Botan  2.4.0
Crypto and TLS for C++11
Public Types | Public Member Functions | Static Public Member Functions | Friends | List of all members
Botan::PointGFp Class Referencefinal

#include <point_gfp.h>

Public Types

enum  Compression_Type { UNCOMPRESSED = 0, COMPRESSED = 1, HYBRID = 2 }
 

Public Member Functions

BigInt get_affine_x () const
 
BigInt get_affine_y () const
 
const CurveGFpget_curve () const
 
bool is_zero () const
 
PointGFpnegate ()
 
bool on_the_curve () const
 
PointGFpoperator*= (const BigInt &scalar)
 
PointGFpoperator+= (const PointGFp &rhs)
 
PointGFpoperator-= (const PointGFp &rhs)
 
PointGFpoperator= (const PointGFp &)=default
 
PointGFpoperator= (PointGFp &&other)
 
bool operator== (const PointGFp &other) const
 
 PointGFp ()=default
 
 PointGFp (const CurveGFp &curve)
 
 PointGFp (const PointGFp &)=default
 
 PointGFp (PointGFp &&other)
 
 PointGFp (const CurveGFp &curve, const BigInt &x, const BigInt &y)
 
void randomize_repr (RandomNumberGenerator &rng)
 
void swap (PointGFp &other)
 

Static Public Member Functions

static PointGFp zero_of (const CurveGFp &curve)
 

Friends

class Blinded_Point_Multiply
 
PointGFp multi_exponentiate (const PointGFp &p1, const BigInt &z1, const PointGFp &p2, const BigInt &z2)
 
PointGFp operator* (const BigInt &scalar, const PointGFp &point)
 

Detailed Description

This class represents one point on a curve of GF(p)

Definition at line 43 of file point_gfp.h.

Member Enumeration Documentation

◆ Compression_Type

Enumerator
UNCOMPRESSED 
COMPRESSED 
HYBRID 

Definition at line 46 of file point_gfp.h.

Constructor & Destructor Documentation

◆ PointGFp() [1/5]

Botan::PointGFp::PointGFp ( )
default

Construct an uninitialized PointGFp

Referenced by Botan::operator*(), operator-=(), and randomize_repr().

◆ PointGFp() [2/5]

Botan::PointGFp::PointGFp ( const CurveGFp curve)
explicit

Construct the zero point

Parameters
curveThe base curve

Definition at line 17 of file point_gfp.cpp.

17  :
18  m_curve(curve),
19  m_coord_x(0),
20  m_coord_y(1),
21  m_coord_z(0)
22  {
23  m_curve.to_rep(m_coord_x, m_monty_ws);
24  m_curve.to_rep(m_coord_y, m_monty_ws);
25  m_curve.to_rep(m_coord_z, m_monty_ws);
26  }
void to_rep(BigInt &x, secure_vector< word > &ws) const
Definition: curve_gfp.h:97

◆ PointGFp() [3/5]

Botan::PointGFp::PointGFp ( const PointGFp )
default

Copy constructor

◆ PointGFp() [4/5]

Botan::PointGFp::PointGFp ( PointGFp &&  other)
inline

Move Constructor

Definition at line 76 of file point_gfp.h.

77  {
78  this->swap(other);
79  }
void swap(PointGFp &other)
Definition: point_gfp.cpp:446

◆ PointGFp() [5/5]

Botan::PointGFp::PointGFp ( const CurveGFp curve,
const BigInt x,
const BigInt y 
)

Construct a point from its affine coordinates

Parameters
curvethe base curve
xaffine x coordinate
yaffine y coordinate

Definition at line 28 of file point_gfp.cpp.

References Botan::CurveGFp::get_p(), and Botan::CurveGFp::to_rep().

28  :
29  m_curve(curve),
30  m_coord_x(x),
31  m_coord_y(y),
32  m_coord_z(1)
33  {
34  if(x <= 0 || x >= curve.get_p())
35  throw Invalid_Argument("Invalid PointGFp affine x");
36  if(y <= 0 || y >= curve.get_p())
37  throw Invalid_Argument("Invalid PointGFp affine y");
38 
39  m_curve.to_rep(m_coord_x, m_monty_ws);
40  m_curve.to_rep(m_coord_y, m_monty_ws);
41  m_curve.to_rep(m_coord_z, m_monty_ws);
42  }
void to_rep(BigInt &x, secure_vector< word > &ws) const
Definition: curve_gfp.h:97

Member Function Documentation

◆ get_affine_x()

BigInt Botan::PointGFp::get_affine_x ( ) const

get affine x coordinate

Returns
affine x coordinate

Definition at line 389 of file point_gfp.cpp.

References Botan::CT::is_zero().

Referenced by Botan::EC2OSP(), operator==(), Botan::GOST_3410_PublicKey::public_key_bits(), and Botan::sm2_compute_za().

390  {
391  if(is_zero())
392  throw Illegal_Transformation("Cannot convert zero point to affine");
393 
394  BigInt z2 = curve_sqr(m_coord_z);
395  m_curve.from_rep(z2, m_monty_ws);
396  z2 = inverse_mod(z2, m_curve.get_p());
397 
398  return curve_mult(z2, m_coord_x);
399  }
void from_rep(BigInt &x, secure_vector< word > &ws) const
Definition: curve_gfp.h:102
BigInt inverse_mod(const BigInt &n, const BigInt &mod)
Definition: numthry.cpp:277
bool is_zero() const
Definition: point_gfp.h:179
const BigInt & get_p() const
Definition: curve_gfp.h:91

◆ get_affine_y()

BigInt Botan::PointGFp::get_affine_y ( ) const

get affine y coordinate

Returns
affine y coordinate

Definition at line 401 of file point_gfp.cpp.

References Botan::inverse_mod(), and Botan::CT::is_zero().

Referenced by Botan::EC2OSP(), operator==(), Botan::GOST_3410_PublicKey::public_key_bits(), and Botan::sm2_compute_za().

402  {
403  if(is_zero())
404  throw Illegal_Transformation("Cannot convert zero point to affine");
405 
406  BigInt z3 = curve_mult(m_coord_z, curve_sqr(m_coord_z));
407  z3 = inverse_mod(z3, m_curve.get_p());
408  m_curve.to_rep(z3, m_monty_ws);
409 
410  return curve_mult(z3, m_coord_y);
411  }
void to_rep(BigInt &x, secure_vector< word > &ws) const
Definition: curve_gfp.h:97
BigInt inverse_mod(const BigInt &n, const BigInt &mod)
Definition: numthry.cpp:277
bool is_zero() const
Definition: point_gfp.h:179
const BigInt & get_p() const
Definition: curve_gfp.h:91

◆ get_curve()

const CurveGFp& Botan::PointGFp::get_curve ( ) const
inline

Return base curve of this point

Returns
the curve over GF(p) of this point

Definition at line 161 of file point_gfp.h.

Referenced by Botan::EC2OSP(), Botan::EC_PublicKey::EC_PublicKey(), Botan::multi_exponentiate(), Botan::operator*(), and operator==().

161 { return m_curve; }

◆ is_zero()

bool Botan::PointGFp::is_zero ( ) const
inline

Is this the point at infinity?

Returns
true, if this point is at infinity, false otherwise.

Definition at line 179 of file point_gfp.h.

References Botan::operator==().

Referenced by Botan::EC_PublicKey::check_key(), Botan::ECIES_KA_Operation::derive_secret(), Botan::EC2OSP(), Botan::ECIES_Encryptor::ECIES_Encryptor(), operator-=(), operator==(), and randomize_repr().

180  { return (m_coord_x.is_zero() && m_coord_z.is_zero()); }
bool is_zero() const
Definition: bigint.h:255

◆ negate()

PointGFp& Botan::PointGFp::negate ( )
inline

Negate this point

Returns
*this

Definition at line 150 of file point_gfp.h.

References Botan::CT::is_zero().

Referenced by Botan::operator*(), and Botan::operator-().

151  {
152  if(!is_zero())
153  m_coord_y = m_curve.get_p() - m_coord_y;
154  return *this;
155  }
bool is_zero() const
Definition: point_gfp.h:179
const BigInt & get_p() const
Definition: curve_gfp.h:91

◆ on_the_curve()

bool Botan::PointGFp::on_the_curve ( ) const

Checks whether the point is to be found on the underlying curve; used to prevent fault attacks.

Returns
if the point is on the curve

Definition at line 413 of file point_gfp.cpp.

References Botan::CT::is_zero().

Referenced by Botan::EC_PublicKey::check_key(), Botan::EC_PrivateKey::EC_PrivateKey(), Botan::GOST_3410_PublicKey::GOST_3410_PublicKey(), Botan::OS2ECP(), and Botan::EC_Group::verify_group().

414  {
415  /*
416  Is the point still on the curve?? (If everything is correct, the
417  point is always on its curve; then the function will return true.
418  If somehow the state is corrupted, which suggests a fault attack
419  (or internal computational error), then return false.
420  */
421  if(is_zero())
422  return true;
423 
424  const BigInt y2 = m_curve.from_rep(curve_sqr(m_coord_y), m_monty_ws);
425  const BigInt x3 = curve_mult(m_coord_x, curve_sqr(m_coord_x));
426  const BigInt ax = curve_mult(m_coord_x, m_curve.get_a_rep());
427  const BigInt z2 = curve_sqr(m_coord_z);
428 
429  if(m_coord_z == z2) // Is z equal to 1 (in Montgomery form)?
430  {
431  if(y2 != m_curve.from_rep(x3 + ax + m_curve.get_b_rep(), m_monty_ws))
432  return false;
433  }
434 
435  const BigInt z3 = curve_mult(m_coord_z, z2);
436  const BigInt ax_z4 = curve_mult(ax, curve_sqr(z2));
437  const BigInt b_z6 = curve_mult(m_curve.get_b_rep(), curve_sqr(z3));
438 
439  if(y2 != m_curve.from_rep(x3 + ax_z4 + b_z6, m_monty_ws))
440  return false;
441 
442  return true;
443  }
const BigInt & get_a_rep() const
Definition: curve_gfp.h:93
const BigInt & get_b_rep() const
Definition: curve_gfp.h:95
void from_rep(BigInt &x, secure_vector< word > &ws) const
Definition: curve_gfp.h:102
bool is_zero() const
Definition: point_gfp.h:179

◆ operator*=()

PointGFp & Botan::PointGFp::operator*= ( const BigInt scalar)

*= Operator

Parameters
scalarthe PointGFp to multiply with *this
Returns
resulting PointGFp

Definition at line 241 of file point_gfp.cpp.

242  {
243  *this = scalar * *this;
244  return *this;
245  }

◆ operator+=()

PointGFp & Botan::PointGFp::operator+= ( const PointGFp rhs)

+= Operator

Parameters
rhsthe PointGFp to add to the local value
Returns
resulting PointGFp

Definition at line 222 of file point_gfp.cpp.

223  {
224  std::vector<BigInt> ws(9);
225  add(rhs, ws);
226  return *this;
227  }

◆ operator-=()

PointGFp & Botan::PointGFp::operator-= ( const PointGFp rhs)

-= Operator

Parameters
rhsthe PointGFp to subtract from the local value
Returns
resulting PointGFp

Definition at line 229 of file point_gfp.cpp.

References is_zero(), and PointGFp().

230  {
231  PointGFp minus_rhs = PointGFp(rhs).negate();
232 
233  if(is_zero())
234  *this = minus_rhs;
235  else
236  *this += minus_rhs;
237 
238  return *this;
239  }
PointGFp()=default
bool is_zero() const
Definition: point_gfp.h:179

◆ operator=() [1/2]

PointGFp& Botan::PointGFp::operator= ( const PointGFp )
default

Standard Assignment

◆ operator=() [2/2]

PointGFp& Botan::PointGFp::operator= ( PointGFp &&  other)
inline

Move Assignment

Definition at line 89 of file point_gfp.h.

References BOTAN_PUBLIC_API, Botan::multi_exponentiate(), Botan::operator*(), and Botan::operator+=().

90  {
91  if(this != &other)
92  this->swap(other);
93  return (*this);
94  }
void swap(PointGFp &other)
Definition: point_gfp.cpp:446

◆ operator==()

bool Botan::PointGFp::operator== ( const PointGFp other) const

Equality operator

Definition at line 455 of file point_gfp.cpp.

References get_affine_x(), get_affine_y(), get_curve(), Botan::CT::is_zero(), and is_zero().

456  {
457  if(get_curve() != other.get_curve())
458  return false;
459 
460  // If this is zero, only equal if other is also zero
461  if(is_zero())
462  return other.is_zero();
463 
464  return (get_affine_x() == other.get_affine_x() &&
465  get_affine_y() == other.get_affine_y());
466  }
BigInt get_affine_x() const
Definition: point_gfp.cpp:389
BigInt get_affine_y() const
Definition: point_gfp.cpp:401
bool is_zero() const
Definition: point_gfp.h:179
const CurveGFp & get_curve() const
Definition: point_gfp.h:161

◆ randomize_repr()

void Botan::PointGFp::randomize_repr ( RandomNumberGenerator rng)

Randomize the point representation The actual value (get_affine_x, get_affine_y) does not change

Definition at line 44 of file point_gfp.cpp.

References Botan::CurveGFp::get_a_rep(), Botan::CurveGFp::get_p(), Botan::BigInt::is_negative(), is_zero(), Botan::BigInt::is_zero(), PointGFp(), Botan::BigInt::randomize(), and Botan::CurveGFp::to_rep().

Referenced by Botan::Blinded_Point_Multiply::blinded_multiply().

45  {
46  if(BOTAN_POINTGFP_RANDOMIZE_BLINDING_BITS > 1)
47  {
48  BigInt mask;
49  while(mask.is_zero())
50  mask.randomize(rng, BOTAN_POINTGFP_RANDOMIZE_BLINDING_BITS, false);
51 
52  m_curve.to_rep(mask, m_monty_ws);
53  const BigInt mask2 = curve_mult(mask, mask);
54  const BigInt mask3 = curve_mult(mask2, mask);
55 
56  m_coord_x = curve_mult(m_coord_x, mask2);
57  m_coord_y = curve_mult(m_coord_y, mask3);
58  m_coord_z = curve_mult(m_coord_z, mask);
59  }
60  }
void to_rep(BigInt &x, secure_vector< word > &ws) const
Definition: curve_gfp.h:97

◆ swap()

void Botan::PointGFp::swap ( PointGFp other)

swaps the states of *this and other, does not throw!

Parameters
otherthe object to swap values with

Definition at line 446 of file point_gfp.cpp.

447  {
448  m_curve.swap(other.m_curve);
449  m_coord_x.swap(other.m_coord_x);
450  m_coord_y.swap(other.m_coord_y);
451  m_coord_z.swap(other.m_coord_z);
452  m_monty_ws.swap(other.m_monty_ws);
453  }
void swap(BigInt &other)
Definition: bigint.h:127
void swap(CurveGFp &other)
Definition: curve_gfp.h:140

◆ zero_of()

static PointGFp Botan::PointGFp::zero_of ( const CurveGFp curve)
inlinestatic

Definition at line 63 of file point_gfp.h.

64  {
65  return PointGFp(curve);
66  }
PointGFp()=default

Friends And Related Function Documentation

◆ Blinded_Point_Multiply

friend class Blinded_Point_Multiply
friend

Definition at line 206 of file point_gfp.h.

◆ multi_exponentiate

PointGFp multi_exponentiate ( const PointGFp p1,
const BigInt z1,
const PointGFp p2,
const BigInt z2 
)
friend

Multiexponentiation

Parameters
p1a point
z1a scalar
p2a point
z2a scalar
Returns
(p1 * z1 + p2 * z2)

Definition at line 247 of file point_gfp.cpp.

249  {
250  const PointGFp p3 = p1 + p2;
251 
252  PointGFp H(p1.get_curve()); // create as zero
253  size_t bits_left = std::max(z1.bits(), z2.bits());
254 
255  std::vector<BigInt> ws(9);
256 
257  while(bits_left)
258  {
259  H.mult2(ws);
260 
261  const bool z1_b = z1.get_bit(bits_left - 1);
262  const bool z2_b = z2.get_bit(bits_left - 1);
263 
264  if(z1_b == true && z2_b == true)
265  H.add(p3, ws);
266  else if(z1_b)
267  H.add(p1, ws);
268  else if(z2_b)
269  H.add(p2, ws);
270 
271  --bits_left;
272  }
273 
274  if(z1.is_negative() != z2.is_negative())
275  H.negate();
276 
277  return H;
278  }
PointGFp()=default

◆ operator*

PointGFp operator* ( const BigInt scalar,
const PointGFp point 
)
friend

Multiplication Operator

Parameters
scalarthe scalar value
pointthe point value
Returns
scalar*point on the curve

Definition at line 280 of file point_gfp.cpp.

281  {
282  //BOTAN_ASSERT(point.on_the_curve(), "Input is on the curve");
283 
284  const CurveGFp& curve = point.get_curve();
285 
286  const size_t scalar_bits = scalar.bits();
287 
288  std::vector<BigInt> ws(9);
289 
290  PointGFp R[2] = { PointGFp(curve), point };
291 
292  for(size_t i = scalar_bits; i > 0; i--)
293  {
294  const size_t b = scalar.get_bit(i - 1);
295  R[b ^ 1].add(R[b], ws);
296  R[b].mult2(ws);
297  }
298 
299  if(scalar.is_negative())
300  R[0].negate();
301 
302  //BOTAN_ASSERT(R[0].on_the_curve(), "Output is on the curve");
303 
304  return R[0];
305  }
PointGFp()=default
PointGFp & negate()
Definition: point_gfp.h:150

The documentation for this class was generated from the following files: