7#ifndef BOTAN_PCURVES_WRAP_H_
8#define BOTAN_PCURVES_WRAP_H_
10#include <botan/internal/pcurves.h>
11#include <botan/internal/pcurves_impl.h>
17 { C::scalar_invert(s) } -> std::same_as<typename C::Scalar>;
36 size_t order_bits()
const override {
return C::OrderBits; }
43 return stash(m_mul_by_g.mul(from_stash(scalar), rng));
47 auto tbl = WindowedMulTable<C, VarPointWindowBits>(from_stash(pt));
48 return stash(tbl.mul(from_stash(scalar), rng));
54 auto tbl = WindowedMulTable<C, VarPointWindowBits>(from_stash(pt));
55 auto pt_x = to_affine_x<C>(tbl.mul(from_stash(scalar), rng));
57 pt_x.serialize_to(std::span<uint8_t, C::FieldElement::BYTES>{x_bytes});
63 const auto&
table()
const {
return m_table; }
69 WindowedMul2Table<C, Mul2PrecompWindowBits> m_table;
74 return std::make_unique<PrecomputedMul2TableC>(from_stash(p), from_stash(q));
78 return std::make_unique<PrecomputedMul2TableC>(C::G, from_stash(q));
83 const Scalar& y)
const override {
86 auto pt = table.
table().mul2_vartime(from_stash(x), from_stash(y));
87 if(pt.is_identity().as_bool()) {
92 }
catch(std::bad_cast&) {
102 WindowedMul2Table<C, Mul2WindowBits> tbl(from_stash(p), from_stash(q));
103 auto pt = tbl.mul2(from_stash(x), from_stash(y), rng);
104 if(pt.is_identity().as_bool()) {
114 const Scalar& y)
const override {
117 const auto pt = table.
table().mul2_vartime(from_stash(x), from_stash(y));
119 if(pt.is_identity().as_bool()) {
136 const auto z2 = pt.z().square();
138 std::array<uint8_t, C::Scalar::BYTES> v_bytes;
139 from_stash(v).serialize_to(v_bytes);
141 if(
const auto fe_v = C::FieldElement::deserialize(v_bytes)) {
142 if((*fe_v * z2 == pt.x()).as_bool()) {
157 if constexpr(C::OrderIsLessThanField) {
172 const auto n = C::FieldElement::from_words(C::NW);
173 const auto neg_n = n.negate().to_words();
175 const auto vw = fe_v->to_words();
176 if(
bigint_ct_is_lt(vw.data(), vw.size(), neg_n.data(), neg_n.size()).as_bool()) {
177 return (((*fe_v + n) * z2) == pt.x()).as_bool();
183 }
catch(std::bad_cast&) {
189 auto pt = m_mul_by_g.mul(from_stash(scalar), rng);
190 std::array<uint8_t, C::FieldElement::BYTES> x_bytes;
191 to_affine_x<C>(pt).serialize_to(std::span{x_bytes});
193 return stash(C::Scalar::from_wide_bytes(std::span<const uint8_t, C::FieldElement::BYTES>{x_bytes}));
199 return stash(to_affine<C>(from_stash(pt)));
203 return stash(C::ProjectivePoint::from_affine(from_stash(pt)));
209 return stash(from_stash(a) + from_stash(
b));
213 return stash(from_stash(a) + from_stash(
b));
219 return from_stash(pt).is_identity().as_bool();
223 BOTAN_ARG_CHECK(bytes.size() == C::AffinePoint::BYTES,
"Invalid length for serialize_point");
224 from_stash(pt).serialize_to(bytes.subspan<0, C::AffinePoint::BYTES>());
229 "Invalid length for serialize_point_compressed");
230 from_stash(pt).serialize_compressed_to(bytes.subspan<0, C::AffinePoint::COMPRESSED_BYTES>());
234 BOTAN_ARG_CHECK(bytes.size() == C::FieldElement::BYTES,
"Invalid length for serialize_point_x");
235 from_stash(pt).serialize_x_to(bytes.subspan<0, C::FieldElement::BYTES>());
239 BOTAN_ARG_CHECK(bytes.size() == C::Scalar::BYTES,
"Invalid length to serialize_scalar");
240 return from_stash(scalar).serialize_to(bytes.subspan<0, C::Scalar::BYTES>());
244 if(
auto scalar = C::Scalar::deserialize(bytes)) {
245 if(!scalar->is_zero().as_bool()) {
246 return stash(*scalar);
254 if(
auto s = C::Scalar::from_wide_bytes_varlen(bytes)) {
262 if(
auto pt = C::AffinePoint::deserialize(bytes)) {
270 std::span<const uint8_t> input,
271 std::span<const uint8_t> domain_sep)
const override {
272 if constexpr(C::ValidForSswuHash) {
273 return stash(hash_to_curve_sswu<C, false>(hash, input, domain_sep));
275 throw Not_Implemented(
"Hash to curve is not implemented for this curve");
280 std::span<const uint8_t> input,
281 std::span<const uint8_t> domain_sep)
const override {
282 if constexpr(C::ValidForSswuHash) {
283 return stash(hash_to_curve_sswu<C, true>(hash, input, domain_sep));
285 throw Not_Implemented(
"Hash to curve is not implemented for this curve");
290 return stash(from_stash(a) + from_stash(
b));
294 return stash(from_stash(a) - from_stash(
b));
298 return stash(from_stash(a) * from_stash(
b));
304 auto s = from_stash(ss);
306 return stash(C::scalar_invert(s));
308 return stash(s.invert());
313 auto s = from_stash(ss);
316 return stash(C::scalar_invert(s));
318 return stash(s.invert());
327 return (from_stash(a) == from_stash(
b)).as_bool();
338 static std::shared_ptr<const PrimeOrderCurve>
instance() {
339 static auto g_curve = std::make_shared<const PrimeOrderCurveImpl<C>>();
338 static std::shared_ptr<const PrimeOrderCurve>
instance() {
…}
344 static Scalar stash(
const typename C::Scalar& s) {
345 return Scalar::_create(
instance(), s.template stash_value<StorageWords>());
348 static typename C::Scalar from_stash(
const Scalar& s) {
352 return C::Scalar::from_stash(s._value());
355 static AffinePoint stash(
const typename C::AffinePoint& pt) {
356 auto x_w = pt.x().template stash_value<StorageWords>();
357 auto y_w = pt.y().template stash_value<StorageWords>();
358 return AffinePoint::_create(
instance(), x_w, y_w);
361 static typename C::AffinePoint from_stash(
const AffinePoint& pt) {
363 throw Invalid_Argument(
"Curve mismatch");
365 auto x = C::FieldElement::from_stash(pt._x());
366 auto y = C::FieldElement::from_stash(pt._y());
367 return typename C::AffinePoint(x, y);
370 static ProjectivePoint stash(
const typename C::ProjectivePoint& pt) {
371 auto x_w = pt.x().template stash_value<StorageWords>();
372 auto y_w = pt.y().template stash_value<StorageWords>();
373 auto z_w = pt.z().template stash_value<StorageWords>();
374 return ProjectivePoint::_create(
instance(), x_w, y_w, z_w);
377 static typename C::ProjectivePoint from_stash(
const ProjectivePoint& pt) {
379 throw Invalid_Argument(
"Curve mismatch");
381 auto x = C::FieldElement::from_stash(pt._x());
382 auto y = C::FieldElement::from_stash(pt._y());
383 auto z = C::FieldElement::from_stash(pt._z());
384 return typename C::ProjectivePoint(x, y, z);
388 const PrecomputedBaseMulTable<C, BasePointWindowBits> m_mul_by_g;
#define BOTAN_ARG_CHECK(expr, msg)
PrecomputedMul2TableC(const typename C::AffinePoint &x, const typename C::AffinePoint &y)
const auto & table() const
AffinePoint point_negate(const AffinePoint &pt) const override
Scalar scalar_invert(const Scalar &ss) const override
size_t field_element_bytes() const override
Scalar scalar_zero() const override
std::unique_ptr< const PrecomputedMul2Table > mul2_setup_g(const AffinePoint &q) const override
Setup a table for 2-ary multiplication where the first point is the generator.
ProjectivePoint hash_to_curve_ro(std::string_view hash, std::span< const uint8_t > input, std::span< const uint8_t > domain_sep) const override
bool scalar_equal(const Scalar &a, const Scalar &b) const override
void serialize_scalar(std::span< uint8_t > bytes, const Scalar &scalar) const override
bool affine_point_is_identity(const AffinePoint &pt) const override
Scalar scalar_sub(const Scalar &a, const Scalar &b) const override
size_t order_bits() const override
Return the bit length of the group order.
void serialize_point_x(std::span< uint8_t > bytes, const AffinePoint &pt) const override
AffinePoint generator() const override
Return the standard generator.
ProjectivePoint mul_by_g(const Scalar &scalar, RandomNumberGenerator &rng) const override
size_t scalar_bytes() const override
Return the byte length of the scalar element.
bool scalar_is_zero(const Scalar &s) const override
Scalar scalar_one() const override
static constexpr size_t Mul2WindowBits
static std::shared_ptr< const PrimeOrderCurve > instance()
std::optional< Scalar > scalar_from_wide_bytes(std::span< const uint8_t > bytes) const override
std::unique_ptr< const PrecomputedMul2Table > mul2_setup(const AffinePoint &p, const AffinePoint &q) const override
Setup a table for 2-ary multiplication.
static constexpr size_t BasePointWindowBits
Scalar base_point_mul_x_mod_order(const Scalar &scalar, RandomNumberGenerator &rng) const override
ProjectivePoint point_double(const ProjectivePoint &pt) const override
std::optional< Scalar > deserialize_scalar(std::span< const uint8_t > bytes) const override
Scalar scalar_add(const Scalar &a, const Scalar &b) const override
AffinePoint hash_to_curve_nu(std::string_view hash, std::span< const uint8_t > input, std::span< const uint8_t > domain_sep) const override
Scalar scalar_negate(const Scalar &s) const override
Scalar scalar_invert_vartime(const Scalar &ss) const override
bool mul2_vartime_x_mod_order_eq(const PrecomputedMul2Table &tableb, const Scalar &v, const Scalar &x, const Scalar &y) const override
std::optional< AffinePoint > deserialize_point(std::span< const uint8_t > bytes) const override
Scalar random_scalar(RandomNumberGenerator &rng) const override
ProjectivePoint point_add(const ProjectivePoint &a, const ProjectivePoint &b) const override
void serialize_point(std::span< uint8_t > bytes, const AffinePoint &pt) const override
Scalar scalar_square(const Scalar &s) const override
static constexpr size_t VarPointWindowBits
static constexpr size_t Mul2PrecompWindowBits
secure_vector< uint8_t > mul_x_only(const AffinePoint &pt, const Scalar &scalar, RandomNumberGenerator &rng) const override
ProjectivePoint point_to_projective(const AffinePoint &pt) const override
Scalar scalar_mul(const Scalar &a, const Scalar &b) const override
AffinePoint point_to_affine(const ProjectivePoint &pt) const override
ProjectivePoint point_add_mixed(const ProjectivePoint &a, const AffinePoint &b) const override
std::optional< ProjectivePoint > mul2_vartime(const PrecomputedMul2Table &tableb, const Scalar &x, const Scalar &y) const override
ProjectivePoint mul(const AffinePoint &pt, const Scalar &scalar, RandomNumberGenerator &rng) const override
std::optional< ProjectivePoint > mul_px_qy(const AffinePoint &p, const Scalar &x, const AffinePoint &q, const Scalar &y, RandomNumberGenerator &rng) const override
void serialize_point_compressed(std::span< uint8_t > bytes, const AffinePoint &pt) const override
static const size_t MaximumBitLength
int(* final)(unsigned char *, CTX *)
BigInt square(const BigInt &x)
constexpr auto bigint_ct_is_lt(const W x[], size_t x_size, const W y[], size_t y_size, bool lt_or_equal=false) -> CT::Mask< W >
std::vector< T, secure_allocator< T > > secure_vector