#include <ec_point.h>

Public Types
enum	: uint8_t { WORKSPACE_SIZE = 8 }
typedef EC_Point_Format	Compression_Type

Public Member Functions
bool	_is_x_eq_to_v_mod_order (const BigInt &v) const
void	add (const EC_Point &other, std::vector< BigInt > &workspace)
void	add (const word x_words[], size_t x_size, const word y_words[], size_t y_size, const word z_words[], size_t z_size, std::vector< BigInt > &workspace)
void	add_affine (const EC_Point &other, std::vector< BigInt > &workspace)
void	add_affine (const word x_words[], size_t x_size, const word y_words[], size_t y_size, std::vector< BigInt > &workspace)
EC_Point	double_of (std::vector< BigInt > &workspace) const
	EC_Point ()=default
	EC_Point (const CurveGFp &curve)
	EC_Point (const CurveGFp &curve, BigInt x, BigInt y)
	EC_Point (const EC_Point &)=default
	EC_Point (EC_Point &&other) noexcept
std::vector< uint8_t >	encode (EC_Point_Format format) const
void	force_affine ()
BigInt	get_affine_x () const
BigInt	get_affine_y () const
const CurveGFp &	get_curve () const
const BigInt &	get_x () const
const BigInt &	get_y () const
const BigInt &	get_z () const
bool	is_affine () const
bool	is_zero () const
EC_Point	mul (const BigInt &scalar) const
void	mult2 (std::vector< BigInt > &workspace)
void	mult2i (size_t i, std::vector< BigInt > &workspace)
EC_Point &	negate ()
bool	on_the_curve () const
bool	operator!= (const EC_Point &other) const =default
EC_Point &	operator*= (const BigInt &scalar)
EC_Point &	operator+= (const EC_Point &rhs)
EC_Point &	operator-= (const EC_Point &rhs)
EC_Point &	operator= (const EC_Point &)=default
EC_Point &	operator= (EC_Point &&other) noexcept
bool	operator== (const EC_Point &other) const
EC_Point	plus (const EC_Point &other, std::vector< BigInt > &workspace) const
void	randomize_repr (RandomNumberGenerator &rng)
void	randomize_repr (RandomNumberGenerator &rng, secure_vector< word > &ws)
void	swap (EC_Point &other) noexcept
void	swap_coords (BigInt &new_x, BigInt &new_y, BigInt &new_z)
secure_vector< uint8_t >	x_bytes () const
secure_vector< uint8_t >	xy_bytes () const
secure_vector< uint8_t >	y_bytes () const
EC_Point	zero () const
	~EC_Point ()=default

Static Public Member Functions
static void	force_all_affine (std::span< EC_Point > points, secure_vector< word > &ws)

Friends
class	EC_Point_Base_Point_Precompute
class	EC_Point_Multi_Point_Precompute
class	EC_Point_Var_Point_Precompute
void	swap (EC_Point &x, EC_Point &y) noexcept

Detailed Description

Deprecated elliptic curve type

Use EC_AffinePoint in new code; this type is no longer used internally at all except to support very unfortunate (and deprecated) curve types, specifically those with a cofactor, or with unreasonable sizes (above 521 bits), which cannot be accommodated by the new faster EC library in math/pcurves. For normal curves EC_AffinePoint will typically be 2 or 3 times faster.

This type will be completely removed in Botan4

Definition at line 33 of file ec_point.h.

Member Typedef Documentation

◆ Compression_Type

typedef EC_Point_Format Botan::EC_Point::Compression_Type

Definition at line 39 of file ec_point.h.

Member Enumeration Documentation

◆ anonymous enum

anonymous enum : uint8_t

Enumerator
WORKSPACE_SIZE

Definition at line 42 of file ec_point.h.

42: uint8_t /* NOLINT(*-use-enum-class) */ { WORKSPACE_SIZE = 8 };

Botan::EC_Point::WORKSPACE_SIZE

@ WORKSPACE_SIZE

Definition ec_point.h:42

Constructor & Destructor Documentation

◆ EC_Point() [1/5]

Botan::EC_Point::EC_Point ( )

default

Construct an uninitialized EC_Point

References EC_Point().

Referenced by add(), add_affine(), double_of(), EC_Point(), EC_Point(), EC_Point(), EC_Point(), force_all_affine(), mul(), mult2(), mult2i(), negate(), operator!=(), operator*=(), operator+=(), operator-=(), operator=(), operator=(), operator==(), plus(), swap(), swap, zero(), and ~EC_Point().

◆ EC_Point() [2/5]

Botan::EC_Point::EC_Point ( const CurveGFp & curve )

explicit

Construct the zero point

Parameters

curve The base curve

Definition at line 107 of file ec_point.cpp.

107: m_curve(curve), m_x(0), m_y(curve.group().monty().R1()), m_z(0) {}

References EC_Point().

◆ EC_Point() [3/5]

Botan::EC_Point::EC_Point ( const EC_Point & )

default

Copy constructor

References EC_Point().

◆ EC_Point() [4/5]

Botan::EC_Point::EC_Point ( EC_Point && other )

inlinenoexcept

Move Constructor

Definition at line 63 of file ec_point.h.

63{ this->swap(other); }

Botan::EC_Point::swap

void swap(EC_Point &other) noexcept

Definition ec_point.cpp:780

References EC_Point(), and swap().

◆ ~EC_Point()

Botan::EC_Point::~EC_Point ( )

default

References EC_Point(), encode(), and mul().

◆ EC_Point() [5/5]

Botan::EC_Point::EC_Point	(	const CurveGFp &	curve,
		BigInt	x,
		BigInt	y )

Construct a point from its affine coordinates

Parameters

curve	the base curve
x	affine x coordinate
y	affine y coordinate

Definition at line 113 of file ec_point.cpp.

                                                            :
      m_curve(curve), m_x(std::move(x)), m_y(std::move(y)), m_z(m_curve.group().monty().R1()) {
   const auto& group = m_curve.group();
 
   if(m_x < 0 || m_x >= group.p()) {
      throw Invalid_Argument("Invalid EC_Point affine x");
   }
   if(m_y < 0 || m_y >= group.p()) {
      throw Invalid_Argument("Invalid EC_Point affine y");
   }
 
   secure_vector<word> monty_ws(monty_ws_size(group));
 
   to_rep(group, m_x, monty_ws);
   to_rep(group, m_y, monty_ws);
}

Member Function Documentation

◆ _is_x_eq_to_v_mod_order()

bool Botan::EC_Point::_is_x_eq_to_v_mod_order ( const BigInt & v ) const

For internal use only

Definition at line 713 of file ec_point.cpp.

                                                            {
   if(this->is_zero()) {
      return false;
   }
 
   const auto& group = m_curve.group();
 
   /*
   * The trick used below doesn't work for curves with cofactors
   */
   if(group.has_cofactor()) {
      return group.mod_order().reduce(this->get_affine_x()) == v;
   }
 
   /*
   * Note we're working with the projective coordinate directly here!
   * Nominally we're comparing v with the affine x coordinate.
   *
   * return group.mod_order(this->get_affine_x()) == v;
   *
   * However by instead projecting r to an identical z as the x
   * coordinate, we can compare without having to perform an
   * expensive inversion in the field.
   *
   * That is, given (x*z2) and r, instead of checking if
   *    (x*z2)*z2^-1 == r,
   * we check if
   *    (x*z2) == (r*z2)
   */
   secure_vector<word> ws;
   BigInt vr = v;
   to_rep(group, vr, ws);
   BigInt z2;
   BigInt v_z2;
   fe_sqr(group, z2, this->get_z(), ws);
   fe_mul(group, v_z2, vr, z2, ws);
 
   /*
   * Since (typically) the group order is slightly less than the size
   * of the field elements, its possible the signer had to reduce the
   * r component. If they did not reduce r, then this value is correct.
   *
   * Due to the Hasse bound, this case occurs almost always; the
   * probability that a reduction was actually required is
   * approximately 1 in 2^(n/2) where n is the bit length of the curve.
   */
   if(this->get_x() == v_z2) {
      return true;
   }
 
   if(group.order_is_less_than_p()) {
      vr = v + group.order();
      if(vr < group.p()) {
         to_rep(group, vr, ws);
         fe_mul(group, v_z2, vr, z2, ws);
 
         if(this->get_x() == v_z2) {
            return true;
         }
      }
   }
 
   // Reject:
   return false;
}

References get_affine_x(), get_x(), get_z(), and is_zero().

Referenced by operator!=().

◆ add() [1/2]

void Botan::EC_Point::add	(	const EC_Point &	other,
		std::vector< BigInt > &	workspace )

Point addition

Parameters

other	the point to add to *this
workspace	temp space, at least WORKSPACE_SIZE elements

Definition at line 265 of file ec_point.cpp.

                                                                      {
   BOTAN_ARG_CHECK(m_curve == other.m_curve, "cannot add points on different curves");
 
   const size_t p_words = m_curve.get_p_words();
 
   add(other.m_x._data(),
       std::min(p_words, other.m_x.size()),
       other.m_y._data(),
       std::min(p_words, other.m_y.size()),
       other.m_z._data(),
       std::min(p_words, other.m_z.size()),
       workspace);
}

References Botan::BigInt::_data(), add(), BOTAN_ARG_CHECK, EC_Point(), and Botan::BigInt::size().

Referenced by add(), mul(), Botan::EC_Point_Var_Point_Precompute::mul(), Botan::EC_Point_Multi_Point_Precompute::multi_exp(), operator+=(), and plus().

◆ add() [2/2]

void Botan::EC_Point::add	(	const word	x_words[],
		size_t	x_size,
		const word	y_words[],
		size_t	y_size,
		const word	z_words[],
		size_t	z_size,
		std::vector< BigInt > &	workspace )

Point addition. Array version.

Parameters

x_words	the words of the x coordinate of the other point
x_size	size of x_words
y_words	the words of the y coordinate of the other point
y_size	size of y_words
z_words	the words of the z coordinate of the other point
z_size	size of z_words
workspace	temp space, at least WORKSPACE_SIZE elements

Definition at line 279 of file ec_point.cpp.

                                             {
   if((CT::all_zeros(x_words, x_size) & CT::all_zeros(z_words, z_size)).as_bool()) {
      return;
   }
 
   const auto& group = m_curve.group();
 
   if(is_zero()) {
      m_x.set_words(x_words, x_size);
      m_y.set_words(y_words, y_size);
      m_z.set_words(z_words, z_size);
      return;
   }
 
   resize_ws(ws_bn, monty_ws_size(group));
 
   secure_vector<word>& ws = ws_bn[0].get_word_vector();
   secure_vector<word>& sub_ws = ws_bn[1].get_word_vector();
 
   BigInt& T0 = ws_bn[2];
   BigInt& T1 = ws_bn[3];
   BigInt& T2 = ws_bn[4];
   BigInt& T3 = ws_bn[5];
   BigInt& T4 = ws_bn[6];
   BigInt& T5 = ws_bn[7];
 
   /*
   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2
   */
 
   const BigInt& p = group.p();
 
   fe_sqr(group, T0, z_words, z_size, ws);      // z2^2
   fe_mul(group, T1, m_x, T0, ws);              // x1*z2^2
   fe_mul(group, T3, z_words, z_size, T0, ws);  // z2^3
   fe_mul(group, T2, m_y, T3, ws);              // y1*z2^3
 
   fe_sqr(group, T3, m_z, ws);                  // z1^2
   fe_mul(group, T4, x_words, x_size, T3, ws);  // x2*z1^2
 
   fe_mul(group, T5, m_z, T3, ws);              // z1^3
   fe_mul(group, T0, y_words, y_size, T5, ws);  // y2*z1^3
 
   T4.mod_sub(T1, p, sub_ws);  // x2*z1^2 - x1*z2^2
 
   T0.mod_sub(T2, p, sub_ws);
 
   if(T4.is_zero()) {
      if(T0.is_zero()) {
         mult2(ws_bn);
         return;
      }
 
      // setting to zero:
      m_x.clear();
      m_y = group.monty().R1();
      m_z.clear();
      return;
   }
 
   fe_sqr(group, T5, T4, ws);
 
   fe_mul(group, T3, T1, T5, ws);
 
   fe_mul(group, T1, T5, T4, ws);
 
   fe_sqr(group, m_x, T0, ws);
   m_x.mod_sub(T1, p, sub_ws);
   m_x.mod_sub(T3, p, sub_ws);
   m_x.mod_sub(T3, p, sub_ws);
 
   T3.mod_sub(m_x, p, sub_ws);
 
   fe_mul(group, m_y, T0, T3, ws);
   fe_mul(group, T3, T2, T1, ws);
 
   m_y.mod_sub(T3, p, sub_ws);
 
   fe_mul(group, T3, z_words, z_size, m_z, ws);
   fe_mul(group, m_z, T3, T4, ws);
}

References Botan::CT::all_zeros(), Botan::BigInt::is_zero(), is_zero(), Botan::BigInt::mod_sub(), and mult2().

◆ add_affine() [1/2]

void Botan::EC_Point::add_affine	(	const EC_Point &	other,
		std::vector< BigInt > &	workspace )

Point addition - mixed J+A

Warning: This function assumes that other is affine, if this is not correct the result will be invalid.

Parameters

other	affine point to add - assumed to be affine!
workspace	temp space, at least WORKSPACE_SIZE elements

Definition at line 174 of file ec_point.cpp.

                                                                             {
   BOTAN_ASSERT_NOMSG(m_curve == other.m_curve);
   BOTAN_DEBUG_ASSERT(other.is_affine());
 
   const size_t p_words = m_curve.get_p_words();
   add_affine(other.m_x._data(),
              std::min(p_words, other.m_x.size()),
              other.m_y._data(),
              std::min(p_words, other.m_y.size()),
              workspace);
}

References Botan::BigInt::_data(), add_affine(), BOTAN_ASSERT_NOMSG, BOTAN_DEBUG_ASSERT, EC_Point(), is_affine(), and Botan::BigInt::size().

Referenced by add_affine(), Botan::EC_Point_Base_Point_Precompute::mul(), and Botan::EC_Point_Multi_Point_Precompute::multi_exp().

◆ add_affine() [2/2]

void Botan::EC_Point::add_affine	(	const word	x_words[],
		size_t	x_size,
		const word	y_words[],
		size_t	y_size,
		std::vector< BigInt > &	workspace )

Point addition - mixed J+A. Array version.

Parameters

x_words	the words of the x coordinate of the other point
x_size	size of x_words
y_words	the words of the y coordinate of the other point
y_size	size of y_words
workspace	temp space, at least WORKSPACE_SIZE elements

Definition at line 186 of file ec_point.cpp.

                                                                                                       {
   if((CT::all_zeros(x_words, x_size) & CT::all_zeros(y_words, y_size)).as_bool()) {
      return;
   }
 
   const auto& group = m_curve.group();
 
   if(is_zero()) {
      m_x.set_words(x_words, x_size);
      m_y.set_words(y_words, y_size);
      m_z = group.monty().R1();
      return;
   }
 
   resize_ws(ws_bn, monty_ws_size(group));
 
   secure_vector<word>& ws = ws_bn[0].get_word_vector();
   secure_vector<word>& sub_ws = ws_bn[1].get_word_vector();
 
   BigInt& T0 = ws_bn[2];
   BigInt& T1 = ws_bn[3];
   BigInt& T2 = ws_bn[4];
   BigInt& T3 = ws_bn[5];
   BigInt& T4 = ws_bn[6];
 
   /*
   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2
   simplified with Z2 = 1
   */
 
   const BigInt& p = group.p();
 
   fe_sqr(group, T3, m_z, ws);                  // z1^2
   fe_mul(group, T4, x_words, x_size, T3, ws);  // x2*z1^2
 
   fe_mul(group, T2, m_z, T3, ws);              // z1^3
   fe_mul(group, T0, y_words, y_size, T2, ws);  // y2*z1^3
 
   T4.mod_sub(m_x, p, sub_ws);  // x2*z1^2 - x1*z2^2
 
   T0.mod_sub(m_y, p, sub_ws);
 
   if(T4.is_zero()) {
      if(T0.is_zero()) {
         mult2(ws_bn);
         return;
      }
 
      // setting to zero:
      m_x.clear();
      m_y = group.monty().R1();
      m_z.clear();
      return;
   }
 
   fe_sqr(group, T2, T4, ws);
 
   fe_mul(group, T3, m_x, T2, ws);
 
   fe_mul(group, T1, T2, T4, ws);
 
   fe_sqr(group, m_x, T0, ws);
   m_x.mod_sub(T1, p, sub_ws);
 
   m_x.mod_sub(T3, p, sub_ws);
   m_x.mod_sub(T3, p, sub_ws);
 
   T3.mod_sub(m_x, p, sub_ws);
 
   fe_mul(group, T2, T0, T3, ws);
   fe_mul(group, T0, m_y, T1, ws);
   T2.mod_sub(T0, p, sub_ws);
   m_y.swap(T2);
 
   fe_mul(group, T0, m_z, T4, ws);
   m_z.swap(T0);
}

References Botan::CT::all_zeros(), Botan::BigInt::is_zero(), is_zero(), Botan::BigInt::mod_sub(), mult2(), and Botan::BigInt::swap().

◆ double_of()

EC_Point Botan::EC_Point::double_of ( std::vector< BigInt > & workspace ) const

inline

Point doubling

Parameters

workspace temp space, at least WORKSPACE_SIZE elements

Returns: *this doubled

Definition at line 350 of file ec_point.h.

                                                             {
         EC_Point x = (*this);
         x.mult2(workspace);
         return x;
      }

References EC_Point(), and mult2().

◆ encode()

std::vector< uint8_t > Botan::EC_Point::encode ( EC_Point_Format format ) const

EC2OSP - elliptic curve to octet string primitive

Parameters

format which format to encode using

Definition at line 801 of file ec_point.cpp.

                                                                {
   if(is_zero()) {
      return std::vector<uint8_t>(1);  // single 0 byte
   }
 
   const size_t p_bytes = m_curve.group().p_bytes();
 
   const BigInt x = get_affine_x();
   const BigInt y = get_affine_y();
 
   const size_t parts = (format == EC_Point_Format::Compressed) ? 1 : 2;
 
   std::vector<uint8_t> result(1 + parts * p_bytes);
   BufferStuffer stuffer(result);
 
   if(format == EC_Point_Format::Uncompressed) {
      stuffer.append(0x04);
      x.serialize_to(stuffer.next(p_bytes));
      y.serialize_to(stuffer.next(p_bytes));
   } else if(format == EC_Point_Format::Compressed) {
      stuffer.append(0x02 | static_cast<uint8_t>(y.get_bit(0)));
      x.serialize_to(stuffer.next(p_bytes));
   } else if(format == EC_Point_Format::Hybrid) {
      stuffer.append(0x06 | static_cast<uint8_t>(y.get_bit(0)));
      x.serialize_to(stuffer.next(p_bytes));
      y.serialize_to(stuffer.next(p_bytes));
   } else {
      throw Invalid_Argument("EC2OSP illegal point encoding");
   }
 
   return result;
}

References Botan::BufferStuffer::append(), Botan::Compressed, get_affine_x(), get_affine_y(), Botan::BigInt::get_bit(), Botan::Hybrid, is_zero(), Botan::BufferStuffer::next(), Botan::BigInt::serialize_to(), and Botan::Uncompressed.

Referenced by ~EC_Point().

◆ force_affine()

void Botan::EC_Point::force_affine ( )

Force this point to affine coordinates

Convert the point to its equivalent affine coordinates. Throws if this is the point at infinity.

Definition at line 583 of file ec_point.cpp.

                            {
   if(is_zero()) {
      throw Invalid_State("Cannot convert zero ECC point to affine");
   }
 
   secure_vector<word> ws;
 
   const auto& group = m_curve.group();
 
   const BigInt z_inv = invert_element(group, m_z, ws);
   const BigInt z2_inv = fe_sqr(group, z_inv, ws);
   const BigInt z3_inv = fe_mul(group, z_inv, z2_inv, ws);
   m_x = fe_mul(group, m_x, z2_inv, ws);
   m_y = fe_mul(group, m_y, z3_inv, ws);
   m_z = group.monty().R1();
}

References is_zero().

◆ force_all_affine()

void Botan::EC_Point::force_all_affine	(	std::span< EC_Point >	points,
		secure_vector< word > &	ws )

static

Force all points on the list to affine coordinates

Force several points to be affine at once. Uses Montgomery's trick to reduce number of inversions required, so this is much faster than calling force_affine on each point in sequence.

Definition at line 519 of file ec_point.cpp.

                                                                                 {
   if(points.size() <= 1) {
      for(auto& point : points) {
         point.force_affine();
      }
      return;
   }
 
   for(auto& point : points) {
      if(point.is_zero()) {
         throw Invalid_State("Cannot convert zero ECC point to affine");
      }
   }
 
   /*
   For >= 2 points use Montgomery's trick
 
   See Algorithm 2.26 in "Guide to Elliptic Curve Cryptography"
   (Hankerson, Menezes, Vanstone)
 
   TODO is it really necessary to save all k points in c?
   */
 
   const auto& group = points[0].m_curve.group();
   const BigInt& rep_1 = group.monty().R1();
 
   if(ws.size() < monty_ws_size(group)) {
      ws.resize(monty_ws_size(group));
   }
 
   std::vector<BigInt> c(points.size());
   c[0] = points[0].m_z;
 
   for(size_t i = 1; i != points.size(); ++i) {
      fe_mul(group, c[i], c[i - 1], points[i].m_z, ws);
   }
 
   BigInt s_inv = invert_element(group, c[c.size() - 1], ws);
 
   BigInt z_inv;
   BigInt z2_inv;
   BigInt z3_inv;
 
   for(size_t i = points.size() - 1; i != 0; i--) {
      EC_Point& point = points[i];
 
      fe_mul(group, z_inv, s_inv, c[i - 1], ws);
 
      s_inv = fe_mul(group, s_inv, point.m_z, ws);
 
      fe_sqr(group, z2_inv, z_inv, ws);
      fe_mul(group, z3_inv, z2_inv, z_inv, ws);
      point.m_x = fe_mul(group, point.m_x, z2_inv, ws);
      point.m_y = fe_mul(group, point.m_y, z3_inv, ws);
      point.m_z = rep_1;
   }
 
   fe_sqr(group, z2_inv, s_inv, ws);
   fe_mul(group, z3_inv, z2_inv, s_inv, ws);
   points[0].m_x = fe_mul(group, points[0].m_x, z2_inv, ws);
   points[0].m_y = fe_mul(group, points[0].m_y, z3_inv, ws);
   points[0].m_z = rep_1;
}

References EC_Point().

Referenced by Botan::EC_Point_Base_Point_Precompute::EC_Point_Base_Point_Precompute(), and Botan::EC_Point_Multi_Point_Precompute::EC_Point_Multi_Point_Precompute().

◆ get_affine_x()

BigInt Botan::EC_Point::get_affine_x ( ) const

get affine x coordinate

Returns: affine x coordinate

Definition at line 630 of file ec_point.cpp.

                                    {
   if(is_zero()) {
      throw Invalid_State("Cannot convert zero point to affine");
   }
 
   secure_vector<word> monty_ws;
 
   const auto& group = m_curve.group();
 
   if(is_affine()) {
      return from_rep_to_tmp(group, m_x, monty_ws);
   }
 
   BigInt z2 = fe_sqr(group, m_z, monty_ws);
   z2 = invert_element(group, z2, monty_ws);
 
   BigInt r;
   fe_mul(group, r, m_x, z2, monty_ws);
   from_rep(group, r, monty_ws);
   return r;
}

References is_affine(), and is_zero().

Referenced by _is_x_eq_to_v_mod_order(), encode(), operator==(), and xy_bytes().

◆ get_affine_y()

BigInt Botan::EC_Point::get_affine_y ( ) const

get affine y coordinate

Returns: affine y coordinate

Definition at line 652 of file ec_point.cpp.

                                    {
   if(is_zero()) {
      throw Invalid_State("Cannot convert zero point to affine");
   }
 
   const auto& group = m_curve.group();
   secure_vector<word> monty_ws;
 
   if(is_affine()) {
      return from_rep_to_tmp(group, m_y, monty_ws);
   }
 
   const BigInt z2 = fe_sqr(group, m_z, monty_ws);
   const BigInt z3 = fe_mul(group, m_z, z2, monty_ws);
   const BigInt z3_inv = invert_element(group, z3, monty_ws);
 
   BigInt r;
   fe_mul(group, r, m_y, z3_inv, monty_ws);
   from_rep(group, r, monty_ws);
   return r;
}

References is_affine(), and is_zero().

Referenced by encode(), operator==(), and xy_bytes().

◆ get_curve()

const CurveGFp & Botan::EC_Point::get_curve ( ) const

inline

Return base curve of this point

Returns: the curve over GF(p) of this point

You should not need to use this

Definition at line 362 of file ec_point.h.

362{ return m_curve; }

References get_curve().

Referenced by get_curve().

◆ get_x()

const BigInt & Botan::EC_Point::get_x ( ) const

inline

Return the internal x coordinate

Note this may be in Montgomery form

Definition at line 239 of file ec_point.h.

239{ return m_x; }

References get_x().

Referenced by _is_x_eq_to_v_mod_order(), and get_x().

◆ get_y()

const BigInt & Botan::EC_Point::get_y ( ) const

inline

Return the internal y coordinate

Note this may be in Montgomery form

Definition at line 246 of file ec_point.h.

246{ return m_y; }

References get_y().

Referenced by get_y().

◆ get_z()

const BigInt & Botan::EC_Point::get_z ( ) const

inline

Return the internal z coordinate

Note this may be in Montgomery form

Definition at line 253 of file ec_point.h.

253{ return m_z; }

References get_z().

Referenced by _is_x_eq_to_v_mod_order(), and get_z().

◆ is_affine()

bool Botan::EC_Point::is_affine ( ) const

Definition at line 600 of file ec_point.cpp.

                               {
   const auto& group = m_curve.group();
   return m_z == group.monty().R1();
}

Referenced by add_affine(), get_affine_x(), and get_affine_y().

◆ is_zero()

bool Botan::EC_Point::is_zero ( ) const

inline

Is this the point at infinity?

Returns: true, if this point is at infinity, false otherwise.

Definition at line 164 of file ec_point.h.

164{ return m_z.is_zero(); }

Referenced by _is_x_eq_to_v_mod_order(), add(), add_affine(), encode(), force_affine(), get_affine_x(), get_affine_y(), mult2(), negate(), on_the_curve(), operator-=(), and operator==().

◆ mul()

EC_Point Botan::EC_Point::mul ( const BigInt & scalar ) const

Point multiplication operator

Simple unblinded Montgomery ladder

Warning: prefer the functions on EC_Group such as blinded_var_point_multiply

Parameters

scalar the scalar value

Returns: *this multiplied by the scalar value

Definition at line 496 of file ec_point.cpp.

                                                 {
   const size_t scalar_bits = scalar.bits();
 
   std::vector<BigInt> ws(EC_Point::WORKSPACE_SIZE);
 
   EC_Point R[2] = {this->zero(), *this};
 
   for(size_t i = scalar_bits; i > 0; i--) {
      const size_t b = scalar.get_bit(i - 1) ? 1 : 0;
      R[b ^ 1].add(R[b], ws);
      R[b].mult2(ws);
   }
 
   if(scalar.is_negative()) {
      R[0].negate();
   }
 
   BOTAN_DEBUG_ASSERT(R[0].on_the_curve());
 
   return R[0];
}

References add(), Botan::BigInt::bits(), BOTAN_DEBUG_ASSERT, EC_Point(), Botan::BigInt::get_bit(), Botan::BigInt::is_negative(), mult2(), negate(), on_the_curve(), WORKSPACE_SIZE, and zero().

Referenced by Botan::operator*(), Botan::operator*(), and ~EC_Point().

◆ mult2()

void Botan::EC_Point::mult2 ( std::vector< BigInt > & workspace )

Point doubling

Parameters

workspace temp space, at least WORKSPACE_SIZE elements

Definition at line 387 of file ec_point.cpp.

                                             {
   if(is_zero()) {
      return;
   }
 
   const auto& group = m_curve.group();
 
   if(m_y.is_zero()) {
      *this = EC_Point(m_curve);  // setting myself to zero
      return;
   }
 
   resize_ws(ws_bn, monty_ws_size(group));
 
   secure_vector<word>& ws = ws_bn[0].get_word_vector();
   secure_vector<word>& sub_ws = ws_bn[1].get_word_vector();
 
   BigInt& T0 = ws_bn[2];
   BigInt& T1 = ws_bn[3];
   BigInt& T2 = ws_bn[4];
   BigInt& T3 = ws_bn[5];
   BigInt& T4 = ws_bn[6];
 
   /*
   https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-1986-cc
   */
   const BigInt& p = group.p();
 
   fe_sqr(group, T0, m_y, ws);
 
   fe_mul(group, T1, m_x, T0, ws);
   fe_smul<4>(T1, p, sub_ws);
 
   if(group.a_is_zero()) {
      // if a == 0 then 3*x^2 + a*z^4 is just 3*x^2
      fe_sqr(group, T4, m_x, ws);  // x^2
      fe_smul<3>(T4, p, sub_ws);   // 3*x^2
   } else if(group.a_is_minus_3()) {
      /*
      if a == -3 then
        3*x^2 + a*z^4 == 3*x^2 - 3*z^4 == 3*(x^2-z^4) == 3*(x-z^2)*(x+z^2)
      */
      fe_sqr(group, T3, m_z, ws);  // z^2
 
      // (x-z^2)
      T2 = m_x;
      T2.mod_sub(T3, p, sub_ws);
 
      // (x+z^2)
      T3.mod_add(m_x, p, sub_ws);
 
      fe_mul(group, T4, T2, T3, ws);  // (x-z^2)*(x+z^2)
 
      fe_smul<3>(T4, p, sub_ws);  // 3*(x-z^2)*(x+z^2)
   } else {
      fe_sqr(group, T3, m_z, ws);                  // z^2
      fe_sqr(group, T4, T3, ws);                   // z^4
      fe_mul(group, T3, group.monty_a(), T4, ws);  // a*z^4
 
      fe_sqr(group, T4, m_x, ws);  // x^2
      fe_smul<3>(T4, p, sub_ws);
      T4.mod_add(T3, p, sub_ws);  // 3*x^2 + a*z^4
   }
 
   fe_sqr(group, T2, T4, ws);
   T2.mod_sub(T1, p, sub_ws);
   T2.mod_sub(T1, p, sub_ws);
 
   fe_sqr(group, T3, T0, ws);
   fe_smul<8>(T3, p, sub_ws);
 
   T1.mod_sub(T2, p, sub_ws);
 
   fe_mul(group, T0, T4, T1, ws);
   T0.mod_sub(T3, p, sub_ws);
 
   m_x.swap(T2);
 
   fe_mul(group, T2, m_y, m_z, ws);
   fe_smul<2>(T2, p, sub_ws);
 
   m_y.swap(T0);
   m_z.swap(T2);
}

References EC_Point(), is_zero(), Botan::BigInt::mod_add(), Botan::BigInt::mod_sub(), and Botan::BigInt::swap().

Referenced by add(), add_affine(), double_of(), Botan::EC_Point_Base_Point_Precompute::EC_Point_Base_Point_Precompute(), Botan::EC_Point_Multi_Point_Precompute::EC_Point_Multi_Point_Precompute(), mul(), and mult2i().

◆ mult2i()

void Botan::EC_Point::mult2i	(	size_t	i,
		std::vector< BigInt > &	workspace )

Repeated point doubling

Parameters

i	number of doublings to perform
workspace	temp space, at least WORKSPACE_SIZE elements

Definition at line 367 of file ec_point.cpp.

                                                                 {
   if(iterations == 0) {
      return;
   }
 
   if(m_y.is_zero()) {
      *this = EC_Point(m_curve);  // setting myself to zero
      return;
   }
 
   /*
   TODO we can save 2 squarings per iteration by computing
   a*Z^4 using values cached from previous iteration
   */
   for(size_t i = 0; i != iterations; ++i) {
      mult2(ws_bn);
   }
}

References EC_Point(), and mult2().

Referenced by Botan::EC_Point_Var_Point_Precompute::mul(), and Botan::EC_Point_Multi_Point_Precompute::multi_exp().

◆ negate()

EC_Point & Botan::EC_Point::negate ( )

inline

Negate this point

Returns: *this

Definition at line 134 of file ec_point.h.

                         {
         if(!is_zero()) {
            m_y = m_curve.get_p() - m_y;
         }
         return *this;
      }

References EC_Point(), is_zero(), and negate().

Referenced by mul(), Botan::EC_Point_Multi_Point_Precompute::multi_exp(), negate(), and Botan::operator-().

◆ on_the_curve()

bool Botan::EC_Point::on_the_curve ( ) const

Checks whether the point is to be found on the underlying curve; used to prevent fault attacks.

Returns: if the point is on the curve

Definition at line 674 of file ec_point.cpp.

                                  {
   /*
   Is the point still on the curve?? (If everything is correct, the
   point is always on its curve; then the function will return true.
   If somehow the state is corrupted, which suggests a fault attack
   (or internal computational error), then return false.
   */
   if(is_zero()) {
      return true;
   }
 
   const auto& group = m_curve.group();
   secure_vector<word> monty_ws;
 
   const BigInt y2 = from_rep_to_tmp(group, fe_sqr(group, m_y, monty_ws), monty_ws);
   const BigInt x3 = fe_mul(group, m_x, fe_sqr(group, m_x, monty_ws), monty_ws);
   const BigInt ax = fe_mul(group, m_x, group.monty_a(), monty_ws);
   const BigInt z2 = fe_sqr(group, m_z, monty_ws);
 
   const BigInt& monty_b = group.monty_b();
 
   // Is z equal to 1 (in Montgomery form)?
   if(m_z == z2) {
      if(y2 != from_rep_to_tmp(group, x3 + ax + monty_b, monty_ws)) {
         return false;
      }
   }
 
   const BigInt z3 = fe_mul(group, m_z, z2, monty_ws);
   const BigInt ax_z4 = fe_mul(group, ax, fe_sqr(group, z2, monty_ws), monty_ws);
   const BigInt b_z6 = fe_mul(group, monty_b, fe_sqr(group, z3, monty_ws), monty_ws);
 
   if(y2 != from_rep_to_tmp(group, x3 + ax_z4 + b_z6, monty_ws)) {
      return false;
   }
 
   return true;
}

References is_zero().

Referenced by Botan::EC_Point_Multi_Point_Precompute::EC_Point_Multi_Point_Precompute(), mul(), Botan::EC_Point_Base_Point_Precompute::mul(), Botan::EC_Point_Var_Point_Precompute::mul(), Botan::OS2ECP(), and Botan::EC_Group::verify_group().

◆ operator!=()

bool Botan::EC_Point::operator!= ( const EC_Point & other ) const

default

References _is_x_eq_to_v_mod_order(), EC_Point(), and swap().

◆ operator*=()

EC_Point & Botan::EC_Point::operator*= ( const BigInt & scalar )

*= Operator

Parameters

scalar the EC_Point to multiply with *this

Returns: resulting EC_Point

Definition at line 491 of file ec_point.cpp.

                                                   {
   *this = scalar * *this;
   return *this;
}

References EC_Point().

◆ operator+=()

EC_Point & Botan::EC_Point::operator+= ( const EC_Point & rhs )

+= Operator

Parameters

rhs	the EC_Point to add to the local value

Returns: resulting EC_Point

Definition at line 473 of file ec_point.cpp.

                                                  {
   std::vector<BigInt> ws(EC_Point::WORKSPACE_SIZE);
   add(rhs, ws);
   return *this;
}

References add(), EC_Point(), and WORKSPACE_SIZE.

◆ operator-=()

EC_Point & Botan::EC_Point::operator-= ( const EC_Point & rhs )

-= Operator

Parameters

rhs	the EC_Point to subtract from the local value

Returns: resulting EC_Point

Definition at line 479 of file ec_point.cpp.

                                                  {
   EC_Point minus_rhs = EC_Point(rhs).negate();
 
   if(is_zero()) {
      *this = minus_rhs;
   } else {
      *this += minus_rhs;
   }
 
   return *this;
}

References EC_Point(), and is_zero().

◆ operator=() [1/2]

EC_Point & Botan::EC_Point::operator= ( const EC_Point & )

default

Standard Assignment

References EC_Point().

◆ operator=() [2/2]

EC_Point & Botan::EC_Point::operator= ( EC_Point && other )

inlinenoexcept

Move Assignment

Definition at line 73 of file ec_point.h.

                                                     {
         if(this != &other) {
            this->swap(other);
         }
         return (*this);
      }

References EC_Point(), and swap().

◆ operator==()

bool Botan::EC_Point::operator== ( const EC_Point & other ) const

Equality operator

Definition at line 787 of file ec_point.cpp.

                                                     {
   if(m_curve != other.m_curve) {
      return false;
   }
 
   // If this is zero, only equal if other is also zero
   if(is_zero()) {
      return other.is_zero();
   }
 
   return (get_affine_x() == other.get_affine_x() && get_affine_y() == other.get_affine_y());
}

References EC_Point(), get_affine_x(), get_affine_y(), and is_zero().

◆ plus()

EC_Point Botan::EC_Point::plus	(	const EC_Point &	other,
		std::vector< BigInt > &	workspace ) const

inline

Point addition

Parameters

other	the point to add to *this
workspace	temp space, at least WORKSPACE_SIZE elements

Returns: other plus *this

Definition at line 339 of file ec_point.h.

                                                                               {
         EC_Point x = (*this);
         x.add(other, workspace);
         return x;
      }

References add(), and EC_Point().

Referenced by Botan::EC_Point_Base_Point_Precompute::EC_Point_Base_Point_Precompute(), and Botan::EC_Point_Multi_Point_Precompute::EC_Point_Multi_Point_Precompute().

◆ randomize_repr() [1/2]

void Botan::EC_Point::randomize_repr ( RandomNumberGenerator & rng )

Randomize the point representation The actual value (get_affine_x, get_affine_y) does not change

Definition at line 130 of file ec_point.cpp.

                                                        {
   const auto& group = m_curve.group();
   secure_vector<word> ws(monty_ws_size(group));
   randomize_repr(rng, ws);
}

References randomize_repr().

Referenced by Botan::EC_Point_Var_Point_Precompute::EC_Point_Var_Point_Precompute(), Botan::EC_Point_Base_Point_Precompute::mul(), Botan::EC_Point_Var_Point_Precompute::mul(), and randomize_repr().

◆ randomize_repr() [2/2]

void Botan::EC_Point::randomize_repr	(	RandomNumberGenerator &	rng,
		secure_vector< word > &	ws )

Randomize the point representation The actual value (get_affine_x, get_affine_y) does not change

Definition at line 136 of file ec_point.cpp.

                                                                                 {
   if(!rng.is_seeded()) {
      return;
   }
 
   const auto& group = m_curve.group();
 
   const BigInt mask = BigInt::random_integer(rng, BigInt::from_s32(2), group.p());
 
   /*
   * No reason to convert this to Montgomery representation first,
   * just pretend the random mask was chosen as Redc(mask) and the
   * random mask we generated above is in the Montgomery
   * representation.
   */
 
   const BigInt mask2 = fe_sqr(group, mask, ws);
   const BigInt mask3 = fe_mul(group, mask2, mask, ws);
 
   m_x = fe_mul(group, m_x, mask2, ws);
   m_y = fe_mul(group, m_y, mask3, ws);
   m_z = fe_mul(group, m_z, mask, ws);
}

References Botan::BigInt::from_s32(), Botan::RandomNumberGenerator::is_seeded(), and Botan::BigInt::random_integer().

◆ swap()

void Botan::EC_Point::swap ( EC_Point & other )

noexcept

swaps the states of *this and other

Parameters

other the object to swap values with

Definition at line 780 of file ec_point.cpp.

                                            {
   m_curve.swap(other.m_curve);
   m_x.swap(other.m_x);
   m_y.swap(other.m_y);
   m_z.swap(other.m_z);
}

References EC_Point().

Referenced by EC_Point(), Botan::EC_Point_Base_Point_Precompute::EC_Point_Base_Point_Precompute(), operator!=(), and operator=().

◆ swap_coords()

void Botan::EC_Point::swap_coords	(	BigInt &	new_x,
		BigInt &	new_y,
		BigInt &	new_z )

inline

Definition at line 257 of file ec_point.h.

                                                                    {
         m_x.swap(new_x);
         m_y.swap(new_y);
         m_z.swap(new_z);
      }

References swap_coords().

Referenced by swap_coords().

◆ x_bytes()

secure_vector< uint8_t > Botan::EC_Point::x_bytes ( ) const

Return the fixed length big endian encoding of x coordinate

Definition at line 605 of file ec_point.cpp.

                                               {
   const auto& group = m_curve.group();
   const size_t p_bytes = group.p_bytes();
   secure_vector<uint8_t> b(p_bytes);
   BigInt::encode_1363(b.data(), b.size(), this->get_affine_x());
   return b;
}

References Botan::BigInt::encode_1363().

◆ xy_bytes()

secure_vector< uint8_t > Botan::EC_Point::xy_bytes ( ) const

Return the fixed length concatenation of the x and y coordinates

Definition at line 621 of file ec_point.cpp.

                                                {
   const auto& group = m_curve.group();
   const size_t p_bytes = group.p_bytes();
   secure_vector<uint8_t> b(2 * p_bytes);
   BigInt::encode_1363(&b[0], p_bytes, this->get_affine_x());  // NOLINT(*container-data-pointer)
   BigInt::encode_1363(&b[p_bytes], p_bytes, this->get_affine_y());
   return b;
}

References Botan::BigInt::encode_1363(), get_affine_x(), and get_affine_y().

◆ y_bytes()

secure_vector< uint8_t > Botan::EC_Point::y_bytes ( ) const

Return the fixed length big endian encoding of y coordinate

Definition at line 613 of file ec_point.cpp.

                                               {
   const auto& group = m_curve.group();
   const size_t p_bytes = group.p_bytes();
   secure_vector<uint8_t> b(p_bytes);
   BigInt::encode_1363(b.data(), b.size(), this->get_affine_y());
   return b;
}

References Botan::BigInt::encode_1363().

◆ zero()

EC_Point Botan::EC_Point::zero ( ) const

Return the zero (aka infinite) point associated with this curve

Definition at line 109 of file ec_point.cpp.

                              {
   return EC_Point(m_curve);
}

References EC_Point().

Referenced by Botan::EC_Point_Multi_Point_Precompute::EC_Point_Multi_Point_Precompute(), mul(), Botan::EC_Point_Base_Point_Precompute::mul(), and Botan::EC_Point_Multi_Point_Precompute::multi_exp().

◆ EC_Point_Base_Point_Precompute

friend class EC_Point_Base_Point_Precompute

friend

Definition at line 37 of file ec_point.h.

References EC_Point_Base_Point_Precompute.

Referenced by EC_Point_Base_Point_Precompute.

◆ EC_Point_Multi_Point_Precompute

friend class EC_Point_Multi_Point_Precompute

friend

Definition at line 36 of file ec_point.h.

References EC_Point_Multi_Point_Precompute.

Referenced by EC_Point_Multi_Point_Precompute.

◆ EC_Point_Var_Point_Precompute

friend class EC_Point_Var_Point_Precompute

friend

Definition at line 35 of file ec_point.h.

References EC_Point_Var_Point_Precompute.

Referenced by EC_Point_Var_Point_Precompute.

◆ swap

void swap	(	EC_Point &	x,
		EC_Point &	y )

friend

Definition at line 263 of file ec_point.h.

263{ x.swap(y); }

References EC_Point().

The documentation for this class was generated from the following files:

src/lib/pubkey/ec_group/legacy_ec_point/ec_point.h
src/lib/pubkey/ec_group/legacy_ec_point/ec_point.cpp

Public Types

Public Member Functions

Static Public Member Functions

Friends

Detailed Description

Member Typedef Documentation

◆ Compression_Type

Member Enumeration Documentation

◆ anonymous enum

Constructor & Destructor Documentation

◆ EC_Point() [1/5]

◆ EC_Point() [2/5]

◆ EC_Point() [3/5]

◆ EC_Point() [4/5]

◆ ~EC_Point()

◆ EC_Point() [5/5]

Member Function Documentation

◆ _is_x_eq_to_v_mod_order()

◆ add() [1/2]

◆ add() [2/2]

◆ add_affine() [1/2]

◆ add_affine() [2/2]

◆ double_of()

◆ encode()

◆ force_affine()

◆ force_all_affine()

◆ get_affine_x()

◆ get_affine_y()

◆ get_curve()

◆ get_x()

◆ get_y()

◆ get_z()

◆ is_affine()

◆ is_zero()

◆ mul()

◆ mult2()

◆ mult2i()

◆ negate()

◆ on_the_curve()

◆ operator!=()

◆ operator*=()

◆ operator+=()

◆ operator-=()

◆ operator=() [1/2]

◆ operator=() [2/2]

◆ operator==()

◆ plus()

◆ randomize_repr() [1/2]

◆ randomize_repr() [2/2]

◆ swap()

◆ swap_coords()

◆ x_bytes()

◆ xy_bytes()

◆ y_bytes()

◆ zero()

Friends And Related Symbol Documentation

◆ EC_Point_Base_Point_Precompute

◆ EC_Point_Multi_Point_Precompute

◆ EC_Point_Var_Point_Precompute

◆ swap