#include <pcurves_wrap.h>

Inheritance diagram for Botan::PCurve::PrimeOrderCurveImpl< C >:

Classes
class	PrecomputedMul2TableC

Public Types
typedef std::shared_ptr< const PrimeOrderCurve >	CurvePtr

typedef std::array< word, StorageWords >	StorageUnit

Public Member Functions
bool	affine_point_is_identity (const AffinePoint &pt) const override

Scalar	base_point_mul_x_mod_order (const Scalar &scalar, RandomNumberGenerator &rng) const override

std::optional< AffinePoint >	deserialize_point (std::span< const uint8_t > bytes) const override

std::optional< Scalar >	deserialize_scalar (std::span< const uint8_t > bytes) const override

size_t	field_element_bytes () const override

AffinePoint	generator () const override
	Return the standard generator.

AffinePoint	hash_to_curve_nu (std::function< void(std::span< uint8_t >)> expand_message) const override

ProjectivePoint	hash_to_curve_ro (std::function< void(std::span< uint8_t >)> expand_message) const override

ProjectivePoint	mul (const AffinePoint &pt, const Scalar &scalar, RandomNumberGenerator &rng) const override

std::unique_ptr< const PrecomputedMul2Table >	mul2_setup_g (const AffinePoint &q) const override
	Setup a table for 2-ary multiplication where the first point is the generator.

std::optional< ProjectivePoint >	mul2_vartime (const PrecomputedMul2Table &tableb, const Scalar &x, const Scalar &y) const override

bool	mul2_vartime_x_mod_order_eq (const PrecomputedMul2Table &tableb, const Scalar &v, const Scalar &x, const Scalar &y) const override

ProjectivePoint	mul_by_g (const Scalar &scalar, RandomNumberGenerator &rng) const override

std::optional< ProjectivePoint >	mul_px_qy (const AffinePoint &p, const Scalar &x, const AffinePoint &q, const Scalar &y, RandomNumberGenerator &rng) const override

secure_vector< uint8_t >	mul_x_only (const AffinePoint &pt, const Scalar &scalar, RandomNumberGenerator &rng) const override

size_t	order_bits () const override
	Return the bit length of the group order.

ProjectivePoint	point_add (const AffinePoint &a, const AffinePoint &b) const override

AffinePoint	point_negate (const AffinePoint &pt) const override

AffinePoint	point_to_affine (const ProjectivePoint &pt) const override

	PrimeOrderCurveImpl ()

Scalar	random_scalar (RandomNumberGenerator &rng) const override

Scalar	scalar_add (const Scalar &a, const Scalar &b) const override
	Scalar addition.

size_t	scalar_bytes () const override
	Return the byte length of the scalar element.

bool	scalar_equal (const Scalar &a, const Scalar &b) const override
	Test if two scalars are equal.

std::optional< Scalar >	scalar_from_wide_bytes (std::span< const uint8_t > bytes) const override

Scalar	scalar_invert (const Scalar &ss) const override
	Scalar inversion.

Scalar	scalar_invert_vartime (const Scalar &ss) const override
	Scalar inversion (variable time)

bool	scalar_is_zero (const Scalar &s) const override
	Test if scalar is zero.

Scalar	scalar_mul (const Scalar &a, const Scalar &b) const override
	Scalar multiplication.

Scalar	scalar_negate (const Scalar &s) const override
	Scalar negation.

Scalar	scalar_one () const override

Scalar	scalar_square (const Scalar &s) const override
	Scalar squaring.

Scalar	scalar_sub (const Scalar &a, const Scalar &b) const override
	Scalar subtraction.

void	serialize_point (std::span< uint8_t > bytes, const AffinePoint &pt) const override

void	serialize_scalar (std::span< uint8_t > bytes, const Scalar &scalar) const override

Static Public Member Functions
static std::shared_ptr< const PrimeOrderCurve >	for_named_curve (std::string_view name)

static std::shared_ptr< const PrimeOrderCurve >	from_params (const BigInt &p, const BigInt &a, const BigInt &b, const BigInt &base_x, const BigInt &base_y, const BigInt &order)

static std::shared_ptr< const PrimeOrderCurve >	instance ()

Static Public Attributes
static constexpr size_t	MaximumBitLength = 521

static constexpr size_t	MaximumByteLength = (MaximumBitLength + 7) / 8

static constexpr size_t	StorageWords = (MaximumByteLength + sizeof(word) - 1) / sizeof(word)
	Number of words used to store MaximumByteLength.

Detailed Description

template<typename C>
class Botan::PCurve::PrimeOrderCurveImpl< C >

This class provides a bridge between the "public" (actually still internal) PrimeOrderCurve type, and the inner templates which are subclasses of EllipticCurve from pcurves_impl.h

Definition at line 27 of file pcurves_wrap.h.

Member Typedef Documentation

◆ CurvePtr

typedef std::shared_ptr<const PrimeOrderCurve> Botan::PCurve::PrimeOrderCurve::CurvePtr

inherited

Definition at line 60 of file pcurves.h.

◆ StorageUnit

typedef std::array<word, StorageWords> Botan::PCurve::PrimeOrderCurve::StorageUnit

inherited

Definition at line 59 of file pcurves.h.

Constructor & Destructor Documentation

◆ PrimeOrderCurveImpl()

template<typename C>

Botan::PCurve::PrimeOrderCurveImpl< C >::PrimeOrderCurveImpl ( )

inline

Definition at line 303 of file pcurves_wrap.h.

303: m_mul_by_g(C::G) {}

Botan::PCurve::PrimeOrderCurveImpl

Definition pcurves_wrap.h:27

Member Function Documentation

◆ affine_point_is_identity()

template<typename C>

bool Botan::PCurve::PrimeOrderCurveImpl< C >::affine_point_is_identity ( const AffinePoint & pt ) const

inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 207 of file pcurves_wrap.h.

207 {

208 return from_stash(pt).is_identity().as_bool();

209 }

◆ base_point_mul_x_mod_order()

template<typename C>

Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::base_point_mul_x_mod_order	(	const Scalar &	scalar,
		RandomNumberGenerator &	rng ) const

inlineoverridevirtual

Base point multiplication, returning only the x coordinate modulo the group order

Multiply by the standard generator point g, then extract the x coordinate as an integer, then reduce the x coordinate modulo the group order

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 179 of file pcurves_wrap.h.

                                                                                                         {
         auto pt = m_mul_by_g.mul(from_stash(scalar), rng);
         std::array<uint8_t, C::FieldElement::BYTES> x_bytes;
         to_affine_x<C>(pt).serialize_to(std::span{x_bytes});
         // Reduction might be required (if unlikely)
         return stash(C::Scalar::from_wide_bytes(std::span<const uint8_t, C::FieldElement::BYTES>{x_bytes}));
      }

References Botan::to_affine_x().

◆ deserialize_point()

template<typename C>

std::optional< AffinePoint > Botan::PCurve::PrimeOrderCurveImpl< C >::deserialize_point ( std::span< const uint8_t > bytes ) const

inlineoverridevirtual

Deserialize a point

Both compressed and uncompressed encodings are accepted

Note that the deprecated "hybrid" encoding is not supported here

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 239 of file pcurves_wrap.h.

                                                                                              {
         if(auto pt = C::AffinePoint::deserialize(bytes)) {
            return stash(*pt);
         } else {
            return {};
         }
      }

◆ deserialize_scalar()

template<typename C>

std::optional< Scalar > Botan::PCurve::PrimeOrderCurveImpl< C >::deserialize_scalar ( std::span< const uint8_t > bytes ) const

inlineoverridevirtual

Deserialize a scalar in [1,p)

This function requires the input length be exactly scalar_bytes long; it does not accept inputs that are shorter, or with excess leading zero padding bytes.

This function also rejects zero as an input, since in normal usage scalars are integers in Z_p*

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 221 of file pcurves_wrap.h.

                                                                                          {
         if(auto scalar = C::Scalar::deserialize(bytes)) {
            if(!scalar->is_zero().as_bool()) {
               return stash(*scalar);
            }
         }
 
         return {};
      }

◆ field_element_bytes()

template<typename C>

size_t Botan::PCurve::PrimeOrderCurveImpl< C >::field_element_bytes ( ) const

inlineoverridevirtual

Return the byte length of a field element

Each point consists of two field elements

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 36 of file pcurves_wrap.h.

36{ return C::FieldElement::BYTES; }

◆ for_named_curve()

std::shared_ptr< const PrimeOrderCurve > Botan::PCurve::PrimeOrderCurve::for_named_curve ( std::string_view name )

staticinherited

Returns: nullptr if the curve specified is not available

Definition at line 26 of file pcurves.cpp.

                                                                                         {
#if defined(BOTAN_HAS_PCURVES_SECP192R1)
   if(name == "secp192r1") {
      return PCurveInstance::secp192r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_SECP224R1)
   if(name == "secp224r1") {
      return PCurveInstance::secp224r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_SECP256R1)
   if(name == "secp256r1") {
      return PCurveInstance::secp256r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_SECP384R1)
   if(name == "secp384r1") {
      return PCurveInstance::secp384r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_SECP521R1)
   if(name == "secp521r1") {
      return PCurveInstance::secp521r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_SECP256K1)
   if(name == "secp256k1") {
      return PCurveInstance::secp256k1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_BRAINPOOL256R1)
   if(name == "brainpool256r1") {
      return PCurveInstance::brainpool256r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_BRAINPOOL384R1)
   if(name == "brainpool384r1") {
      return PCurveInstance::brainpool384r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_BRAINPOOL512R1)
   if(name == "brainpool512r1") {
      return PCurveInstance::brainpool512r1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_FRP256V1)
   if(name == "frp256v1") {
      return PCurveInstance::frp256v1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_SM2P256V1)
   if(name == "sm2p256v1") {
      return PCurveInstance::sm2p256v1();
   }
#endif
 
#if defined(BOTAN_HAS_PCURVES_NUMSP512D1)
   if(name == "numsp512d1") {
      return PCurveInstance::numsp512d1();
   }
#endif
 
   BOTAN_UNUSED(name);
   return {};
}

References BOTAN_UNUSED.

◆ from_params()

std::shared_ptr< const PrimeOrderCurve > Botan::PCurve::PrimeOrderCurve::from_params	(	const BigInt &	p,
		const BigInt &	a,
		const BigInt &	b,
		const BigInt &	base_x,
		const BigInt &	base_y,
		const BigInt &	order )

staticinherited

Returns: nullptr if the parameters seem unsuitable for pcurves for example if the prime is too large

This function should accept the same subset of curves as the EC_Group constructor that accepts BigInts.

Definition at line 15 of file pcurves.cpp.

                                                                                                                       {
#if defined(BOTAN_HAS_PCURVES_GENERIC)
   return PCurveInstance::from_params(p, a, b, base_x, base_y, order);
#endif
 
   BOTAN_UNUSED(p, a, b, base_x, base_y, order);
   return {};
}

References BOTAN_UNUSED.

◆ generator()

template<typename C>

AffinePoint Botan::PCurve::PrimeOrderCurveImpl< C >::generator ( ) const

inlineoverridevirtual

Return the standard generator.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 187 of file pcurves_wrap.h.

187{ return stash(C::G); }

◆ hash_to_curve_nu()

template<typename C>

AffinePoint Botan::PCurve::PrimeOrderCurveImpl< C >::hash_to_curve_nu ( std::function< void(std::span< uint8_t >)> expand_message ) const

inlineoverridevirtual

RFC 9380 hash to curve (NU variant)

This is currently only supported for a few specific curves

Parameters

expand_message is a callback which must fill the provided output span with a sequence of uniform bytes, or if this is not possible due to length limitations or some other issue, throw an exception. It is invoked to produce the uniform_bytes value; see RFC 9380 section 5.2

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 247 of file pcurves_wrap.h.

                                                                                                      {
         if constexpr(C::ValidForSswuHash) {
            return stash(hash_to_curve_sswu<C, false>(expand_message));
         } else {
            throw Not_Implemented("Hash to curve is not implemented for this curve");
         }
      }

◆ hash_to_curve_ro()

template<typename C>

ProjectivePoint Botan::PCurve::PrimeOrderCurveImpl< C >::hash_to_curve_ro ( std::function< void(std::span< uint8_t >)> expand_message ) const

inlineoverridevirtual

RFC 9380 hash to curve (RO variant)

This is currently only supported for a few specific curves

Parameters

expand_message is a callback which must fill the provided output span with a sequence of uniform bytes, or if this is not possible due to length limitations or some other issue, throw an exception. It is invoked to produce the uniform_bytes value; see RFC 9380 section 5.2

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 255 of file pcurves_wrap.h.

                                                                                                          {
         if constexpr(C::ValidForSswuHash) {
            return stash(hash_to_curve_sswu<C, true>(expand_message));
         } else {
            throw Not_Implemented("Hash to curve is not implemented for this curve");
         }
      }

◆ instance()

template<typename C>

static std::shared_ptr< const PrimeOrderCurve > Botan::PCurve::PrimeOrderCurveImpl< C >::instance ( )

inlinestatic

Definition at line 305 of file pcurves_wrap.h.

305 {

306 static auto g_curve = std::make_shared<const PrimeOrderCurveImpl<C>>();

307 return g_curve;

308 }

◆ mul()

template<typename C>

ProjectivePoint Botan::PCurve::PrimeOrderCurveImpl< C >::mul	(	const AffinePoint &	pt,
		const Scalar &	scalar,
		RandomNumberGenerator &	rng ) const

inlineoverridevirtual

Generic point multiplication

Multiply an arbitrary point by a scalar

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 42 of file pcurves_wrap.h.

42 {

43 auto tbl = WindowedBoothMulTable<C, VarPointWindowBits>(from_stash(pt));

44 return stash(tbl.mul(from_stash(scalar), rng));

45 }

◆ mul2_setup_g()

template<typename C>

std::unique_ptr< const PrecomputedMul2Table > Botan::PCurve::PrimeOrderCurveImpl< C >::mul2_setup_g ( const AffinePoint & q ) const

inlineoverridevirtual

Setup a table for 2-ary multiplication where the first point is the generator.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 68 of file pcurves_wrap.h.

68 {

69 return std::make_unique<PrecomputedMul2TableC>(C::G, from_stash(q));

70 }

◆ mul2_vartime()

template<typename C>

std::optional< ProjectivePoint > Botan::PCurve::PrimeOrderCurveImpl< C >::mul2_vartime	(	const PrecomputedMul2Table &	table,
		const Scalar &	x,
		const Scalar &	y ) const

inlineoverridevirtual

Perform 2-ary multiplication (variable time)

Compute p*x + q*y in variable time

Returns nullopt if the produced point is the point at infinity

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 72 of file pcurves_wrap.h.

                                                                                  {
         try {
            const auto& table = dynamic_cast<const PrecomputedMul2TableC&>(tableb);
            auto pt = table.table().mul2_vartime(from_stash(x), from_stash(y));
            if(pt.is_identity().as_bool()) {
               return {};
            } else {
               return stash(pt);
            }
         } catch(std::bad_cast&) {
            throw Invalid_Argument("Curve mismatch");
         }
      }

References Botan::PCurve::PrimeOrderCurveImpl< C >::PrecomputedMul2TableC::table().

◆ mul2_vartime_x_mod_order_eq()

template<typename C>

bool Botan::PCurve::PrimeOrderCurveImpl< C >::mul2_vartime_x_mod_order_eq	(	const PrecomputedMul2Table &	table,
		const Scalar &	v,
		const Scalar &	x,
		const Scalar &	y ) const

inlineoverridevirtual

Perform 2-ary multiplication (variable time), reducing x modulo order

Compute p*x + q*y in variable time, then extract the x coordinate of the result, and reduce x modulo the group order. Compare that value with v. If equal, returns true. Otherwise returns false, including if the produced point is the point at infinity

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 102 of file pcurves_wrap.h.

                                                                       {
         try {
            const auto& table = dynamic_cast<const PrecomputedMul2TableC&>(tableb);
            const auto pt = table.table().mul2_vartime(from_stash(x), from_stash(y));
            // Variable time here, so the early return is fine
            if(pt.is_identity().as_bool()) {
               return false;
            }
 
            /*
            * Avoid the inversion by instead projecting v.
            *
            * Given (x*z2) and v we want to know if x % n == v
            *
            * Inverting z2 to extract x is expensive. Instead compute (v*z2) and
            * compare it with (x*z2).
            *
            * With overwhelming probability, this conversion is correct. The
            * only time it is not is in the extremely unlikely case where the
            * signer actually reduced the x coordinate modulo the group order.
            * That is handled seperately in a second step.
            */
            const auto z2 = pt.z().square();
 
            std::array<uint8_t, C::Scalar::BYTES> v_bytes;
            from_stash(v).serialize_to(v_bytes);
 
            if(const auto fe_v = C::FieldElement::deserialize(v_bytes)) {
               if((*fe_v * z2 == pt.x()).as_bool()) {
                  return true;
               }
 
               /*
               * Possibly (if cryptographically unlikely) the signer
               * reduced the value modulo the group order.
               *
               * If so we must check v + n similarly as before. However here
               * we must be careful to not overflow since otherwise that
               * would lead to us accepting an incorrect signature.
               *
               * If the order is > p then the reduction modulo p would not have
               * had any effect and we don't need to consider the possibility
               */
               if constexpr(C::OrderIsLessThanField) {
                  /*
                  * We have to be careful to avoid overflow since this would
                  * lead to a forgery
                  *
                  * v < (p)-n => v + n < p
                  *
                  * The values n and neg_n could be precomputed but they are
                  * fast to compute and this codepath will ~never be taken
                  * unless when verifying an invalid signature. In any case
                  * it is many times cheaper than performing the modular inversion
                  * which this approach avoids.
                  */
 
                  // Create the group order as a field element, safe because n < p
                  const auto n = C::FieldElement::from_words(C::NW);
                  const auto neg_n = n.negate().to_words();
 
                  const auto vw = fe_v->to_words();
                  if(bigint_ct_is_lt(vw.data(), vw.size(), neg_n.data(), neg_n.size()).as_bool()) {
                     return (((*fe_v + n) * z2) == pt.x()).as_bool();
                  }
               }
            }
 
            return false;
         } catch(std::bad_cast&) {
            throw Invalid_Argument("Curve mismatch");
         }
      }

References Botan::bigint_ct_is_lt(), and Botan::PCurve::PrimeOrderCurveImpl< C >::PrecomputedMul2TableC::table().

◆ mul_by_g()

template<typename C>

ProjectivePoint Botan::PCurve::PrimeOrderCurveImpl< C >::mul_by_g	(	const Scalar &	scalar,
		RandomNumberGenerator &	rng ) const

inlineoverridevirtual

Base point multiplication

Multiply by the standard generator point g

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 38 of file pcurves_wrap.h.

38 {

39 return stash(m_mul_by_g.mul(from_stash(scalar), rng));

40 }

◆ mul_px_qy()

template<typename C>

std::optional< ProjectivePoint > Botan::PCurve::PrimeOrderCurveImpl< C >::mul_px_qy	(	const AffinePoint &	p,
		const Scalar &	x,
		const AffinePoint &	q,
		const Scalar &	y,
		RandomNumberGenerator &	rng ) const

inlineoverridevirtual

Perform 2-ary multiplication (constant time)

Compute p*x + q*y

Returns nullopt if the produced point is the point at infinity

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 88 of file pcurves_wrap.h.

                                                                                          {
         WindowedMul2Table<C, Mul2WindowBits> tbl(from_stash(p), from_stash(q));
         auto pt = tbl.mul2(from_stash(x), from_stash(y), rng);
         if(pt.is_identity().as_bool()) {
            return {};
         } else {
            return stash(pt);
         }
      }

◆ mul_x_only()

template<typename C>

secure_vector< uint8_t > Botan::PCurve::PrimeOrderCurveImpl< C >::mul_x_only	(	const AffinePoint &	pt,
		const Scalar &	scalar,
		RandomNumberGenerator &	rng ) const

inlineoverridevirtual

Generic x-only point multiplication

Multiply an arbitrary point by a scalar, returning only the x coordinate

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 47 of file pcurves_wrap.h.

                                                                                   {
         auto tbl = WindowedBoothMulTable<C, VarPointWindowBits>(from_stash(pt));
         auto pt_x = to_affine_x<C>(tbl.mul(from_stash(scalar), rng));
         secure_vector<uint8_t> x_bytes(C::FieldElement::BYTES);
         pt_x.serialize_to(std::span<uint8_t, C::FieldElement::BYTES>{x_bytes});
         return x_bytes;
      }

References Botan::to_affine_x().

◆ order_bits()

template<typename C>

size_t Botan::PCurve::PrimeOrderCurveImpl< C >::order_bits ( ) const

inlineoverridevirtual

Return the bit length of the group order.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 32 of file pcurves_wrap.h.

32{ return C::OrderBits; }

◆ point_add()

template<typename C>

ProjectivePoint Botan::PCurve::PrimeOrderCurveImpl< C >::point_add	(	const AffinePoint &	a,
		const AffinePoint &	b ) const

inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 201 of file pcurves_wrap.h.

201 {

202 return stash(C::ProjectivePoint::from_affine(from_stash(a)) + from_stash(b));

203 }

◆ point_negate()

template<typename C>

AffinePoint Botan::PCurve::PrimeOrderCurveImpl< C >::point_negate ( const AffinePoint & pt ) const

inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 205 of file pcurves_wrap.h.

205{ return stash(from_stash(pt).negate()); }

◆ point_to_affine()

template<typename C>

AffinePoint Botan::PCurve::PrimeOrderCurveImpl< C >::point_to_affine ( const ProjectivePoint & pt ) const

inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 189 of file pcurves_wrap.h.

                                                                            {
         auto affine = to_affine<C>(from_stash(pt));
 
         const auto y2 = affine.y().square();
         const auto x3_ax_b = C::AffinePoint::x3_ax_b(affine.x());
         const auto valid_point = affine.is_identity() || (y2 == x3_ax_b);
 
         BOTAN_ASSERT(valid_point.as_bool(), "Computed point is on the curve");
 
         return stash(affine);
      }

References BOTAN_ASSERT, and Botan::to_affine().

◆ random_scalar()

template<typename C>

Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::random_scalar ( RandomNumberGenerator & rng ) const

inlineoverridevirtual

Return a new random scalar

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 301 of file pcurves_wrap.h.

301{ return stash(C::Scalar::random(rng)); }

◆ scalar_add()

template<typename C>

Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_add	(	const Scalar &	a,
		const Scalar &	b ) const

inlineoverridevirtual

Scalar addition.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 263 of file pcurves_wrap.h.

263 {

264 return stash(from_stash(a) + from_stash(b));

265 }

◆ scalar_bytes()

template<typename C>

size_t Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_bytes ( ) const

inlineoverridevirtual

Return the byte length of the scalar element.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 34 of file pcurves_wrap.h.

34{ return C::Scalar::BYTES; }

◆ scalar_equal()

template<typename C>

bool Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_equal	(	const Scalar &	a,
		const Scalar &	b ) const

inlineoverridevirtual

Test if two scalars are equal.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 295 of file pcurves_wrap.h.

295 {

296 return (from_stash(a) == from_stash(b)).as_bool();

297 }

◆ scalar_from_wide_bytes()

template<typename C>

std::optional< Scalar > Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_from_wide_bytes ( std::span< const uint8_t > bytes ) const

inlineoverridevirtual

Reduce an integer modulo the group order

The input can be at most twice the bit length of the order; if larger than this nullopt is returned

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 231 of file pcurves_wrap.h.

                                                                                              {
         if(auto s = C::Scalar::from_wide_bytes_varlen(bytes)) {
            return stash(*s);
         } else {
            return {};
         }
      }

◆ scalar_invert()

template<typename C>

Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_invert ( const Scalar & s ) const

inlineoverridevirtual

Scalar inversion.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 277 of file pcurves_wrap.h.

                                                            {
         auto s = from_stash(ss);
         if constexpr(curve_supports_scalar_invert<C>) {
            return stash(C::scalar_invert(s));
         } else {
            return stash(s.invert());
         }
      }

◆ scalar_invert_vartime()

template<typename C>

Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_invert_vartime ( const Scalar & s ) const

inlineoverridevirtual

Scalar inversion (variable time)

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 286 of file pcurves_wrap.h.

286 {

287 auto s = from_stash(ss);

288 return stash(s.invert_vartime());

289 }

◆ scalar_is_zero()

template<typename C>

bool Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_is_zero ( const Scalar & s ) const

inlineoverridevirtual

Test if scalar is zero.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 293 of file pcurves_wrap.h.

293{ return from_stash(s).is_zero().as_bool(); }

◆ scalar_mul()

template<typename C>

Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_mul	(	const Scalar &	a,
		const Scalar &	b ) const

inlineoverridevirtual

Scalar multiplication.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 271 of file pcurves_wrap.h.

271 {

272 return stash(from_stash(a) * from_stash(b));

273 }

◆ scalar_negate()

template<typename C>

Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_negate ( const Scalar & s ) const

inlineoverridevirtual

Scalar negation.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 291 of file pcurves_wrap.h.

291{ return stash(from_stash(s).negate()); }

◆ scalar_one()

template<typename C>

Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_one ( ) const

inlineoverridevirtual

Return the scalar one

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 299 of file pcurves_wrap.h.

299{ return stash(C::Scalar::one()); }

◆ scalar_square()

template<typename C>

Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_square ( const Scalar & s ) const

inlineoverridevirtual

Scalar squaring.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 275 of file pcurves_wrap.h.

275{ return stash(from_stash(s).square()); }

Botan::square

BigInt square(const BigInt &x)

Definition numthry.cpp:157

References Botan::square().

◆ scalar_sub()

template<typename C>

Scalar Botan::PCurve::PrimeOrderCurveImpl< C >::scalar_sub	(	const Scalar &	a,
		const Scalar &	b ) const

inlineoverridevirtual

Scalar subtraction.

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 267 of file pcurves_wrap.h.

267 {

268 return stash(from_stash(a) - from_stash(b));

269 }

◆ serialize_point()

template<typename C>

void Botan::PCurve::PrimeOrderCurveImpl< C >::serialize_point	(	std::span< uint8_t >	bytes,
		const AffinePoint &	pt ) const

inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 211 of file pcurves_wrap.h.

211 {

212 BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES, "Invalid length for serialize_point");

213 from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>());

214 }

BOTAN_ARG_CHECK

#define BOTAN_ARG_CHECK(expr, msg)

Definition assert.h:31

References BOTAN_ARG_CHECK.

◆ serialize_scalar()

template<typename C>

void Botan::PCurve::PrimeOrderCurveImpl< C >::serialize_scalar	(	std::span< uint8_t >	bytes,
		const Scalar &	scalar ) const

inlineoverridevirtual

Implements Botan::PCurve::PrimeOrderCurve.

Definition at line 216 of file pcurves_wrap.h.

216 {

217 BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES, "Invalid length to serialize_scalar");

218 return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>());

219 }

References BOTAN_ARG_CHECK.

Member Data Documentation

◆ MaximumBitLength

size_t Botan::PCurve::PrimeOrderCurve::MaximumBitLength = 521

staticconstexprinherited

Somewhat arbitrary maximum size for a field or scalar

Sized to fit at least P-521

Definition at line 37 of file pcurves.h.

◆ MaximumByteLength

size_t Botan::PCurve::PrimeOrderCurve::MaximumByteLength = (MaximumBitLength + 7) / 8

staticconstexprinherited

Definition at line 39 of file pcurves.h.

◆ StorageWords

size_t Botan::PCurve::PrimeOrderCurve::StorageWords = (MaximumByteLength + sizeof(word) - 1) / sizeof(word)

staticconstexprinherited

Number of words used to store MaximumByteLength.

Definition at line 42 of file pcurves.h.

The documentation for this class was generated from the following file:

src/lib/math/pcurves/pcurves_impl/pcurves_wrap.h

Classes

Public Types

Public Member Functions

Static Public Member Functions

Static Public Attributes

Detailed Description

Member Typedef Documentation

◆ CurvePtr

◆ StorageUnit

Constructor & Destructor Documentation

◆ PrimeOrderCurveImpl()

Member Function Documentation

◆ affine_point_is_identity()

◆ base_point_mul_x_mod_order()

◆ deserialize_point()

◆ deserialize_scalar()

◆ field_element_bytes()

◆ for_named_curve()

◆ from_params()

◆ generator()

◆ hash_to_curve_nu()

◆ hash_to_curve_ro()

◆ instance()

◆ mul()

◆ mul2_setup_g()

◆ mul2_vartime()

◆ mul2_vartime_x_mod_order_eq()

◆ mul_by_g()

◆ mul_px_qy()

◆ mul_x_only()

◆ order_bits()

◆ point_add()

◆ point_negate()

◆ point_to_affine()

◆ random_scalar()

◆ scalar_add()

◆ scalar_bytes()

◆ scalar_equal()

◆ scalar_from_wide_bytes()

◆ scalar_invert()

◆ scalar_invert_vartime()

◆ scalar_is_zero()

◆ scalar_mul()

◆ scalar_negate()

◆ scalar_one()

◆ scalar_square()

◆ scalar_sub()

◆ serialize_point()

◆ serialize_scalar()

Member Data Documentation

◆ MaximumBitLength

◆ MaximumByteLength

◆ StorageWords