Botan 3.8.1
Crypto and TLS for C&
ec_group.h
Go to the documentation of this file.
1/*
2* ECC Domain Parameters
3*
4* (C) 2007 Falko Strenzke, FlexSecure GmbH
5* 2008-2010,2024 Jack Lloyd
6*
7* Botan is released under the Simplified BSD License (see license.txt)
8*/
9
10#ifndef BOTAN_ECC_DOMAIN_PARAMETERS_H_
11#define BOTAN_ECC_DOMAIN_PARAMETERS_H_
12
13#include <botan/asn1_obj.h>
14#include <botan/bigint.h>
15#include <botan/ec_apoint.h>
16#include <botan/ec_point_format.h>
17#include <botan/ec_scalar.h>
18#include <memory>
19#include <set>
20#include <span>
21
22#if defined(BOTAN_HAS_LEGACY_EC_POINT)
23 #include <botan/ec_point.h>
24#endif
25
26namespace Botan {
27
28/**
29* This enum indicates the method used to encode the EC parameters
30*
31* @warning All support for explicit or implicit domain encodings
32* will be removed in Botan4. Only named curves will be supported.
33*
34* TODO(Botan4) remove this enum
35*/
45
46/**
47* This enum indicates the source of the elliptic curve parameters
48* in use.
49*
50* Builtin means the curve is a known standard one which was compiled
51* in the library.
52*
53* ExternalSource means the curve parameters came from either an explicit
54* curve encoding or an application defined curve.
55*/
60
61/**
62* Enum indicating the way the group in question is implemented
63*
64* This is returned by EC_Group::engine
65*/
66enum class EC_Group_Engine {
67 /// Using per curve implementation; fastest available
69 /// A generic implementation that handles many curves in one implementation
71 /// The old implementation, used as a fallback if none of the other
72 /// implementations can be used
73 /// TODO(Botan4) remove this
75};
76
77class EC_Mul2Table_Data;
78class EC_Group_Data;
79class EC_Group_Data_Map;
80
81/**
82* Class representing an elliptic curve
83*
84* The internal representation is stored in a shared_ptr, so copying an
85* EC_Group is inexpensive.
86*/
87class BOTAN_PUBLIC_API(2, 0) EC_Group final {
88 public:
89 /**
90 * Construct elliptic curve from the specified parameters
91 *
92 * This is used for example to create custom (application-specific) curves.
93 *
94 * Some build configurations do not support application specific curves, in
95 * which case this constructor will throw an exception. You can check for
96 * this situation beforehand using the function
97 * EC_Group::supports_application_specific_group()
98 *
99 * @param p the elliptic curve p
100 * @param a the elliptic curve a param
101 * @param b the elliptic curve b param
102 * @param base_x the x coordinate of the base point
103 * @param base_y the y coordinate of the base point
104 * @param order the order of the base point
105 * @param cofactor the cofactor
106 * @param oid an optional OID used to identify this curve
107 *
108 * @warning This constructor is deprecated and will be removed in Botan 4
109 *
110 * @warning support for cofactors > 1 is deprecated and will be removed
111 *
112 * @warning support for prime fields > 521 bits is deprecated and
113 * will be removed.
114 *
115 * @warning Support for explicitly encoded curve parameters is deprecated.
116 * An OID must be assigned.
117 */
118 BOTAN_DEPRECATED("Use alternate constructor")
119 EC_Group(const BigInt& p,
120 const BigInt& a,
121 const BigInt& b,
122 const BigInt& base_x,
123 const BigInt& base_y,
124 const BigInt& order,
125 const BigInt& cofactor,
126 const OID& oid = OID());
127
128 /**
129 * Construct elliptic curve from the specified parameters
130 *
131 * This is used for example to create custom (application-specific) curves.
132 *
133 * Some build configurations do not support application specific curves, in
134 * which case this constructor will throw an exception. You can check for
135 * this situation beforehand using the function
136 * EC_Group::supports_application_specific_group()
137 *
138 * Unlike the deprecated constructor, this constructor imposes additional
139 * restrictions on the parameters, namely:
140 *
141 * - An object identifier must be provided
142 *
143 * - The prime must be at least 192 bits and at most 512 bits, and a multiple
144 * of 32 bits. Currently, as long as BOTAN_DISABLE_DEPRECATED_FEATURES is not
145 * set, this constructor accepts primes as small as 128 bits - this lower
146 * bound will be removed in the next major release.
147 *
148 * - As an extension of the above restriction, the prime can also be exactly
149 * the 521-bit Mersenne prime (2**521-1) or exactly the 239-bit prime used in
150 * X9.62 239 bit groups (2**239 - 2**143 - 2**95 + 2**47 - 1)
151 *
152 * - The prime must be congruent to 3 modulo 4
153 *
154 * - The group order must have the same bit length as the prime. It is allowed
155 * for the order to be larger than p, but they must have the same bit length.
156 *
157 * - Only prime order curves (with cofactor == 1) are allowed
158 *
159 * @warning use only elliptic curve parameters that you trust
160 *
161 * @param oid an object identifier used to identify this curve
162 * @param p the elliptic curve prime (at most 521 bits)
163 * @param a the elliptic curve a param
164 * @param b the elliptic curve b param
165 * @param base_x the x coordinate of the group generator
166 * @param base_y the y coordinate of the group generator
167 * @param order the order of the group
168 */
169 EC_Group(const OID& oid,
170 const BigInt& p,
171 const BigInt& a,
172 const BigInt& b,
173 const BigInt& base_x,
174 const BigInt& base_y,
175 const BigInt& order);
176
177 /**
178 * Decode a BER encoded ECC domain parameter set
179 * @param ber the bytes of the BER encoding
180 */
181 explicit EC_Group(std::span<const uint8_t> ber);
182
183 BOTAN_DEPRECATED("Use EC_Group(std::span)")
184 EC_Group(const uint8_t ber[], size_t ber_len) : EC_Group(std::span{ber, ber_len}) {}
185
186 /**
187 * Create an EC domain by OID (or throw if unknown)
188 * @param oid the OID of the EC domain to create
189 */
190 BOTAN_DEPRECATED("Use EC_Group::from_OID") explicit EC_Group(const OID& oid) { *this = EC_Group::from_OID(oid); }
191
192 /**
193 * Create an EC domain from PEM encoding (as from PEM_encode()), or
194 * from an OID name (eg "secp256r1", or "1.2.840.10045.3.1.7")
195 * @param pem_or_oid PEM-encoded data, or an OID
196 *
197 * @warning Support for PEM in this function is deprecated. Use
198 * EC_Group::from_PEM or EC_Group::from_OID or EC_Group::from_name
199 */
200 BOTAN_DEPRECATED("Use EC_Group::from_{name,OID,PEM}") explicit EC_Group(std::string_view pem_or_oid);
201
202 /**
203 * Initialize an EC group from the PEM/ASN.1 encoding
204 */
205 static EC_Group from_PEM(std::string_view pem);
206
207 /**
208 * Initialize an EC group from a group named by an object identifier
209 */
210 static EC_Group from_OID(const OID& oid);
211
212 /**
213 * Initialize an EC group from a group common name (eg "secp256r1")
214 */
215 static EC_Group from_name(std::string_view name);
216
217 BOTAN_DEPRECATED("Use EC_Group::from_PEM") static EC_Group EC_Group_from_PEM(std::string_view pem) {
218 return EC_Group::from_PEM(pem);
219 }
220
221 /**
222 * Create an uninitialized EC_Group
223 */
224 BOTAN_DEPRECATED("Deprecated no replacement") EC_Group();
225
227
229 EC_Group(EC_Group&&) = default;
230
231 EC_Group& operator=(const EC_Group&);
232 EC_Group& operator=(EC_Group&&) = default;
233
234 bool initialized() const { return (m_data != nullptr); }
235
236 /**
237 * Verify EC_Group domain
238 * @returns true if group is valid. false otherwise
239 */
240 bool verify_group(RandomNumberGenerator& rng, bool strong = false) const;
241
242 bool operator==(const EC_Group& other) const;
243
244 EC_Group_Source source() const;
245
246 /**
247 * Return true if in this build configuration it is possible to
248 * register an application specific elliptic curve.
249 */
250 static bool supports_application_specific_group();
251
252 /**
253 * Return true if in this build configuration EC_Group::from_name(name) will succeed
254 */
255 static bool supports_named_group(std::string_view name);
256
257 /**
258 * Return true if this EC_Group was derived from an explicit encoding
259 *
260 * Explicit encoding of groups is deprecated; when support for explicit curves
261 * is removed in a future major release, this function will also be removed.
262 */
263 bool used_explicit_encoding() const { return m_explicit_encoding; }
264
265 /**
266 * Return how this EC_Group is implemented under the hood
267 *
268 * This is mostly useful for diagnostic or debugging purposes
269 */
270 EC_Group_Engine engine() const;
271
272 /**
273 * Return a set of known named EC groups
274 *
275 * This returns the set of groups for which from_name should succeed
276 * Note that the set of included groups can vary based on the
277 * build configuration.
278 */
279 static const std::set<std::string>& known_named_groups();
280
281 /**
282 * Create the DER encoding of this domain
283 * @param form of encoding to use
284 * @returns the group information encoded as DER
285 */
286 BOTAN_DEPRECATED("Use the variant that does not take EC_Group_Encoding")
287 std::vector<uint8_t> DER_encode(EC_Group_Encoding form) const;
288
289 /**
290 * Create the DER encoding of this domain, using namedCurve format
291 * @returns the group information encoded as DER
292 */
293 std::vector<uint8_t> DER_encode() const;
294
295 /**
296 * Return the PEM encoding
297 * @return string containing PEM data
298 *
299 * @warning In Botan4 the form parameter will be removed and only
300 * namedCurve will be supported
301 *
302 * TODO(Botan4) remove the argument
303 */
304 std::string PEM_encode(EC_Group_Encoding form = EC_Group_Encoding::Explicit) const;
305
306 /**
307 * Return the size of p in bits (same as get_p().bits())
308 */
309 size_t get_p_bits() const;
310
311 /**
312 * Return the size of p in bytes (same as get_p().bytes())
313 */
314 size_t get_p_bytes() const;
315
316 /**
317 * Return the size of group order in bits (same as get_order().bits())
318 */
319 size_t get_order_bits() const;
320
321 /**
322 * Return the size of the group order in bytes (same as get_order().bytes())
323 */
324 size_t get_order_bytes() const;
325
326 /// Table for computing g*x + h*y
327 class BOTAN_PUBLIC_API(3, 6) Mul2Table final {
328 public:
329 /**
330 * Create a table for computing g*x + h*y
331 */
332 Mul2Table(const EC_AffinePoint& h);
333
334 /**
335 * Return the elliptic curve point g*x + h*y
336 *
337 * Where g is the group generator and h is the value passed to the constructor
338 *
339 * Returns nullopt if g*x + h*y was the point at infinity
340 *
341 * @warning this function is variable time with respect to x and y
342 */
343 std::optional<EC_AffinePoint> mul2_vartime(const EC_Scalar& x, const EC_Scalar& y) const;
344
345 /**
346 * Check if v equals the x coordinate of g*x + h*y reduced modulo the order
347 *
348 * Where g is the group generator and h is the value passed to the constructor
349 *
350 * Returns false if unequal, including if g*x + h*y was the point at infinity
351 *
352 * @warning this function is variable time with respect to x and y
353 */
354 bool mul2_vartime_x_mod_order_eq(const EC_Scalar& v, const EC_Scalar& x, const EC_Scalar& y) const;
355
356 /**
357 * Check if v equals the x coordinate of g*x*c + h*y*c reduced modulo the order
358 *
359 * Where g is the group generator and h is the value passed to the constructor
360 *
361 * Returns false if unequal, including if g*x*c + h*y*c was the point at infinity
362 *
363 * @warning this function is variable time with respect to x and y
364 */
366 const EC_Scalar& c,
367 const EC_Scalar& x,
368 const EC_Scalar& y) const;
369
371
372 private:
373 std::unique_ptr<EC_Mul2Table_Data> m_tbl;
374 };
375
376 /**
377 * Return the OID of these domain parameters
378 * @result the OID
379 */
380 const OID& get_curve_oid() const;
381
382 /**
383 * Return the prime modulus of the field
384 */
385 const BigInt& get_p() const;
386
387 /**
388 * Return the a parameter of the elliptic curve equation
389 */
390 const BigInt& get_a() const;
391
392 /**
393 * Return the b parameter of the elliptic curve equation
394 */
395 const BigInt& get_b() const;
396
397 /**
398 * Return the x coordinate of the base point
399 */
400 const BigInt& get_g_x() const;
401
402 /**
403 * Return the y coordinate of the base point
404 */
405 const BigInt& get_g_y() const;
406
407 /**
408 * Return the order of the base point
409 * @result order of the base point
410 */
411 const BigInt& get_order() const;
412
413 /**
414 * Return the cofactor
415 * @result the cofactor
416 * TODO(Botan4): Remove this
417 */
418 const BigInt& get_cofactor() const;
419
420 /**
421 * Return true if the cofactor is > 1
422 * TODO(Botan4): Remove this
423 */
424 bool has_cofactor() const;
425
426 /*
427 * For internal use only
428 * TODO(Botan4): Move this to an internal header
429 */
430 static std::shared_ptr<EC_Group_Data> EC_group_info(const OID& oid);
431
432 /*
433 * For internal use only
434 *
435 * @warning this invalidates pointers and can cause memory corruption.
436 * This function exists only to be called in tests.
437 *
438 * TODO(Botan4): Move this to an internal header
439 */
440 static size_t clear_registered_curve_data();
441
442 /*
443 * For internal use only
444 * TODO(Botan4): Move this to an internal header
445 */
446 static OID EC_group_identity_from_order(const BigInt& order);
447
448 /*
449 * For internal use only
450 */
451 const std::shared_ptr<EC_Group_Data>& _data() const { return m_data; }
452
453#if defined(BOTAN_HAS_LEGACY_EC_POINT)
454 /**
455 * Check if y is a plausible point on the curve
456 *
457 * In particular, checks that it is a point on the curve, not infinity,
458 * and that it has order matching the group.
459 */
460 bool verify_public_element(const EC_Point& y) const;
461
462 /**
463 * OS2ECP (Octet String To Elliptic Curve Point)
464 *
465 * Deserialize an encoded point. Verifies that the point is on the curve.
466 */
467 BOTAN_DEPRECATED("Use EC_AffinePoint::deserialize") EC_Point OS2ECP(const uint8_t bits[], size_t len) const {
468 return EC_AffinePoint(*this, std::span{bits, len}).to_legacy_point();
469 }
470
471 BOTAN_DEPRECATED("Use EC_AffinePoint::deserialize")
472 EC_Point OS2ECP(std::span<const uint8_t> encoded_point) const {
473 return EC_AffinePoint(*this, encoded_point).to_legacy_point();
474 }
475
476 /**
477 * Return group base point
478 * @result base point
479 */
480 BOTAN_DEPRECATED("Use EC_AffinePoint::generator") const EC_Point& get_base_point() const;
481
482 // Everything below here will be removed in a future release:
483
484 /**
485 * Return the canonical group generator
486 * @result standard generator of the curve
487 */
488 BOTAN_DEPRECATED("Use EC_AffinePoint::generator") const EC_Point& generator() const;
489
490 /**
491 * Multi exponentiate. Not constant time.
492 * @return base_point*x + h*y
493 */
494 BOTAN_DEPRECATED("Use EC_Group::Mul2Table")
495 EC_Point point_multiply(const BigInt& x_bn, const EC_Point& h_pt, const BigInt& y_bn) const {
496 auto x = EC_Scalar::from_bigint(*this, x_bn);
497 auto y = EC_Scalar::from_bigint(*this, y_bn);
498 auto h = EC_AffinePoint(*this, h_pt);
499
500 Mul2Table gh_mul(h);
501
502 if(auto r = gh_mul.mul2_vartime(x, y)) {
503 return r->to_legacy_point();
504 } else {
505 return EC_AffinePoint::identity(*this).to_legacy_point();
506 }
507 }
508
509 /**
510 * Blinded point multiplication, attempts resistance to side channels
511 * @param k_bn the scalar
512 * @param rng a random number generator
513 * @return base_point*k
514 */
515 BOTAN_DEPRECATED("Use EC_AffinePoint and EC_Scalar")
516 EC_Point blinded_base_point_multiply(const BigInt& k_bn, RandomNumberGenerator& rng, std::vector<BigInt>&) const {
517 auto k = EC_Scalar::from_bigint(*this, k_bn);
518 auto pt = EC_AffinePoint::g_mul(k, rng);
519 return pt.to_legacy_point();
520 }
521
522 /**
523 * Blinded point multiplication, attempts resistance to side channels
524 * Returns just the x coordinate of the point
525 *
526 * @param k_bn the scalar
527 * @param rng a random number generator
528 * @return x coordinate of base_point*k
529 */
530 BOTAN_DEPRECATED("Use EC_AffinePoint and EC_Scalar")
531 BigInt blinded_base_point_multiply_x(const BigInt& k_bn, RandomNumberGenerator& rng, std::vector<BigInt>&) const {
532 auto k = EC_Scalar::from_bigint(*this, k_bn);
533 return BigInt(EC_AffinePoint::g_mul(k, rng).x_bytes());
534 }
535
536 /**
537 * Blinded point multiplication, attempts resistance to side channels
538 * @param point input point
539 * @param k_bn the scalar
540 * @param rng a random number generator
541 * @return point*k
542 */
543 BOTAN_DEPRECATED("Use EC_AffinePoint and EC_Scalar")
544 EC_Point blinded_var_point_multiply(const EC_Point& point,
545 const BigInt& k_bn,
546 RandomNumberGenerator& rng,
547 std::vector<BigInt>&) const {
548 auto k = EC_Scalar::from_bigint(*this, k_bn);
549 auto pt = EC_AffinePoint(*this, point);
550 return pt.mul(k, rng).to_legacy_point();
551 }
552
553 /**
554 * Return a random scalar ie an integer in [1,order)
555 */
556 BOTAN_DEPRECATED("Use EC_Scalar::random") BigInt random_scalar(RandomNumberGenerator& rng) const {
557 return EC_Scalar::random(*this, rng).to_bigint();
558 }
559
560 /**
561 * Hash onto the curve.
562 * For some curve types no mapping is currently available, in this
563 * case this function will throw an exception.
564 *
565 * @param hash_fn the hash function to use (typically "SHA-256" or "SHA-512")
566 * @param input the input to hash
567 * @param input_len length of input in bytes
568 * @param domain_sep a domain seperator
569 * @param domain_sep_len length of domain_sep in bytes
570 * @param random_oracle if the mapped point must be uniform (use
571 "true" here unless you know what you are doing)
572 */
573 BOTAN_DEPRECATED("Use EC_AffinePoint")
574 EC_Point hash_to_curve(std::string_view hash_fn,
575 const uint8_t input[],
576 size_t input_len,
577 const uint8_t domain_sep[],
578 size_t domain_sep_len,
579 bool random_oracle = true) const {
580 auto inp = std::span{input, input_len};
581 auto dst = std::span{domain_sep, domain_sep_len};
582
583 if(random_oracle) {
584 return EC_AffinePoint::hash_to_curve_ro(*this, hash_fn, inp, dst).to_legacy_point();
585 } else {
586 return EC_AffinePoint::hash_to_curve_nu(*this, hash_fn, inp, dst).to_legacy_point();
587 }
588 }
589
590 /**
591 * Hash onto the curve.
592 * For some curve types no mapping is currently available, in this
593 * case this function will throw an exception.
594 *
595 * @param hash_fn the hash function to use (typically "SHA-256" or "SHA-512")
596 * @param input the input to hash
597 * @param input_len length of input in bytes
598 * @param domain_sep a domain seperator
599 * @param random_oracle if the mapped point must be uniform (use
600 "true" here unless you know what you are doing)
601 */
602 BOTAN_DEPRECATED("Use EC_AffinePoint")
603 EC_Point hash_to_curve(std::string_view hash_fn,
604 const uint8_t input[],
605 size_t input_len,
606 std::string_view domain_sep,
607 bool random_oracle = true) const {
608 auto inp = std::span{input, input_len};
609 auto dst = std::span{reinterpret_cast<const uint8_t*>(domain_sep.data()), domain_sep.size()};
610
611 if(random_oracle) {
612 return EC_AffinePoint::hash_to_curve_ro(*this, hash_fn, inp, dst).to_legacy_point();
613 } else {
614 return EC_AffinePoint::hash_to_curve_nu(*this, hash_fn, inp, dst).to_legacy_point();
615 }
616 }
617
618 /**
619 * Return a point on this curve with the affine values x, y
620 */
621 BOTAN_DEPRECATED("Deprecated - use EC_AffinePoint") EC_Point point(const BigInt& x, const BigInt& y) const {
622 if(auto pt = EC_AffinePoint::from_bigint_xy(*this, x, y)) {
623 return pt->to_legacy_point();
624 } else {
625 throw Decoding_Error("Invalid x/y coordinates for elliptic curve point");
626 }
627 }
628
629 /**
630 * Return the zero (or infinite) point on this curve
631 */
632 BOTAN_DEPRECATED("Deprecated no replacement") EC_Point zero_point() const {
633 return EC_AffinePoint::identity(*this).to_legacy_point();
634 }
635#endif
636
637 /**
638 * Return if a == -3 mod p
639 */
640 BOTAN_DEPRECATED("Deprecated no replacement") bool a_is_minus_3() const { return get_a() + 3 == get_p(); }
641
642 /**
643 * Return if a == 0 mod p
644 */
645 BOTAN_DEPRECATED("Deprecated no replacement") bool a_is_zero() const { return get_a().is_zero(); }
646
647 /*
648 * Reduce x modulo the order
649 */
650 BOTAN_DEPRECATED("Use EC_Scalar") BigInt mod_order(const BigInt& x) const {
651 return EC_Scalar::from_bytes_mod_order(*this, x.serialize()).to_bigint();
652 }
653
654 /*
655 * Return inverse of x modulo the order
656 */
657 BOTAN_DEPRECATED("Use EC_Scalar") BigInt inverse_mod_order(const BigInt& x) const {
658 return EC_Scalar::from_bigint(*this, x).invert().to_bigint();
659 }
660
661 /*
662 * Reduce (x*x) modulo the order
663 */
664 BOTAN_DEPRECATED("Use EC_Scalar") BigInt square_mod_order(const BigInt& x) const {
665 auto xs = EC_Scalar::from_bigint(*this, x);
666 xs.square_self();
667 return xs.to_bigint();
668 }
669
670 /*
671 * Reduce (x*y) modulo the order
672 */
673 BOTAN_DEPRECATED("Use EC_Scalar") BigInt multiply_mod_order(const BigInt& x, const BigInt& y) const {
674 auto xs = EC_Scalar::from_bigint(*this, x);
675 auto ys = EC_Scalar::from_bigint(*this, y);
676 return (xs * ys).to_bigint();
677 }
678
679 /*
680 * Reduce (x*y*z) modulo the order
681 */
682 BOTAN_DEPRECATED("Use EC_Scalar")
683 BigInt multiply_mod_order(const BigInt& x, const BigInt& y, const BigInt& z) const {
684 auto xs = EC_Scalar::from_bigint(*this, x);
685 auto ys = EC_Scalar::from_bigint(*this, y);
686 auto zs = EC_Scalar::from_bigint(*this, z);
687 return (xs * ys * zs).to_bigint();
688 }
689
690 /*
691 * Return x^3 modulo the order
692 */
693 BOTAN_DEPRECATED("Deprecated no replacement") BigInt cube_mod_order(const BigInt& x) const {
694 auto xs = EC_Scalar::from_bigint(*this, x);
695 return (xs * xs * xs).to_bigint();
696 }
697
698 BOTAN_DEPRECATED("Just serialize the point and check") size_t point_size(EC_Point_Format format) const {
699 // Hybrid and standard format are (x,y), compressed is y, +1 format byte
700 if(format == EC_Point_Format::Compressed) {
701 return (1 + get_p_bytes());
702 } else {
703 return (1 + 2 * get_p_bytes());
704 }
705 }
706
707 private:
708 static EC_Group_Data_Map& ec_group_data();
709
710 EC_Group(std::shared_ptr<EC_Group_Data>&& data);
711
712 static std::pair<std::shared_ptr<EC_Group_Data>, bool> BER_decode_EC_group(std::span<const uint8_t> ber,
713 EC_Group_Source source);
714
715 static std::shared_ptr<EC_Group_Data> load_EC_group_info(const char* p,
716 const char* a,
717 const char* b,
718 const char* g_x,
719 const char* g_y,
720 const char* order,
721 const OID& oid);
722
723 const EC_Group_Data& data() const;
724
725 // Member data
726 std::shared_ptr<EC_Group_Data> m_data;
727 bool m_explicit_encoding = false;
728};
729
730inline bool operator!=(const EC_Group& lhs, const EC_Group& rhs) {
731 return !(lhs == rhs);
732}
733
734} // namespace Botan
735
736#endif
#define BOTAN_PUBLIC_API(maj, min)
Definition api.h:19
#define BOTAN_DEPRECATED(msg)
Definition api.h:59
std::optional< EC_AffinePoint > mul2_vartime(const EC_Scalar &x, const EC_Scalar &y) const
Definition ec_group.cpp:756
Mul2Table(const EC_AffinePoint &h)
Definition ec_group.cpp:752
bool mul2_vartime_x_mod_order_eq(const EC_Scalar &v, const EC_Scalar &x, const EC_Scalar &y) const
Definition ec_group.cpp:765
bool a_is_minus_3() const
Definition ec_group.h:640
static EC_Group EC_Group_from_PEM(std::string_view pem)
Definition ec_group.h:217
static EC_Group from_PEM(std::string_view pem)
Definition ec_group.cpp:414
const BigInt & get_b() const
Definition ec_group.cpp:544
const BigInt & get_a() const
Definition ec_group.cpp:540
bool initialized() const
Definition ec_group.h:234
const BigInt & get_g_y() const
Definition ec_group.cpp:592
const BigInt & get_cofactor() const
Definition ec_group.cpp:596
BigInt mod_order(const BigInt &x) const
Definition ec_group.h:650
BigInt cube_mod_order(const BigInt &x) const
Definition ec_group.h:693
BigInt multiply_mod_order(const BigInt &x, const BigInt &y) const
Definition ec_group.h:673
bool a_is_zero() const
Definition ec_group.h:645
const BigInt & get_p() const
Definition ec_group.cpp:536
const BigInt & get_order() const
Definition ec_group.cpp:584
static EC_Group from_OID(const OID &oid)
Definition ec_group.cpp:360
static std::shared_ptr< EC_Group_Data > EC_group_info(const OID &oid)
Definition ec_named.cpp:15
const BigInt & get_g_x() const
Definition ec_group.cpp:588
bool used_explicit_encoding() const
Definition ec_group.h:263
const std::shared_ptr< EC_Group_Data > & _data() const
Definition ec_group.h:451
EC_Group(const BigInt &p, const BigInt &a, const BigInt &b, const BigInt &base_x, const BigInt &base_y, const BigInt &order, const BigInt &cofactor, const OID &oid=OID())
Definition ec_group.cpp:419
const OID & get_curve_oid() const
Definition ec_group.cpp:604
BigInt square_mod_order(const BigInt &x) const
Definition ec_group.h:664
bool has_cofactor() const
Definition ec_group.cpp:600
static size_t clear_registered_curve_data()
Definition ec_group.cpp:187
BigInt inverse_mod_order(const BigInt &x) const
Definition ec_group.h:657
size_t point_size(EC_Point_Format format) const
Definition ec_group.h:698
size_t get_p_bytes() const
Definition ec_group.cpp:524
static OID EC_group_identity_from_order(const BigInt &order)
Definition ec_named.cpp:356
static EC_Scalar from_bigint(const EC_Group &group, const BigInt &bn)
Definition ec_scalar.cpp:65
static EC_Scalar from_bytes_mod_order(const EC_Group &group, std::span< const uint8_t > bytes)
Definition ec_scalar.cpp:49
EC_Group_Source
Definition ec_group.h:56
EC_Group_Engine
Definition ec_group.h:66
@ Optimized
Using per curve implementation; fastest available.
Definition ec_group.h:68
@ Generic
A generic implementation that handles many curves in one implementation.
Definition ec_group.h:70
bool operator!=(const AlgorithmIdentifier &a1, const AlgorithmIdentifier &a2)
Definition alg_id.cpp:69
bool operator==(const AlgorithmIdentifier &a1, const AlgorithmIdentifier &a2)
Definition alg_id.cpp:54
EC_Group_Encoding
Definition ec_group.h:36
EC_Point OS2ECP(std::span< const uint8_t > data, const CurveGFp &curve)
Definition ec_point.cpp:846