Botan 3.9.0
Crypto and TLS for C&
ec_inner_data.h
Go to the documentation of this file.
1/*
2* (C) 2024 Jack Lloyd
3*
4* Botan is released under the Simplified BSD License (see license.txt)
5*/
6
7#ifndef BOTAN_EC_INNER_DATA_H_
8#define BOTAN_EC_INNER_DATA_H_
9
10#include <botan/ec_group.h>
11
12#include <botan/asn1_obj.h>
13#include <botan/bigint.h>
14#include <botan/internal/monty.h>
15#include <botan/internal/stl_util.h>
16#include <memory>
17#include <span>
18
19#if defined(BOTAN_HAS_LEGACY_EC_POINT)
20 #include <botan/internal/barrett.h>
21#endif
22
23namespace Botan {
24
25#if defined(BOTAN_HAS_LEGACY_EC_POINT)
27#endif
28
29namespace PCurve {
30
31class PrimeOrderCurve;
32
33}
34
35class EC_Group_Data;
36
37class EC_Scalar_Data /* NOLINT(*-special-member-functions) */ {
38 public:
39 virtual ~EC_Scalar_Data() = default;
40
41 virtual const std::shared_ptr<const EC_Group_Data>& group() const = 0;
42
43 virtual size_t bytes() const = 0;
44
45 virtual std::unique_ptr<EC_Scalar_Data> clone() const = 0;
46
47 virtual bool is_zero() const = 0;
48
49 virtual bool is_eq(const EC_Scalar_Data& y) const = 0;
50
51 virtual void assign(const EC_Scalar_Data& y) = 0;
52
53 virtual void zeroize() = 0;
54
55 virtual void square_self() = 0;
56
57 virtual std::unique_ptr<EC_Scalar_Data> negate() const = 0;
58
59 virtual std::unique_ptr<EC_Scalar_Data> invert() const = 0;
60
61 virtual std::unique_ptr<EC_Scalar_Data> invert_vartime() const = 0;
62
63 virtual std::unique_ptr<EC_Scalar_Data> add(const EC_Scalar_Data& other) const = 0;
64
65 virtual std::unique_ptr<EC_Scalar_Data> sub(const EC_Scalar_Data& other) const = 0;
66
67 virtual std::unique_ptr<EC_Scalar_Data> mul(const EC_Scalar_Data& other) const = 0;
68
69 virtual void serialize_to(std::span<uint8_t> bytes) const = 0;
70};
71
72class EC_AffinePoint_Data /* NOLINT(*-special-member-functions) */ {
73 public:
74 virtual ~EC_AffinePoint_Data() = default;
75
76 virtual const std::shared_ptr<const EC_Group_Data>& group() const = 0;
77
78 virtual std::unique_ptr<EC_AffinePoint_Data> clone() const = 0;
79
80 // Return size of a field element
81 virtual size_t field_element_bytes() const = 0;
82
83 // Return if this is the identity element
84 virtual bool is_identity() const = 0;
85
86 // Writes 1 field element worth of data to bytes
87 virtual void serialize_x_to(std::span<uint8_t> bytes) const = 0;
88
89 // Writes 1 field element worth of data to bytes
90 virtual void serialize_y_to(std::span<uint8_t> bytes) const = 0;
91
92 // Writes 2 field elements worth of data to bytes
93 virtual void serialize_xy_to(std::span<uint8_t> bytes) const = 0;
94
95 // Writes 1 byte + 1 field element worth of data to bytes
96 virtual void serialize_compressed_to(std::span<uint8_t> bytes) const = 0;
97
98 // Writes 1 byte + 2 field elements worth of data to bytes
99 virtual void serialize_uncompressed_to(std::span<uint8_t> bytes) const = 0;
100
101 virtual std::unique_ptr<EC_AffinePoint_Data> mul(const EC_Scalar_Data& scalar,
102 RandomNumberGenerator& rng) const = 0;
103
105
106#if defined(BOTAN_HAS_LEGACY_EC_POINT)
107 virtual EC_Point to_legacy_point() const = 0;
108#endif
109};
110
111class EC_Mul2Table_Data /* NOLINT(*-special-member-functions) */ {
112 public:
113 virtual ~EC_Mul2Table_Data() = default;
114
115 // Returns nullptr if g*x + h*y was point at infinity
116 virtual std::unique_ptr<EC_AffinePoint_Data> mul2_vartime(const EC_Scalar_Data& x,
117 const EC_Scalar_Data& y) const = 0;
118
119 // Check if v == (g*x + h*y).x % n
120 //
121 // Returns false if g*x + h*y was point at infinity
123 const EC_Scalar_Data& x,
124 const EC_Scalar_Data& y) const = 0;
125};
126
127class EC_Group_Data final : public std::enable_shared_from_this<EC_Group_Data> {
128 public:
129 static std::shared_ptr<EC_Group_Data> create(const BigInt& p,
130 const BigInt& a,
131 const BigInt& b,
132 const BigInt& g_x,
133 const BigInt& g_y,
134 const BigInt& order,
135 const BigInt& cofactor,
136 const OID& oid,
138
140
141 EC_Group_Data(const EC_Group_Data& other) = delete;
142 EC_Group_Data(EC_Group_Data&& other) = delete;
143 EC_Group_Data& operator=(const EC_Group_Data& other) = delete;
145
146 bool params_match(const BigInt& p,
147 const BigInt& a,
148 const BigInt& b,
149 const BigInt& g_x,
150 const BigInt& g_y,
151 const BigInt& order,
152 const BigInt& cofactor) const;
153
154 bool params_match(const EC_Group_Data& other) const;
155
156 void set_oid(const OID& oid);
157
158 const OID& oid() const { return m_oid; }
159
160 const std::vector<uint8_t>& der_named_curve() const { return m_der_named_curve; }
161
162 const BigInt& p() const { return m_p; }
163
164 const BigInt& a() const { return m_a; }
165
166 const BigInt& b() const { return m_b; }
167
168 const BigInt& order() const { return m_order; }
169
170 const BigInt& cofactor() const { return m_cofactor; }
171
172#if defined(BOTAN_HAS_LEGACY_EC_POINT)
173 const CurveGFp& curve() const { return m_curve; }
174
175 const EC_Point& base_point() const { return m_base_point; }
176
177 const Montgomery_Params& monty() const { return m_monty; }
178
179 const BigInt& monty_a() const { return m_a_r; }
180
181 const BigInt& monty_b() const { return m_b_r; }
182
183 const Barrett_Reduction& mod_order() const { return m_mod_order; }
184#endif
185
186 bool order_is_less_than_p() const { return m_order_is_less_than_p; }
187
188 bool has_cofactor() const { return m_has_cofactor; }
189
190 const BigInt& g_x() const { return m_g_x; }
191
192 const BigInt& g_y() const { return m_g_y; }
193
194 size_t p_words() const { return m_p_words; }
195
196 size_t p_bits() const { return m_p_bits; }
197
198 size_t p_bytes() const { return (m_p_bits + 7) / 8; }
199
200 size_t order_bits() const { return m_order_bits; }
201
202 size_t order_bytes() const { return m_order_bytes; }
203
204 bool a_is_minus_3() const { return m_a_is_minus_3; }
205
206 bool a_is_zero() const { return m_a_is_zero; }
207
208 EC_Group_Source source() const { return m_source; }
209
210 EC_Group_Engine engine() const { return m_engine; }
211
212 /// Scalar from bytes
213 ///
214 /// This returns a value only if the bytes represent (in big-endian encoding) an integer
215 /// that is less than n, where n is the group order. It requires that the fixed length
216 /// encoding (with zero prefix) be used. It also rejects inputs that encode zero.
217 /// Thus the accepted range is [1,n)
218 ///
219 /// If the input is rejected then nullptr is returned
220 std::unique_ptr<EC_Scalar_Data> scalar_deserialize(std::span<const uint8_t> bytes) const;
221
222 /// Scalar from bytes with ECDSA style trunction
223 ///
224 /// This should always succeed
225 std::unique_ptr<EC_Scalar_Data> scalar_from_bytes_with_trunc(std::span<const uint8_t> bytes) const;
226
227 /// Scalar from bytes with modular reduction
228 ///
229 /// This returns a value only if bytes represents (in big-endian encoding) an integer
230 /// that is at most the square of the scalar group size. Otherwise it returns nullptr.
231 std::unique_ptr<EC_Scalar_Data> scalar_from_bytes_mod_order(std::span<const uint8_t> bytes) const;
232
233 /// Scalar from BigInt
234 ///
235 /// This returns a value only if bn is in [1,n) where n is the group order.
236 /// Otherwise it returns nullptr
237 std::unique_ptr<EC_Scalar_Data> scalar_from_bigint(const BigInt& bn) const;
238
239 /// Return a random scalar
240 ///
241 /// This will be in the range [1,n) where n is the group order
242 std::unique_ptr<EC_Scalar_Data> scalar_random(RandomNumberGenerator& rng) const;
243
244 std::unique_ptr<EC_Scalar_Data> scalar_one() const;
245
246 std::unique_ptr<EC_Scalar_Data> gk_x_mod_order(const EC_Scalar_Data& scalar, RandomNumberGenerator& rng) const;
247
248 /// Deserialize a point
249 ///
250 /// Returns nullptr if the point encoding was invalid or not on the curve
251 std::unique_ptr<EC_AffinePoint_Data> point_deserialize(std::span<const uint8_t> bytes) const;
252
253 std::unique_ptr<EC_AffinePoint_Data> point_hash_to_curve_ro(std::string_view hash_fn,
254 std::span<const uint8_t> input,
255 std::span<const uint8_t> domain_sep) const;
256
257 std::unique_ptr<EC_AffinePoint_Data> point_hash_to_curve_nu(std::string_view hash_fn,
258 std::span<const uint8_t> input,
259 std::span<const uint8_t> domain_sep) const;
260
261 std::unique_ptr<EC_AffinePoint_Data> point_g_mul(const EC_Scalar_Data& scalar, RandomNumberGenerator& rng) const;
262
263 std::unique_ptr<EC_AffinePoint_Data> mul_px_qy(const EC_AffinePoint_Data& p,
264 const EC_Scalar_Data& x,
265 const EC_AffinePoint_Data& q,
266 const EC_Scalar_Data& y,
267 RandomNumberGenerator& rng) const;
268
269 std::unique_ptr<EC_AffinePoint_Data> affine_add(const EC_AffinePoint_Data& p, const EC_AffinePoint_Data& q) const;
270
271 std::unique_ptr<EC_AffinePoint_Data> affine_neg(const EC_AffinePoint_Data& p) const;
272
273 std::unique_ptr<EC_Mul2Table_Data> make_mul2_table(const EC_AffinePoint_Data& pt) const;
274
276 BOTAN_ASSERT_NONNULL(m_pcurve);
277 return *m_pcurve;
278 }
279
280 /**
281 * Note this constructor should *only* be called by EC_Group_Data::create.
282 *
283 * It is only public to allow use of std::make_shared
284 */
285 EC_Group_Data(const BigInt& p,
286 const BigInt& a,
287 const BigInt& b,
288 const BigInt& g_x,
289 const BigInt& g_y,
290 const BigInt& order,
291 const BigInt& cofactor,
292 const OID& oid,
294
295 private:
296 // Possibly nullptr (if pcurves not available or not a standard curve)
297 std::shared_ptr<const PCurve::PrimeOrderCurve> m_pcurve;
298
299#if defined(BOTAN_HAS_LEGACY_EC_POINT)
300 // Set only if m_pcurve is nullptr
301 std::unique_ptr<EC_Point_Base_Point_Precompute> m_base_mult;
302#endif
303
304 BigInt m_p;
305 BigInt m_a;
306 BigInt m_b;
307 BigInt m_g_x;
308 BigInt m_g_y;
309 BigInt m_order;
310 BigInt m_cofactor;
311
312#if defined(BOTAN_HAS_LEGACY_EC_POINT)
313 CurveGFp m_curve;
314 EC_Point m_base_point;
315
316 Barrett_Reduction m_mod_field;
317 Barrett_Reduction m_mod_order;
318
319 // Montgomery parameters (only used for legacy EC_Point)
320 Montgomery_Params m_monty;
321
322 BigInt m_a_r; // (a*r) % p
323 BigInt m_b_r; // (b*r) % p
324#endif
325
326 OID m_oid;
327 std::vector<uint8_t> m_der_named_curve;
328 size_t m_p_words;
329 size_t m_p_bits;
330 size_t m_order_bits;
331 size_t m_order_bytes;
332 bool m_a_is_minus_3;
333 bool m_a_is_zero;
334 bool m_has_cofactor;
335 bool m_order_is_less_than_p;
336 EC_Group_Source m_source;
337 EC_Group_Engine m_engine;
338};
339
340} // namespace Botan
341
342#endif
#define BOTAN_ASSERT_NONNULL(ptr)
Definition assert.h:114
virtual void serialize_compressed_to(std::span< uint8_t > bytes) const =0
virtual ~EC_AffinePoint_Data()=default
virtual std::unique_ptr< EC_AffinePoint_Data > mul(const EC_Scalar_Data &scalar, RandomNumberGenerator &rng) const =0
virtual secure_vector< uint8_t > mul_x_only(const EC_Scalar_Data &scalar, RandomNumberGenerator &rng) const =0
virtual void serialize_y_to(std::span< uint8_t > bytes) const =0
virtual std::unique_ptr< EC_AffinePoint_Data > clone() const =0
virtual size_t field_element_bytes() const =0
virtual void serialize_uncompressed_to(std::span< uint8_t > bytes) const =0
virtual void serialize_x_to(std::span< uint8_t > bytes) const =0
virtual const std::shared_ptr< const EC_Group_Data > & group() const =0
virtual bool is_identity() const =0
virtual void serialize_xy_to(std::span< uint8_t > bytes) const =0
std::unique_ptr< EC_Scalar_Data > gk_x_mod_order(const EC_Scalar_Data &scalar, RandomNumberGenerator &rng) const
const BigInt & p() const
const BigInt & g_x() const
std::unique_ptr< EC_AffinePoint_Data > affine_neg(const EC_AffinePoint_Data &p) const
const BigInt & a() const
std::unique_ptr< EC_Scalar_Data > scalar_from_bytes_mod_order(std::span< const uint8_t > bytes) const
std::unique_ptr< EC_AffinePoint_Data > point_deserialize(std::span< const uint8_t > bytes) const
bool a_is_minus_3() const
std::unique_ptr< EC_Scalar_Data > scalar_random(RandomNumberGenerator &rng) const
bool has_cofactor() const
std::unique_ptr< EC_Scalar_Data > scalar_deserialize(std::span< const uint8_t > bytes) const
bool params_match(const BigInt &p, const BigInt &a, const BigInt &b, const BigInt &g_x, const BigInt &g_y, const BigInt &order, const BigInt &cofactor) const
const PCurve::PrimeOrderCurve & pcurve() const
static std::shared_ptr< EC_Group_Data > create(const BigInt &p, const BigInt &a, const BigInt &b, const BigInt &g_x, const BigInt &g_y, const BigInt &order, const BigInt &cofactor, const OID &oid, EC_Group_Source source)
EC_Group_Data & operator=(EC_Group_Data &&other)=delete
std::unique_ptr< EC_AffinePoint_Data > affine_add(const EC_AffinePoint_Data &p, const EC_AffinePoint_Data &q) const
std::unique_ptr< EC_Scalar_Data > scalar_from_bytes_with_trunc(std::span< const uint8_t > bytes) const
std::unique_ptr< EC_Mul2Table_Data > make_mul2_table(const EC_AffinePoint_Data &pt) const
std::unique_ptr< EC_AffinePoint_Data > mul_px_qy(const EC_AffinePoint_Data &p, const EC_Scalar_Data &x, const EC_AffinePoint_Data &q, const EC_Scalar_Data &y, RandomNumberGenerator &rng) const
std::unique_ptr< EC_Scalar_Data > scalar_one() const
const OID & oid() const
EC_Group_Data & operator=(const EC_Group_Data &other)=delete
std::unique_ptr< EC_AffinePoint_Data > point_g_mul(const EC_Scalar_Data &scalar, RandomNumberGenerator &rng) const
size_t order_bits() const
const BigInt & cofactor() const
const std::vector< uint8_t > & der_named_curve() const
bool order_is_less_than_p() const
EC_Group_Data(EC_Group_Data &&other)=delete
EC_Group_Data(const EC_Group_Data &other)=delete
size_t p_words() const
size_t p_bytes() const
EC_Group_Source source() const
void set_oid(const OID &oid)
EC_Group_Engine engine() const
const BigInt & g_y() const
size_t order_bytes() const
std::unique_ptr< EC_Scalar_Data > scalar_from_bigint(const BigInt &bn) const
std::unique_ptr< EC_AffinePoint_Data > point_hash_to_curve_ro(std::string_view hash_fn, std::span< const uint8_t > input, std::span< const uint8_t > domain_sep) const
size_t p_bits() const
const BigInt & b() const
std::unique_ptr< EC_AffinePoint_Data > point_hash_to_curve_nu(std::string_view hash_fn, std::span< const uint8_t > input, std::span< const uint8_t > domain_sep) const
const BigInt & order() const
virtual ~EC_Mul2Table_Data()=default
virtual bool mul2_vartime_x_mod_order_eq(const EC_Scalar_Data &v, const EC_Scalar_Data &x, const EC_Scalar_Data &y) const =0
virtual std::unique_ptr< EC_AffinePoint_Data > mul2_vartime(const EC_Scalar_Data &x, const EC_Scalar_Data &y) const =0
virtual void assign(const EC_Scalar_Data &y)=0
virtual const std::shared_ptr< const EC_Group_Data > & group() const =0
virtual std::unique_ptr< EC_Scalar_Data > invert_vartime() const =0
virtual void zeroize()=0
virtual size_t bytes() const =0
virtual std::unique_ptr< EC_Scalar_Data > sub(const EC_Scalar_Data &other) const =0
virtual std::unique_ptr< EC_Scalar_Data > invert() const =0
virtual void serialize_to(std::span< uint8_t > bytes) const =0
virtual std::unique_ptr< EC_Scalar_Data > negate() const =0
virtual std::unique_ptr< EC_Scalar_Data > clone() const =0
virtual std::unique_ptr< EC_Scalar_Data > add(const EC_Scalar_Data &other) const =0
virtual void square_self()=0
virtual bool is_eq(const EC_Scalar_Data &y) const =0
virtual bool is_zero() const =0
virtual ~EC_Scalar_Data()=default
virtual std::unique_ptr< EC_Scalar_Data > mul(const EC_Scalar_Data &other) const =0
EC_Group_Engine
Definition ec_group.h:66
std::vector< T, secure_allocator< T > > secure_vector
Definition secmem.h:69
EC_Group_Source
Definition ec_group.h:56