ecp_internal.h 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299
  1. /**
  2. * \file ecp_internal.h
  3. *
  4. * \brief Function declarations for alternative implementation of elliptic curve
  5. * point arithmetic.
  6. */
  7. /*
  8. * Copyright (C) 2016, ARM Limited, All Rights Reserved
  9. * SPDX-License-Identifier: Apache-2.0
  10. *
  11. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  12. * not use this file except in compliance with the License.
  13. * You may obtain a copy of the License at
  14. *
  15. * http://www.apache.org/licenses/LICENSE-2.0
  16. *
  17. * Unless required by applicable law or agreed to in writing, software
  18. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  19. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  20. * See the License for the specific language governing permissions and
  21. * limitations under the License.
  22. *
  23. * This file is part of mbed TLS (https://tls.mbed.org)
  24. */
  25. /*
  26. * References:
  27. *
  28. * [1] BERNSTEIN, Daniel J. Curve25519: new Diffie-Hellman speed records.
  29. * <http://cr.yp.to/ecdh/curve25519-20060209.pdf>
  30. *
  31. * [2] CORON, Jean-S'ebastien. Resistance against differential power analysis
  32. * for elliptic curve cryptosystems. In : Cryptographic Hardware and
  33. * Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302.
  34. * <http://link.springer.com/chapter/10.1007/3-540-48059-5_25>
  35. *
  36. * [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to
  37. * render ECC resistant against Side Channel Attacks. IACR Cryptology
  38. * ePrint Archive, 2004, vol. 2004, p. 342.
  39. * <http://eprint.iacr.org/2004/342.pdf>
  40. *
  41. * [4] Certicom Research. SEC 2: Recommended Elliptic Curve Domain Parameters.
  42. * <http://www.secg.org/sec2-v2.pdf>
  43. *
  44. * [5] HANKERSON, Darrel, MENEZES, Alfred J., VANSTONE, Scott. Guide to Elliptic
  45. * Curve Cryptography.
  46. *
  47. * [6] Digital Signature Standard (DSS), FIPS 186-4.
  48. * <http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf>
  49. *
  50. * [7] Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer
  51. * Security (TLS), RFC 4492.
  52. * <https://tools.ietf.org/search/rfc4492>
  53. *
  54. * [8] <http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html>
  55. *
  56. * [9] COHEN, Henri. A Course in Computational Algebraic Number Theory.
  57. * Springer Science & Business Media, 1 Aug 2000
  58. */
  59. #ifndef MBEDTLS_ECP_INTERNAL_H
  60. #define MBEDTLS_ECP_INTERNAL_H
  61. #if !defined(MBEDTLS_CONFIG_FILE)
  62. #include "config.h"
  63. #else
  64. #include MBEDTLS_CONFIG_FILE
  65. #endif
  66. #if defined(MBEDTLS_ECP_INTERNAL_ALT)
  67. /**
  68. * \brief Indicate if the Elliptic Curve Point module extension can
  69. * handle the group.
  70. *
  71. * \param grp The pointer to the elliptic curve group that will be the
  72. * basis of the cryptographic computations.
  73. *
  74. * \return Non-zero if successful.
  75. */
  76. unsigned char mbedtls_internal_ecp_grp_capable( const mbedtls_ecp_group *grp );
  77. /**
  78. * \brief Initialise the Elliptic Curve Point module extension.
  79. *
  80. * If mbedtls_internal_ecp_grp_capable returns true for a
  81. * group, this function has to be able to initialise the
  82. * module for it.
  83. *
  84. * This module can be a driver to a crypto hardware
  85. * accelerator, for which this could be an initialise function.
  86. *
  87. * \param grp The pointer to the group the module needs to be
  88. * initialised for.
  89. *
  90. * \return 0 if successful.
  91. */
  92. int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp );
  93. /**
  94. * \brief Frees and deallocates the Elliptic Curve Point module
  95. * extension.
  96. *
  97. * \param grp The pointer to the group the module was initialised for.
  98. */
  99. void mbedtls_internal_ecp_free( const mbedtls_ecp_group *grp );
  100. #if defined(ECP_SHORTWEIERSTRASS)
  101. #if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT)
  102. /**
  103. * \brief Randomize jacobian coordinates:
  104. * (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l.
  105. *
  106. * \param grp Pointer to the group representing the curve.
  107. *
  108. * \param pt The point on the curve to be randomised, given with Jacobian
  109. * coordinates.
  110. *
  111. * \param f_rng A function pointer to the random number generator.
  112. *
  113. * \param p_rng A pointer to the random number generator state.
  114. *
  115. * \return 0 if successful.
  116. */
  117. int mbedtls_internal_ecp_randomize_jac( const mbedtls_ecp_group *grp,
  118. mbedtls_ecp_point *pt, int (*f_rng)(void *, unsigned char *, size_t),
  119. void *p_rng );
  120. #endif
  121. #if defined(MBEDTLS_ECP_ADD_MIXED_ALT)
  122. /**
  123. * \brief Addition: R = P + Q, mixed affine-Jacobian coordinates.
  124. *
  125. * The coordinates of Q must be normalized (= affine),
  126. * but those of P don't need to. R is not normalized.
  127. *
  128. * This function is used only as a subrutine of
  129. * ecp_mul_comb().
  130. *
  131. * Special cases: (1) P or Q is zero, (2) R is zero,
  132. * (3) P == Q.
  133. * None of these cases can happen as intermediate step in
  134. * ecp_mul_comb():
  135. * - at each step, P, Q and R are multiples of the base
  136. * point, the factor being less than its order, so none of
  137. * them is zero;
  138. * - Q is an odd multiple of the base point, P an even
  139. * multiple, due to the choice of precomputed points in the
  140. * modified comb method.
  141. * So branches for these cases do not leak secret information.
  142. *
  143. * We accept Q->Z being unset (saving memory in tables) as
  144. * meaning 1.
  145. *
  146. * Cost in field operations if done by [5] 3.22:
  147. * 1A := 8M + 3S
  148. *
  149. * \param grp Pointer to the group representing the curve.
  150. *
  151. * \param R Pointer to a point structure to hold the result.
  152. *
  153. * \param P Pointer to the first summand, given with Jacobian
  154. * coordinates
  155. *
  156. * \param Q Pointer to the second summand, given with affine
  157. * coordinates.
  158. *
  159. * \return 0 if successful.
  160. */
  161. int mbedtls_internal_ecp_add_mixed( const mbedtls_ecp_group *grp,
  162. mbedtls_ecp_point *R, const mbedtls_ecp_point *P,
  163. const mbedtls_ecp_point *Q );
  164. #endif
  165. /**
  166. * \brief Point doubling R = 2 P, Jacobian coordinates.
  167. *
  168. * Cost: 1D := 3M + 4S (A == 0)
  169. * 4M + 4S (A == -3)
  170. * 3M + 6S + 1a otherwise
  171. * when the implementation is based on the "dbl-1998-cmo-2"
  172. * doubling formulas in [8] and standard optimizations are
  173. * applied when curve parameter A is one of { 0, -3 }.
  174. *
  175. * \param grp Pointer to the group representing the curve.
  176. *
  177. * \param R Pointer to a point structure to hold the result.
  178. *
  179. * \param P Pointer to the point that has to be doubled, given with
  180. * Jacobian coordinates.
  181. *
  182. * \return 0 if successful.
  183. */
  184. #if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT)
  185. int mbedtls_internal_ecp_double_jac( const mbedtls_ecp_group *grp,
  186. mbedtls_ecp_point *R, const mbedtls_ecp_point *P );
  187. #endif
  188. /**
  189. * \brief Normalize jacobian coordinates of an array of (pointers to)
  190. * points.
  191. *
  192. * Using Montgomery's trick to perform only one inversion mod P
  193. * the cost is:
  194. * 1N(t) := 1I + (6t - 3)M + 1S
  195. * (See for example Algorithm 10.3.4. in [9])
  196. *
  197. * This function is used only as a subrutine of
  198. * ecp_mul_comb().
  199. *
  200. * Warning: fails (returning an error) if one of the points is
  201. * zero!
  202. * This should never happen, see choice of w in ecp_mul_comb().
  203. *
  204. * \param grp Pointer to the group representing the curve.
  205. *
  206. * \param T Array of pointers to the points to normalise.
  207. *
  208. * \param t_len Number of elements in the array.
  209. *
  210. * \return 0 if successful,
  211. * an error if one of the points is zero.
  212. */
  213. #if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT)
  214. int mbedtls_internal_ecp_normalize_jac_many( const mbedtls_ecp_group *grp,
  215. mbedtls_ecp_point *T[], size_t t_len );
  216. #endif
  217. /**
  218. * \brief Normalize jacobian coordinates so that Z == 0 || Z == 1.
  219. *
  220. * Cost in field operations if done by [5] 3.2.1:
  221. * 1N := 1I + 3M + 1S
  222. *
  223. * \param grp Pointer to the group representing the curve.
  224. *
  225. * \param pt pointer to the point to be normalised. This is an
  226. * input/output parameter.
  227. *
  228. * \return 0 if successful.
  229. */
  230. #if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT)
  231. int mbedtls_internal_ecp_normalize_jac( const mbedtls_ecp_group *grp,
  232. mbedtls_ecp_point *pt );
  233. #endif
  234. #endif /* ECP_SHORTWEIERSTRASS */
  235. #if defined(ECP_MONTGOMERY)
  236. #if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT)
  237. int mbedtls_internal_ecp_double_add_mxz( const mbedtls_ecp_group *grp,
  238. mbedtls_ecp_point *R, mbedtls_ecp_point *S, const mbedtls_ecp_point *P,
  239. const mbedtls_ecp_point *Q, const mbedtls_mpi *d );
  240. #endif
  241. /**
  242. * \brief Randomize projective x/z coordinates:
  243. * (X, Z) -> (l X, l Z) for random l
  244. *
  245. * \param grp pointer to the group representing the curve
  246. *
  247. * \param P the point on the curve to be randomised given with
  248. * projective coordinates. This is an input/output parameter.
  249. *
  250. * \param f_rng a function pointer to the random number generator
  251. *
  252. * \param p_rng a pointer to the random number generator state
  253. *
  254. * \return 0 if successful
  255. */
  256. #if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT)
  257. int mbedtls_internal_ecp_randomize_mxz( const mbedtls_ecp_group *grp,
  258. mbedtls_ecp_point *P, int (*f_rng)(void *, unsigned char *, size_t),
  259. void *p_rng );
  260. #endif
  261. /**
  262. * \brief Normalize Montgomery x/z coordinates: X = X/Z, Z = 1.
  263. *
  264. * \param grp pointer to the group representing the curve
  265. *
  266. * \param P pointer to the point to be normalised. This is an
  267. * input/output parameter.
  268. *
  269. * \return 0 if successful
  270. */
  271. #if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT)
  272. int mbedtls_internal_ecp_normalize_mxz( const mbedtls_ecp_group *grp,
  273. mbedtls_ecp_point *P );
  274. #endif
  275. #endif /* ECP_MONTGOMERY */
  276. #endif /* MBEDTLS_ECP_INTERNAL_ALT */
  277. #endif /* ecp_internal.h */