• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /* Originally written by Bodo Moeller and Nils Larsch for the OpenSSL project.
2  * ====================================================================
3  * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  *
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in
14  *    the documentation and/or other materials provided with the
15  *    distribution.
16  *
17  * 3. All advertising materials mentioning features or use of this
18  *    software must display the following acknowledgment:
19  *    "This product includes software developed by the OpenSSL Project
20  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
21  *
22  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
23  *    endorse or promote products derived from this software without
24  *    prior written permission. For written permission, please contact
25  *    openssl-core@openssl.org.
26  *
27  * 5. Products derived from this software may not be called "OpenSSL"
28  *    nor may "OpenSSL" appear in their names without prior written
29  *    permission of the OpenSSL Project.
30  *
31  * 6. Redistributions of any form whatsoever must retain the following
32  *    acknowledgment:
33  *    "This product includes software developed by the OpenSSL Project
34  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
35  *
36  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
37  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
39  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
40  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
41  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
42  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
43  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
45  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
46  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
47  * OF THE POSSIBILITY OF SUCH DAMAGE.
48  * ====================================================================
49  *
50  * This product includes cryptographic software written by Eric Young
51  * (eay@cryptsoft.com).  This product includes software written by Tim
52  * Hudson (tjh@cryptsoft.com).
53  *
54  */
55 /* ====================================================================
56  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
57  *
58  * Portions of the attached software ("Contribution") are developed by
59  * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
60  *
61  * The Contribution is licensed pursuant to the OpenSSL open source
62  * license provided above.
63  *
64  * The elliptic curve binary polynomial software is originally written by
65  * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems
66  * Laboratories. */
67 
68 #include <openssl/ec.h>
69 
70 #include <openssl/bn.h>
71 #include <openssl/err.h>
72 #include <openssl/mem.h>
73 
74 #include "../bn/internal.h"
75 #include "../delocate.h"
76 #include "internal.h"
77 
78 
ec_GFp_mont_group_init(EC_GROUP * group)79 int ec_GFp_mont_group_init(EC_GROUP *group) {
80   int ok;
81 
82   ok = ec_GFp_simple_group_init(group);
83   group->mont = NULL;
84   return ok;
85 }
86 
ec_GFp_mont_group_finish(EC_GROUP * group)87 void ec_GFp_mont_group_finish(EC_GROUP *group) {
88   BN_MONT_CTX_free(group->mont);
89   group->mont = NULL;
90   ec_GFp_simple_group_finish(group);
91 }
92 
ec_GFp_mont_group_set_curve(EC_GROUP * group,const BIGNUM * p,const BIGNUM * a,const BIGNUM * b,BN_CTX * ctx)93 int ec_GFp_mont_group_set_curve(EC_GROUP *group, const BIGNUM *p,
94                                 const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
95   BN_CTX *new_ctx = NULL;
96   int ret = 0;
97 
98   BN_MONT_CTX_free(group->mont);
99   group->mont = NULL;
100 
101   if (ctx == NULL) {
102     ctx = new_ctx = BN_CTX_new();
103     if (ctx == NULL) {
104       return 0;
105     }
106   }
107 
108   group->mont = BN_MONT_CTX_new_for_modulus(p, ctx);
109   if (group->mont == NULL) {
110     OPENSSL_PUT_ERROR(EC, ERR_R_BN_LIB);
111     goto err;
112   }
113 
114   ret = ec_GFp_simple_group_set_curve(group, p, a, b, ctx);
115 
116   if (!ret) {
117     BN_MONT_CTX_free(group->mont);
118     group->mont = NULL;
119   }
120 
121 err:
122   BN_CTX_free(new_ctx);
123   return ret;
124 }
125 
ec_GFp_mont_felem_to_montgomery(const EC_GROUP * group,EC_FELEM * out,const EC_FELEM * in)126 static void ec_GFp_mont_felem_to_montgomery(const EC_GROUP *group,
127                                             EC_FELEM *out, const EC_FELEM *in) {
128   bn_to_montgomery_small(out->words, in->words, group->field.width,
129                          group->mont);
130 }
131 
ec_GFp_mont_felem_from_montgomery(const EC_GROUP * group,EC_FELEM * out,const EC_FELEM * in)132 static void ec_GFp_mont_felem_from_montgomery(const EC_GROUP *group,
133                                               EC_FELEM *out,
134                                               const EC_FELEM *in) {
135   bn_from_montgomery_small(out->words, in->words, group->field.width,
136                            group->mont);
137 }
138 
ec_GFp_mont_felem_inv(const EC_GROUP * group,EC_FELEM * out,const EC_FELEM * a)139 static void ec_GFp_mont_felem_inv(const EC_GROUP *group, EC_FELEM *out,
140                                   const EC_FELEM *a) {
141   bn_mod_inverse_prime_mont_small(out->words, a->words, group->field.width,
142                                   group->mont);
143 }
144 
ec_GFp_mont_felem_mul(const EC_GROUP * group,EC_FELEM * r,const EC_FELEM * a,const EC_FELEM * b)145 void ec_GFp_mont_felem_mul(const EC_GROUP *group, EC_FELEM *r,
146                            const EC_FELEM *a, const EC_FELEM *b) {
147   bn_mod_mul_montgomery_small(r->words, a->words, b->words, group->field.width,
148                               group->mont);
149 }
150 
ec_GFp_mont_felem_sqr(const EC_GROUP * group,EC_FELEM * r,const EC_FELEM * a)151 void ec_GFp_mont_felem_sqr(const EC_GROUP *group, EC_FELEM *r,
152                            const EC_FELEM *a) {
153   bn_mod_mul_montgomery_small(r->words, a->words, a->words, group->field.width,
154                               group->mont);
155 }
156 
ec_GFp_mont_bignum_to_felem(const EC_GROUP * group,EC_FELEM * out,const BIGNUM * in)157 int ec_GFp_mont_bignum_to_felem(const EC_GROUP *group, EC_FELEM *out,
158                                 const BIGNUM *in) {
159   if (group->mont == NULL) {
160     OPENSSL_PUT_ERROR(EC, EC_R_NOT_INITIALIZED);
161     return 0;
162   }
163 
164   if (!bn_copy_words(out->words, group->field.width, in)) {
165     return 0;
166   }
167   ec_GFp_mont_felem_to_montgomery(group, out, out);
168   return 1;
169 }
170 
ec_GFp_mont_felem_to_bignum(const EC_GROUP * group,BIGNUM * out,const EC_FELEM * in)171 int ec_GFp_mont_felem_to_bignum(const EC_GROUP *group, BIGNUM *out,
172                                 const EC_FELEM *in) {
173   if (group->mont == NULL) {
174     OPENSSL_PUT_ERROR(EC, EC_R_NOT_INITIALIZED);
175     return 0;
176   }
177 
178   EC_FELEM tmp;
179   ec_GFp_mont_felem_from_montgomery(group, &tmp, in);
180   return bn_set_words(out, tmp.words, group->field.width);
181 }
182 
ec_GFp_mont_point_get_affine_coordinates(const EC_GROUP * group,const EC_RAW_POINT * point,EC_FELEM * x,EC_FELEM * y)183 static int ec_GFp_mont_point_get_affine_coordinates(const EC_GROUP *group,
184                                                     const EC_RAW_POINT *point,
185                                                     EC_FELEM *x, EC_FELEM *y) {
186   if (ec_GFp_simple_is_at_infinity(group, point)) {
187     OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY);
188     return 0;
189   }
190 
191   // Transform  (X, Y, Z)  into  (x, y) := (X/Z^2, Y/Z^3).
192 
193   EC_FELEM z1, z2;
194   ec_GFp_mont_felem_inv(group, &z2, &point->Z);
195   ec_GFp_mont_felem_sqr(group, &z1, &z2);
196 
197   // Instead of using |ec_GFp_mont_felem_from_montgomery| to convert the |x|
198   // coordinate and then calling |ec_GFp_mont_felem_from_montgomery| again to
199   // convert the |y| coordinate below, convert the common factor |z1| once now,
200   // saving one reduction.
201   ec_GFp_mont_felem_from_montgomery(group, &z1, &z1);
202 
203   if (x != NULL) {
204     ec_GFp_mont_felem_mul(group, x, &point->X, &z1);
205   }
206 
207   if (y != NULL) {
208     ec_GFp_mont_felem_mul(group, &z1, &z1, &z2);
209     ec_GFp_mont_felem_mul(group, y, &point->Y, &z1);
210   }
211 
212   return 1;
213 }
214 
ec_GFp_mont_add(const EC_GROUP * group,EC_RAW_POINT * out,const EC_RAW_POINT * a,const EC_RAW_POINT * b)215 void ec_GFp_mont_add(const EC_GROUP *group, EC_RAW_POINT *out,
216                      const EC_RAW_POINT *a, const EC_RAW_POINT *b) {
217   if (a == b) {
218     ec_GFp_mont_dbl(group, out, a);
219     return;
220   }
221 
222   // The method is taken from:
223   //   http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#addition-add-2007-bl
224   //
225   // Coq transcription and correctness proof:
226   // <https://github.com/davidben/fiat-crypto/blob/c7b95f62b2a54b559522573310e9b487327d219a/src/Curves/Weierstrass/Jacobian.v#L467>
227   // <https://github.com/davidben/fiat-crypto/blob/c7b95f62b2a54b559522573310e9b487327d219a/src/Curves/Weierstrass/Jacobian.v#L544>
228   EC_FELEM x_out, y_out, z_out;
229   BN_ULONG z1nz = ec_felem_non_zero_mask(group, &a->Z);
230   BN_ULONG z2nz = ec_felem_non_zero_mask(group, &b->Z);
231 
232   // z1z1 = z1z1 = z1**2
233   EC_FELEM z1z1;
234   ec_GFp_mont_felem_sqr(group, &z1z1, &a->Z);
235 
236   // z2z2 = z2**2
237   EC_FELEM z2z2;
238   ec_GFp_mont_felem_sqr(group, &z2z2, &b->Z);
239 
240   // u1 = x1*z2z2
241   EC_FELEM u1;
242   ec_GFp_mont_felem_mul(group, &u1, &a->X, &z2z2);
243 
244   // two_z1z2 = (z1 + z2)**2 - (z1z1 + z2z2) = 2z1z2
245   EC_FELEM two_z1z2;
246   ec_felem_add(group, &two_z1z2, &a->Z, &b->Z);
247   ec_GFp_mont_felem_sqr(group, &two_z1z2, &two_z1z2);
248   ec_felem_sub(group, &two_z1z2, &two_z1z2, &z1z1);
249   ec_felem_sub(group, &two_z1z2, &two_z1z2, &z2z2);
250 
251   // s1 = y1 * z2**3
252   EC_FELEM s1;
253   ec_GFp_mont_felem_mul(group, &s1, &b->Z, &z2z2);
254   ec_GFp_mont_felem_mul(group, &s1, &s1, &a->Y);
255 
256   // u2 = x2*z1z1
257   EC_FELEM u2;
258   ec_GFp_mont_felem_mul(group, &u2, &b->X, &z1z1);
259 
260   // h = u2 - u1
261   EC_FELEM h;
262   ec_felem_sub(group, &h, &u2, &u1);
263 
264   BN_ULONG xneq = ec_felem_non_zero_mask(group, &h);
265 
266   // z_out = two_z1z2 * h
267   ec_GFp_mont_felem_mul(group, &z_out, &h, &two_z1z2);
268 
269   // z1z1z1 = z1 * z1z1
270   EC_FELEM z1z1z1;
271   ec_GFp_mont_felem_mul(group, &z1z1z1, &a->Z, &z1z1);
272 
273   // s2 = y2 * z1**3
274   EC_FELEM s2;
275   ec_GFp_mont_felem_mul(group, &s2, &b->Y, &z1z1z1);
276 
277   // r = (s2 - s1)*2
278   EC_FELEM r;
279   ec_felem_sub(group, &r, &s2, &s1);
280   ec_felem_add(group, &r, &r, &r);
281 
282   BN_ULONG yneq = ec_felem_non_zero_mask(group, &r);
283 
284   // This case will never occur in the constant-time |ec_GFp_mont_mul|.
285   if (!xneq && !yneq && z1nz && z2nz) {
286     ec_GFp_mont_dbl(group, out, a);
287     return;
288   }
289 
290   // I = (2h)**2
291   EC_FELEM i;
292   ec_felem_add(group, &i, &h, &h);
293   ec_GFp_mont_felem_sqr(group, &i, &i);
294 
295   // J = h * I
296   EC_FELEM j;
297   ec_GFp_mont_felem_mul(group, &j, &h, &i);
298 
299   // V = U1 * I
300   EC_FELEM v;
301   ec_GFp_mont_felem_mul(group, &v, &u1, &i);
302 
303   // x_out = r**2 - J - 2V
304   ec_GFp_mont_felem_sqr(group, &x_out, &r);
305   ec_felem_sub(group, &x_out, &x_out, &j);
306   ec_felem_sub(group, &x_out, &x_out, &v);
307   ec_felem_sub(group, &x_out, &x_out, &v);
308 
309   // y_out = r(V-x_out) - 2 * s1 * J
310   ec_felem_sub(group, &y_out, &v, &x_out);
311   ec_GFp_mont_felem_mul(group, &y_out, &y_out, &r);
312   EC_FELEM s1j;
313   ec_GFp_mont_felem_mul(group, &s1j, &s1, &j);
314   ec_felem_sub(group, &y_out, &y_out, &s1j);
315   ec_felem_sub(group, &y_out, &y_out, &s1j);
316 
317   ec_felem_select(group, &x_out, z1nz, &x_out, &b->X);
318   ec_felem_select(group, &out->X, z2nz, &x_out, &a->X);
319   ec_felem_select(group, &y_out, z1nz, &y_out, &b->Y);
320   ec_felem_select(group, &out->Y, z2nz, &y_out, &a->Y);
321   ec_felem_select(group, &z_out, z1nz, &z_out, &b->Z);
322   ec_felem_select(group, &out->Z, z2nz, &z_out, &a->Z);
323 }
324 
ec_GFp_mont_dbl(const EC_GROUP * group,EC_RAW_POINT * r,const EC_RAW_POINT * a)325 void ec_GFp_mont_dbl(const EC_GROUP *group, EC_RAW_POINT *r,
326                      const EC_RAW_POINT *a) {
327   if (group->a_is_minus3) {
328     // The method is taken from:
329     //   http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b
330     //
331     // Coq transcription and correctness proof:
332     // <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/Jacobian.v#L93>
333     // <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/Jacobian.v#L201>
334     EC_FELEM delta, gamma, beta, ftmp, ftmp2, tmptmp, alpha, fourbeta;
335     // delta = z^2
336     ec_GFp_mont_felem_sqr(group, &delta, &a->Z);
337     // gamma = y^2
338     ec_GFp_mont_felem_sqr(group, &gamma, &a->Y);
339     // beta = x*gamma
340     ec_GFp_mont_felem_mul(group, &beta, &a->X, &gamma);
341 
342     // alpha = 3*(x-delta)*(x+delta)
343     ec_felem_sub(group, &ftmp, &a->X, &delta);
344     ec_felem_add(group, &ftmp2, &a->X, &delta);
345 
346     ec_felem_add(group, &tmptmp, &ftmp2, &ftmp2);
347     ec_felem_add(group, &ftmp2, &ftmp2, &tmptmp);
348     ec_GFp_mont_felem_mul(group, &alpha, &ftmp, &ftmp2);
349 
350     // x' = alpha^2 - 8*beta
351     ec_GFp_mont_felem_sqr(group, &r->X, &alpha);
352     ec_felem_add(group, &fourbeta, &beta, &beta);
353     ec_felem_add(group, &fourbeta, &fourbeta, &fourbeta);
354     ec_felem_add(group, &tmptmp, &fourbeta, &fourbeta);
355     ec_felem_sub(group, &r->X, &r->X, &tmptmp);
356 
357     // z' = (y + z)^2 - gamma - delta
358     ec_felem_add(group, &delta, &gamma, &delta);
359     ec_felem_add(group, &ftmp, &a->Y, &a->Z);
360     ec_GFp_mont_felem_sqr(group, &r->Z, &ftmp);
361     ec_felem_sub(group, &r->Z, &r->Z, &delta);
362 
363     // y' = alpha*(4*beta - x') - 8*gamma^2
364     ec_felem_sub(group, &r->Y, &fourbeta, &r->X);
365     ec_felem_add(group, &gamma, &gamma, &gamma);
366     ec_GFp_mont_felem_sqr(group, &gamma, &gamma);
367     ec_GFp_mont_felem_mul(group, &r->Y, &alpha, &r->Y);
368     ec_felem_add(group, &gamma, &gamma, &gamma);
369     ec_felem_sub(group, &r->Y, &r->Y, &gamma);
370   } else {
371     // The method is taken from:
372     //   http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#doubling-dbl-2007-bl
373     //
374     // Coq transcription and correctness proof:
375     // <https://github.com/davidben/fiat-crypto/blob/c7b95f62b2a54b559522573310e9b487327d219a/src/Curves/Weierstrass/Jacobian.v#L102>
376     // <https://github.com/davidben/fiat-crypto/blob/c7b95f62b2a54b559522573310e9b487327d219a/src/Curves/Weierstrass/Jacobian.v#L534>
377     EC_FELEM xx, yy, yyyy, zz;
378     ec_GFp_mont_felem_sqr(group, &xx, &a->X);
379     ec_GFp_mont_felem_sqr(group, &yy, &a->Y);
380     ec_GFp_mont_felem_sqr(group, &yyyy, &yy);
381     ec_GFp_mont_felem_sqr(group, &zz, &a->Z);
382 
383     // s = 2*((x_in + yy)^2 - xx - yyyy)
384     EC_FELEM s;
385     ec_felem_add(group, &s, &a->X, &yy);
386     ec_GFp_mont_felem_sqr(group, &s, &s);
387     ec_felem_sub(group, &s, &s, &xx);
388     ec_felem_sub(group, &s, &s, &yyyy);
389     ec_felem_add(group, &s, &s, &s);
390 
391     // m = 3*xx + a*zz^2
392     EC_FELEM m;
393     ec_GFp_mont_felem_sqr(group, &m, &zz);
394     ec_GFp_mont_felem_mul(group, &m, &group->a, &m);
395     ec_felem_add(group, &m, &m, &xx);
396     ec_felem_add(group, &m, &m, &xx);
397     ec_felem_add(group, &m, &m, &xx);
398 
399     // x_out = m^2 - 2*s
400     ec_GFp_mont_felem_sqr(group, &r->X, &m);
401     ec_felem_sub(group, &r->X, &r->X, &s);
402     ec_felem_sub(group, &r->X, &r->X, &s);
403 
404     // z_out = (y_in + z_in)^2 - yy - zz
405     ec_felem_add(group, &r->Z, &a->Y, &a->Z);
406     ec_GFp_mont_felem_sqr(group, &r->Z, &r->Z);
407     ec_felem_sub(group, &r->Z, &r->Z, &yy);
408     ec_felem_sub(group, &r->Z, &r->Z, &zz);
409 
410     // y_out = m*(s-x_out) - 8*yyyy
411     ec_felem_add(group, &yyyy, &yyyy, &yyyy);
412     ec_felem_add(group, &yyyy, &yyyy, &yyyy);
413     ec_felem_add(group, &yyyy, &yyyy, &yyyy);
414     ec_felem_sub(group, &r->Y, &s, &r->X);
415     ec_GFp_mont_felem_mul(group, &r->Y, &r->Y, &m);
416     ec_felem_sub(group, &r->Y, &r->Y, &yyyy);
417   }
418 }
419 
ec_GFp_mont_cmp_x_coordinate(const EC_GROUP * group,const EC_RAW_POINT * p,const EC_SCALAR * r)420 static int ec_GFp_mont_cmp_x_coordinate(const EC_GROUP *group,
421                                         const EC_RAW_POINT *p,
422                                         const EC_SCALAR *r) {
423   if (!group->field_greater_than_order ||
424       group->field.width != group->order.width) {
425     // Do not bother optimizing this case. p > order in all commonly-used
426     // curves.
427     return ec_GFp_simple_cmp_x_coordinate(group, p, r);
428   }
429 
430   if (ec_GFp_simple_is_at_infinity(group, p)) {
431     return 0;
432   }
433 
434   // We wish to compare X/Z^2 with r. This is equivalent to comparing X with
435   // r*Z^2. Note that X and Z are represented in Montgomery form, while r is
436   // not.
437   EC_FELEM r_Z2, Z2_mont, X;
438   ec_GFp_mont_felem_mul(group, &Z2_mont, &p->Z, &p->Z);
439   // r < order < p, so this is valid.
440   OPENSSL_memcpy(r_Z2.words, r->words, group->field.width * sizeof(BN_ULONG));
441   ec_GFp_mont_felem_mul(group, &r_Z2, &r_Z2, &Z2_mont);
442   ec_GFp_mont_felem_from_montgomery(group, &X, &p->X);
443 
444   if (ec_felem_equal(group, &r_Z2, &X)) {
445     return 1;
446   }
447 
448   // During signing the x coefficient is reduced modulo the group order.
449   // Therefore there is a small possibility, less than 1/2^128, that group_order
450   // < p.x < P. in that case we need not only to compare against |r| but also to
451   // compare against r+group_order.
452   if (bn_less_than_words(r->words, group->field_minus_order.words,
453                          group->field.width)) {
454     // We can ignore the carry because: r + group_order < p < 2^256.
455     bn_add_words(r_Z2.words, r->words, group->order.d, group->field.width);
456     ec_GFp_mont_felem_mul(group, &r_Z2, &r_Z2, &Z2_mont);
457     if (ec_felem_equal(group, &r_Z2, &X)) {
458       return 1;
459     }
460   }
461 
462   return 0;
463 }
464 
DEFINE_METHOD_FUNCTION(EC_METHOD,EC_GFp_mont_method)465 DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_mont_method) {
466   out->group_init = ec_GFp_mont_group_init;
467   out->group_finish = ec_GFp_mont_group_finish;
468   out->group_set_curve = ec_GFp_mont_group_set_curve;
469   out->point_get_affine_coordinates = ec_GFp_mont_point_get_affine_coordinates;
470   out->add = ec_GFp_mont_add;
471   out->dbl = ec_GFp_mont_dbl;
472   out->mul = ec_GFp_mont_mul;
473   out->mul_public = ec_GFp_mont_mul_public;
474   out->felem_mul = ec_GFp_mont_felem_mul;
475   out->felem_sqr = ec_GFp_mont_felem_sqr;
476   out->bignum_to_felem = ec_GFp_mont_bignum_to_felem;
477   out->felem_to_bignum = ec_GFp_mont_felem_to_bignum;
478   out->scalar_inv_montgomery = ec_simple_scalar_inv_montgomery;
479   out->scalar_inv_montgomery_vartime = ec_GFp_simple_mont_inv_mod_ord_vartime;
480   out->cmp_x_coordinate = ec_GFp_mont_cmp_x_coordinate;
481 }
482