Botan 3.7.1
Crypto and TLS for C&
Botan::EC_AffinePoint Class Referencefinal

#include <ec_apoint.h>

Public Member Functions

const std::shared_ptr< const EC_Group_Data > & _group () const
 
const EC_AffinePoint_Data_inner () const
 
EC_AffinePoint add (const EC_AffinePoint &q) const
 
 EC_AffinePoint (const EC_AffinePoint &other)
 
 EC_AffinePoint (const EC_Group &group, std::span< const uint8_t > bytes)
 
 EC_AffinePoint (EC_AffinePoint &&other) noexcept
 
size_t field_element_bytes () const
 
bool is_identity () const
 Return true if this point is the identity element.
 
EC_AffinePoint mul (const EC_Scalar &scalar, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const
 
secure_vector< uint8_t > mul_x_only (const EC_Scalar &scalar, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const
 
EC_AffinePoint negate () const
 Point negation.
 
bool operator!= (const EC_AffinePoint &other) const
 
EC_AffinePointoperator= (const EC_AffinePoint &other)
 
EC_AffinePointoperator= (EC_AffinePoint &&other) noexcept
 
bool operator== (const EC_AffinePoint &other) const
 
std::vector< uint8_t > serialize (EC_Point_Format format) const
 Return an encoding depending on the requested format.
 
template<concepts::resizable_byte_buffer T = std::vector<uint8_t>>
T serialize_compressed () const
 
void serialize_compressed_to (std::span< uint8_t > bytes) const
 
template<concepts::resizable_byte_buffer T = std::vector<uint8_t>>
T serialize_uncompressed () const
 
void serialize_uncompressed_to (std::span< uint8_t > bytes) const
 
void serialize_x_to (std::span< uint8_t > bytes) const
 
void serialize_xy_to (std::span< uint8_t > bytes) const
 
void serialize_y_to (std::span< uint8_t > bytes) const
 
template<concepts::resizable_byte_buffer T = secure_vector<uint8_t>>
T x_bytes () const
 
template<concepts::resizable_byte_buffer T = secure_vector<uint8_t>>
T xy_bytes () const
 
template<concepts::resizable_byte_buffer T = secure_vector<uint8_t>>
T y_bytes () const
 
 ~EC_AffinePoint ()
 

Static Public Member Functions

static EC_AffinePoint _from_inner (std::unique_ptr< EC_AffinePoint_Data > inner)
 
static std::optional< EC_AffinePointdeserialize (const EC_Group &group, std::span< const uint8_t > bytes)
 
static std::optional< EC_AffinePointfrom_bigint_xy (const EC_Group &group, const BigInt &x, const BigInt &y)
 
static EC_AffinePoint g_mul (const EC_Scalar &scalar, RandomNumberGenerator &rng, std::vector< BigInt > &ws)
 
static EC_AffinePoint generator (const EC_Group &group)
 Return the standard group generator.
 
static EC_AffinePoint hash_to_curve_nu (const EC_Group &group, std::string_view hash_fn, std::span< const uint8_t > input, std::span< const uint8_t > domain_sep)
 
static EC_AffinePoint hash_to_curve_ro (const EC_Group &group, std::string_view hash_fn, std::span< const uint8_t > input, std::span< const uint8_t > domain_sep)
 
static EC_AffinePoint identity (const EC_Group &group)
 Return the identity element.
 
static std::optional< EC_AffinePointmul_px_qy (const EC_AffinePoint &p, const EC_Scalar &x, const EC_AffinePoint &q, const EC_Scalar &y, RandomNumberGenerator &rng)
 

Friends

class EC_Mul2Table
 

Detailed Description

Elliptic Curve Point in Affine Representation

Definition at line 35 of file ec_apoint.h.

Constructor & Destructor Documentation

◆ EC_AffinePoint() [1/3]

Botan::EC_AffinePoint::EC_AffinePoint ( const EC_Group & group,
std::span< const uint8_t > bytes )

Point deserialization. Throws if wrong length or not a valid point

This accepts SEC1 compressed or uncompressed formats

Definition at line 35 of file ec_apoint.cpp.

35 {
36 m_point = group._data()->point_deserialize(bytes);
37 if(!m_point) {
38 throw Decoding_Error("Failed to deserialize elliptic curve point");
39 }
40}

References Botan::EC_Group::_data().

Referenced by _from_inner(), add(), deserialize(), g_mul(), hash_to_curve_nu(), hash_to_curve_ro(), identity(), mul(), mul_px_qy(), and negate().

◆ EC_AffinePoint() [2/3]

Botan::EC_AffinePoint::EC_AffinePoint ( const EC_AffinePoint & other)

Definition at line 19 of file ec_apoint.cpp.

19: m_point(other.inner().clone()) {}

◆ EC_AffinePoint() [3/3]

Botan::EC_AffinePoint::EC_AffinePoint ( EC_AffinePoint && other)
noexcept

Definition at line 21 of file ec_apoint.cpp.

21: m_point(std::move(other.m_point)) {}

◆ ~EC_AffinePoint()

Botan::EC_AffinePoint::~EC_AffinePoint ( )
default

Member Function Documentation

◆ _from_inner()

EC_AffinePoint Botan::EC_AffinePoint::_from_inner ( std::unique_ptr< EC_AffinePoint_Data > inner)
static

Definition at line 221 of file ec_apoint.cpp.

221 {
222 return EC_AffinePoint(std::move(inner));
223}
EC_AffinePoint(const EC_Group &group, std::span< const uint8_t > bytes)
Definition ec_apoint.cpp:35

References EC_AffinePoint().

Referenced by Botan::EC_Group::Mul2Table::mul2_vartime().

◆ _group()

const std::shared_ptr< const EC_Group_Data > & Botan::EC_AffinePoint::_group ( ) const

Definition at line 225 of file ec_apoint.cpp.

225 {
226 return inner().group();
227}
virtual const std::shared_ptr< const EC_Group_Data > & group() const =0

References Botan::EC_AffinePoint_Data::group().

Referenced by operator==().

◆ _inner()

const EC_AffinePoint_Data & Botan::EC_AffinePoint::_inner ( ) const
inline

Definition at line 237 of file ec_apoint.h.

237{ return inner(); }

Referenced by add(), mul_px_qy(), and negate().

◆ add()

EC_AffinePoint Botan::EC_AffinePoint::add ( const EC_AffinePoint & q) const

Point addition

Note that this is quite slow since it converts the resulting projective point immediately to affine coordinates, which requires a field inversion. This can be sufficient when implementing protocols that just need to perform a few additions.

In the future a cooresponding EC_ProjectivePoint type may be added which would avoid the expensive affine conversions

Definition at line 171 of file ec_apoint.cpp.

171 {
172 auto pt = _inner().group()->affine_add(_inner(), q._inner());
173 return EC_AffinePoint(std::move(pt));
174}
const EC_AffinePoint_Data & _inner() const
Definition ec_apoint.h:237

References _inner(), EC_AffinePoint(), and Botan::EC_AffinePoint_Data::group().

◆ deserialize()

std::optional< EC_AffinePoint > Botan::EC_AffinePoint::deserialize ( const EC_Group & group,
std::span< const uint8_t > bytes )
static

Point deserialization. Returns nullopt if wrong length or not a valid point

This accepts SEC1 compressed or uncompressed formats

Definition at line 135 of file ec_apoint.cpp.

135 {
136 if(auto pt = group._data()->point_deserialize(bytes)) {
137 return EC_AffinePoint(std::move(pt));
138 } else {
139 return {};
140 }
141}

References Botan::EC_Group::_data(), and EC_AffinePoint().

Referenced by from_bigint_xy().

◆ field_element_bytes()

size_t Botan::EC_AffinePoint::field_element_bytes ( ) const

Return the number of bytes of a field element

A point consists of two field elements, plus possibly a header

Definition at line 109 of file ec_apoint.cpp.

109 {
110 return inner().field_element_bytes();
111}
virtual size_t field_element_bytes() const =0

References Botan::EC_AffinePoint_Data::field_element_bytes().

◆ from_bigint_xy()

std::optional< EC_AffinePoint > Botan::EC_AffinePoint::from_bigint_xy ( const EC_Group & group,
const BigInt & x,
const BigInt & y )
static

Create a point from a pair (x,y) of integers

The integers must be within the field - in the range [0,p) and must satisfy the curve equation

Definition at line 92 of file ec_apoint.cpp.

92 {
93 if(x.is_negative() || x >= group.get_p()) {
94 return {};
95 }
96 if(y.is_negative() || y >= group.get_p()) {
97 return {};
98 }
99
100 const size_t fe_bytes = group.get_p_bytes();
101 std::vector<uint8_t> sec1(1 + 2 * fe_bytes);
102 sec1[0] = 0x04;
103 x.serialize_to(std::span{sec1}.subspan(1, fe_bytes));
104 y.serialize_to(std::span{sec1}.last(fe_bytes));
105
106 return EC_AffinePoint::deserialize(group, sec1);
107}
static std::optional< EC_AffinePoint > deserialize(const EC_Group &group, std::span< const uint8_t > bytes)

References deserialize(), Botan::EC_Group::get_p(), Botan::EC_Group::get_p_bytes(), Botan::BigInt::is_negative(), and Botan::BigInt::serialize_to().

Referenced by generator().

◆ g_mul()

EC_AffinePoint Botan::EC_AffinePoint::g_mul ( const EC_Scalar & scalar,
RandomNumberGenerator & rng,
std::vector< BigInt > & ws )
static

Multiply by the group generator returning a complete point

Workspace argument is transitional

Definition at line 143 of file ec_apoint.cpp.

143 {
144 auto pt = scalar._inner().group()->point_g_mul(scalar.inner(), rng, ws);
145 return EC_AffinePoint(std::move(pt));
146}

References Botan::EC_Scalar::_inner(), EC_AffinePoint(), and Botan::EC_Scalar_Data::group().

Referenced by Botan::EC_PrivateKey_Data::public_key().

◆ generator()

EC_AffinePoint Botan::EC_AffinePoint::generator ( const EC_Group & group)
static

Return the standard group generator.

Definition at line 83 of file ec_apoint.cpp.

83 {
84 // TODO it would be nice to improve this (pcurves supports returning generator directly)
85 try {
86 return EC_AffinePoint::from_bigint_xy(group, group.get_g_x(), group.get_g_y()).value();
87 } catch(...) {
88 throw Internal_Error("EC_AffinePoint::generator curve rejected generator");
89 }
90}
static std::optional< EC_AffinePoint > from_bigint_xy(const EC_Group &group, const BigInt &x, const BigInt &y)
Definition ec_apoint.cpp:92

References from_bigint_xy(), Botan::EC_Group::get_g_x(), and Botan::EC_Group::get_g_y().

Referenced by Botan::EC_Group::DER_encode().

◆ hash_to_curve_nu()

EC_AffinePoint Botan::EC_AffinePoint::hash_to_curve_nu ( const EC_Group & group,
std::string_view hash_fn,
std::span< const uint8_t > input,
std::span< const uint8_t > domain_sep )
static

Hash to curve (RFC 9380), non uniform variant

Only supported for specific groups

Definition at line 125 of file ec_apoint.cpp.

128 {
129 auto pt = group._data()->point_hash_to_curve_nu(hash_fn, input, domain_sep);
130 return EC_AffinePoint(std::move(pt));
131}

References Botan::EC_Group::_data(), and EC_AffinePoint().

◆ hash_to_curve_ro()

EC_AffinePoint Botan::EC_AffinePoint::hash_to_curve_ro ( const EC_Group & group,
std::string_view hash_fn,
std::span< const uint8_t > input,
std::span< const uint8_t > domain_sep )
static

Hash to curve (RFC 9380), random oracle variant

Only supported for specific groups

Definition at line 117 of file ec_apoint.cpp.

120 {
121 auto pt = group._data()->point_hash_to_curve_ro(hash_fn, input, domain_sep);
122 return EC_AffinePoint(std::move(pt));
123}

References Botan::EC_Group::_data(), and EC_AffinePoint().

◆ identity()

EC_AffinePoint Botan::EC_AffinePoint::identity ( const EC_Group & group)
static

Return the identity element.

Definition at line 78 of file ec_apoint.cpp.

78 {
79 const uint8_t id_encoding[1] = {0};
80 return EC_AffinePoint(group, id_encoding);
81}

References EC_AffinePoint().

◆ is_identity()

bool Botan::EC_AffinePoint::is_identity ( ) const

Return true if this point is the identity element.

Definition at line 113 of file ec_apoint.cpp.

113 {
114 return inner().is_identity();
115}
virtual bool is_identity() const =0

References Botan::EC_AffinePoint_Data::is_identity().

Referenced by Botan::EC_PublicKey::check_key(), Botan::ECIES_KA_Operation::derive_secret(), operator==(), serialize_compressed_to(), serialize_uncompressed_to(), serialize_x_to(), serialize_xy_to(), and serialize_y_to().

◆ mul()

EC_AffinePoint Botan::EC_AffinePoint::mul ( const EC_Scalar & scalar,
RandomNumberGenerator & rng,
std::vector< BigInt > & ws ) const

Multiply a point by a scalar returning a complete point

Workspace argument is transitional

Definition at line 148 of file ec_apoint.cpp.

148 {
149 return EC_AffinePoint(inner().mul(scalar._inner(), rng, ws));
150}
EC_AffinePoint mul(const EC_Scalar &scalar, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const

References Botan::EC_Scalar::_inner(), EC_AffinePoint(), and mul().

Referenced by mul().

◆ mul_px_qy()

std::optional< EC_AffinePoint > Botan::EC_AffinePoint::mul_px_qy ( const EC_AffinePoint & p,
const EC_Scalar & x,
const EC_AffinePoint & q,
const EC_Scalar & y,
RandomNumberGenerator & rng )
static

Compute 2-ary multiscalar multiplication - p*x + q*y

This operation runs in constant time with respect to p, x, q, and y

Returns
p*x+q*y, or nullopt if the result was the point at infinity

Definition at line 158 of file ec_apoint.cpp.

162 {
163 auto pt = p._inner().group()->mul_px_qy(p._inner(), x._inner(), q._inner(), y._inner(), rng);
164 if(pt) {
165 return EC_AffinePoint(std::move(pt));
166 } else {
167 return {};
168 }
169}

References _inner(), Botan::EC_Scalar::_inner(), EC_AffinePoint(), and Botan::EC_AffinePoint_Data::group().

◆ mul_x_only()

secure_vector< uint8_t > Botan::EC_AffinePoint::mul_x_only ( const EC_Scalar & scalar,
RandomNumberGenerator & rng,
std::vector< BigInt > & ws ) const

Multiply a point by a scalar, returning the byte encoding of the x coordinate only

Workspace argument is transitional

Definition at line 152 of file ec_apoint.cpp.

154 {
155 return inner().mul_x_only(scalar._inner(), rng, ws);
156}
virtual secure_vector< uint8_t > mul_x_only(const EC_Scalar_Data &scalar, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const =0

References Botan::EC_Scalar::_inner(), and Botan::EC_AffinePoint_Data::mul_x_only().

◆ negate()

EC_AffinePoint Botan::EC_AffinePoint::negate ( ) const

Point negation.

Definition at line 176 of file ec_apoint.cpp.

176 {
177 auto pt = this->_inner().group()->affine_neg(this->_inner());
178 return EC_AffinePoint(std::move(pt));
179}

References _inner(), EC_AffinePoint(), and Botan::EC_AffinePoint_Data::group().

◆ operator!=()

bool Botan::EC_AffinePoint::operator!= ( const EC_AffinePoint & other) const
inline

Definition at line 212 of file ec_apoint.h.

212{ return !(*this == other); }

◆ operator=() [1/2]

EC_AffinePoint & Botan::EC_AffinePoint::operator= ( const EC_AffinePoint & other)

Definition at line 23 of file ec_apoint.cpp.

23 {
24 if(this != &other) {
25 m_point = other.inner().clone();
26 }
27 return (*this);
28}

References Botan::EC_AffinePoint_Data::clone().

◆ operator=() [2/2]

EC_AffinePoint & Botan::EC_AffinePoint::operator= ( EC_AffinePoint && other)
noexcept

Definition at line 30 of file ec_apoint.cpp.

30 {
31 m_point.swap(other.m_point);
32 return (*this);
33}

◆ operator==()

bool Botan::EC_AffinePoint::operator== ( const EC_AffinePoint & other) const

Definition at line 53 of file ec_apoint.cpp.

53 {
54 if(this == &other) {
55 return true;
56 }
57
58 // We are relying on EC_Group to ensure there is just a single shared_ptr
59 // for any set of group params
60 if(this->_group() != other._group()) {
61 return false;
62 }
63
64 auto a_is_id = this->is_identity();
65 auto b_is_id = other.is_identity();
66
67 if(a_is_id || b_is_id) {
68 return (a_is_id == b_is_id);
69 }
70
71 auto a_xy = this->serialize_uncompressed();
72 auto b_xy = other.serialize_uncompressed();
73 BOTAN_ASSERT_NOMSG(a_xy.size() == b_xy.size());
74
75 return CT::is_equal(a_xy.data(), b_xy.data(), a_xy.size()).as_bool();
76}
#define BOTAN_ASSERT_NOMSG(expr)
Definition assert.h:59
bool is_identity() const
Return true if this point is the identity element.
T serialize_uncompressed() const
Definition ec_apoint.h:194
const std::shared_ptr< const EC_Group_Data > & _group() const
constexpr CT::Mask< T > is_equal(const T x[], const T y[], size_t len)
Definition ct_utils.h:788

References _group(), BOTAN_ASSERT_NOMSG, Botan::CT::is_equal(), is_identity(), and serialize_uncompressed().

◆ serialize()

std::vector< uint8_t > Botan::EC_AffinePoint::serialize ( EC_Point_Format format) const

Return an encoding depending on the requested format.

Definition at line 181 of file ec_apoint.cpp.

181 {
182 if(format == EC_Point_Format::Compressed) {
183 return this->serialize_compressed();
184 } else if(format == EC_Point_Format::Uncompressed) {
185 return this->serialize_uncompressed();
186 } else {
187 // The deprecated "hybrid" point encoding
188 // TODO(Botan4) Remove this
189 auto enc = this->serialize_uncompressed();
190 const bool y_is_odd = (enc[enc.size() - 1] & 0x01) == 0x01;
191 enc.front() = y_is_odd ? 0x07 : 0x06;
192 return enc;
193 }
194}
T serialize_compressed() const
Definition ec_apoint.h:204

References Botan::Compressed, serialize_compressed(), serialize_uncompressed(), and Botan::Uncompressed.

Referenced by Botan::ECIES_KA_Operation::derive_secret(), Botan::ECDH_PublicKey::public_value(), and Botan::EC_PublicKey::raw_public_key_bits().

◆ serialize_compressed()

template<concepts::resizable_byte_buffer T = std::vector<uint8_t>>
T Botan::EC_AffinePoint::serialize_compressed ( ) const
inline

Return the bytes of the affine x and y coordinates in a container

This function will fail if this point is the identity element

Definition at line 204 of file ec_apoint.h.

204 {
205 T bytes(1 + this->field_element_bytes());
206 this->serialize_compressed_to(bytes);
207 return bytes;
208 }
size_t field_element_bytes() const
void serialize_compressed_to(std::span< uint8_t > bytes) const
FE_25519 T
Definition ge.cpp:34

References T.

Referenced by Botan::ECDSA_PublicKey::recovery_param(), and serialize().

◆ serialize_compressed_to()

void Botan::EC_AffinePoint::serialize_compressed_to ( std::span< uint8_t > bytes) const

Write the fixed length SEC1 compressed encoding

The output span must be exactly 1 + field_element_bytes long

This function will fail if this point is the identity element

Definition at line 211 of file ec_apoint.cpp.

211 {
213 m_point->serialize_compressed_to(bytes);
214}
#define BOTAN_STATE_CHECK(expr)
Definition assert.h:41

References BOTAN_STATE_CHECK, and is_identity().

◆ serialize_uncompressed()

template<concepts::resizable_byte_buffer T = std::vector<uint8_t>>
T Botan::EC_AffinePoint::serialize_uncompressed ( ) const
inline

Return the bytes of the affine x and y coordinates in a container

This function will fail if this point is the identity element

Definition at line 194 of file ec_apoint.h.

194 {
195 T bytes(1 + 2 * this->field_element_bytes());
196 this->serialize_uncompressed_to(bytes);
197 return bytes;
198 }
void serialize_uncompressed_to(std::span< uint8_t > bytes) const

References T.

Referenced by Botan::EC_Group::DER_encode(), operator==(), and serialize().

◆ serialize_uncompressed_to()

void Botan::EC_AffinePoint::serialize_uncompressed_to ( std::span< uint8_t > bytes) const

Return the fixed length encoding of SEC1 uncompressed encoding

The output span must be exactly 1 + 2*field_element_bytes long

This function will fail if this point is the identity element

Definition at line 216 of file ec_apoint.cpp.

216 {
218 m_point->serialize_uncompressed_to(bytes);
219}

References BOTAN_STATE_CHECK, and is_identity().

◆ serialize_x_to()

void Botan::EC_AffinePoint::serialize_x_to ( std::span< uint8_t > bytes) const

Write the fixed length encoding of affine x coordinate

The output span must be exactly field_element_bytes long

This function will fail if this point is the identity element

Definition at line 196 of file ec_apoint.cpp.

196 {
198 m_point->serialize_x_to(bytes);
199}

References BOTAN_STATE_CHECK, and is_identity().

◆ serialize_xy_to()

void Botan::EC_AffinePoint::serialize_xy_to ( std::span< uint8_t > bytes) const

Write the fixed length encoding of affine x and y coordinates

The output span must be exactly 2*field_element_bytes long

This function will fail if this point is the identity element

Definition at line 206 of file ec_apoint.cpp.

206 {
208 m_point->serialize_xy_to(bytes);
209}

References BOTAN_STATE_CHECK, and is_identity().

◆ serialize_y_to()

void Botan::EC_AffinePoint::serialize_y_to ( std::span< uint8_t > bytes) const

Write the fixed length encoding of affine y coordinate

The output span must be exactly field_element_bytes long

This function will fail if this point is the identity element

Definition at line 201 of file ec_apoint.cpp.

201 {
203 m_point->serialize_y_to(bytes);
204}

References BOTAN_STATE_CHECK, and is_identity().

◆ x_bytes()

template<concepts::resizable_byte_buffer T = secure_vector<uint8_t>>
T Botan::EC_AffinePoint::x_bytes ( ) const
inline

Return the bytes of the affine x coordinate in a container

This function will fail if this point is the identity element

Definition at line 164 of file ec_apoint.h.

164 {
165 T bytes(this->field_element_bytes());
166 this->serialize_x_to(bytes);
167 return bytes;
168 }
void serialize_x_to(std::span< uint8_t > bytes) const

References T.

◆ xy_bytes()

template<concepts::resizable_byte_buffer T = secure_vector<uint8_t>>
T Botan::EC_AffinePoint::xy_bytes ( ) const
inline

Return the bytes of the affine x and y coordinates in a container

This function will fail if this point is the identity element

Definition at line 184 of file ec_apoint.h.

184 {
185 T bytes(2 * this->field_element_bytes());
186 this->serialize_xy_to(bytes);
187 return bytes;
188 }
void serialize_xy_to(std::span< uint8_t > bytes) const

References T.

Referenced by Botan::GOST_3410_PublicKey::public_key_bits(), and Botan::sm2_compute_za().

◆ y_bytes()

template<concepts::resizable_byte_buffer T = secure_vector<uint8_t>>
T Botan::EC_AffinePoint::y_bytes ( ) const
inline

Return the bytes of the affine y coordinate in a container

This function will fail if this point is the identity element

Definition at line 174 of file ec_apoint.h.

174 {
175 T bytes(this->field_element_bytes());
176 this->serialize_y_to(bytes);
177 return bytes;
178 }
void serialize_y_to(std::span< uint8_t > bytes) const

References T.

Friends And Related Symbol Documentation

◆ EC_Mul2Table

friend class EC_Mul2Table
friend

Definition at line 244 of file ec_apoint.h.


The documentation for this class was generated from the following files: