Botan::EC_Mul2Table_Data_BN Class Reference

#include <ec_inner_bn.h>

Inheritance diagram for Botan::EC_Mul2Table_Data_BN:

Public Member Functions
	EC_Mul2Table_Data_BN (const EC_AffinePoint_Data &g, const EC_AffinePoint_Data &h)
std::unique_ptr< EC_AffinePoint_Data >	mul2_vartime (const EC_Scalar_Data &x, const EC_Scalar_Data &y) const override
bool	mul2_vartime_x_mod_order_eq (const EC_Scalar_Data &v, const EC_Scalar_Data &x, const EC_Scalar_Data &y) const override

Detailed Description

Definition at line 91 of file ec_inner_bn.h.

Constructor & Destructor Documentation

EC_Mul2Table_Data_BN()

Botan::EC_Mul2Table_Data_BN::EC_Mul2Table_Data_BN	(	const EC_AffinePoint_Data &	g,
		const EC_AffinePoint_Data &	h )

Definition at line 165 of file ec_inner_bn.cpp.

                                                                                                     :
      m_group(g.group()), m_tbl(g.to_legacy_point(), h.to_legacy_point()) {
   BOTAN_ARG_CHECK(h.group() == m_group, "Curve mismatch");
}

References BOTAN_ARG_CHECK, and Botan::EC_AffinePoint_Data::group().

Member Function Documentation

mul2_vartime()

std::unique_ptr< EC_AffinePoint_Data > Botan::EC_Mul2Table_Data_BN::mul2_vartime ( const EC_Scalar_Data & x, const EC_Scalar_Data & y ) const

overridevirtual

Implements Botan::EC_Mul2Table_Data.

Definition at line 170 of file ec_inner_bn.cpp.

                                                                                                       {
   BOTAN_ARG_CHECK(x.group() == m_group && y.group() == m_group, "Curve mismatch");
 
   const auto& bn_x = EC_Scalar_Data_BN::checked_ref(x);
   const auto& bn_y = EC_Scalar_Data_BN::checked_ref(y);
   auto pt = m_tbl.multi_exp(bn_x.value(), bn_y.value());
 
   if(pt.is_zero()) {
      return nullptr;
   }
   return std::make_unique<EC_AffinePoint_Data_BN>(m_group, std::move(pt));
}

References BOTAN_ARG_CHECK, Botan::EC_Scalar_Data_BN::checked_ref(), Botan::EC_Scalar_Data::group(), and Botan::EC_Point_Multi_Point_Precompute::multi_exp().

mul2_vartime_x_mod_order_eq()

bool Botan::EC_Mul2Table_Data_BN::mul2_vartime_x_mod_order_eq ( const EC_Scalar_Data & v, const EC_Scalar_Data & x, const EC_Scalar_Data & y ) const

overridevirtual

Implements Botan::EC_Mul2Table_Data.

Definition at line 184 of file ec_inner_bn.cpp.

                                                                                      {
   BOTAN_ARG_CHECK(x.group() == m_group && y.group() == m_group && v.group() == m_group, "Curve mismatch");
 
   const auto& bn_v = EC_Scalar_Data_BN::checked_ref(v);
   const auto& bn_x = EC_Scalar_Data_BN::checked_ref(x);
   const auto& bn_y = EC_Scalar_Data_BN::checked_ref(y);
   const auto pt = m_tbl.multi_exp(bn_x.value(), bn_y.value());
 
   if(pt.is_zero()) {
      return false;
   }
 
   /*
   * The trick used below doesn't work for curves with cofactors
   */
   if(m_group->has_cofactor()) {
      return m_group->mod_order(pt.get_affine_x()) == bn_v.value();
   }
 
   /*
   * Note we're working with the projective coordinate directly here!
   * Nominally we're comparing v with the affine x coordinate.
   *
   * return m_group->mod_order(pt.get_affine_x()) == bn_v.value();
   *
   * However by instead projecting r to an identical z as the x
   * coordinate, we can compare without having to perform an
   * expensive inversion in the field.
   *
   * That is, given (x*z2) and r, instead of checking if
   *    (x*z2)*z2^-1 == r,
   * we check if
   *    (x*z2) == (r*z2)
   */
   auto& curve = m_group->curve();
 
   secure_vector<word> ws;
   BigInt vr = bn_v.value();
   curve.to_rep(vr, ws);
   BigInt z2, v_z2;
   curve.sqr(z2, pt.get_z(), ws);
   curve.mul(v_z2, vr, z2, ws);
 
   /*
   * Since (typically) the group order is slightly less than the size
   * of the field elements, its possible the signer had to reduce the
   * r component. If they did not reduce r, then this value is correct.
   *
   * Due to the Hasse bound, this case occurs almost always; the
   * probability that a reduction was actually required is
   * approximately 1 in 2^(n/2) where n is the bit length of the curve.
   */
   if(pt.get_x() == v_z2) {
      return true;
   }
 
   if(m_group->order_is_less_than_p()) {
      vr = bn_v.value() + m_group->order();
      if(vr < m_group->p()) {
         curve.to_rep(vr, ws);
         curve.mul(v_z2, vr, z2, ws);
 
         if(pt.get_x() == v_z2) {
            return true;
         }
      }
   }
 
   // Reject:
   return false;
}

References BOTAN_ARG_CHECK, Botan::EC_Scalar_Data_BN::checked_ref(), Botan::EC_Scalar_Data::group(), Botan::BigInt::mul(), and Botan::EC_Point_Multi_Point_Precompute::multi_exp().

---

The documentation for this class was generated from the following files:

• src/lib/pubkey/ec_group/ec_inner_bn.h
• src/lib/pubkey/ec_group/ec_inner_bn.cpp