28 	struct sae_temporary_data *tmp;  in sae_set_group()  local
40 	tmp = sae->tmp = os_zalloc(sizeof(*tmp));  in sae_set_group()
41 	if (tmp == NULL)  in sae_set_group()
45 	tmp->ec = crypto_ec_init(group);  in sae_set_group()
46 	if (tmp->ec) {  in sae_set_group()
50 		tmp->prime_len = crypto_ec_prime_len(tmp->ec);  in sae_set_group()
51 		tmp->prime = crypto_ec_get_prime(tmp->ec);  in sae_set_group()
52 		tmp->order_len = crypto_ec_order_len(tmp->ec);  in sae_set_group()
53 		tmp->order = crypto_ec_get_order(tmp->ec);  in sae_set_group()
58 	tmp->dh = dh_groups_get(group);  in sae_set_group()
59 	if (tmp->dh) {  in sae_set_group()
63 		tmp->prime_len = tmp->dh->prime_len;  in sae_set_group()
64 		if (tmp->prime_len > SAE_MAX_PRIME_LEN) {  in sae_set_group()
69 		tmp->prime_buf = crypto_bignum_init_set(tmp->dh->prime,  in sae_set_group()
70 							tmp->prime_len);  in sae_set_group()
71 		if (tmp->prime_buf == NULL) {  in sae_set_group()
75 		tmp->prime = tmp->prime_buf;  in sae_set_group()
77 		tmp->order_len = tmp->dh->order_len;  in sae_set_group()
78 		tmp->order_buf = crypto_bignum_init_set(tmp->dh->order,  in sae_set_group()
79 							tmp->dh->order_len);  in sae_set_group()
80 		if (tmp->order_buf == NULL) {  in sae_set_group()
84 		tmp->order = tmp->order_buf;  in sae_set_group()
98 	struct sae_temporary_data *tmp;  in sae_clear_temp_data()  local
99 	if (sae == NULL || sae->tmp == NULL)  in sae_clear_temp_data()
101 	tmp = sae->tmp;  in sae_clear_temp_data()
102 	crypto_ec_deinit(tmp->ec);  in sae_clear_temp_data()
103 	crypto_bignum_deinit(tmp->prime_buf, 0);  in sae_clear_temp_data()
104 	crypto_bignum_deinit(tmp->order_buf, 0);  in sae_clear_temp_data()
105 	crypto_bignum_deinit(tmp->sae_rand, 1);  in sae_clear_temp_data()
106 	crypto_bignum_deinit(tmp->pwe_ffc, 1);  in sae_clear_temp_data()
107 	crypto_bignum_deinit(tmp->own_commit_scalar, 0);  in sae_clear_temp_data()
108 	crypto_bignum_deinit(tmp->own_commit_element_ffc, 0);  in sae_clear_temp_data()
109 	crypto_bignum_deinit(tmp->peer_commit_element_ffc, 0);  in sae_clear_temp_data()
110 	crypto_ec_point_deinit(tmp->pwe_ecc, 1);  in sae_clear_temp_data()
111 	crypto_ec_point_deinit(tmp->own_commit_element_ecc, 0);  in sae_clear_temp_data()
112 	crypto_ec_point_deinit(tmp->peer_commit_element_ecc, 0);  in sae_clear_temp_data()
113 	wpabuf_free(tmp->anti_clogging_token);  in sae_clear_temp_data()
114 	wpabuf_free(tmp->own_rejected_groups);  in sae_clear_temp_data()
115 	wpabuf_free(tmp->peer_rejected_groups);  in sae_clear_temp_data()
116 	os_free(tmp->pw_id);  in sae_clear_temp_data()
117 	bin_clear_free(tmp, sizeof(*tmp));  in sae_clear_temp_data()
118 	sae->tmp = NULL;  in sae_clear_temp_data()
160 	bits = crypto_ec_prime_len_bits(sae->tmp->ec);  in sae_test_pwd_seed_ecc()
162 			    prime, sae->tmp->prime_len, pwd_value, bits) < 0)  in sae_test_pwd_seed_ecc()
165 		buf_shift_right(pwd_value, sae->tmp->prime_len, 8 - bits % 8);  in sae_test_pwd_seed_ecc()
167 			pwd_value, sae->tmp->prime_len);  in sae_test_pwd_seed_ecc()
169 	cmp_prime = const_time_memcmp(pwd_value, prime, sae->tmp->prime_len);  in sae_test_pwd_seed_ecc()
177 	x_cand = crypto_bignum_init_set(pwd_value, sae->tmp->prime_len);  in sae_test_pwd_seed_ecc()
180 	y_sqr = crypto_ec_point_compute_y_sqr(sae->tmp->ec, x_cand);  in sae_test_pwd_seed_ecc()
185 	res = dragonfly_is_quadratic_residue_blind(sae->tmp->ec, qr, qnr,  in sae_test_pwd_seed_ecc()
200 	size_t bits = sae->tmp->prime_len * 8;  in sae_test_pwd_seed_ffc()
210 			    sae->tmp->dh->prime, sae->tmp->prime_len, pwd_value,  in sae_test_pwd_seed_ffc()
214 			sae->tmp->prime_len);  in sae_test_pwd_seed_ffc()
217 	res = const_time_memcmp(pwd_value, sae->tmp->dh->prime,  in sae_test_pwd_seed_ffc()
218 				sae->tmp->prime_len);  in sae_test_pwd_seed_ffc()
232 	a = crypto_bignum_init_set(pwd_value, sae->tmp->prime_len);  in sae_test_pwd_seed_ffc()
239 	if (sae->tmp->dh->safe_prime) {  in sae_test_pwd_seed_ffc()
251 		    crypto_bignum_sub(sae->tmp->prime, b, b) < 0 ||  in sae_test_pwd_seed_ffc()
252 		    crypto_bignum_div(b, sae->tmp->order, b) < 0)  in sae_test_pwd_seed_ffc()
259 	res = crypto_bignum_exptmod(a, b, sae->tmp->prime, pwe);  in sae_test_pwd_seed_ffc()
314 	prime_len = sae->tmp->prime_len;  in sae_derive_pwe_ecc()
315 	if (crypto_bignum_to_bin(sae->tmp->prime, prime, sizeof(prime),  in sae_derive_pwe_ecc()
323 	if (dragonfly_get_random_qr_qnr(sae->tmp->prime, &qr, &qnr) < 0 ||  in sae_derive_pwe_ecc()
417 	y = crypto_ec_point_compute_y_sqr(sae->tmp->ec, x);  in sae_derive_pwe_ecc()
419 	    dragonfly_sqrt(sae->tmp->ec, y, y) < 0 ||  in sae_derive_pwe_ecc()
422 	    crypto_bignum_sub(sae->tmp->prime, y, y) < 0 ||  in sae_derive_pwe_ecc()
434 	crypto_ec_point_deinit(sae->tmp->pwe_ecc, 1);  in sae_derive_pwe_ecc()
435 	sae->tmp->pwe_ecc = crypto_ec_point_from_bin(sae->tmp->ec, x_y);  in sae_derive_pwe_ecc()
436 	if (!sae->tmp->pwe_ecc) {  in sae_derive_pwe_ecc()
468 	size_t prime_len = sae->tmp->prime_len;  in sae_derive_pwe_ffc()
471 	crypto_bignum_deinit(sae->tmp->pwe_ffc, 1);  in sae_derive_pwe_ffc()
472 	sae->tmp->pwe_ffc = NULL;  in sae_derive_pwe_ffc()
534 	sae->tmp->pwe_ffc = crypto_bignum_init_set(pwe_buf, prime_len);  in sae_derive_pwe_ffc()
538 	return sae->tmp->pwe_ffc ? 0 : -1;  in sae_derive_pwe_ffc()
979 	struct crypto_bignum *one = NULL, *two = NULL, *bn = NULL, *tmp = NULL,  in sae_derive_pt_ffc()  local
1013 	tmp = crypto_bignum_init();  in sae_derive_pt_ffc()
1014 	if (!bn || !one || !two || !tmp ||  in sae_derive_pt_ffc()
1015 	    crypto_bignum_sub(prime, two, tmp) < 0 ||  in sae_derive_pt_ffc()
1016 	    crypto_bignum_mod(bn, tmp, bn) < 0 ||  in sae_derive_pt_ffc()
1027 	    crypto_bignum_sub(prime, one, tmp) < 0 ||  in sae_derive_pt_ffc()
1028 	    crypto_bignum_div(tmp, order, tmp) < 0 ||  in sae_derive_pt_ffc()
1029 	    crypto_bignum_exptmod(bn, tmp, prime, pt) < 0) {  in sae_derive_pt_ffc()
1040 	crypto_bignum_deinit(tmp, 1);  in sae_derive_pt_ffc()
1107 	struct sae_pt *pt = NULL, *last = NULL, *tmp;  in sae_derive_pt()  local
1114 		tmp = sae_derive_pt_group(groups[i], ssid, ssid_len, password,  in sae_derive_pt()
1116 		if (!tmp)  in sae_derive_pt()
1120 			last->next = tmp;  in sae_derive_pt()
1122 			pt = tmp;  in sae_derive_pt()
1123 		last = tmp;  in sae_derive_pt()
1156 	struct crypto_bignum *tmp = NULL, *val = NULL, *one = NULL;  in sae_derive_pwe_from_pt_ecc()  local
1180 	tmp = crypto_bignum_init();  in sae_derive_pwe_from_pt_ecc()
1183 	if (!tmp || !val || !one ||  in sae_derive_pwe_from_pt_ecc()
1184 	    crypto_bignum_sub(order, one, tmp) < 0 ||  in sae_derive_pwe_from_pt_ecc()
1185 	    crypto_bignum_mod(val, tmp, val) < 0 ||  in sae_derive_pwe_from_pt_ecc()
1203 	crypto_bignum_deinit(tmp, 1);  in sae_derive_pwe_from_pt_ecc()
1219 	struct crypto_bignum *tmp = NULL, *val = NULL, *one = NULL;  in sae_derive_pwe_from_pt_ffc()  local
1241 	tmp = crypto_bignum_init();  in sae_derive_pwe_from_pt_ffc()
1244 	if (!tmp || !val || !one ||  in sae_derive_pwe_from_pt_ffc()
1245 	    crypto_bignum_sub(order, one, tmp) < 0 ||  in sae_derive_pwe_from_pt_ffc()
1246 	    crypto_bignum_mod(val, tmp, val) < 0 ||  in sae_derive_pwe_from_pt_ffc()
1261 	crypto_bignum_deinit(tmp, 1);  in sae_derive_pwe_from_pt_ffc()
1289 	if (!sae->tmp->own_commit_element_ecc) {  in sae_derive_commit_element_ecc()
1290 		sae->tmp->own_commit_element_ecc =  in sae_derive_commit_element_ecc()
1291 			crypto_ec_point_init(sae->tmp->ec);  in sae_derive_commit_element_ecc()
1292 		if (!sae->tmp->own_commit_element_ecc)  in sae_derive_commit_element_ecc()
1296 	if (crypto_ec_point_mul(sae->tmp->ec, sae->tmp->pwe_ecc, mask,  in sae_derive_commit_element_ecc()
1297 				sae->tmp->own_commit_element_ecc) < 0 ||  in sae_derive_commit_element_ecc()
1298 	    crypto_ec_point_invert(sae->tmp->ec,  in sae_derive_commit_element_ecc()
1299 				   sae->tmp->own_commit_element_ecc) < 0) {  in sae_derive_commit_element_ecc()
1312 	if (!sae->tmp->own_commit_element_ffc) {  in sae_derive_commit_element_ffc()
1313 		sae->tmp->own_commit_element_ffc = crypto_bignum_init();  in sae_derive_commit_element_ffc()
1314 		if (!sae->tmp->own_commit_element_ffc)  in sae_derive_commit_element_ffc()
1318 	if (crypto_bignum_exptmod(sae->tmp->pwe_ffc, mask, sae->tmp->prime,  in sae_derive_commit_element_ffc()
1319 				  sae->tmp->own_commit_element_ffc) < 0 ||  in sae_derive_commit_element_ffc()
1320 	    crypto_bignum_inverse(sae->tmp->own_commit_element_ffc,  in sae_derive_commit_element_ffc()
1321 				  sae->tmp->prime,  in sae_derive_commit_element_ffc()
1322 				  sae->tmp->own_commit_element_ffc) < 0) {  in sae_derive_commit_element_ffc()
1337 	if (!sae->tmp->sae_rand)  in sae_derive_commit()
1338 		sae->tmp->sae_rand = crypto_bignum_init();  in sae_derive_commit()
1339 	if (!sae->tmp->own_commit_scalar)  in sae_derive_commit()
1340 		sae->tmp->own_commit_scalar = crypto_bignum_init();  in sae_derive_commit()
1341 	ret = !mask || !sae->tmp->sae_rand || !sae->tmp->own_commit_scalar ||  in sae_derive_commit()
1342 		dragonfly_generate_scalar(sae->tmp->order, sae->tmp->sae_rand,  in sae_derive_commit()
1344 					  sae->tmp->own_commit_scalar) < 0 ||  in sae_derive_commit()
1345 		(sae->tmp->ec &&  in sae_derive_commit()
1347 		(sae->tmp->dh &&  in sae_derive_commit()
1358 	if (sae->tmp == NULL ||  in sae_prepare_commit()
1359 	    (sae->tmp->ec && sae_derive_pwe_ecc(sae, addr1, addr2, password,  in sae_prepare_commit()
1361 	    (sae->tmp->dh && sae_derive_pwe_ffc(sae, addr1, addr2, password,  in sae_prepare_commit()
1375 	if (!sae->tmp)  in sae_prepare_commit_pt()
1390 	os_memcpy(sae->tmp->ssid, pt->ssid, pt->ssid_len);  in sae_prepare_commit_pt()
1391 	sae->tmp->ssid_len = pt->ssid_len;  in sae_prepare_commit_pt()
1392 	sae->tmp->ap_pk = pk;  in sae_prepare_commit_pt()
1394 	sae->tmp->own_addr_higher = os_memcmp(addr1, addr2, ETH_ALEN) > 0;  in sae_prepare_commit_pt()
1395 	wpabuf_free(sae->tmp->own_rejected_groups);  in sae_prepare_commit_pt()
1396 	sae->tmp->own_rejected_groups = NULL;  in sae_prepare_commit_pt()
1407 		sae->tmp->own_rejected_groups = groups;  in sae_prepare_commit_pt()
1411 		crypto_ec_point_deinit(sae->tmp->pwe_ecc, 1);  in sae_prepare_commit_pt()
1412 		sae->tmp->pwe_ecc = sae_derive_pwe_from_pt_ecc(pt, addr1,  in sae_prepare_commit_pt()
1414 		if (!sae->tmp->pwe_ecc)  in sae_prepare_commit_pt()
1419 		crypto_bignum_deinit(sae->tmp->pwe_ffc, 1);  in sae_prepare_commit_pt()
1420 		sae->tmp->pwe_ffc = sae_derive_pwe_from_pt_ffc(pt, addr1,  in sae_prepare_commit_pt()
1422 		if (!sae->tmp->pwe_ffc)  in sae_prepare_commit_pt()
1436 	K = crypto_ec_point_init(sae->tmp->ec);  in sae_derive_k_ecc()
1447 	if (crypto_ec_point_mul(sae->tmp->ec, sae->tmp->pwe_ecc,  in sae_derive_k_ecc()
1449 	    crypto_ec_point_add(sae->tmp->ec, K,  in sae_derive_k_ecc()
1450 				sae->tmp->peer_commit_element_ecc, K) < 0 ||  in sae_derive_k_ecc()
1451 	    crypto_ec_point_mul(sae->tmp->ec, K, sae->tmp->sae_rand, K) < 0 ||  in sae_derive_k_ecc()
1452 	    crypto_ec_point_is_at_infinity(sae->tmp->ec, K) ||  in sae_derive_k_ecc()
1453 	    crypto_ec_point_to_bin(sae->tmp->ec, K, k, NULL) < 0) {  in sae_derive_k_ecc()
1458 	wpa_hexdump_key(MSG_DEBUG, "SAE: k", k, sae->tmp->prime_len);  in sae_derive_k_ecc()
1483 	if (crypto_bignum_exptmod(sae->tmp->pwe_ffc, sae->peer_commit_scalar,  in sae_derive_k_ffc()
1484 				  sae->tmp->prime, K) < 0 ||  in sae_derive_k_ffc()
1485 	    crypto_bignum_mulmod(K, sae->tmp->peer_commit_element_ffc,  in sae_derive_k_ffc()
1486 				 sae->tmp->prime, K) < 0 ||  in sae_derive_k_ffc()
1487 	    crypto_bignum_exptmod(K, sae->tmp->sae_rand, sae->tmp->prime, K) < 0  in sae_derive_k_ffc()
1490 	    crypto_bignum_to_bin(K, k, SAE_MAX_PRIME_LEN, sae->tmp->prime_len) <  in sae_derive_k_ffc()
1496 	wpa_hexdump_key(MSG_DEBUG, "SAE: k", k, sae->tmp->prime_len);  in sae_derive_k_ffc()
1533 	struct crypto_bignum *tmp;  in sae_derive_keys()  local
1535 	size_t hash_len, salt_len, prime_len = sae->tmp->prime_len;  in sae_derive_keys()
1540 	tmp = crypto_bignum_init();  in sae_derive_keys()
1541 	if (tmp == NULL)  in sae_derive_keys()
1554 	else if (sae->tmp->dh)  in sae_derive_keys()
1566 	if (sae->h2e && (sae->tmp->own_rejected_groups ||  in sae_derive_keys()
1567 			 sae->tmp->peer_rejected_groups)) {  in sae_derive_keys()
1570 		own = sae->tmp->own_rejected_groups;  in sae_derive_keys()
1571 		peer = sae->tmp->peer_rejected_groups;  in sae_derive_keys()
1580 		if (sae->tmp->own_addr_higher) {  in sae_derive_keys()
1606 	if (crypto_bignum_add(sae->tmp->own_commit_scalar,  in sae_derive_keys()
1607 			      sae->peer_commit_scalar, tmp) < 0 ||  in sae_derive_keys()
1608 	    crypto_bignum_mod(tmp, sae->tmp->order, tmp) < 0)  in sae_derive_keys()
1616 	if (crypto_bignum_to_bin(tmp, val, sizeof(val),  in sae_derive_keys()
1617 				 sae->tmp->order_len) < 0)  in sae_derive_keys()
1624 				 val, sae->tmp->order_len,  in sae_derive_keys()
1629 				 val, sae->tmp->order_len,  in sae_derive_keys()
1635 			 val, sae->tmp->order_len,  in sae_derive_keys()
1641 	os_memcpy(sae->tmp->kck, keys, hash_len);  in sae_derive_keys()
1642 	sae->tmp->kck_len = hash_len;  in sae_derive_keys()
1648 		os_memcpy(sae->tmp->kek, keys + hash_len + SAE_PMK_LEN,  in sae_derive_keys()
1650 		sae->tmp->kek_len = hash_len;  in sae_derive_keys()
1652 				sae->tmp->kek, sae->tmp->kek_len);  in sae_derive_keys()
1657 			sae->tmp->kck, sae->tmp->kck_len);  in sae_derive_keys()
1663 	crypto_bignum_deinit(tmp, 0);  in sae_derive_keys()
1671 	if (sae->tmp == NULL ||  in sae_process_commit()
1672 	    (sae->tmp->ec && sae_derive_k_ecc(sae, k) < 0) ||  in sae_process_commit()
1673 	    (sae->tmp->dh && sae_derive_k_ffc(sae, k) < 0) ||  in sae_process_commit()
1685 	if (sae->tmp == NULL)  in sae_write_commit()
1694 	pos = wpabuf_put(buf, sae->tmp->prime_len);  in sae_write_commit()
1695 	if (crypto_bignum_to_bin(sae->tmp->own_commit_scalar, pos,  in sae_write_commit()
1696 				 sae->tmp->prime_len, sae->tmp->prime_len) < 0)  in sae_write_commit()
1699 		    pos, sae->tmp->prime_len);  in sae_write_commit()
1700 	if (sae->tmp->ec) {  in sae_write_commit()
1701 		pos = wpabuf_put(buf, 2 * sae->tmp->prime_len);  in sae_write_commit()
1702 		if (crypto_ec_point_to_bin(sae->tmp->ec,  in sae_write_commit()
1703 					   sae->tmp->own_commit_element_ecc,  in sae_write_commit()
1704 					   pos, pos + sae->tmp->prime_len) < 0)  in sae_write_commit()
1707 			    pos, sae->tmp->prime_len);  in sae_write_commit()
1709 			    pos + sae->tmp->prime_len, sae->tmp->prime_len);  in sae_write_commit()
1711 		pos = wpabuf_put(buf, sae->tmp->prime_len);  in sae_write_commit()
1712 		if (crypto_bignum_to_bin(sae->tmp->own_commit_element_ffc, pos,  in sae_write_commit()
1713 					 sae->tmp->prime_len,  in sae_write_commit()
1714 					 sae->tmp->prime_len) < 0)  in sae_write_commit()
1717 			    pos, sae->tmp->prime_len);  in sae_write_commit()
1730 	if (sae->h2e && sae->tmp->own_rejected_groups) {  in sae_write_commit()
1732 				sae->tmp->own_rejected_groups);  in sae_write_commit()
1735 			      1 + wpabuf_len(sae->tmp->own_rejected_groups));  in sae_write_commit()
1737 		wpabuf_put_buf(buf, sae->tmp->own_rejected_groups);  in sae_write_commit()
1792 	if (sae->tmp == NULL) {  in sae_group_allowed()
1797 	if (sae->tmp->dh && !allowed_groups) {  in sae_group_allowed()
1861 	scalar_elem_len = (sae->tmp->ec ? 3 : 2) * sae->tmp->prime_len;  in sae_parse_commit_token()
1903 	if (sae->tmp->prime_len > end - *pos) {  in sae_parse_commit_scalar()
1908 	peer_scalar = crypto_bignum_init_set(*pos, sae->tmp->prime_len);  in sae_parse_commit_scalar()
1930 	    crypto_bignum_cmp(peer_scalar, sae->tmp->order) >= 0) {  in sae_parse_commit_scalar()
1940 		    *pos, sae->tmp->prime_len);  in sae_parse_commit_scalar()
1941 	*pos += sae->tmp->prime_len;  in sae_parse_commit_scalar()
1952 	if (2 * sae->tmp->prime_len > end - *pos) {  in sae_parse_commit_element_ecc()
1958 	if (crypto_bignum_to_bin(sae->tmp->prime, prime, sizeof(prime),  in sae_parse_commit_element_ecc()
1959 				 sae->tmp->prime_len) < 0)  in sae_parse_commit_element_ecc()
1963 	if (os_memcmp(*pos, prime, sae->tmp->prime_len) >= 0 ||  in sae_parse_commit_element_ecc()
1964 	    os_memcmp(*pos + sae->tmp->prime_len, prime,  in sae_parse_commit_element_ecc()
1965 		      sae->tmp->prime_len) >= 0) {  in sae_parse_commit_element_ecc()
1972 		    *pos, sae->tmp->prime_len);  in sae_parse_commit_element_ecc()
1974 		    *pos + sae->tmp->prime_len, sae->tmp->prime_len);  in sae_parse_commit_element_ecc()
1976 	crypto_ec_point_deinit(sae->tmp->peer_commit_element_ecc, 0);  in sae_parse_commit_element_ecc()
1977 	sae->tmp->peer_commit_element_ecc =  in sae_parse_commit_element_ecc()
1978 		crypto_ec_point_from_bin(sae->tmp->ec, *pos);  in sae_parse_commit_element_ecc()
1979 	if (!sae->tmp->peer_commit_element_ecc) {  in sae_parse_commit_element_ecc()
1984 	if (!crypto_ec_point_is_on_curve(sae->tmp->ec,  in sae_parse_commit_element_ecc()
1985 					 sae->tmp->peer_commit_element_ecc)) {  in sae_parse_commit_element_ecc()
1990 	*pos += 2 * sae->tmp->prime_len;  in sae_parse_commit_element_ecc()
2002 	if (sae->tmp->prime_len > end - *pos) {  in sae_parse_commit_element_ffc()
2008 		    sae->tmp->prime_len);  in sae_parse_commit_element_ffc()
2010 	crypto_bignum_deinit(sae->tmp->peer_commit_element_ffc, 0);  in sae_parse_commit_element_ffc()
2011 	sae->tmp->peer_commit_element_ffc =  in sae_parse_commit_element_ffc()
2012 		crypto_bignum_init_set(*pos, sae->tmp->prime_len);  in sae_parse_commit_element_ffc()
2013 	if (sae->tmp->peer_commit_element_ffc == NULL)  in sae_parse_commit_element_ffc()
2019 	    crypto_bignum_sub(sae->tmp->prime, one, res) ||  in sae_parse_commit_element_ffc()
2020 	    crypto_bignum_is_zero(sae->tmp->peer_commit_element_ffc) ||  in sae_parse_commit_element_ffc()
2021 	    crypto_bignum_is_one(sae->tmp->peer_commit_element_ffc) ||  in sae_parse_commit_element_ffc()
2022 	    crypto_bignum_cmp(sae->tmp->peer_commit_element_ffc, res) >= 0) {  in sae_parse_commit_element_ffc()
2031 	if (crypto_bignum_exptmod(sae->tmp->peer_commit_element_ffc,  in sae_parse_commit_element_ffc()
2032 				  sae->tmp->order, sae->tmp->prime, res) < 0 ||  in sae_parse_commit_element_ffc()
2040 	*pos += sae->tmp->prime_len;  in sae_parse_commit_element_ffc()
2049 	if (sae->tmp->dh)  in sae_parse_commit_element()
2064 		if (sae->tmp->pw_id) {  in sae_parse_password_identifier()
2067 				   sae->tmp->pw_id);  in sae_parse_password_identifier()
2070 		os_free(sae->tmp->pw_id);  in sae_parse_password_identifier()
2071 		sae->tmp->pw_id = NULL;  in sae_parse_password_identifier()
2083 	if (sae->tmp->pw_id &&  in sae_parse_password_identifier()
2084 	    (len != os_strlen(sae->tmp->pw_id) ||  in sae_parse_password_identifier()
2085 	     os_memcmp(sae->tmp->pw_id, epos, len) != 0)) {  in sae_parse_password_identifier()
2088 			   sae->tmp->pw_id);  in sae_parse_password_identifier()
2092 	os_free(sae->tmp->pw_id);  in sae_parse_password_identifier()
2093 	sae->tmp->pw_id = os_malloc(len + 1);  in sae_parse_password_identifier()
2094 	if (!sae->tmp->pw_id)  in sae_parse_password_identifier()
2096 	os_memcpy(sae->tmp->pw_id, epos, len);  in sae_parse_password_identifier()
2097 	sae->tmp->pw_id[len] = '\0';  in sae_parse_password_identifier()
2099 			  sae->tmp->pw_id, len);  in sae_parse_password_identifier()
2114 		wpabuf_free(sae->tmp->peer_rejected_groups);  in sae_parse_rejected_groups()
2115 		sae->tmp->peer_rejected_groups = NULL;  in sae_parse_rejected_groups()
2133 	wpabuf_free(sae->tmp->peer_rejected_groups);  in sae_parse_rejected_groups()
2134 	sae->tmp->peer_rejected_groups = wpabuf_alloc(len);  in sae_parse_rejected_groups()
2135 	if (!sae->tmp->peer_rejected_groups)  in sae_parse_rejected_groups()
2137 	wpabuf_put_data(sae->tmp->peer_rejected_groups, epos, len);  in sae_parse_rejected_groups()
2139 			sae->tmp->peer_rejected_groups);  in sae_parse_rejected_groups()
2216 		wpabuf_free(sae->tmp->peer_rejected_groups);  in sae_parse_commit()
2217 		sae->tmp->peer_rejected_groups = NULL;  in sae_parse_commit()
2253 	if (!sae->tmp->own_commit_scalar ||  in sae_parse_commit()
2254 	    crypto_bignum_cmp(sae->tmp->own_commit_scalar,  in sae_parse_commit()
2256 	    (sae->tmp->dh &&  in sae_parse_commit()
2257 	     (!sae->tmp->own_commit_element_ffc ||  in sae_parse_commit()
2258 	      crypto_bignum_cmp(sae->tmp->own_commit_element_ffc,  in sae_parse_commit()
2259 				sae->tmp->peer_commit_element_ffc) != 0)) ||  in sae_parse_commit()
2260 	    (sae->tmp->ec &&  in sae_parse_commit()
2261 	     (!sae->tmp->own_commit_element_ecc ||  in sae_parse_commit()
2262 	      crypto_ec_point_cmp(sae->tmp->ec,  in sae_parse_commit()
2263 				  sae->tmp->own_commit_element_ecc,  in sae_parse_commit()
2264 				  sae->tmp->peer_commit_element_ecc) != 0)))  in sae_parse_commit()
2296 				 sae->tmp->prime_len) < 0 ||  in sae_cn_confirm()
2298 				 sae->tmp->prime_len) < 0)  in sae_cn_confirm()
2303 	len[1] = sae->tmp->prime_len;  in sae_cn_confirm()
2307 	len[3] = sae->tmp->prime_len;  in sae_cn_confirm()
2310 	return hkdf_extract(sae->tmp->kck_len, sae->tmp->kck, sae->tmp->kck_len,  in sae_cn_confirm()
2325 	if (crypto_ec_point_to_bin(sae->tmp->ec, element1, element_b1,  in sae_cn_confirm_ecc()
2326 				   element_b1 + sae->tmp->prime_len) < 0 ||  in sae_cn_confirm_ecc()
2327 	    crypto_ec_point_to_bin(sae->tmp->ec, element2, element_b2,  in sae_cn_confirm_ecc()
2328 				   element_b2 + sae->tmp->prime_len) < 0 ||  in sae_cn_confirm_ecc()
2330 			   2 * sae->tmp->prime_len,  in sae_cn_confirm_ecc()
2331 			   scalar2, element_b2, 2 * sae->tmp->prime_len,  in sae_cn_confirm_ecc()
2349 				 sae->tmp->prime_len) < 0 ||  in sae_cn_confirm_ffc()
2351 				 sae->tmp->prime_len) < 0 ||  in sae_cn_confirm_ffc()
2352 	    sae_cn_confirm(sae, sc, scalar1, element_b1, sae->tmp->prime_len,  in sae_cn_confirm_ffc()
2353 			   scalar2, element_b2, sae->tmp->prime_len,  in sae_cn_confirm_ffc()
2366 	if (sae->tmp == NULL)  in sae_write_confirm()
2369 	hash_len = sae->tmp->kck_len;  in sae_write_confirm()
2377 	if (sae->tmp->ec)  in sae_write_confirm()
2378 		res = sae_cn_confirm_ecc(sae, sc, sae->tmp->own_commit_scalar,  in sae_write_confirm()
2379 					 sae->tmp->own_commit_element_ecc,  in sae_write_confirm()
2381 					 sae->tmp->peer_commit_element_ecc,  in sae_write_confirm()
2384 		res = sae_cn_confirm_ffc(sae, sc, sae->tmp->own_commit_scalar,  in sae_write_confirm()
2385 					 sae->tmp->own_commit_element_ffc,  in sae_write_confirm()
2387 					 sae->tmp->peer_commit_element_ffc,  in sae_write_confirm()
2407 	if (!sae->tmp)  in sae_check_confirm()
2410 	hash_len = sae->tmp->kck_len;  in sae_check_confirm()
2418 	if (!sae->peer_commit_scalar || !sae->tmp->own_commit_scalar) {  in sae_check_confirm()
2423 	if (sae->tmp->ec) {  in sae_check_confirm()
2424 		if (!sae->tmp->peer_commit_element_ecc ||  in sae_check_confirm()
2425 		    !sae->tmp->own_commit_element_ecc ||  in sae_check_confirm()
2427 				       sae->tmp->peer_commit_element_ecc,  in sae_check_confirm()
2428 				       sae->tmp->own_commit_scalar,  in sae_check_confirm()
2429 				       sae->tmp->own_commit_element_ecc,  in sae_check_confirm()
2433 		if (!sae->tmp->peer_commit_element_ffc ||  in sae_check_confirm()
2434 		    !sae->tmp->own_commit_element_ffc ||  in sae_check_confirm()
2436 				       sae->tmp->peer_commit_element_ffc,  in sae_check_confirm()
2437 				       sae->tmp->own_commit_scalar,  in sae_check_confirm()
2438 				       sae->tmp->own_commit_element_ffc,  in sae_check_confirm()