Botan  2.10.0
Crypto and TLS for C++11
Public Member Functions | Static Public Member Functions | List of all members
Botan::EC_Group Class Referencefinal

#include <ec_group.h>

Public Member Functions

bool a_is_minus_3 () const
 
bool a_is_zero () const
 
PointGFp blinded_base_point_multiply (const BigInt &k, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const
 
BigInt blinded_base_point_multiply_x (const BigInt &k, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const
 
PointGFp blinded_var_point_multiply (const PointGFp &point, const BigInt &k, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const
 
std::vector< uint8_t > DER_encode (EC_Group_Encoding form) const
 
 EC_Group (const CurveGFp &curve, const PointGFp &base_point, const BigInt &order, const BigInt &cofactor)
 
 EC_Group (const BigInt &p, const BigInt &a, const BigInt &b, const BigInt &base_x, const BigInt &base_y, const BigInt &order, const BigInt &cofactor, const OID &oid=OID())
 
 EC_Group (const std::vector< uint8_t > &ber_encoding)
 
 EC_Group (const OID &oid)
 
 EC_Group (const std::string &pem_or_oid)
 
 EC_Group ()
 
const BigIntget_a () const
 
const BigIntget_b () const
 
const PointGFpget_base_point () const
 
const BigIntget_cofactor () const
 
const CurveGFpget_curve () const
 
const OIDget_curve_oid () const
 
const BigIntget_g_x () const
 
const BigIntget_g_y () const
 
std::string get_oid () const
 
const BigIntget_order () const
 
size_t get_order_bits () const
 
size_t get_order_bytes () const
 
const BigIntget_p () const
 
size_t get_p_bits () const
 
size_t get_p_bytes () const
 
bool initialized () const
 
BigInt inverse_mod_order (const BigInt &x) const
 
BigInt mod_order (const BigInt &x) const
 
BigInt multiply_mod_order (const BigInt &x, const BigInt &y) const
 
BigInt multiply_mod_order (const BigInt &x, const BigInt &y, const BigInt &z) const
 
bool operator== (const EC_Group &other) const
 
PointGFp OS2ECP (const uint8_t bits[], size_t len) const
 
template<typename Alloc >
PointGFp OS2ECP (const std::vector< uint8_t, Alloc > &vec) const
 
std::string PEM_encode () const
 
PointGFp point (const BigInt &x, const BigInt &y) const
 
PointGFp point_multiply (const BigInt &x, const PointGFp &pt, const BigInt &y) const
 
size_t point_size (PointGFp::Compression_Type format) const
 
BigInt random_scalar (RandomNumberGenerator &rng) const
 
BigInt square_mod_order (const BigInt &x) const
 
bool verify_group (RandomNumberGenerator &rng, bool strong=false) const
 
bool verify_public_element (const PointGFp &y) const
 
PointGFp zero_point () const
 
 ~EC_Group ()
 

Static Public Member Functions

static size_t clear_registered_curve_data ()
 
static std::shared_ptr< EC_Group_Data > EC_group_info (const OID &oid)
 
static const std::set< std::string > & known_named_groups ()
 
static std::string PEM_for_named_group (const std::string &name)
 

Detailed Description

Class representing an elliptic curve

The internal representation is stored in a shared_ptr, so copying an EC_Group is inexpensive.

Definition at line 40 of file ec_group.h.

Constructor & Destructor Documentation

◆ EC_Group() [1/6]

Botan::EC_Group::EC_Group ( const CurveGFp curve,
const PointGFp base_point,
const BigInt order,
const BigInt cofactor 
)
inline

Construct Domain paramers from specified parameters

Parameters
curveelliptic curve
base_pointa base point
orderthe order of the base point
cofactorthe cofactor

Definition at line 52 of file ec_group.h.

References Botan::PKCS8::PEM_encode().

55  :
56  EC_Group(curve.get_p(),
57  curve.get_a(),
58  curve.get_b(),
59  base_point.get_affine_x(),
60  base_point.get_affine_y(),
61  order,
62  cofactor) {}

◆ EC_Group() [2/6]

Botan::EC_Group::EC_Group ( const BigInt p,
const BigInt a,
const BigInt b,
const BigInt base_x,
const BigInt base_y,
const BigInt order,
const BigInt cofactor,
const OID oid = OID() 
)

Construct Domain paramers from specified parameters

Parameters
pthe elliptic curve p
athe elliptic curve a param
bthe elliptic curve b param
base_xthe x coordinate of the base point
base_ythe y coordinate of the base point
orderthe order of the base point
cofactorthe cofactor
oidan optional OID used to identify this curve

Definition at line 400 of file ec_group.cpp.

408  {
409  m_data = ec_group_data().lookup_or_create(p, a, b, base_x, base_y, order, cofactor, oid);
410  }

◆ EC_Group() [3/6]

Botan::EC_Group::EC_Group ( const std::vector< uint8_t > &  ber_encoding)
explicit

Decode a BER encoded ECC domain parameter set

Parameters
ber_encodingthe bytes of the BER encoding

Definition at line 412 of file ec_group.cpp.

413  {
414  m_data = BER_decode_EC_group(ber.data(), ber.size());
415  }

◆ EC_Group() [4/6]

Botan::EC_Group::EC_Group ( const OID oid)
explicit

Create an EC domain by OID (or throw if unknown)

Parameters
oidthe OID of the EC domain to create

Definition at line 350 of file ec_group.cpp.

References Botan::OID::to_string().

351  {
352  this->m_data = ec_group_data().lookup(domain_oid);
353  if(!this->m_data)
354  throw Invalid_Argument("Unknown EC_Group " + domain_oid.to_string());
355  }

◆ EC_Group() [5/6]

Botan::EC_Group::EC_Group ( const std::string &  pem_or_oid)
explicit

Create an EC domain from PEM encoding (as from PEM_encode), or from an OID name (eg "secp256r1", or "1.2.840.10045.3.1.7")

Parameters
pem_or_oidPEM-encoded data, or an OID

Definition at line 357 of file ec_group.cpp.

References Botan::PEM_Code::decode_check_label(), Botan::OID::empty(), and Botan::OIDS::lookup().

358  {
359  if(str == "")
360  return; // no initialization / uninitialized
361 
362  try
363  {
364  OID oid = OIDS::lookup(str);
365  if(oid.empty() == false)
366  m_data = ec_group_data().lookup(oid);
367  }
368  catch(Invalid_OID&)
369  {
370  }
371 
372  if(m_data == nullptr)
373  {
374  if(str.size() > 30 && str.substr(0, 29) == "-----BEGIN EC PARAMETERS-----")
375  {
376  // OK try it as PEM ...
377  secure_vector<uint8_t> ber = PEM_Code::decode_check_label(str, "EC PARAMETERS");
378  this->m_data = BER_decode_EC_group(ber.data(), ber.size());
379  }
380  }
381 
382  if(m_data == nullptr)
383  throw Invalid_Argument("Unknown ECC group '" + str + "'");
384  }
secure_vector< uint8_t > decode_check_label(DataSource &source, const std::string &label_want)
Definition: pem.cpp:54
std::string lookup(const OID &oid)
Definition: oids.cpp:113

◆ EC_Group() [6/6]

Botan::EC_Group::EC_Group ( )

Create an uninitialized EC_Group

Definition at line 341 of file ec_group.cpp.

342  {
343  }

◆ ~EC_Group()

Botan::EC_Group::~EC_Group ( )

Definition at line 345 of file ec_group.cpp.

346  {
347  // shared_ptr possibly freed here
348  }

Member Function Documentation

◆ a_is_minus_3()

bool Botan::EC_Group::a_is_minus_3 ( ) const

Return if a == -3 mod p

Definition at line 429 of file ec_group.cpp.

430  {
431  return data().a_is_minus_3();
432  }

◆ a_is_zero()

bool Botan::EC_Group::a_is_zero ( ) const

Return if a == 0 mod p

Definition at line 434 of file ec_group.cpp.

435  {
436  return data().a_is_zero();
437  }

◆ blinded_base_point_multiply()

PointGFp Botan::EC_Group::blinded_base_point_multiply ( const BigInt k,
RandomNumberGenerator rng,
std::vector< BigInt > &  ws 
) const

Blinded point multiplication, attempts resistance to side channels

Parameters
kthe scalar
rnga random number generator
wsa temp workspace
Returns
base_point*k

Definition at line 555 of file ec_group.cpp.

Referenced by Botan::EC_PrivateKey::EC_PrivateKey().

558  {
559  return data().blinded_base_point_multiply(k, rng, ws);
560  }

◆ blinded_base_point_multiply_x()

BigInt Botan::EC_Group::blinded_base_point_multiply_x ( const BigInt k,
RandomNumberGenerator rng,
std::vector< BigInt > &  ws 
) const

Blinded point multiplication, attempts resistance to side channels Returns just the x coordinate of the point

Parameters
kthe scalar
rnga random number generator
wsa temp workspace
Returns
x coordinate of base_point*k

Definition at line 562 of file ec_group.cpp.

References Botan::PointGFp::get_affine_x(), and Botan::PointGFp::is_zero().

565  {
566  const PointGFp pt = data().blinded_base_point_multiply(k, rng, ws);
567 
568  if(pt.is_zero())
569  return 0;
570  return pt.get_affine_x();
571  }

◆ blinded_var_point_multiply()

PointGFp Botan::EC_Group::blinded_var_point_multiply ( const PointGFp point,
const BigInt k,
RandomNumberGenerator rng,
std::vector< BigInt > &  ws 
) const

Blinded point multiplication, attempts resistance to side channels

Parameters
pointinput point
kthe scalar
rnga random number generator
wsa temp workspace
Returns
point*k

Definition at line 578 of file ec_group.cpp.

References Botan::PointGFp_Var_Point_Precompute::mul().

582  {
583  PointGFp_Var_Point_Precompute mul(point, rng, ws);
584  return mul.mul(k, rng, get_order(), ws);
585  }
PointGFp point(const BigInt &x, const BigInt &y) const
Definition: ec_group.cpp:543
const BigInt & get_order() const
Definition: ec_group.cpp:479

◆ clear_registered_curve_data()

size_t Botan::EC_Group::clear_registered_curve_data ( )
static

◆ DER_encode()

std::vector< uint8_t > Botan::EC_Group::DER_encode ( EC_Group_Encoding  form) const

Create the DER encoding of this domain

Parameters
formof encoding to use
Returns
bytes encododed as DER

Definition at line 593 of file ec_group.cpp.

References Botan::EC_DOMPAR_ENC_EXPLICIT, Botan::EC_DOMPAR_ENC_IMPLICITCA, Botan::EC_DOMPAR_ENC_OID, Botan::OID::empty(), Botan::PEM_Code::encode(), Botan::DER_Encoder::encode(), Botan::BigInt::encode_1363(), Botan::DER_Encoder::encode_null(), Botan::DER_Encoder::end_cons(), Botan::OCTET_STRING, Botan::SEQUENCE, Botan::DER_Encoder::start_cons(), and Botan::PointGFp::UNCOMPRESSED.

594  {
595  std::vector<uint8_t> output;
596 
597  DER_Encoder der(output);
598 
599  if(form == EC_DOMPAR_ENC_EXPLICIT)
600  {
601  const size_t ecpVers1 = 1;
602  const OID curve_type("1.2.840.10045.1.1"); // prime field
603 
604  const size_t p_bytes = get_p_bytes();
605 
606  der.start_cons(SEQUENCE)
607  .encode(ecpVers1)
608  .start_cons(SEQUENCE)
609  .encode(curve_type)
610  .encode(get_p())
611  .end_cons()
612  .start_cons(SEQUENCE)
613  .encode(BigInt::encode_1363(get_a(), p_bytes),
614  OCTET_STRING)
615  .encode(BigInt::encode_1363(get_b(), p_bytes),
616  OCTET_STRING)
617  .end_cons()
619  .encode(get_order())
620  .encode(get_cofactor())
621  .end_cons();
622  }
623  else if(form == EC_DOMPAR_ENC_OID)
624  {
625  const OID oid = get_curve_oid();
626  if(oid.empty())
627  {
628  throw Encoding_Error("Cannot encode EC_Group as OID because OID not set");
629  }
630  der.encode(oid);
631  }
632  else if(form == EC_DOMPAR_ENC_IMPLICITCA)
633  {
634  der.encode_null();
635  }
636  else
637  {
638  throw Internal_Error("EC_Group::DER_encode: Unknown encoding");
639  }
640 
641  return output;
642  }
size_t get_p_bytes() const
Definition: ec_group.cpp:444
const OID & get_curve_oid() const
Definition: ec_group.cpp:524
const BigInt & get_order() const
Definition: ec_group.cpp:479
std::string encode(const uint8_t der[], size_t length, const std::string &label, size_t width)
Definition: pem.cpp:43
const PointGFp & get_base_point() const
Definition: ec_group.cpp:474
const BigInt & get_cofactor() const
Definition: ec_group.cpp:494
const BigInt & get_b() const
Definition: ec_group.cpp:469
const BigInt & get_a() const
Definition: ec_group.cpp:464
const BigInt & get_p() const
Definition: ec_group.cpp:459
static secure_vector< uint8_t > encode_1363(const BigInt &n, size_t bytes)
Definition: big_code.cpp:111

◆ EC_group_info()

std::shared_ptr< EC_Group_Data > Botan::EC_Group::EC_group_info ( const OID oid)
static

Definition at line 13 of file ec_named.cpp.

14  {
15  // P-256
16  if(oid == OID{1,2,840,10045,3,1,7})
17  return load_EC_group_info("0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF",
18  "0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC",
19  "0x5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B",
20  "0x6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296",
21  "0x4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5",
22  "0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551",
23  oid);
24 
25  // P-384
26  if(oid == OID{1,3,132,0,34})
27  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF",
28  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC",
29  "0xB3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF",
30  "0xAA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7",
31  "0x3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F",
32  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973",
33  oid);
34  // P-521
35  if(oid == OID{1,3,132,0,35})
36  return load_EC_group_info("0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
37  "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC",
38  "0x51953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00",
39  "0xC6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66",
40  "0x11839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650",
41  "0x1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409",
42  oid);
43 
44  // brainpool160r1
45  if(oid == OID{1,3,36,3,3,2,8,1,1,1})
46  return load_EC_group_info("0xE95E4A5F737059DC60DFC7AD95B3D8139515620F",
47  "0x340E7BE2A280EB74E2BE61BADA745D97E8F7C300",
48  "0x1E589A8595423412134FAA2DBDEC95C8D8675E58",
49  "0xBED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC3",
50  "0x1667CB477A1A8EC338F94741669C976316DA6321",
51  "0xE95E4A5F737059DC60DF5991D45029409E60FC09",
52  oid);
53  // brainpool192r1
54  if(oid == OID{1,3,36,3,3,2,8,1,1,3})
55  return load_EC_group_info("0xC302F41D932A36CDA7A3463093D18DB78FCE476DE1A86297",
56  "0x6A91174076B1E0E19C39C031FE8685C1CAE040E5C69A28EF",
57  "0x469A28EF7C28CCA3DC721D044F4496BCCA7EF4146FBF25C9",
58  "0xC0A0647EAAB6A48753B033C56CB0F0900A2F5C4853375FD6",
59  "0x14B690866ABD5BB88B5F4828C1490002E6773FA2FA299B8F",
60  "0xC302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1",
61  oid);
62  // brainpool224r1
63  if(oid == OID{1,3,36,3,3,2,8,1,1,5})
64  return load_EC_group_info("0xD7C134AA264366862A18302575D1D787B09F075797DA89F57EC8C0FF",
65  "0x68A5E62CA9CE6C1C299803A6C1530B514E182AD8B0042A59CAD29F43",
66  "0x2580F63CCFE44138870713B1A92369E33E2135D266DBB372386C400B",
67  "0xD9029AD2C7E5CF4340823B2A87DC68C9E4CE3174C1E6EFDEE12C07D",
68  "0x58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD",
69  "0xD7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F",
70  oid);
71  // brainpool256r1
72  if(oid == OID{1,3,36,3,3,2,8,1,1,7})
73  return load_EC_group_info("0xA9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377",
74  "0x7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9",
75  "0x26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6",
76  "0x8BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262",
77  "0x547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997",
78  "0xA9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7",
79  oid);
80  // brainpool320r1
81  if(oid == OID{1,3,36,3,3,2,8,1,1,9})
82  return load_EC_group_info("0xD35E472036BC4FB7E13C785ED201E065F98FCFA6F6F40DEF4F92B9EC7893EC28FCD412B1F1B32E27",
83  "0x3EE30B568FBAB0F883CCEBD46D3F3BB8A2A73513F5EB79DA66190EB085FFA9F492F375A97D860EB4",
84  "0x520883949DFDBC42D3AD198640688A6FE13F41349554B49ACC31DCCD884539816F5EB4AC8FB1F1A6",
85  "0x43BD7E9AFB53D8B85289BCC48EE5BFE6F20137D10A087EB6E7871E2A10A599C710AF8D0D39E20611",
86  "0x14FDD05545EC1CC8AB4093247F77275E0743FFED117182EAA9C77877AAAC6AC7D35245D1692E8EE1",
87  "0xD35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311",
88  oid);
89  // brainpool384r1
90  if(oid == OID{1,3,36,3,3,2,8,1,1,11})
91  return load_EC_group_info("0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53",
92  "0x7BC382C63D8C150C3C72080ACE05AFA0C2BEA28E4FB22787139165EFBA91F90F8AA5814A503AD4EB04A8C7DD22CE2826",
93  "0x4A8C7DD22CE28268B39B55416F0447C2FB77DE107DCD2A62E880EA53EEB62D57CB4390295DBC9943AB78696FA504C11",
94  "0x1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E",
95  "0x8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315",
96  "0x8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565",
97  oid);
98  // brainpool512r1
99  if(oid == OID{1,3,36,3,3,2,8,1,1,13})
100  return load_EC_group_info("0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3",
101  "0x7830A3318B603B89E2327145AC234CC594CBDD8D3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CA",
102  "0x3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CADC083E67984050B75EBAE5DD2809BD638016F723",
103  "0x81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822",
104  "0x7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892",
105  "0xAADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069",
106  oid);
107  // frp256v1
108  if(oid == OID{1,2,250,1,223,101,256,1})
109  return load_EC_group_info("0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C03",
110  "0xF1FD178C0B3AD58F10126DE8CE42435B3961ADBCABC8CA6DE8FCF353D86E9C00",
111  "0xEE353FCA5428A9300D4ABA754A44C00FDFEC0C9AE4B1A1803075ED967B7BB73F",
112  "0xB6B3D4C356C139EB31183D4749D423958C27D2DCAF98B70164C97A2DD98F5CFF",
113  "0x6142E0F7C8B204911F9271F0F3ECEF8C2701C307E8E4C9E183115A1554062CFB",
114  "0xF1FD178C0B3AD58F10126DE8CE42435B53DC67E140D2BF941FFDD459C6D655E1",
115  oid);
116  // gost_256A
117  if(oid == OID{1,2,643,2,2,35,1})
118  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD97",
119  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD94",
120  "0xA6",
121  "0x1",
122  "0x8D91E471E0989CDA27DF505A453F2B7635294F2DDF23E3B122ACC99C9E9F1E14",
123  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C611070995AD10045841B09B761B893",
124  oid);
125  // secp160k1
126  if(oid == OID{1,3,132,0,9})
127  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
128  "0x0",
129  "0x7",
130  "0x3B4C382CE37AA192A4019E763036F4F5DD4D7EBB",
131  "0x938CF935318FDCED6BC28286531733C3F03C4FEE",
132  "0x100000000000000000001B8FA16DFAB9ACA16B6B3",
133  oid);
134  // secp160r1
135  if(oid == OID{1,3,132,0,8})
136  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF",
137  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC",
138  "0x1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45",
139  "0x4A96B5688EF573284664698968C38BB913CBFC82",
140  "0x23A628553168947D59DCC912042351377AC5FB32",
141  "0x100000000000000000001F4C8F927AED3CA752257",
142  oid);
143  // secp160r2
144  if(oid == OID{1,3,132,0,30})
145  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73",
146  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC70",
147  "0xB4E134D3FB59EB8BAB57274904664D5AF50388BA",
148  "0x52DCB034293A117E1F4FF11B30F7199D3144CE6D",
149  "0xFEAFFEF2E331F296E071FA0DF9982CFEA7D43F2E",
150  "0x100000000000000000000351EE786A818F3A1A16B",
151  oid);
152  // secp192k1
153  if(oid == OID{1,3,132,0,31})
154  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37",
155  "0x0",
156  "0x3",
157  "0xDB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D",
158  "0x9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D",
159  "0xFFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D",
160  oid);
161  // secp192r1
162  if(oid == OID{1,2,840,10045,3,1,1})
163  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
164  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
165  "0x64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1",
166  "0x188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012",
167  "0x7192B95FFC8DA78631011ED6B24CDD573F977A11E794811",
168  "0xFFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831",
169  oid);
170  // secp224k1
171  if(oid == OID{1,3,132,0,32})
172  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D",
173  "0x0",
174  "0x5",
175  "0xA1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C",
176  "0x7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5",
177  "0x10000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7",
178  oid);
179  // secp224r1
180  if(oid == OID{1,3,132,0,33})
181  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001",
182  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE",
183  "0xB4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4",
184  "0xB70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21",
185  "0xBD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34",
186  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D",
187  oid);
188  // secp256k1
189  if(oid == OID{1,3,132,0,10})
190  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F",
191  "0x0",
192  "0x7",
193  "0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798",
194  "0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8",
195  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141",
196  oid);
197 
198  // sm2p256v1
199  if(oid == OID{1,2,156,10197,1,301})
200  return load_EC_group_info("0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFF",
201  "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC",
202  "0x28E9FA9E9D9F5E344D5A9E4BCF6509A7F39789F515AB8F92DDBCBD414D940E93",
203  "0x32C4AE2C1F1981195F9904466A39C9948FE30BBFF2660BE1715A4589334C74C7",
204  "0xBC3736A2F4F6779C59BDCEE36B692153D0A9877CC62A474002DF32E52139F0A0",
205  "0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFF7203DF6B21C6052B53BBF40939D54123",
206  oid);
207  // x962_p192v2
208  if(oid == OID{1,2,840,10045,3,1,2})
209  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
210  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
211  "0xCC22D6DFB95C6B25E49C0D6364A4E5980C393AA21668D953",
212  "0xEEA2BAE7E1497842F2DE7769CFE9C989C072AD696F48034A",
213  "0x6574D11D69B6EC7A672BB82A083DF2F2B0847DE970B2DE15",
214  "0xFFFFFFFFFFFFFFFFFFFFFFFE5FB1A724DC80418648D8DD31",
215  oid);
216  // x962_p192v3
217  if(oid == OID{1,2,840,10045,3,1,3})
218  return load_EC_group_info("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF",
219  "0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC",
220  "0x22123DC2395A05CAA7423DAECCC94760A7D462256BD56916",
221  "0x7D29778100C65A1DA1783716588DCE2B8B4AEE8E228F1896",
222  "0x38A90F22637337334B49DCB66A6DC8F9978ACA7648A943B0",
223  "0xFFFFFFFFFFFFFFFFFFFFFFFF7A62D031C83F4294F640EC13",
224  oid);
225  // x962_p239v1
226  if(oid == OID{1,2,840,10045,3,1,4})
227  return load_EC_group_info("0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
228  "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
229  "0x6B016C3BDCF18941D0D654921475CA71A9DB2FB27D1D37796185C2942C0A",
230  "0xFFA963CDCA8816CCC33B8642BEDF905C3D358573D3F27FBBD3B3CB9AAAF",
231  "0x7DEBE8E4E90A5DAE6E4054CA530BA04654B36818CE226B39FCCB7B02F1AE",
232  "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B",
233  oid);
234  // x962_p239v2
235  if(oid == OID{1,2,840,10045,3,1,5})
236  return load_EC_group_info("0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
237  "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
238  "0x617FAB6832576CBBFED50D99F0249C3FEE58B94BA0038C7AE84C8C832F2C",
239  "0x38AF09D98727705120C921BB5E9E26296A3CDCF2F35757A0EAFD87B830E7",
240  "0x5B0125E4DBEA0EC7206DA0FC01D9B081329FB555DE6EF460237DFF8BE4BA",
241  "0x7FFFFFFFFFFFFFFFFFFFFFFF800000CFA7E8594377D414C03821BC582063",
242  oid);
243  // x962_p239v3
244  if(oid == OID{1,2,840,10045,3,1,6})
245  return load_EC_group_info("0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF",
246  "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC",
247  "0x255705FA2A306654B1F4CB03D6A750A30C250102D4988717D9BA15AB6D3E",
248  "0x6768AE8E18BB92CFCF005C949AA2C6D94853D0E660BBF854B1C9505FE95A",
249  "0x1607E6898F390C06BC1D552BAD226F3B6FCFE48B6E818499AF18E3ED6CF3",
250  "0x7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF975DEB41B3A6057C3C432146526551",
251  oid);
252 
253  return std::shared_ptr<EC_Group_Data>();
254  }

◆ get_a()

const BigInt & Botan::EC_Group::get_a ( ) const

Return the a parameter of the elliptic curve equation

Definition at line 464 of file ec_group.cpp.

Referenced by operator==(), and Botan::sm2_compute_za().

465  {
466  return data().a();
467  }

◆ get_b()

const BigInt & Botan::EC_Group::get_b ( ) const

Return the b parameter of the elliptic curve equation

Definition at line 469 of file ec_group.cpp.

Referenced by operator==(), and Botan::sm2_compute_za().

470  {
471  return data().b();
472  }

◆ get_base_point()

const PointGFp & Botan::EC_Group::get_base_point ( ) const

Return group base point

Returns
base point

Definition at line 474 of file ec_group.cpp.

Referenced by Botan::EC_PrivateKey::EC_PrivateKey().

475  {
476  return data().base_point();
477  }

◆ get_cofactor()

const BigInt & Botan::EC_Group::get_cofactor ( ) const

Return the cofactor

Returns
the cofactor

Definition at line 494 of file ec_group.cpp.

Referenced by Botan::ECIES_KA_Operation::derive_secret(), and Botan::ECIES_Decryptor::ECIES_Decryptor().

495  {
496  return data().cofactor();
497  }

◆ get_curve()

const CurveGFp & Botan::EC_Group::get_curve ( ) const

Return domain parameter curve

Returns
domain parameter curve

Definition at line 424 of file ec_group.cpp.

Referenced by Botan::EC_PublicKey::EC_PublicKey().

425  {
426  return data().curve();
427  }

◆ get_curve_oid()

const OID & Botan::EC_Group::get_curve_oid ( ) const

Return the OID of these domain parameters

Returns
the OID

Definition at line 524 of file ec_group.cpp.

Referenced by Botan::EC_PrivateKey::EC_PrivateKey(), Botan::EC_PublicKey::EC_PublicKey(), and Botan::EC_PublicKey::set_parameter_encoding().

525  {
526  return data().oid();
527  }

◆ get_g_x()

const BigInt & Botan::EC_Group::get_g_x ( ) const

Return the x coordinate of the base point

Definition at line 484 of file ec_group.cpp.

Referenced by operator==(), and Botan::sm2_compute_za().

485  {
486  return data().g_x();
487  }

◆ get_g_y()

const BigInt & Botan::EC_Group::get_g_y ( ) const

Return the y coordinate of the base point

Definition at line 489 of file ec_group.cpp.

Referenced by operator==(), and Botan::sm2_compute_za().

490  {
491  return data().g_y();
492  }

◆ get_oid()

std::string Botan::EC_Group::get_oid ( ) const
inline

Return the OID of these domain parameters

Returns
the OID as a string

Definition at line 239 of file ec_group.h.

References Botan::OS2ECP().

239 { return get_curve_oid().to_string(); }
const OID & get_curve_oid() const
Definition: ec_group.cpp:524
std::string to_string() const
Definition: asn1_oid.cpp:50

◆ get_order()

const BigInt & Botan::EC_Group::get_order ( ) const

Return the order of the base point

Returns
order of the base point

Definition at line 479 of file ec_group.cpp.

Referenced by Botan::ECIES_KA_Operation::derive_secret(), and Botan::ECIES_Decryptor::ECIES_Decryptor().

480  {
481  return data().order();
482  }

◆ get_order_bits()

size_t Botan::EC_Group::get_order_bits ( ) const

Return the size of group order in bits (same as get_order().bits())

Definition at line 449 of file ec_group.cpp.

450  {
451  return data().order_bits();
452  }

◆ get_order_bytes()

size_t Botan::EC_Group::get_order_bytes ( ) const

Return the size of p in bytes (same as get_order().bytes())

Definition at line 454 of file ec_group.cpp.

455  {
456  return data().order_bytes();
457  }

◆ get_p()

const BigInt & Botan::EC_Group::get_p ( ) const

Return the prime modulus of the field

Definition at line 459 of file ec_group.cpp.

Referenced by operator==().

460  {
461  return data().p();
462  }

◆ get_p_bits()

size_t Botan::EC_Group::get_p_bits ( ) const

Return the size of p in bits (same as get_p().bits())

Definition at line 439 of file ec_group.cpp.

Referenced by Botan::EC_PublicKey::key_length().

440  {
441  return data().p_bits();
442  }

◆ get_p_bytes()

size_t Botan::EC_Group::get_p_bytes ( ) const

Return the size of p in bits (same as get_p().bytes())

Definition at line 444 of file ec_group.cpp.

Referenced by Botan::sm2_compute_za().

445  {
446  return data().p_bytes();
447  }

◆ initialized()

bool Botan::EC_Group::initialized ( ) const
inline

Definition at line 315 of file ec_group.h.

References name, and Botan::operator==().

315 { return (m_data != nullptr); }

◆ inverse_mod_order()

BigInt Botan::EC_Group::inverse_mod_order ( const BigInt x) const

Definition at line 519 of file ec_group.cpp.

Referenced by Botan::EC_PrivateKey::EC_PrivateKey(), and Botan::SM2_PrivateKey::SM2_PrivateKey().

520  {
521  return data().inverse_mod_order(x);
522  }

◆ known_named_groups()

const std::set< std::string > & Botan::EC_Group::known_named_groups ( )
static

Return a set of known named EC groups

Definition at line 257 of file ec_named.cpp.

258  {
259  static const std::set<std::string> named_groups = {
260  "secp160k1",
261  "secp160r1",
262  "secp160r2",
263  "secp192k1",
264  "secp192r1",
265  "secp224k1",
266  "secp224r1",
267  "secp256k1",
268  "secp256r1",
269  "secp384r1",
270  "secp521r1",
271  "brainpool160r1",
272  "brainpool192r1",
273  "brainpool224r1",
274  "brainpool256r1",
275  "brainpool320r1",
276  "brainpool384r1",
277  "brainpool512r1",
278  "x962_p192v2",
279  "x962_p192v3",
280  "x962_p239v1",
281  "x962_p239v2",
282  "x962_p239v3",
283  "gost_256A",
284  "frp256v1",
285  "sm2p256v1"
286  };
287  return named_groups;
288  }

◆ mod_order()

BigInt Botan::EC_Group::mod_order ( const BigInt x) const

Definition at line 499 of file ec_group.cpp.

500  {
501  return data().mod_order(k);
502  }

◆ multiply_mod_order() [1/2]

BigInt Botan::EC_Group::multiply_mod_order ( const BigInt x,
const BigInt y 
) const

Definition at line 509 of file ec_group.cpp.

510  {
511  return data().multiply_mod_order(x, y);
512  }

◆ multiply_mod_order() [2/2]

BigInt Botan::EC_Group::multiply_mod_order ( const BigInt x,
const BigInt y,
const BigInt z 
) const

Definition at line 514 of file ec_group.cpp.

515  {
516  return data().multiply_mod_order(x, y, z);
517  }

◆ operator==()

bool Botan::EC_Group::operator== ( const EC_Group other) const

Definition at line 650 of file ec_group.cpp.

References get_a(), get_b(), get_g_x(), get_g_y(), and get_p().

651  {
652  if(m_data == other.m_data)
653  return true; // same shared rep
654 
655  /*
656  * No point comparing order/cofactor as they are uniquely determined
657  * by the curve equation (p,a,b) and the base point.
658  */
659  return (get_p() == other.get_p() &&
660  get_a() == other.get_a() &&
661  get_b() == other.get_b() &&
662  get_g_x() == other.get_g_x() &&
663  get_g_y() == other.get_g_y());
664  }
const BigInt & get_b() const
Definition: ec_group.cpp:469
const BigInt & get_g_x() const
Definition: ec_group.cpp:484
const BigInt & get_a() const
Definition: ec_group.cpp:464
const BigInt & get_g_y() const
Definition: ec_group.cpp:489
const BigInt & get_p() const
Definition: ec_group.cpp:459

◆ OS2ECP() [1/2]

PointGFp Botan::EC_Group::OS2ECP ( const uint8_t  bits[],
size_t  len 
) const

Definition at line 538 of file ec_group.cpp.

References Botan::OS2ECP().

Referenced by Botan::EC_PrivateKey::EC_PrivateKey(), Botan::EC_PublicKey::EC_PublicKey(), Botan::ECIES_Decryptor::ECIES_Decryptor(), Botan::ECIES_Encryptor::ECIES_Encryptor(), and Botan::TLS::Callbacks::tls_ecdh_agree().

539  {
540  return Botan::OS2ECP(bits, len, data().curve());
541  }
PointGFp OS2ECP(const uint8_t data[], size_t data_len, const CurveGFp &curve)
Definition: point_gfp.cpp:661

◆ OS2ECP() [2/2]

template<typename Alloc >
PointGFp Botan::EC_Group::OS2ECP ( const std::vector< uint8_t, Alloc > &  vec) const
inline

Definition at line 310 of file ec_group.h.

References Botan::OS2ECP().

311  {
312  return this->OS2ECP(vec.data(), vec.size());
313  }
PointGFp OS2ECP(const uint8_t bits[], size_t len) const
Definition: ec_group.cpp:538

◆ PEM_encode()

std::string Botan::EC_Group::PEM_encode ( ) const

Return the PEM encoding (always in explicit form)

Returns
string containing PEM data

Definition at line 644 of file ec_group.cpp.

References Botan::EC_DOMPAR_ENC_EXPLICIT, and Botan::PEM_Code::encode().

Referenced by PEM_for_named_group().

645  {
646  const std::vector<uint8_t> der = DER_encode(EC_DOMPAR_ENC_EXPLICIT);
647  return PEM_Code::encode(der, "EC PARAMETERS");
648  }
std::string encode(const uint8_t der[], size_t length, const std::string &label, size_t width)
Definition: pem.cpp:43
std::vector< uint8_t > DER_encode(EC_Group_Encoding form) const
Definition: ec_group.cpp:593

◆ PEM_for_named_group()

std::string Botan::EC_Group::PEM_for_named_group ( const std::string &  name)
static

Return PEM representation of named EC group Deprecated: Use EC_Group(name).PEM_encode() if this is needed

Definition at line 387 of file ec_group.cpp.

References PEM_encode().

388  {
389  try
390  {
391  EC_Group group(name);
392  return group.PEM_encode();
393  }
394  catch(...)
395  {
396  return "";
397  }
398  }
std::string name

◆ point()

PointGFp Botan::EC_Group::point ( const BigInt x,
const BigInt y 
) const

Return a point on this curve with the affine values x, y

Definition at line 543 of file ec_group.cpp.

Referenced by Botan::GOST_3410_PublicKey::GOST_3410_PublicKey().

544  {
545  // TODO: randomize the representation?
546  return PointGFp(data().curve(), x, y);
547  }

◆ point_multiply()

PointGFp Botan::EC_Group::point_multiply ( const BigInt x,
const PointGFp pt,
const BigInt y 
) const

Multi exponentiate. Not constant time.

Returns
base_point*x + pt*y

Definition at line 549 of file ec_group.cpp.

References Botan::PointGFp_Multi_Point_Precompute::multi_exp().

550  {
551  PointGFp_Multi_Point_Precompute xy_mul(get_base_point(), pt);
552  return xy_mul.multi_exp(x, y);
553  }
const PointGFp & get_base_point() const
Definition: ec_group.cpp:474

◆ point_size()

size_t Botan::EC_Group::point_size ( PointGFp::Compression_Type  format) const

Definition at line 529 of file ec_group.cpp.

References Botan::PointGFp::COMPRESSED.

Referenced by Botan::ECIES_Decryptor::ECIES_Decryptor().

530  {
531  // Hybrid and standard format are (x,y), compressed is y, +1 format byte
532  if(format == PointGFp::COMPRESSED)
533  return (1 + get_p_bytes());
534  else
535  return (1 + 2*get_p_bytes());
536  }
size_t get_p_bytes() const
Definition: ec_group.cpp:444

◆ random_scalar()

BigInt Botan::EC_Group::random_scalar ( RandomNumberGenerator rng) const

Return a random scalar ie an integer in [1,order)

Definition at line 573 of file ec_group.cpp.

References Botan::BigInt::random_integer().

Referenced by Botan::EC_PrivateKey::EC_PrivateKey().

574  {
575  return BigInt::random_integer(rng, 1, get_order());
576  }
const BigInt & get_order() const
Definition: ec_group.cpp:479
static BigInt random_integer(RandomNumberGenerator &rng, const BigInt &min, const BigInt &max)
Definition: big_rand.cpp:45

◆ square_mod_order()

BigInt Botan::EC_Group::square_mod_order ( const BigInt x) const

Definition at line 504 of file ec_group.cpp.

505  {
506  return data().square_mod_order(x);
507  }

◆ verify_group()

bool Botan::EC_Group::verify_group ( RandomNumberGenerator rng,
bool  strong = false 
) const

Verify EC_Group domain

Returns
true if group is valid. false otherwise

Definition at line 689 of file ec_group.cpp.

References Botan::Modular_Reducer::cube(), Botan::is_prime(), Botan::Modular_Reducer::multiply(), Botan::PointGFp::on_the_curve(), Botan::Modular_Reducer::reduce(), and Botan::Modular_Reducer::square().

Referenced by Botan::EC_PublicKey::check_key().

691  {
692  const BigInt& p = get_p();
693  const BigInt& a = get_a();
694  const BigInt& b = get_b();
695  const BigInt& order = get_order();
696  const PointGFp& base_point = get_base_point();
697 
698  if(a < 0 || a >= p)
699  return false;
700  if(b <= 0 || b >= p)
701  return false;
702  if(order <= 0)
703  return false;
704 
705  //check if field modulus is prime
706  if(!is_prime(p, rng, 128))
707  {
708  return false;
709  }
710 
711  //check if order is prime
712  if(!is_prime(order, rng, 128))
713  {
714  return false;
715  }
716 
717  //compute the discriminant: 4*a^3 + 27*b^2 which must be nonzero
718  const Modular_Reducer mod_p(p);
719 
720  const BigInt discriminant = mod_p.reduce(
721  mod_p.multiply(4, mod_p.cube(a)) +
722  mod_p.multiply(27, mod_p.square(b)));
723 
724  if(discriminant == 0)
725  {
726  return false;
727  }
728 
729  //check for valid cofactor
730  if(get_cofactor() < 1)
731  {
732  return false;
733  }
734 
735  //check if the base point is on the curve
736  if(!base_point.on_the_curve())
737  {
738  return false;
739  }
740  if((base_point * get_cofactor()).is_zero())
741  {
742  return false;
743  }
744  //check if order of the base point is correct
745  if(!(base_point * order).is_zero())
746  {
747  return false;
748  }
749 
750  return true;
751  }
const BigInt & get_order() const
Definition: ec_group.cpp:479
bool is_prime(const BigInt &n, RandomNumberGenerator &rng, size_t prob, bool is_random)
Definition: numthry.cpp:488
const PointGFp & get_base_point() const
Definition: ec_group.cpp:474
const BigInt & get_cofactor() const
Definition: ec_group.cpp:494
const BigInt & get_b() const
Definition: ec_group.cpp:469
const BigInt & get_a() const
Definition: ec_group.cpp:464
const BigInt & get_p() const
Definition: ec_group.cpp:459

◆ verify_public_element()

bool Botan::EC_Group::verify_public_element ( const PointGFp y) const

Check if y is a plausible point on the curve

In particular, checks that it is a point on the curve, not infinity, and that it has order matching the group.

Definition at line 666 of file ec_group.cpp.

References Botan::PointGFp::is_zero(), and Botan::PointGFp::on_the_curve().

Referenced by Botan::EC_PublicKey::check_key().

667  {
668  //check that public point is not at infinity
669  if(point.is_zero())
670  return false;
671 
672  //check that public point is on the curve
673  if(point.on_the_curve() == false)
674  return false;
675 
676  //check that public point has order q
677  if((point * get_order()).is_zero() == false)
678  return false;
679 
680  if(get_cofactor() > 1)
681  {
682  if((point * get_cofactor()).is_zero())
683  return false;
684  }
685 
686  return true;
687  }
PointGFp point(const BigInt &x, const BigInt &y) const
Definition: ec_group.cpp:543
const BigInt & get_order() const
Definition: ec_group.cpp:479
const BigInt & get_cofactor() const
Definition: ec_group.cpp:494
bool on_the_curve() const
Definition: point_gfp.cpp:538
bool is_zero() const
Definition: point_gfp.h:183

◆ zero_point()

PointGFp Botan::EC_Group::zero_point ( ) const

Return the zero (or infinite) point on this curve

Definition at line 587 of file ec_group.cpp.

588  {
589  return PointGFp(data().curve());
590  }

The documentation for this class was generated from the following files: