Botan 3.7.1
Crypto and TLS for C&
Botan::PCurve::PrimeOrderCurveImpl< C > Class Template Referencefinal

#include <pcurves_wrap.h>

Inheritance diagram for Botan::PCurve::PrimeOrderCurveImpl< C >:
Botan::PCurve::PrimeOrderCurve

Classes

class  PrecomputedMul2TableC
 

Public Types

typedef std::shared_ptr< const PrimeOrderCurveCurvePtr
 
typedef std::array< word, StorageWordsStorageUnit
 

Public Member Functions

bool affine_point_is_identity (const AffinePoint &pt) const override
 
Scalar base_point_mul_x_mod_order (const Scalar &scalar, RandomNumberGenerator &rng) const override
 
std::optional< AffinePointdeserialize_point (std::span< const uint8_t > bytes) const override
 
std::optional< Scalardeserialize_scalar (std::span< const uint8_t > bytes) const override
 
size_t field_element_bytes () const override
 
AffinePoint generator () const override
 Return the standard generator.
 
AffinePoint hash_to_curve_nu (std::string_view hash, std::span< const uint8_t > input, std::span< const uint8_t > domain_sep) const override
 
ProjectivePoint hash_to_curve_ro (std::string_view hash, std::span< const uint8_t > input, std::span< const uint8_t > domain_sep) const override
 
ProjectivePoint mul (const AffinePoint &pt, const Scalar &scalar, RandomNumberGenerator &rng) const override
 
std::unique_ptr< const PrecomputedMul2Tablemul2_setup (const AffinePoint &p, const AffinePoint &q) const override
 Setup a table for 2-ary multiplication.
 
std::unique_ptr< const PrecomputedMul2Tablemul2_setup_g (const AffinePoint &q) const override
 Setup a table for 2-ary multiplication where the first point is the generator.
 
std::optional< ProjectivePointmul2_vartime (const PrecomputedMul2Table &tableb, const Scalar &x, const Scalar &y) const override
 
bool mul2_vartime_x_mod_order_eq (const PrecomputedMul2Table &tableb, const Scalar &v, const Scalar &x, const Scalar &y) const override
 
ProjectivePoint mul_by_g (const Scalar &scalar, RandomNumberGenerator &rng) const override
 
std::optional< ProjectivePointmul_px_qy (const AffinePoint &p, const Scalar &x, const AffinePoint &q, const Scalar &y, RandomNumberGenerator &rng) const override
 
secure_vector< uint8_t > mul_x_only (const AffinePoint &pt, const Scalar &scalar, RandomNumberGenerator &rng) const override
 
size_t order_bits () const override
 Return the bit length of the group order.
 
ProjectivePoint point_add (const ProjectivePoint &a, const ProjectivePoint &b) const override
 
ProjectivePoint point_add_mixed (const ProjectivePoint &a, const AffinePoint &b) const override
 
ProjectivePoint point_double (const ProjectivePoint &pt) const override
 
AffinePoint point_negate (const AffinePoint &pt) const override
 
AffinePoint point_to_affine (const ProjectivePoint &pt) const override
 
ProjectivePoint point_to_projective (const AffinePoint &pt) const override
 
 PrimeOrderCurveImpl ()
 
Scalar random_scalar (RandomNumberGenerator &rng) const override
 
Scalar scalar_add (const Scalar &a, const Scalar &b) const override
 
size_t scalar_bytes () const override
 Return the byte length of the scalar element.
 
bool scalar_equal (const Scalar &a, const Scalar &b) const override
 
std::optional< Scalarscalar_from_wide_bytes (std::span< const uint8_t > bytes) const override
 
Scalar scalar_invert (const Scalar &ss) const override
 
Scalar scalar_invert_vartime (const Scalar &ss) const override
 
bool scalar_is_zero (const Scalar &s) const override
 
Scalar scalar_mul (const Scalar &a, const Scalar &b) const override
 
Scalar scalar_negate (const Scalar &s) const override
 
Scalar scalar_one () const override
 
Scalar scalar_square (const Scalar &s) const override
 
Scalar scalar_sub (const Scalar &a, const Scalar &b) const override
 
Scalar scalar_zero () const override
 
void serialize_point (std::span< uint8_t > bytes, const AffinePoint &pt) const override
 
void serialize_point_compressed (std::span< uint8_t > bytes, const AffinePoint &pt) const override
 
void serialize_point_x (std::span< uint8_t > bytes, const AffinePoint &pt) const override
 
void serialize_scalar (std::span< uint8_t > bytes, const Scalar &scalar) const override
 

Static Public Member Functions

static std::shared_ptr< const PrimeOrderCurvefrom_id (PrimeOrderCurveId id)
 
static std::shared_ptr< const PrimeOrderCurvefrom_name (std::string_view name)
 
static std::shared_ptr< const PrimeOrderCurveinstance ()
 

Static Public Attributes

static constexpr size_t BasePointWindowBits = 5
 
static const size_t MaximumBitLength = 521
 
static const size_t MaximumByteLength = (MaximumBitLength + 7) / 8
 
static constexpr size_t Mul2PrecompWindowBits = 3
 
static constexpr size_t Mul2WindowBits = 2
 
static const size_t StorageWords = (MaximumByteLength + sizeof(word) - 1) / sizeof(word)
 Number of words used to store MaximumByteLength.
 
static constexpr size_t VarPointWindowBits = 4
 

Detailed Description

template<typename C>
class Botan::PCurve::PrimeOrderCurveImpl< C >

This class provides a bridge between the "public" (actually still internal) PrimeOrderCurve type, and the inner templates which are subclasses of EllipticCurve from pcurves_impl.h

Definition at line 26 of file pcurves_wrap.h.

Member Typedef Documentation

◆ CurvePtr

Definition at line 55 of file pcurves.h.

◆ StorageUnit

Definition at line 54 of file pcurves.h.

Constructor & Destructor Documentation

◆ PrimeOrderCurveImpl()

template<typename C >
Botan::PCurve::PrimeOrderCurveImpl< C >::PrimeOrderCurveImpl ( )
inline

Definition at line 336 of file pcurves_wrap.h.

336: m_mul_by_g(C::G) {}

Member Function Documentation

◆ affine_point_is_identity()

template<typename C >
bool Botan::PCurve::PrimeOrderCurveImpl< C >::affine_point_is_identity ( const AffinePoint & pt) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 218 of file pcurves_wrap.h.

218 {
219 return from_stash(pt).is_identity().as_bool();
220 }

◆ base_point_mul_x_mod_order()

template<typename C >
Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::base_point_mul_x_mod_order ( const Scalar & scalar,
RandomNumberGenerator & rng ) const
inlineoverridevirtual

Base point multiplication, returning only the x coordinate modulo the group order

Multiply by the standard generator point g, then extract the x coordinate as an integer, then reduce the x coordinate modulo the group order

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 188 of file pcurves_wrap.h.

188 {
189 auto pt = m_mul_by_g.mul(from_stash(scalar), rng);
190 std::array<uint8_t, C::FieldElement::BYTES> x_bytes;
191 to_affine_x<C>(pt).serialize_to(std::span{x_bytes});
192 // Reduction might be required (if unlikely)
193 return stash(C::Scalar::from_wide_bytes(std::span<const uint8_t, C::FieldElement::BYTES>{x_bytes}));
194 }

◆ deserialize_point()

template<typename C >
std::optional< AffinePoint > Botan::PCurve::PrimeOrderCurveImpl< C >::deserialize_point ( std::span< const uint8_t > bytes) const
inlineoverridevirtual

Deserialize a point

Both compressed and uncompressed encodings are accepted

Note that the deprecated "hybrid" encoding is not supported here

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 261 of file pcurves_wrap.h.

261 {
262 if(auto pt = C::AffinePoint::deserialize(bytes)) {
263 return stash(*pt);
264 } else {
265 return {};
266 }
267 }

◆ deserialize_scalar()

template<typename C >
std::optional< Scalar > Botan::PCurve::PrimeOrderCurveImpl< C >::deserialize_scalar ( std::span< const uint8_t > bytes) const
inlineoverridevirtual

Deserialize a scalar in [1,p)

This function requires the input length be exactly scalar_bytes long; it does not accept inputs that are shorter, or with excess leading zero padding bytes.

This function also rejects zero as an input, since in normal usage scalars are integers in Z_p*

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 243 of file pcurves_wrap.h.

243 {
244 if(auto scalar = C::Scalar::deserialize(bytes)) {
245 if(!scalar->is_zero().as_bool()) {
246 return stash(*scalar);
247 }
248 }
249
250 return {};
251 }

◆ field_element_bytes()

template<typename C >
size_t Botan::PCurve::PrimeOrderCurveImpl< C >::field_element_bytes ( ) const
inlineoverridevirtual

Return the byte length of a field element

Each point consists of two field elements

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 40 of file pcurves_wrap.h.

40{ return C::FieldElement::BYTES; }

◆ from_id()

std::shared_ptr< const PrimeOrderCurve > Botan::PCurve::PrimeOrderCurve::from_id ( PrimeOrderCurveId id)
staticinherited

Definition at line 101 of file pcurves.cpp.

101 {
102 switch(id.code()) {
127 }
128 return {};
129}
static std::shared_ptr< const PrimeOrderCurve > secp521r1()
Definition pcurves.cpp:47
static std::shared_ptr< const PrimeOrderCurve > numsp512d1()
Definition pcurves.cpp:96
static std::shared_ptr< const PrimeOrderCurve > secp256k1()
Definition pcurves.cpp:54
static std::shared_ptr< const PrimeOrderCurve > secp192r1()
Definition pcurves.cpp:19
static std::shared_ptr< const PrimeOrderCurve > secp384r1()
Definition pcurves.cpp:40
static std::shared_ptr< const PrimeOrderCurve > brainpool384r1()
Definition pcurves.cpp:68
static std::shared_ptr< const PrimeOrderCurve > brainpool512r1()
Definition pcurves.cpp:75
static std::shared_ptr< const PrimeOrderCurve > secp224r1()
Definition pcurves.cpp:26
static std::shared_ptr< const PrimeOrderCurve > frp256v1()
Definition pcurves.cpp:82
static std::shared_ptr< const PrimeOrderCurve > brainpool256r1()
Definition pcurves.cpp:61
static std::shared_ptr< const PrimeOrderCurve > sm2p256v1()
Definition pcurves.cpp:89
static std::shared_ptr< const PrimeOrderCurve > secp256r1()
Definition pcurves.cpp:33

References Botan::PCurve::PCurveInstance::brainpool256r1(), Botan::PCurve::PrimeOrderCurveId::brainpool256r1, Botan::PCurve::PCurveInstance::brainpool384r1(), Botan::PCurve::PrimeOrderCurveId::brainpool384r1, Botan::PCurve::PCurveInstance::brainpool512r1(), Botan::PCurve::PrimeOrderCurveId::brainpool512r1, Botan::PCurve::PCurveInstance::frp256v1(), Botan::PCurve::PrimeOrderCurveId::frp256v1, Botan::PCurve::PCurveInstance::numsp512d1(), Botan::PCurve::PrimeOrderCurveId::numsp512d1, Botan::PCurve::PCurveInstance::secp192r1(), Botan::PCurve::PrimeOrderCurveId::secp192r1, Botan::PCurve::PCurveInstance::secp224r1(), Botan::PCurve::PrimeOrderCurveId::secp224r1, Botan::PCurve::PCurveInstance::secp256k1(), Botan::PCurve::PrimeOrderCurveId::secp256k1, Botan::PCurve::PCurveInstance::secp256r1(), Botan::PCurve::PrimeOrderCurveId::secp256r1, Botan::PCurve::PCurveInstance::secp384r1(), Botan::PCurve::PrimeOrderCurveId::secp384r1, Botan::PCurve::PCurveInstance::secp521r1(), Botan::PCurve::PrimeOrderCurveId::secp521r1, Botan::PCurve::PCurveInstance::sm2p256v1(), and Botan::PCurve::PrimeOrderCurveId::sm2p256v1.

Referenced by Botan::PCurve::PrimeOrderCurve::from_name().

◆ from_name()

static std::shared_ptr< const PrimeOrderCurve > Botan::PCurve::PrimeOrderCurve::from_name ( std::string_view name)
inlinestaticinherited

Definition at line 44 of file pcurves.h.

44 {
46 return PrimeOrderCurve::from_id(id.value());
47 } else {
48 return {};
49 }
50 }
static std::optional< PrimeOrderCurveId > from_string(std::string_view name)
Map a string to a curve identifier.
Definition pcurves.cpp:163
static std::shared_ptr< const PrimeOrderCurve > from_id(PrimeOrderCurveId id)
Definition pcurves.cpp:101
std::string name

References Botan::PCurve::PrimeOrderCurve::from_id(), Botan::PCurve::PrimeOrderCurveId::from_string(), and name.

◆ generator()

template<typename C >
AffinePoint Botan::PCurve::PrimeOrderCurveImpl< C >::generator ( ) const
inlineoverridevirtual

Return the standard generator.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 196 of file pcurves_wrap.h.

196{ return stash(C::G); }

◆ hash_to_curve_nu()

template<typename C >
AffinePoint Botan::PCurve::PrimeOrderCurveImpl< C >::hash_to_curve_nu ( std::string_view hash,
std::span< const uint8_t > input,
std::span< const uint8_t > domain_sep ) const
inlineoverridevirtual

RFC 9380 hash to curve (NU variant)

This is currently only supported for a few specific curves

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 269 of file pcurves_wrap.h.

271 {
272 if constexpr(C::ValidForSswuHash) {
273 return stash(hash_to_curve_sswu<C, false>(hash, input, domain_sep));
274 } else {
275 throw Not_Implemented("Hash to curve is not implemented for this curve");
276 }
277 }

◆ hash_to_curve_ro()

template<typename C >
ProjectivePoint Botan::PCurve::PrimeOrderCurveImpl< C >::hash_to_curve_ro ( std::string_view hash,
std::span< const uint8_t > input,
std::span< const uint8_t > domain_sep ) const
inlineoverridevirtual

RFC 9380 hash to curve (RO variant)

This is currently only supported for a few specific curves

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 279 of file pcurves_wrap.h.

281 {
282 if constexpr(C::ValidForSswuHash) {
283 return stash(hash_to_curve_sswu<C, true>(hash, input, domain_sep));
284 } else {
285 throw Not_Implemented("Hash to curve is not implemented for this curve");
286 }
287 }

◆ instance()

template<typename C >
static std::shared_ptr< const PrimeOrderCurve > Botan::PCurve::PrimeOrderCurveImpl< C >::instance ( )
inlinestatic

Definition at line 338 of file pcurves_wrap.h.

338 {
339 static auto g_curve = std::make_shared<const PrimeOrderCurveImpl<C>>();
340 return g_curve;
341 }

◆ mul()

template<typename C >
ProjectivePoint Botan::PCurve::PrimeOrderCurveImpl< C >::mul ( const AffinePoint & pt,
const Scalar & scalar,
RandomNumberGenerator & rng ) const
inlineoverridevirtual

Generic point multiplication

Multiply an arbitrary point by a scalar

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 46 of file pcurves_wrap.h.

46 {
47 auto tbl = WindowedMulTable<C, VarPointWindowBits>(from_stash(pt));
48 return stash(tbl.mul(from_stash(scalar), rng));
49 }

◆ mul2_setup()

template<typename C >
std::unique_ptr< const PrecomputedMul2Table > Botan::PCurve::PrimeOrderCurveImpl< C >::mul2_setup ( const AffinePoint & p,
const AffinePoint & pq ) const
inlineoverridevirtual

Setup a table for 2-ary multiplication.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 72 of file pcurves_wrap.h.

73 {
74 return std::make_unique<PrecomputedMul2TableC>(from_stash(p), from_stash(q));
75 }

◆ mul2_setup_g()

template<typename C >
std::unique_ptr< const PrecomputedMul2Table > Botan::PCurve::PrimeOrderCurveImpl< C >::mul2_setup_g ( const AffinePoint & q) const
inlineoverridevirtual

Setup a table for 2-ary multiplication where the first point is the generator.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 77 of file pcurves_wrap.h.

77 {
78 return std::make_unique<PrecomputedMul2TableC>(C::G, from_stash(q));
79 }

◆ mul2_vartime()

template<typename C >
std::optional< ProjectivePoint > Botan::PCurve::PrimeOrderCurveImpl< C >::mul2_vartime ( const PrecomputedMul2Table & table,
const Scalar & x,
const Scalar & y ) const
inlineoverridevirtual

Perform 2-ary multiplication (variable time)

Compute p*x + q*y in variable time

Returns nullopt if the produced point is the point at infinity

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 81 of file pcurves_wrap.h.

83 {
84 try {
85 const auto& table = dynamic_cast<const PrecomputedMul2TableC&>(tableb);
86 auto pt = table.table().mul2_vartime(from_stash(x), from_stash(y));
87 if(pt.is_identity().as_bool()) {
88 return {};
89 } else {
90 return stash(pt);
91 }
92 } catch(std::bad_cast&) {
93 throw Invalid_Argument("Curve mismatch");
94 }
95 }

References Botan::PCurve::PrimeOrderCurveImpl< C >::PrecomputedMul2TableC::table().

◆ mul2_vartime_x_mod_order_eq()

template<typename C >
bool Botan::PCurve::PrimeOrderCurveImpl< C >::mul2_vartime_x_mod_order_eq ( const PrecomputedMul2Table & table,
const Scalar & v,
const Scalar & x,
const Scalar & y ) const
inlineoverridevirtual

Perform 2-ary multiplication (variable time), reducing x modulo order

Compute p*x + q*y in variable time, then extract the x coordinate of the result, and reduce x modulo the group order. Compare that value with v. If equal, returns true. Otherwise returns false, including if the produced point is the point at infinity

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 111 of file pcurves_wrap.h.

114 {
115 try {
116 const auto& table = dynamic_cast<const PrecomputedMul2TableC&>(tableb);
117 const auto pt = table.table().mul2_vartime(from_stash(x), from_stash(y));
118 // Variable time here, so the early return is fine
119 if(pt.is_identity().as_bool()) {
120 return false;
121 }
122
123 /*
124 * Avoid the inversion by instead projecting v.
125 *
126 * Given (x*z2) and v we want to know if x % n == v
127 *
128 * Inverting z2 to extract x is expensive. Instead compute (v*z2) and
129 * compare it with (x*z2).
130 *
131 * With overwhelming probability, this conversion is correct. The
132 * only time it is not is in the extremely unlikely case where the
133 * signer actually reduced the x coordinate modulo the group order.
134 * That is handled seperately in a second step.
135 */
136 const auto z2 = pt.z().square();
137
138 std::array<uint8_t, C::Scalar::BYTES> v_bytes;
139 from_stash(v).serialize_to(v_bytes);
140
141 if(const auto fe_v = C::FieldElement::deserialize(v_bytes)) {
142 if((*fe_v * z2 == pt.x()).as_bool()) {
143 return true;
144 }
145
146 /*
147 * Possibly (if cryptographically unlikely) the signer
148 * reduced the value modulo the group order.
149 *
150 * If so we must check v + n similarly as before. However here
151 * we must be careful to not overflow since otherwise that
152 * would lead to us accepting an incorrect signature.
153 *
154 * If the order is > p then the reduction modulo p would not have
155 * had any effect and we don't need to consider the possibility
156 */
157 if constexpr(C::OrderIsLessThanField) {
158 /*
159 * We have to be careful to avoid overflow since this would
160 * lead to a forgery
161 *
162 * v < (p)-n => v + n < p
163 *
164 * The values n and neg_n could be precomputed but they are
165 * fast to compute and this codepath will ~never be taken
166 * unless when verifying an invalid signature. In any case
167 * it is many times cheaper than performing the modular inversion
168 * which this approach avoids.
169 */
170
171 // Create the group order as a field element, safe because n < p
172 const auto n = C::FieldElement::from_words(C::NW);
173 const auto neg_n = n.negate().to_words();
174
175 const auto vw = fe_v->to_words();
176 if(bigint_ct_is_lt(vw.data(), vw.size(), neg_n.data(), neg_n.size()).as_bool()) {
177 return (((*fe_v + n) * z2) == pt.x()).as_bool();
178 }
179 }
180 }
181
182 return false;
183 } catch(std::bad_cast&) {
184 throw Invalid_Argument("Curve mismatch");
185 }
186 }
constexpr auto bigint_ct_is_lt(const W x[], size_t x_size, const W y[], size_t y_size, bool lt_or_equal=false) -> CT::Mask< W >
Definition mp_core.h:620

References Botan::bigint_ct_is_lt(), and Botan::PCurve::PrimeOrderCurveImpl< C >::PrecomputedMul2TableC::table().

◆ mul_by_g()

template<typename C >
ProjectivePoint Botan::PCurve::PrimeOrderCurveImpl< C >::mul_by_g ( const Scalar & scalar,
RandomNumberGenerator & rng ) const
inlineoverridevirtual

Base point multiplication

Multiply by the standard generator point g

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 42 of file pcurves_wrap.h.

42 {
43 return stash(m_mul_by_g.mul(from_stash(scalar), rng));
44 }

◆ mul_px_qy()

template<typename C >
std::optional< ProjectivePoint > Botan::PCurve::PrimeOrderCurveImpl< C >::mul_px_qy ( const AffinePoint & p,
const Scalar & x,
const AffinePoint & q,
const Scalar & y,
RandomNumberGenerator & rng ) const
inlineoverridevirtual

Perform 2-ary multiplication (constant time)

Compute p*x + q*y

Returns nullopt if the produced point is the point at infinity

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 97 of file pcurves_wrap.h.

101 {
102 WindowedMul2Table<C, Mul2WindowBits> tbl(from_stash(p), from_stash(q));
103 auto pt = tbl.mul2(from_stash(x), from_stash(y), rng);
104 if(pt.is_identity().as_bool()) {
105 return {};
106 } else {
107 return stash(pt);
108 }
109 }

◆ mul_x_only()

template<typename C >
secure_vector< uint8_t > Botan::PCurve::PrimeOrderCurveImpl< C >::mul_x_only ( const AffinePoint & pt,
const Scalar & scalar,
RandomNumberGenerator & rng ) const
inlineoverridevirtual

Generic x-only point multiplication

Multiply an arbitrary point by a scalar, returning only the x coordinate

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 51 of file pcurves_wrap.h.

53 {
54 auto tbl = WindowedMulTable<C, VarPointWindowBits>(from_stash(pt));
55 auto pt_x = to_affine_x<C>(tbl.mul(from_stash(scalar), rng));
56 secure_vector<uint8_t> x_bytes(C::FieldElement::BYTES);
57 pt_x.serialize_to(std::span<uint8_t, C::FieldElement::BYTES>{x_bytes});
58 return x_bytes;
59 }
std::vector< T, secure_allocator< T > > secure_vector
Definition secmem.h:61

◆ order_bits()

template<typename C >
size_t Botan::PCurve::PrimeOrderCurveImpl< C >::order_bits ( ) const
inlineoverridevirtual

Return the bit length of the group order.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 36 of file pcurves_wrap.h.

36{ return C::OrderBits; }

◆ point_add()

template<typename C >
ProjectivePoint Botan::PCurve::PrimeOrderCurveImpl< C >::point_add ( const ProjectivePoint & a,
const ProjectivePoint & b ) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 208 of file pcurves_wrap.h.

208 {
209 return stash(from_stash(a) + from_stash(b));
210 }
const SIMD_8x32 & b

References Botan::b.

◆ point_add_mixed()

template<typename C >
ProjectivePoint Botan::PCurve::PrimeOrderCurveImpl< C >::point_add_mixed ( const ProjectivePoint & a,
const AffinePoint & b ) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 212 of file pcurves_wrap.h.

212 {
213 return stash(from_stash(a) + from_stash(b));
214 }

References Botan::b.

◆ point_double()

template<typename C >
ProjectivePoint Botan::PCurve::PrimeOrderCurveImpl< C >::point_double ( const ProjectivePoint & pt) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 206 of file pcurves_wrap.h.

206{ return stash(from_stash(pt).dbl()); }

◆ point_negate()

template<typename C >
AffinePoint Botan::PCurve::PrimeOrderCurveImpl< C >::point_negate ( const AffinePoint & pt) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 216 of file pcurves_wrap.h.

216{ return stash(from_stash(pt).negate()); }

◆ point_to_affine()

template<typename C >
AffinePoint Botan::PCurve::PrimeOrderCurveImpl< C >::point_to_affine ( const ProjectivePoint & pt) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 198 of file pcurves_wrap.h.

198 {
199 return stash(to_affine<C>(from_stash(pt)));
200 }

◆ point_to_projective()

template<typename C >
ProjectivePoint Botan::PCurve::PrimeOrderCurveImpl< C >::point_to_projective ( const AffinePoint & pt) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 202 of file pcurves_wrap.h.

202 {
203 return stash(C::ProjectivePoint::from_affine(from_stash(pt)));
204 }

◆ random_scalar()

template<typename C >
Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::random_scalar ( RandomNumberGenerator & rng) const
inlineoverridevirtual

Return a new random scalar

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 334 of file pcurves_wrap.h.

334{ return stash(C::Scalar::random(rng)); }

◆ scalar_add()

template<typename C >
Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_add ( const Scalar & a,
const Scalar & b ) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 289 of file pcurves_wrap.h.

289 {
290 return stash(from_stash(a) + from_stash(b));
291 }

References Botan::b.

◆ scalar_bytes()

template<typename C >
size_t Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_bytes ( ) const
inlineoverridevirtual

Return the byte length of the scalar element.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 38 of file pcurves_wrap.h.

38{ return C::Scalar::BYTES; }

◆ scalar_equal()

template<typename C >
bool Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_equal ( const Scalar & a,
const Scalar & b ) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 326 of file pcurves_wrap.h.

326 {
327 return (from_stash(a) == from_stash(b)).as_bool();
328 }

References Botan::b.

◆ scalar_from_wide_bytes()

template<typename C >
std::optional< Scalar > Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_from_wide_bytes ( std::span< const uint8_t > bytes) const
inlineoverridevirtual

Reduce an integer modulo the group order

The input can be at most twice the bit length of the order; if larger than this nullopt is returned

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 253 of file pcurves_wrap.h.

253 {
254 if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) {
255 return stash(*s);
256 } else {
257 return {};
258 }
259 }

◆ scalar_invert()

template<typename C >
Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_invert ( const Scalar & ss) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 303 of file pcurves_wrap.h.

303 {
304 auto s = from_stash(ss);
305 if constexpr(curve_supports_scalar_invert<C>) {
306 return stash(C::scalar_invert(s));
307 } else {
308 return stash(s.invert());
309 }
310 }

◆ scalar_invert_vartime()

template<typename C >
Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_invert_vartime ( const Scalar & ss) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 312 of file pcurves_wrap.h.

312 {
313 auto s = from_stash(ss);
314 // TODO take advantage of variable time
315 if constexpr(curve_supports_scalar_invert<C>) {
316 return stash(C::scalar_invert(s));
317 } else {
318 return stash(s.invert());
319 }
320 }

◆ scalar_is_zero()

template<typename C >
bool Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_is_zero ( const Scalar & s) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 324 of file pcurves_wrap.h.

324{ return from_stash(s).is_zero().as_bool(); }

◆ scalar_mul()

template<typename C >
Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_mul ( const Scalar & a,
const Scalar & b ) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 297 of file pcurves_wrap.h.

297 {
298 return stash(from_stash(a) * from_stash(b));
299 }

References Botan::b.

◆ scalar_negate()

template<typename C >
Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_negate ( const Scalar & s) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 322 of file pcurves_wrap.h.

322{ return stash(from_stash(s).negate()); }

◆ scalar_one()

template<typename C >
Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_one ( ) const
inlineoverridevirtual

Return the scalar one

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 332 of file pcurves_wrap.h.

332{ return stash(C::Scalar::one()); }

◆ scalar_square()

template<typename C >
Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_square ( const Scalar & s) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 301 of file pcurves_wrap.h.

301{ return stash(from_stash(s).square()); }
BigInt square(const BigInt &x)
Definition numthry.cpp:157

References Botan::square().

◆ scalar_sub()

template<typename C >
Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_sub ( const Scalar & a,
const Scalar & b ) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 293 of file pcurves_wrap.h.

293 {
294 return stash(from_stash(a) - from_stash(b));
295 }

References Botan::b.

◆ scalar_zero()

template<typename C >
Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_zero ( ) const
inlineoverridevirtual

Return the scalar zero

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 330 of file pcurves_wrap.h.

330{ return stash(C::Scalar::zero()); }

◆ serialize_point()

template<typename C >
void Botan::PCurve::PrimeOrderCurveImpl< C >::serialize_point ( std::span< uint8_t > bytes,
const AffinePoint & pt ) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 222 of file pcurves_wrap.h.

222 {
223 BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point");
224 from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>());
225 }
#define BOTAN_ARG_CHECK(expr, msg)
Definition assert.h:29

References BOTAN_ARG_CHECK.

◆ serialize_point_compressed()

template<typename C >
void Botan::PCurve::PrimeOrderCurveImpl< C >::serialize_point_compressed ( std::span< uint8_t > bytes,
const AffinePoint & pt ) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 227 of file pcurves_wrap.h.

227 {
228 BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::COMPRESSED_BYTES,
229 "Invalid length for serialize_point_compressed");
230 from_stash(pt).serialize_compressed_to(bytes.subspan<0, C::AffinePoint::COMPRESSED_BYTES>());
231 }

References BOTAN_ARG_CHECK.

◆ serialize_point_x()

template<typename C >
void Botan::PCurve::PrimeOrderCurveImpl< C >::serialize_point_x ( std::span< uint8_t > bytes,
const AffinePoint & pt ) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 233 of file pcurves_wrap.h.

233 {
234 BOTAN_ARG_CHECK(bytes.size() == C::FieldElement::BYTES, "Invalid length for serialize_point_x");
235 from_stash(pt).serialize_x_to(bytes.subspan<0, C::FieldElement::BYTES>());
236 }

References BOTAN_ARG_CHECK.

◆ serialize_scalar()

template<typename C >
void Botan::PCurve::PrimeOrderCurveImpl< C >::serialize_scalar ( std::span< uint8_t > bytes,
const Scalar & scalar ) const
inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 238 of file pcurves_wrap.h.

238 {
239 BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar");
240 return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>());
241 }

References BOTAN_ARG_CHECK.

Member Data Documentation

◆ BasePointWindowBits

template<typename C >
size_t Botan::PCurve::PrimeOrderCurveImpl< C >::BasePointWindowBits = 5
staticconstexpr

Definition at line 28 of file pcurves_wrap.h.

◆ MaximumBitLength

const size_t Botan::PCurve::PrimeOrderCurve::MaximumBitLength = 521
staticinherited

Somewhat arbitrary maximum size for a field or scalar

Sized to fit at least P-521

Definition at line 37 of file pcurves.h.

◆ MaximumByteLength

const size_t Botan::PCurve::PrimeOrderCurve::MaximumByteLength = (MaximumBitLength + 7) / 8
staticinherited

Definition at line 39 of file pcurves.h.

◆ Mul2PrecompWindowBits

template<typename C >
size_t Botan::PCurve::PrimeOrderCurveImpl< C >::Mul2PrecompWindowBits = 3
staticconstexpr

Definition at line 30 of file pcurves_wrap.h.

◆ Mul2WindowBits

template<typename C >
size_t Botan::PCurve::PrimeOrderCurveImpl< C >::Mul2WindowBits = 2
staticconstexpr

Definition at line 31 of file pcurves_wrap.h.

◆ StorageWords

const size_t Botan::PCurve::PrimeOrderCurve::StorageWords = (MaximumByteLength + sizeof(word) - 1) / sizeof(word)
staticinherited

Number of words used to store MaximumByteLength.

Definition at line 42 of file pcurves.h.

◆ VarPointWindowBits

template<typename C >
size_t Botan::PCurve::PrimeOrderCurveImpl< C >::VarPointWindowBits = 4
staticconstexpr

Definition at line 29 of file pcurves_wrap.h.


The documentation for this class was generated from the following file: