Botan::EC_Point Class Reference

#include <ec_point.h>

Public Types
enum	{ WORKSPACE_SIZE = 8 }
typedef EC_Point_Format	Compression_Type

Public Member Functions
bool	_is_x_eq_to_v_mod_order (const BigInt &v) const
void	add (const EC_Point &other, std::vector< BigInt > &workspace)
void	add (const word x_words[], size_t x_size, const word y_words[], size_t y_size, const word z_words[], size_t z_size, std::vector< BigInt > &workspace)
void	add_affine (const EC_Point &other, std::vector< BigInt > &workspace)
void	add_affine (const word x_words[], size_t x_size, const word y_words[], size_t y_size, std::vector< BigInt > &workspace)
EC_Point	double_of (std::vector< BigInt > &workspace) const
	EC_Point ()=default
	EC_Point (const CurveGFp &curve)
	EC_Point (const CurveGFp &curve, BigInt x, BigInt y)
	EC_Point (const EC_Point &)=default
	EC_Point (EC_Point &&other)
std::vector< uint8_t >	encode (EC_Point_Format format) const
void	force_affine ()
BigInt	get_affine_x () const
BigInt	get_affine_y () const
const CurveGFp &	get_curve () const
const BigInt &	get_x () const
const BigInt &	get_y () const
const BigInt &	get_z () const
bool	is_affine () const
bool	is_zero () const
EC_Point	mul (const BigInt &scalar) const
void	mult2 (std::vector< BigInt > &workspace)
void	mult2i (size_t i, std::vector< BigInt > &workspace)
EC_Point &	negate ()
bool	on_the_curve () const
bool	operator!= (const EC_Point &other) const =default
EC_Point &	operator*= (const BigInt &scalar)
EC_Point &	operator+= (const EC_Point &rhs)
EC_Point &	operator-= (const EC_Point &rhs)
EC_Point &	operator= (const EC_Point &)=default
EC_Point &	operator= (EC_Point &&other)
bool	operator== (const EC_Point &other) const
EC_Point	plus (const EC_Point &other, std::vector< BigInt > &workspace) const
void	randomize_repr (RandomNumberGenerator &rng)
void	randomize_repr (RandomNumberGenerator &rng, secure_vector< word > &ws)
void	swap (EC_Point &other) noexcept
void	swap_coords (BigInt &new_x, BigInt &new_y, BigInt &new_z)
secure_vector< uint8_t >	x_bytes () const
secure_vector< uint8_t >	xy_bytes () const
secure_vector< uint8_t >	y_bytes () const
EC_Point	zero () const

Static Public Member Functions
static void	force_all_affine (std::span< EC_Point > points, secure_vector< word > &ws)

Friends
class	EC_Point_Base_Point_Precompute
class	EC_Point_Multi_Point_Precompute
class	EC_Point_Var_Point_Precompute
void	swap (EC_Point &x, EC_Point &y)

Detailed Description

Deprecated elliptic curve type

Use EC_AffinePoint in new code; this type is no longer used internally at all except to support very unfortunate (and deprecated) curve types, specifically those with a cofactor, or with unreasonable sizes (above 521 bits), which cannot be accomodated by the new faster EC library in math/pcurves. For normal curves EC_AffinePoint will typically be 2 or 3 times faster.

This type will be completely removed in Botan4

Definition at line 33 of file ec_point.h.

Member Typedef Documentation

Compression_Type

EC_Point_Format Botan::EC_Point::Compression_Type

Definition at line 39 of file ec_point.h.

Member Enumeration Documentation

anonymous enum

anonymous enum

Enumerator
WORKSPACE_SIZE

Definition at line 42 of file ec_point.h.

{ WORKSPACE_SIZE = 8 };

Constructor & Destructor Documentation

EC_Point() [1/5]

Botan::EC_Point::EC_Point ( )

default

Construct an uninitialized EC_Point

Referenced by mult2(), mult2i(), operator-=(), and zero().

EC_Point() [2/5]

Botan::EC_Point::EC_Point ( const CurveGFp & curve )

explicit

Construct the zero point

Parameters

curve

The base curve

Definition at line 97 of file ec_point.cpp.

: m_curve(curve), m_x(0), m_y(curve.group().monty().R1()), m_z(0) {}

EC_Point() [3/5]

Botan::EC_Point::EC_Point ( const EC_Point & )

default

Copy constructor

EC_Point() [4/5]

Botan::EC_Point::EC_Point ( EC_Point && other )

inline

Move Constructor

Definition at line 63 of file ec_point.h.

{ this->swap(other); }

EC_Point() [5/5]

Botan::EC_Point::EC_Point	(	const CurveGFp &	curve,
		BigInt	x,
		BigInt	y )

Construct a point from its affine coordinates

Parameters

curve	the base curve
x	affine x coordinate
y	affine y coordinate

Definition at line 103 of file ec_point.cpp.

                                                            :
      m_curve(curve), m_x(std::move(x)), m_y(std::move(y)), m_z(m_curve.group().monty().R1()) {
   const auto& group = m_curve.group();
 
   if(m_x < 0 || m_x >= group.p()) {
      throw Invalid_Argument("Invalid EC_Point affine x");
   }
   if(m_y < 0 || m_y >= group.p()) {
      throw Invalid_Argument("Invalid EC_Point affine y");
   }
 
   secure_vector<word> monty_ws(monty_ws_size(group));
 
   to_rep(group, m_x, monty_ws);
   to_rep(group, m_y, monty_ws);
}

Member Function Documentation

_is_x_eq_to_v_mod_order()

bool Botan::EC_Point::_is_x_eq_to_v_mod_order

(

const BigInt &

v

)

const

For internal use only

Definition at line 675 of file ec_point.cpp.

                                                            {
   if(this->is_zero()) {
      return false;
   }
 
   const auto& group = m_curve.group();
 
   /*
   * The trick used below doesn't work for curves with cofactors
   */
   if(group.has_cofactor()) {
      return group.mod_order().reduce(this->get_affine_x()) == v;
   }
 
   /*
   * Note we're working with the projective coordinate directly here!
   * Nominally we're comparing v with the affine x coordinate.
   *
   * return group.mod_order(this->get_affine_x()) == v;
   *
   * However by instead projecting r to an identical z as the x
   * coordinate, we can compare without having to perform an
   * expensive inversion in the field.
   *
   * That is, given (x*z2) and r, instead of checking if
   *    (x*z2)*z2^-1 == r,
   * we check if
   *    (x*z2) == (r*z2)
   */
   secure_vector<word> ws;
   BigInt vr = v;
   to_rep(group, vr, ws);
   BigInt z2, v_z2;
   fe_sqr(group, z2, this->get_z(), ws);
   fe_mul(group, v_z2, vr, z2, ws);
 
   /*
   * Since (typically) the group order is slightly less than the size
   * of the field elements, its possible the signer had to reduce the
   * r component. If they did not reduce r, then this value is correct.
   *
   * Due to the Hasse bound, this case occurs almost always; the
   * probability that a reduction was actually required is
   * approximately 1 in 2^(n/2) where n is the bit length of the curve.
   */
   if(this->get_x() == v_z2) {
      return true;
   }
 
   if(group.order_is_less_than_p()) {
      vr = v + group.order();
      if(vr < group.p()) {
         to_rep(group, vr, ws);
         fe_mul(group, v_z2, vr, z2, ws);
 
         if(this->get_x() == v_z2) {
            return true;
         }
      }
   }
 
   // Reject:
   return false;
}

References Botan::fe_mul(), get_affine_x(), get_x(), get_z(), and is_zero().

Referenced by Botan::EC_Mul2Table_Data_BN::mul2_vartime_x_mod_order_eq().

add() [1/2]

void Botan::EC_Point::add ( const EC_Point & other, std::vector< BigInt > & workspace )

inline

Point addition

Parameters

other	the point to add to *this
workspace	temp space, at least WORKSPACE_SIZE elements

Definition at line 274 of file ec_point.h.

                                                                    {
         BOTAN_ARG_CHECK(m_curve == other.m_curve, "cannot add points on different curves");
 
         const size_t p_words = m_curve.get_p_words();
 
         add(other.m_x._data(),
             std::min(p_words, other.m_x.size()),
             other.m_y._data(),
             std::min(p_words, other.m_y.size()),
             other.m_z._data(),
             std::min(p_words, other.m_z.size()),
             workspace);
      }

References Botan::BigInt::_data(), BOTAN_ARG_CHECK, and Botan::BigInt::size().

Referenced by mul(), Botan::EC_Point_Var_Point_Precompute::mul(), Botan::EC_Point_Multi_Point_Precompute::multi_exp(), operator+=(), and plus().

add() [2/2]

void Botan::EC_Point::add	(	const word	x_words[],
		size_t	x_size,
		const word	y_words[],
		size_t	y_size,
		const word	z_words[],
		size_t	z_size,
		std::vector< BigInt > &	workspace )

Point addition. Array version.

Parameters

x_words	the words of the x coordinate of the other point
x_size	size of x_words
y_words	the words of the y coordinate of the other point
y_size	size of y_words
z_words	the words of the z coordinate of the other point
z_size	size of z_words
workspace	temp space, at least WORKSPACE_SIZE elements

Definition at line 243 of file ec_point.cpp.

                                             {
   if((CT::all_zeros(x_words, x_size) & CT::all_zeros(z_words, z_size)).as_bool()) {
      return;
   }
 
   const auto& group = m_curve.group();
 
   if(is_zero()) {
      m_x.set_words(x_words, x_size);
      m_y.set_words(y_words, y_size);
      m_z.set_words(z_words, z_size);
      return;
   }
 
   resize_ws(ws_bn, monty_ws_size(group));
 
   secure_vector<word>& ws = ws_bn[0].get_word_vector();
   secure_vector<word>& sub_ws = ws_bn[1].get_word_vector();
 
   BigInt& T0 = ws_bn[2];
   BigInt& T1 = ws_bn[3];
   BigInt& T2 = ws_bn[4];
   BigInt& T3 = ws_bn[5];
   BigInt& T4 = ws_bn[6];
   BigInt& T5 = ws_bn[7];
 
   /*
   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2
   */
 
   const BigInt& p = group.p();
 
   fe_sqr(group, T0, z_words, z_size, ws);      // z2^2
   fe_mul(group, T1, m_x, T0, ws);              // x1*z2^2
   fe_mul(group, T3, z_words, z_size, T0, ws);  // z2^3
   fe_mul(group, T2, m_y, T3, ws);              // y1*z2^3
 
   fe_sqr(group, T3, m_z, ws);                  // z1^2
   fe_mul(group, T4, x_words, x_size, T3, ws);  // x2*z1^2
 
   fe_mul(group, T5, m_z, T3, ws);              // z1^3
   fe_mul(group, T0, y_words, y_size, T5, ws);  // y2*z1^3
 
   T4.mod_sub(T1, p, sub_ws);  // x2*z1^2 - x1*z2^2
 
   T0.mod_sub(T2, p, sub_ws);
 
   if(T4.is_zero()) {
      if(T0.is_zero()) {
         mult2(ws_bn);
         return;
      }
 
      // setting to zero:
      m_x.clear();
      m_y = group.monty().R1();
      m_z.clear();
      return;
   }
 
   fe_sqr(group, T5, T4, ws);
 
   fe_mul(group, T3, T1, T5, ws);
 
   fe_mul(group, T1, T5, T4, ws);
 
   fe_sqr(group, m_x, T0, ws);
   m_x.mod_sub(T1, p, sub_ws);
   m_x.mod_sub(T3, p, sub_ws);
   m_x.mod_sub(T3, p, sub_ws);
 
   T3.mod_sub(m_x, p, sub_ws);
 
   fe_mul(group, m_y, T0, T3, ws);
   fe_mul(group, T3, T2, T1, ws);
 
   m_y.mod_sub(T3, p, sub_ws);
 
   fe_mul(group, T3, z_words, z_size, m_z, ws);
   fe_mul(group, m_z, T3, T4, ws);
}

References Botan::CT::all_zeros(), Botan::BigInt::clear(), Botan::fe_mul(), Botan::BigInt::is_zero(), is_zero(), Botan::BigInt::mod_sub(), mult2(), and Botan::BigInt::set_words().

add_affine() [1/2]

void Botan::EC_Point::add_affine ( const EC_Point & other, std::vector< BigInt > & workspace )

inline

Point addition - mixed J+A

Warning

This function assumes that other is affine, if this is not correct the result will be invalid.

Parameters

other	affine point to add - assumed to be affine!
workspace	temp space, at least WORKSPACE_SIZE elements

Definition at line 316 of file ec_point.h.

                                                                           {
         BOTAN_ASSERT_NOMSG(m_curve == other.m_curve);
         BOTAN_DEBUG_ASSERT(other.is_affine());
 
         const size_t p_words = m_curve.get_p_words();
         add_affine(other.m_x._data(),
                    std::min(p_words, other.m_x.size()),
                    other.m_y._data(),
                    std::min(p_words, other.m_y.size()),
                    workspace);
      }

References Botan::BigInt::_data(), BOTAN_ASSERT_NOMSG, BOTAN_DEBUG_ASSERT, is_affine(), and Botan::BigInt::size().

Referenced by Botan::EC_Point_Base_Point_Precompute::mul(), and Botan::EC_Point_Multi_Point_Precompute::multi_exp().

add_affine() [2/2]

void Botan::EC_Point::add_affine	(	const word	x_words[],
		size_t	x_size,
		const word	y_words[],
		size_t	y_size,
		std::vector< BigInt > &	workspace )

Point addition - mixed J+A. Array version.

Parameters

x_words	the words of the x coordinate of the other point
x_size	size of x_words
y_words	the words of the y coordinate of the other point
y_size	size of y_words
workspace	temp space, at least WORKSPACE_SIZE elements

Definition at line 164 of file ec_point.cpp.

                                                                                                       {
   if((CT::all_zeros(x_words, x_size) & CT::all_zeros(y_words, y_size)).as_bool()) {
      return;
   }
 
   const auto& group = m_curve.group();
 
   if(is_zero()) {
      m_x.set_words(x_words, x_size);
      m_y.set_words(y_words, y_size);
      m_z = group.monty().R1();
      return;
   }
 
   resize_ws(ws_bn, monty_ws_size(group));
 
   secure_vector<word>& ws = ws_bn[0].get_word_vector();
   secure_vector<word>& sub_ws = ws_bn[1].get_word_vector();
 
   BigInt& T0 = ws_bn[2];
   BigInt& T1 = ws_bn[3];
   BigInt& T2 = ws_bn[4];
   BigInt& T3 = ws_bn[5];
   BigInt& T4 = ws_bn[6];
 
   /*
   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2
   simplified with Z2 = 1
   */
 
   const BigInt& p = group.p();
 
   fe_sqr(group, T3, m_z, ws);                  // z1^2
   fe_mul(group, T4, x_words, x_size, T3, ws);  // x2*z1^2
 
   fe_mul(group, T2, m_z, T3, ws);              // z1^3
   fe_mul(group, T0, y_words, y_size, T2, ws);  // y2*z1^3
 
   T4.mod_sub(m_x, p, sub_ws);  // x2*z1^2 - x1*z2^2
 
   T0.mod_sub(m_y, p, sub_ws);
 
   if(T4.is_zero()) {
      if(T0.is_zero()) {
         mult2(ws_bn);
         return;
      }
 
      // setting to zero:
      m_x.clear();
      m_y = group.monty().R1();
      m_z.clear();
      return;
   }
 
   fe_sqr(group, T2, T4, ws);
 
   fe_mul(group, T3, m_x, T2, ws);
 
   fe_mul(group, T1, T2, T4, ws);
 
   fe_sqr(group, m_x, T0, ws);
   m_x.mod_sub(T1, p, sub_ws);
 
   m_x.mod_sub(T3, p, sub_ws);
   m_x.mod_sub(T3, p, sub_ws);
 
   T3.mod_sub(m_x, p, sub_ws);
 
   fe_mul(group, T2, T0, T3, ws);
   fe_mul(group, T0, m_y, T1, ws);
   T2.mod_sub(T0, p, sub_ws);
   m_y.swap(T2);
 
   fe_mul(group, T0, m_z, T4, ws);
   m_z.swap(T0);
}

References Botan::CT::all_zeros(), Botan::BigInt::clear(), Botan::fe_mul(), Botan::BigInt::is_zero(), is_zero(), Botan::BigInt::mod_sub(), mult2(), Botan::BigInt::set_words(), and Botan::BigInt::swap().

double_of()

EC_Point Botan::EC_Point::double_of ( std::vector< BigInt > & workspace ) const

inline

Point doubling

Parameters

workspace

temp space, at least WORKSPACE_SIZE elements

Returns

*this doubled

Definition at line 370 of file ec_point.h.

                                                             {
         EC_Point x = (*this);
         x.mult2(workspace);
         return x;
      }

References mult2().

encode()

std::vector< uint8_t > Botan::EC_Point::encode

(

EC_Point_Format

format

)

const

EC2OSP - elliptic curve to octet string primitive

Parameters

format

which format to encode using

Definition at line 762 of file ec_point.cpp.

                                                                {
   if(is_zero()) {
      return std::vector<uint8_t>(1);  // single 0 byte
   }
 
   const size_t p_bytes = m_curve.group().p_bytes();
 
   const BigInt x = get_affine_x();
   const BigInt y = get_affine_y();
 
   const size_t parts = (format == EC_Point_Format::Compressed) ? 1 : 2;
 
   std::vector<uint8_t> result(1 + parts * p_bytes);
   BufferStuffer stuffer(result);
 
   if(format == EC_Point_Format::Uncompressed) {
      stuffer.append(0x04);
      x.serialize_to(stuffer.next(p_bytes));
      y.serialize_to(stuffer.next(p_bytes));
   } else if(format == EC_Point_Format::Compressed) {
      stuffer.append(0x02 | static_cast<uint8_t>(y.get_bit(0)));
      x.serialize_to(stuffer.next(p_bytes));
   } else if(format == EC_Point_Format::Hybrid) {
      stuffer.append(0x06 | static_cast<uint8_t>(y.get_bit(0)));
      x.serialize_to(stuffer.next(p_bytes));
      y.serialize_to(stuffer.next(p_bytes));
   } else {
      throw Invalid_Argument("EC2OSP illegal point encoding");
   }
 
   return result;
}

References Botan::BufferStuffer::append(), Botan::Compressed, get_affine_x(), get_affine_y(), Botan::BigInt::get_bit(), Botan::Hybrid, is_zero(), Botan::BufferStuffer::next(), Botan::EC_Group_Data::p_bytes(), Botan::BigInt::serialize_to(), and Botan::Uncompressed.

force_affine()

void Botan::EC_Point::force_affine

(

)

Force this point to affine coordinates

Convert the point to its equivalent affine coordinates. Throws if this is the point at infinity.

Definition at line 545 of file ec_point.cpp.

                            {
   if(is_zero()) {
      throw Invalid_State("Cannot convert zero ECC point to affine");
   }
 
   secure_vector<word> ws;
 
   const auto& group = m_curve.group();
 
   const BigInt z_inv = invert_element(group, m_z, ws);
   const BigInt z2_inv = fe_sqr(group, z_inv, ws);
   const BigInt z3_inv = fe_mul(group, z_inv, z2_inv, ws);
   m_x = fe_mul(group, m_x, z2_inv, ws);
   m_y = fe_mul(group, m_y, z3_inv, ws);
   m_z = group.monty().R1();
}

References Botan::fe_mul(), and is_zero().

force_all_affine()

void Botan::EC_Point::force_all_affine ( std::span< EC_Point > points, secure_vector< word > & ws )

static

Force all points on the list to affine coordinates

Force several points to be affine at once. Uses Montgomery's trick to reduce number of inversions required, so this is much faster than calling force_affine on each point in sequence.

Definition at line 483 of file ec_point.cpp.

                                                                                 {
   if(points.size() <= 1) {
      for(auto& point : points) {
         point.force_affine();
      }
      return;
   }
 
   for(auto& point : points) {
      if(point.is_zero()) {
         throw Invalid_State("Cannot convert zero ECC point to affine");
      }
   }
 
   /*
   For >= 2 points use Montgomery's trick
 
   See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography"
   (Hankerson, Menezes, Vanstone)
 
   TODO is it really necessary to save all k points in c?
   */
 
   const auto& group = points[0].m_curve.group();
   const BigInt& rep_1 = group.monty().R1();
 
   if(ws.size() < monty_ws_size(group)) {
      ws.resize(monty_ws_size(group));
   }
 
   std::vector<BigInt> c(points.size());
   c[0] = points[0].m_z;
 
   for(size_t i = 1; i != points.size(); ++i) {
      fe_mul(group, c[i], c[i - 1], points[i].m_z, ws);
   }
 
   BigInt s_inv = invert_element(group, c[c.size() - 1], ws);
 
   BigInt z_inv, z2_inv, z3_inv;
 
   for(size_t i = points.size() - 1; i != 0; i--) {
      EC_Point& point = points[i];
 
      fe_mul(group, z_inv, s_inv, c[i - 1], ws);
 
      s_inv = fe_mul(group, s_inv, point.m_z, ws);
 
      fe_sqr(group, z2_inv, z_inv, ws);
      fe_mul(group, z3_inv, z2_inv, z_inv, ws);
      point.m_x = fe_mul(group, point.m_x, z2_inv, ws);
      point.m_y = fe_mul(group, point.m_y, z3_inv, ws);
      point.m_z = rep_1;
   }
 
   fe_sqr(group, z2_inv, s_inv, ws);
   fe_mul(group, z3_inv, z2_inv, s_inv, ws);
   points[0].m_x = fe_mul(group, points[0].m_x, z2_inv, ws);
   points[0].m_y = fe_mul(group, points[0].m_y, z3_inv, ws);
   points[0].m_z = rep_1;
}

References Botan::fe_mul().

Referenced by Botan::EC_Point_Base_Point_Precompute::EC_Point_Base_Point_Precompute().

get_affine_x()

BigInt Botan::EC_Point::get_affine_x

(

)

const

get affine x coordinate

Returns

affine x coordinate

Definition at line 592 of file ec_point.cpp.

                                    {
   if(is_zero()) {
      throw Invalid_State("Cannot convert zero point to affine");
   }
 
   secure_vector<word> monty_ws;
 
   const auto& group = m_curve.group();
 
   if(is_affine()) {
      return from_rep_to_tmp(group, m_x, monty_ws);
   }
 
   BigInt z2 = fe_sqr(group, m_z, monty_ws);
   z2 = invert_element(group, z2, monty_ws);
 
   BigInt r;
   fe_mul(group, r, m_x, z2, monty_ws);
   from_rep(group, r, monty_ws);
   return r;
}

References Botan::fe_mul(), is_affine(), and is_zero().

Referenced by _is_x_eq_to_v_mod_order(), encode(), operator==(), and xy_bytes().

get_affine_y()

BigInt Botan::EC_Point::get_affine_y

(

)

const

get affine y coordinate

Returns

affine y coordinate

Definition at line 614 of file ec_point.cpp.

                                    {
   if(is_zero()) {
      throw Invalid_State("Cannot convert zero point to affine");
   }
 
   const auto& group = m_curve.group();
   secure_vector<word> monty_ws;
 
   if(is_affine()) {
      return from_rep_to_tmp(group, m_y, monty_ws);
   }
 
   const BigInt z2 = fe_sqr(group, m_z, monty_ws);
   const BigInt z3 = fe_mul(group, m_z, z2, monty_ws);
   const BigInt z3_inv = invert_element(group, z3, monty_ws);
 
   BigInt r;
   fe_mul(group, r, m_y, z3_inv, monty_ws);
   from_rep(group, r, monty_ws);
   return r;
}

References Botan::fe_mul(), is_affine(), and is_zero().

Referenced by encode(), operator==(), and xy_bytes().

get_curve()

const CurveGFp & Botan::EC_Point::get_curve ( ) const

inline

Return base curve of this point

Returns

the curve over GF(p) of this point

You should not need to use this

Definition at line 382 of file ec_point.h.

{ return m_curve; }

get_x()

const BigInt & Botan::EC_Point::get_x ( ) const

inline

Return the internal x coordinate

Note this may be in Montgomery form

Definition at line 237 of file ec_point.h.

{ return m_x; }

Referenced by _is_x_eq_to_v_mod_order().

get_y()

const BigInt & Botan::EC_Point::get_y ( ) const

inline

Return the internal y coordinate

Note this may be in Montgomery form

Definition at line 244 of file ec_point.h.

{ return m_y; }

get_z()

const BigInt & Botan::EC_Point::get_z ( ) const

inline

Return the internal z coordinate

Note this may be in Montgomery form

Definition at line 251 of file ec_point.h.

{ return m_z; }

Referenced by _is_x_eq_to_v_mod_order().

is_affine()

bool Botan::EC_Point::is_affine

(

)

const

Definition at line 562 of file ec_point.cpp.

                               {
   const auto& group = m_curve.group();
   return m_z == group.monty().R1();
}

Referenced by add_affine(), get_affine_x(), and get_affine_y().

is_zero()

bool Botan::EC_Point::is_zero ( ) const

inline

Is this the point at infinity?

Returns

true, if this point is at infinity, false otherwise.

Definition at line 162 of file ec_point.h.

{ return m_z.is_zero(); }

Referenced by _is_x_eq_to_v_mod_order(), add(), add_affine(), Botan::EC_AffinePoint_Data_BN::EC_AffinePoint_Data_BN(), Botan::EC_AffinePoint_Data_BN::EC_AffinePoint_Data_BN(), encode(), force_affine(), get_affine_x(), get_affine_y(), mult2(), on_the_curve(), operator-=(), and operator==().

mul()

EC_Point Botan::EC_Point::mul

(

const BigInt &

scalar

)

const

Point multiplication operator

Simple unblinded Montgomery ladder

Warning: prefer the functions on EC_Group such as blinded_var_point_multiply

Parameters

scalar

the scalar value

Returns

*this multiplied by the scalar value

Definition at line 460 of file ec_point.cpp.

                                                 {
   const size_t scalar_bits = scalar.bits();
 
   std::vector<BigInt> ws(EC_Point::WORKSPACE_SIZE);
 
   EC_Point R[2] = {this->zero(), *this};
 
   for(size_t i = scalar_bits; i > 0; i--) {
      const size_t b = scalar.get_bit(i - 1);
      R[b ^ 1].add(R[b], ws);
      R[b].mult2(ws);
   }
 
   if(scalar.is_negative()) {
      R[0].negate();
   }
 
   BOTAN_DEBUG_ASSERT(R[0].on_the_curve());
 
   return R[0];
}

References add(), Botan::b, Botan::BigInt::bits(), BOTAN_DEBUG_ASSERT, Botan::BigInt::get_bit(), Botan::BigInt::is_negative(), mult2(), negate(), on_the_curve(), WORKSPACE_SIZE, and zero().

Referenced by Botan::operator*(), and Botan::operator*().

mult2()

void Botan::EC_Point::mult2

(

std::vector< BigInt > &

workspace

)

Point doubling

Parameters

workspace

temp space, at least WORKSPACE_SIZE elements

Definition at line 351 of file ec_point.cpp.

                                             {
   if(is_zero()) {
      return;
   }
 
   const auto& group = m_curve.group();
 
   if(m_y.is_zero()) {
      *this = EC_Point(m_curve);  // setting myself to zero
      return;
   }
 
   resize_ws(ws_bn, monty_ws_size(group));
 
   secure_vector<word>& ws = ws_bn[0].get_word_vector();
   secure_vector<word>& sub_ws = ws_bn[1].get_word_vector();
 
   BigInt& T0 = ws_bn[2];
   BigInt& T1 = ws_bn[3];
   BigInt& T2 = ws_bn[4];
   BigInt& T3 = ws_bn[5];
   BigInt& T4 = ws_bn[6];
 
   /*
   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-1986-cc
   */
   const BigInt& p = group.p();
 
   fe_sqr(group, T0, m_y, ws);
 
   fe_mul(group, T1, m_x, T0, ws);
   T1.mod_mul(4, p, sub_ws);
 
   if(group.a_is_zero()) {
      // if a == 0 then 3*x^2 + a*z^4 is just 3*x^2
      fe_sqr(group, T4, m_x, ws);  // x^2
      T4.mod_mul(3, p, sub_ws);    // 3*x^2
   } else if(group.a_is_minus_3()) {
      /*
      if a == -3 then
        3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2)
      */
      fe_sqr(group, T3, m_z, ws);  // z^2
 
      // (x-z^2)
      T2 = m_x;
      T2.mod_sub(T3, p, sub_ws);
 
      // (x+z^2)
      T3.mod_add(m_x, p, sub_ws);
 
      fe_mul(group, T4, T2, T3, ws);  // (x-z^2)*(x+z^2)
 
      T4.mod_mul(3, p, sub_ws);  // 3*(x-z^2)*(x+z^2)
   } else {
      fe_sqr(group, T3, m_z, ws);                  // z^2
      fe_sqr(group, T4, T3, ws);                   // z^4
      fe_mul(group, T3, group.monty_a(), T4, ws);  // a*z^4
 
      fe_sqr(group, T4, m_x, ws);  // x^2
      T4.mod_mul(3, p, sub_ws);
      T4.mod_add(T3, p, sub_ws);  // 3*x^2 + a*z^4
   }
 
   fe_sqr(group, T2, T4, ws);
   T2.mod_sub(T1, p, sub_ws);
   T2.mod_sub(T1, p, sub_ws);
 
   fe_sqr(group, T3, T0, ws);
   T3.mod_mul(8, p, sub_ws);
 
   T1.mod_sub(T2, p, sub_ws);
 
   fe_mul(group, T0, T4, T1, ws);
   T0.mod_sub(T3, p, sub_ws);
 
   m_x.swap(T2);
 
   fe_mul(group, T2, m_y, m_z, ws);
   T2.mod_mul(2, p, sub_ws);
 
   m_y.swap(T0);
   m_z.swap(T2);
}

References EC_Point(), Botan::fe_mul(), Botan::BigInt::is_zero(), is_zero(), Botan::BigInt::mod_add(), Botan::BigInt::mod_mul(), Botan::BigInt::mod_sub(), and Botan::BigInt::swap().

Referenced by add(), add_affine(), double_of(), Botan::EC_Point_Base_Point_Precompute::EC_Point_Base_Point_Precompute(), Botan::EC_Point_Multi_Point_Precompute::EC_Point_Multi_Point_Precompute(), mul(), and mult2i().

mult2i()

void Botan::EC_Point::mult2i	(	size_t	i,
		std::vector< BigInt > &	workspace )

Repeated point doubling

Parameters

i	number of doublings to perform
workspace	temp space, at least WORKSPACE_SIZE elements

Definition at line 331 of file ec_point.cpp.

                                                                 {
   if(iterations == 0) {
      return;
   }
 
   if(m_y.is_zero()) {
      *this = EC_Point(m_curve);  // setting myself to zero
      return;
   }
 
   /*
   TODO we can save 2 squarings per iteration by computing
   a*Z^4 using values cached from previous iteration
   */
   for(size_t i = 0; i != iterations; ++i) {
      mult2(ws_bn);
   }
}

References EC_Point(), Botan::BigInt::is_zero(), and mult2().

Referenced by Botan::EC_Point_Var_Point_Precompute::mul(), and Botan::EC_Point_Multi_Point_Precompute::multi_exp().

negate()

EC_Point & Botan::EC_Point::negate ( )

inline

Negate this point

Returns

*this

Definition at line 132 of file ec_point.h.

                         {
         if(!is_zero()) {
            m_y = m_curve.get_p() - m_y;
         }
         return *this;
      }

Referenced by mul(), Botan::EC_Point_Multi_Point_Precompute::multi_exp(), Botan::operator-(), and operator-=().

on_the_curve()

bool Botan::EC_Point::on_the_curve

(

)

const

Checks whether the point is to be found on the underlying curve; used to prevent fault attacks.

Returns

if the point is on the curve

Definition at line 636 of file ec_point.cpp.

                                  {
   /*
   Is the point still on the curve?? (If everything is correct, the
   point is always on its curve; then the function will return true.
   If somehow the state is corrupted, which suggests a fault attack
   (or internal computational error), then return false.
   */
   if(is_zero()) {
      return true;
   }
 
   const auto& group = m_curve.group();
   secure_vector<word> monty_ws;
 
   const BigInt y2 = from_rep_to_tmp(group, fe_sqr(group, m_y, monty_ws), monty_ws);
   const BigInt x3 = fe_mul(group, m_x, fe_sqr(group, m_x, monty_ws), monty_ws);
   const BigInt ax = fe_mul(group, m_x, group.monty_a(), monty_ws);
   const BigInt z2 = fe_sqr(group, m_z, monty_ws);
 
   const BigInt& monty_b = group.monty_b();
 
   // Is z equal to 1 (in Montgomery form)?
   if(m_z == z2) {
      if(y2 != from_rep_to_tmp(group, x3 + ax + monty_b, monty_ws)) {
         return false;
      }
   }
 
   const BigInt z3 = fe_mul(group, m_z, z2, monty_ws);
   const BigInt ax_z4 = fe_mul(group, ax, fe_sqr(group, z2, monty_ws), monty_ws);
   const BigInt b_z6 = fe_mul(group, monty_b, fe_sqr(group, z3, monty_ws), monty_ws);
 
   if(y2 != from_rep_to_tmp(group, x3 + ax_z4 + b_z6, monty_ws)) {
      return false;
   }
 
   return true;
}

References Botan::fe_mul(), and is_zero().

Referenced by Botan::EC_Point_Multi_Point_Precompute::EC_Point_Multi_Point_Precompute(), mul(), Botan::EC_Point_Base_Point_Precompute::mul(), Botan::EC_Point_Var_Point_Precompute::mul(), Botan::OS2ECP(), and Botan::EC_Group::verify_group().

operator!=()

bool Botan::EC_Point::operator!= ( const EC_Point & other ) const

default

operator*=()

EC_Point & Botan::EC_Point::operator*=

(

const BigInt &

scalar

)

*= Operator

Parameters

scalar

the EC_Point to multiply with *this

Returns

resulting EC_Point

Definition at line 455 of file ec_point.cpp.

                                                   {
   *this = scalar * *this;
   return *this;
}

operator+=()

EC_Point & Botan::EC_Point::operator+=

(

const EC_Point &

rhs

)

+= Operator

Parameters

rhs	the EC_Point to add to the local value

Returns

resulting EC_Point

Definition at line 437 of file ec_point.cpp.

                                                  {
   std::vector<BigInt> ws(EC_Point::WORKSPACE_SIZE);
   add(rhs, ws);
   return *this;
}

References add(), and WORKSPACE_SIZE.

operator-=()

EC_Point & Botan::EC_Point::operator-=

(

const EC_Point &

rhs

)

-= Operator

Parameters

rhs	the EC_Point to subtract from the local value

Returns

resulting EC_Point

Definition at line 443 of file ec_point.cpp.

                                                  {
   EC_Point minus_rhs = EC_Point(rhs).negate();
 
   if(is_zero()) {
      *this = minus_rhs;
   } else {
      *this += minus_rhs;
   }
 
   return *this;
}

References EC_Point(), is_zero(), and negate().

operator=() [1/2]

EC_Point & Botan::EC_Point::operator= ( const EC_Point & )

default

Standard Assignment

operator=() [2/2]

EC_Point & Botan::EC_Point::operator= ( EC_Point && other )

inline

Move Assignment

Definition at line 73 of file ec_point.h.

                                            {
         if(this != &other) {
            this->swap(other);
         }
         return (*this);
      }

operator==()

bool Botan::EC_Point::operator==

(

const EC_Point &

other

)

const

Equality operator

Definition at line 748 of file ec_point.cpp.

                                                     {
   if(m_curve != other.m_curve) {
      return false;
   }
 
   // If this is zero, only equal if other is also zero
   if(is_zero()) {
      return other.is_zero();
   }
 
   return (get_affine_x() == other.get_affine_x() && get_affine_y() == other.get_affine_y());
}

References get_affine_x(), get_affine_y(), and is_zero().

plus()

EC_Point Botan::EC_Point::plus ( const EC_Point & other, std::vector< BigInt > & workspace ) const

inline

Point addition

Parameters

other	the point to add to *this
workspace	temp space, at least WORKSPACE_SIZE elements

Returns

other plus *this

Definition at line 359 of file ec_point.h.

                                                                               {
         EC_Point x = (*this);
         x.add(other, workspace);
         return x;
      }

References add().

Referenced by Botan::EC_Point_Base_Point_Precompute::EC_Point_Base_Point_Precompute(), and Botan::EC_Point_Multi_Point_Precompute::EC_Point_Multi_Point_Precompute().

randomize_repr() [1/2]

void Botan::EC_Point::randomize_repr

(

RandomNumberGenerator &

rng

)

Randomize the point representation The actual value (get_affine_x, get_affine_y) does not change

Definition at line 120 of file ec_point.cpp.

                                                        {
   const auto& group = m_curve.group();
   secure_vector<word> ws(monty_ws_size(group));
   randomize_repr(rng, ws);
}

References randomize_repr().

Referenced by Botan::EC_Point_Var_Point_Precompute::EC_Point_Var_Point_Precompute(), Botan::EC_Point_Base_Point_Precompute::mul(), Botan::EC_Point_Var_Point_Precompute::mul(), and randomize_repr().

randomize_repr() [2/2]

void Botan::EC_Point::randomize_repr	(	RandomNumberGenerator &	rng,
		secure_vector< word > &	ws )

Randomize the point representation The actual value (get_affine_x, get_affine_y) does not change

Definition at line 126 of file ec_point.cpp.

                                                                                 {
   if(!rng.is_seeded()) {
      return;
   }
 
   const auto& group = m_curve.group();
 
   const BigInt mask = BigInt::random_integer(rng, 2, group.p());
 
   /*
   * No reason to convert this to Montgomery representation first,
   * just pretend the random mask was chosen as Redc(mask) and the
   * random mask we generated above is in the Montgomery
   * representation.
   */
 
   const BigInt mask2 = fe_sqr(group, mask, ws);
   const BigInt mask3 = fe_mul(group, mask2, mask, ws);
 
   m_x = fe_mul(group, m_x, mask2, ws);
   m_y = fe_mul(group, m_y, mask3, ws);
   m_z = fe_mul(group, m_z, mask, ws);
}

References Botan::fe_mul(), Botan::RandomNumberGenerator::is_seeded(), and Botan::BigInt::random_integer().

swap()

void Botan::EC_Point::swap ( EC_Point & other )

noexcept

swaps the states of *this and other

Parameters

other

the object to swap values with

Definition at line 741 of file ec_point.cpp.

                                            {
   m_curve.swap(other.m_curve);
   m_x.swap(other.m_x);
   m_y.swap(other.m_y);
   m_z.swap(other.m_z);
}

Referenced by Botan::EC_Point_Base_Point_Precompute::EC_Point_Base_Point_Precompute().

swap_coords()

void Botan::EC_Point::swap_coords ( BigInt & new_x, BigInt & new_y, BigInt & new_z )

inline

Definition at line 255 of file ec_point.h.

                                                                    {
         m_x.swap(new_x);
         m_y.swap(new_y);
         m_z.swap(new_z);
      }

x_bytes()

secure_vector< uint8_t > Botan::EC_Point::x_bytes

(

)

const

Return the fixed length big endian encoding of x coordinate

Definition at line 567 of file ec_point.cpp.

                                               {
   const auto& group = m_curve.group();
   const size_t p_bytes = group.p_bytes();
   secure_vector<uint8_t> b(p_bytes);
   BigInt::encode_1363(b.data(), b.size(), this->get_affine_x());
   return b;
}

References Botan::b, Botan::BigInt::encode_1363(), and Botan::EC_Group_Data::p_bytes().

xy_bytes()

secure_vector< uint8_t > Botan::EC_Point::xy_bytes

(

)

const

Return the fixed length concatenation of the x and y coordinates

Definition at line 583 of file ec_point.cpp.

                                                {
   const auto& group = m_curve.group();
   const size_t p_bytes = group.p_bytes();
   secure_vector<uint8_t> b(2 * p_bytes);
   BigInt::encode_1363(&b[0], p_bytes, this->get_affine_x());
   BigInt::encode_1363(&b[p_bytes], p_bytes, this->get_affine_y());
   return b;
}

References Botan::b, Botan::BigInt::encode_1363(), get_affine_x(), get_affine_y(), and Botan::EC_Group_Data::p_bytes().

Referenced by Botan::EC_AffinePoint_Data_BN::EC_AffinePoint_Data_BN().

y_bytes()

secure_vector< uint8_t > Botan::EC_Point::y_bytes

(

)

const

Return the fixed length big endian encoding of y coordinate

Definition at line 575 of file ec_point.cpp.

                                               {
   const auto& group = m_curve.group();
   const size_t p_bytes = group.p_bytes();
   secure_vector<uint8_t> b(p_bytes);
   BigInt::encode_1363(b.data(), b.size(), this->get_affine_y());
   return b;
}

References Botan::b, Botan::BigInt::encode_1363(), and Botan::EC_Group_Data::p_bytes().

zero()

EC_Point Botan::EC_Point::zero

(

)

const

Return the zero (aka infinite) point associated with this curve

Definition at line 99 of file ec_point.cpp.

                              {
   return EC_Point(m_curve);
}

References EC_Point().

Referenced by Botan::EC_Point_Multi_Point_Precompute::EC_Point_Multi_Point_Precompute(), mul(), Botan::EC_Point_Base_Point_Precompute::mul(), and Botan::EC_Point_Multi_Point_Precompute::multi_exp().

Friends And Related Symbol Documentation

EC_Point_Base_Point_Precompute

friend class EC_Point_Base_Point_Precompute

friend

Definition at line 37 of file ec_point.h.

EC_Point_Multi_Point_Precompute

friend class EC_Point_Multi_Point_Precompute

friend

Definition at line 36 of file ec_point.h.

EC_Point_Var_Point_Precompute

friend class EC_Point_Var_Point_Precompute

friend

Definition at line 35 of file ec_point.h.

swap

void swap ( EC_Point & x, EC_Point & y )

friend

Definition at line 261 of file ec_point.h.

{ x.swap(y); }

---

The documentation for this class was generated from the following files:

• src/lib/pubkey/ec_group/legacy_ec_point/ec_point.h
• src/lib/pubkey/ec_group/legacy_ec_point/ec_point.cpp