0 if successful
  250. */
  251. #if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT)
  252. int mbedtls_internal_ecp_randomize_mxz( const mbedtls_ecp_group *grp,
  253. mbedtls_ecp_point *P, int (*f_rng)(void *, unsigned char *, size_t),
  254. void *p_rng );
  255. #endif
  256. /**
  257. * \brief Normalize Montgomery x/z coordinates: X = X/Z, Z = 1.
  258. *
  259. * \param grp pointer to the group representing the curve
  260. *
  261. * \param P pointer to the point to be normalised. This is an
  262. * input/output parameter.
  263. *
  264. * \return 0 if successful
  265. */
  266. #if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT)
  267. int mbedtls_internal_ecp_normalize_mxz( const mbedtls_ecp_group *grp,
  268. mbedtls_ecp_point *P );
  269. #endif
  270. #endif /* ECP_MONTGOMERY */
  271. #endif /* MBEDTLS_ECP_INTERNAL_ALT */
  272. #endif /* ecp_internal.h */