1 /** 2 * \file ecp_internal_alt.h 3 * 4 * \brief Function declarations for alternative implementation of elliptic curve 5 * point arithmetic. 6 */ 7 /* 8 * Copyright The Mbed TLS Contributors 9 * SPDX-License-Identifier: Apache-2.0 10 * 11 * Licensed under the Apache License, Version 2.0 (the "License"); you may 12 * not use this file except in compliance with the License. 13 * You may obtain a copy of the License at 14 * 15 * http://www.apache.org/licenses/LICENSE-2.0 16 * 17 * Unless required by applicable law or agreed to in writing, software 18 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 19 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 20 * See the License for the specific language governing permissions and 21 * limitations under the License. 22 */ 23 24 /* 25 * References: 26 * 27 * [1] BERNSTEIN, Daniel J. Curve25519: new Diffie-Hellman speed records. 28 * <http://cr.yp.to/ecdh/curve25519-20060209.pdf> 29 * 30 * [2] CORON, Jean-S'ebastien. Resistance against differential power analysis 31 * for elliptic curve cryptosystems. In : Cryptographic Hardware and 32 * Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302. 33 * <http://link.springer.com/chapter/10.1007/3-540-48059-5_25> 34 * 35 * [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to 36 * render ECC resistant against Side Channel Attacks. IACR Cryptology 37 * ePrint Archive, 2004, vol. 2004, p. 342. 38 * <http://eprint.iacr.org/2004/342.pdf> 39 * 40 * [4] Certicom Research. SEC 2: Recommended Elliptic Curve Domain Parameters. 41 * <http://www.secg.org/sec2-v2.pdf> 42 * 43 * [5] HANKERSON, Darrel, MENEZES, Alfred J., VANSTONE, Scott. Guide to Elliptic 44 * Curve Cryptography. 45 * 46 * [6] Digital Signature Standard (DSS), FIPS 186-4. 47 * <http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf> 48 * 49 * [7] Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer 50 * Security (TLS), RFC 4492. 51 * <https://tools.ietf.org/search/rfc4492> 52 * 53 * [8] <http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html> 54 * 55 * [9] COHEN, Henri. A Course in Computational Algebraic Number Theory. 56 * Springer Science & Business Media, 1 Aug 2000 57 */ 58 59 #ifndef MBEDTLS_ECP_INTERNAL_H 60 #define MBEDTLS_ECP_INTERNAL_H 61 62 #include "mbedtls/build_info.h" 63 64 #if defined(MBEDTLS_ECP_INTERNAL_ALT) 65 66 /** 67 * \brief Indicate if the Elliptic Curve Point module extension can 68 * handle the group. 69 * 70 * \param grp The pointer to the elliptic curve group that will be the 71 * basis of the cryptographic computations. 72 * 73 * \return Non-zero if successful. 74 */ 75 unsigned char mbedtls_internal_ecp_grp_capable(const mbedtls_ecp_group *grp); 76 77 /** 78 * \brief Initialise the Elliptic Curve Point module extension. 79 * 80 * If mbedtls_internal_ecp_grp_capable returns true for a 81 * group, this function has to be able to initialise the 82 * module for it. 83 * 84 * This module can be a driver to a crypto hardware 85 * accelerator, for which this could be an initialise function. 86 * 87 * \param grp The pointer to the group the module needs to be 88 * initialised for. 89 * 90 * \return 0 if successful. 91 */ 92 int mbedtls_internal_ecp_init(const mbedtls_ecp_group *grp); 93 94 /** 95 * \brief Frees and deallocates the Elliptic Curve Point module 96 * extension. 97 * 98 * \param grp The pointer to the group the module was initialised for. 99 */ 100 void mbedtls_internal_ecp_free(const mbedtls_ecp_group *grp); 101 102 #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) 103 104 #if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT) 105 /** 106 * \brief Randomize jacobian coordinates: 107 * (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l. 108 * 109 * \param grp Pointer to the group representing the curve. 110 * 111 * \param pt The point on the curve to be randomised, given with Jacobian 112 * coordinates. 113 * 114 * \param f_rng A function pointer to the random number generator. 115 * 116 * \param p_rng A pointer to the random number generator state. 117 * 118 * \return 0 if successful. 119 */ 120 int mbedtls_internal_ecp_randomize_jac(const mbedtls_ecp_group *grp, 121 mbedtls_ecp_point *pt, int (*f_rng)(void *, 122 unsigned char *, 123 size_t), 124 void *p_rng); 125 #endif 126 127 #if defined(MBEDTLS_ECP_ADD_MIXED_ALT) 128 /** 129 * \brief Addition: R = P + Q, mixed affine-Jacobian coordinates. 130 * 131 * The coordinates of Q must be normalized (= affine), 132 * but those of P don't need to. R is not normalized. 133 * 134 * This function is used only as a subrutine of 135 * ecp_mul_comb(). 136 * 137 * Special cases: (1) P or Q is zero, (2) R is zero, 138 * (3) P == Q. 139 * None of these cases can happen as intermediate step in 140 * ecp_mul_comb(): 141 * - at each step, P, Q and R are multiples of the base 142 * point, the factor being less than its order, so none of 143 * them is zero; 144 * - Q is an odd multiple of the base point, P an even 145 * multiple, due to the choice of precomputed points in the 146 * modified comb method. 147 * So branches for these cases do not leak secret information. 148 * 149 * We accept Q->Z being unset (saving memory in tables) as 150 * meaning 1. 151 * 152 * Cost in field operations if done by [5] 3.22: 153 * 1A := 8M + 3S 154 * 155 * \param grp Pointer to the group representing the curve. 156 * 157 * \param R Pointer to a point structure to hold the result. 158 * 159 * \param P Pointer to the first summand, given with Jacobian 160 * coordinates 161 * 162 * \param Q Pointer to the second summand, given with affine 163 * coordinates. 164 * 165 * \return 0 if successful. 166 */ 167 int mbedtls_internal_ecp_add_mixed(const mbedtls_ecp_group *grp, 168 mbedtls_ecp_point *R, const mbedtls_ecp_point *P, 169 const mbedtls_ecp_point *Q); 170 #endif 171 172 /** 173 * \brief Point doubling R = 2 P, Jacobian coordinates. 174 * 175 * Cost: 1D := 3M + 4S (A == 0) 176 * 4M + 4S (A == -3) 177 * 3M + 6S + 1a otherwise 178 * when the implementation is based on the "dbl-1998-cmo-2" 179 * doubling formulas in [8] and standard optimizations are 180 * applied when curve parameter A is one of { 0, -3 }. 181 * 182 * \param grp Pointer to the group representing the curve. 183 * 184 * \param R Pointer to a point structure to hold the result. 185 * 186 * \param P Pointer to the point that has to be doubled, given with 187 * Jacobian coordinates. 188 * 189 * \return 0 if successful. 190 */ 191 #if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) 192 int mbedtls_internal_ecp_double_jac(const mbedtls_ecp_group *grp, 193 mbedtls_ecp_point *R, const mbedtls_ecp_point *P); 194 #endif 195 196 /** 197 * \brief Normalize jacobian coordinates of an array of (pointers to) 198 * points. 199 * 200 * Using Montgomery's trick to perform only one inversion mod P 201 * the cost is: 202 * 1N(t) := 1I + (6t - 3)M + 1S 203 * (See for example Algorithm 10.3.4. in [9]) 204 * 205 * This function is used only as a subrutine of 206 * ecp_mul_comb(). 207 * 208 * Warning: fails (returning an error) if one of the points is 209 * zero! 210 * This should never happen, see choice of w in ecp_mul_comb(). 211 * 212 * \param grp Pointer to the group representing the curve. 213 * 214 * \param T Array of pointers to the points to normalise. 215 * 216 * \param t_len Number of elements in the array. 217 * 218 * \return 0 if successful, 219 * an error if one of the points is zero. 220 */ 221 #if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT) 222 int mbedtls_internal_ecp_normalize_jac_many(const mbedtls_ecp_group *grp, 223 mbedtls_ecp_point *T[], size_t t_len); 224 #endif 225 226 /** 227 * \brief Normalize jacobian coordinates so that Z == 0 || Z == 1. 228 * 229 * Cost in field operations if done by [5] 3.2.1: 230 * 1N := 1I + 3M + 1S 231 * 232 * \param grp Pointer to the group representing the curve. 233 * 234 * \param pt pointer to the point to be normalised. This is an 235 * input/output parameter. 236 * 237 * \return 0 if successful. 238 */ 239 #if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT) 240 int mbedtls_internal_ecp_normalize_jac(const mbedtls_ecp_group *grp, 241 mbedtls_ecp_point *pt); 242 #endif 243 244 #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ 245 246 #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) 247 248 #if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) 249 int mbedtls_internal_ecp_double_add_mxz(const mbedtls_ecp_group *grp, 250 mbedtls_ecp_point *R, 251 mbedtls_ecp_point *S, 252 const mbedtls_ecp_point *P, 253 const mbedtls_ecp_point *Q, 254 const mbedtls_mpi *d); 255 #endif 256 257 /** 258 * \brief Randomize projective x/z coordinates: 259 * (X, Z) -> (l X, l Z) for random l 260 * 261 * \param grp pointer to the group representing the curve 262 * 263 * \param P the point on the curve to be randomised given with 264 * projective coordinates. This is an input/output parameter. 265 * 266 * \param f_rng a function pointer to the random number generator 267 * 268 * \param p_rng a pointer to the random number generator state 269 * 270 * \return 0 if successful 271 */ 272 #if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT) 273 int mbedtls_internal_ecp_randomize_mxz(const mbedtls_ecp_group *grp, 274 mbedtls_ecp_point *P, int (*f_rng)(void *, 275 unsigned char *, 276 size_t), 277 void *p_rng); 278 #endif 279 280 /** 281 * \brief Normalize Montgomery x/z coordinates: X = X/Z, Z = 1. 282 * 283 * \param grp pointer to the group representing the curve 284 * 285 * \param P pointer to the point to be normalised. This is an 286 * input/output parameter. 287 * 288 * \return 0 if successful 289 */ 290 #if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT) 291 int mbedtls_internal_ecp_normalize_mxz(const mbedtls_ecp_group *grp, 292 mbedtls_ecp_point *P); 293 #endif 294 295 #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ 296 297 #endif /* MBEDTLS_ECP_INTERNAL_ALT */ 298 299 #endif /* ecp_internal_alt.h */ 300
