1/* BEGIN_HEADER */
2#include "mbedtls/ecp.h"
3
4#include "ecp_invasive.h"
5
6#if defined(MBEDTLS_TEST_HOOKS) &&                  \
7    ( defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) ||  \
8      defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) ||  \
9      defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) )
10#define HAVE_FIX_NEGATIVE
11#endif
12
13#define ECP_PF_UNKNOWN     -1
14
15#define ECP_PT_RESET( x )           \
16    mbedtls_ecp_point_free( x );    \
17    mbedtls_ecp_point_init( x );
18
19/* END_HEADER */
20
21/* BEGIN_DEPENDENCIES
22 * depends_on:MBEDTLS_ECP_C
23 * END_DEPENDENCIES
24 */
25
26/* BEGIN_CASE */
27void ecp_valid_param( )
28{
29    TEST_VALID_PARAM( mbedtls_ecp_group_free( NULL ) );
30    TEST_VALID_PARAM( mbedtls_ecp_keypair_free( NULL ) );
31    TEST_VALID_PARAM( mbedtls_ecp_point_free( NULL ) );
32
33#if defined(MBEDTLS_ECP_RESTARTABLE)
34    TEST_VALID_PARAM( mbedtls_ecp_restart_free( NULL ) );
35#endif /* MBEDTLS_ECP_RESTARTABLE */
36
37exit:
38    return;
39}
40/* END_CASE */
41
42/* BEGIN_CASE depends_on:MBEDTLS_CHECK_PARAMS:!MBEDTLS_PARAM_FAILED_ALT */
43void ecp_invalid_param( )
44{
45    mbedtls_ecp_group grp;
46    mbedtls_ecp_keypair kp;
47    mbedtls_ecp_point P;
48    mbedtls_mpi m;
49    const char *x = "deadbeef";
50    int valid_fmt   = MBEDTLS_ECP_PF_UNCOMPRESSED;
51    int invalid_fmt = 42;
52    size_t olen;
53    unsigned char buf[42] = { 0 };
54    const unsigned char *null_buf = NULL;
55    mbedtls_ecp_group_id valid_group = MBEDTLS_ECP_DP_SECP192R1;
56#if defined(MBEDTLS_ECP_RESTARTABLE)
57    mbedtls_ecp_restart_ctx restart_ctx;
58#endif /* MBEDTLS_ECP_RESTARTABLE */
59
60    TEST_INVALID_PARAM( mbedtls_ecp_point_init( NULL ) );
61    TEST_INVALID_PARAM( mbedtls_ecp_keypair_init( NULL ) );
62    TEST_INVALID_PARAM( mbedtls_ecp_group_init( NULL ) );
63
64#if defined(MBEDTLS_ECP_RESTARTABLE)
65    TEST_INVALID_PARAM( mbedtls_ecp_restart_init( NULL ) );
66    TEST_INVALID_PARAM( mbedtls_ecp_check_budget( NULL, &restart_ctx, 42 ) );
67#endif /* MBEDTLS_ECP_RESTARTABLE */
68
69    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
70                            mbedtls_ecp_copy( NULL, &P ) );
71    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
72                            mbedtls_ecp_copy( &P, NULL ) );
73
74    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
75                            mbedtls_ecp_group_copy( NULL, &grp ) );
76    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
77                            mbedtls_ecp_group_copy( &grp, NULL ) );
78
79    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
80                            mbedtls_ecp_gen_privkey( NULL,
81                                                     &m,
82                                                     mbedtls_test_rnd_std_rand,
83                                                     NULL ) );
84    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
85                            mbedtls_ecp_gen_privkey( &grp,
86                                                     NULL,
87                                                     mbedtls_test_rnd_std_rand,
88                                                     NULL ) );
89    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
90                            mbedtls_ecp_gen_privkey( &grp,
91                                                     &m,
92                                                     NULL,
93                                                     NULL ) );
94
95    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
96                            mbedtls_ecp_set_zero( NULL ) );
97    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
98                            mbedtls_ecp_is_zero( NULL ) );
99
100    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
101                            mbedtls_ecp_point_cmp( NULL, &P ) );
102    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
103                            mbedtls_ecp_point_cmp( &P, NULL ) );
104
105    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
106                            mbedtls_ecp_point_read_string( NULL, 2,
107                                                           x, x ) );
108    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
109                            mbedtls_ecp_point_read_string( &P, 2,
110                                                           NULL, x ) );
111    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
112                            mbedtls_ecp_point_read_string( &P, 2,
113                                                           x, NULL ) );
114
115    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
116                            mbedtls_ecp_point_write_binary( NULL, &P,
117                                                      valid_fmt,
118                                                      &olen,
119                                                      buf, sizeof( buf ) ) );
120    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
121                            mbedtls_ecp_point_write_binary( &grp, NULL,
122                                                      valid_fmt,
123                                                      &olen,
124                                                      buf, sizeof( buf ) ) );
125    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
126                            mbedtls_ecp_point_write_binary( &grp, &P,
127                                                      invalid_fmt,
128                                                      &olen,
129                                                      buf, sizeof( buf ) ) );
130    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
131                            mbedtls_ecp_point_write_binary( &grp, &P,
132                                                      valid_fmt,
133                                                      NULL,
134                                                      buf, sizeof( buf ) ) );
135    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
136                            mbedtls_ecp_point_write_binary( &grp, &P,
137                                                      valid_fmt,
138                                                      &olen,
139                                                      NULL, sizeof( buf ) ) );
140
141    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
142                            mbedtls_ecp_point_read_binary( NULL, &P, buf,
143                                                     sizeof( buf ) ) );
144    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
145                            mbedtls_ecp_point_read_binary( &grp, NULL, buf,
146                                                     sizeof( buf ) ) );
147    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
148                            mbedtls_ecp_point_read_binary( &grp, &P, NULL,
149                                                     sizeof( buf ) ) );
150
151    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
152                            mbedtls_ecp_tls_read_point( NULL, &P,
153                                                 (const unsigned char **) &buf,
154                                                 sizeof( buf ) ) );
155    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
156                            mbedtls_ecp_tls_read_point( &grp, NULL,
157                                                 (const unsigned char **) &buf,
158                                                 sizeof( buf ) ) );
159    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
160                            mbedtls_ecp_tls_read_point( &grp, &P, &null_buf,
161                                                        sizeof( buf ) ) );
162    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
163                            mbedtls_ecp_tls_read_point( &grp, &P, NULL,
164                                                    sizeof( buf ) ) );
165
166    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
167                            mbedtls_ecp_tls_write_point( NULL, &P,
168                                                     valid_fmt,
169                                                     &olen,
170                                                     buf,
171                                                     sizeof( buf ) ) );
172    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
173                            mbedtls_ecp_tls_write_point( &grp, NULL,
174                                                     valid_fmt,
175                                                     &olen,
176                                                     buf,
177                                                     sizeof( buf ) ) );
178    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
179                            mbedtls_ecp_tls_write_point( &grp, &P,
180                                                     invalid_fmt,
181                                                     &olen,
182                                                     buf,
183                                                     sizeof( buf ) ) );
184    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
185                            mbedtls_ecp_tls_write_point( &grp, &P,
186                                                     valid_fmt,
187                                                     NULL,
188                                                     buf,
189                                                     sizeof( buf ) ) );
190    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
191                            mbedtls_ecp_tls_write_point( &grp, &P,
192                                                     valid_fmt,
193                                                     &olen,
194                                                     NULL,
195                                                     sizeof( buf ) ) );
196
197    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
198                            mbedtls_ecp_group_load( NULL, valid_group ) );
199
200    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
201                            mbedtls_ecp_tls_read_group( NULL,
202                                                 (const unsigned char **) &buf,
203                                                 sizeof( buf ) ) );
204    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
205                            mbedtls_ecp_tls_read_group( &grp, NULL,
206                                                        sizeof( buf ) ) );
207    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
208                            mbedtls_ecp_tls_read_group( &grp, &null_buf,
209                                                        sizeof( buf ) ) );
210
211    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
212                            mbedtls_ecp_tls_read_group_id( NULL,
213                                                 (const unsigned char **) &buf,
214                                                 sizeof( buf ) ) );
215    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
216                            mbedtls_ecp_tls_read_group_id( &valid_group, NULL,
217                                                        sizeof( buf ) ) );
218    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
219                            mbedtls_ecp_tls_read_group_id( &valid_group,
220                                                           &null_buf,
221                                                           sizeof( buf ) ) );
222
223    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
224                            mbedtls_ecp_tls_write_group( NULL, &olen,
225                                                       buf, sizeof( buf ) ) );
226    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
227                            mbedtls_ecp_tls_write_group( &grp, NULL,
228                                                       buf, sizeof( buf ) ) );
229    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
230                            mbedtls_ecp_tls_write_group( &grp, &olen,
231                                                       NULL, sizeof( buf ) ) );
232
233    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
234                            mbedtls_ecp_mul( NULL, &P, &m, &P,
235                                             mbedtls_test_rnd_std_rand,
236                                             NULL ) );
237    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
238                            mbedtls_ecp_mul( &grp, NULL, &m, &P,
239                                             mbedtls_test_rnd_std_rand,
240                                             NULL ) );
241    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
242                            mbedtls_ecp_mul( &grp, &P, NULL, &P,
243                                             mbedtls_test_rnd_std_rand,
244                                             NULL ) );
245    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
246                            mbedtls_ecp_mul( &grp, &P, &m, NULL,
247                                             mbedtls_test_rnd_std_rand,
248                                             NULL ) );
249
250    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
251                            mbedtls_ecp_mul_restartable( NULL, &P, &m, &P,
252                                                     mbedtls_test_rnd_std_rand,
253                                                     NULL , NULL ) );
254    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
255                            mbedtls_ecp_mul_restartable( &grp, NULL, &m, &P,
256                                                     mbedtls_test_rnd_std_rand,
257                                                     NULL , NULL ) );
258    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
259                            mbedtls_ecp_mul_restartable( &grp, &P, NULL, &P,
260                                                     mbedtls_test_rnd_std_rand,
261                                                     NULL , NULL ) );
262    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
263                            mbedtls_ecp_mul_restartable( &grp, &P, &m, NULL,
264                                                     mbedtls_test_rnd_std_rand,
265                                                     NULL , NULL ) );
266
267    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
268                            mbedtls_ecp_muladd( NULL, &P, &m, &P,
269                                                &m, &P ) );
270    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
271                            mbedtls_ecp_muladd( &grp, NULL, &m, &P,
272                                                &m, &P ) );
273    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
274                            mbedtls_ecp_muladd( &grp, &P, NULL, &P,
275                                                &m, &P ) );
276    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
277                            mbedtls_ecp_muladd( &grp, &P, &m, NULL,
278                                                &m, &P ) );
279    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
280                            mbedtls_ecp_muladd( &grp, &P, &m, &P,
281                                                NULL, &P ) );
282    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
283                            mbedtls_ecp_muladd( &grp, &P, &m, &P,
284                                                &m, NULL ) );
285
286    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
287                            mbedtls_ecp_muladd_restartable( NULL, &P, &m, &P,
288                                                            &m, &P, NULL ) );
289    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
290                            mbedtls_ecp_muladd_restartable( &grp, NULL, &m, &P,
291                                                            &m, &P, NULL ) );
292    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
293                            mbedtls_ecp_muladd_restartable( &grp, &P, NULL, &P,
294                                                            &m, &P, NULL ) );
295    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
296                            mbedtls_ecp_muladd_restartable( &grp, &P, &m, NULL,
297                                                            &m, &P, NULL ) );
298    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
299                            mbedtls_ecp_muladd_restartable( &grp, &P, &m, &P,
300                                                            NULL, &P, NULL ) );
301    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
302                            mbedtls_ecp_muladd_restartable( &grp, &P, &m, &P,
303                                                            &m, NULL, NULL ) );
304
305    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
306                            mbedtls_ecp_check_pubkey( NULL, &P ) );
307    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
308                            mbedtls_ecp_check_pubkey( &grp, NULL ) );
309
310    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
311                            mbedtls_ecp_check_pub_priv( NULL, &kp ) );
312    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
313                            mbedtls_ecp_check_pub_priv( &kp, NULL ) );
314
315    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
316                            mbedtls_ecp_check_privkey( NULL, &m ) );
317    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
318                            mbedtls_ecp_check_privkey( &grp, NULL ) );
319
320    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
321        mbedtls_ecp_gen_keypair_base( NULL, &P, &m, &P,
322                                      mbedtls_test_rnd_std_rand, NULL ) );
323
324    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
325        mbedtls_ecp_gen_keypair_base( &grp, NULL, &m, &P,
326                                      mbedtls_test_rnd_std_rand, NULL ) );
327
328    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
329        mbedtls_ecp_gen_keypair_base( &grp, &P, NULL, &P,
330                                      mbedtls_test_rnd_std_rand, NULL ) );
331
332    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
333        mbedtls_ecp_gen_keypair_base( &grp, &P, &m, NULL,
334                                      mbedtls_test_rnd_std_rand, NULL ) );
335
336    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
337        mbedtls_ecp_gen_keypair_base( &grp, &P, &m, &P, NULL, NULL ) );
338
339    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
340                            mbedtls_ecp_gen_keypair( NULL,
341                                                     &m, &P,
342                                                     mbedtls_test_rnd_std_rand,
343                                                     NULL ) );
344    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
345                            mbedtls_ecp_gen_keypair( &grp,
346                                                     NULL, &P,
347                                                     mbedtls_test_rnd_std_rand,
348                                                     NULL ) );
349    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
350                            mbedtls_ecp_gen_keypair( &grp,
351                                                     &m, NULL,
352                                                     mbedtls_test_rnd_std_rand,
353                                                     NULL ) );
354    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
355                            mbedtls_ecp_gen_keypair( &grp,
356                                                     &m, &P,
357                                                     NULL,
358                                                     NULL ) );
359
360    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
361                            mbedtls_ecp_gen_key( valid_group, NULL,
362                                                 mbedtls_test_rnd_std_rand,
363                                                 NULL ) );
364    TEST_INVALID_PARAM_RET( MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
365                            mbedtls_ecp_gen_key( valid_group, &kp,
366                                                 NULL, NULL ) );
367
368exit:
369    return;
370}
371/* END_CASE */
372
373/* BEGIN_CASE */
374void mbedtls_ecp_curve_info( int id, int tls_id, int size, char * name )
375{
376    const mbedtls_ecp_curve_info *by_id, *by_tls, *by_name;
377
378    by_id   = mbedtls_ecp_curve_info_from_grp_id( id     );
379    by_tls  = mbedtls_ecp_curve_info_from_tls_id( tls_id );
380    by_name = mbedtls_ecp_curve_info_from_name(   name   );
381    TEST_ASSERT( by_id   != NULL );
382    TEST_ASSERT( by_tls  != NULL );
383    TEST_ASSERT( by_name != NULL );
384
385    TEST_ASSERT( by_id == by_tls  );
386    TEST_ASSERT( by_id == by_name );
387
388    TEST_ASSERT( by_id->bit_size == size );
389    TEST_ASSERT( size <= MBEDTLS_ECP_MAX_BITS );
390    TEST_ASSERT( size <= MBEDTLS_ECP_MAX_BYTES * 8 );
391}
392/* END_CASE */
393
394/* BEGIN_CASE */
395void ecp_check_pub( int grp_id, char * x_hex, char * y_hex, char * z_hex,
396                    int ret )
397{
398    mbedtls_ecp_group grp;
399    mbedtls_ecp_point P;
400
401    mbedtls_ecp_group_init( &grp );
402    mbedtls_ecp_point_init( &P );
403
404    TEST_ASSERT( mbedtls_ecp_group_load( &grp, grp_id ) == 0 );
405
406    TEST_ASSERT( mbedtls_test_read_mpi( &P.X, 16, x_hex ) == 0 );
407    TEST_ASSERT( mbedtls_test_read_mpi( &P.Y, 16, y_hex ) == 0 );
408    TEST_ASSERT( mbedtls_test_read_mpi( &P.Z, 16, z_hex ) == 0 );
409
410    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &P ) == ret );
411
412exit:
413    mbedtls_ecp_group_free( &grp );
414    mbedtls_ecp_point_free( &P );
415}
416/* END_CASE */
417
418/* BEGIN_CASE depends_on:MBEDTLS_ECP_RESTARTABLE */
419void ecp_test_vect_restart( int id,
420                            char *dA_str, char *xA_str, char *yA_str,
421                            char *dB_str,  char *xZ_str, char *yZ_str,
422                            int max_ops, int min_restarts, int max_restarts )
423{
424    /*
425     * Test for early restart. Based on test vectors like ecp_test_vect(),
426     * but for the sake of simplicity only does half of each side. It's
427     * important to test both base point and random point, though, as memory
428     * management is different in each case.
429     *
430     * Don't try using too precise bounds for restarts as the exact number
431     * will depend on settings such as MBEDTLS_ECP_FIXED_POINT_OPTIM and
432     * MBEDTLS_ECP_WINDOW_SIZE, as well as implementation details that may
433     * change in the future. A factor 2 is a minimum safety margin.
434     *
435     * For reference, with mbed TLS 2.4 and default settings, for P-256:
436     * - Random point mult:     ~3250M
437     * - Cold base point mult:  ~3300M
438     * - Hot base point mult:   ~1100M
439     * With MBEDTLS_ECP_WINDOW_SIZE set to 2 (minimum):
440     * - Random point mult:     ~3850M
441     */
442    mbedtls_ecp_restart_ctx ctx;
443    mbedtls_ecp_group grp;
444    mbedtls_ecp_point R, P;
445    mbedtls_mpi dA, xA, yA, dB, xZ, yZ;
446    int cnt_restarts;
447    int ret;
448
449    mbedtls_ecp_restart_init( &ctx );
450    mbedtls_ecp_group_init( &grp );
451    mbedtls_ecp_point_init( &R ); mbedtls_ecp_point_init( &P );
452    mbedtls_mpi_init( &dA ); mbedtls_mpi_init( &xA ); mbedtls_mpi_init( &yA );
453    mbedtls_mpi_init( &dB ); mbedtls_mpi_init( &xZ ); mbedtls_mpi_init( &yZ );
454
455    TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
456
457    TEST_ASSERT( mbedtls_test_read_mpi( &dA, 16, dA_str ) == 0 );
458    TEST_ASSERT( mbedtls_test_read_mpi( &xA, 16, xA_str ) == 0 );
459    TEST_ASSERT( mbedtls_test_read_mpi( &yA, 16, yA_str ) == 0 );
460
461    TEST_ASSERT( mbedtls_test_read_mpi( &dB, 16, dB_str ) == 0 );
462    TEST_ASSERT( mbedtls_test_read_mpi( &xZ, 16, xZ_str ) == 0 );
463    TEST_ASSERT( mbedtls_test_read_mpi( &yZ, 16, yZ_str ) == 0 );
464
465    mbedtls_ecp_set_max_ops( (unsigned) max_ops );
466
467    /* Base point case */
468    cnt_restarts = 0;
469    do {
470        ECP_PT_RESET( &R );
471        ret = mbedtls_ecp_mul_restartable( &grp, &R, &dA, &grp.G, NULL, NULL, &ctx );
472    } while( ret == MBEDTLS_ERR_ECP_IN_PROGRESS && ++cnt_restarts );
473
474    TEST_ASSERT( ret == 0 );
475    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.X, &xA ) == 0 );
476    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.Y, &yA ) == 0 );
477
478    TEST_ASSERT( cnt_restarts >= min_restarts );
479    TEST_ASSERT( cnt_restarts <= max_restarts );
480
481    /* Non-base point case */
482    mbedtls_ecp_copy( &P, &R );
483    cnt_restarts = 0;
484    do {
485        ECP_PT_RESET( &R );
486        ret = mbedtls_ecp_mul_restartable( &grp, &R, &dB, &P, NULL, NULL, &ctx );
487    } while( ret == MBEDTLS_ERR_ECP_IN_PROGRESS && ++cnt_restarts );
488
489    TEST_ASSERT( ret == 0 );
490    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.X, &xZ ) == 0 );
491    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.Y, &yZ ) == 0 );
492
493    TEST_ASSERT( cnt_restarts >= min_restarts );
494    TEST_ASSERT( cnt_restarts <= max_restarts );
495
496    /* Do we leak memory when aborting an operation?
497     * This test only makes sense when we actually restart */
498    if( min_restarts > 0 )
499    {
500        ret = mbedtls_ecp_mul_restartable( &grp, &R, &dB, &P, NULL, NULL, &ctx );
501        TEST_ASSERT( ret == MBEDTLS_ERR_ECP_IN_PROGRESS );
502    }
503
504exit:
505    mbedtls_ecp_restart_free( &ctx );
506    mbedtls_ecp_group_free( &grp );
507    mbedtls_ecp_point_free( &R ); mbedtls_ecp_point_free( &P );
508    mbedtls_mpi_free( &dA ); mbedtls_mpi_free( &xA ); mbedtls_mpi_free( &yA );
509    mbedtls_mpi_free( &dB ); mbedtls_mpi_free( &xZ ); mbedtls_mpi_free( &yZ );
510}
511/* END_CASE */
512
513/* BEGIN_CASE depends_on:MBEDTLS_ECP_RESTARTABLE */
514void ecp_muladd_restart( int id, char *xR_str, char *yR_str,
515                         char *u1_str, char *u2_str,
516                         char *xQ_str, char *yQ_str,
517                         int max_ops, int min_restarts, int max_restarts )
518{
519    /*
520     * Compute R = u1 * G + u2 * Q
521     * (test vectors mostly taken from ECDSA intermediate results)
522     *
523     * See comments at the top of ecp_test_vect_restart()
524     */
525    mbedtls_ecp_restart_ctx ctx;
526    mbedtls_ecp_group grp;
527    mbedtls_ecp_point R, Q;
528    mbedtls_mpi u1, u2, xR, yR;
529    int cnt_restarts;
530    int ret;
531
532    mbedtls_ecp_restart_init( &ctx );
533    mbedtls_ecp_group_init( &grp );
534    mbedtls_ecp_point_init( &R );
535    mbedtls_ecp_point_init( &Q );
536    mbedtls_mpi_init( &u1 ); mbedtls_mpi_init( &u2 );
537    mbedtls_mpi_init( &xR ); mbedtls_mpi_init( &yR );
538
539    TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
540
541    TEST_ASSERT( mbedtls_test_read_mpi( &u1, 16, u1_str ) == 0 );
542    TEST_ASSERT( mbedtls_test_read_mpi( &u2, 16, u2_str ) == 0 );
543    TEST_ASSERT( mbedtls_test_read_mpi( &xR, 16, xR_str ) == 0 );
544    TEST_ASSERT( mbedtls_test_read_mpi( &yR, 16, yR_str ) == 0 );
545
546    TEST_ASSERT( mbedtls_test_read_mpi( &Q.X, 16, xQ_str ) == 0 );
547    TEST_ASSERT( mbedtls_test_read_mpi( &Q.Y, 16, yQ_str ) == 0 );
548    TEST_ASSERT( mbedtls_mpi_lset( &Q.Z, 1 ) == 0 );
549
550    mbedtls_ecp_set_max_ops( (unsigned) max_ops );
551
552    cnt_restarts = 0;
553    do {
554        ECP_PT_RESET( &R );
555        ret = mbedtls_ecp_muladd_restartable( &grp, &R,
556                                              &u1, &grp.G, &u2, &Q, &ctx );
557    } while( ret == MBEDTLS_ERR_ECP_IN_PROGRESS && ++cnt_restarts );
558
559    TEST_ASSERT( ret == 0 );
560    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.X, &xR ) == 0 );
561    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.Y, &yR ) == 0 );
562
563    TEST_ASSERT( cnt_restarts >= min_restarts );
564    TEST_ASSERT( cnt_restarts <= max_restarts );
565
566    /* Do we leak memory when aborting an operation?
567     * This test only makes sense when we actually restart */
568    if( min_restarts > 0 )
569    {
570        ret = mbedtls_ecp_muladd_restartable( &grp, &R,
571                                              &u1, &grp.G, &u2, &Q, &ctx );
572        TEST_ASSERT( ret == MBEDTLS_ERR_ECP_IN_PROGRESS );
573    }
574
575exit:
576    mbedtls_ecp_restart_free( &ctx );
577    mbedtls_ecp_group_free( &grp );
578    mbedtls_ecp_point_free( &R );
579    mbedtls_ecp_point_free( &Q );
580    mbedtls_mpi_free( &u1 ); mbedtls_mpi_free( &u2 );
581    mbedtls_mpi_free( &xR ); mbedtls_mpi_free( &yR );
582}
583/* END_CASE */
584
585/* BEGIN_CASE */
586void ecp_test_vect( int id, char * dA_str, char * xA_str, char * yA_str,
587                    char * dB_str, char * xB_str, char * yB_str,
588                    char * xZ_str, char * yZ_str )
589{
590    mbedtls_ecp_group grp;
591    mbedtls_ecp_point R;
592    mbedtls_mpi dA, xA, yA, dB, xB, yB, xZ, yZ;
593    mbedtls_test_rnd_pseudo_info rnd_info;
594
595    mbedtls_ecp_group_init( &grp ); mbedtls_ecp_point_init( &R );
596    mbedtls_mpi_init( &dA ); mbedtls_mpi_init( &xA ); mbedtls_mpi_init( &yA ); mbedtls_mpi_init( &dB );
597    mbedtls_mpi_init( &xB ); mbedtls_mpi_init( &yB ); mbedtls_mpi_init( &xZ ); mbedtls_mpi_init( &yZ );
598    memset( &rnd_info, 0x00, sizeof( mbedtls_test_rnd_pseudo_info ) );
599
600    TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
601
602    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &grp.G ) == 0 );
603
604    TEST_ASSERT( mbedtls_test_read_mpi( &dA, 16, dA_str ) == 0 );
605    TEST_ASSERT( mbedtls_test_read_mpi( &xA, 16, xA_str ) == 0 );
606    TEST_ASSERT( mbedtls_test_read_mpi( &yA, 16, yA_str ) == 0 );
607    TEST_ASSERT( mbedtls_test_read_mpi( &dB, 16, dB_str ) == 0 );
608    TEST_ASSERT( mbedtls_test_read_mpi( &xB, 16, xB_str ) == 0 );
609    TEST_ASSERT( mbedtls_test_read_mpi( &yB, 16, yB_str ) == 0 );
610    TEST_ASSERT( mbedtls_test_read_mpi( &xZ, 16, xZ_str ) == 0 );
611    TEST_ASSERT( mbedtls_test_read_mpi( &yZ, 16, yZ_str ) == 0 );
612
613    TEST_ASSERT( mbedtls_ecp_mul( &grp, &R, &dA, &grp.G,
614                          &mbedtls_test_rnd_pseudo_rand, &rnd_info ) == 0 );
615    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.X, &xA ) == 0 );
616    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.Y, &yA ) == 0 );
617    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &R ) == 0 );
618    TEST_ASSERT( mbedtls_ecp_mul( &grp, &R, &dB, &R, NULL, NULL ) == 0 );
619    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.X, &xZ ) == 0 );
620    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.Y, &yZ ) == 0 );
621    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &R ) == 0 );
622
623    TEST_ASSERT( mbedtls_ecp_mul( &grp, &R, &dB, &grp.G, NULL, NULL ) == 0 );
624    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.X, &xB ) == 0 );
625    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.Y, &yB ) == 0 );
626    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &R ) == 0 );
627    TEST_ASSERT( mbedtls_ecp_mul( &grp, &R, &dA, &R,
628                          &mbedtls_test_rnd_pseudo_rand, &rnd_info ) == 0 );
629    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.X, &xZ ) == 0 );
630    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.Y, &yZ ) == 0 );
631    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &R ) == 0 );
632
633exit:
634    mbedtls_ecp_group_free( &grp ); mbedtls_ecp_point_free( &R );
635    mbedtls_mpi_free( &dA ); mbedtls_mpi_free( &xA ); mbedtls_mpi_free( &yA ); mbedtls_mpi_free( &dB );
636    mbedtls_mpi_free( &xB ); mbedtls_mpi_free( &yB ); mbedtls_mpi_free( &xZ ); mbedtls_mpi_free( &yZ );
637}
638/* END_CASE */
639
640/* BEGIN_CASE */
641void ecp_test_vec_x( int id, char * dA_hex, char * xA_hex, char * dB_hex,
642                     char * xB_hex, char * xS_hex )
643{
644    mbedtls_ecp_group grp;
645    mbedtls_ecp_point R;
646    mbedtls_mpi dA, xA, dB, xB, xS;
647    mbedtls_test_rnd_pseudo_info rnd_info;
648
649    mbedtls_ecp_group_init( &grp ); mbedtls_ecp_point_init( &R );
650    mbedtls_mpi_init( &dA ); mbedtls_mpi_init( &xA );
651    mbedtls_mpi_init( &dB ); mbedtls_mpi_init( &xB );
652    mbedtls_mpi_init( &xS );
653    memset( &rnd_info, 0x00, sizeof( mbedtls_test_rnd_pseudo_info ) );
654
655    TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
656
657    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &grp.G ) == 0 );
658
659    TEST_ASSERT( mbedtls_test_read_mpi( &dA, 16, dA_hex ) == 0 );
660    TEST_ASSERT( mbedtls_test_read_mpi( &dB, 16, dB_hex ) == 0 );
661    TEST_ASSERT( mbedtls_test_read_mpi( &xA, 16, xA_hex ) == 0 );
662    TEST_ASSERT( mbedtls_test_read_mpi( &xB, 16, xB_hex ) == 0 );
663    TEST_ASSERT( mbedtls_test_read_mpi( &xS, 16, xS_hex ) == 0 );
664
665    TEST_ASSERT( mbedtls_ecp_mul( &grp, &R, &dA, &grp.G,
666                          &mbedtls_test_rnd_pseudo_rand, &rnd_info ) == 0 );
667    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &R ) == 0 );
668    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.X, &xA ) == 0 );
669
670    TEST_ASSERT( mbedtls_ecp_mul( &grp, &R, &dB, &R,
671                          &mbedtls_test_rnd_pseudo_rand, &rnd_info ) == 0 );
672    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &R ) == 0 );
673    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.X, &xS ) == 0 );
674
675    TEST_ASSERT( mbedtls_ecp_mul( &grp, &R, &dB, &grp.G, NULL, NULL ) == 0 );
676    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &R ) == 0 );
677    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.X, &xB ) == 0 );
678
679    TEST_ASSERT( mbedtls_ecp_mul( &grp, &R, &dA, &R, NULL, NULL ) == 0 );
680    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &R ) == 0 );
681    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &R.X, &xS ) == 0 );
682
683exit:
684    mbedtls_ecp_group_free( &grp ); mbedtls_ecp_point_free( &R );
685    mbedtls_mpi_free( &dA ); mbedtls_mpi_free( &xA );
686    mbedtls_mpi_free( &dB ); mbedtls_mpi_free( &xB );
687    mbedtls_mpi_free( &xS );
688}
689/* END_CASE */
690
691/* BEGIN_CASE */
692void ecp_test_mul( int id, data_t * n_hex,
693                   data_t *  Px_hex, data_t *  Py_hex, data_t *  Pz_hex,
694                   data_t * nPx_hex, data_t * nPy_hex, data_t * nPz_hex,
695                   int expected_ret )
696{
697    mbedtls_ecp_group grp;
698    mbedtls_ecp_point P, nP, R;
699    mbedtls_mpi n;
700    mbedtls_test_rnd_pseudo_info rnd_info;
701
702    mbedtls_ecp_group_init( &grp ); mbedtls_ecp_point_init( &R );
703    mbedtls_ecp_point_init( &P ); mbedtls_ecp_point_init( &nP );
704    mbedtls_mpi_init( &n );
705    memset( &rnd_info, 0x00, sizeof( mbedtls_test_rnd_pseudo_info ) );
706
707    TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
708
709    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &grp.G ) == 0 );
710
711    TEST_ASSERT( mbedtls_mpi_read_binary( &n, n_hex->x, n_hex->len ) == 0 );
712
713    TEST_ASSERT( mbedtls_mpi_read_binary( &P.X, Px_hex->x, Px_hex->len ) == 0 );
714    TEST_ASSERT( mbedtls_mpi_read_binary( &P.Y, Py_hex->x, Py_hex->len ) == 0 );
715    TEST_ASSERT( mbedtls_mpi_read_binary( &P.Z, Pz_hex->x, Pz_hex->len ) == 0 );
716    TEST_ASSERT( mbedtls_mpi_read_binary( &nP.X, nPx_hex->x, nPx_hex->len )
717                 == 0 );
718    TEST_ASSERT( mbedtls_mpi_read_binary( &nP.Y, nPy_hex->x, nPy_hex->len )
719                 == 0 );
720    TEST_ASSERT( mbedtls_mpi_read_binary( &nP.Z, nPz_hex->x, nPz_hex->len )
721                 == 0 );
722
723    TEST_ASSERT( mbedtls_ecp_mul( &grp, &R, &n, &P,
724                                  &mbedtls_test_rnd_pseudo_rand, &rnd_info )
725                 == expected_ret );
726
727    if( expected_ret == 0 )
728    {
729        TEST_ASSERT( mbedtls_mpi_cmp_mpi( &nP.X, &R.X ) == 0 );
730        TEST_ASSERT( mbedtls_mpi_cmp_mpi( &nP.Y, &R.Y ) == 0 );
731        TEST_ASSERT( mbedtls_mpi_cmp_mpi( &nP.Z, &R.Z ) == 0 );
732    }
733
734exit:
735    mbedtls_ecp_group_free( &grp ); mbedtls_ecp_point_free( &R );
736    mbedtls_ecp_point_free( &P ); mbedtls_ecp_point_free( &nP );
737    mbedtls_mpi_free( &n );
738}
739/* END_CASE */
740
741/* BEGIN_CASE */
742void ecp_test_mul_rng( int id, data_t * d_hex)
743{
744    mbedtls_ecp_group grp;
745    mbedtls_mpi d;
746    mbedtls_ecp_point Q;
747
748    mbedtls_ecp_group_init( &grp ); mbedtls_mpi_init( &d );
749    mbedtls_ecp_point_init( &Q );
750
751    TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
752
753    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &grp.G ) == 0 );
754
755    TEST_ASSERT( mbedtls_mpi_read_binary( &d, d_hex->x, d_hex->len ) == 0 );
756
757    TEST_ASSERT( mbedtls_ecp_mul( &grp, &Q, &d, &grp.G,
758                                  &mbedtls_test_rnd_zero_rand, NULL )
759                 == MBEDTLS_ERR_ECP_RANDOM_FAILED );
760
761exit:
762    mbedtls_ecp_group_free( &grp ); mbedtls_mpi_free( &d );
763    mbedtls_ecp_point_free( &Q );
764}
765/* END_CASE */
766
767/* BEGIN_CASE depends_on:MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
768void ecp_muladd( int id,
769                 data_t *u1_bin, data_t *P1_bin,
770                 data_t *u2_bin, data_t *P2_bin,
771                 data_t *expected_result )
772{
773    /* Compute R = u1 * P1 + u2 * P2 */
774    mbedtls_ecp_group grp;
775    mbedtls_ecp_point P1, P2, R;
776    mbedtls_mpi u1, u2;
777    uint8_t actual_result[MBEDTLS_ECP_MAX_PT_LEN];
778    size_t len;
779
780    mbedtls_ecp_group_init( &grp );
781    mbedtls_ecp_point_init( &P1 );
782    mbedtls_ecp_point_init( &P2 );
783    mbedtls_ecp_point_init( &R );
784    mbedtls_mpi_init( &u1 );
785    mbedtls_mpi_init( &u2 );
786
787    TEST_EQUAL( 0, mbedtls_ecp_group_load( &grp, id ) );
788    TEST_EQUAL( 0, mbedtls_mpi_read_binary( &u1, u1_bin->x, u1_bin->len ) );
789    TEST_EQUAL( 0, mbedtls_mpi_read_binary( &u2, u2_bin->x, u2_bin->len ) );
790    TEST_EQUAL( 0, mbedtls_ecp_point_read_binary( &grp, &P1,
791                                                  P1_bin->x, P1_bin->len ) );
792    TEST_EQUAL( 0, mbedtls_ecp_point_read_binary( &grp, &P2,
793                                                  P2_bin->x, P2_bin->len ) );
794
795    TEST_EQUAL( 0, mbedtls_ecp_muladd( &grp, &R, &u1, &P1, &u2, &P2 ) );
796    TEST_EQUAL( 0, mbedtls_ecp_point_write_binary(
797                    &grp, &R, MBEDTLS_ECP_PF_UNCOMPRESSED,
798                    &len, actual_result, sizeof( actual_result ) ) );
799    TEST_ASSERT( len <= MBEDTLS_ECP_MAX_PT_LEN );
800
801    ASSERT_COMPARE( expected_result->x, expected_result->len,
802                    actual_result, len );
803
804exit:
805    mbedtls_ecp_group_free( &grp );
806    mbedtls_ecp_point_free( &P1 );
807    mbedtls_ecp_point_free( &P2 );
808    mbedtls_ecp_point_free( &R );
809    mbedtls_mpi_free( &u1 );
810    mbedtls_mpi_free( &u2 );
811}
812/* END_CASE */
813
814/* BEGIN_CASE */
815void ecp_fast_mod( int id, char * N_str )
816{
817    mbedtls_ecp_group grp;
818    mbedtls_mpi N, R;
819
820    mbedtls_mpi_init( &N ); mbedtls_mpi_init( &R );
821    mbedtls_ecp_group_init( &grp );
822
823    TEST_ASSERT( mbedtls_test_read_mpi( &N, 16, N_str ) == 0 );
824    TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
825    TEST_ASSERT( grp.modp != NULL );
826
827    /*
828     * Store correct result before we touch N
829     */
830    TEST_ASSERT( mbedtls_mpi_mod_mpi( &R, &N, &grp.P ) == 0 );
831
832    TEST_ASSERT( grp.modp( &N ) == 0 );
833    TEST_ASSERT( mbedtls_mpi_bitlen( &N ) <= grp.pbits + 3 );
834
835    /*
836     * Use mod rather than addition/subtraction in case previous test fails
837     */
838    TEST_ASSERT( mbedtls_mpi_mod_mpi( &N, &N, &grp.P ) == 0 );
839    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &N, &R ) == 0 );
840
841exit:
842    mbedtls_mpi_free( &N ); mbedtls_mpi_free( &R );
843    mbedtls_ecp_group_free( &grp );
844}
845/* END_CASE */
846
847/* BEGIN_CASE */
848void ecp_write_binary( int id, char * x, char * y, char * z, int format,
849                       data_t * out, int blen, int ret )
850{
851    mbedtls_ecp_group grp;
852    mbedtls_ecp_point P;
853    unsigned char buf[256];
854    size_t olen;
855
856    memset( buf, 0, sizeof( buf ) );
857
858    mbedtls_ecp_group_init( &grp ); mbedtls_ecp_point_init( &P );
859
860    TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
861
862    TEST_ASSERT( mbedtls_test_read_mpi( &P.X, 16, x ) == 0 );
863    TEST_ASSERT( mbedtls_test_read_mpi( &P.Y, 16, y ) == 0 );
864    TEST_ASSERT( mbedtls_test_read_mpi( &P.Z, 16, z ) == 0 );
865
866    TEST_ASSERT( mbedtls_ecp_point_write_binary( &grp, &P, format,
867                                   &olen, buf, blen ) == ret );
868
869    if( ret == 0 )
870    {
871        TEST_ASSERT( olen <= MBEDTLS_ECP_MAX_PT_LEN );
872        TEST_ASSERT( mbedtls_test_hexcmp( buf, out->x, olen, out->len ) == 0 );
873    }
874
875exit:
876    mbedtls_ecp_group_free( &grp ); mbedtls_ecp_point_free( &P );
877}
878/* END_CASE */
879
880/* BEGIN_CASE */
881void ecp_read_binary( int id, data_t * buf, char * x, char * y, char * z,
882                      int ret )
883{
884    mbedtls_ecp_group grp;
885    mbedtls_ecp_point P;
886    mbedtls_mpi X, Y, Z;
887
888
889    mbedtls_ecp_group_init( &grp ); mbedtls_ecp_point_init( &P );
890    mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y ); mbedtls_mpi_init( &Z );
891
892    TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
893
894    TEST_ASSERT( mbedtls_test_read_mpi( &X, 16, x ) == 0 );
895    TEST_ASSERT( mbedtls_test_read_mpi( &Y, 16, y ) == 0 );
896    TEST_ASSERT( mbedtls_test_read_mpi( &Z, 16, z ) == 0 );
897
898    TEST_ASSERT( mbedtls_ecp_point_read_binary( &grp, &P, buf->x, buf->len ) == ret );
899
900    if( ret == 0 )
901    {
902        TEST_ASSERT( mbedtls_mpi_cmp_mpi( &P.X, &X ) == 0 );
903        if( mbedtls_ecp_get_type( &grp ) == MBEDTLS_ECP_TYPE_MONTGOMERY )
904        {
905            TEST_ASSERT( mbedtls_mpi_cmp_int( &Y, 0 ) == 0 );
906            TEST_ASSERT( P.Y.p == NULL );
907            TEST_ASSERT( mbedtls_mpi_cmp_int( &Z, 1 ) == 0 );
908            TEST_ASSERT( mbedtls_mpi_cmp_int( &P.Z, 1 ) == 0 );
909        }
910        else
911        {
912            TEST_ASSERT( mbedtls_mpi_cmp_mpi( &P.Y, &Y ) == 0 );
913            TEST_ASSERT( mbedtls_mpi_cmp_mpi( &P.Z, &Z ) == 0 );
914        }
915    }
916
917exit:
918    mbedtls_ecp_group_free( &grp ); mbedtls_ecp_point_free( &P );
919    mbedtls_mpi_free( &X ); mbedtls_mpi_free( &Y ); mbedtls_mpi_free( &Z );
920}
921/* END_CASE */
922
923/* BEGIN_CASE */
924void mbedtls_ecp_tls_read_point( int id, data_t * buf, char * x, char * y,
925                                 char * z, int ret )
926{
927    mbedtls_ecp_group grp;
928    mbedtls_ecp_point P;
929    mbedtls_mpi X, Y, Z;
930    const unsigned char *vbuf = buf->x;
931
932
933    mbedtls_ecp_group_init( &grp ); mbedtls_ecp_point_init( &P );
934    mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y ); mbedtls_mpi_init( &Z );
935
936    TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
937
938    TEST_ASSERT( mbedtls_test_read_mpi( &X, 16, x ) == 0 );
939    TEST_ASSERT( mbedtls_test_read_mpi( &Y, 16, y ) == 0 );
940    TEST_ASSERT( mbedtls_test_read_mpi( &Z, 16, z ) == 0 );
941
942    TEST_ASSERT( mbedtls_ecp_tls_read_point( &grp, &P, &vbuf, buf->len ) == ret );
943
944    if( ret == 0 )
945    {
946        TEST_ASSERT( mbedtls_mpi_cmp_mpi( &P.X, &X ) == 0 );
947        TEST_ASSERT( mbedtls_mpi_cmp_mpi( &P.Y, &Y ) == 0 );
948        TEST_ASSERT( mbedtls_mpi_cmp_mpi( &P.Z, &Z ) == 0 );
949        TEST_ASSERT( (uint32_t)( vbuf - buf->x ) == buf->len );
950    }
951
952exit:
953    mbedtls_ecp_group_free( &grp ); mbedtls_ecp_point_free( &P );
954    mbedtls_mpi_free( &X ); mbedtls_mpi_free( &Y ); mbedtls_mpi_free( &Z );
955}
956/* END_CASE */
957
958/* BEGIN_CASE */
959void ecp_tls_write_read_point( int id )
960{
961    mbedtls_ecp_group grp;
962    mbedtls_ecp_point pt;
963    unsigned char buf[256];
964    const unsigned char *vbuf;
965    size_t olen;
966
967    mbedtls_ecp_group_init( &grp );
968    mbedtls_ecp_point_init( &pt );
969
970    TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
971
972    memset( buf, 0x00, sizeof( buf ) ); vbuf = buf;
973    TEST_ASSERT( mbedtls_ecp_tls_write_point( &grp, &grp.G,
974                    MBEDTLS_ECP_PF_COMPRESSED, &olen, buf, 256 ) == 0 );
975    TEST_ASSERT( mbedtls_ecp_tls_read_point( &grp, &pt, &vbuf, olen )
976                 == MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
977    TEST_ASSERT( vbuf == buf + olen );
978
979    memset( buf, 0x00, sizeof( buf ) ); vbuf = buf;
980    TEST_ASSERT( mbedtls_ecp_tls_write_point( &grp, &grp.G,
981                    MBEDTLS_ECP_PF_UNCOMPRESSED, &olen, buf, 256 ) == 0 );
982    TEST_ASSERT( mbedtls_ecp_tls_read_point( &grp, &pt, &vbuf, olen ) == 0 );
983    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &grp.G.X, &pt.X ) == 0 );
984    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &grp.G.Y, &pt.Y ) == 0 );
985    TEST_ASSERT( mbedtls_mpi_cmp_mpi( &grp.G.Z, &pt.Z ) == 0 );
986    TEST_ASSERT( vbuf == buf + olen );
987
988    memset( buf, 0x00, sizeof( buf ) ); vbuf = buf;
989    TEST_ASSERT( mbedtls_ecp_set_zero( &pt ) == 0 );
990    TEST_ASSERT( mbedtls_ecp_tls_write_point( &grp, &pt,
991                    MBEDTLS_ECP_PF_COMPRESSED, &olen, buf, 256 ) == 0 );
992    TEST_ASSERT( mbedtls_ecp_tls_read_point( &grp, &pt, &vbuf, olen ) == 0 );
993    TEST_ASSERT( mbedtls_ecp_is_zero( &pt ) );
994    TEST_ASSERT( vbuf == buf + olen );
995
996    memset( buf, 0x00, sizeof( buf ) ); vbuf = buf;
997    TEST_ASSERT( mbedtls_ecp_set_zero( &pt ) == 0 );
998    TEST_ASSERT( mbedtls_ecp_tls_write_point( &grp, &pt,
999                    MBEDTLS_ECP_PF_UNCOMPRESSED, &olen, buf, 256 ) == 0 );
1000    TEST_ASSERT( mbedtls_ecp_tls_read_point( &grp, &pt, &vbuf, olen ) == 0 );
1001    TEST_ASSERT( mbedtls_ecp_is_zero( &pt ) );
1002    TEST_ASSERT( vbuf == buf + olen );
1003
1004exit:
1005    mbedtls_ecp_group_free( &grp );
1006    mbedtls_ecp_point_free( &pt );
1007}
1008/* END_CASE */
1009
1010/* BEGIN_CASE */
1011void mbedtls_ecp_tls_read_group( data_t * buf, int result, int bits,
1012                                 int record_len )
1013{
1014    mbedtls_ecp_group grp;
1015    const unsigned char *vbuf = buf->x;
1016    int ret;
1017
1018    mbedtls_ecp_group_init( &grp );
1019
1020    ret = mbedtls_ecp_tls_read_group( &grp, &vbuf, buf->len );
1021
1022    TEST_ASSERT( ret == result );
1023    if( ret == 0)
1024    {
1025        TEST_ASSERT( mbedtls_mpi_bitlen( &grp.P ) == (size_t) bits );
1026        TEST_ASSERT( vbuf - buf->x ==  record_len);
1027    }
1028
1029exit:
1030    mbedtls_ecp_group_free( &grp );
1031}
1032/* END_CASE */
1033
1034/* BEGIN_CASE */
1035void ecp_tls_write_read_group( int id )
1036{
1037    mbedtls_ecp_group grp1, grp2;
1038    unsigned char buf[10];
1039    const unsigned char *vbuf = buf;
1040    size_t len;
1041    int ret;
1042
1043    mbedtls_ecp_group_init( &grp1 );
1044    mbedtls_ecp_group_init( &grp2 );
1045    memset( buf, 0x00, sizeof( buf ) );
1046
1047    TEST_ASSERT( mbedtls_ecp_group_load( &grp1, id ) == 0 );
1048
1049    TEST_ASSERT( mbedtls_ecp_tls_write_group( &grp1, &len, buf, 10 ) == 0 );
1050    ret = mbedtls_ecp_tls_read_group( &grp2, &vbuf, len );
1051    TEST_ASSERT( ret == 0 );
1052
1053    if( ret == 0 )
1054    {
1055        TEST_ASSERT( mbedtls_mpi_cmp_mpi( &grp1.N, &grp2.N ) == 0 );
1056        TEST_ASSERT( grp1.id == grp2.id );
1057    }
1058
1059exit:
1060    mbedtls_ecp_group_free( &grp1 );
1061    mbedtls_ecp_group_free( &grp2 );
1062}
1063/* END_CASE */
1064
1065/* BEGIN_CASE */
1066void mbedtls_ecp_check_privkey( int id, char * key_hex, int ret )
1067{
1068    mbedtls_ecp_group grp;
1069    mbedtls_mpi d;
1070
1071    mbedtls_ecp_group_init( &grp );
1072    mbedtls_mpi_init( &d );
1073
1074    TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
1075    TEST_ASSERT( mbedtls_test_read_mpi( &d, 16, key_hex ) == 0 );
1076
1077    TEST_ASSERT( mbedtls_ecp_check_privkey( &grp, &d ) == ret );
1078
1079exit:
1080    mbedtls_ecp_group_free( &grp );
1081    mbedtls_mpi_free( &d );
1082}
1083/* END_CASE */
1084
1085/* BEGIN_CASE */
1086void mbedtls_ecp_check_pub_priv( int id_pub, char * Qx_pub, char * Qy_pub,
1087                                 int id, char * d, char * Qx, char * Qy,
1088                                 int ret )
1089{
1090    mbedtls_ecp_keypair pub, prv;
1091
1092    mbedtls_ecp_keypair_init( &pub );
1093    mbedtls_ecp_keypair_init( &prv );
1094
1095    if( id_pub != MBEDTLS_ECP_DP_NONE )
1096        TEST_ASSERT( mbedtls_ecp_group_load( &pub.grp, id_pub ) == 0 );
1097    TEST_ASSERT( mbedtls_ecp_point_read_string( &pub.Q, 16, Qx_pub, Qy_pub ) == 0 );
1098
1099    if( id != MBEDTLS_ECP_DP_NONE )
1100        TEST_ASSERT( mbedtls_ecp_group_load( &prv.grp, id ) == 0 );
1101    TEST_ASSERT( mbedtls_ecp_point_read_string( &prv.Q, 16, Qx, Qy ) == 0 );
1102    TEST_ASSERT( mbedtls_test_read_mpi( &prv.d, 16, d ) == 0 );
1103
1104    TEST_ASSERT( mbedtls_ecp_check_pub_priv( &pub, &prv ) == ret );
1105
1106exit:
1107    mbedtls_ecp_keypair_free( &pub );
1108    mbedtls_ecp_keypair_free( &prv );
1109}
1110/* END_CASE */
1111
1112/* BEGIN_CASE */
1113void mbedtls_ecp_gen_keypair( int id )
1114{
1115    mbedtls_ecp_group grp;
1116    mbedtls_ecp_point Q;
1117    mbedtls_mpi d;
1118    mbedtls_test_rnd_pseudo_info rnd_info;
1119
1120    mbedtls_ecp_group_init( &grp );
1121    mbedtls_ecp_point_init( &Q );
1122    mbedtls_mpi_init( &d );
1123    memset( &rnd_info, 0x00, sizeof( mbedtls_test_rnd_pseudo_info ) );
1124
1125    TEST_ASSERT( mbedtls_ecp_group_load( &grp, id ) == 0 );
1126
1127    TEST_ASSERT( mbedtls_ecp_gen_keypair( &grp, &d, &Q,
1128                                          &mbedtls_test_rnd_pseudo_rand,
1129                                          &rnd_info ) == 0 );
1130
1131    TEST_ASSERT( mbedtls_ecp_check_pubkey( &grp, &Q ) == 0 );
1132    TEST_ASSERT( mbedtls_ecp_check_privkey( &grp, &d ) == 0 );
1133
1134exit:
1135    mbedtls_ecp_group_free( &grp );
1136    mbedtls_ecp_point_free( &Q );
1137    mbedtls_mpi_free( &d );
1138}
1139/* END_CASE */
1140
1141/* BEGIN_CASE */
1142void mbedtls_ecp_gen_key( int id )
1143{
1144    mbedtls_ecp_keypair key;
1145    mbedtls_test_rnd_pseudo_info rnd_info;
1146
1147    mbedtls_ecp_keypair_init( &key );
1148    memset( &rnd_info, 0x00, sizeof( mbedtls_test_rnd_pseudo_info ) );
1149
1150    TEST_ASSERT( mbedtls_ecp_gen_key( id, &key,
1151                                      &mbedtls_test_rnd_pseudo_rand,
1152                                      &rnd_info ) == 0 );
1153
1154    TEST_ASSERT( mbedtls_ecp_check_pubkey( &key.grp, &key.Q ) == 0 );
1155    TEST_ASSERT( mbedtls_ecp_check_privkey( &key.grp, &key.d ) == 0 );
1156
1157exit:
1158    mbedtls_ecp_keypair_free( &key );
1159}
1160/* END_CASE */
1161
1162/* BEGIN_CASE */
1163void mbedtls_ecp_read_key( int grp_id, data_t* in_key, int expected, int canonical )
1164{
1165    int ret = 0;
1166    mbedtls_ecp_keypair key;
1167    mbedtls_ecp_keypair key2;
1168
1169    mbedtls_ecp_keypair_init( &key );
1170    mbedtls_ecp_keypair_init( &key2 );
1171
1172    ret = mbedtls_ecp_read_key( grp_id, &key, in_key->x, in_key->len );
1173    TEST_ASSERT( ret == expected );
1174
1175    if( expected == 0 )
1176    {
1177        ret = mbedtls_ecp_check_privkey( &key.grp, &key.d );
1178        TEST_ASSERT( ret == 0 );
1179
1180        if( canonical )
1181        {
1182            unsigned char buf[MBEDTLS_ECP_MAX_BYTES];
1183
1184            ret = mbedtls_ecp_write_key( &key, buf, in_key->len );
1185            TEST_ASSERT( ret == 0 );
1186
1187            ASSERT_COMPARE( in_key->x, in_key->len,
1188                            buf, in_key->len );
1189        }
1190        else
1191        {
1192            unsigned char export1[MBEDTLS_ECP_MAX_BYTES];
1193            unsigned char export2[MBEDTLS_ECP_MAX_BYTES];
1194
1195            ret = mbedtls_ecp_write_key( &key, export1, in_key->len );
1196            TEST_ASSERT( ret == 0 );
1197
1198            ret = mbedtls_ecp_read_key( grp_id, &key2, export1, in_key->len );
1199            TEST_ASSERT( ret == expected );
1200
1201            ret = mbedtls_ecp_write_key( &key2, export2, in_key->len );
1202            TEST_ASSERT( ret == 0 );
1203
1204            ASSERT_COMPARE( export1, in_key->len,
1205                            export2, in_key->len );
1206        }
1207    }
1208
1209exit:
1210    mbedtls_ecp_keypair_free( &key );
1211    mbedtls_ecp_keypair_free( &key2 );
1212}
1213/* END_CASE */
1214
1215/* BEGIN_CASE depends_on:HAVE_FIX_NEGATIVE */
1216void fix_negative( data_t *N_bin, int c, int bits )
1217{
1218    mbedtls_mpi C, M, N;
1219
1220    mbedtls_mpi_init( &C );
1221    mbedtls_mpi_init( &M );
1222    mbedtls_mpi_init( &N );
1223
1224    /* C = - c * 2^bits (positive since c is negative) */
1225    TEST_EQUAL( 0, mbedtls_mpi_lset( &C, -c ) );
1226    TEST_EQUAL( 0, mbedtls_mpi_shift_l( &C, bits ) );
1227
1228    TEST_EQUAL( 0, mbedtls_mpi_read_binary( &N, N_bin->x, N_bin->len ) );
1229    TEST_EQUAL( 0, mbedtls_mpi_grow( &N, C.n ) );
1230
1231    /* M = N - C = - ( C - N ) (expected result of fix_negative) */
1232    TEST_EQUAL( 0, mbedtls_mpi_sub_mpi( &M, &N, &C ) );
1233
1234    mbedtls_ecp_fix_negative( &N, c, bits );
1235
1236    TEST_EQUAL( 0, mbedtls_mpi_cmp_mpi( &N, &M ) );
1237
1238exit:
1239    mbedtls_mpi_free( &C );
1240    mbedtls_mpi_free( &M );
1241    mbedtls_mpi_free( &N );
1242}
1243/* END_CASE */
1244
1245/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_ECP_MONTGOMERY_ENABLED */
1246void genkey_mx_known_answer( int bits, data_t *seed, data_t *expected )
1247{
1248    mbedtls_test_rnd_buf_info rnd_info;
1249    mbedtls_mpi d;
1250    int ret;
1251    uint8_t *actual = NULL;
1252
1253    mbedtls_mpi_init( &d );
1254    rnd_info.buf = seed->x;
1255    rnd_info.length = seed->len;
1256    rnd_info.fallback_f_rng = NULL;
1257    rnd_info.fallback_p_rng = NULL;
1258
1259    ASSERT_ALLOC( actual, expected->len );
1260
1261    ret = mbedtls_ecp_gen_privkey_mx( bits, &d,
1262                                      mbedtls_test_rnd_buffer_rand, &rnd_info );
1263
1264    if( expected->len == 0 )
1265    {
1266        /* Expecting an error (happens if there isn't enough randomness) */
1267        TEST_ASSERT( ret != 0 );
1268    }
1269    else
1270    {
1271        TEST_EQUAL( ret, 0 );
1272        TEST_EQUAL( (size_t) bits + 1, mbedtls_mpi_bitlen( &d ) );
1273        TEST_EQUAL( 0, mbedtls_mpi_write_binary( &d, actual, expected->len ) );
1274        /* Test the exact result. This assumes that the output of the
1275         * RNG is used in a specific way, which is overly constraining.
1276         * The advantage is that it's easier to test the expected properties
1277         * of the generated key:
1278         * - The most significant bit must be at a specific positions
1279         *   (can be enforced by checking the bit-length).
1280         * - The least significant bits must have specific values
1281         *   (can be enforced by checking these bits).
1282         * - Other bits must be random (by testing with different RNG outputs,
1283         *   we validate that those bits are indeed influenced by the RNG). */
1284        ASSERT_COMPARE( expected->x, expected->len,
1285                        actual, expected->len );
1286    }
1287
1288exit:
1289    mbedtls_free( actual );
1290    mbedtls_mpi_free( &d );
1291}
1292/* END_CASE */
1293
1294/* BEGIN_CASE depends_on:MBEDTLS_SELF_TEST */
1295void ecp_selftest(  )
1296{
1297    TEST_ASSERT( mbedtls_ecp_self_test( 1 ) == 0 );
1298}
1299/* END_CASE */
1300