#include <pcurves.h>

Inheritance diagram for Botan::PCurve::PrimeOrderCurve:

Classes
class	AffinePoint

class	PrecomputedMul2Table

class	ProjectivePoint

class	Scalar

Public Types
typedef std::shared_ptr< const PrimeOrderCurve >	CurvePtr

typedef std::array< word, StorageWords >	StorageUnit

Public Member Functions
virtual bool	affine_point_is_identity (const AffinePoint &pt) const =0

virtual Scalar	base_point_mul_x_mod_order (const Scalar &scalar, RandomNumberGenerator &rng) const =0

virtual std::optional< AffinePoint >	deserialize_point (std::span< const uint8_t > bytes) const =0

virtual std::optional< Scalar >	deserialize_scalar (std::span< const uint8_t > bytes) const =0

virtual size_t	field_element_bytes () const =0

virtual AffinePoint	generator () const =0
	Return the standard generator.

virtual AffinePoint	hash_to_curve_nu (std::function< void(std::span< uint8_t >)> expand_message) const =0

virtual ProjectivePoint	hash_to_curve_ro (std::function< void(std::span< uint8_t >)> expand_message) const =0

virtual ProjectivePoint	mul (const AffinePoint &pt, const Scalar &scalar, RandomNumberGenerator &rng) const =0

virtual std::unique_ptr< const PrecomputedMul2Table >	mul2_setup_g (const AffinePoint &q) const =0
	Setup a table for 2-ary multiplication where the first point is the generator.

virtual std::optional< ProjectivePoint >	mul2_vartime (const PrecomputedMul2Table &table, const Scalar &x, const Scalar &y) const =0

virtual bool	mul2_vartime_x_mod_order_eq (const PrecomputedMul2Table &table, const Scalar &v, const Scalar &x, const Scalar &y) const =0

virtual ProjectivePoint	mul_by_g (const Scalar &scalar, RandomNumberGenerator &rng) const =0

virtual std::optional< ProjectivePoint >	mul_px_qy (const AffinePoint &p, const Scalar &x, const AffinePoint &q, const Scalar &y, RandomNumberGenerator &rng) const =0

virtual secure_vector< uint8_t >	mul_x_only (const AffinePoint &pt, const Scalar &scalar, RandomNumberGenerator &rng) const =0

virtual size_t	order_bits () const =0
	Return the bit length of the group order.

virtual ProjectivePoint	point_add (const AffinePoint &a, const AffinePoint &b) const =0

virtual AffinePoint	point_negate (const AffinePoint &pt) const =0

virtual AffinePoint	point_to_affine (const ProjectivePoint &pt) const =0

virtual Scalar	random_scalar (RandomNumberGenerator &rng) const =0

virtual Scalar	scalar_add (const Scalar &a, const Scalar &b) const =0
	Scalar addition.

virtual size_t	scalar_bytes () const =0
	Return the byte length of the scalar element.

virtual bool	scalar_equal (const Scalar &a, const Scalar &b) const =0
	Test if two scalars are equal.

virtual std::optional< Scalar >	scalar_from_wide_bytes (std::span< const uint8_t > bytes) const =0

virtual Scalar	scalar_invert (const Scalar &s) const =0
	Scalar inversion.

virtual Scalar	scalar_invert_vartime (const Scalar &s) const =0
	Scalar inversion (variable time)

virtual bool	scalar_is_zero (const Scalar &s) const =0
	Test if scalar is zero.

virtual Scalar	scalar_mul (const Scalar &a, const Scalar &b) const =0
	Scalar multiplication.

virtual Scalar	scalar_negate (const Scalar &s) const =0
	Scalar negation.

virtual Scalar	scalar_one () const =0

virtual Scalar	scalar_square (const Scalar &s) const =0
	Scalar squaring.

virtual Scalar	scalar_sub (const Scalar &a, const Scalar &b) const =0
	Scalar subtraction.

virtual void	serialize_point (std::span< uint8_t > bytes, const AffinePoint &pt) const =0

virtual void	serialize_scalar (std::span< uint8_t > bytes, const Scalar &scalar) const =0

virtual	~PrimeOrderCurve ()=default

Static Public Member Functions
static std::shared_ptr< const PrimeOrderCurve >	for_named_curve (std::string_view name)

static std::shared_ptr< const PrimeOrderCurve >	from_params (const BigInt &p, const BigInt &a, const BigInt &b, const BigInt &base_x, const BigInt &base_y, const BigInt &order)

Static Public Attributes
static constexpr size_t	MaximumBitLength = 521

static constexpr size_t	MaximumByteLength = (MaximumBitLength + 7) / 8

static constexpr size_t	StorageWords = (MaximumByteLength + sizeof(word) - 1) / sizeof(word)
	Number of words used to store MaximumByteLength.

Detailed Description

An elliptic curve without cofactor in Weierstrass form

Definition at line 32 of file pcurves.h.

Member Typedef Documentation

◆ CurvePtr

typedef std::shared_ptr<const PrimeOrderCurve> Botan::PCurve::PrimeOrderCurve::CurvePtr

Definition at line 60 of file pcurves.h.

◆ StorageUnit

typedef std::array<word, StorageWords> Botan::PCurve::PrimeOrderCurve::StorageUnit

Definition at line 59 of file pcurves.h.

Constructor & Destructor Documentation

◆ ~PrimeOrderCurve()

virtual Botan::PCurve::PrimeOrderCurve::~PrimeOrderCurve ( )

virtualdefault

Member Function Documentation

◆ affine_point_is_identity()

virtual bool Botan::PCurve::PrimeOrderCurve::affine_point_is_identity ( const AffinePoint & pt ) const

pure virtual

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ base_point_mul_x_mod_order()

virtual Scalar Botan::PCurve::PrimeOrderCurve::base_point_mul_x_mod_order	(	const Scalar &	scalar,
		RandomNumberGenerator &	rng ) const

pure virtual

Base point multiplication, returning only the x coordinate modulo the group order

Multiply by the standard generator point g, then extract the x coordinate as an integer, then reduce the x coordinate modulo the group order

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ deserialize_point()

virtual std::optional< AffinePoint > Botan::PCurve::PrimeOrderCurve::deserialize_point ( std::span< const uint8_t > bytes ) const

pure virtual

Deserialize a point

Both compressed and uncompressed encodings are accepted

Note that the deprecated "hybrid" encoding is not supported here

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ deserialize_scalar()

virtual std::optional< Scalar > Botan::PCurve::PrimeOrderCurve::deserialize_scalar ( std::span< const uint8_t > bytes ) const

pure virtual

Deserialize a scalar in [1,p)

This function requires the input length be exactly scalar_bytes long; it does not accept inputs that are shorter, or with excess leading zero padding bytes.

This function also rejects zero as an input, since in normal usage scalars are integers in Z_p*

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ field_element_bytes()

virtual size_t Botan::PCurve::PrimeOrderCurve::field_element_bytes ( ) const

pure virtual

Return the byte length of a field element

Each point consists of two field elements

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ for_named_curve()

std::shared_ptr< const PrimeOrderCurve > Botan::PCurve::PrimeOrderCurve::for_named_curve ( std::string_view name )

static

Returns: nullptr if the curve specified is not available

Definition at line 26 of file pcurves.cpp.

                                                                                         {
#if defined(BOTAN_HAS_PCURVES_SECP192R1)
   if(name == "secp192r1") {
      return PCurveInstance::secp192r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_SECP224R1)
   if(name == "secp224r1") {
      return PCurveInstance::secp224r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_SECP256R1)
   if(name == "secp256r1") {
      return PCurveInstance::secp256r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_SECP384R1)
   if(name == "secp384r1") {
      return PCurveInstance::secp384r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_SECP521R1)
   if(name == "secp521r1") {
      return PCurveInstance::secp521r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_SECP256K1)
   if(name == "secp256k1") {
      return PCurveInstance::secp256k1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_BRAINPOOL256R1)
   if(name == "brainpool256r1") {
      return PCurveInstance::brainpool256r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_BRAINPOOL384R1)
   if(name == "brainpool384r1") {
      return PCurveInstance::brainpool384r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_BRAINPOOL512R1)
   if(name == "brainpool512r1") {
      return PCurveInstance::brainpool512r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_FRP256V1)
   if(name == "frp256v1") {
      return PCurveInstance::frp256v1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_SM2P256V1)
   if(name == "sm2p256v1") {
      return PCurveInstance::sm2p256v1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_NUMSP512D1)
   if(name == "numsp512d1") {
      return PCurveInstance::numsp512d1();
   }
#endif
 
   BOTAN_UNUSED(name);
   return {};
}

References BOTAN_UNUSED.

◆ from_params()

std::shared_ptr< const PrimeOrderCurve > Botan::PCurve::PrimeOrderCurve::from_params	(	const BigInt &	p,
		const BigInt &	a,
		const BigInt &	b,
		const BigInt &	base_x,
		const BigInt &	base_y,
		const BigInt &	order )

static

Returns: nullptr if the parameters seem unsuitable for pcurves for example if the prime is too large

This function should accept the same subset of curves as the EC_Group constructor that accepts BigInts.

Definition at line 15 of file pcurves.cpp.

                                                                                                                       {
#if defined(BOTAN_HAS_PCURVES_GENERIC)
   return PCurveInstance::from_params(p, a, b, base_x, base_y, order);
#endif
 
   BOTAN_UNUSED(p, a, b, base_x, base_y, order);
   return {};
}

References BOTAN_UNUSED.

◆ generator()

virtual AffinePoint Botan::PCurve::PrimeOrderCurve::generator ( ) const

pure virtual

Return the standard generator.

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ hash_to_curve_nu()

virtual AffinePoint Botan::PCurve::PrimeOrderCurve::hash_to_curve_nu ( std::function< void(std::span< uint8_t >)> expand_message ) const

pure virtual

RFC 9380 hash to curve (NU variant)

This is currently only supported for a few specific curves

Parameters

expand_message is a callback which must fill the provided output span with a sequence of uniform bytes, or if this is not possible due to length limitations or some other issue, throw an exception. It is invoked to produce the uniform_bytes value; see RFC 9380 section 5.2

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ hash_to_curve_ro()

virtual ProjectivePoint Botan::PCurve::PrimeOrderCurve::hash_to_curve_ro ( std::function< void(std::span< uint8_t >)> expand_message ) const

pure virtual

RFC 9380 hash to curve (RO variant)

This is currently only supported for a few specific curves

Parameters

expand_message is a callback which must fill the provided output span with a sequence of uniform bytes, or if this is not possible due to length limitations or some other issue, throw an exception. It is invoked to produce the uniform_bytes value; see RFC 9380 section 5.2

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ mul()

virtual ProjectivePoint Botan::PCurve::PrimeOrderCurve::mul	(	const AffinePoint &	pt,
		const Scalar &	scalar,
		RandomNumberGenerator &	rng ) const

pure virtual

Generic point multiplication

Multiply an arbitrary point by a scalar

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ mul2_setup_g()

virtual std::unique_ptr< const PrecomputedMul2Table > Botan::PCurve::PrimeOrderCurve::mul2_setup_g ( const AffinePoint & q ) const

pure virtual

Setup a table for 2-ary multiplication where the first point is the generator.

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ mul2_vartime()

virtual std::optional< ProjectivePoint > Botan::PCurve::PrimeOrderCurve::mul2_vartime	(	const PrecomputedMul2Table &	table,
		const Scalar &	x,
		const Scalar &	y ) const

pure virtual

Perform 2-ary multiplication (variable time)

Compute p*x + q*y in variable time

Returns nullopt if the produced point is the point at infinity

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ mul2_vartime_x_mod_order_eq()

virtual bool Botan::PCurve::PrimeOrderCurve::mul2_vartime_x_mod_order_eq	(	const PrecomputedMul2Table &	table,
		const Scalar &	v,
		const Scalar &	x,
		const Scalar &	y ) const

pure virtual

Perform 2-ary multiplication (variable time), reducing x modulo order

Compute p*x + q*y in variable time, then extract the x coordinate of the result, and reduce x modulo the group order. Compare that value with v. If equal, returns true. Otherwise returns false, including if the produced point is the point at infinity

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ mul_by_g()

virtual ProjectivePoint Botan::PCurve::PrimeOrderCurve::mul_by_g	(	const Scalar &	scalar,
		RandomNumberGenerator &	rng ) const

pure virtual

Base point multiplication

Multiply by the standard generator point g

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ mul_px_qy()

virtual std::optional< ProjectivePoint > Botan::PCurve::PrimeOrderCurve::mul_px_qy	(	const AffinePoint &	p,
		const Scalar &	x,
		const AffinePoint &	q,
		const Scalar &	y,
		RandomNumberGenerator &	rng ) const

pure virtual

Perform 2-ary multiplication (constant time)

Compute p*x + q*y

Returns nullopt if the produced point is the point at infinity

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ mul_x_only()

virtual secure_vector< uint8_t > Botan::PCurve::PrimeOrderCurve::mul_x_only	(	const AffinePoint &	pt,
		const Scalar &	scalar,
		RandomNumberGenerator &	rng ) const

pure virtual

Generic x-only point multiplication

Multiply an arbitrary point by a scalar, returning only the x coordinate

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ order_bits()

virtual size_t Botan::PCurve::PrimeOrderCurve::order_bits ( ) const

pure virtual

Return the bit length of the group order.

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ point_add()

virtual ProjectivePoint Botan::PCurve::PrimeOrderCurve::point_add	(	const AffinePoint &	a,
		const AffinePoint &	b ) const

pure virtual

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ point_negate()

virtual AffinePoint Botan::PCurve::PrimeOrderCurve::point_negate ( const AffinePoint & pt ) const

pure virtual

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ point_to_affine()

virtual AffinePoint Botan::PCurve::PrimeOrderCurve::point_to_affine ( const ProjectivePoint & pt ) const

pure virtual

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ random_scalar()

virtual Scalar Botan::PCurve::PrimeOrderCurve::random_scalar ( RandomNumberGenerator & rng ) const

pure virtual

Return a new random scalar

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ scalar_add()

virtual Scalar Botan::PCurve::PrimeOrderCurve::scalar_add	(	const Scalar &	a,
		const Scalar &	b ) const

pure virtual

Scalar addition.

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ scalar_bytes()

virtual size_t Botan::PCurve::PrimeOrderCurve::scalar_bytes ( ) const

pure virtual

Return the byte length of the scalar element.

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ scalar_equal()

virtual bool Botan::PCurve::PrimeOrderCurve::scalar_equal	(	const Scalar &	a,
		const Scalar &	b ) const

pure virtual

Test if two scalars are equal.

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ scalar_from_wide_bytes()

virtual std::optional< Scalar > Botan::PCurve::PrimeOrderCurve::scalar_from_wide_bytes ( std::span< const uint8_t > bytes ) const

pure virtual

Reduce an integer modulo the group order

The input can be at most twice the bit length of the order; if larger than this nullopt is returned

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ scalar_invert()

virtual Scalar Botan::PCurve::PrimeOrderCurve::scalar_invert ( const Scalar & s ) const

pure virtual

Scalar inversion.

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ scalar_invert_vartime()

virtual Scalar Botan::PCurve::PrimeOrderCurve::scalar_invert_vartime ( const Scalar & s ) const

pure virtual

Scalar inversion (variable time)

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ scalar_is_zero()

virtual bool Botan::PCurve::PrimeOrderCurve::scalar_is_zero ( const Scalar & s ) const

pure virtual

Test if scalar is zero.

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ scalar_mul()

virtual Scalar Botan::PCurve::PrimeOrderCurve::scalar_mul	(	const Scalar &	a,
		const Scalar &	b ) const

pure virtual

Scalar multiplication.

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ scalar_negate()

virtual Scalar Botan::PCurve::PrimeOrderCurve::scalar_negate ( const Scalar & s ) const

pure virtual

Scalar negation.

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ scalar_one()

virtual Scalar Botan::PCurve::PrimeOrderCurve::scalar_one ( ) const

pure virtual

Return the scalar one

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ scalar_square()

virtual Scalar Botan::PCurve::PrimeOrderCurve::scalar_square ( const Scalar & s ) const

pure virtual

Scalar squaring.

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ scalar_sub()

virtual Scalar Botan::PCurve::PrimeOrderCurve::scalar_sub	(	const Scalar &	a,
		const Scalar &	b ) const

pure virtual

Scalar subtraction.

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ serialize_point()

virtual void Botan::PCurve::PrimeOrderCurve::serialize_point	(	std::span< uint8_t >	bytes,
		const AffinePoint &	pt ) const

pure virtual

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

◆ serialize_scalar()

virtual void Botan::PCurve::PrimeOrderCurve::serialize_scalar	(	std::span< uint8_t >	bytes,
		const Scalar &	scalar ) const

pure virtual

Implemented in Botan::PCurve::GenericPrimeOrderCurve, and Botan::PCurve::PrimeOrderCurveImpl< C >.

Member Data Documentation

◆ MaximumBitLength

size_t Botan::PCurve::PrimeOrderCurve::MaximumBitLength = 521

staticconstexpr

Somewhat arbitrary maximum size for a field or scalar

Sized to fit at least P-521

Definition at line 37 of file pcurves.h.

◆ MaximumByteLength

size_t Botan::PCurve::PrimeOrderCurve::MaximumByteLength = (MaximumBitLength + 7) / 8

staticconstexpr

Definition at line 39 of file pcurves.h.

◆ StorageWords

size_t Botan::PCurve::PrimeOrderCurve::StorageWords = (MaximumByteLength + sizeof(word) - 1) / sizeof(word)

staticconstexpr

Number of words used to store MaximumByteLength.

Definition at line 42 of file pcurves.h.

The documentation for this class was generated from the following files:

src/lib/math/pcurves/pcurves.h
src/lib/math/pcurves/pcurves.cpp

Classes

Public Types

Public Member Functions

Static Public Member Functions

Static Public Attributes

Detailed Description

Member Typedef Documentation

◆ CurvePtr

◆ StorageUnit

Constructor & Destructor Documentation

◆ ~PrimeOrderCurve()

Member Function Documentation

◆ affine_point_is_identity()

◆ base_point_mul_x_mod_order()

◆ deserialize_point()

◆ deserialize_scalar()

◆ field_element_bytes()

◆ for_named_curve()

◆ from_params()

◆ generator()

◆ hash_to_curve_nu()

◆ hash_to_curve_ro()

◆ mul()

◆ mul2_setup_g()

◆ mul2_vartime()

◆ mul2_vartime_x_mod_order_eq()

◆ mul_by_g()

◆ mul_px_qy()

◆ mul_x_only()

◆ order_bits()

◆ point_add()

◆ point_negate()

◆ point_to_affine()

◆ random_scalar()

◆ scalar_add()

◆ scalar_bytes()

◆ scalar_equal()

◆ scalar_from_wide_bytes()

◆ scalar_invert()

◆ scalar_invert_vartime()

◆ scalar_is_zero()

◆ scalar_mul()

◆ scalar_negate()

◆ scalar_one()

◆ scalar_square()

◆ scalar_sub()

◆ serialize_point()

◆ serialize_scalar()

Member Data Documentation

◆ MaximumBitLength

◆ MaximumByteLength

◆ StorageWords