xref: /external/tpm2/CpriECC.c

// This file was extracted from the TCG Published
// Trusted Platform Module Library
// Part 4: Supporting Routines
// Family "2.0"
// Level 00 Revision 01.16
// October 30, 2014

#include <string.h>

#include   "OsslCryptoEngine.h"

#ifdef TPM_ALG_ECC
#include   "CpriDataEcc.h"
#include   "CpriDataEcc.c"
//
//
//      Functions
//
//      _cpri__EccStartup()
//
//     This function is called at TPM Startup to initialize the crypto units.
//     In this implementation, no initialization is performed at startup but a future version may initialize the self-
//     test functions here.
//
LIB_EXPORT BOOL
_cpri__EccStartup(
    void
    )
{
    return TRUE;
}
//
//
//      _cpri__GetCurveIdByIndex()
//
//     This function returns the number of the i-th implemented curve. The normal use would be to call this
//     function with i starting at 0. When the i is greater than or equal to the number of implemented curves,
//     TPM_ECC_NONE is returned.
//
LIB_EXPORT TPM_ECC_CURVE
_cpri__GetCurveIdByIndex(
    UINT16                i
    )
{
    if(i >= ECC_CURVE_COUNT)
        return TPM_ECC_NONE;
    return eccCurves[i].curveId;
}
LIB_EXPORT UINT32
_cpri__EccGetCurveCount(
    void
    )
{
    return ECC_CURVE_COUNT;
}
//
//
//      _cpri__EccGetParametersByCurveId()
//
//     This function returns a pointer to the curve data that is associated with the indicated curveId. If there is no
//     curve with the indicated ID, the function returns NULL.
//
//
//
//
//     Return Value                      Meaning
//
//     NULL                              curve with the      indicated   TPM_ECC_CURVE    value   is   not
//                                       implemented
//     non-NULL                          pointer to the curve data
//
LIB_EXPORT const ECC_CURVE *
_cpri__EccGetParametersByCurveId(
   TPM_ECC_CURVE       curveId               // IN: the curveID
   )
{
   int          i;
   for(i = 0; i < ECC_CURVE_COUNT; i++)
   {
       if(eccCurves[i].curveId == curveId)
           return &eccCurves[i];
   }
   FAIL(FATAL_ERROR_INTERNAL);

   return NULL; // Never reached.
}
static const ECC_CURVE_DATA *
GetCurveData(
   TPM_ECC_CURVE       curveId               // IN: the curveID
   )
{
   const ECC_CURVE     *curve = _cpri__EccGetParametersByCurveId(curveId);
   return curve->curveData;
}
//
//
//      Point2B()
//
//     This function makes a TPMS_ECC_POINT from a BIGNUM EC_POINT.
//
static BOOL
Point2B(
   EC_GROUP           *group,                //   IN: group for the point
   TPMS_ECC_POINT     *p,                    //   OUT: receives the converted point
   EC_POINT           *ecP,                  //   IN: the point to convert
   INT16               size,                 //   IN: size of the coordinates
   BN_CTX             *context               //   IN: working context
   )
{
   BIGNUM             *bnX;
   BIGNUM             *bnY;
   BN_CTX_start(context);
   bnX = BN_CTX_get(context);
   bnY = BN_CTX_get(context);
   if(        bnY == NULL
        // Get the coordinate values
       || EC_POINT_get_affine_coordinates_GFp(group, ecP, bnX, bnY, context) != 1
       // Convert x
       || (!BnTo2B(&p->x.b, bnX, size))
       // Convert y
       || (!BnTo2B(&p->y.b, bnY, size))
      )
            FAIL(FATAL_ERROR_INTERNAL);
   BN_CTX_end(context);
   return TRUE;
}
//
//
//       EccCurveInit()
//
//      This function initializes the OpenSSL() group definition structure
//      This function is only used within this file.
//      It is a fatal error if groupContext is not provided.
//
//      Return Value                       Meaning
//
//      NULL                               the TPM_ECC_CURVE is not valid
//      non-NULL                           points to a structure in groupContext static EC_GROUP *
//
static EC_GROUP *
EccCurveInit(
    TPM_ECC_CURVE         curveId,             // IN: the ID of the curve
    BN_CTX               *groupContext         // IN: the context in which the group is to be
                                               //     created
    )
{
    const ECC_CURVE_DATA            *curveData = GetCurveData(curveId);
    EC_GROUP                        *group = NULL;
    EC_POINT                        *P = NULL;
    BN_CTX                          *context;
    BIGNUM                          *bnP;
    BIGNUM                          *bnA;
    BIGNUM                          *bnB;
    BIGNUM                          *bnX;
    BIGNUM                          *bnY;
    BIGNUM                          *bnN;
    BIGNUM                          *bnH;
    int                              ok = FALSE;
    // Context must be provided and curve selector must be valid
    pAssert(groupContext != NULL && curveData != NULL);
    context = BN_CTX_new();
    if(context == NULL)
        FAIL(FATAL_ERROR_ALLOCATION);
    BN_CTX_start(context);
    bnP = BN_CTX_get(context);
    bnA = BN_CTX_get(context);
    bnB = BN_CTX_get(context);
    bnX = BN_CTX_get(context);
    bnY = BN_CTX_get(context);
    bnN = BN_CTX_get(context);
    bnH = BN_CTX_get(context);
    if (bnH == NULL)
        goto Cleanup;
    // Convert the number formats
    BnFrom2B(bnP,      curveData->p);
    BnFrom2B(bnA,      curveData->a);
    BnFrom2B(bnB,      curveData->b);
    BnFrom2B(bnX,      curveData->x);
    BnFrom2B(bnY,      curveData->y);
    BnFrom2B(bnN,      curveData->n);
    BnFrom2B(bnH,      curveData->h);
   // initialize EC group, associate a generator point and initialize the point
   // from the parameter data
   ok = (   (group = EC_GROUP_new_curve_GFp(bnP, bnA, bnB, groupContext)) != NULL
         && (P = EC_POINT_new(group)) != NULL
         && EC_POINT_set_affine_coordinates_GFp(group, P, bnX, bnY, groupContext)
         && EC_GROUP_set_generator(group, P, bnN, bnH)
        );
Cleanup:
   if (!ok && group != NULL)
   {
       EC_GROUP_free(group);
       group = NULL;
   }
   if(P != NULL)
       EC_POINT_free(P);
   BN_CTX_end(context);
   BN_CTX_free(context);
   return group;
}
//
//
//       PointFrom2B()
//
//      This function sets the coordinates of an existing BN Point from a TPMS_ECC_POINT.
//
static EC_POINT *
PointFrom2B(
   EC_GROUP           *group,           //   IN:   the group for the point
   EC_POINT           *ecP,             //   IN:   an existing BN point in the group
   TPMS_ECC_POINT     *p,               //   IN:   the 2B coordinates of the point
   BN_CTX             *context          //   IN:   the BIGNUM context
   )
{
   BIGNUM             *bnX;
   BIGNUM             *bnY;
   // If the point is not allocated then just return a NULL
   if(ecP == NULL)
       return NULL;
   BN_CTX_start(context);
   bnX = BN_CTX_get(context);
   bnY = BN_CTX_get(context);
   if( // Set the coordinates of the point
         bnY == NULL
      || BN_bin2bn(p->x.t.buffer, p->x.t.size, bnX) == NULL
      || BN_bin2bn(p->y.t.buffer, p->y.t.size, bnY) == NULL
      || !EC_POINT_set_affine_coordinates_GFp(group, ecP, bnX, bnY, context)
      )
      FAIL(FATAL_ERROR_INTERNAL);
   BN_CTX_end(context);
   return ecP;
}
//
//
//       EccInitPoint2B()
//
//      This function allocates a point in the provided group and initializes it with the values in a
//      TPMS_ECC_POINT.
//
static EC_POINT *
EccInitPoint2B(
   EC_GROUP           *group,           // IN: group for the point
   TPMS_ECC_POINT     *p,               // IN: the coordinates for the point
    BN_CTX              *context                // IN: the BIGNUM context
    )
{
    EC_POINT            *ecP;
    BN_CTX_start(context);
    ecP = EC_POINT_new(group);
    if(PointFrom2B(group, ecP, p, context) == NULL)
        FAIL(FATAL_ERROR_INTERNAL);
    BN_CTX_end(context);
    return ecP;
}
//
//
//       PointMul()
//
//      This function does a point multiply and checks for the result being the point at infinity. Q = ([A]G + [B]P)
//
//      Return Value                      Meaning
//
//      CRYPT_NO_RESULT                   point is at infinity
//      CRYPT_SUCCESS                     point not at infinity
//
static CRYPT_RESULT
PointMul(
    EC_GROUP            *group,                 //      IN: group curve
    EC_POINT            *ecpQ,                  //      OUT: result
    BIGNUM              *bnA,                   //      IN: scalar for [A]G
    EC_POINT            *ecpP,                  //      IN: point for [B]P
    BIGNUM              *bnB,                   //      IN: scalar for [B]P
    BN_CTX              *context                //      IN: working context
    )
{
       if(EC_POINT_mul(group, ecpQ, bnA, ecpP, bnB, context) != 1)
            FAIL(FATAL_ERROR_INTERNAL);
        if(EC_POINT_is_at_infinity(group, ecpQ))
            return CRYPT_NO_RESULT;
        return CRYPT_SUCCESS;
}
//
//
//       GetRandomPrivate()
//
//      This function gets a random value (d) to use as a private ECC key and then qualifies the key so that it is
//      between 0 < d < n.
//      It is a fatal error if dOut or pIn is not provided or if the size of pIn is larger than MAX_ECC_KEY_BYTES
//      (the largest buffer size of a TPM2B_ECC_PARAMETER)
//
static void
GetRandomPrivate(
    TPM2B_ECC_PARAMETER            *dOut,                    // OUT: the qualified random value
    const TPM2B                    *pIn                      // IN: the maximum value for the key
    )
{
    int             i;
    BYTE           *pb;
    pAssert(pIn != NULL && dOut != NULL && pIn->size <= MAX_ECC_KEY_BYTES);
    // Set the size of the output
    dOut->t.size = pIn->size;
    // Get some random bits
    while(TRUE)
    {
        _cpri__GenerateRandom(dOut->t.size, dOut->t.buffer);
        // See if the d < n
        if(memcmp(dOut->t.buffer, pIn->buffer, pIn->size) < 0)
        {
            // dOut < n so make sure that 0 < dOut
            for(pb = dOut->t.buffer, i = dOut->t.size; i > 0; i--)
            {
                if(*pb++ != 0)
                    return;
            }
        }
    }
}
//
//
//       _cpri__EccPointMultiply
//
//      This function computes 'R := [dIn]G + [uIn]QIn. Where dIn and uIn are scalars, G and QIn are points on
//      the specified curve and G is the default generator of the curve.
//      The xOut and yOut parameters are optional and may be set to NULL if not used.
//      It is not necessary to provide uIn if QIn is specified but one of uIn and dIn must be provided. If dIn and
//      QIn are specified but uIn is not provided, then R = [dIn]QIn.
//      If the multiply produces the point at infinity, the CRYPT_NO_RESULT is returned.
//      The sizes of xOut and yOut' will be set to be the size of the degree of the curve
//      It is a fatal error if dIn and uIn are both unspecified (NULL) or if Qin or Rout is unspecified.
//
//
//
//
//      Return Value                    Meaning
//
//      CRYPT_SUCCESS                   point multiplication succeeded
//      CRYPT_POINT                     the point Qin is not on the curve
//      CRYPT_NO_RESULT                 the product point is at infinity
//
LIB_EXPORT CRYPT_RESULT
_cpri__EccPointMultiply(
   TPMS_ECC_POINT                *Rout,                  //   OUT: the product point R
   TPM_ECC_CURVE                  curveId,               //   IN: the curve to use
   TPM2B_ECC_PARAMETER           *dIn,                   //   IN: value to multiply against the
                                                         //       curve generator
   TPMS_ECC_POINT                *Qin,                   //   IN: point Q
   TPM2B_ECC_PARAMETER           *uIn                    //   IN: scalar value for the multiplier
                                                         //       of Q
   )
{
   BN_CTX                    *context;
   BIGNUM                    *bnD;
   BIGNUM                    *bnU;
   EC_GROUP                  *group;
   EC_POINT                  *R = NULL;
   EC_POINT                  *Q = NULL;
   CRYPT_RESULT               retVal = CRYPT_SUCCESS;
   // Validate that the required parameters are provided.
   pAssert((dIn != NULL || uIn != NULL) && (Qin != NULL || dIn != NULL));
   // If a point is provided for the multiply, make sure that it is on the curve
   if(Qin != NULL && !_cpri__EccIsPointOnCurve(curveId, Qin))
       return CRYPT_POINT;
   context = BN_CTX_new();
   if(context == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   BN_CTX_start(context);
   bnU = BN_CTX_get(context);
   bnD = BN_CTX_get(context);
   group = EccCurveInit(curveId, context);
   // There should be no path for getting a bad curve ID into this function.
   pAssert(group != NULL);
   // check allocations should have worked and allocate R
   if(   bnD == NULL
      || (R = EC_POINT_new(group)) == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   // If Qin is present, create the point
   if(Qin != NULL)
   {
       // Assume the size variables do not overflow. This should not happen in
       // the contexts in which this function will be called.
       assert2Bsize(Qin->x.t);
       assert2Bsize(Qin->x.t);
       Q = EccInitPoint2B(group, Qin, context);
   }
   if(dIn != NULL)
   {
       // Assume the size variables do not overflow, which should not happen in
       // the contexts that this function will be called.
       assert2Bsize(dIn->t);
        BnFrom2B(bnD, &dIn->b);
    }
    else
        bnD = NULL;
    // If uIn is specified, initialize its BIGNUM
    if(uIn != NULL)
    {
        // Assume the size variables do not overflow, which should not happen in
        // the contexts that this function will be called.
        assert2Bsize(uIn->t);
        BnFrom2B(bnU, &uIn->b);
    }
    // If uIn is not specified but Q is, then we are going to
    // do R = [d]Q
    else if(Qin != NULL)
    {
        bnU = bnD;
        bnD = NULL;
    }
    // If neither Q nor u is specified, then null this pointer
    else
        bnU = NULL;
    // Use the generator of the curve
    if((retVal = PointMul(group, R, bnD, Q, bnU, context)) == CRYPT_SUCCESS)
        Point2B(group, Rout, R, (INT16) ((EC_GROUP_get_degree(group)+7)/8), context);
    if (Q)
        EC_POINT_free(Q);
    if(R)
        EC_POINT_free(R);
    if(group)
        EC_GROUP_free(group);
    BN_CTX_end(context);
    BN_CTX_free(context);
    return retVal;
}
#if defined TPM_ALG_ECDAA || defined TPM_ALG_SM2 //%
//
//
//       ClearPoint2B()
//
//      Initialize the size values of a point
//
static void
ClearPoint2B(
    TPMS_ECC_POINT       *p                 // IN: the point
    )
{
    if(p != NULL) {
        p->x.t.size = 0;
        p->y.t.size = 0;
    }
}
//
//
//       _cpri__EccCommitCompute()
//
//      This function performs the point multiply operations required by TPM2_Commit().
//      If B or M is provided, they must be on the curve defined by curveId. This routine does not check that they
//      are on the curve and results are unpredictable if they are not.
//
//
//
//      It is a fatal error if r or d is NULL. If B is not NULL, then it is a fatal error if K and L are both NULL. If M is
//      not NULL, then it is a fatal error if E is NULL.
//
//      Return Value                       Meaning
//
//      CRYPT_SUCCESS                      computations completed normally
//      CRYPT_NO_RESULT                    if K, L or E was computed to be the point at infinity
//      CRYPT_CANCEL                       a cancel indication was asserted during this function
//
LIB_EXPORT CRYPT_RESULT
_cpri__EccCommitCompute(
    TPMS_ECC_POINT                  *K,                   //   OUT: [d]B or [r]Q
    TPMS_ECC_POINT                  *L,                   //   OUT: [r]B
    TPMS_ECC_POINT                  *E,                   //   OUT: [r]M
    TPM_ECC_CURVE                    curveId,             //   IN: the curve for the computations
    TPMS_ECC_POINT                  *M,                   //   IN: M (optional)
    TPMS_ECC_POINT                  *B,                   //   IN: B (optional)
    TPM2B_ECC_PARAMETER             *d,                   //   IN: d (required)
    TPM2B_ECC_PARAMETER             *r                    //   IN: the computed r value (required)
    )
{
    BN_CTX                    *context;
    BIGNUM                    *bnY, *bnR, *bnD;
    EC_GROUP                  *group;
    EC_POINT                  *pK = NULL, *pL = NULL, *pE = NULL, *pM = NULL, *pB = NULL;
    UINT16                     keySizeInBytes;
    CRYPT_RESULT               retVal = CRYPT_SUCCESS;
    // Validate that the required parameters are provided.
    // Note: E has to be provided if computing E := [r]Q or E := [r]M. Will do
    // E := [r]Q if both M and B are NULL.

    pAssert((r && (K || !B) && (L || !B)) || (E || (!M && B)));
    context = BN_CTX_new();
    if(context == NULL)
        FAIL(FATAL_ERROR_ALLOCATION);
    BN_CTX_start(context);
    bnR = BN_CTX_get(context);
    bnD = BN_CTX_get(context);
    bnY = BN_CTX_get(context);
    if(bnY == NULL)
        FAIL(FATAL_ERROR_ALLOCATION);
    // Initialize the output points in case they are not computed
    ClearPoint2B(K);
    ClearPoint2B(L);
    ClearPoint2B(E);
    if((group = EccCurveInit(curveId, context)) == NULL)
    {
        retVal = CRYPT_PARAMETER;
        goto Cleanup2;
    }
    keySizeInBytes = (UINT16) ((EC_GROUP_get_degree(group)+7)/8);
    // Size of the r parameter may not be zero
    pAssert((int) r->t.size > 0);
    // Convert scalars to BIGNUM
    BnFrom2B(bnR, &r->b);
   // If B is provided, compute K=[d]B and L=[r]B
   if(B != NULL)
   {
       // Size of the d parameter may not be zero
       pAssert((int) d->t.size > 0);
       BnFrom2B(bnD, &d->b);

       // Allocate the points to receive the value
       if(    (pK = EC_POINT_new(group)) == NULL
           || (pL = EC_POINT_new(group)) == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
       // need to compute K = [d]B
       // Allocate and initialize BIGNUM version of B
       pB = EccInitPoint2B(group, B, context);
        // do the math for K = [d]B
        if((retVal = PointMul(group, pK, NULL, pB, bnD, context)) != CRYPT_SUCCESS)
            goto Cleanup;
        // Convert BN K to TPM2B K
        Point2B(group, K, pK, (INT16)keySizeInBytes, context);
        // compute L= [r]B after checking for cancel
        if(_plat__IsCanceled())
        {
            retVal = CRYPT_CANCEL;
            goto Cleanup;
        }
        // compute L = [r]B
        if((retVal = PointMul(group, pL, NULL, pB, bnR, context)) != CRYPT_SUCCESS)
            goto Cleanup;
        // Convert BN L to TPM2B L
        Point2B(group, L, pL, (INT16)keySizeInBytes, context);
   }
   if(M != NULL || B == NULL)
   {
       // if this is the third point multiply, check for cancel first
       if(B != NULL && _plat__IsCanceled())
       {
           retVal = CRYPT_CANCEL;
           goto Cleanup;
       }
        // Allocate E
        if((pE = EC_POINT_new(group)) == NULL)
            FAIL(FATAL_ERROR_ALLOCATION);
        // Create BIGNUM version of M unless M is NULL
        if(M != NULL)
        {
             // M provided so initialize a BIGNUM M and compute E = [r]M
             pM = EccInitPoint2B(group, M, context);
             retVal = PointMul(group, pE, NULL, pM, bnR, context);
        }
        else
             // compute E = [r]G (this is only done if M and B are both NULL
             retVal = PointMul(group, pE, bnR, NULL, NULL, context);
        if(retVal == CRYPT_SUCCESS)
            // Convert E to 2B format
            Point2B(group, E, pE, (INT16)keySizeInBytes, context);
   }
Cleanup:
   EC_GROUP_free(group);
   if(pK != NULL) EC_POINT_free(pK);
   if(pL != NULL) EC_POINT_free(pL);
   if(pE != NULL) EC_POINT_free(pE);
   if(pM != NULL) EC_POINT_free(pM);
   if(pB != NULL) EC_POINT_free(pB);
Cleanup2:
   BN_CTX_end(context);
   BN_CTX_free(context);
   return retVal;
}
#endif //%
//
//
//       _cpri__EccIsPointOnCurve()
//
//      This function is used to test if a point is on a defined curve. It does this by checking that y^2 mod p = x^3
//      + a*x + b mod p
//      It is a fatal error if Q is not specified (is NULL).
//
//      Return Value                        Meaning
//
//      TRUE                                point is on curve
//      FALSE                               point is not on curve or curve is not supported
//
LIB_EXPORT BOOL
_cpri__EccIsPointOnCurve(
    TPM_ECC_CURVE          curveId,             // IN: the curve selector
    TPMS_ECC_POINT        *Q                    // IN: the point.
    )
{
    BN_CTX                           *context;
    BIGNUM                           *bnX;
    BIGNUM                           *bnY;
    BIGNUM                           *bnA;
    BIGNUM                           *bnB;
    BIGNUM                           *bnP;
    BIGNUM                           *bn3;
    const ECC_CURVE_DATA             *curveData = GetCurveData(curveId);
    BOOL                              retVal;
    pAssert(Q != NULL && curveData != NULL);
    if((context = BN_CTX_new()) == NULL)
        FAIL(FATAL_ERROR_ALLOCATION);
    BN_CTX_start(context);
    bnX = BN_CTX_get(context);
    bnY = BN_CTX_get(context);
    bnA = BN_CTX_get(context);
    bnB = BN_CTX_get(context);
    bn3 = BN_CTX_get(context);
    bnP = BN_CTX_get(context);
    if(bnP == NULL)
        FAIL(FATAL_ERROR_ALLOCATION);
    // Convert values
    if (    !BN_bin2bn(Q->x.t.buffer, Q->x.t.size, bnX)
         || !BN_bin2bn(Q->y.t.buffer, Q->y.t.size, bnY)
         || !BN_bin2bn(curveData->p->buffer, curveData->p->size, bnP)
         || !BN_bin2bn(curveData->a->buffer, curveData->a->size, bnA)
         || !BN_set_word(bn3, 3)
         || !BN_bin2bn(curveData->b->buffer, curveData->b->size, bnB)
       )
         FAIL(FATAL_ERROR_INTERNAL);
    // The following sequence is probably not optimal but it seems to be correct.
    // compute x^3 + a*x + b mod p
            // first, compute a*x mod p
    if(   !BN_mod_mul(bnA, bnA, bnX, bnP, context)
//
              // next, compute a*x + b mod p
         || !BN_mod_add(bnA, bnA, bnB, bnP, context)
              // next, compute X^3 mod p
         || !BN_mod_exp(bnX, bnX, bn3, bnP, context)
              // finally, compute x^3 + a*x + b mod p
         || !BN_mod_add(bnX, bnX, bnA, bnP, context)
              // then compute y^2
         || !BN_mod_mul(bnY, bnY, bnY, bnP, context)
        )
          FAIL(FATAL_ERROR_INTERNAL);
    retVal = BN_cmp(bnX, bnY) == 0;
    BN_CTX_end(context);
    BN_CTX_free(context);
    return retVal;
}
//
//
//       _cpri__GenerateKeyEcc()
//
//      This function generates an ECC key pair based on the input parameters. This routine uses KDFa() to
//      produce candidate numbers. The method is according to FIPS 186-3, section B.4.1 "GKey() Pair
//      Generation Using Extra Random Bits." According to the method in FIPS 186-3, the resulting private value
//      d should be 1 <= d < n where n is the order of the base point. In this implementation, the range of the
//      private value is further restricted to be 2^(nLen/2) <= d < n where nLen is the order of n.
//
//      EXAMPLE:         If the curve is NIST-P256, then nLen is 256 bits and d will need to be between 2^128 <= d < n
//
//      It is a fatal error if Qout, dOut, or seed is not provided (is NULL).
//
//      Return Value                         Meaning
//
//      CRYPT_PARAMETER                      the hash algorithm is not supported
//
LIB_EXPORT CRYPT_RESULT
_cpri__GenerateKeyEcc(
    TPMS_ECC_POINT                    *Qout,                  //   OUT: the public point
    TPM2B_ECC_PARAMETER               *dOut,                  //   OUT: the private scalar
    TPM_ECC_CURVE                      curveId,               //   IN: the curve identifier
    TPM_ALG_ID                         hashAlg,               //   IN: hash algorithm to use in the key
                                                              //       generation process
    TPM2B                             *seed,                  //   IN: the seed to use
    const char                        *label,                 //   IN: A label for the generation
                                                              //       process.
    TPM2B                             *extra,                 //   IN: Party 1 data for the KDF
    UINT32                            *counter                //   IN/OUT: Counter value to allow KDF
                                                              //       iteration to be propagated across
                                                              //       multiple functions
    )
{
    const ECC_CURVE_DATA              *curveData = GetCurveData(curveId);
    INT16                              keySizeInBytes;
    UINT32                             count = 0;
    CRYPT_RESULT                       retVal;
    UINT16                             hLen = _cpri__GetDigestSize(hashAlg);
    BIGNUM                            *bnNm1;          // Order of the curve minus one
    BIGNUM                            *bnD;            // the private scalar
    BN_CTX                            *context;        // the context for the BIGNUM values
    BYTE                               withExtra[MAX_ECC_KEY_BYTES + 8]; // trial key with
                                                                           //extra bits
    TPM2B_4_BYTE_VALUE                 marshaledCounter = {.t = {4}};
    UINT32                             totalBits;
    // Validate parameters (these are fatal)
   pAssert(     seed != NULL && dOut != NULL && Qout != NULL && curveData != NULL);
   // Non-fatal parameter checks.
   if(hLen <= 0)
       return CRYPT_PARAMETER;
   // allocate the local BN values
   context = BN_CTX_new();
   if(context == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   BN_CTX_start(context);
   bnNm1 = BN_CTX_get(context);
   bnD = BN_CTX_get(context);
   // The size of the input scalars is limited by the size of the size of a
   // TPM2B_ECC_PARAMETER. Make sure that it is not irrational.
   pAssert((int) curveData->n->size <= MAX_ECC_KEY_BYTES);
   if(   bnD == NULL
      || BN_bin2bn(curveData->n->buffer, curveData->n->size, bnNm1) == NULL
      || (keySizeInBytes = (INT16) BN_num_bytes(bnNm1)) > MAX_ECC_KEY_BYTES)
       FAIL(FATAL_ERROR_INTERNAL);
   // get the total number of bits
   totalBits = BN_num_bits(bnNm1) + 64;
   // Reduce bnNm1 from 'n' to 'n' - 1
   BN_sub_word(bnNm1, 1);
   // Initialize the count value
   if(counter != NULL)
       count = *counter;
   if(count == 0)
       count = 1;
   // Start search for key (should be quick)
   for(; count != 0; count++)
   {
        UINT32_TO_BYTE_ARRAY(count, marshaledCounter.t.buffer);
        _cpri__KDFa(hashAlg, seed, label, extra, &marshaledCounter.b,
                    totalBits, withExtra, NULL, FALSE);
        // Convert the result and modular reduce
        // Assume the size variables do not overflow, which should not happen in
        // the contexts that this function will be called.
        pAssert(keySizeInBytes <= MAX_ECC_KEY_BYTES);
        if (    BN_bin2bn(withExtra, keySizeInBytes+8, bnD) == NULL
             || BN_mod(bnD, bnD, bnNm1, context) != 1)
             FAIL(FATAL_ERROR_INTERNAL);
        // Add one to get 0 < d < n
        BN_add_word(bnD, 1);
        if(BnTo2B(&dOut->b, bnD, keySizeInBytes) != 1)
                FAIL(FATAL_ERROR_INTERNAL);
        // Do the point multiply to create the public portion of the key. If
        // the multiply generates the point at infinity (unlikely), do another
        // iteration.
        if(    (retVal = _cpri__EccPointMultiply(Qout, curveId, dOut, NULL, NULL))
            != CRYPT_NO_RESULT)
            break;
   }
   if(count == 0) // if counter wrapped, then the TPM should go into failure mode
       FAIL(FATAL_ERROR_INTERNAL);
   // Free up allocated BN values
   BN_CTX_end(context);
   BN_CTX_free(context);
   if(counter != NULL)
       *counter = count;
   return retVal;
}
//
//
//       _cpri__GetEphemeralEcc()
//
//      This function creates an ephemeral ECC. It is ephemeral in that is expected that the private part of the
//      key will be discarded
//
LIB_EXPORT CRYPT_RESULT
_cpri__GetEphemeralEcc(
   TPMS_ECC_POINT                *Qout,            // OUT: the public point
   TPM2B_ECC_PARAMETER           *dOut,            // OUT: the private scalar
   TPM_ECC_CURVE                  curveId          // IN: the curve for the key
   )
{
   CRYPT_RESULT                   retVal;
   const ECC_CURVE_DATA          *curveData = GetCurveData(curveId);
   pAssert(curveData != NULL);
   // Keep getting random values until one is found that doesn't create a point
   // at infinity. This will never, ever, ever, ever, ever, happen but if it does
   // we have to get a next random value.
   while(TRUE)
   {
       GetRandomPrivate(dOut, curveData->p);
        // _cpri__EccPointMultiply does not return CRYPT_ECC_POINT if no point is
        // provided. CRYPT_PARAMTER should not be returned because the curve ID
        // has to be supported. Thus the only possible error is CRYPT_NO_RESULT.
        retVal = _cpri__EccPointMultiply(Qout, curveId, dOut, NULL, NULL);
        if(retVal != CRYPT_NO_RESULT)
            return retVal; // Will return CRYPT_SUCCESS
   }
}
#ifdef TPM_ALG_ECDSA      //%
//
//
//       SignEcdsa()
//
//      This function implements the ECDSA signing algorithm. The method is described in the comments below.
//      It is a fatal error if rOut, sOut, dIn, or digest are not provided.
//
LIB_EXPORT CRYPT_RESULT
SignEcdsa(
   TPM2B_ECC_PARAMETER           *rOut,            //   OUT: r component of the signature
   TPM2B_ECC_PARAMETER           *sOut,            //   OUT: s component of the signature
   TPM_ECC_CURVE                  curveId,         //   IN: the curve used in the signature
                                                   //       process
   TPM2B_ECC_PARAMETER           *dIn,             //   IN: the private key
   TPM2B                         *digest           //   IN: the value to sign
   )
{
   BIGNUM                        *bnK;
   BIGNUM                        *bnIk;
   BIGNUM                        *bnN;
   BIGNUM                        *bnR;
//
    BIGNUM                    *bnD;
    BIGNUM                    *bnZ;
    TPM2B_ECC_PARAMETER        k;
    TPMS_ECC_POINT             R;
    BN_CTX                    *context;
    CRYPT_RESULT               retVal = CRYPT_SUCCESS;
    const ECC_CURVE_DATA      *curveData = GetCurveData(curveId);
    pAssert(rOut != NULL && sOut != NULL && dIn != NULL && digest != NULL);
    context = BN_CTX_new();
    if(context == NULL)
        FAIL(FATAL_ERROR_ALLOCATION);
    BN_CTX_start(context);
    bnN = BN_CTX_get(context);
    bnZ = BN_CTX_get(context);
    bnR = BN_CTX_get(context);
    bnD = BN_CTX_get(context);
    bnIk = BN_CTX_get(context);
    bnK = BN_CTX_get(context);
    // Assume the size variables do not overflow, which should not happen in
    // the contexts that this function will be called.
    pAssert(curveData->n->size <= MAX_ECC_PARAMETER_BYTES);
    if(   bnK == NULL
       || BN_bin2bn(curveData->n->buffer, curveData->n->size, bnN) == NULL)
        FAIL(FATAL_ERROR_INTERNAL);
//   The algorithm as described in "Suite B Implementer's Guide to FIPS 186-3(ECDSA)"
//   1. Use one of the routines in Appendix A.2 to generate (k, k^-1), a per-message
//      secret number and its inverse modulo n. Since n is prime, the
//      output will be invalid only if there is a failure in the RBG.
//   2. Compute the elliptic curve point R = [k]G = (xR, yR) using EC scalar
//      multiplication (see [Routines]), where G is the base point included in
//      the set of domain parameters.
//   3. Compute r = xR mod n. If r = 0, then return to Step 1. 1.
//   4. Use the selected hash function to compute H = Hash(M).
//   5. Convert the bit string H to an integer e as described in Appendix B.2.
//   6. Compute s = (k^-1 * (e + d * r)) mod n. If s = 0, return to Step 1.2.
//   7. Return (r, s).
    // Generate a random value k in the range 1 <= k < n
    // Want a K value that is the same size as the curve order
    k.t.size = curveData->n->size;
    while(TRUE) // This implements the loop at step 6. If s is zero, start over.
    {
        while(TRUE)
        {
            // Step 1 and 2 -- generate an ephemeral key and the modular inverse
            // of the private key.
            while(TRUE)
            {
                GetRandomPrivate(&k, curveData->n);
                  // Do the point multiply to generate a point and check to see if
                  // the point it at infinity
                  if(    _cpri__EccPointMultiply(&R, curveId, &k, NULL, NULL)
                      != CRYPT_NO_RESULT)
                      break; // can only be CRYPT_SUCCESS
              }
              // x coordinate is mod p. Make it mod n
              // Assume the size variables do not overflow, which should not happen
              // in the contexts that this function will be called.
              assert2Bsize(R.x.t);
              BN_bin2bn(R.x.t.buffer, R.x.t.size, bnR);
              BN_mod(bnR, bnR, bnN, context);
              // Make sure that it is not zero;
              if(BN_is_zero(bnR))
                  continue;
              // Make sure that a modular inverse exists
              // Assume the size variables do not overflow, which should not happen
              // in the contexts that this function will be called.
              assert2Bsize(k.t);
              BN_bin2bn(k.t.buffer, k.t.size, bnK);
              if( BN_mod_inverse(bnIk, bnK, bnN, context) != NULL)
                  break;
        }
        // Set z = leftmost bits of the digest
        // NOTE: This is implemented such that the key size needs to be
        //        an even number of bytes in length.
        if(digest->size > curveData->n->size)
        {
             // Assume the size variables do not overflow, which should not happen
             // in the contexts that this function will be called.
             pAssert(curveData->n->size <= MAX_ECC_KEY_BYTES);
             // digest is larger than n so truncate
             BN_bin2bn(digest->buffer, curveData->n->size, bnZ);
        }
        else
        {
             // Assume the size variables do not overflow, which should not happen
             // in the contexts that this function will be called.
             pAssert(digest->size <= MAX_DIGEST_SIZE);
             // digest is same or smaller than n so use it all
             BN_bin2bn(digest->buffer, digest->size, bnZ);
        }
        // Assume the size variables do not overflow, which should not happen in
        // the contexts that this function will be called.
        assert2Bsize(dIn->t);
        if(   bnZ == NULL
             // need the private scalar of the signing key
             || BN_bin2bn(dIn->t.buffer, dIn->t.size, bnD) == NULL)
              FAIL(FATAL_ERROR_INTERNAL);
        //   NOTE: When the result of an operation is going to be reduced mod x
        //   any modular multiplication is done so that the intermediate values
        //   don't get too large.
        //
        // now have inverse of K (bnIk), z (bnZ), r (bnR),      d (bnD) and n (bnN)
        // Compute s = k^-1 (z + r*d)(mod n)
            // first do d = r*d mod n
        if( !BN_mod_mul(bnD, bnR, bnD, bnN, context)
             // d = z + r * d
             || !BN_add(bnD, bnZ, bnD)
             // d = k^(-1)(z + r * d)(mod n)
             || !BN_mod_mul(bnD, bnIk, bnD, bnN, context)
             // convert to TPM2B format
             || !BnTo2B(&sOut->b, bnD, curveData->n->size)
             //   and write the modular reduced version of r
             //   NOTE: this was deferred to reduce the number of
             //   error checks.
             ||   !BnTo2B(&rOut->b, bnR, curveData->n->size))
              FAIL(FATAL_ERROR_INTERNAL);
        if(!BN_is_zero(bnD))
            break; // signature not zero so done
        // if the signature value was zero, start over
   }
   // Free up allocated BN values
   BN_CTX_end(context);
   BN_CTX_free(context);
   return retVal;
}
#endif //%
#if defined TPM_ALG_ECDAA || defined TPM_ALG_ECSCHNORR                //%
//
//
//       EcDaa()
//
//      This function is used to perform a modified Schnorr signature for ECDAA.
//      This function performs s = k + T * d mod n where
//      a) 'k is a random, or pseudo-random value used in the commit phase
//      b) T is the digest to be signed, and
//      c) d is a private key.
//      If tIn is NULL then use tOut as T
//
//      Return Value                        Meaning
//
//      CRYPT_SUCCESS                       signature created
//
static CRYPT_RESULT
EcDaa(
   TPM2B_ECC_PARAMETER              *tOut,             //   OUT: T component of the signature
   TPM2B_ECC_PARAMETER              *sOut,             //   OUT: s component of the signature
   TPM_ECC_CURVE                     curveId,          //   IN: the curve used in signing
   TPM2B_ECC_PARAMETER              *dIn,              //   IN: the private key
   TPM2B                            *tIn,              //   IN: the value to sign
   TPM2B_ECC_PARAMETER              *kIn               //   IN: a random value from commit
   )
{
   BIGNUM                           *bnN, *bnK, *bnT, *bnD;
   BN_CTX                           *context;
   const TPM2B                      *n;
   const ECC_CURVE_DATA             *curveData = GetCurveData(curveId);
   BOOL                              OK = TRUE;
   // Parameter checks
    pAssert(   sOut != NULL && dIn != NULL && tOut != NULL
            && kIn != NULL && curveData != NULL);
   // this just saves key strokes
   n = curveData->n;
   if(tIn != NULL)
       Copy2B(&tOut->b, tIn);
   // The size of dIn and kIn input scalars is limited by the size of the size
   // of a TPM2B_ECC_PARAMETER and tIn can be no larger than a digest.
   // Make sure they are within range.
   pAssert(   (int) dIn->t.size <= MAX_ECC_KEY_BYTES
           && (int) kIn->t.size <= MAX_ECC_KEY_BYTES
//
             && (int) tOut->t.size <= MAX_DIGEST_SIZE
            );
   context = BN_CTX_new();
   if(context == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   BN_CTX_start(context);
   bnN = BN_CTX_get(context);
   bnK = BN_CTX_get(context);
   bnT = BN_CTX_get(context);
   bnD = BN_CTX_get(context);
   // Check for allocation problems
   if(bnD == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   // Convert values
   if(   BN_bin2bn(n->buffer, n->size, bnN) == NULL
      || BN_bin2bn(kIn->t.buffer, kIn->t.size, bnK) == NULL
      || BN_bin2bn(dIn->t.buffer, dIn->t.size, bnD) == NULL
      || BN_bin2bn(tOut->t.buffer, tOut->t.size, bnT) == NULL)
       FAIL(FATAL_ERROR_INTERNAL);
   // Compute T = T mod n
   OK = OK && BN_mod(bnT, bnT, bnN, context);
   // compute (s = k + T * d mod n)
           //   d = T * d mod n
   OK = OK && BN_mod_mul(bnD, bnT, bnD, bnN, context) == 1;
           //   d = k + T * d mod n
   OK = OK && BN_mod_add(bnD, bnK, bnD, bnN, context) == 1;
           //   s = d
   OK = OK && BnTo2B(&sOut->b, bnD, n->size);
           //   r = T
   OK = OK && BnTo2B(&tOut->b, bnT, n->size);
   if(!OK)
       FAIL(FATAL_ERROR_INTERNAL);
   // Cleanup
   BN_CTX_end(context);
   BN_CTX_free(context);
   return CRYPT_SUCCESS;
}
#endif //%
#ifdef TPM_ALG_ECSCHNORR //%
//
//
//       Mod2B()
//
//      Function does modular reduction of TPM2B values.
//
static CRYPT_RESULT
Mod2B(
    TPM2B                *x,                 // IN/OUT: value to reduce
    const TPM2B          *n                  // IN: mod
    )
{
    int         compare;
    compare = _math__uComp(x->size, x->buffer, n->size, n->buffer);
    if(compare < 0)
        // if x < n, then mod is x
        return CRYPT_SUCCESS;
    if(compare == 0)
    {
        // if x == n then mod is 0
        x->size = 0;
        x->buffer[0] = 0;
        return CRYPT_SUCCESS;
    }
   return _math__Div(x, n, NULL, x);
}

//
//
//       SchnorrEcc()
//
//      This function is used to perform a modified Schnorr signature.
//      This function will generate a random value k and compute
//      a) (xR, yR) = [k]G
//      b) r = hash(P || xR)(mod n)
//      c) s= k + r * ds
//      d) return the tuple T, s
//
//
//
//
//      Return Value                  Meaning
//
//      CRYPT_SUCCESS                 signature created
//      CRYPT_SCHEME                  hashAlg can't produce zero-length digest
//
static CRYPT_RESULT
SchnorrEcc(
   TPM2B_ECC_PARAMETER        *rOut,               //   OUT: r component of the signature
   TPM2B_ECC_PARAMETER        *sOut,               //   OUT: s component of the signature
   TPM_ALG_ID                  hashAlg,            //   IN: hash algorithm used
   TPM_ECC_CURVE               curveId,            //   IN: the curve used in signing
   TPM2B_ECC_PARAMETER        *dIn,                //   IN: the private key
   TPM2B                      *digest,             //   IN: the digest to sign
   TPM2B_ECC_PARAMETER        *kIn                 //   IN: for testing
   )
{
   TPM2B_ECC_PARAMETER      k;
   BIGNUM                  *bnR, *bnN, *bnK, *bnT, *bnD;
   BN_CTX                  *context;
   const TPM2B             *n;
   EC_POINT                *pR = NULL;
   EC_GROUP                *group = NULL;
   CPRI_HASH_STATE          hashState;
   UINT16                   digestSize = _cpri__GetDigestSize(hashAlg);
   const ECC_CURVE_DATA    *curveData = GetCurveData(curveId);
   TPM2B_TYPE(T, MAX(MAX_DIGEST_SIZE, MAX_ECC_PARAMETER_BYTES));
   TPM2B_T                  T2b;
   BOOL                     OK = TRUE;
   // Parameter checks
   // Must have a place for the 'r' and 's' parts of the signature, a private
   // key ('d')
   pAssert(   rOut != NULL && sOut != NULL && dIn != NULL
           && digest != NULL && curveData != NULL);
   // to save key strokes
   n = curveData->n;
   // If the digest does not produce a hash, then null the signature and return
   // a failure.
   if(digestSize == 0)
   {
       rOut->t.size = 0;
       sOut->t.size = 0;
       return CRYPT_SCHEME;
   }
   // Allocate big number values
   context = BN_CTX_new();
   if(context == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   BN_CTX_start(context);
   bnR = BN_CTX_get(context);
   bnN = BN_CTX_get(context);
   bnK = BN_CTX_get(context);
   bnT = BN_CTX_get(context);
   bnD = BN_CTX_get(context);
   if(   bnD == NULL
           // initialize the group parameters
      || (group = EccCurveInit(curveId, context)) == NULL
          // allocate a local point
      || (pR = EC_POINT_new(group)) == NULL
     )
        FAIL(FATAL_ERROR_ALLOCATION);
   if(BN_bin2bn(curveData->n->buffer, curveData->n->size, bnN) == NULL)
       FAIL(FATAL_ERROR_INTERNAL);
   while(OK)
   {
// a) set k to a random value such that 1 k n-1
       if(kIn != NULL)
       {
            Copy2B(&k.b, &kIn->b); // copy input k if testing
            OK = FALSE;              // not OK to loop
       }
       else
       // If get a random value in the correct range
            GetRandomPrivate(&k, n);
        // Convert 'k' and generate pR = ['k']G
        BnFrom2B(bnK, &k.b);
// b) compute E (xE, yE) [k]G
       if(PointMul(group, pR, bnK, NULL, NULL, context) == CRYPT_NO_RESULT)
// c) if E is the point at infinity, go to a)
           continue;
// d) compute e xE (mod n)
       // Get the x coordinate of the point
       EC_POINT_get_affine_coordinates_GFp(group, pR, bnR, NULL, context);
        // make (mod n)
        BN_mod(bnR, bnR, bnN, context);
// e) if e is zero, go to a)
       if(BN_is_zero(bnR))
           continue;
        // Convert xR to a string (use T as a temp)
        BnTo2B(&T2b.b, bnR, (UINT16)(BN_num_bits(bnR)+7)/8);
// f) compute r HschemeHash(P || e) (mod n)
       _cpri__StartHash(hashAlg, FALSE, &hashState);
       _cpri__UpdateHash(&hashState, digest->size, digest->buffer);
       _cpri__UpdateHash(&hashState, T2b.t.size, T2b.t.buffer);
       if(_cpri__CompleteHash(&hashState, digestSize, T2b.b.buffer) != digestSize)
           FAIL(FATAL_ERROR_INTERNAL);
       T2b.t.size = digestSize;
       BnFrom2B(bnT, &T2b.b);
       BN_div(NULL, bnT, bnT, bnN, context);
       BnTo2B(&rOut->b, bnT, (UINT16)BN_num_bytes(bnT));
        // We have a value and we are going to exit the loop successfully
        OK = TRUE;
        break;
   }
   // Cleanup
   EC_POINT_free(pR);
   EC_GROUP_free(group);
   BN_CTX_end(context);
   BN_CTX_free(context);
   // If we have a value, finish the signature
   if(OK)
       return EcDaa(rOut, sOut, curveId, dIn, NULL, &k);
   else
       return CRYPT_NO_RESULT;
}
#endif //%
#ifdef TPM_ALG_SM2 //%
#ifdef _SM2_SIGN_DEBUG //%
static int
cmp_bn2hex(
   BIGNUM              *bn,               // IN: big number value
   const char          *c                 // IN: character string number
   )
{
   int         result;
   BIGNUM      *bnC = BN_new();
   pAssert(bnC != NULL);
   BN_hex2bn(&bnC, c);
   result = BN_ucmp(bn, bnC);
   BN_free(bnC);
   return result;
}
static int
cmp_2B2hex(
   TPM2B               *a,                // IN: TPM2B number to compare
   const char          *c                 // IN: character string
   )
{
   int            result;
   int            sl = strlen(c);
   BIGNUM         *bnA;
   result = (a->size * 2) - sl;
   if(result != 0)
       return result;
   pAssert((bnA = BN_bin2bn(a->buffer, a->size, NULL)) != NULL);
   result = cmp_bn2hex(bnA, c);
   BN_free(bnA);
   return result;
}
static void
cpy_hexTo2B(
   TPM2B               *b,                // OUT: receives value
   const char          *c                 // IN: source string
   )
{
   BIGNUM      *bnB = BN_new();
   pAssert((strlen(c) & 1) == 0);         // must have an even number of digits
   b->size = strlen(c) / 2;
   BN_hex2bn(&bnB, c);
   pAssert(bnB != NULL);
   BnTo2B(b, bnB, b->size);
   BN_free(bnB);
}
#endif //% _SM2_SIGN_DEBUG
//
//
//        SignSM2()
//
//       This function signs a digest using the method defined in SM2 Part 2. The method in the standard will add
//       a header to the message to be signed that is a hash of the values that define the key. This then hashed
//       with the message to produce a digest (e) that is signed. This function signs e.
//
//
//
//
//       Return Value                      Meaning
//
//       CRYPT_SUCCESS                     sign worked
//
static CRYPT_RESULT
SignSM2(
   TPM2B_ECC_PARAMETER            *rOut,                 //   OUT: r component of the signature
   TPM2B_ECC_PARAMETER            *sOut,                 //   OUT: s component of the signature
   TPM_ECC_CURVE                   curveId,              //   IN: the curve used in signing
   TPM2B_ECC_PARAMETER            *dIn,                  //   IN: the private key
   TPM2B                          *digest                //   IN: the digest to sign
   )
{
   BIGNUM                         *bnR;
   BIGNUM                         *bnS;
   BIGNUM                         *bnN;
   BIGNUM                         *bnK;
   BIGNUM                         *bnX1;
   BIGNUM                         *bnD;
   BIGNUM                         *bnT;        // temp
   BIGNUM                         *bnE;
   BN_CTX                  *context;
   TPM2B_ECC_PARAMETER      k;
   TPMS_ECC_POINT           p2Br;
   const ECC_CURVE_DATA    *curveData = GetCurveData(curveId);
   pAssert(curveData != NULL);
   context = BN_CTX_new();
   BN_CTX_start(context);
   bnK = BN_CTX_get(context);
   bnR = BN_CTX_get(context);
   bnS = BN_CTX_get(context);
   bnX1 = BN_CTX_get(context);
   bnN = BN_CTX_get(context);
   bnD = BN_CTX_get(context);
   bnT = BN_CTX_get(context);
   bnE = BN_CTX_get(context);
   if(bnE == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   BnFrom2B(bnE, digest);
   BnFrom2B(bnN, curveData->n);
   BnFrom2B(bnD, &dIn->b);
#ifdef _SM2_SIGN_DEBUG
BN_hex2bn(&bnE, "B524F552CD82B8B028476E005C377FB19A87E6FC682D48BB5D42E3D9B9EFFE76");
BN_hex2bn(&bnD, "128B2FA8BD433C6C068C8D803DFF79792A519A55171B1B650C23661D15897263");
#endif
// A3: Use random number generator to generate random number 1 <= k <= n-1;
// NOTE: Ax: numbers are from the SM2 standard
   k.t.size = curveData->n->size;
loop:
   {
       // Get a random number
       _cpri__GenerateRandom(k.t.size, k.t.buffer);
#ifdef _SM2_SIGN_DEBUG
BN_hex2bn(&bnK, "6CB28D99385C175C94F94E934817663FC176D925DD72B727260DBAAE1FB2F96F");
BnTo2B(&k.b,bnK, 32);
k.t.size = 32;
#endif
       //make sure that the number is 0 < k < n
       BnFrom2B(bnK, &k.b);
        if(      BN_ucmp(bnK, bnN) >= 0
              || BN_is_zero(bnK))
              goto loop;
// A4: Figure out the point of elliptic curve (x1, y1)=[k]G, and according
// to details specified in 4.2.7 in Part 1 of this document, transform the
// data type of x1 into an integer;
       if(    _cpri__EccPointMultiply(&p2Br, curveId, &k, NULL, NULL)
           == CRYPT_NO_RESULT)
            goto loop;
        BnFrom2B(bnX1, &p2Br.x.b);
// A5: Figure out r = (e + x1) mod n,
       if(!BN_mod_add(bnR, bnE, bnX1, bnN, context))
           FAIL(FATAL_ERROR_INTERNAL);
#ifdef _SM2_SIGN_DEBUG
pAssert(cmp_bn2hex(bnR,
               "40F1EC59F793D9F49E09DCEF49130D4194F79FB1EED2CAA55BACDB49C4E755D1")
       == 0);
#endif
           // if r=0 or r+k=n, return to A3;
         if(!BN_add(bnT, bnK, bnR))
            FAIL(FATAL_ERROR_INTERNAL);
        if(BN_is_zero(bnR) || BN_ucmp(bnT, bnN) == 0)
            goto loop;
// A6: Figure out s = ((1 + dA)^-1 (k - r dA)) mod n, if s=0, return to A3;
       // compute t = (1+d)-1
       BN_copy(bnT, bnD);
       if(     !BN_add_word(bnT, 1)
           || !BN_mod_inverse(bnT, bnT, bnN, context) // (1 + dA)^-1 mod n
           )
             FAIL(FATAL_ERROR_INTERNAL);
#ifdef _SM2_SIGN_DEBUG
pAssert(cmp_bn2hex(bnT,
                 "79BFCF3052C80DA7B939E0C6914A18CBB2D96D8555256E83122743A7D4F5F956")
       == 0);
#endif
       // compute s = t * (k - r * dA) mod n
       if(     !BN_mod_mul(bnS, bnD, bnR, bnN, context) // (r * dA) mod n
           || !BN_mod_sub(bnS, bnK, bnS, bnN, context) // (k - (r * dA) mod n
           || !BN_mod_mul(bnS, bnT, bnS, bnN, context))// t * (k - (r * dA) mod n
           FAIL(FATAL_ERROR_INTERNAL);
#ifdef _SM2_SIGN_DEBUG
pAssert(cmp_bn2hex(bnS,
                 "6FC6DAC32C5D5CF10C77DFB20F7C2EB667A457872FB09EC56327A67EC7DEEBE7")
       == 0);
#endif
        if(BN_is_zero(bnS))
            goto loop;
   }
// A7: According to details specified in 4.2.1 in Part 1 of this document, transform
// the data type of r, s into bit strings, signature of message M is (r, s).
   BnTo2B(&rOut->b, bnR, curveData->n->size);
   BnTo2B(&sOut->b, bnS, curveData->n->size);
#ifdef _SM2_SIGN_DEBUG
pAssert(cmp_2B2hex(&rOut->b,
               "40F1EC59F793D9F49E09DCEF49130D4194F79FB1EED2CAA55BACDB49C4E755D1")
       == 0);
pAssert(cmp_2B2hex(&sOut->b,
                  "6FC6DAC32C5D5CF10C77DFB20F7C2EB667A457872FB09EC56327A67EC7DEEBE7")
        == 0);
#endif
   BN_CTX_end(context);
   BN_CTX_free(context);
   return CRYPT_SUCCESS;
}
#endif //% TPM_ALG_SM2
//
//
//        _cpri__SignEcc()
//
//       This function is the dispatch function for the various ECC-based signing schemes.
//
//       Return Value                      Meaning
//
//       CRYPT_SCHEME                      scheme is not supported
//
LIB_EXPORT CRYPT_RESULT
_cpri__SignEcc(
   TPM2B_ECC_PARAMETER            *rOut,              //   OUT: r component of the signature
   TPM2B_ECC_PARAMETER            *sOut,              //   OUT: s component of the signature
   TPM_ALG_ID                      scheme,            //   IN: the scheme selector
   TPM_ALG_ID                      hashAlg,           //   IN: the hash algorithm if need
   TPM_ECC_CURVE                   curveId,           //   IN: the curve used in the signature
                                                      //       process
   TPM2B_ECC_PARAMETER            *dIn,               //   IN: the private key
   TPM2B                          *digest,            //   IN: the digest to sign
   TPM2B_ECC_PARAMETER            *kIn                //   IN: k for input
   )
{
   switch (scheme)
   {
       case TPM_ALG_ECDSA:
           // SignEcdsa always works
           return SignEcdsa(rOut, sOut, curveId, dIn, digest);
           break;
#ifdef TPM_ALG_ECDAA
       case TPM_ALG_ECDAA:
           if(rOut != NULL)
                rOut->b.size = 0;
           return EcDaa(rOut, sOut, curveId, dIn, digest, kIn);
           break;
#endif
#ifdef TPM_ALG_ECSCHNORR
       case TPM_ALG_ECSCHNORR:
           return SchnorrEcc(rOut, sOut, hashAlg, curveId, dIn, digest, kIn);
           break;
#endif
#ifdef TPM_ALG_SM2
       case TPM_ALG_SM2:
           return SignSM2(rOut, sOut, curveId, dIn, digest);
           break;
#endif
       default:
           return CRYPT_SCHEME;
   }
}
#ifdef TPM_ALG_ECDSA //%
//
//
//        ValidateSignatureEcdsa()
//
//       This function validates an ECDSA signature. rIn and sIn shoudl have been checked to make sure that
//       they are not zero.
//
//       Return Value                  Meaning
//
//       CRYPT_SUCCESS                 signature valid
//       CRYPT_FAIL                    signature not valid
//
static CRYPT_RESULT
ValidateSignatureEcdsa(
   TPM2B_ECC_PARAMETER        *rIn,                //   IN: r component of the signature
   TPM2B_ECC_PARAMETER        *sIn,                //   IN: s component of the signature
   TPM_ECC_CURVE               curveId,            //   IN: the curve used in the signature
                                                   //       process
   TPMS_ECC_POINT             *Qin,                //   IN: the public point of the key
   TPM2B                      *digest              //   IN: the digest that was signed
   )
{
   TPM2B_ECC_PARAMETER         U1;
   TPM2B_ECC_PARAMETER         U2;
   TPMS_ECC_POINT              R;
   const TPM2B                *n;
   BN_CTX                     *context;
   EC_POINT                   *pQ = NULL;
   EC_GROUP                   *group = NULL;
   BIGNUM                     *bnU1;
   BIGNUM                     *bnU2;
   BIGNUM                     *bnR;
   BIGNUM                     *bnS;
   BIGNUM                     *bnW;
   BIGNUM                     *bnV;
   BIGNUM                     *bnN;
   BIGNUM                     *bnE;
   BIGNUM                     *bnQx;
   BIGNUM                     *bnQy;
   CRYPT_RESULT                retVal = CRYPT_FAIL;
   int                         t;
   const ECC_CURVE_DATA       *curveData = GetCurveData(curveId);
   // The curve selector should have been filtered by the unmarshaling process
   pAssert (curveData != NULL);
   n = curveData->n;
// 1. If r and s are not both integers in the interval [1, n - 1], output
//    INVALID.
// rIn and sIn are known to be greater than zero (was checked by the caller).
   if(     _math__uComp(rIn->t.size, rIn->t.buffer, n->size, n->buffer) >= 0
       || _math__uComp(sIn->t.size, sIn->t.buffer, n->size, n->buffer) >= 0
     )
      return CRYPT_FAIL;
   context = BN_CTX_new();
   if(context == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   BN_CTX_start(context);
   bnR = BN_CTX_get(context);
   bnS = BN_CTX_get(context);
   bnN = BN_CTX_get(context);
   bnE = BN_CTX_get(context);
   bnV = BN_CTX_get(context);
   bnW = BN_CTX_get(context);
   bnQx = BN_CTX_get(context);
   bnQy = BN_CTX_get(context);
   bnU1 = BN_CTX_get(context);
   bnU2 = BN_CTX_get(context);
   // Assume the size variables do not overflow, which should not happen in
   // the contexts that this function will be called.
   assert2Bsize(Qin->x.t);
   assert2Bsize(rIn->t);
   assert2Bsize(sIn->t);
   // BN_CTX_get() is sticky so only need to check the last value to know that
   // all worked.
   if(   bnU2 == NULL
        // initialize the group parameters
       || (group = EccCurveInit(curveId, context)) == NULL
       // allocate a local point
       || (pQ = EC_POINT_new(group)) == NULL
       //   use the public key values (QxIn and QyIn) to initialize Q
       ||   BN_bin2bn(Qin->x.t.buffer, Qin->x.t.size, bnQx) == NULL
       ||   BN_bin2bn(Qin->x.t.buffer, Qin->x.t.size, bnQy) == NULL
       ||   !EC_POINT_set_affine_coordinates_GFp(group, pQ, bnQx, bnQy, context)
       // convert the signature values
       || BN_bin2bn(rIn->t.buffer, rIn->t.size, bnR) == NULL
       || BN_bin2bn(sIn->t.buffer, sIn->t.size, bnS) == NULL
       // convert the curve order
       || BN_bin2bn(curveData->n->buffer, curveData->n->size, bnN) == NULL)
        FAIL(FATAL_ERROR_INTERNAL);
// 2. Use the selected hash function to compute H0 = Hash(M0).
   // This is an input parameter
// 3. Convert the bit string H0 to an integer e as described in Appendix B.2.
   t = (digest->size > rIn->t.size) ? rIn->t.size : digest->size;
   if(BN_bin2bn(digest->buffer, t, bnE) == NULL)
       FAIL(FATAL_ERROR_INTERNAL);
// 4. Compute w = (s')^-1 mod n, using the routine in Appendix B.1.
   if (BN_mod_inverse(bnW, bnS, bnN, context) == NULL)
       FAIL(FATAL_ERROR_INTERNAL);
// 5. Compute u1 = (e' *   w) mod n, and compute u2 = (r' *     w) mod n.
   if(   !BN_mod_mul(bnU1, bnE, bnW, bnN, context)
      || !BN_mod_mul(bnU2, bnR, bnW, bnN, context))
       FAIL(FATAL_ERROR_INTERNAL);
   BnTo2B(&U1.b, bnU1, (INT16) BN_num_bytes(bnU1));
   BnTo2B(&U2.b, bnU2, (INT16) BN_num_bytes(bnU2));
// 6. Compute the elliptic curve point R = (xR, yR) = u1G+u2Q, using EC
//    scalar multiplication and EC addition (see [Routines]). If R is equal to
//    the point at infinity O, output INVALID.
   if(_cpri__EccPointMultiply(&R, curveId, &U1, Qin, &U2) == CRYPT_SUCCESS)
   {
       // 7. Compute v = Rx mod n.
       if(    BN_bin2bn(R.x.t.buffer, R.x.t.size, bnV) == NULL
           || !BN_mod(bnV, bnV, bnN, context))
            FAIL(FATAL_ERROR_INTERNAL);
   // 8. Compare v and r0. If v = r0, output VALID; otherwise, output INVALID
       if(BN_cmp(bnV, bnR) == 0)
           retVal = CRYPT_SUCCESS;
   }
   if(pQ != NULL) EC_POINT_free(pQ);
   if(group != NULL) EC_GROUP_free(group);
   BN_CTX_end(context);
   BN_CTX_free(context);
   return retVal;
}
#endif      //% TPM_ALG_ECDSA
#ifdef TPM_ALG_ECSCHNORR //%
//
//
//        ValidateSignatureEcSchnorr()
//
//       This function is used to validate an EC Schnorr signature. rIn and sIn are required to be greater than
//       zero. This is checked in _cpri__ValidateSignatureEcc().
//
//       Return Value                   Meaning
//
//       CRYPT_SUCCESS                  signature valid
//       CRYPT_FAIL                     signature not valid
//       CRYPT_SCHEME                   hashAlg is not supported
//
static CRYPT_RESULT
ValidateSignatureEcSchnorr(
   TPM2B_ECC_PARAMETER         *rIn,                //   IN: r component of the signature
   TPM2B_ECC_PARAMETER         *sIn,                //   IN: s component of the signature
   TPM_ALG_ID                   hashAlg,            //   IN: hash algorithm of the signature
   TPM_ECC_CURVE                curveId,            //   IN: the curve used in the signature
                                                    //       process
   TPMS_ECC_POINT              *Qin,                //   IN: the public point of the key
   TPM2B                       *digest              //   IN: the digest that was signed
   )
{
   TPMS_ECC_POINT               pE;
   const TPM2B                 *n;
   CPRI_HASH_STATE              hashState;
   TPM2B_DIGEST                 rPrime;
   TPM2B_ECC_PARAMETER          minusR;
   UINT16                       digestSize = _cpri__GetDigestSize(hashAlg);
   const ECC_CURVE_DATA        *curveData = GetCurveData(curveId);
   // The curve parameter should have been filtered by unmarshaling code
   pAssert(curveData != NULL);
   if(digestSize == 0)
       return CRYPT_SCHEME;
   // Input parameter validation
   pAssert(rIn != NULL && sIn != NULL && Qin != NULL && digest != NULL);
   n = curveData->n;
   // if sIn or rIn are not between 1 and N-1, signature check fails
   // sIn and rIn were verified to be non-zero by the caller
   if(   _math__uComp(sIn->b.size, sIn->b.buffer, n->size, n->buffer) >= 0
      || _math__uComp(rIn->b.size, rIn->b.buffer, n->size, n->buffer) >= 0
     )
       return CRYPT_FAIL;
   //E = [s]InG - [r]InQ
   _math__sub(n->size, n->buffer,
              rIn->t.size, rIn->t.buffer,
              &minusR.t.size, minusR.t.buffer);
   if(_cpri__EccPointMultiply(&pE, curveId, sIn, Qin, &minusR) != CRYPT_SUCCESS)
       return CRYPT_FAIL;
   // Ex = Ex mod N
   if(Mod2B(&pE.x.b, n) != CRYPT_SUCCESS)
       FAIL(FATAL_ERROR_INTERNAL);
   _math__Normalize2B(&pE.x.b);
   // rPrime = h(digest || pE.x) mod n;
   _cpri__StartHash(hashAlg, FALSE, &hashState);
   _cpri__UpdateHash(&hashState, digest->size, digest->buffer);
   _cpri__UpdateHash(&hashState, pE.x.t.size, pE.x.t.buffer);
   if(_cpri__CompleteHash(&hashState, digestSize, rPrime.t.buffer) != digestSize)
       FAIL(FATAL_ERROR_INTERNAL);
   rPrime.t.size = digestSize;
   // rPrime = rPrime (mod n)
   if(Mod2B(&rPrime.b, n) != CRYPT_SUCCESS)
       FAIL(FATAL_ERROR_INTERNAL);
   // if the values don't match, then the signature is bad
   if(_math__uComp(rIn->t.size, rIn->t.buffer,
                   rPrime.t.size, rPrime.t.buffer) != 0)
       return CRYPT_FAIL;
   else
       return CRYPT_SUCCESS;
}
#endif //% TPM_ALG_ECSCHNORR
#ifdef TPM_ALG_SM2 //%
//
//
//        ValidateSignatueSM2Dsa()
//
//       This function is used to validate an SM2 signature.
//
//       Return Value                      Meaning
//
//       CRYPT_SUCCESS                     signature valid
//       CRYPT_FAIL                        signature not valid
//
static CRYPT_RESULT
ValidateSignatureSM2Dsa(
   TPM2B_ECC_PARAMETER            *rIn,                //   IN: r component of the signature
   TPM2B_ECC_PARAMETER            *sIn,                //   IN: s component of the signature
   TPM_ECC_CURVE                   curveId,            //   IN: the curve used in the signature
                                                       //       process
   TPMS_ECC_POINT                 *Qin,                //   IN: the public point of the key
   TPM2B                          *digest              //   IN: the digest that was signed
   )
{
   BIGNUM                         *bnR;
   BIGNUM                         *bnRp;
   BIGNUM                         *bnT;
   BIGNUM                         *bnS;
   BIGNUM                         *bnE;
   BIGNUM                         *order;
   EC_POINT                       *pQ;
   BN_CTX                         *context;
   EC_GROUP                       *group = NULL;
   const ECC_CURVE_DATA           *curveData = GetCurveData(curveId);
   BOOL                            fail = FALSE;
//
   if((context = BN_CTX_new()) == NULL || curveData == NULL)
       FAIL(FATAL_ERROR_INTERNAL);
   bnR = BN_CTX_get(context);
   bnRp= BN_CTX_get(context);
   bnE = BN_CTX_get(context);
   bnT = BN_CTX_get(context);
   bnS = BN_CTX_get(context);
   order = BN_CTX_get(context);
   if(   order == NULL
      || (group = EccCurveInit(curveId, context)) == NULL)
       FAIL(FATAL_ERROR_INTERNAL);
#ifdef _SM2_SIGN_DEBUG
   cpy_hexTo2B(&Qin->x.b,
          "0AE4C7798AA0F119471BEE11825BE46202BB79E2A5844495E97C04FF4DF2548A");
   cpy_hexTo2B(&Qin->y.b,
          "7C0240F88F1CD4E16352A73C17B7F16F07353E53A176D684A9FE0C6BB798E857");
   cpy_hexTo2B(digest,
          "B524F552CD82B8B028476E005C377FB19A87E6FC682D48BB5D42E3D9B9EFFE76");
#endif
   pQ = EccInitPoint2B(group, Qin, context);
#ifdef _SM2_SIGN_DEBUG
   pAssert(EC_POINT_get_affine_coordinates_GFp(group, pQ, bnT, bnS, context));
   pAssert(cmp_bn2hex(bnT,
               "0AE4C7798AA0F119471BEE11825BE46202BB79E2A5844495E97C04FF4DF2548A")
           == 0);
   pAssert(cmp_bn2hex(bnS,
               "7C0240F88F1CD4E16352A73C17B7F16F07353E53A176D684A9FE0C6BB798E857")
           == 0);
#endif
   BnFrom2B(bnR, &rIn->b);
   BnFrom2B(bnS, &sIn->b);
   BnFrom2B(bnE, digest);
#ifdef _SM2_SIGN_DEBUG
// Make sure that the input signature is the test signature
pAssert(cmp_2B2hex(&rIn->b,
       "40F1EC59F793D9F49E09DCEF49130D4194F79FB1EED2CAA55BACDB49C4E755D1") == 0);
pAssert(cmp_2B2hex(&sIn->b,
       "6FC6DAC32C5D5CF10C77DFB20F7C2EB667A457872FB09EC56327A67EC7DEEBE7") == 0);
#endif
// a) verify that r and s are in the inclusive interval 1 to (n   1)
   if (!EC_GROUP_get_order(group, order, context)) goto Cleanup;
   fail = (BN_ucmp(bnR, order) >= 0);
   fail = (BN_ucmp(bnS, order) >= 0) || fail;
   if(fail)
   // There is no reason to continue. Since r and s are inputs from the caller,
   // they can know that the values are not in the proper range. So, exiting here
   // does not disclose any information.
       goto Cleanup;
// b) compute t := (r + s) mod n
   if(!BN_mod_add(bnT, bnR, bnS, order, context))
       FAIL(FATAL_ERROR_INTERNAL);
#ifdef _SM2_SIGN_DEBUG
   pAssert(cmp_bn2hex(bnT,
               "2B75F07ED7ECE7CCC1C8986B991F441AD324D6D619FE06DD63ED32E0C997C801")
           == 0);
#endif
// c) verify that t > 0
   if(BN_is_zero(bnT)) {
       fail = TRUE;
       // set to a value that should allow rest of the computations to run without
         // trouble
         BN_copy(bnT, bnS);
   }
// d) compute (x, y) := [s]G + [t]Q
   if(!EC_POINT_mul(group, pQ, bnS, pQ, bnT, context))
       FAIL(FATAL_ERROR_INTERNAL);
   // Get the x coordinate of the point
   if(!EC_POINT_get_affine_coordinates_GFp(group, pQ, bnT, NULL, context))
       FAIL(FATAL_ERROR_INTERNAL);
#ifdef _SM2_SIGN_DEBUG
   pAssert(cmp_bn2hex(bnT,
               "110FCDA57615705D5E7B9324AC4B856D23E6D9188B2AE47759514657CE25D112")
               == 0);
#endif
// e) compute r' := (e + x) mod n (the x coordinate is in bnT)
   if(!BN_mod_add(bnRp, bnE, bnT, order, context))
       FAIL(FATAL_ERROR_INTERNAL);
// f) verify that r' = r
   fail = BN_ucmp(bnR, bnRp) != 0 || fail;
Cleanup:
   if(pQ) EC_POINT_free(pQ);
   if(group) EC_GROUP_free(group);
   BN_CTX_end(context);
   BN_CTX_free(context);
    if(fail)
        return CRYPT_FAIL;
    else
        return CRYPT_SUCCESS;
}
#endif //% TPM_ALG_SM2
//
//
//        _cpri__ValidateSignatureEcc()
//
//       This function validates
//
//       Return Value                      Meaning
//
//       CRYPT_SUCCESS                     signature is valid
//       CRYPT_FAIL                        not a valid signature
//       CRYPT_SCHEME                      unsupported scheme
//
LIB_EXPORT CRYPT_RESULT
_cpri__ValidateSignatureEcc(
    TPM2B_ECC_PARAMETER           *rIn,                  //   IN: r component of the signature
    TPM2B_ECC_PARAMETER           *sIn,                  //   IN: s component of the signature
    TPM_ALG_ID                     scheme,               //   IN: the scheme selector
    TPM_ALG_ID                     hashAlg,              //   IN: the hash algorithm used (not used
                                                         //       in all schemes)
    TPM_ECC_CURVE                   curveId,             //   IN: the curve used in the signature
                                                         //       process
    TPMS_ECC_POINT                *Qin,                  //   IN: the public point of the key
    TPM2B                         *digest                //   IN: the digest that was signed
    )
{
    CRYPT_RESULT                  retVal;
    // return failure if either part of the signature is zero
    if(_math__Normalize2B(&rIn->b) == 0 || _math__Normalize2B(&sIn->b) == 0)
        return CRYPT_FAIL;
   switch (scheme)
   {
       case TPM_ALG_ECDSA:
           retVal = ValidateSignatureEcdsa(rIn, sIn, curveId, Qin, digest);
           break;
#ifdef   TPM_ALG_ECSCHNORR
        case TPM_ALG_ECSCHNORR:
            retVal = ValidateSignatureEcSchnorr(rIn, sIn, hashAlg, curveId, Qin,
                                              digest);
            break;
#endif
#ifdef TPM_ALG_SM2
       case TPM_ALG_SM2:
           retVal = ValidateSignatureSM2Dsa(rIn, sIn, curveId, Qin, digest);
#endif
       default:
           retVal = CRYPT_SCHEME;
           break;
   }
   return retVal;
}
#if CC_ZGen_2Phase == YES //%
#ifdef TPM_ALG_ECMQV
//
//
//        avf1()
//
//       This function does the associated value computation required by MQV key exchange. Process:
//       a) Convert xQ to an integer xqi using the convention specified in Appendix C.3.
//       b) Calculate xqm = xqi mod 2^ceil(f/2) (where f = ceil(log2(n)).
//       c) Calculate the associate value function avf(Q) = xqm + 2ceil(f / 2)
//
static BOOL
avf1(
   BIGNUM              *bnX,               // IN/OUT: the reduced value
   BIGNUM              *bnN                // IN: the order of the curve
   )
{
// compute f = 2^(ceil(ceil(log2(n)) / 2))
   int                      f = (BN_num_bits(bnN) + 1) / 2;
// x' = 2^f + (x mod 2^f)
   BN_mask_bits(bnX, f);   // This is mod 2*2^f but it doesn't matter because
                           // the next operation will SET the extra bit anyway
   BN_set_bit(bnX, f);
   return TRUE;
}
//
//
//        C_2_2_MQV()
//
//       This function performs the key exchange defined in SP800-56A 6.1.1.4 Full MQV, C(2, 2, ECC MQV).
//       CAUTION: Implementation of this function may require use of essential claims in patents not owned by
//       TCG members.
//       Points QsB() and QeB() are required to be on the curve of inQsA. The function will fail, possibly
//       catastrophically, if this is not the case.
//
//
//
//       Return Value                      Meaning
//
//       CRYPT_SUCCESS                     results is valid
//       CRYPT_NO_RESULT                   the value for dsA does not give a valid point on the curve
//
static CRYPT_RESULT
C_2_2_MQV(
   TPMS_ECC_POINT                  *outZ,                //   OUT: the computed point
   TPM_ECC_CURVE                    curveId,             //   IN: the curve for the computations
   TPM2B_ECC_PARAMETER             *dsA,                 //   IN: static private TPM key
   TPM2B_ECC_PARAMETER             *deA,                 //   IN: ephemeral private TPM key
   TPMS_ECC_POINT                  *QsB,                 //   IN: static public party B key
   TPMS_ECC_POINT                  *QeB                  //   IN: ephemeral public party B key
   )
{
   BN_CTX                          *context;
   EC_POINT                        *pQeA = NULL;
   EC_POINT                        *pQeB = NULL;
   EC_POINT                        *pQsB = NULL;
   EC_GROUP                        *group = NULL;
   BIGNUM                          *bnTa;
   BIGNUM                          *bnDeA;
   BIGNUM                          *bnDsA;
   BIGNUM                          *bnXeA;         // x coordinate of ephemeral party A key
   BIGNUM                          *bnH;
   BIGNUM                          *bnN;
   BIGNUM                          *bnXeB;
   const ECC_CURVE_DATA            *curveData = GetCurveData(curveId);
   CRYPT_RESULT                    retVal;
   pAssert(       curveData != NULL && outZ != NULL && dsA != NULL
           &&           deA != NULL && QsB != NULL && QeB != NULL);
   context = BN_CTX_new();
   if(context == NULL || curveData == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   BN_CTX_start(context);
   bnTa = BN_CTX_get(context);
   bnDeA = BN_CTX_get(context);
   bnDsA = BN_CTX_get(context);
   bnXeA = BN_CTX_get(context);
   bnH = BN_CTX_get(context);
   bnN = BN_CTX_get(context);
   bnXeB = BN_CTX_get(context);
   if(bnXeB == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
// Process:
// 1. implicitsigA = (de,A + avf(Qe,A)ds,A ) mod n.
// 2. P = h(implicitsigA)(Qe,B + avf(Qe,B)Qs,B).
// 3. If P = O, output an error indicator.
// 4. Z=xP, where xP is the x-coordinate of P.
   // Initialize group parameters and local values of input
   if((group = EccCurveInit(curveId, context)) == NULL)
       FAIL(FATAL_ERROR_INTERNAL);
   if((pQeA = EC_POINT_new(group)) == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   BnFrom2B(bnDeA, &deA->b);
   BnFrom2B(bnDsA, &dsA->b);
   BnFrom2B(bnH, curveData->h);
   BnFrom2B(bnN, curveData->n);
   BnFrom2B(bnXeB, &QeB->x.b);
   pQeB = EccInitPoint2B(group, QeB, context);
   pQsB = EccInitPoint2B(group, QsB, context);
   // Compute the public ephemeral key pQeA = [de,A]G
   if(    (retVal = PointMul(group, pQeA, bnDeA, NULL, NULL, context))
      != CRYPT_SUCCESS)
       goto Cleanup;
   if(EC_POINT_get_affine_coordinates_GFp(group, pQeA, bnXeA, NULL, context) != 1)
           FAIL(FATAL_ERROR_INTERNAL);
// 1. implicitsigA = (de,A + avf(Qe,A)ds,A ) mod n.
// tA := (ds,A + de,A avf(Xe,A)) mod n (3)
// Compute 'tA' = ('deA' + 'dsA' avf('XeA')) mod n
   // Ta = avf(XeA);
   BN_copy(bnTa, bnXeA);
   avf1(bnTa, bnN);
   if(// do Ta = ds,A * Ta mod n = dsA * avf(XeA) mod n
         !BN_mod_mul(bnTa, bnDsA, bnTa, bnN, context)
       // now Ta = deA + Ta mod n = deA + dsA * avf(XeA) mod n
       || !BN_mod_add(bnTa, bnDeA, bnTa, bnN, context)
      )
            FAIL(FATAL_ERROR_INTERNAL);
// 2. P = h(implicitsigA)(Qe,B + avf(Qe,B)Qs,B).
// Put this in because almost every case of h is == 1 so skip the call when
   // not necessary.
   if(!BN_is_one(bnH))
   {
       // Cofactor is not 1 so compute Ta := Ta * h mod n
       if(!BN_mul(bnTa, bnTa, bnH, context))
           FAIL(FATAL_ERROR_INTERNAL);
   }
   // Now that 'tA' is (h * 'tA' mod n)
   // 'outZ' = (tA)(Qe,B + avf(Qe,B)Qs,B).
   // first, compute XeB = avf(XeB)
   avf1(bnXeB, bnN);
   // QsB := [XeB]QsB
   if(     !EC_POINT_mul(group, pQsB, NULL, pQsB, bnXeB, context)
        // QeB := QsB + QeB
        || !EC_POINT_add(group, pQeB, pQeB, pQsB, context)
       )
        FAIL(FATAL_ERROR_INTERNAL);
   // QeB := [tA]QeB = [tA](QsB + [Xe,B]QeB) and check for at infinity
   if(PointMul(group, pQeB, NULL, pQeB, bnTa, context) == CRYPT_SUCCESS)
       // Convert BIGNUM E to TPM2B E
       Point2B(group, outZ, pQeB, (INT16)BN_num_bytes(bnN), context);
Cleanup:
   if(pQeA != NULL) EC_POINT_free(pQeA);
   if(pQeB != NULL) EC_POINT_free(pQeB);
   if(pQsB != NULL) EC_POINT_free(pQsB);
   if(group != NULL) EC_GROUP_free(group);
   BN_CTX_end(context);
   BN_CTX_free(context);
   return retVal;
}
#endif // TPM_ALG_ECMQV
#ifdef TPM_ALG_SM2 //%
//
//
//        avfSm2()
//
//       This function does the associated value computation required by SM2 key exchange. This is different
//       form the avf() in the international standards because it returns a value that is half the size of the value
//       returned by the standard avf. For example, if n is 15, Ws (w in the standard) is 2 but the W here is 1. This
//       means that an input value of 14 (1110b) would return a value of 110b with the standard but 10b with the
//       scheme in SM2.
//
static BOOL
avfSm2(
    BIGNUM              *bnX,                  // IN/OUT: the reduced value
    BIGNUM              *bnN                   // IN: the order of the curve
    )
{
// a) set w := ceil(ceil(log2(n)) / 2) - 1
   int                      w = ((BN_num_bits(bnN) + 1) / 2) - 1;
// b) set x' := 2^w + ( x & (2^w - 1))
// This is just like the avf for MQV where x' = 2^w + (x mod 2^w)
   BN_mask_bits(bnX, w);   // as wiht avf1, this is too big by a factor of 2 but
                           // it doesn't matter becasue we SET the extra bit anyway
   BN_set_bit(bnX, w);
   return TRUE;
}
//
//       SM2KeyExchange() This function performs the key exchange defined in SM2. The first step is to compute
//       tA = (dsA + deA avf(Xe,A)) mod n Then, compute the Z value from outZ = (h tA mod n) (QsA +
//       [avf(QeB().x)](QeB())). The function will compute the ephemeral public key from the ephemeral private
//       key. All points are required to be on the curve of inQsA. The function will fail catastrophically if this is not
//       the case
//
//       Return Value                      Meaning
//
//       CRYPT_SUCCESS                     results is valid
//       CRYPT_NO_RESULT                   the value for dsA does not give a valid point on the curve
//
static CRYPT_RESULT
SM2KeyExchange(
    TPMS_ECC_POINT                 *outZ,                //   OUT: the computed point
    TPM_ECC_CURVE                   curveId,             //   IN: the curve for the computations
    TPM2B_ECC_PARAMETER            *dsA,                 //   IN: static private TPM key
    TPM2B_ECC_PARAMETER            *deA,                 //   IN: ephemeral private TPM key
    TPMS_ECC_POINT                 *QsB,                 //   IN: static public party B key
    TPMS_ECC_POINT                 *QeB                  //   IN: ephemeral public party B key
    )
{
    BN_CTX                         *context;
    EC_POINT                       *pQeA = NULL;
    EC_POINT                       *pQeB = NULL;
    EC_POINT                       *pQsB = NULL;
    EC_GROUP                       *group = NULL;
    BIGNUM                         *bnTa;
    BIGNUM                         *bnDeA;
    BIGNUM                         *bnDsA;
    BIGNUM                         *bnXeA;               // x coordinate of ephemeral party A key
    BIGNUM                         *bnH;
    BIGNUM                         *bnN;
    BIGNUM                         *bnXeB;
//
   const ECC_CURVE_DATA      *curveData = GetCurveData(curveId);
   CRYPT_RESULT              retVal;
   pAssert(       curveData != NULL && outZ != NULL && dsA != NULL
           &&           deA != NULL && QsB != NULL && QeB != NULL);
   context = BN_CTX_new();
   if(context == NULL || curveData == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   BN_CTX_start(context);
   bnTa = BN_CTX_get(context);
   bnDeA = BN_CTX_get(context);
   bnDsA = BN_CTX_get(context);
   bnXeA = BN_CTX_get(context);
   bnH = BN_CTX_get(context);
   bnN = BN_CTX_get(context);
   bnXeB = BN_CTX_get(context);
   if(bnXeB == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   // Initialize group parameters and local values of input
   if((group = EccCurveInit(curveId, context)) == NULL)
       FAIL(FATAL_ERROR_INTERNAL);
   if((pQeA = EC_POINT_new(group)) == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   BnFrom2B(bnDeA, &deA->b);
   BnFrom2B(bnDsA, &dsA->b);
   BnFrom2B(bnH, curveData->h);
   BnFrom2B(bnN, curveData->n);
   BnFrom2B(bnXeB, &QeB->x.b);
   pQeB = EccInitPoint2B(group, QeB, context);
   pQsB = EccInitPoint2B(group, QsB, context);
   // Compute the public ephemeral key pQeA = [de,A]G
   if(    (retVal = PointMul(group, pQeA, bnDeA, NULL, NULL, context))
      != CRYPT_SUCCESS)
       goto Cleanup;
   if(EC_POINT_get_affine_coordinates_GFp(group, pQeA, bnXeA, NULL, context) != 1)
           FAIL(FATAL_ERROR_INTERNAL);
// tA := (ds,A + de,A avf(Xe,A)) mod n (3)
// Compute 'tA' = ('dsA' + 'deA' avf('XeA')) mod n
   // Ta = avf(XeA);
   BN_copy(bnTa, bnXeA);
   avfSm2(bnTa, bnN);
   if(// do Ta = de,A * Ta mod n = deA * avf(XeA) mod n
         !BN_mod_mul(bnTa, bnDeA, bnTa, bnN, context)
       // now Ta = dsA + Ta mod n = dsA + deA * avf(XeA) mod n
       || !BN_mod_add(bnTa, bnDsA, bnTa, bnN, context)
      )
            FAIL(FATAL_ERROR_INTERNAL);
// outZ ? [h tA mod n] (Qs,B + [avf(Xe,B)](Qe,B)) (4)
   // Put this in because almost every case of h is == 1 so skip the call when
   // not necessary.
   if(!BN_is_one(bnH))
   {
       // Cofactor is not 1 so compute Ta := Ta * h mod n
       if(!BN_mul(bnTa, bnTa, bnH, context))
           FAIL(FATAL_ERROR_INTERNAL);
   }
   // Now that 'tA' is (h * 'tA' mod n)
   // 'outZ' = ['tA'](QsB + [avf(QeB.x)](QeB)).
   // first, compute XeB = avf(XeB)
   avfSm2(bnXeB, bnN);
   // QeB := [XeB]QeB
   if(     !EC_POINT_mul(group, pQeB, NULL, pQeB, bnXeB, context)
         // QeB := QsB + QeB
         || !EC_POINT_add(group, pQeB, pQeB, pQsB, context)
        )
         FAIL(FATAL_ERROR_INTERNAL);
   // QeB := [tA]QeB = [tA](QsB + [Xe,B]QeB) and check for at infinity
   if(PointMul(group, pQeB, NULL, pQeB, bnTa, context) == CRYPT_SUCCESS)
       // Convert BIGNUM E to TPM2B E
       Point2B(group, outZ, pQeB, (INT16)BN_num_bytes(bnN), context);
Cleanup:
   if(pQeA != NULL) EC_POINT_free(pQeA);
   if(pQeB != NULL) EC_POINT_free(pQeB);
   if(pQsB != NULL) EC_POINT_free(pQsB);
   if(group != NULL) EC_GROUP_free(group);
   BN_CTX_end(context);
   BN_CTX_free(context);
   return retVal;
}
#endif       //% TPM_ALG_SM2
//
//
//        C_2_2_ECDH()
//
//       This function performs the two phase key exchange defined in SP800-56A, 6.1.1.2 Full Unified Model,
//       C(2, 2, ECC CDH).
//
static CRYPT_RESULT
C_2_2_ECDH(
   TPMS_ECC_POINT                *outZ1,         //   OUT: Zs
   TPMS_ECC_POINT                *outZ2,         //   OUT: Ze
   TPM_ECC_CURVE                  curveId,       //   IN: the curve for the computations
   TPM2B_ECC_PARAMETER           *dsA,           //   IN: static private TPM key
   TPM2B_ECC_PARAMETER           *deA,           //   IN: ephemeral private TPM key
   TPMS_ECC_POINT                *QsB,           //   IN: static public party B key
   TPMS_ECC_POINT                *QeB            //   IN: ephemeral public party B key
   )
{
   BIGNUM                        *order;
   BN_CTX                        *context;
   EC_POINT                      *pQ = NULL;
   EC_GROUP                      *group = NULL;
   BIGNUM                        *bnD;
   INT16                          size;
   const ECC_CURVE_DATA          *curveData = GetCurveData(curveId);
   context = BN_CTX_new();
   if(context == NULL || curveData == NULL)
       FAIL(FATAL_ERROR_ALLOCATION);
   BN_CTX_start(context);
   order = BN_CTX_get(context);
   if((bnD = BN_CTX_get(context)) == NULL)
       FAIL(FATAL_ERROR_INTERNAL);
   // Initialize group parameters and local values of input
   if((group = EccCurveInit(curveId, context)) == NULL)
       FAIL(FATAL_ERROR_INTERNAL);
   if (!EC_GROUP_get_order(group, order, context))
       FAIL(FATAL_ERROR_INTERNAL);
   size = (INT16)BN_num_bytes(order);
   // Get the static private key of A
   BnFrom2B(bnD, &dsA->b);
   // Initialize the static public point from B
   pQ = EccInitPoint2B(group, QsB, context);
   // Do the point multiply for the Zs value
   if(PointMul(group, pQ, NULL, pQ, bnD, context) != CRYPT_NO_RESULT)
       // Convert the Zs value
       Point2B(group, outZ1, pQ, size, context);
   // Get the ephemeral private key of A
   BnFrom2B(bnD, &deA->b);
   // Initalize the ephemeral public point from B
   PointFrom2B(group, pQ, QeB, context);
   // Do the point multiply for the Ze value
   if(PointMul(group, pQ, NULL, pQ, bnD, context) != CRYPT_NO_RESULT)
       // Convert the Ze value.
       Point2B(group, outZ2, pQ, size, context);
   if(pQ != NULL) EC_POINT_free(pQ);
   if(group != NULL) EC_GROUP_free(group);
   BN_CTX_end(context);
   BN_CTX_free(context);
   return CRYPT_SUCCESS;
}
//
//
//        _cpri__C_2_2_KeyExchange()
//
//       This function is the dispatch routine for the EC key exchange function that use two ephemeral and two
//       static keys.
//
//       Return Value                   Meaning
//
//       CRYPT_SCHEME                   scheme is not defined
//
LIB_EXPORT CRYPT_RESULT
_cpri__C_2_2_KeyExchange(
   TPMS_ECC_POINT              *outZ1,                //   OUT: a computed point
   TPMS_ECC_POINT              *outZ2,                //   OUT: and optional second point
   TPM_ECC_CURVE                curveId,              //   IN: the curve for the computations
   TPM_ALG_ID                   scheme,               //   IN: the key exchange scheme
   TPM2B_ECC_PARAMETER         *dsA,                  //   IN: static private TPM key
   TPM2B_ECC_PARAMETER         *deA,                  //   IN: ephemeral private TPM key
   TPMS_ECC_POINT              *QsB,                  //   IN: static public party B key
   TPMS_ECC_POINT              *QeB                   //   IN: ephemeral public party B key
   )
{
   pAssert(   outZ1 != NULL
           && dsA != NULL && deA != NULL
           && QsB != NULL && QeB != NULL);
   // Initalize the output points so that they are empty until one of the
   // functions decides otherwise
   outZ1->x.b.size = 0;
   outZ1->y.b.size = 0;
   if(outZ2 != NULL)
   {
       outZ2->x.b.size = 0;
        outZ2->y.b.size = 0;
   }
   switch (scheme)
   {
       case TPM_ALG_ECDH:
           return C_2_2_ECDH(outZ1, outZ2, curveId, dsA, deA, QsB, QeB);
           break;
#ifdef TPM_ALG_ECMQV
       case TPM_ALG_ECMQV:
           return C_2_2_MQV(outZ1, curveId, dsA, deA, QsB, QeB);
           break;
#endif
#ifdef TPM_ALG_SM2
       case TPM_ALG_SM2:
           return SM2KeyExchange(outZ1, curveId, dsA, deA, QsB, QeB);
           break;
#endif
       default:
           return CRYPT_SCHEME;
   }
}
#else       //%
//
//       Stub used when the 2-phase key exchange is not defined so that the linker has something to associate
//       with the value in the .def file.
//
LIB_EXPORT CRYPT_RESULT
_cpri__C_2_2_KeyExchange(
   void
   )
{
   return CRYPT_FAIL;
}
#endif //% CC_ZGen_2Phase
#endif // TPM_ALG_ECC