Botan  2.7.0
Crypto and TLS for C++11
Public Member Functions | Static Public Member Functions | List of all members
Botan::EC_Group Class Referencefinal

#include <ec_group.h>

Public Member Functions

bool a_is_minus_3 () const
 
bool a_is_zero () const
 
PointGFp blinded_base_point_multiply (const BigInt &k, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const
 
BigInt blinded_base_point_multiply_x (const BigInt &k, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const
 
PointGFp blinded_var_point_multiply (const PointGFp &point, const BigInt &k, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const
 
std::vector< uint8_t > DER_encode (EC_Group_Encoding form) const
 
 EC_Group (const CurveGFp &curve, const PointGFp &base_point, const BigInt &order, const BigInt &cofactor)
 
 EC_Group (const BigInt &p, const BigInt &a, const BigInt &b, const BigInt &base_x, const BigInt &base_y, const BigInt &order, const BigInt &cofactor, const OID &oid=OID())
 
 EC_Group (const std::vector< uint8_t > &ber_encoding)
 
 EC_Group (const OID &oid)
 
 EC_Group (const std::string &pem_or_oid)
 
 EC_Group ()
 
const BigIntget_a () const
 
const BigIntget_b () const
 
const PointGFpget_base_point () const
 
const BigIntget_cofactor () const
 
const CurveGFpget_curve () const
 
const OIDget_curve_oid () const
 
const BigIntget_g_x () const
 
const BigIntget_g_y () const
 
std::string get_oid () const
 
const BigIntget_order () const
 
size_t get_order_bits () const
 
size_t get_order_bytes () const
 
const BigIntget_p () const
 
size_t get_p_bits () const
 
size_t get_p_bytes () const
 
bool initialized () const
 
BigInt inverse_mod_order (const BigInt &x) const
 
BigInt mod_order (const BigInt &x) const
 
BigInt multiply_mod_order (const BigInt &x, const BigInt &y) const
 
BigInt multiply_mod_order (const BigInt &x, const BigInt &y, const BigInt &z) const
 
bool operator== (const EC_Group &other) const
 
PointGFp OS2ECP (const uint8_t bits[], size_t len) const
 
template<typename Alloc >
PointGFp OS2ECP (const std::vector< uint8_t, Alloc > &vec) const
 
std::string PEM_encode () const
 
PointGFp point (const BigInt &x, const BigInt &y) const
 
PointGFp point_multiply (const BigInt &x, const PointGFp &pt, const BigInt &y) const
 
BigInt random_scalar (RandomNumberGenerator &rng) const
 
BigInt square_mod_order (const BigInt &x) const
 
bool verify_group (RandomNumberGenerator &rng, bool strong=false) const
 
bool verify_public_element (const PointGFp &y) const
 
PointGFp zero_point () const
 
 ~EC_Group ()
 

Static Public Member Functions

static size_t clear_registered_curve_data ()
 
static std::shared_ptr< EC_Group_Data > EC_group_info (const OID &oid)
 
static const std::set< std::string > & known_named_groups ()
 
static std::string PEM_for_named_group (const std::string &name)
 

Detailed Description

Class representing an elliptic curve

The internal representation is stored in a shared_ptr, so copying an EC_Group is inexpensive.

Definition at line 40 of file ec_group.h.

Constructor & Destructor Documentation

◆ EC_Group() [1/6]

Botan::EC_Group::EC_Group ( const CurveGFp curve,
const PointGFp base_point,
const BigInt order,
const BigInt cofactor 
)
inline

Construct Domain paramers from specified parameters

Parameters
curveelliptic curve
base_pointa base point
orderthe order of the base point
cofactorthe cofactor

Definition at line 52 of file ec_group.h.

55  :
56  EC_Group(curve.get_p(),
57  curve.get_a(),
58  curve.get_b(),
59  base_point.get_affine_x(),
60  base_point.get_affine_y(),
61  order,
62  cofactor) {}

◆ EC_Group() [2/6]

Botan::EC_Group::EC_Group ( const BigInt p,
const BigInt a,
const BigInt b,
const BigInt base_x,
const BigInt base_y,
const BigInt order,
const BigInt cofactor,
const OID oid = OID() 
)

Construct Domain paramers from specified parameters

Parameters
pthe elliptic curve p
athe elliptic curve a param
bthe elliptic curve b param
base_xthe x coordinate of the base point
base_ythe y coordinate of the base point
orderthe order of the base point
cofactorthe cofactor
oidan optional OID used to identify this curve

Definition at line 421 of file ec_group.cpp.

429  {
430  m_data = ec_group_data().lookup_or_create(p, a, b, base_x, base_y, order, cofactor, oid);
431  }

◆ EC_Group() [3/6]

Botan::EC_Group::EC_Group ( const std::vector< uint8_t > &  ber_encoding)
explicit

Decode a BER encoded ECC domain parameter set

Parameters
ber_encodingthe bytes of the BER encoding

Definition at line 433 of file ec_group.cpp.

434  {
435  m_data = BER_decode_EC_group(ber.data(), ber.size());
436  }

◆ EC_Group() [4/6]

Botan::EC_Group::EC_Group ( const OID oid)
explicit

Create an EC domain by OID (or throw if unknown)

Parameters
oidthe OID of the EC domain to create

Definition at line 371 of file ec_group.cpp.

References Botan::OID::as_string().

372  {
373  this->m_data = ec_group_data().lookup(domain_oid);
374  if(!this->m_data)
375  throw Invalid_Argument("Unknown EC_Group " + domain_oid.as_string());
376  }

◆ EC_Group() [5/6]

Botan::EC_Group::EC_Group ( const std::string &  pem_or_oid)
explicit

Create an EC domain from PEM encoding (as from PEM_encode), or from an OID name (eg "secp256r1", or "1.2.840.10045.3.1.7")

Parameters
pem_or_oidPEM-encoded data, or an OID

Definition at line 378 of file ec_group.cpp.

References Botan::PEM_Code::decode_check_label(), Botan::OID::empty(), and Botan::OIDS::lookup().

379  {
380  if(str == "")
381  return; // no initialization / uninitialized
382 
383  try
384  {
385  OID oid = OIDS::lookup(str);
386  if(oid.empty() == false)
387  m_data = ec_group_data().lookup(oid);
388  }
389  catch(Invalid_OID&)
390  {
391  }
392 
393  if(m_data == nullptr)
394  {
395  if(str.size() > 30 && str.substr(0, 29) == "-----BEGIN EC PARAMETERS-----")
396  {
397  // OK try it as PEM ...
398  secure_vector<uint8_t> ber = PEM_Code::decode_check_label(str, "EC PARAMETERS");
399  this->m_data = BER_decode_EC_group(ber.data(), ber.size());
400  }
401  }
402 
403  if(m_data == nullptr)
404  throw Invalid_Argument("Unknown ECC group '" + str + "'");
405  }
secure_vector< uint8_t > decode_check_label(DataSource &source, const std::string &label_want)
Definition: pem.cpp:54
std::string lookup(const OID &oid)
Definition: oids.cpp:113

◆ EC_Group() [6/6]

Botan::EC_Group::EC_Group ( )

Create an uninitialized EC_Group

Definition at line 362 of file ec_group.cpp.

363  {
364  }

◆ ~EC_Group()

Botan::EC_Group::~EC_Group ( )

Definition at line 366 of file ec_group.cpp.

367  {
368  // shared_ptr possibly freed here
369  }

Member Function Documentation

◆ a_is_minus_3()

bool Botan::EC_Group::a_is_minus_3 ( ) const

Return if a == -3 mod p

Definition at line 450 of file ec_group.cpp.

451  {
452  return data().a_is_minus_3();
453  }

◆ a_is_zero()

bool Botan::EC_Group::a_is_zero ( ) const

Return if a == 0 mod p

Definition at line 455 of file ec_group.cpp.

456  {
457  return data().a_is_zero();
458  }

◆ blinded_base_point_multiply()

PointGFp Botan::EC_Group::blinded_base_point_multiply ( const BigInt k,
RandomNumberGenerator rng,
std::vector< BigInt > &  ws 
) const

Blinded point multiplication, attempts resistance to side channels

Parameters
kthe scalar
rnga random number generator
wsa temp workspace
Returns
base_point*k

Definition at line 567 of file ec_group.cpp.

570  {
571  return data().blinded_base_point_multiply(k, rng, ws);
572  }

◆ blinded_base_point_multiply_x()

BigInt Botan::EC_Group::blinded_base_point_multiply_x ( const BigInt k,
RandomNumberGenerator rng,
std::vector< BigInt > &  ws 
) const

Blinded point multiplication, attempts resistance to side channels Returns just the x coordinate of the point

Parameters
kthe scalar
rnga random number generator
wsa temp workspace
Returns
x coordinate of base_point*k

Definition at line 574 of file ec_group.cpp.

References Botan::PointGFp::get_affine_x(), and Botan::PointGFp::is_zero().

577  {
578  const PointGFp pt = data().blinded_base_point_multiply(k, rng, ws);
579 
580  if(pt.is_zero())
581  return 0;
582  return pt.get_affine_x();
583  }

◆ blinded_var_point_multiply()

PointGFp Botan::EC_Group::blinded_var_point_multiply ( const PointGFp point,
const BigInt k,
RandomNumberGenerator rng,
std::vector< BigInt > &  ws 
) const

Blinded point multiplication, attempts resistance to side channels

Parameters
pointinput point
kthe scalar
rnga random number generator
wsa temp workspace
Returns
point*k

Definition at line 590 of file ec_group.cpp.

References get_order(), Botan::PointGFp_Var_Point_Precompute::mul(), and point().

594  {
595  PointGFp_Var_Point_Precompute mul(point, rng, ws);
596  return mul.mul(k, rng, get_order(), ws);
597  }
PointGFp point(const BigInt &x, const BigInt &y) const
Definition: ec_group.cpp:555
const BigInt & get_order() const
Definition: ec_group.cpp:500

◆ clear_registered_curve_data()

size_t Botan::EC_Group::clear_registered_curve_data ( )
static

Definition at line 254 of file ec_group.cpp.

255  {
256  return ec_group_data().clear();
257  }

◆ DER_encode()

std::vector< uint8_t > Botan::EC_Group::DER_encode ( EC_Group_Encoding  form) const

Create the DER encoding of this domain

Parameters
formof encoding to use
Returns
bytes encododed as DER

Definition at line 605 of file ec_group.cpp.

References Botan::EC_DOMPAR_ENC_EXPLICIT, Botan::EC_DOMPAR_ENC_IMPLICITCA, Botan::EC_DOMPAR_ENC_OID, Botan::OID::empty(), Botan::PEM_Code::encode(), Botan::DER_Encoder::encode(), Botan::BigInt::encode_1363(), Botan::DER_Encoder::encode_null(), Botan::DER_Encoder::end_cons(), get_a(), get_b(), get_base_point(), get_cofactor(), get_curve_oid(), get_order(), get_p(), get_p_bytes(), Botan::OCTET_STRING, Botan::SEQUENCE, Botan::DER_Encoder::start_cons(), and Botan::PointGFp::UNCOMPRESSED.

Referenced by PEM_encode().

606  {
607  std::vector<uint8_t> output;
608 
609  DER_Encoder der(output);
610 
611  if(form == EC_DOMPAR_ENC_EXPLICIT)
612  {
613  const size_t ecpVers1 = 1;
614  const OID curve_type("1.2.840.10045.1.1"); // prime field
615 
616  const size_t p_bytes = get_p_bytes();
617 
618  der.start_cons(SEQUENCE)
619  .encode(ecpVers1)
620  .start_cons(SEQUENCE)
621  .encode(curve_type)
622  .encode(get_p())
623  .end_cons()
624  .start_cons(SEQUENCE)
625  .encode(BigInt::encode_1363(get_a(), p_bytes),
626  OCTET_STRING)
627  .encode(BigInt::encode_1363(get_b(), p_bytes),
628  OCTET_STRING)
629  .end_cons()
631  .encode(get_order())
632  .encode(get_cofactor())
633  .end_cons();
634  }
635  else if(form == EC_DOMPAR_ENC_OID)
636  {
637  const OID oid = get_curve_oid();
638  if(oid.empty())
639  {
640  throw Encoding_Error("Cannot encode EC_Group as OID because OID not set");
641  }
642  der.encode(oid);
643  }
644  else if(form == EC_DOMPAR_ENC_IMPLICITCA)
645  {
646  der.encode_null();
647  }
648  else
649  {
650  throw Internal_Error("EC_Group::DER_encode: Unknown encoding");
651  }
652 
653  return output;
654  }
size_t get_p_bytes() const
Definition: ec_group.cpp:465
const OID & get_curve_oid() const
Definition: ec_group.cpp:545
const BigInt & get_order() const
Definition: ec_group.cpp:500
std::string encode(const uint8_t der[], size_t length, const std::string &label, size_t width)
Definition: pem.cpp:43
const PointGFp & get_base_point() const
Definition: ec_group.cpp:495
const BigInt & get_cofactor() const
Definition: ec_group.cpp:515
const BigInt & get_b() const
Definition: ec_group.cpp:490
const BigInt & get_a() const
Definition: ec_group.cpp:485
const BigInt & get_p() const
Definition: ec_group.cpp:480
static secure_vector< uint8_t > encode_1363(const BigInt &n, size_t bytes)
Definition: big_code.cpp:82

◆ EC_group_info()

std::shared_ptr< EC_Group_Data > Botan::EC_Group::EC_group_info ( const OID oid)
static

Definition at line 13 of file ec_named.cpp.

14  {
15  // P-256
16  if(oid == OID{1,2,840,10045,3,1,7})
17  return load_EC_group_info("0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF",
18  "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC",
19  "0x5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B",
20  "0x6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296",
21  "0x4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5",
22  "0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551",
23  oid);
24 
25  // P-384
26  if(oid == OID{1,3,132,0,34})
27  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF",
28  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC",
29  "0xB3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF",
30  "0xAA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7",
31  "0x3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F",
32  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973",
33  oid);
34  // P-521
35  if(oid == OID{1,3,132,0,35})
36  return load_EC_group_info("0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
37  "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC",
38  "0x51953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00",
39  "0xC6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66",
40  "0x11839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650",
41  "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409",
42  oid);
43 
44  // brainpool160r1
45  if(oid == OID{1,3,36,3,3,2,8,1,1,1})
46  return load_EC_group_info("0xE95E4A5F737059DC60DFC7AD95B3D8139515620F",
47  "0x340E7BE2A280EB74E2BE61BADA745D97E8F7C300",
48  "0x1E589A8595423412134FAA2DBDEC95C8D8675E58",
49  "0xBED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC3",
50  "0x1667CB477A1A8EC338F94741669C976316DA6321",
51  "0xE95E4A5F737059DC60DF5991D45029409E60FC09",
52  oid);
53  // brainpool192r1
54  if(oid == OID{1,3,36,3,3,2,8,1,1,3})
55  return load_EC_group_info("0xC302F41D932A36CDA7A3463093D18DB78FCE476DE1A86297",
56  "0x6A91174076B1E0E19C39C031FE8685C1CAE040E5C69A28EF",
57  "0x469A28EF7C28CCA3DC721D044F4496BCCA7EF4146FBF25C9",
58  "0xC0A0647EAAB6A48753B033C56CB0F0900A2F5C4853375FD6",
59  "0x14B690866ABD5BB88B5F4828C1490002E6773FA2FA299B8F",
60  "0xC302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1",
61  oid);
62  // brainpool224r1
63  if(oid == OID{1,3,36,3,3,2,8,1,1,5})
64  return load_EC_group_info("0xD7C134AA264366862A18302575D1D787B09F075797DA89F57EC8C0FF",
65  "0x68A5E62CA9CE6C1C299803A6C1530B514E182AD8B0042A59CAD29F43",
66  "0x2580F63CCFE44138870713B1A92369E33E2135D266DBB372386C400B",
67  "0xD9029AD2C7E5CF4340823B2A87DC68C9E4CE3174C1E6EFDEE12C07D",
68  "0x58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD",
69  "0xD7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F",
70  oid);
71  // brainpool256r1
72  if(oid == OID{1,3,36,3,3,2,8,1,1,7})
73  return load_EC_group_info("0xA9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377",
74  "0x7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9",
75  "0x26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6",
76  "0x8BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262",
77  "0x547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997",
78  "0xA9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7",
79  oid);
80  // brainpool320r1
81  if(oid == OID{1,3,36,3,3,2,8,1,1,9})
82  return load_EC_group_info("0xD35E472036BC4FB7E13C785ED201E065F98FCFA6F6F40DEF4F92B9EC7893EC28FCD412B1F1B32E27",
83  "0x3EE30B568FBAB0F883CCEBD46D3F3BB8A2A73513F5EB79DA66190EB085FFA9F492F375A97D860EB4",
84  "0x520883949DFDBC42D3AD198640688A6FE13F41349554B49ACC31DCCD884539816F5EB4AC8FB1F1A6",
85  "0x43BD7E9AFB53D8B85289BCC48EE5BFE6F20137D10A087EB6E7871E2A10A599C710AF8D0D39E20611",
86  "0x14FDD05545EC1CC8AB4093247F77275E0743FFED117182EAA9C77877AAAC6AC7D35245D1692E8EE1",
87  "0xD35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311",
88  oid);
89  // brainpool384r1
90  if(oid == OID{1,3,36,3,3,2,8,1,1,11})
91  return load_EC_group_info("0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53",
92  "0x7BC382C63D8C150C3C72080ACE05AFA0C2BEA28E4FB22787139165EFBA91F90F8AA5814A503AD4EB04A8C7DD22CE2826",
93  "0x4A8C7DD22CE28268B39B55416F0447C2FB77DE107DCD2A62E880EA53EEB62D57CB4390295DBC9943AB78696FA504C11",
94  "0x1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E",
95  "0x8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315",
96  "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565",
97  oid);
98  // brainpool512r1
99  if(oid == OID{1,3,36,3,3,2,8,1,1,13})
100  return load_EC_group_info("0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3",
101  "0x7830A3318B603B89E2327145AC234CC594CBDD8D3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CA",
102  "0x3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CADC083E67984050B75EBAE5DD2809BD638016F723",
103  "0x81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822",
104  "0x7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892",
105  "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069",
106  oid);
107  // frp256v1
108  if(oid == OID{1,2,250,1,223,101,256,1})
109  return load_EC_group_info("0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C03",
110  "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C00",
111  "0xEE353FCA5428A9300D4ABA754A44C00FDFEC0C9AE4B1A1803075ED967B7BB73F",
112  "0xB6B3D4C356C139EB31183D4749D423958C27D2DCAF98B70164C97A2DD98F5CFF",
113  "0x6142E0F7C8B204911F9271F0F3ECEF8C2701C307E8E4C9E183115A1554062CFB",
114  "0xF1FD178C0B3AD58F10126DE8CE42435B53DC67E140D2BF941FFDD459C6D655E1",
115  oid);
116  // gost_256A
117  if(oid == OID{1,2,643,2,2,35,1})
118  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD97",
119  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD94",
120  "0xA6",
121  "0x1",
122  "0x8D91E471E0989CDA27DF505A453F2B7635294F2DDF23E3B122ACC99C9E9F1E14",
123  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C611070995AD10045841B09B761B893",
124  oid);
125  // secp160k1
126  if(oid == OID{1,3,132,0,9})
127  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
128  "0x0",
129  "0x7",
130  "0x3B4C382CE37AA192A4019E763036F4F5DD4D7EBB",
131  "0x938CF935318FDCED6BC28286531733C3F03C4FEE",
132  "0x100000000000000000001B8FA16DFAB9ACA16B6B3",
133  oid);
134  // secp160r1
135  if(oid == OID{1,3,132,0,8})
136  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF",
137  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC",
138  "0x1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45",
139  "0x4A96B5688EF573284664698968C38BB913CBFC82",
140  "0x23A628553168947D59DCC912042351377AC5FB32",
141  "0x100000000000000000001F4C8F927AED3CA752257",
142  oid);
143  // secp160r2
144  if(oid == OID{1,3,132,0,30})
145  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
146  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC70",
147  "0xB4E134D3FB59EB8BAB57274904664D5AF50388BA",
148  "0x52DCB034293A117E1F4FF11B30F7199D3144CE6D",
149  "0xFEAFFEF2E331F296E071FA0DF9982CFEA7D43F2E",
150  "0x100000000000000000000351EE786A818F3A1A16B",
151  oid);
152  // secp192k1
153  if(oid == OID{1,3,132,0,31})
154  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37",
155  "0x0",
156  "0x3",
157  "0xDB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D",
158  "0x9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D",
159  "0xFFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D",
160  oid);
161  // secp192r1
162  if(oid == OID{1,2,840,10045,3,1,1})
163  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
164  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
165  "0x64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1",
166  "0x188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012",
167  "0x7192B95FFC8DA78631011ED6B24CDD573F977A11E794811",
168  "0xFFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831",
169  oid);
170  // secp224k1
171  if(oid == OID{1,3,132,0,32})
172  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D",
173  "0x0",
174  "0x5",
175  "0xA1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C",
176  "0x7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5",
177  "0x10000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7",
178  oid);
179  // secp224r1
180  if(oid == OID{1,3,132,0,33})
181  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001",
182  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE",
183  "0xB4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4",
184  "0xB70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21",
185  "0xBD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34",
186  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D",
187  oid);
188  // secp256k1
189  if(oid == OID{1,3,132,0,10})
190  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F",
191  "0x0",
192  "0x7",
193  "0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798",
194  "0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8",
195  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141",
196  oid);
197 
198  // sm2p256v1
199  if(oid == OID{1,2,156,10197,1,301})
200  return load_EC_group_info("0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFF",
201  "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC",
202  "0x28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB8F92DDBCBD414D940E93",
203  "0x32C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7",
204  "0xBC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0",
205  "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123",
206  oid);
207  // x962_p192v2
208  if(oid == OID{1,2,840,10045,3,1,2})
209  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
210  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
211  "0xCC22D6DFB95C6B25E49C0D6364A4E5980C393AA21668D953",
212  "0xEEA2BAE7E1497842F2DE7769CFE9C989C072AD696F48034A",
213  "0x6574D11D69B6EC7A672BB82A083DF2F2B0847DE970B2DE15",
214  "0xFFFFFFFFFFFFFFFFFFFFFFFE5FB1A724DC80418648D8DD31",
215  oid);
216  // x962_p192v3
217  if(oid == OID{1,2,840,10045,3,1,3})
218  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
219  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
220  "0x22123DC2395A05CAA7423DAECCC94760A7D462256BD56916",
221  "0x7D29778100C65A1DA1783716588DCE2B8B4AEE8E228F1896",
222  "0x38A90F22637337334B49DCB66A6DC8F9978ACA7648A943B0",
223  "0xFFFFFFFFFFFFFFFFFFFFFFFF7A62D031C83F4294F640EC13",
224  oid);
225  // x962_p239v1
226  if(oid == OID{1,2,840,10045,3,1,4})
227  return load_EC_group_info("0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
228  "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
229  "0x6B016C3BDCF18941D0D654921475CA71A9DB2FB27D1D37796185C2942C0A",
230  "0xFFA963CDCA8816CCC33B8642BEDF905C3D358573D3F27FBBD3B3CB9AAAF",
231  "0x7DEBE8E4E90A5DAE6E4054CA530BA04654B36818CE226B39FCCB7B02F1AE",
232  "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B",
233  oid);
234  // x962_p239v2
235  if(oid == OID{1,2,840,10045,3,1,5})
236  return load_EC_group_info("0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
237  "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
238  "0x617FAB6832576CBBFED50D99F0249C3FEE58B94BA0038C7AE84C8C832F2C",
239  "0x38AF09D98727705120C921BB5E9E26296A3CDCF2F35757A0EAFD87B830E7",
240  "0x5B0125E4DBEA0EC7206DA0FC01D9B081329FB555DE6EF460237DFF8BE4BA",
241  "0x7FFFFFFFFFFFFFFFFFFFFFFF800000CFA7E8594377D414C03821BC582063",
242  oid);
243  // x962_p239v3
244  if(oid == OID{1,2,840,10045,3,1,6})
245  return load_EC_group_info("0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
246  "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
247  "0x255705FA2A306654B1F4CB03D6A750A30C250102D4988717D9BA15AB6D3E",
248  "0x6768AE8E18BB92CFCF005C949AA2C6D94853D0E660BBF854B1C9505FE95A",
249  "0x1607E6898F390C06BC1D552BAD226F3B6FCFE48B6E818499AF18E3ED6CF3",
250  "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF975DEB41B3A6057C3C432146526551",
251  oid);
252 
253  return std::shared_ptr<EC_Group_Data>();
254  }

◆ get_a()

const BigInt & Botan::EC_Group::get_a ( ) const

Return the a parameter of the elliptic curve equation

Definition at line 485 of file ec_group.cpp.

Referenced by DER_encode(), operator==(), Botan::sm2_compute_za(), and verify_group().

486  {
487  return data().a();
488  }

◆ get_b()

const BigInt & Botan::EC_Group::get_b ( ) const

Return the b parameter of the elliptic curve equation

Definition at line 490 of file ec_group.cpp.

Referenced by DER_encode(), operator==(), Botan::sm2_compute_za(), and verify_group().

491  {
492  return data().b();
493  }

◆ get_base_point()

const PointGFp & Botan::EC_Group::get_base_point ( ) const

Return group base point

Returns
base point

Definition at line 495 of file ec_group.cpp.

Referenced by DER_encode(), Botan::EC_PrivateKey::EC_PrivateKey(), point_multiply(), and verify_group().

496  {
497  return data().base_point();
498  }

◆ get_cofactor()

const BigInt & Botan::EC_Group::get_cofactor ( ) const

Return the cofactor

Returns
the cofactor

Definition at line 515 of file ec_group.cpp.

Referenced by DER_encode(), Botan::ECIES_KA_Operation::derive_secret(), Botan::ECIES_Decryptor::ECIES_Decryptor(), verify_group(), and verify_public_element().

516  {
517  return data().cofactor();
518  }

◆ get_curve()

const CurveGFp & Botan::EC_Group::get_curve ( ) const

Return domain parameter curve

Returns
domain parameter curve

Definition at line 445 of file ec_group.cpp.

Referenced by Botan::EC_PublicKey::EC_PublicKey().

446  {
447  return data().curve();
448  }

◆ get_curve_oid()

const OID & Botan::EC_Group::get_curve_oid ( ) const

Return the OID of these domain parameters

Returns
the OID

Definition at line 545 of file ec_group.cpp.

Referenced by DER_encode(), Botan::EC_PrivateKey::EC_PrivateKey(), Botan::EC_PublicKey::EC_PublicKey(), and Botan::EC_PublicKey::set_parameter_encoding().

546  {
547  return data().oid();
548  }

◆ get_g_x()

const BigInt & Botan::EC_Group::get_g_x ( ) const

Return the x coordinate of the base point

Definition at line 505 of file ec_group.cpp.

Referenced by operator==(), and Botan::sm2_compute_za().

506  {
507  return data().g_x();
508  }

◆ get_g_y()

const BigInt & Botan::EC_Group::get_g_y ( ) const

Return the y coordinate of the base point

Definition at line 510 of file ec_group.cpp.

Referenced by operator==(), and Botan::sm2_compute_za().

511  {
512  return data().g_y();
513  }

◆ get_oid()

std::string Botan::EC_Group::get_oid ( ) const
inline

Return the OID of these domain parameters

Returns
the OID as a string

Definition at line 239 of file ec_group.h.

239 { return get_curve_oid().as_string(); }
const OID & get_curve_oid() const
Definition: ec_group.cpp:545
std::string as_string() const
Definition: asn1_oid.h:48

◆ get_order()

const BigInt & Botan::EC_Group::get_order ( ) const

Return the order of the base point

Returns
order of the base point

Definition at line 500 of file ec_group.cpp.

Referenced by blinded_var_point_multiply(), DER_encode(), Botan::ECIES_KA_Operation::derive_secret(), Botan::ECIES_Decryptor::ECIES_Decryptor(), random_scalar(), verify_group(), and verify_public_element().

501  {
502  return data().order();
503  }

◆ get_order_bits()

size_t Botan::EC_Group::get_order_bits ( ) const

Return the size of group order in bits (same as get_order().bits())

Definition at line 470 of file ec_group.cpp.

471  {
472  return data().order_bits();
473  }

◆ get_order_bytes()

size_t Botan::EC_Group::get_order_bytes ( ) const

Return the size of p in bytes (same as get_order().bytes())

Definition at line 475 of file ec_group.cpp.

476  {
477  return data().order_bytes();
478  }

◆ get_p()

const BigInt & Botan::EC_Group::get_p ( ) const

Return the prime modulus of the field

Definition at line 480 of file ec_group.cpp.

Referenced by DER_encode(), operator==(), and verify_group().

481  {
482  return data().p();
483  }

◆ get_p_bits()

size_t Botan::EC_Group::get_p_bits ( ) const

Return the size of p in bits (same as get_p().bits())

Definition at line 460 of file ec_group.cpp.

Referenced by Botan::EC_PublicKey::key_length().

461  {
462  return data().p_bits();
463  }

◆ get_p_bytes()

size_t Botan::EC_Group::get_p_bytes ( ) const

Return the size of p in bits (same as get_p().bytes())

Definition at line 465 of file ec_group.cpp.

Referenced by DER_encode(), and Botan::sm2_compute_za().

466  {
467  return data().p_bytes();
468  }

◆ initialized()

bool Botan::EC_Group::initialized ( ) const
inline

Definition at line 313 of file ec_group.h.

313 { return (m_data != nullptr); }

◆ inverse_mod_order()

BigInt Botan::EC_Group::inverse_mod_order ( const BigInt x) const

Definition at line 540 of file ec_group.cpp.

Referenced by Botan::EC_PrivateKey::EC_PrivateKey(), and Botan::SM2_Signature_PrivateKey::SM2_Signature_PrivateKey().

541  {
542  return data().inverse_mod_order(x);
543  }

◆ known_named_groups()

const std::set< std::string > & Botan::EC_Group::known_named_groups ( )
static

Return a set of known named EC groups

Definition at line 257 of file ec_named.cpp.

258  {
259  static const std::set<std::string> named_groups = {
260  "secp160k1",
261  "secp160r1",
262  "secp160r2",
263  "secp192k1",
264  "secp192r1",
265  "secp224k1",
266  "secp224r1",
267  "secp256k1",
268  "secp256r1",
269  "secp384r1",
270  "secp521r1",
271  "brainpool160r1",
272  "brainpool192r1",
273  "brainpool224r1",
274  "brainpool256r1",
275  "brainpool320r1",
276  "brainpool384r1",
277  "brainpool512r1",
278  "x962_p192v2",
279  "x962_p192v3",
280  "x962_p239v1",
281  "x962_p239v2",
282  "x962_p239v3",
283  "gost_256A",
284  "frp256v1",
285  "sm2p256v1"
286  };
287  return named_groups;
288  }

◆ mod_order()

BigInt Botan::EC_Group::mod_order ( const BigInt x) const

Definition at line 520 of file ec_group.cpp.

521  {
522  return data().mod_order(k);
523  }

◆ multiply_mod_order() [1/2]

BigInt Botan::EC_Group::multiply_mod_order ( const BigInt x,
const BigInt y 
) const

Definition at line 530 of file ec_group.cpp.

531  {
532  return data().multiply_mod_order(x, y);
533  }

◆ multiply_mod_order() [2/2]

BigInt Botan::EC_Group::multiply_mod_order ( const BigInt x,
const BigInt y,
const BigInt z 
) const

Definition at line 535 of file ec_group.cpp.

536  {
537  return data().multiply_mod_order(x, y, z);
538  }

◆ operator==()

bool Botan::EC_Group::operator== ( const EC_Group other) const

Definition at line 662 of file ec_group.cpp.

References get_a(), get_b(), get_g_x(), get_g_y(), and get_p().

663  {
664  if(m_data == other.m_data)
665  return true; // same shared rep
666 
667  /*
668  * No point comparing order/cofactor as they are uniquely determined
669  * by the curve equation (p,a,b) and the base point.
670  */
671  return (get_p() == other.get_p() &&
672  get_a() == other.get_a() &&
673  get_b() == other.get_b() &&
674  get_g_x() == other.get_g_x() &&
675  get_g_y() == other.get_g_y());
676  }
const BigInt & get_b() const
Definition: ec_group.cpp:490
const BigInt & get_g_x() const
Definition: ec_group.cpp:505
const BigInt & get_a() const
Definition: ec_group.cpp:485
const BigInt & get_g_y() const
Definition: ec_group.cpp:510
const BigInt & get_p() const
Definition: ec_group.cpp:480

◆ OS2ECP() [1/2]

PointGFp Botan::EC_Group::OS2ECP ( const uint8_t  bits[],
size_t  len 
) const

Definition at line 550 of file ec_group.cpp.

References Botan::OS2ECP().

Referenced by Botan::EC_PrivateKey::EC_PrivateKey(), Botan::ECIES_Encryptor::ECIES_Encryptor(), and Botan::TLS::Callbacks::tls_ecdh_agree().

551  {
552  return Botan::OS2ECP(bits, len, data().curve());
553  }
PointGFp OS2ECP(const uint8_t data[], size_t data_len, const CurveGFp &curve)
Definition: point_gfp.cpp:663

◆ OS2ECP() [2/2]

template<typename Alloc >
PointGFp Botan::EC_Group::OS2ECP ( const std::vector< uint8_t, Alloc > &  vec) const
inline

Definition at line 308 of file ec_group.h.

References Botan::OS2ECP().

309  {
310  return this->OS2ECP(vec.data(), vec.size());
311  }
PointGFp OS2ECP(const uint8_t bits[], size_t len) const
Definition: ec_group.cpp:550

◆ PEM_encode()

std::string Botan::EC_Group::PEM_encode ( ) const

Return the PEM encoding (always in explicit form)

Returns
string containing PEM data

Definition at line 656 of file ec_group.cpp.

References DER_encode(), Botan::EC_DOMPAR_ENC_EXPLICIT, and Botan::PEM_Code::encode().

Referenced by PEM_for_named_group().

657  {
658  const std::vector<uint8_t> der = DER_encode(EC_DOMPAR_ENC_EXPLICIT);
659  return PEM_Code::encode(der, "EC PARAMETERS");
660  }
std::string encode(const uint8_t der[], size_t length, const std::string &label, size_t width)
Definition: pem.cpp:43
std::vector< uint8_t > DER_encode(EC_Group_Encoding form) const
Definition: ec_group.cpp:605

◆ PEM_for_named_group()

std::string Botan::EC_Group::PEM_for_named_group ( const std::string &  name)
static

Return PEM representation of named EC group Deprecated: Use EC_Group(name).PEM_encode() if this is needed

Definition at line 408 of file ec_group.cpp.

References PEM_encode().

409  {
410  try
411  {
412  EC_Group group(name);
413  return group.PEM_encode();
414  }
415  catch(...)
416  {
417  return "";
418  }
419  }

◆ point()

PointGFp Botan::EC_Group::point ( const BigInt x,
const BigInt y 
) const

Return a point on this curve with the affine values x, y

Definition at line 555 of file ec_group.cpp.

Referenced by blinded_var_point_multiply(), Botan::GOST_3410_PublicKey::GOST_3410_PublicKey(), and verify_public_element().

556  {
557  // TODO: randomize the representation?
558  return PointGFp(data().curve(), x, y);
559  }

◆ point_multiply()

PointGFp Botan::EC_Group::point_multiply ( const BigInt x,
const PointGFp pt,
const BigInt y 
) const

Multi exponentiate. Not constant time.

Returns
base_point*x + pt*y

Definition at line 561 of file ec_group.cpp.

References get_base_point(), and Botan::PointGFp_Multi_Point_Precompute::multi_exp().

562  {
563  PointGFp_Multi_Point_Precompute xy_mul(get_base_point(), pt);
564  return xy_mul.multi_exp(x, y);
565  }
const PointGFp & get_base_point() const
Definition: ec_group.cpp:495

◆ random_scalar()

BigInt Botan::EC_Group::random_scalar ( RandomNumberGenerator rng) const

Return a random scalar ie an integer in [1,order)

Definition at line 585 of file ec_group.cpp.

References get_order(), and Botan::BigInt::random_integer().

Referenced by Botan::EC_PrivateKey::EC_PrivateKey().

586  {
587  return BigInt::random_integer(rng, 1, get_order());
588  }
const BigInt & get_order() const
Definition: ec_group.cpp:500
static BigInt random_integer(RandomNumberGenerator &rng, const BigInt &min, const BigInt &max)
Definition: big_rand.cpp:45

◆ square_mod_order()

BigInt Botan::EC_Group::square_mod_order ( const BigInt x) const

Definition at line 525 of file ec_group.cpp.

526  {
527  return data().square_mod_order(x);
528  }

◆ verify_group()

bool Botan::EC_Group::verify_group ( RandomNumberGenerator rng,
bool  strong = false 
) const

Verify EC_Group domain

Returns
true if group is valid. false otherwise

Definition at line 701 of file ec_group.cpp.

References Botan::Modular_Reducer::cube(), get_a(), get_b(), get_base_point(), get_cofactor(), get_order(), get_p(), Botan::is_prime(), Botan::Modular_Reducer::multiply(), Botan::PointGFp::on_the_curve(), Botan::Modular_Reducer::reduce(), and Botan::Modular_Reducer::square().

Referenced by Botan::EC_PublicKey::check_key().

703  {
704  const BigInt& p = get_p();
705  const BigInt& a = get_a();
706  const BigInt& b = get_b();
707  const BigInt& order = get_order();
708  const PointGFp& base_point = get_base_point();
709 
710  if(a < 0 || a >= p)
711  return false;
712  if(b <= 0 || b >= p)
713  return false;
714  if(order <= 0)
715  return false;
716 
717  //check if field modulus is prime
718  if(!is_prime(p, rng, 128))
719  {
720  return false;
721  }
722 
723  //check if order is prime
724  if(!is_prime(order, rng, 128))
725  {
726  return false;
727  }
728 
729  //compute the discriminant: 4*a^3 + 27*b^2 which must be nonzero
730  const Modular_Reducer mod_p(p);
731 
732  const BigInt discriminant = mod_p.reduce(
733  mod_p.multiply(4, mod_p.cube(a)) +
734  mod_p.multiply(27, mod_p.square(b)));
735 
736  if(discriminant == 0)
737  {
738  return false;
739  }
740 
741  //check for valid cofactor
742  if(get_cofactor() < 1)
743  {
744  return false;
745  }
746 
747  //check if the base point is on the curve
748  if(!base_point.on_the_curve())
749  {
750  return false;
751  }
752  if((base_point * get_cofactor()).is_zero())
753  {
754  return false;
755  }
756  //check if order of the base point is correct
757  if(!(base_point * order).is_zero())
758  {
759  return false;
760  }
761 
762  return true;
763  }
const BigInt & get_order() const
Definition: ec_group.cpp:500
bool is_prime(const BigInt &n, RandomNumberGenerator &rng, size_t prob, bool is_random)
Definition: numthry.cpp:507
const PointGFp & get_base_point() const
Definition: ec_group.cpp:495
const BigInt & get_cofactor() const
Definition: ec_group.cpp:515
const BigInt & get_b() const
Definition: ec_group.cpp:490
const BigInt & get_a() const
Definition: ec_group.cpp:485
const BigInt & get_p() const
Definition: ec_group.cpp:480

◆ verify_public_element()

bool Botan::EC_Group::verify_public_element ( const PointGFp y) const

Check if y is a plausible point on the curve

In particular, checks that it is a point on the curve, not infinity, and that it has order matching the group.

Definition at line 678 of file ec_group.cpp.

References get_cofactor(), get_order(), Botan::PointGFp::is_zero(), Botan::PointGFp::on_the_curve(), and point().

Referenced by Botan::EC_PublicKey::check_key().

679  {
680  //check that public point is not at infinity
681  if(point.is_zero())
682  return false;
683 
684  //check that public point is on the curve
685  if(point.on_the_curve() == false)
686  return false;
687 
688  //check that public point has order q
689  if((point * get_order()).is_zero() == false)
690  return false;
691 
692  if(get_cofactor() > 1)
693  {
694  if((point * get_cofactor()).is_zero())
695  return false;
696  }
697 
698  return true;
699  }
PointGFp point(const BigInt &x, const BigInt &y) const
Definition: ec_group.cpp:555
const BigInt & get_order() const
Definition: ec_group.cpp:500
const BigInt & get_cofactor() const
Definition: ec_group.cpp:515
bool on_the_curve() const
Definition: point_gfp.cpp:540
bool is_zero() const
Definition: point_gfp.h:180

◆ zero_point()

PointGFp Botan::EC_Group::zero_point ( ) const

Return the zero (or infinite) point on this curve

Definition at line 599 of file ec_group.cpp.

600  {
601  return PointGFp(data().curve());
602  }

The documentation for this class was generated from the following files: