1 /* 2 * Copyright The Mbed TLS Contributors 3 * SPDX-License-Identifier: Apache-2.0 4 * 5 * Licensed under the Apache License, Version 2.0 (the "License"); you may 6 * not use this file except in compliance with the License. 7 * You may obtain a copy of the License at 8 * 9 * http://www.apache.org/licenses/LICENSE-2.0 10 * 11 * Unless required by applicable law or agreed to in writing, software 12 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 13 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 * See the License for the specific language governing permissions and 15 * limitations under the License. 16 * Copyright (c) 2023 Telink Semiconductor (Shanghai) Co., Ltd. ("TELINK") 17 */ 18 19 /* 20 * References: 21 * 22 * [1] BERNSTEIN, Daniel J. Curve25519: new Diffie-Hellman speed records. 23 * <http://cr.yp.to/ecdh/curve25519-20060209.pdf> 24 * 25 * [2] CORON, Jean-S'ebastien. Resistance against differential power analysis 26 * for elliptic curve cryptosystems. In : Cryptographic Hardware and 27 * Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302. 28 * <http://link.springer.com/chapter/10.1007/3-540-48059-5_25> 29 * 30 * [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to 31 * render ECC resistant against Side Channel Attacks. IACR Cryptology 32 * ePrint Archive, 2004, vol. 2004, p. 342. 33 * <http://eprint.iacr.org/2004/342.pdf> 34 * 35 * [4] Certicom Research. SEC 2: Recommended Elliptic Curve Domain Parameters. 36 * <http://www.secg.org/sec2-v2.pdf> 37 * 38 * [5] HANKERSON, Darrel, MENEZES, Alfred J., VANSTONE, Scott. Guide to Elliptic 39 * Curve Cryptography. 40 * 41 * [6] Digital Signature Standard (DSS), FIPS 186-4. 42 * <http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf> 43 * 44 * [7] Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer 45 * Security (TLS), RFC 4492. 46 * <https://tools.ietf.org/search/rfc4492> 47 * 48 * [8] <http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html> 49 * 50 * [9] COHEN, Henri. A Course in Computational Algebraic Number Theory. 51 * Springer Science & Business Media, 1 Aug 2000 52 */ 53 54 #ifndef MBEDTLS_ECP_INTERNAL_H 55 #define MBEDTLS_ECP_INTERNAL_H 56 57 #include "mbedtls/build_info.h" 58 59 #if defined(MBEDTLS_ECP_INTERNAL_ALT) 60 61 /** 62 * \brief Indicate if the Elliptic Curve Point module extension can 63 * handle the group. 64 * 65 * \param grp The pointer to the elliptic curve group that will be the 66 * basis of the cryptographic computations. 67 * 68 * \return Non-zero if successful. 69 */ 70 unsigned char mbedtls_internal_ecp_grp_capable(const mbedtls_ecp_group *grp); 71 72 /** 73 * \brief Initialise the Elliptic Curve Point module extension. 74 * 75 * If mbedtls_internal_ecp_grp_capable returns true for a 76 * group, this function has to be able to initialise the 77 * module for it. 78 * 79 * This module can be a driver to a crypto hardware 80 * accelerator, for which this could be an initialise function. 81 * 82 * \param grp The pointer to the group the module needs to be 83 * initialised for. 84 * 85 * \return 0 if successful. 86 */ 87 int mbedtls_internal_ecp_init(const mbedtls_ecp_group *grp); 88 89 /** 90 * \brief Frees and deallocates the Elliptic Curve Point module 91 * extension. 92 * 93 * \param grp The pointer to the group the module was initialised for. 94 */ 95 void mbedtls_internal_ecp_free(const mbedtls_ecp_group *grp); 96 97 #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) 98 99 #if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT) 100 /** 101 * \brief Randomize jacobian coordinates: 102 * (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l. 103 * 104 * \param grp Pointer to the group representing the curve. 105 * 106 * \param pt The point on the curve to be randomised, given with Jacobian 107 * coordinates. 108 * 109 * \param f_rng A function pointer to the random number generator. 110 * 111 * \param p_rng A pointer to the random number generator state. 112 * 113 * \return 0 if successful. 114 */ 115 int mbedtls_internal_ecp_randomize_jac( 116 const mbedtls_ecp_group *grp, mbedtls_ecp_point *pt, int (*f_rng)(void *, unsigned char *, size_t), void *p_rng); 117 #endif 118 119 #if defined(MBEDTLS_ECP_ADD_MIXED_ALT) 120 /** 121 * \brief Addition: R = P + Q, mixed affine-Jacobian coordinates. 122 * 123 * The coordinates of Q must be normalized (= affine), 124 * but those of P don't need to. R is not normalized. 125 * 126 * This function is used only as a subrutine of 127 * ecp_mul_comb(). 128 * 129 * Special cases: (1) P or Q is zero, (2) R is zero, 130 * (3) P == Q. 131 * None of these cases can happen as intermediate step in 132 * ecp_mul_comb(): 133 * - at each step, P, Q and R are multiples of the base 134 * point, the factor being less than its order, so none of 135 * them is zero; 136 * - Q is an odd multiple of the base point, P an even 137 * multiple, due to the choice of precomputed points in the 138 * modified comb method. 139 * So branches for these cases do not leak secret information. 140 * 141 * We accept Q->Z being unset (saving memory in tables) as 142 * meaning 1. 143 * 144 * Cost in field operations if done by [5] 3.22: 145 * 1A := 8M + 3S 146 * 147 * \param grp Pointer to the group representing the curve. 148 * 149 * \param R Pointer to a point structure to hold the result. 150 * 151 * \param P Pointer to the first summand, given with Jacobian 152 * coordinates 153 * 154 * \param Q Pointer to the second summand, given with affine 155 * coordinates. 156 * 157 * \return 0 if successful. 158 */ 159 int mbedtls_internal_ecp_add_mixed( 160 const mbedtls_ecp_group *grp, mbedtls_ecp_point *R, const mbedtls_ecp_point *P, const mbedtls_ecp_point *Q); 161 #endif 162 163 /** 164 * \brief Point doubling R = 2 P, Jacobian coordinates. 165 * 166 * Cost: 1D := 3M + 4S (A == 0) 167 * 4M + 4S (A == -3) 168 * 3M + 6S + 1a otherwise 169 * when the implementation is based on the "dbl-1998-cmo-2" 170 * doubling formulas in [8] and standard optimizations are 171 * applied when curve parameter A is one of { 0, -3 }. 172 * 173 * \param grp Pointer to the group representing the curve. 174 * 175 * \param R Pointer to a point structure to hold the result. 176 * 177 * \param P Pointer to the point that has to be doubled, given with 178 * Jacobian coordinates. 179 * 180 * \return 0 if successful. 181 */ 182 #if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) 183 int mbedtls_internal_ecp_double_jac(const mbedtls_ecp_group *grp, mbedtls_ecp_point *R, const mbedtls_ecp_point *P); 184 #endif 185 186 /** 187 * \brief Normalize jacobian coordinates of an array of (pointers to) 188 * points. 189 * 190 * Using Montgomery's trick to perform only one inversion mod P 191 * the cost is: 192 * 1N(t) := 1I + (6t - 3)M + 1S 193 * (See for example Algorithm 10.3.4. in [9]) 194 * 195 * This function is used only as a subrutine of 196 * ecp_mul_comb(). 197 * 198 * Warning: fails (returning an error) if one of the points is 199 * zero! 200 * This should never happen, see choice of w in ecp_mul_comb(). 201 * 202 * \param grp Pointer to the group representing the curve. 203 * 204 * \param T Array of pointers to the points to normalise. 205 * 206 * \param t_len Number of elements in the array. 207 * 208 * \return 0 if successful, 209 * an error if one of the points is zero. 210 */ 211 #if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT) 212 int mbedtls_internal_ecp_normalize_jac_many(const mbedtls_ecp_group *grp, mbedtls_ecp_point *T[], size_t t_len); 213 #endif 214 215 /** 216 * \brief Normalize jacobian coordinates so that Z == 0 || Z == 1. 217 * 218 * Cost in field operations if done by [5] 3.2.1: 219 * 1N := 1I + 3M + 1S 220 * 221 * \param grp Pointer to the group representing the curve. 222 * 223 * \param pt pointer to the point to be normalised. This is an 224 * input/output parameter. 225 * 226 * \return 0 if successful. 227 */ 228 #if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT) 229 int mbedtls_internal_ecp_normalize_jac(const mbedtls_ecp_group *grp, mbedtls_ecp_point *pt); 230 #endif 231 232 #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ 233 234 #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) 235 236 #if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) 237 int mbedtls_internal_ecp_double_add_mxz(const mbedtls_ecp_group *grp, mbedtls_ecp_point *R, mbedtls_ecp_point *S, 238 const mbedtls_ecp_point *P, const mbedtls_ecp_point *Q, const mbedtls_mpi *d); 239 #endif 240 241 /** 242 * \brief Randomize projective x/z coordinates: 243 * (X, Z) -> (l X, l Z) for random l 244 * 245 * \param grp pointer to the group representing the curve 246 * 247 * \param P the point on the curve to be randomised given with 248 * projective coordinates. This is an input/output parameter. 249 * 250 * \param f_rng a function pointer to the random number generator 251 * 252 * \param p_rng a pointer to the random number generator state 253 * 254 * \return 0 if successful 255 */ 256 #if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT) 257 int mbedtls_internal_ecp_randomize_mxz( 258 const mbedtls_ecp_group *grp, mbedtls_ecp_point *P, int (*f_rng)(void *, unsigned char *, size_t), void *p_rng); 259 #endif 260 261 /** 262 * \brief Normalize Montgomery x/z coordinates: X = X/Z, Z = 1. 263 * 264 * \param grp pointer to the group representing the curve 265 * 266 * \param P pointer to the point to be normalised. This is an 267 * input/output parameter. 268 * 269 * \return 0 if successful 270 */ 271 #if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT) 272 int mbedtls_internal_ecp_normalize_mxz(const mbedtls_ecp_group *grp, mbedtls_ecp_point *P); 273 #endif 274 275 #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ 276 277 #endif /* MBEDTLS_ECP_INTERNAL_ALT */ 278 279 #endif /* ecp_internal_alt.h */ 280