Botan 3.7.1
Crypto and TLS for C&
ec_inner_data.h
Go to the documentation of this file.
1/*
2* (C) 2024 Jack Lloyd
3*
4* Botan is released under the Simplified BSD License (see license.txt)
5*/
6
7#ifndef BOTAN_EC_INNER_DATA_H_
8#define BOTAN_EC_INNER_DATA_H_
9
10#include <botan/ec_group.h>
11
12#include <botan/asn1_obj.h>
13#include <botan/bigint.h>
14#include <botan/internal/monty.h>
15#include <botan/internal/stl_util.h>
16#include <memory>
17#include <span>
18
19#if defined(BOTAN_HAS_LEGACY_EC_POINT)
20 #include <botan/reducer.h>
21#endif
22
23namespace Botan {
24
25#if defined(BOTAN_HAS_LEGACY_EC_POINT)
26class EC_Point_Base_Point_Precompute;
27#endif
28
29namespace PCurve {
30
31class PrimeOrderCurve;
32
33}
34
35class EC_Group_Data;
36
38 public:
39 virtual ~EC_Scalar_Data() = default;
40
41 virtual const std::shared_ptr<const EC_Group_Data>& group() const = 0;
42
43 virtual size_t bytes() const = 0;
44
45 virtual std::unique_ptr<EC_Scalar_Data> clone() const = 0;
46
47 virtual bool is_zero() const = 0;
48
49 virtual bool is_eq(const EC_Scalar_Data& y) const = 0;
50
51 virtual void assign(const EC_Scalar_Data& y) = 0;
52
53 virtual void square_self() = 0;
54
55 virtual std::unique_ptr<EC_Scalar_Data> negate() const = 0;
56
57 virtual std::unique_ptr<EC_Scalar_Data> invert() const = 0;
58
59 virtual std::unique_ptr<EC_Scalar_Data> invert_vartime() const = 0;
60
61 virtual std::unique_ptr<EC_Scalar_Data> add(const EC_Scalar_Data& other) const = 0;
62
63 virtual std::unique_ptr<EC_Scalar_Data> sub(const EC_Scalar_Data& other) const = 0;
64
65 virtual std::unique_ptr<EC_Scalar_Data> mul(const EC_Scalar_Data& other) const = 0;
66
67 virtual void serialize_to(std::span<uint8_t> bytes) const = 0;
68};
69
71 public:
72 virtual ~EC_AffinePoint_Data() = default;
73
74 virtual const std::shared_ptr<const EC_Group_Data>& group() const = 0;
75
76 virtual std::unique_ptr<EC_AffinePoint_Data> clone() const = 0;
77
78 // Return size of a field element
79 virtual size_t field_element_bytes() const = 0;
80
81 // Return if this is the identity element
82 virtual bool is_identity() const = 0;
83
84 // Writes 1 field element worth of data to bytes
85 virtual void serialize_x_to(std::span<uint8_t> bytes) const = 0;
86
87 // Writes 1 field element worth of data to bytes
88 virtual void serialize_y_to(std::span<uint8_t> bytes) const = 0;
89
90 // Writes 2 field elements worth of data to bytes
91 virtual void serialize_xy_to(std::span<uint8_t> bytes) const = 0;
92
93 // Writes 1 byte + 1 field element worth of data to bytes
94 virtual void serialize_compressed_to(std::span<uint8_t> bytes) const = 0;
95
96 // Writes 1 byte + 2 field elements worth of data to bytes
97 virtual void serialize_uncompressed_to(std::span<uint8_t> bytes) const = 0;
98
99 virtual std::unique_ptr<EC_AffinePoint_Data> mul(const EC_Scalar_Data& scalar,
101 std::vector<BigInt>& ws) const = 0;
102
105 std::vector<BigInt>& ws) const = 0;
106
107#if defined(BOTAN_HAS_LEGACY_EC_POINT)
108 virtual EC_Point to_legacy_point() const = 0;
109#endif
110};
111
113 public:
114 virtual ~EC_Mul2Table_Data() = default;
115
116 // Returns nullptr if g*x + h*y was point at infinity
117 virtual std::unique_ptr<EC_AffinePoint_Data> mul2_vartime(const EC_Scalar_Data& x,
118 const EC_Scalar_Data& y) const = 0;
119
120 // Check if v == (g*x + h*y).x % n
121 //
122 // Returns false if g*x + h*y was point at infinity
124 const EC_Scalar_Data& x,
125 const EC_Scalar_Data& y) const = 0;
126};
127
128class EC_Group_Data final : public std::enable_shared_from_this<EC_Group_Data> {
129 public:
130 static std::shared_ptr<EC_Group_Data> create(const BigInt& p,
131 const BigInt& a,
132 const BigInt& b,
133 const BigInt& g_x,
134 const BigInt& g_y,
135 const BigInt& order,
136 const BigInt& cofactor,
137 const OID& oid,
139
141
142 bool params_match(const BigInt& p,
143 const BigInt& a,
144 const BigInt& b,
145 const BigInt& g_x,
146 const BigInt& g_y,
147 const BigInt& order,
148 const BigInt& cofactor) const;
149
150 bool params_match(const EC_Group_Data& other) const;
151
152 void set_oid(const OID& oid);
153
154 const OID& oid() const { return m_oid; }
155
156 const std::vector<uint8_t>& der_named_curve() const { return m_der_named_curve; }
157
158 const BigInt& p() const { return m_p; }
159
160 const BigInt& a() const { return m_a; }
161
162 const BigInt& b() const { return m_b; }
163
164 const BigInt& order() const { return m_order; }
165
166 const BigInt& cofactor() const { return m_cofactor; }
167
168#if defined(BOTAN_HAS_LEGACY_EC_POINT)
169 const CurveGFp& curve() const { return m_curve; }
170
171 const EC_Point& base_point() const { return m_base_point; }
172
173 const Montgomery_Params& monty() const { return m_monty; }
174
175 const BigInt& monty_a() const { return m_a_r; }
176
177 const BigInt& monty_b() const { return m_b_r; }
178
179 const Modular_Reducer& mod_order() const { return m_mod_order; }
180#endif
181
182 bool order_is_less_than_p() const { return m_order_is_less_than_p; }
183
184 bool has_cofactor() const { return m_has_cofactor; }
185
186 const BigInt& g_x() const { return m_g_x; }
187
188 const BigInt& g_y() const { return m_g_y; }
189
190 size_t p_words() const { return m_p_words; }
191
192 size_t p_bits() const { return m_p_bits; }
193
194 size_t p_bytes() const { return (m_p_bits + 7) / 8; }
195
196 size_t order_bits() const { return m_order_bits; }
197
198 size_t order_bytes() const { return m_order_bytes; }
199
200 bool a_is_minus_3() const { return m_a_is_minus_3; }
201
202 bool a_is_zero() const { return m_a_is_zero; }
203
204 EC_Group_Source source() const { return m_source; }
205
206 EC_Group_Engine engine() const { return m_engine; }
207
208 /// Scalar from bytes
209 ///
210 /// This returns a value only if the bytes represent (in big-endian encoding) an integer
211 /// that is less than n, where n is the group order. It requires that the fixed length
212 /// encoding (with zero prefix) be used. It also rejects inputs that encode zero.
213 /// Thus the accepted range is [1,n)
214 ///
215 /// If the input is rejected then nullptr is returned
216 std::unique_ptr<EC_Scalar_Data> scalar_deserialize(std::span<const uint8_t> bytes) const;
217
218 /// Scalar from bytes with ECDSA style trunction
219 ///
220 /// This should always succeed
221 std::unique_ptr<EC_Scalar_Data> scalar_from_bytes_with_trunc(std::span<const uint8_t> bytes) const;
222
223 /// Scalar from bytes with modular reduction
224 ///
225 /// This returns a value only if bytes represents (in big-endian encoding) an integer
226 /// that is at most the square of the scalar group size. Otherwise it returns nullptr.
227 std::unique_ptr<EC_Scalar_Data> scalar_from_bytes_mod_order(std::span<const uint8_t> bytes) const;
228
229 /// Scalar from BigInt
230 ///
231 /// This returns a value only if bn is in [1,n) where n is the group order.
232 /// Otherwise it returns nullptr
233 std::unique_ptr<EC_Scalar_Data> scalar_from_bigint(const BigInt& bn) const;
234
235 /// Return a random scalar
236 ///
237 /// This will be in the range [1,n) where n is the group order
238 std::unique_ptr<EC_Scalar_Data> scalar_random(RandomNumberGenerator& rng) const;
239
240 std::unique_ptr<EC_Scalar_Data> scalar_zero() const;
241
242 std::unique_ptr<EC_Scalar_Data> scalar_one() const;
243
244 std::unique_ptr<EC_Scalar_Data> gk_x_mod_order(const EC_Scalar_Data& scalar,
246 std::vector<BigInt>& ws) const;
247
248 /// Deserialize a point
249 ///
250 /// Returns nullptr if the point encoding was invalid or not on the curve
251 std::unique_ptr<EC_AffinePoint_Data> point_deserialize(std::span<const uint8_t> bytes) const;
252
253 std::unique_ptr<EC_AffinePoint_Data> point_hash_to_curve_ro(std::string_view hash_fn,
254 std::span<const uint8_t> input,
255 std::span<const uint8_t> domain_sep) const;
256
257 std::unique_ptr<EC_AffinePoint_Data> point_hash_to_curve_nu(std::string_view hash_fn,
258 std::span<const uint8_t> input,
259 std::span<const uint8_t> domain_sep) const;
260
261 std::unique_ptr<EC_AffinePoint_Data> point_g_mul(const EC_Scalar_Data& scalar,
263 std::vector<BigInt>& ws) const;
264
265 std::unique_ptr<EC_AffinePoint_Data> mul_px_qy(const EC_AffinePoint_Data& p,
266 const EC_Scalar_Data& x,
267 const EC_AffinePoint_Data& q,
268 const EC_Scalar_Data& y,
269 RandomNumberGenerator& rng) const;
270
271 std::unique_ptr<EC_AffinePoint_Data> affine_add(const EC_AffinePoint_Data& p, const EC_AffinePoint_Data& q) const;
272
273 std::unique_ptr<EC_AffinePoint_Data> affine_neg(const EC_AffinePoint_Data& p) const;
274
275 std::unique_ptr<EC_Mul2Table_Data> make_mul2_table(const EC_AffinePoint_Data& pt) const;
276
278 BOTAN_ASSERT_NONNULL(m_pcurve);
279 return *m_pcurve;
280 }
281
282 /**
283 * Note this constructor should *only* be called by EC_Group_Data::create.
284 *
285 * It is only public to allow use of std::make_shared
286 */
287 EC_Group_Data(const BigInt& p,
288 const BigInt& a,
289 const BigInt& b,
290 const BigInt& g_x,
291 const BigInt& g_y,
292 const BigInt& order,
293 const BigInt& cofactor,
294 const OID& oid,
296
297 private:
298 // Possibly nullptr (if pcurves not available or not a standard curve)
299 std::shared_ptr<const PCurve::PrimeOrderCurve> m_pcurve;
300
301#if defined(BOTAN_HAS_LEGACY_EC_POINT)
302 // Set only if m_pcurve is nullptr
303 std::unique_ptr<EC_Point_Base_Point_Precompute> m_base_mult;
304#endif
305
306 BigInt m_p;
307 BigInt m_a;
308 BigInt m_b;
309 BigInt m_g_x;
310 BigInt m_g_y;
311 BigInt m_order;
312 BigInt m_cofactor;
313
314#if defined(BOTAN_HAS_LEGACY_EC_POINT)
315 CurveGFp m_curve;
316 EC_Point m_base_point;
317
318 Modular_Reducer m_mod_field;
319 Modular_Reducer m_mod_order;
320
321 // Montgomery parameters (only used for legacy EC_Point)
322 Montgomery_Params m_monty;
323
324 BigInt m_a_r; // (a*r) % p
325 BigInt m_b_r; // (b*r) % p
326#endif
327
328 OID m_oid;
329 std::vector<uint8_t> m_der_named_curve;
330 size_t m_p_words;
331 size_t m_p_bits;
332 size_t m_order_bits;
333 size_t m_order_bytes;
334 bool m_a_is_minus_3;
335 bool m_a_is_zero;
336 bool m_has_cofactor;
337 bool m_order_is_less_than_p;
338 EC_Group_Source m_source;
339 EC_Group_Engine m_engine;
340};
341
342} // namespace Botan
343
344#endif
#define BOTAN_ASSERT_NONNULL(ptr)
Definition assert.h:86
virtual void serialize_compressed_to(std::span< uint8_t > bytes) const =0
virtual ~EC_AffinePoint_Data()=default
virtual void serialize_y_to(std::span< uint8_t > bytes) const =0
virtual std::unique_ptr< EC_AffinePoint_Data > clone() const =0
virtual size_t field_element_bytes() const =0
virtual void serialize_uncompressed_to(std::span< uint8_t > bytes) const =0
virtual void serialize_x_to(std::span< uint8_t > bytes) const =0
virtual secure_vector< uint8_t > mul_x_only(const EC_Scalar_Data &scalar, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const =0
virtual const std::shared_ptr< const EC_Group_Data > & group() const =0
virtual bool is_identity() const =0
virtual void serialize_xy_to(std::span< uint8_t > bytes) const =0
virtual std::unique_ptr< EC_AffinePoint_Data > mul(const EC_Scalar_Data &scalar, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const =0
const BigInt & p() const
const BigInt & g_x() const
std::unique_ptr< EC_AffinePoint_Data > affine_neg(const EC_AffinePoint_Data &p) const
std::unique_ptr< EC_Scalar_Data > gk_x_mod_order(const EC_Scalar_Data &scalar, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const
const BigInt & a() const
std::unique_ptr< EC_Scalar_Data > scalar_from_bytes_mod_order(std::span< const uint8_t > bytes) const
std::unique_ptr< EC_AffinePoint_Data > point_deserialize(std::span< const uint8_t > bytes) const
bool a_is_minus_3() const
std::unique_ptr< EC_Scalar_Data > scalar_random(RandomNumberGenerator &rng) const
std::unique_ptr< EC_Scalar_Data > scalar_zero() const
bool has_cofactor() const
std::unique_ptr< EC_Scalar_Data > scalar_deserialize(std::span< const uint8_t > bytes) const
bool params_match(const BigInt &p, const BigInt &a, const BigInt &b, const BigInt &g_x, const BigInt &g_y, const BigInt &order, const BigInt &cofactor) const
const PCurve::PrimeOrderCurve & pcurve() const
static std::shared_ptr< EC_Group_Data > create(const BigInt &p, const BigInt &a, const BigInt &b, const BigInt &g_x, const BigInt &g_y, const BigInt &order, const BigInt &cofactor, const OID &oid, EC_Group_Source source)
std::unique_ptr< EC_AffinePoint_Data > affine_add(const EC_AffinePoint_Data &p, const EC_AffinePoint_Data &q) const
EC_Group_Data(const BigInt &p, const BigInt &a, const BigInt &b, const BigInt &g_x, const BigInt &g_y, const BigInt &order, const BigInt &cofactor, const OID &oid, EC_Group_Source source)
std::unique_ptr< EC_Scalar_Data > scalar_from_bytes_with_trunc(std::span< const uint8_t > bytes) const
std::unique_ptr< EC_Mul2Table_Data > make_mul2_table(const EC_AffinePoint_Data &pt) const
std::unique_ptr< EC_AffinePoint_Data > mul_px_qy(const EC_AffinePoint_Data &p, const EC_Scalar_Data &x, const EC_AffinePoint_Data &q, const EC_Scalar_Data &y, RandomNumberGenerator &rng) const
std::unique_ptr< EC_Scalar_Data > scalar_one() const
const OID & oid() const
size_t order_bits() const
const BigInt & cofactor() const
std::unique_ptr< EC_AffinePoint_Data > point_g_mul(const EC_Scalar_Data &scalar, RandomNumberGenerator &rng, std::vector< BigInt > &ws) const
const std::vector< uint8_t > & der_named_curve() const
bool order_is_less_than_p() const
size_t p_words() const
size_t p_bytes() const
EC_Group_Source source() const
void set_oid(const OID &oid)
EC_Group_Engine engine() const
const BigInt & g_y() const
size_t order_bytes() const
std::unique_ptr< EC_Scalar_Data > scalar_from_bigint(const BigInt &bn) const
std::unique_ptr< EC_AffinePoint_Data > point_hash_to_curve_ro(std::string_view hash_fn, std::span< const uint8_t > input, std::span< const uint8_t > domain_sep) const
size_t p_bits() const
const BigInt & b() const
std::unique_ptr< EC_AffinePoint_Data > point_hash_to_curve_nu(std::string_view hash_fn, std::span< const uint8_t > input, std::span< const uint8_t > domain_sep) const
const BigInt & order() const
virtual ~EC_Mul2Table_Data()=default
virtual bool mul2_vartime_x_mod_order_eq(const EC_Scalar_Data &v, const EC_Scalar_Data &x, const EC_Scalar_Data &y) const =0
virtual std::unique_ptr< EC_AffinePoint_Data > mul2_vartime(const EC_Scalar_Data &x, const EC_Scalar_Data &y) const =0
virtual void assign(const EC_Scalar_Data &y)=0
virtual const std::shared_ptr< const EC_Group_Data > & group() const =0
virtual std::unique_ptr< EC_Scalar_Data > invert_vartime() const =0
virtual size_t bytes() const =0
virtual std::unique_ptr< EC_Scalar_Data > sub(const EC_Scalar_Data &other) const =0
virtual std::unique_ptr< EC_Scalar_Data > invert() const =0
virtual void serialize_to(std::span< uint8_t > bytes) const =0
virtual std::unique_ptr< EC_Scalar_Data > negate() const =0
virtual std::unique_ptr< EC_Scalar_Data > clone() const =0
virtual std::unique_ptr< EC_Scalar_Data > add(const EC_Scalar_Data &other) const =0
virtual void square_self()=0
virtual bool is_eq(const EC_Scalar_Data &y) const =0
virtual bool is_zero() const =0
virtual ~EC_Scalar_Data()=default
virtual std::unique_ptr< EC_Scalar_Data > mul(const EC_Scalar_Data &other) const =0
int(* final)(unsigned char *, CTX *)
EC_Group_Source
Definition ec_group.h:56
EC_Group_Engine
Definition ec_group.h:66
std::vector< T, secure_allocator< T > > secure_vector
Definition secmem.h:61